From a219ba5ab23d6d0f52e87f005d1c88e562875e54 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Mon, 31 Mar 2003 21:08:23 +0000 Subject: Update NT_Security for 3.0 (This used to be commit 6cb01d215621af0cb6ecd3e503ca0182f448c4a2) --- docs/docbook/projdoc/NT_Security.sgml | 43 ++++++++++++----------------------- docs/docs-status | 4 +--- 2 files changed, 15 insertions(+), 32 deletions(-) diff --git a/docs/docbook/projdoc/NT_Security.sgml b/docs/docbook/projdoc/NT_Security.sgml index 2843331519..a68a820b76 100644 --- a/docs/docbook/projdoc/NT_Security.sgml +++ b/docs/docbook/projdoc/NT_Security.sgml @@ -22,10 +22,8 @@ Viewing and changing UNIX permissions using the NT security dialogs - - New in the Samba 2.0.4 release is the ability for Windows - NT clients to use their native security settings dialog box to - view and modify the underlying UNIX permissions. + Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions. Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and @@ -36,13 +34,12 @@ How to view file security on a Samba share - From an NT 4.0 client, single-click with the right + From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click on the Properties entry at the bottom of - the menu. This brings up the normal file properties dialog - box, but with Samba 2.0.4 this will have a new tab along the top - marked Security. Click on this tab and you + the menu. This brings up the file properties dialog + box. Click on the tab Security and you will see three buttons, Permissions, Auditing, and Ownership. The Auditing button will cause either @@ -89,7 +86,7 @@ There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected - to a Samba 2.0.4 server as root to change the ownership of + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written by Jeremy Allison of @@ -193,7 +190,7 @@ message. The first thing to note is that the "Add" - button will not return a list of users in Samba 2.0.4 (it will give + button will not return a list of users in Samba (it will give an error message of "The remote procedure call failed and did not execute"). This means that you can only manipulate the current user/group/world permissions listed in @@ -233,8 +230,9 @@ Interaction with the standard Samba create mask parameters - Note that with Samba 2.0.5 there are four new parameters - to control this interaction. These are : + There are four parameters + to control interaction with the standard Samba create mask parameters. + These are : security mask force security mode @@ -256,9 +254,8 @@ If not set explicitly this parameter is set to the same value as the create mask - parameter to provide compatibility with Samba 2.0.4 - where this permission change facility was introduced. To allow a user to - modify all the user/group/world permissions on a file, set this parameter + parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777. Next Samba checks the changed permissions for a file against @@ -273,8 +270,7 @@ If not set explicitly this parameter is set to the same value as the force - create mode parameter to provide compatibility - with Samba 2.0.4 where the permission change facility was introduced. + create mode parameter. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000. @@ -293,9 +289,7 @@ by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter to provide - compatibility with Samba 2.0.4 where the permission change facility - was introduced. + the force directory mode parameter. In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users @@ -311,15 +305,6 @@ force security mode = 0 directory security mask = 0777 force directory security mode = 0 - - As described, in Samba 2.0.4 the parameters : - - create mask - force create mode - directory mask - force directory mode - - were used instead of the parameters discussed here. diff --git a/docs/docs-status b/docs/docs-status index c1b17d0838..28b88f428f 100644 --- a/docs/docs-status +++ b/docs/docs-status @@ -11,7 +11,6 @@ docs/docbook/manpages/smb.conf.5.sgml - 'restrict anonymous' isn't documented pr docs/docbook/projdoc/DOMAIN_MEMBER.sgml - Needs update to 3.0 docs/docbook/projdoc/ADS-HOWTO.sgml - seems outdated (it says we require 'ads server' when in ads mode, though that's not true, according to the manpages...) docs/docbook/projdoc/Integrating-with-Windows.sgml - Should slowly go a way. Contains a little bit information about wins, a little bit about domain membership, a little about winbind, etc -docs/docbook/projdoc/NT_Security.sgml - probably outdated docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml docs/docbook/projdoc/Printing.sgml - Cups is not documented, smbprint, printing /to/ a windows server... - Kurt Pfeifle docs/docbook/projdoc/Samba-BDC-HOWTO.sgml - Needs update to 3.0 @@ -25,6 +24,7 @@ docs/textdocs/CUPS-PrintingInfo.txt - needs to be converted to sgml - Kurt Pfeif docs/textdocs/PROFILES.txt - needs to be converted to sgml docs/textdocs/README.jis - Seems to need updating - possibly obsoleted by a newer japanese howto? docs/textdocs/RoutedNetworks.txt - still valid, but shouldn't this go into Other_clients.sgml ? This text originally comes from microsoft, what about copyright? +docs/docbook/manpages/ntlm_auth.1.sgml - Is very basic at the moment, parameters need better descriptions These still need to be checked: docs/docbook/manpages/smbmnt.8.sgml @@ -38,9 +38,7 @@ docs/docbook/manpages/smbumount.8.sgml docs/docbook/manpages/testprns.1.sgml Stuff that needs to be documented: -ntlm_auth wrepld -editreg Windows NT 4.0 Style Trust Relationship Winbind in a samba controlled domain One Time Migration script from a Windows NT 4.0 PDC to a Samba PDC -- cgit From 5130e1468e2028613a9f5369237db25b091fd548 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Mon, 31 Mar 2003 21:42:19 +0000 Subject: More doc updates: - Move information about compiling with ADS support to appendix about compiling - Make DOMAIN_MEMBER NT4-domain only (because current ADS info was incomplete and becoming an ADS domain member is documented more properly in ADS-HOWTO) (This used to be commit efe3dd876ac61af0abc46539369860216eeca79b) --- docs/Samba-Developers-Guide.pdf | 4 +- docs/Samba-HOWTO-Collection.pdf | 10370 ++++++++++++++-------------- docs/docbook/projdoc/ADS-HOWTO.sgml | 76 +- docs/docbook/projdoc/Compiling.sgml | 58 + docs/docbook/projdoc/DOMAIN_MEMBER.sgml | 23 +- docs/docs-status | 3 +- docs/htmldocs/Samba-HOWTO-Collection.html | 1422 ++-- 7 files changed, 5951 insertions(+), 6005 deletions(-) diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index a65e7c44ea..e87b401c7b 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -2728,7 +2728,7 @@ xref 0000186776 00000 n 0000186871 00000 n trailer -<<006a374f74bbb42ca5a141f2cec42653>]>> +<<46ba5d3e7036cf10d354f2ef6c5f4150>]>> startxref 187413 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 449b529f39..137d634c8f 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -20,48 +20,48 @@ endobj 16 0 obj<]/Interpolate true/Filter/FlateDecode/Width 24/Height 24/BitsPerComponent 8/Length 223 >>stream xUQ0 58@4wo%wR+8C+N"]ׂ*W ,D1|Ši"%~0)܁1lN!31T4HԆ<<~Z>yn.H>LKb؎џ'4Y}-?f&tA{27L}On4KI" PBhïG]z$>.mcoendstream endobj -17 0 obj<>endobj -18 0 obj<>endobj -19 0 obj<>endobj -20 0 obj<>endobj -21 0 obj<>endobj -22 0 obj<>endobj -23 0 obj<>endobj -24 0 obj<>endobj -25 0 obj<>endobj -26 0 obj<>endobj -27 0 obj<>endobj -28 0 obj<>endobj -29 0 obj<>endobj -30 0 obj<>endobj -31 0 obj<>endobj -32 0 obj<>endobj -33 0 obj<>endobj -34 0 obj<>endobj -35 0 obj<>endobj -36 0 obj<>endobj -37 0 obj<>endobj -38 0 obj<>endobj -39 0 obj<>endobj -40 0 obj<>endobj -41 0 obj<>endobj -42 0 obj<>endobj -43 0 obj<>endobj -44 0 obj<>endobj -45 0 obj<>endobj -46 0 obj<>endobj -47 0 obj<>endobj -48 0 obj<>endobj -49 0 obj<>endobj -50 0 obj<>endobj -51 0 obj<>endobj -52 0 obj<>endobj -53 0 obj<>endobj -54 0 obj<>endobj -55 0 obj<>endobj -56 0 obj<>endobj -57 0 obj<>endobj -58 0 obj<>endobj +17 0 obj<>endobj +18 0 obj<>endobj +19 0 obj<>endobj +20 0 obj<>endobj +21 0 obj<>endobj +22 0 obj<>endobj +23 0 obj<>endobj +24 0 obj<>endobj +25 0 obj<>endobj +26 0 obj<>endobj +27 0 obj<>endobj +28 0 obj<>endobj +29 0 obj<>endobj +30 0 obj<>endobj +31 0 obj<>endobj +32 0 obj<>endobj +33 0 obj<>endobj +34 0 obj<>endobj +35 0 obj<>endobj +36 0 obj<>endobj +37 0 obj<>endobj +38 0 obj<>endobj +39 0 obj<>endobj +40 0 obj<>endobj +41 0 obj<>endobj +42 0 obj<>endobj +43 0 obj<>endobj +44 0 obj<>endobj +45 0 obj<>endobj +46 0 obj<>endobj +47 0 obj<>endobj +48 0 obj<>endobj +49 0 obj<>endobj +50 0 obj<>endobj +51 0 obj<>endobj +52 0 obj<>endobj +53 0 obj<>endobj +54 0 obj<>endobj +55 0 obj<>endobj +56 0 obj<>endobj +57 0 obj<>endobj +58 0 obj<>endobj 59 0 obj[17 0 R 18 0 R 19 0 R @@ -104,48 +104,48 @@ endobj 56 0 R 57 0 R 58 0 R]endobj -60 0 obj<>endobj -61 0 obj<>endobj -62 0 obj<>endobj -63 0 obj<>endobj -64 0 obj<>endobj -65 0 obj<>endobj -66 0 obj<>endobj -67 0 obj<>endobj -68 0 obj<>endobj -69 0 obj<>endobj -70 0 obj<>endobj -71 0 obj<>endobj -72 0 obj<>endobj -73 0 obj<>endobj -74 0 obj<>endobj -75 0 obj<>endobj -76 0 obj<>endobj -77 0 obj<>endobj -78 0 obj<>endobj -79 0 obj<>endobj -80 0 obj<>endobj -81 0 obj<>endobj -82 0 obj<>endobj -83 0 obj<>endobj -84 0 obj<>endobj -85 0 obj<>endobj -86 0 obj<>endobj -87 0 obj<>endobj -88 0 obj<>endobj -89 0 obj<>endobj -90 0 obj<>endobj -91 0 obj<>endobj -92 0 obj<>endobj -93 0 obj<>endobj -94 0 obj<>endobj -95 0 obj<>endobj -96 0 obj<>endobj -97 0 obj<>endobj -98 0 obj<>endobj -99 0 obj<>endobj -100 0 obj<>endobj -101 0 obj<>endobj +60 0 obj<>endobj +61 0 obj<>endobj +62 0 obj<>endobj +63 0 obj<>endobj +64 0 obj<>endobj +65 0 obj<>endobj +66 0 obj<>endobj +67 0 obj<>endobj +68 0 obj<>endobj +69 0 obj<>endobj +70 0 obj<>endobj +71 0 obj<>endobj +72 0 obj<>endobj +73 0 obj<>endobj +74 0 obj<>endobj +75 0 obj<>endobj +76 0 obj<>endobj +77 0 obj<>endobj +78 0 obj<>endobj +79 0 obj<>endobj +80 0 obj<>endobj +81 0 obj<>endobj +82 0 obj<>endobj +83 0 obj<>endobj +84 0 obj<>endobj +85 0 obj<>endobj +86 0 obj<>endobj +87 0 obj<>endobj +88 0 obj<>endobj +89 0 obj<>endobj +90 0 obj<>endobj +91 0 obj<>endobj +92 0 obj<>endobj +93 0 obj<>endobj +94 0 obj<>endobj +95 0 obj<>endobj +96 0 obj<>endobj +97 0 obj<>endobj +98 0 obj<>endobj +99 0 obj<>endobj +100 0 obj<>endobj +101 0 obj<>endobj 102 0 obj[60 0 R 61 0 R 62 0 R @@ -188,50 +188,49 @@ endobj 99 0 R 100 0 R 101 0 R]endobj -103 0 obj<>endobj -104 0 obj<>endobj -105 0 obj<>endobj -106 0 obj<>endobj -107 0 obj<>endobj -108 0 obj<>endobj -109 0 obj<>endobj -110 0 obj<>endobj -111 0 obj<>endobj -112 0 obj<>endobj -113 0 obj<>endobj -114 0 obj<>endobj -115 0 obj<>endobj -116 0 obj<>endobj -117 0 obj<>endobj -118 0 obj<>endobj -119 0 obj<>endobj -120 0 obj<>endobj -121 0 obj<>endobj -122 0 obj<>endobj -123 0 obj<>endobj -124 0 obj<>endobj -125 0 obj<>endobj -126 0 obj<>endobj -127 0 obj<>endobj -128 0 obj<>endobj -129 0 obj<>endobj -130 0 obj<>endobj -131 0 obj<>endobj -132 0 obj<>endobj -133 0 obj<>endobj -134 0 obj<>endobj -135 0 obj<>endobj -136 0 obj<>endobj -137 0 obj<>endobj -138 0 obj<>endobj -139 0 obj<>endobj -140 0 obj<>endobj -141 0 obj<>endobj -142 0 obj<>endobj -143 0 obj<>endobj -144 0 obj<>endobj -145 0 obj<>endobj -146 0 obj[103 0 R +103 0 obj<>endobj +104 0 obj<>endobj +105 0 obj<>endobj +106 0 obj<>endobj +107 0 obj<>endobj +108 0 obj<>endobj +109 0 obj<>endobj +110 0 obj<>endobj +111 0 obj<>endobj +112 0 obj<>endobj +113 0 obj<>endobj +114 0 obj<>endobj +115 0 obj<>endobj +116 0 obj<>endobj +117 0 obj<>endobj +118 0 obj<>endobj +119 0 obj<>endobj +120 0 obj<>endobj +121 0 obj<>endobj +122 0 obj<>endobj +123 0 obj<>endobj +124 0 obj<>endobj +125 0 obj<>endobj +126 0 obj<>endobj +127 0 obj<>endobj +128 0 obj<>endobj +129 0 obj<>endobj +130 0 obj<>endobj +131 0 obj<>endobj +132 0 obj<>endobj +133 0 obj<>endobj +134 0 obj<>endobj +135 0 obj<>endobj +136 0 obj<>endobj +137 0 obj<>endobj +138 0 obj<>endobj +139 0 obj<>endobj +140 0 obj<>endobj +141 0 obj<>endobj +142 0 obj<>endobj +143 0 obj<>endobj +144 0 obj<>endobj +145 0 obj[103 0 R 104 0 R 105 0 R 106 0 R @@ -272,51 +271,53 @@ endobj 141 0 R 142 0 R 143 0 R -144 0 R -145 0 R]endobj -147 0 obj<>endobj -148 0 obj<>endobj -149 0 obj<>endobj -150 0 obj<>endobj -151 0 obj<>endobj -152 0 obj<>endobj -153 0 obj<>endobj -154 0 obj<>endobj -155 0 obj<>endobj -156 0 obj<>endobj -157 0 obj<>endobj -158 0 obj<>endobj -159 0 obj<>endobj -160 0 obj<>endobj -161 0 obj<>endobj -162 0 obj<>endobj -163 0 obj<>endobj -164 0 obj<>endobj -165 0 obj<>endobj -166 0 obj<>endobj -167 0 obj<>endobj -168 0 obj<>endobj -169 0 obj<>endobj -170 0 obj<>endobj -171 0 obj<>endobj -172 0 obj<>endobj -173 0 obj<>endobj -174 0 obj<>endobj -175 0 obj<>endobj -176 0 obj<>endobj -177 0 obj<>endobj -178 0 obj<>endobj -179 0 obj<>endobj -180 0 obj<>endobj -181 0 obj<>endobj -182 0 obj<>endobj -183 0 obj<>endobj -184 0 obj<>endobj -185 0 obj<>endobj -186 0 obj<>endobj -187 0 obj<>endobj -188 0 obj<>endobj -189 0 obj[147 0 R +144 0 R]endobj +146 0 obj<>endobj +147 0 obj<>endobj +148 0 obj<>endobj +149 0 obj<>endobj +150 0 obj<>endobj +151 0 obj<>endobj +152 0 obj<>endobj +153 0 obj<>endobj +154 0 obj<>endobj +155 0 obj<>endobj +156 0 obj<>endobj +157 0 obj<>endobj +158 0 obj<>endobj +159 0 obj<>endobj +160 0 obj<>endobj +161 0 obj<>endobj +162 0 obj<>endobj +163 0 obj<>endobj +164 0 obj<>endobj +165 0 obj<>endobj +166 0 obj<>endobj +167 0 obj<>endobj +168 0 obj<>endobj +169 0 obj<>endobj +170 0 obj<>endobj +171 0 obj<>endobj +172 0 obj<>endobj +173 0 obj<>endobj +174 0 obj<>endobj +175 0 obj<>endobj +176 0 obj<>endobj +177 0 obj<>endobj +178 0 obj<>endobj +179 0 obj<>endobj +180 0 obj<>endobj +181 0 obj<>endobj +182 0 obj<>endobj +183 0 obj<>endobj +184 0 obj<>endobj +185 0 obj<>endobj +186 0 obj<>endobj +187 0 obj<>endobj +188 0 obj<>endobj +189 0 obj<>endobj +190 0 obj[146 0 R +147 0 R 148 0 R 149 0 R 150 0 R @@ -357,53 +358,53 @@ endobj 185 0 R 186 0 R 187 0 R -188 0 R]endobj -190 0 obj<>endobj -191 0 obj<>endobj -192 0 obj<>endobj -193 0 obj<>endobj -194 0 obj<>endobj -195 0 obj<>endobj -196 0 obj<>endobj -197 0 obj<>endobj -198 0 obj<>endobj -199 0 obj<>endobj -200 0 obj<>endobj -201 0 obj<>endobj -202 0 obj<>endobj -203 0 obj<>endobj -204 0 obj<>endobj -205 0 obj<>endobj -206 0 obj<>endobj -207 0 obj<>endobj -208 0 obj<>endobj -209 0 obj<>endobj -210 0 obj<>endobj -211 0 obj<>endobj -212 0 obj<>endobj -213 0 obj<>endobj -214 0 obj<>endobj -215 0 obj<>endobj -216 0 obj<>endobj -217 0 obj<>endobj -218 0 obj<>endobj -219 0 obj<>endobj -220 0 obj<>endobj -221 0 obj<>endobj -222 0 obj<>endobj -223 0 obj<>endobj -224 0 obj<>endobj -225 0 obj<>endobj -226 0 obj<>endobj -227 0 obj<>endobj -228 0 obj<>endobj -229 0 obj<>endobj -230 0 obj<>endobj -231 0 obj<>endobj -232 0 obj<>endobj -233 0 obj<>endobj -234 0 obj[190 0 R -191 0 R +188 0 R +189 0 R]endobj +191 0 obj<>endobj +192 0 obj<>endobj +193 0 obj<>endobj +194 0 obj<>endobj +195 0 obj<>endobj +196 0 obj<>endobj +197 0 obj<>endobj +198 0 obj<>endobj +199 0 obj<>endobj +200 0 obj<>endobj +201 0 obj<>endobj +202 0 obj<>endobj +203 0 obj<>endobj +204 0 obj<>endobj +205 0 obj<>endobj +206 0 obj<>endobj +207 0 obj<>endobj +208 0 obj<>endobj +209 0 obj<>endobj +210 0 obj<>endobj +211 0 obj<>endobj +212 0 obj<>endobj +213 0 obj<>endobj +214 0 obj<>endobj +215 0 obj<>endobj +216 0 obj<>endobj +217 0 obj<>endobj +218 0 obj<>endobj +219 0 obj<>endobj +220 0 obj<>endobj +221 0 obj<>endobj +222 0 obj<>endobj +223 0 obj<>endobj +224 0 obj<>endobj +225 0 obj<>endobj +226 0 obj<>endobj +227 0 obj<>endobj +228 0 obj<>endobj +229 0 obj<>endobj +230 0 obj<>endobj +231 0 obj<>endobj +232 0 obj<>endobj +233 0 obj<>endobj +234 0 obj<>endobj +235 0 obj[191 0 R 192 0 R 193 0 R 194 0 R @@ -445,51 +446,51 @@ endobj 230 0 R 231 0 R 232 0 R -233 0 R]endobj -235 0 obj<>endobj -236 0 obj<>endobj -237 0 obj<>endobj -238 0 obj<>endobj -239 0 obj<>endobj -240 0 obj<>endobj -241 0 obj<>endobj -242 0 obj<>endobj -243 0 obj<>endobj -244 0 obj<>endobj -245 0 obj<>endobj -246 0 obj<>endobj -247 0 obj<>endobj -248 0 obj<>endobj -249 0 obj<>endobj -250 0 obj<>endobj -251 0 obj<>endobj -252 0 obj<>endobj -253 0 obj<>endobj -254 0 obj<>endobj -255 0 obj<>endobj -256 0 obj<>endobj -257 0 obj<>endobj -258 0 obj<>endobj -259 0 obj<>endobj -260 0 obj<>endobj -261 0 obj<>endobj -262 0 obj<>endobj -263 0 obj<>endobj -264 0 obj<>endobj -265 0 obj<>endobj -266 0 obj<>endobj -267 0 obj<>endobj -268 0 obj<>endobj -269 0 obj<>endobj -270 0 obj<>endobj -271 0 obj<>endobj -272 0 obj<>endobj -273 0 obj<>endobj -274 0 obj<>endobj -275 0 obj<>endobj -276 0 obj<>endobj -277 0 obj[235 0 R -236 0 R +233 0 R +234 0 R]endobj +236 0 obj<>endobj +237 0 obj<>endobj +238 0 obj<>endobj +239 0 obj<>endobj +240 0 obj<>endobj +241 0 obj<>endobj +242 0 obj<>endobj +243 0 obj<>endobj +244 0 obj<>endobj +245 0 obj<>endobj +246 0 obj<>endobj +247 0 obj<>endobj +248 0 obj<>endobj +249 0 obj<>endobj +250 0 obj<>endobj +251 0 obj<>endobj +252 0 obj<>endobj +253 0 obj<>endobj +254 0 obj<>endobj +255 0 obj<>endobj +256 0 obj<>endobj +257 0 obj<>endobj +258 0 obj<>endobj +259 0 obj<>endobj +260 0 obj<>endobj +261 0 obj<>endobj +262 0 obj<>endobj +263 0 obj<>endobj +264 0 obj<>endobj +265 0 obj<>endobj +266 0 obj<>endobj +267 0 obj<>endobj +268 0 obj<>endobj +269 0 obj<>endobj +270 0 obj<>endobj +271 0 obj<>endobj +272 0 obj<>endobj +273 0 obj<>endobj +274 0 obj<>endobj +275 0 obj<>endobj +276 0 obj<>endobj +277 0 obj<>endobj +278 0 obj[236 0 R 237 0 R 238 0 R 239 0 R @@ -529,50 +530,47 @@ endobj 273 0 R 274 0 R 275 0 R -276 0 R]endobj -278 0 obj<>endobj -279 0 obj<>endobj -280 0 obj<>endobj -281 0 obj<>endobj -282 0 obj<>endobj -283 0 obj<>endobj -284 0 obj<>endobj -285 0 obj<>endobj -286 0 obj<>endobj -287 0 obj<>endobj -288 0 obj<>endobj -289 0 obj<>endobj -290 0 obj<>endobj -291 0 obj<>endobj -292 0 obj<>endobj -293 0 obj<>endobj -294 0 obj<>endobj -295 0 obj<>endobj -296 0 obj<>endobj -297 0 obj<>endobj -298 0 obj<>endobj -299 0 obj<>endobj -300 0 obj<>endobj -301 0 obj<>endobj -302 0 obj<>endobj -303 0 obj<>endobj -304 0 obj<>endobj -305 0 obj<>endobj -306 0 obj<>endobj -307 0 obj<>endobj -308 0 obj<>endobj -309 0 obj<>endobj -310 0 obj<>endobj -311 0 obj<>endobj -312 0 obj<>endobj -313 0 obj<>endobj -314 0 obj<>endobj -315 0 obj<>endobj -316 0 obj<>endobj -317 0 obj<>endobj -318 0 obj<>endobj -319 0 obj[278 0 R -279 0 R +276 0 R +277 0 R]endobj +279 0 obj<>endobj +280 0 obj<>endobj +281 0 obj<>endobj +282 0 obj<>endobj +283 0 obj<>endobj +284 0 obj<>endobj +285 0 obj<>endobj +286 0 obj<>endobj +287 0 obj<>endobj +288 0 obj<>endobj +289 0 obj<>endobj +290 0 obj<>endobj +291 0 obj<>endobj +292 0 obj<>endobj +293 0 obj<>endobj +294 0 obj<>endobj +295 0 obj<>endobj +296 0 obj<>endobj +297 0 obj<>endobj +298 0 obj<>endobj +299 0 obj<>endobj +300 0 obj<>endobj +301 0 obj<>endobj +302 0 obj<>endobj +303 0 obj<>endobj +304 0 obj<>endobj +305 0 obj<>endobj +306 0 obj<>endobj +307 0 obj<>endobj +308 0 obj<>endobj +309 0 obj<>endobj +310 0 obj<>endobj +311 0 obj<>endobj +312 0 obj<>endobj +313 0 obj<>endobj +314 0 obj<>endobj +315 0 obj<>endobj +316 0 obj<>endobj +317 0 obj[279 0 R 280 0 R 281 0 R 282 0 R @@ -609,54 +607,54 @@ endobj 313 0 R 314 0 R 315 0 R -316 0 R -317 0 R -318 0 R]endobj -320 0 obj<>endobj -321 0 obj<>endobj -322 0 obj<>endobj -323 0 obj<>endobj -324 0 obj<>endobj -325 0 obj<>endobj -326 0 obj<>endobj -327 0 obj<>endobj -328 0 obj<>endobj -329 0 obj<>endobj -330 0 obj<>endobj -331 0 obj<>endobj -332 0 obj<>endobj -333 0 obj<>endobj -334 0 obj<>endobj -335 0 obj<>endobj -336 0 obj<>endobj -337 0 obj<>endobj -338 0 obj<>endobj -339 0 obj<>endobj -340 0 obj<>endobj -341 0 obj<>endobj -342 0 obj<>endobj -343 0 obj<>endobj -344 0 obj<>endobj -345 0 obj<>endobj -346 0 obj<>endobj -347 0 obj<>endobj -348 0 obj<>endobj -349 0 obj<>endobj -350 0 obj<>endobj -351 0 obj<>endobj -352 0 obj<>endobj -353 0 obj<>endobj -354 0 obj<>endobj -355 0 obj<>endobj -356 0 obj<>endobj -357 0 obj<>endobj -358 0 obj<>endobj -359 0 obj<>endobj -360 0 obj<>endobj -361 0 obj<>endobj -362 0 obj[321 0 R +316 0 R]endobj +318 0 obj<>endobj +319 0 obj<>endobj +320 0 obj<>endobj +321 0 obj<>endobj +322 0 obj<>endobj +323 0 obj<>endobj +324 0 obj<>endobj +325 0 obj<>endobj +326 0 obj<>endobj +327 0 obj<>endobj +328 0 obj<>endobj +329 0 obj<>endobj +330 0 obj<>endobj +331 0 obj<>endobj +332 0 obj<>endobj +333 0 obj<>endobj +334 0 obj<>endobj +335 0 obj<>endobj +336 0 obj<>endobj +337 0 obj<>endobj +338 0 obj<>endobj +339 0 obj<>endobj +340 0 obj<>endobj +341 0 obj<>endobj +342 0 obj<>endobj +343 0 obj<>endobj +344 0 obj<>endobj +345 0 obj<>endobj +346 0 obj<>endobj +347 0 obj<>endobj +348 0 obj<>endobj +349 0 obj<>endobj +350 0 obj<>endobj +351 0 obj<>endobj +352 0 obj<>endobj +353 0 obj<>endobj +354 0 obj<>endobj +355 0 obj<>endobj +356 0 obj<>endobj +357 0 obj<>endobj +358 0 obj<>endobj +359 0 obj<>endobj +360 0 obj[319 0 R +321 0 R 323 0 R 325 0 R +326 0 R 327 0 R 328 0 R 329 0 R @@ -689,61 +687,63 @@ endobj 356 0 R 357 0 R 358 0 R -359 0 R -360 0 R -361 0 R]endobj -363 0 obj<>endobj -364 0 obj<>endobj -365 0 obj<>endobj -366 0 obj<>endobj -367 0 obj<>endobj -368 0 obj<>endobj -369 0 obj<>endobj -370 0 obj<>endobj -371 0 obj<>endobj -372 0 obj<>endobj -373 0 obj<>endobj -374 0 obj<>endobj -375 0 obj<>endobj -376 0 obj<>endobj -377 0 obj<>endobj -378 0 obj<>endobj -379 0 obj<>endobj -380 0 obj<>endobj -381 0 obj<>endobj -382 0 obj<>endobj -383 0 obj<>endobj -384 0 obj<>endobj -385 0 obj<>endobj -386 0 obj<>endobj -387 0 obj<>endobj -388 0 obj<>endobj -389 0 obj<>endobj -390 0 obj<>endobj -391 0 obj<>endobj -392 0 obj<>endobj -393 0 obj<>endobj -394 0 obj<>endobj -395 0 obj<>endobj -396 0 obj<>endobj -397 0 obj<>endobj -398 0 obj<>endobj -399 0 obj<>endobj -400 0 obj<>endobj -401 0 obj<>endobj -402 0 obj<>endobj -403 0 obj<>endobj -404 0 obj<>endobj -405 0 obj<>endobj -406 0 obj<>endobj -407 0 obj<>endobj -408 0 obj<>endobj -409 0 obj<>endobj -410 0 obj<>endobj -411 0 obj<>endobj -412 0 obj<>endobj -413 0 obj<>endobj -414 0 obj[363 0 R +359 0 R]endobj +361 0 obj<>endobj +362 0 obj<>endobj +363 0 obj<>endobj +364 0 obj<>endobj +365 0 obj<>endobj +366 0 obj<>endobj +367 0 obj<>endobj +368 0 obj<>endobj +369 0 obj<>endobj +370 0 obj<>endobj +371 0 obj<>endobj +372 0 obj<>endobj +373 0 obj<>endobj +374 0 obj<>endobj +375 0 obj<>endobj +376 0 obj<>endobj +377 0 obj<>endobj +378 0 obj<>endobj +379 0 obj<>endobj +380 0 obj<>endobj +381 0 obj<>endobj +382 0 obj<>endobj +383 0 obj<>endobj +384 0 obj<>endobj +385 0 obj<>endobj +386 0 obj<>endobj +387 0 obj<>endobj +388 0 obj<>endobj +389 0 obj<>endobj +390 0 obj<>endobj +391 0 obj<>endobj +392 0 obj<>endobj +393 0 obj<>endobj +394 0 obj<>endobj +395 0 obj<>endobj +396 0 obj<>endobj +397 0 obj<>endobj +398 0 obj<>endobj +399 0 obj<>endobj +400 0 obj<>endobj +401 0 obj<>endobj +402 0 obj<>endobj +403 0 obj<>endobj +404 0 obj<>endobj +405 0 obj<>endobj +406 0 obj<>endobj +407 0 obj<>endobj +408 0 obj<>endobj +409 0 obj<>endobj +410 0 obj<>endobj +411 0 obj<>endobj +412 0 obj<>endobj +413 0 obj<>endobj +414 0 obj[361 0 R +362 0 R +363 0 R 364 0 R 365 0 R 366 0 R @@ -794,57 +794,57 @@ endobj 411 0 R 412 0 R 413 0 R]endobj -415 0 obj<>endobj -416 0 obj<>endobj -417 0 obj<>endobj -418 0 obj<>endobj -419 0 obj<>endobj -420 0 obj<>endobj -421 0 obj<>endobj -422 0 obj<>endobj -423 0 obj<>endobj -424 0 obj<>endobj -425 0 obj<>endobj -426 0 obj<>endobj -427 0 obj<>endobj -428 0 obj<>endobj -429 0 obj<>endobj -430 0 obj<>endobj -431 0 obj<>endobj -432 0 obj<>endobj -433 0 obj<>endobj -434 0 obj<>endobj -435 0 obj<>endobj -436 0 obj<>endobj -437 0 obj<>endobj -438 0 obj<>endobj -439 0 obj<>endobj -440 0 obj<>endobj -441 0 obj<>endobj -442 0 obj<>endobj -443 0 obj<>endobj -444 0 obj<>endobj -445 0 obj<>endobj -446 0 obj<>endobj -447 0 obj<>endobj -448 0 obj<>endobj -449 0 obj<>endobj -450 0 obj<>endobj -451 0 obj<>endobj -452 0 obj<>endobj -453 0 obj<>endobj -454 0 obj<>endobj -455 0 obj<>endobj -456 0 obj<>endobj -457 0 obj<>endobj -458 0 obj<>endobj -459 0 obj<>endobj -460 0 obj<>endobj -461 0 obj<>endobj -462 0 obj<>endobj -463 0 obj<>endobj -464 0 obj<>endobj -465 0 obj<>endobj +415 0 obj<>endobj +416 0 obj<>endobj +417 0 obj<>endobj +418 0 obj<>endobj +419 0 obj<>endobj +420 0 obj<>endobj +421 0 obj<>endobj +422 0 obj<>endobj +423 0 obj<>endobj +424 0 obj<>endobj +425 0 obj<>endobj +426 0 obj<>endobj +427 0 obj<>endobj +428 0 obj<>endobj +429 0 obj<>endobj +430 0 obj<>endobj +431 0 obj<>endobj +432 0 obj<>endobj +433 0 obj<>endobj +434 0 obj<>endobj +435 0 obj<>endobj +436 0 obj<>endobj +437 0 obj<>endobj +438 0 obj<>endobj +439 0 obj<>endobj +440 0 obj<>endobj +441 0 obj<>endobj +442 0 obj<>endobj +443 0 obj<>endobj +444 0 obj<>endobj +445 0 obj<>endobj +446 0 obj<>endobj +447 0 obj<>endobj +448 0 obj<>endobj +449 0 obj<>endobj +450 0 obj<>endobj +451 0 obj<>endobj +452 0 obj<>endobj +453 0 obj<>endobj +454 0 obj<>endobj +455 0 obj<>endobj +456 0 obj<>endobj +457 0 obj<>endobj +458 0 obj<>endobj +459 0 obj<>endobj +460 0 obj<>endobj +461 0 obj<>endobj +462 0 obj<>endobj +463 0 obj<>endobj +464 0 obj<>endobj +465 0 obj<>endobj 466 0 obj[415 0 R 416 0 R 417 0 R @@ -896,46 +896,43 @@ endobj 463 0 R 464 0 R 465 0 R]endobj -467 0 obj<>endobj -468 0 obj<>endobj -469 0 obj<>endobj -470 0 obj<>endobj -471 0 obj<>endobj -472 0 obj<>endobj -473 0 obj<>endobj -474 0 obj<>endobj -475 0 obj<>endobj -476 0 obj<>endobj -477 0 obj<>endobj -478 0 obj<>endobj -479 0 obj<>endobj -480 0 obj<>endobj -481 0 obj<>endobj -482 0 obj<>endobj -483 0 obj<>endobj -484 0 obj<>endobj -485 0 obj<>endobj -486 0 obj<>endobj -487 0 obj<>endobj -488 0 obj<>endobj -489 0 obj<>endobj -490 0 obj<>endobj -491 0 obj<>endobj -492 0 obj<>endobj -493 0 obj<>endobj -494 0 obj<>endobj -495 0 obj<>endobj -496 0 obj<>endobj -497 0 obj<>endobj -498 0 obj<>endobj -499 0 obj<>endobj -500 0 obj<>endobj -501 0 obj<>endobj -502 0 obj<>endobj -503 0 obj<>endobj -504 0 obj<>endobj -505 0 obj<>endobj -506 0 obj[467 0 R +467 0 obj<>endobj +468 0 obj<>endobj +469 0 obj<>endobj +470 0 obj<>endobj +471 0 obj<>endobj +472 0 obj<>endobj +473 0 obj<>endobj +474 0 obj<>endobj +475 0 obj<>endobj +476 0 obj<>endobj +477 0 obj<>endobj +478 0 obj<>endobj +479 0 obj<>endobj +480 0 obj<>endobj +481 0 obj<>endobj +482 0 obj<>endobj +483 0 obj<>endobj +484 0 obj<>endobj +485 0 obj<>endobj +486 0 obj<>endobj +487 0 obj<>endobj +488 0 obj<>endobj +489 0 obj<>endobj +490 0 obj<>endobj +491 0 obj<>endobj +492 0 obj<>endobj +493 0 obj<>endobj +494 0 obj<>endobj +495 0 obj<>endobj +496 0 obj<>endobj +497 0 obj<>endobj +498 0 obj<>endobj +499 0 obj<>endobj +500 0 obj<>endobj +501 0 obj<>endobj +502 0 obj<>endobj +503 0 obj[467 0 R 468 0 R 469 0 R 470 0 R @@ -970,55 +967,55 @@ endobj 499 0 R 500 0 R 501 0 R -502 0 R -503 0 R -504 0 R -505 0 R]endobj -507 0 obj<>endobj -508 0 obj<>endobj -509 0 obj<>endobj -510 0 obj<>endobj -511 0 obj<>endobj -512 0 obj<>endobj -513 0 obj<>endobj -514 0 obj<>endobj -515 0 obj<>endobj -516 0 obj<>endobj -517 0 obj<>endobj -518 0 obj<>endobj -519 0 obj<>endobj -520 0 obj<>endobj -521 0 obj<>endobj -522 0 obj<>endobj -523 0 obj<>endobj -524 0 obj<>endobj -525 0 obj<>endobj -526 0 obj<>endobj -527 0 obj<>endobj -528 0 obj<>endobj -529 0 obj<>endobj -530 0 obj<>endobj -531 0 obj<>endobj -532 0 obj<>endobj -533 0 obj<>endobj -534 0 obj<>endobj -535 0 obj<>endobj -536 0 obj<>endobj -537 0 obj<>endobj -538 0 obj<>endobj -539 0 obj<>endobj -540 0 obj<>endobj -541 0 obj<>endobj -542 0 obj<>endobj -543 0 obj<>endobj -544 0 obj<>endobj -545 0 obj<>endobj -546 0 obj<>endobj -547 0 obj<>endobj -548 0 obj<>endobj -549 0 obj<>endobj -550 0 obj<>endobj -551 0 obj[507 0 R +502 0 R]endobj +504 0 obj<>endobj +505 0 obj<>endobj +506 0 obj<>endobj +507 0 obj<>endobj +508 0 obj<>endobj +509 0 obj<>endobj +510 0 obj<>endobj +511 0 obj<>endobj +512 0 obj<>endobj +513 0 obj<>endobj +514 0 obj<>endobj +515 0 obj<>endobj +516 0 obj<>endobj +517 0 obj<>endobj +518 0 obj<>endobj +519 0 obj<>endobj +520 0 obj<>endobj +521 0 obj<>endobj +522 0 obj<>endobj +523 0 obj<>endobj +524 0 obj<>endobj +525 0 obj<>endobj +526 0 obj<>endobj +527 0 obj<>endobj +528 0 obj<>endobj +529 0 obj<>endobj +530 0 obj<>endobj +531 0 obj<>endobj +532 0 obj<>endobj +533 0 obj<>endobj +534 0 obj<>endobj +535 0 obj<>endobj +536 0 obj<>endobj +537 0 obj<>endobj +538 0 obj<>endobj +539 0 obj<>endobj +540 0 obj<>endobj +541 0 obj<>endobj +542 0 obj<>endobj +543 0 obj<>endobj +544 0 obj<>endobj +545 0 obj<>endobj +546 0 obj<>endobj +547 0 obj<>endobj +548 0 obj[504 0 R +505 0 R +506 0 R +507 0 R 508 0 R 509 0 R 510 0 R @@ -1058,117 +1055,117 @@ endobj 544 0 R 545 0 R 546 0 R -547 0 R -548 0 R -549 0 R -550 0 R]endobj -552 0 obj<>endobj +547 0 R]endobj +549 0 obj<>endobj +550 0 obj[549 0 R]endobj +551 0 obj<>endobj +552 0 obj<>endobj 553 0 obj[552 0 R]endobj -554 0 obj<>endobj -555 0 obj<>endobj -556 0 obj[555 0 R]endobj -557 0 obj<>endobj -558 0 obj<>endobj -559 0 obj<>endobj -560 0 obj<>endobj -561 0 obj<>endobj -562 0 obj<>endobj -563 0 obj<>endobj -564 0 obj<>endobj -565 0 obj<>endobj -566 0 obj<>endobj -567 0 obj<>endobj -568 0 obj<>endobj -569 0 obj<>endobj -570 0 obj<>endobj -571 0 obj[558 0 R -560 0 R -562 0 R -564 0 R -566 0 R -568 0 R -570 0 R]endobj -572 0 obj<>endobj -573 0 obj<>endobj -574 0 obj<>endobj -575 0 obj<>endobj -576 0 obj<>endobj -577 0 obj<>endobj -578 0 obj[573 0 R -575 0 R -577 0 R]endobj -579 0 obj<>endobj -580 0 obj<>endobj -581 0 obj<>endobj -582 0 obj<>endobj -583 0 obj<>endobj -584 0 obj<>endobj -585 0 obj<>endobj -586 0 obj<>endobj -587 0 obj<>endobj -588 0 obj<>endobj -589 0 obj<>endobj -590 0 obj<>endobj -591 0 obj<>endobj -592 0 obj<>endobj -593 0 obj[580 0 R -582 0 R -584 0 R -586 0 R -588 0 R -590 0 R -592 0 R]endobj -594 0 obj<>endobj -595 0 obj<>endobj +554 0 obj<>endobj +555 0 obj<>endobj +556 0 obj<>endobj +557 0 obj<>endobj +558 0 obj<>endobj +559 0 obj<>endobj +560 0 obj<>endobj +561 0 obj<>endobj +562 0 obj<>endobj +563 0 obj<>endobj +564 0 obj<>endobj +565 0 obj<>endobj +566 0 obj<>endobj +567 0 obj<>endobj +568 0 obj[555 0 R +557 0 R +559 0 R +561 0 R +563 0 R +565 0 R +567 0 R]endobj +569 0 obj<>endobj +570 0 obj<>endobj +571 0 obj<>endobj +572 0 obj<>endobj +573 0 obj<>endobj +574 0 obj<>endobj +575 0 obj[570 0 R +572 0 R +574 0 R]endobj +576 0 obj<>endobj +577 0 obj<>endobj +578 0 obj<>endobj +579 0 obj<>endobj +580 0 obj<>endobj +581 0 obj<>endobj +582 0 obj<>endobj +583 0 obj<>endobj +584 0 obj<>endobj +585 0 obj<>endobj +586 0 obj<>endobj +587 0 obj<>endobj +588 0 obj<>endobj +589 0 obj<>endobj +590 0 obj[577 0 R +579 0 R +581 0 R +583 0 R +585 0 R +587 0 R +589 0 R]endobj +591 0 obj<>endobj +592 0 obj<>endobj +593 0 obj[592 0 R]endobj +594 0 obj<>endobj +595 0 obj<>endobj 596 0 obj[595 0 R]endobj -597 0 obj<>endobj -598 0 obj<>endobj -599 0 obj[598 0 R]endobj -600 0 obj<>endobj -601 0 obj<>endobj -602 0 obj<>endobj -603 0 obj<>endobj -604 0 obj<>endobj -605 0 obj<>endobj -606 0 obj<>endobj -607 0 obj<>endobj -608 0 obj<>endobj -609 0 obj<>endobj -610 0 obj<>endobj -611 0 obj<>endobj -612 0 obj<>endobj -613 0 obj<>endobj -614 0 obj<>endobj -615 0 obj<>endobj -616 0 obj<>endobj -617 0 obj<>endobj -618 0 obj<>endobj -619 0 obj<>endobj -620 0 obj<>endobj -621 0 obj<>endobj -622 0 obj<>endobj -623 0 obj<>endobj -624 0 obj<>endobj -625 0 obj<>endobj -626 0 obj<>endobj -627 0 obj<>endobj -628 0 obj<>endobj -629 0 obj<>endobj -630 0 obj<>endobj -631 0 obj<>endobj -632 0 obj<>endobj -633 0 obj<>endobj -634 0 obj<>endobj -635 0 obj<>endobj -636 0 obj<>endobj -637 0 obj<>endobj -638 0 obj<>endobj -639 0 obj<>endobj -640 0 obj<>endobj -641 0 obj<>endobj -642 0 obj<>endobj -643 0 obj<>endobj -644 0 obj[600 0 R +597 0 obj<>endobj +598 0 obj<>endobj +599 0 obj<>endobj +600 0 obj<>endobj +601 0 obj<>endobj +602 0 obj<>endobj +603 0 obj<>endobj +604 0 obj<>endobj +605 0 obj<>endobj +606 0 obj<>endobj +607 0 obj<>endobj +608 0 obj<>endobj +609 0 obj<>endobj +610 0 obj<>endobj +611 0 obj<>endobj +612 0 obj<>endobj +613 0 obj<>endobj +614 0 obj<>endobj +615 0 obj<>endobj +616 0 obj<>endobj +617 0 obj<>endobj +618 0 obj<>endobj +619 0 obj<>endobj +620 0 obj<>endobj +621 0 obj<>endobj +622 0 obj<>endobj +623 0 obj<>endobj +624 0 obj<>endobj +625 0 obj<>endobj +626 0 obj<>endobj +627 0 obj<>endobj +628 0 obj<>endobj +629 0 obj<>endobj +630 0 obj<>endobj +631 0 obj<>endobj +632 0 obj<>endobj +633 0 obj<>endobj +634 0 obj<>endobj +635 0 obj<>endobj +636 0 obj<>endobj +637 0 obj<>endobj +638 0 obj<>endobj +639 0 obj<>endobj +640 0 obj<>endobj +641 0 obj[597 0 R +598 0 R +599 0 R +600 0 R 601 0 R 602 0 R 603 0 R @@ -1208,210 +1205,211 @@ endobj 637 0 R 638 0 R 639 0 R -640 0 R -641 0 R -642 0 R -643 0 R]endobj -645 0 obj<>endobj -646 0 obj[645 0 R]endobj -647 0 obj<>endobj -648 0 obj<>endobj -649 0 obj[648 0 R]endobj -650 0 obj<>endobj -651 0 obj<>endobj -652 0 obj<>endobj -653 0 obj<>endobj -654 0 obj<>endobj -655 0 obj<>endobj -656 0 obj<>endobj -657 0 obj<>endobj -658 0 obj<>endobj -659 0 obj<>endobj -660 0 obj<>endobj -661 0 obj<>endobj -662 0 obj<>endobj -663 0 obj<>endobj -664 0 obj<>endobj -665 0 obj<>endobj -666 0 obj<>endobj -667 0 obj<>endobj -668 0 obj<>endobj -669 0 obj<>endobj -670 0 obj<>endobj -671 0 obj<>endobj -672 0 obj<>endobj -673 0 obj<>endobj -674 0 obj<>endobj -675 0 obj<>endobj -676 0 obj<>endobj -677 0 obj<>endobj -678 0 obj<>endobj -679 0 obj<>endobj -680 0 obj<>endobj -681 0 obj<>endobj -682 0 obj<>endobj -683 0 obj<>endobj -684 0 obj<>endobj -685 0 obj<>endobj -686 0 obj<>endobj -687 0 obj<>endobj -688 0 obj<>endobj -689 0 obj<>endobj -690 0 obj<>endobj -691 0 obj<>endobj -692 0 obj<>endobj -693 0 obj<>endobj -694 0 obj[651 0 R -653 0 R -655 0 R -657 0 R -659 0 R -661 0 R -663 0 R -665 0 R -667 0 R -669 0 R -671 0 R -673 0 R -675 0 R -677 0 R -679 0 R -681 0 R -683 0 R -685 0 R -687 0 R -689 0 R -691 0 R -693 0 R]endobj -695 0 obj<>endobj -696 0 obj<>endobj -697 0 obj[696 0 R]endobj -698 0 obj<>endobj -699 0 obj<>endobj -700 0 obj[699 0 R]endobj -701 0 obj<>endobj -702 0 obj<>endobj -703 0 obj[702 0 R]endobj -704 0 obj<>endobj -705 0 obj<>endobj -706 0 obj<>endobj -707 0 obj<>endobj -708 0 obj<>endobj -709 0 obj<>endobj -710 0 obj<>endobj -711 0 obj<>endobj -712 0 obj[705 0 R -707 0 R -709 0 R -711 0 R]endobj -713 0 obj<>endobj -714 0 obj<>endobj -715 0 obj<>endobj -716 0 obj<>endobj -717 0 obj<>endobj -718 0 obj<>endobj -719 0 obj<>endobj -720 0 obj<>endobj -721 0 obj<>endobj -722 0 obj<>endobj -723 0 obj<>endobj -724 0 obj<>endobj -725 0 obj<>endobj -726 0 obj<>endobj -727 0 obj<>endobj -728 0 obj<>endobj -729 0 obj[714 0 R -716 0 R -718 0 R -720 0 R -722 0 R -724 0 R -726 0 R +640 0 R]endobj +642 0 obj<>endobj +643 0 obj<>endobj +644 0 obj[643 0 R]endobj +645 0 obj<>endobj +646 0 obj<>endobj +647 0 obj<>endobj +648 0 obj<>endobj +649 0 obj<>endobj +650 0 obj<>endobj +651 0 obj<>endobj +652 0 obj<>endobj +653 0 obj<>endobj +654 0 obj<>endobj +655 0 obj<>endobj +656 0 obj<>endobj +657 0 obj<>endobj +658 0 obj<>endobj +659 0 obj<>endobj +660 0 obj<>endobj +661 0 obj<>endobj +662 0 obj<>endobj +663 0 obj<>endobj +664 0 obj<>endobj +665 0 obj<>endobj +666 0 obj<>endobj +667 0 obj<>endobj +668 0 obj<>endobj +669 0 obj<>endobj +670 0 obj<>endobj +671 0 obj<>endobj +672 0 obj<>endobj +673 0 obj<>endobj +674 0 obj<>endobj +675 0 obj<>endobj +676 0 obj<>endobj +677 0 obj<>endobj +678 0 obj<>endobj +679 0 obj<>endobj +680 0 obj<>endobj +681 0 obj<>endobj +682 0 obj<>endobj +683 0 obj<>endobj +684 0 obj<>endobj +685 0 obj<>endobj +686 0 obj<>endobj +687 0 obj<>endobj +688 0 obj<>endobj +689 0 obj[646 0 R +648 0 R +650 0 R +652 0 R +654 0 R +656 0 R +658 0 R +660 0 R +662 0 R +664 0 R +666 0 R +668 0 R +670 0 R +672 0 R +674 0 R +676 0 R +678 0 R +680 0 R +682 0 R +684 0 R +686 0 R +688 0 R]endobj +690 0 obj<>endobj +691 0 obj<>endobj +692 0 obj[691 0 R]endobj +693 0 obj<>endobj +694 0 obj<>endobj +695 0 obj[694 0 R]endobj +696 0 obj<>endobj +697 0 obj<>endobj +698 0 obj[697 0 R]endobj +699 0 obj<>endobj +700 0 obj<>endobj +701 0 obj<>endobj +702 0 obj<>endobj +703 0 obj<>endobj +704 0 obj<>endobj +705 0 obj<>endobj +706 0 obj<>endobj +707 0 obj[700 0 R +702 0 R +704 0 R +706 0 R]endobj +708 0 obj<>endobj +709 0 obj<>endobj +710 0 obj<>endobj +711 0 obj<>endobj +712 0 obj<>endobj +713 0 obj<>endobj +714 0 obj<>endobj +715 0 obj<>endobj +716 0 obj<>endobj +717 0 obj<>endobj +718 0 obj<>endobj +719 0 obj<>endobj +720 0 obj<>endobj +721 0 obj<>endobj +722 0 obj<>endobj +723 0 obj<>endobj +724 0 obj[709 0 R +711 0 R +713 0 R +715 0 R +717 0 R +719 0 R +721 0 R +723 0 R]endobj +725 0 obj<>endobj +726 0 obj<>endobj +727 0 obj<>endobj +728 0 obj<>endobj +729 0 obj[726 0 R 728 0 R]endobj -730 0 obj<>endobj -731 0 obj<>endobj -732 0 obj<>endobj -733 0 obj<>endobj -734 0 obj[731 0 R -733 0 R]endobj -735 0 obj<>endobj -736 0 obj<>endobj -737 0 obj[736 0 R]endobj -738 0 obj<>endobj -739 0 obj<>endobj -740 0 obj<>endobj -741 0 obj<>endobj -742 0 obj<>endobj -743 0 obj<>endobj -744 0 obj<>endobj -745 0 obj<>endobj -746 0 obj<>endobj -747 0 obj<>endobj -748 0 obj[739 0 R -741 0 R -743 0 R -745 0 R -747 0 R]endobj -749 0 obj<>endobj -750 0 obj<>endobj -751 0 obj<>endobj -752 0 obj<>endobj -753 0 obj<>endobj -754 0 obj<>endobj -755 0 obj[750 0 R -752 0 R -754 0 R]endobj -756 0 obj<>endobj -757 0 obj<>endobj -758 0 obj<>endobj -759 0 obj<>endobj -760 0 obj[757 0 R -759 0 R]endobj -761 0 obj<>endobj -762 0 obj<>endobj -763 0 obj<>endobj -764 0 obj<>endobj -765 0 obj<>endobj -766 0 obj<>endobj -767 0 obj<>endobj -768 0 obj<>endobj -769 0 obj<>endobj -770 0 obj<>endobj -771 0 obj<>endobj -772 0 obj<>endobj -773 0 obj<>endobj -774 0 obj<>endobj -775 0 obj<>endobj -776 0 obj<>endobj -777 0 obj<>endobj -778 0 obj<>endobj -779 0 obj<>endobj -780 0 obj<>endobj -781 0 obj<>endobj -782 0 obj<>endobj -783 0 obj<>endobj -784 0 obj<>endobj -785 0 obj<>endobj -786 0 obj<>endobj -787 0 obj<>endobj -788 0 obj<>endobj -789 0 obj<>endobj -790 0 obj<>endobj -791 0 obj<>endobj -792 0 obj<>endobj -793 0 obj<>endobj -794 0 obj<>endobj -795 0 obj<>endobj -796 0 obj<>endobj -797 0 obj<>endobj -798 0 obj<>endobj -799 0 obj<>endobj -800 0 obj<>endobj -801 0 obj<>endobj -802 0 obj<>endobj -803 0 obj<>endobj -804 0 obj<>endobj -805 0 obj[761 0 R +730 0 obj<>endobj +731 0 obj<>endobj +732 0 obj[731 0 R]endobj +733 0 obj<>endobj +734 0 obj<>endobj +735 0 obj<>endobj +736 0 obj<>endobj +737 0 obj<>endobj +738 0 obj<>endobj +739 0 obj<>endobj +740 0 obj<>endobj +741 0 obj<>endobj +742 0 obj<>endobj +743 0 obj[734 0 R +736 0 R +738 0 R +740 0 R +742 0 R]endobj +744 0 obj<>endobj +745 0 obj<>endobj +746 0 obj<>endobj +747 0 obj<>endobj +748 0 obj<>endobj +749 0 obj<>endobj +750 0 obj<>endobj +751 0 obj<>endobj +752 0 obj<>endobj +753 0 obj<>endobj +754 0 obj[745 0 R +747 0 R +749 0 R +751 0 R +753 0 R]endobj +755 0 obj<>endobj +756 0 obj<>endobj +757 0 obj<>endobj +758 0 obj<>endobj +759 0 obj<>endobj +760 0 obj<>endobj +761 0 obj<>endobj +762 0 obj<>endobj +763 0 obj<>endobj +764 0 obj<>endobj +765 0 obj<>endobj +766 0 obj<>endobj +767 0 obj<>endobj +768 0 obj<>endobj +769 0 obj<>endobj +770 0 obj<>endobj +771 0 obj<>endobj +772 0 obj<>endobj +773 0 obj<>endobj +774 0 obj<>endobj +775 0 obj<>endobj +776 0 obj<>endobj +777 0 obj<>endobj +778 0 obj<>endobj +779 0 obj<>endobj +780 0 obj<>endobj +781 0 obj<>endobj +782 0 obj<>endobj +783 0 obj<>endobj +784 0 obj<>endobj +785 0 obj<>endobj +786 0 obj<>endobj +787 0 obj<>endobj +788 0 obj<>endobj +789 0 obj<>endobj +790 0 obj<>endobj +791 0 obj<>endobj +792 0 obj<>endobj +793 0 obj<>endobj +794 0 obj<>endobj +795 0 obj<>endobj +796 0 obj<>endobj +797 0 obj<>endobj +798 0 obj<>endobj +799 0 obj[755 0 R +756 0 R +757 0 R +758 0 R +759 0 R +760 0 R +761 0 R 762 0 R 763 0 R 764 0 R @@ -1448,65 +1446,65 @@ endobj 795 0 R 796 0 R 797 0 R -798 0 R -799 0 R -800 0 R +798 0 R]endobj +800 0 obj<>endobj +801 0 obj<>endobj +802 0 obj<>endobj +803 0 obj<>endobj +804 0 obj<>endobj +805 0 obj<>endobj +806 0 obj<>endobj +807 0 obj<>endobj +808 0 obj<>endobj +809 0 obj<>endobj +810 0 obj<>endobj +811 0 obj<>endobj +812 0 obj<>endobj +813 0 obj<>endobj +814 0 obj<>endobj +815 0 obj<>endobj +816 0 obj<>endobj +817 0 obj<>endobj +818 0 obj<>endobj +819 0 obj<>endobj +820 0 obj<>endobj +821 0 obj<>endobj +822 0 obj<>endobj +823 0 obj<>endobj +824 0 obj<>endobj +825 0 obj<>endobj +826 0 obj<>endobj +827 0 obj<>endobj +828 0 obj<>endobj +829 0 obj<>endobj +830 0 obj<>endobj +831 0 obj<>endobj +832 0 obj<>endobj +833 0 obj<>endobj +834 0 obj<>endobj +835 0 obj<>endobj +836 0 obj<>endobj +837 0 obj<>endobj +838 0 obj<>endobj +839 0 obj<>endobj +840 0 obj<>endobj +841 0 obj<>endobj +842 0 obj<>endobj +843 0 obj<>endobj +844 0 obj<>endobj +845 0 obj<>endobj +846 0 obj<>endobj +847 0 obj<>endobj +848 0 obj<>endobj +849 0 obj<>endobj +850 0 obj<>endobj +851 0 obj[800 0 R 801 0 R 802 0 R 803 0 R -804 0 R]endobj -806 0 obj<>endobj -807 0 obj<>endobj -808 0 obj<>endobj -809 0 obj<>endobj -810 0 obj<>endobj -811 0 obj<>endobj -812 0 obj<>endobj -813 0 obj<>endobj -814 0 obj<>endobj -815 0 obj<>endobj -816 0 obj<>endobj -817 0 obj<>endobj -818 0 obj<>endobj -819 0 obj<>endobj -820 0 obj<>endobj -821 0 obj<>endobj -822 0 obj<>endobj -823 0 obj<>endobj -824 0 obj<>endobj -825 0 obj<>endobj -826 0 obj<>endobj -827 0 obj<>endobj -828 0 obj<>endobj -829 0 obj<>endobj -830 0 obj<>endobj -831 0 obj<>endobj -832 0 obj<>endobj -833 0 obj<>endobj -834 0 obj<>endobj -835 0 obj<>endobj -836 0 obj<>endobj -837 0 obj<>endobj -838 0 obj<>endobj -839 0 obj<>endobj -840 0 obj<>endobj -841 0 obj<>endobj -842 0 obj<>endobj -843 0 obj<>endobj -844 0 obj<>endobj -845 0 obj<>endobj -846 0 obj<>endobj -847 0 obj<>endobj -848 0 obj<>endobj -849 0 obj<>endobj -850 0 obj<>endobj -851 0 obj<>endobj -852 0 obj<>endobj -853 0 obj<>endobj -854 0 obj<>endobj -855 0 obj<>endobj -856 0 obj<>endobj -857 0 obj[806 0 R +804 0 R +805 0 R +806 0 R 807 0 R 808 0 R 809 0 R @@ -1550,57 +1548,57 @@ endobj 847 0 R 848 0 R 849 0 R -850 0 R -851 0 R -852 0 R +850 0 R]endobj +852 0 obj<>endobj +853 0 obj<>endobj +854 0 obj<>endobj +855 0 obj<>endobj +856 0 obj<>endobj +857 0 obj<>endobj +858 0 obj<>endobj +859 0 obj<>endobj +860 0 obj<>endobj +861 0 obj<>endobj +862 0 obj<>endobj +863 0 obj<>endobj +864 0 obj<>endobj +865 0 obj<>endobj +866 0 obj<>endobj +867 0 obj<>endobj +868 0 obj<>endobj +869 0 obj<>endobj +870 0 obj<>endobj +871 0 obj<>endobj +872 0 obj<>endobj +873 0 obj<>endobj +874 0 obj<>endobj +875 0 obj<>endobj +876 0 obj<>endobj +877 0 obj<>endobj +878 0 obj<>endobj +879 0 obj<>endobj +880 0 obj<>endobj +881 0 obj<>endobj +882 0 obj<>endobj +883 0 obj<>endobj +884 0 obj<>endobj +885 0 obj<>endobj +886 0 obj<>endobj +887 0 obj<>endobj +888 0 obj<>endobj +889 0 obj<>endobj +890 0 obj<>endobj +891 0 obj<>endobj +892 0 obj<>endobj +893 0 obj<>endobj +894 0 obj<>endobj +895 0 obj[852 0 R 853 0 R 854 0 R 855 0 R -856 0 R]endobj -858 0 obj<>endobj -859 0 obj<>endobj -860 0 obj<>endobj -861 0 obj<>endobj -862 0 obj<>endobj -863 0 obj<>endobj -864 0 obj<>endobj -865 0 obj<>endobj -866 0 obj<>endobj -867 0 obj<>endobj -868 0 obj<>endobj -869 0 obj<>endobj -870 0 obj<>endobj -871 0 obj<>endobj -872 0 obj<>endobj -873 0 obj<>endobj -874 0 obj<>endobj -875 0 obj<>endobj -876 0 obj<>endobj -877 0 obj<>endobj -878 0 obj<>endobj -879 0 obj<>endobj -880 0 obj<>endobj -881 0 obj<>endobj -882 0 obj<>endobj -883 0 obj<>endobj -884 0 obj<>endobj -885 0 obj<>endobj -886 0 obj<>endobj -887 0 obj<>endobj -888 0 obj<>endobj -889 0 obj<>endobj -890 0 obj<>endobj -891 0 obj<>endobj -892 0 obj<>endobj -893 0 obj<>endobj -894 0 obj<>endobj -895 0 obj<>endobj -896 0 obj<>endobj -897 0 obj<>endobj -898 0 obj<>endobj -899 0 obj<>endobj -900 0 obj<>endobj -901 0 obj[858 0 R +856 0 R +857 0 R +858 0 R 859 0 R 860 0 R 861 0 R @@ -1636,229 +1634,229 @@ endobj 891 0 R 892 0 R 893 0 R -894 0 R -895 0 R -896 0 R -897 0 R -898 0 R +894 0 R]endobj +896 0 obj<>endobj +897 0 obj<>endobj +898 0 obj<>endobj +899 0 obj<>endobj +900 0 obj<>endobj +901 0 obj<>endobj +902 0 obj[897 0 R 899 0 R -900 0 R]endobj -902 0 obj<>endobj -903 0 obj<>endobj -904 0 obj<>endobj -905 0 obj<>endobj -906 0 obj<>endobj -907 0 obj<>endobj -908 0 obj[903 0 R -905 0 R -907 0 R]endobj -909 0 obj<>endobj -910 0 obj<>endobj -911 0 obj<>endobj -912 0 obj<>endobj -913 0 obj[910 0 R -912 0 R]endobj -914 0 obj<>endobj -915 0 obj<>endobj -916 0 obj<>endobj -917 0 obj<>endobj -918 0 obj[915 0 R -917 0 R]endobj -919 0 obj<>endobj -920 0 obj<>endobj -921 0 obj<>endobj -922 0 obj<>endobj -923 0 obj<>endobj -924 0 obj<>endobj -925 0 obj<>endobj -926 0 obj<>endobj -927 0 obj[920 0 R -922 0 R -924 0 R -926 0 R]endobj -928 0 obj<>endobj -929 0 obj<>endobj -930 0 obj[929 0 R]endobj -931 0 obj<>endobj -932 0 obj<>endobj -933 0 obj<>endobj -934 0 obj<>endobj -935 0 obj[932 0 R -934 0 R]endobj -936 0 obj<>endobj -937 0 obj<>endobj -938 0 obj<>endobj -939 0 obj<>endobj -940 0 obj<>endobj -941 0 obj<>endobj -942 0 obj[937 0 R -939 0 R -941 0 R]endobj -943 0 obj<>endobj -944 0 obj<>endobj -945 0 obj<>endobj -946 0 obj<>endobj -947 0 obj<>endobj -948 0 obj<>endobj -949 0 obj[944 0 R -946 0 R -948 0 R]endobj -950 0 obj<>endobj -951 0 obj<>endobj -952 0 obj<>endobj -953 0 obj<>endobj -954 0 obj<>endobj -955 0 obj<>endobj -956 0 obj<>endobj -957 0 obj<>endobj -958 0 obj<>endobj -959 0 obj<>endobj -960 0 obj[951 0 R -953 0 R -955 0 R -957 0 R -959 0 R]endobj -961 0 obj<>endobj -962 0 obj<>endobj -963 0 obj[962 0 R]endobj -964 0 obj<>endobj -965 0 obj<>endobj -966 0 obj<>endobj -967 0 obj<>endobj -968 0 obj<>endobj -969 0 obj<>endobj -970 0 obj<>endobj -971 0 obj<>endobj -972 0 obj<>endobj -973 0 obj<>endobj -974 0 obj[965 0 R -967 0 R -969 0 R -971 0 R -973 0 R]endobj -975 0 obj<>endobj -976 0 obj<>endobj -977 0 obj<>endobj -978 0 obj<>endobj -979 0 obj[976 0 R -978 0 R]endobj -980 0 obj<>endobj -981 0 obj<>endobj -982 0 obj<>endobj -983 0 obj<>endobj -984 0 obj<>endobj -985 0 obj<>endobj -986 0 obj[981 0 R -983 0 R -985 0 R]endobj -987 0 obj<>endobj -988 0 obj<>endobj -989 0 obj<>endobj -990 0 obj<>endobj -991 0 obj<>endobj -992 0 obj<>endobj -993 0 obj<>endobj -994 0 obj<>endobj -995 0 obj[988 0 R -990 0 R -992 0 R -994 0 R]endobj -996 0 obj<>endobj -997 0 obj<>endobj +901 0 R]endobj +903 0 obj<>endobj +904 0 obj<>endobj +905 0 obj<>endobj +906 0 obj<>endobj +907 0 obj[904 0 R +906 0 R]endobj +908 0 obj<>endobj +909 0 obj<>endobj +910 0 obj<>endobj +911 0 obj<>endobj +912 0 obj[909 0 R +911 0 R]endobj +913 0 obj<>endobj +914 0 obj<>endobj +915 0 obj<>endobj +916 0 obj<>endobj +917 0 obj<>endobj +918 0 obj<>endobj +919 0 obj<>endobj +920 0 obj<>endobj +921 0 obj[914 0 R +916 0 R +918 0 R +920 0 R]endobj +922 0 obj<>endobj +923 0 obj<>endobj +924 0 obj[923 0 R]endobj +925 0 obj<>endobj +926 0 obj<>endobj +927 0 obj<>endobj +928 0 obj<>endobj +929 0 obj[926 0 R +928 0 R]endobj +930 0 obj<>endobj +931 0 obj<>endobj +932 0 obj<>endobj +933 0 obj<>endobj +934 0 obj<>endobj +935 0 obj<>endobj +936 0 obj[931 0 R +933 0 R +935 0 R]endobj +937 0 obj<>endobj +938 0 obj<>endobj +939 0 obj<>endobj +940 0 obj<>endobj +941 0 obj<>endobj +942 0 obj<>endobj +943 0 obj[938 0 R +940 0 R +942 0 R]endobj +944 0 obj<>endobj +945 0 obj<>endobj +946 0 obj<>endobj +947 0 obj<>endobj +948 0 obj<>endobj +949 0 obj<>endobj +950 0 obj<>endobj +951 0 obj<>endobj +952 0 obj<>endobj +953 0 obj<>endobj +954 0 obj[945 0 R +947 0 R +949 0 R +951 0 R +953 0 R]endobj +955 0 obj<>endobj +956 0 obj<>endobj +957 0 obj[956 0 R]endobj +958 0 obj<>endobj +959 0 obj<>endobj +960 0 obj<>endobj +961 0 obj<>endobj +962 0 obj<>endobj +963 0 obj<>endobj +964 0 obj<>endobj +965 0 obj<>endobj +966 0 obj<>endobj +967 0 obj<>endobj +968 0 obj[959 0 R +961 0 R +963 0 R +965 0 R +967 0 R]endobj +969 0 obj<>endobj +970 0 obj<>endobj +971 0 obj<>endobj +972 0 obj<>endobj +973 0 obj[970 0 R +972 0 R]endobj +974 0 obj<>endobj +975 0 obj<>endobj +976 0 obj<>endobj +977 0 obj<>endobj +978 0 obj<>endobj +979 0 obj<>endobj +980 0 obj[975 0 R +977 0 R +979 0 R]endobj +981 0 obj<>endobj +982 0 obj<>endobj +983 0 obj<>endobj +984 0 obj<>endobj +985 0 obj<>endobj +986 0 obj<>endobj +987 0 obj<>endobj +988 0 obj<>endobj +989 0 obj[982 0 R +984 0 R +986 0 R +988 0 R]endobj +990 0 obj<>endobj +991 0 obj<>endobj +992 0 obj[991 0 R]endobj +993 0 obj<>endobj +994 0 obj<>endobj +995 0 obj[994 0 R]endobj +996 0 obj<>endobj +997 0 obj<>endobj 998 0 obj[997 0 R]endobj -999 0 obj<>endobj -1000 0 obj<>endobj +999 0 obj<>endobj +1000 0 obj<>endobj 1001 0 obj[1000 0 R]endobj -1002 0 obj<>endobj -1003 0 obj<>endobj -1004 0 obj[1003 0 R]endobj -1005 0 obj<>endobj -1006 0 obj<>endobj -1007 0 obj[1006 0 R]endobj -1008 0 obj<>endobj -1009 0 obj<>endobj -1010 0 obj<>endobj -1011 0 obj<>endobj -1012 0 obj<>endobj -1013 0 obj<>endobj -1014 0 obj[1009 0 R -1011 0 R -1013 0 R]endobj -1015 0 obj<>endobj -1016 0 obj<>endobj -1017 0 obj<>endobj -1018 0 obj<>endobj -1019 0 obj<>endobj -1020 0 obj<>endobj -1021 0 obj<>endobj -1022 0 obj<>endobj -1023 0 obj<>endobj -1024 0 obj<>endobj -1025 0 obj[1016 0 R -1018 0 R -1020 0 R -1022 0 R -1024 0 R]endobj -1026 0 obj<>endobj -1027 0 obj<>endobj -1028 0 obj<>endobj -1029 0 obj<>endobj -1030 0 obj[1027 0 R -1029 0 R]endobj -1031 0 obj<>endobj -1032 0 obj<>endobj -1033 0 obj[1032 0 R]endobj -1034 0 obj<>endobj -1035 0 obj<>endobj -1036 0 obj[1035 0 R]endobj -1037 0 obj<>endobj -1038 0 obj<>endobj -1039 0 obj<>endobj -1040 0 obj<>endobj -1041 0 obj<>endobj -1042 0 obj<>endobj -1043 0 obj<>endobj -1044 0 obj<>endobj -1045 0 obj<>endobj -1046 0 obj<>endobj -1047 0 obj<>endobj -1048 0 obj<>endobj -1049 0 obj<>endobj -1050 0 obj<>endobj -1051 0 obj<>endobj -1052 0 obj<>endobj -1053 0 obj<>endobj -1054 0 obj<>endobj -1055 0 obj<>endobj -1056 0 obj<>endobj -1057 0 obj<>endobj -1058 0 obj<>endobj -1059 0 obj<>endobj -1060 0 obj<>endobj -1061 0 obj<>endobj -1062 0 obj<>endobj -1063 0 obj<>endobj -1064 0 obj<>endobj -1065 0 obj<>endobj -1066 0 obj<>endobj -1067 0 obj<>endobj -1068 0 obj<>endobj -1069 0 obj<>endobj -1070 0 obj<>endobj -1071 0 obj<>endobj -1072 0 obj<>endobj -1073 0 obj<>endobj -1074 0 obj<>endobj -1075 0 obj<>endobj -1076 0 obj<>endobj -1077 0 obj<>endobj -1078 0 obj<>endobj -1079 0 obj<>endobj -1080 0 obj<>endobj -1081 0 obj<>endobj -1082 0 obj<>endobj -1083 0 obj<>endobj -1084 0 obj[1037 0 R +1002 0 obj<>endobj +1003 0 obj<>endobj +1004 0 obj<>endobj +1005 0 obj<>endobj +1006 0 obj<>endobj +1007 0 obj<>endobj +1008 0 obj[1003 0 R +1005 0 R +1007 0 R]endobj +1009 0 obj<>endobj +1010 0 obj<>endobj +1011 0 obj<>endobj +1012 0 obj<>endobj +1013 0 obj<>endobj +1014 0 obj<>endobj +1015 0 obj<>endobj +1016 0 obj<>endobj +1017 0 obj<>endobj +1018 0 obj<>endobj +1019 0 obj[1010 0 R +1012 0 R +1014 0 R +1016 0 R +1018 0 R]endobj +1020 0 obj<>endobj +1021 0 obj<>endobj +1022 0 obj<>endobj +1023 0 obj<>endobj +1024 0 obj[1021 0 R +1023 0 R]endobj +1025 0 obj<>endobj +1026 0 obj<>endobj +1027 0 obj[1026 0 R]endobj +1028 0 obj<>endobj +1029 0 obj<>endobj +1030 0 obj[1029 0 R]endobj +1031 0 obj<>endobj +1032 0 obj<>endobj +1033 0 obj<>endobj +1034 0 obj<>endobj +1035 0 obj<>endobj +1036 0 obj<>endobj +1037 0 obj<>endobj +1038 0 obj<>endobj +1039 0 obj<>endobj +1040 0 obj<>endobj +1041 0 obj<>endobj +1042 0 obj<>endobj +1043 0 obj<>endobj +1044 0 obj<>endobj +1045 0 obj<>endobj +1046 0 obj<>endobj +1047 0 obj<>endobj +1048 0 obj<>endobj +1049 0 obj<>endobj +1050 0 obj<>endobj +1051 0 obj<>endobj +1052 0 obj<>endobj +1053 0 obj<>endobj +1054 0 obj<>endobj +1055 0 obj<>endobj +1056 0 obj<>endobj +1057 0 obj<>endobj +1058 0 obj<>endobj +1059 0 obj<>endobj +1060 0 obj<>endobj +1061 0 obj<>endobj +1062 0 obj<>endobj +1063 0 obj<>endobj +1064 0 obj<>endobj +1065 0 obj<>endobj +1066 0 obj<>endobj +1067 0 obj<>endobj +1068 0 obj<>endobj +1069 0 obj<>endobj +1070 0 obj<>endobj +1071 0 obj<>endobj +1072 0 obj<>endobj +1073 0 obj<>endobj +1074 0 obj<>endobj +1075 0 obj<>endobj +1076 0 obj<>endobj +1077 0 obj<>endobj +1078 0 obj[1031 0 R +1032 0 R +1033 0 R +1034 0 R +1035 0 R +1036 0 R +1037 0 R 1038 0 R 1039 0 R 1040 0 R @@ -1898,610 +1896,604 @@ endobj 1074 0 R 1075 0 R 1076 0 R -1077 0 R -1078 0 R -1079 0 R +1077 0 R]endobj +1079 0 obj<>endobj +1080 0 obj<>endobj +1081 0 obj<>endobj +1082 0 obj<>endobj +1083 0 obj<>endobj +1084 0 obj<>endobj +1085 0 obj<>endobj +1086 0 obj<>endobj +1087 0 obj[1079 0 R 1080 0 R 1081 0 R 1082 0 R -1083 0 R]endobj -1085 0 obj<>endobj -1086 0 obj<>endobj -1087 0 obj<>endobj -1088 0 obj<>endobj -1089 0 obj<>endobj -1090 0 obj<>endobj -1091 0 obj<>endobj -1092 0 obj[1085 0 R -1086 0 R -1087 0 R -1088 0 R -1089 0 R -1090 0 R -1091 0 R]endobj -1093 0 obj<>endobj -1094 0 obj<>endobj -1095 0 obj<>endobj -1096 0 obj<>endobj -1097 0 obj<>endobj -1098 0 obj<>endobj -1099 0 obj<>endobj -1100 0 obj<>endobj -1101 0 obj<>endobj -1102 0 obj<>endobj -1103 0 obj[1094 0 R -1096 0 R -1098 0 R -1100 0 R -1102 0 R]endobj -1104 0 obj<>endobj -1105 0 obj<>endobj -1106 0 obj<>endobj -1107 0 obj<>endobj -1108 0 obj<>endobj -1109 0 obj<>endobj -1110 0 obj<>endobj -1111 0 obj<>endobj -1112 0 obj[1105 0 R -1107 0 R -1109 0 R -1111 0 R]endobj -1113 0 obj<>endobj -1114 0 obj<>endobj -1115 0 obj[1114 0 R]endobj -1116 0 obj<>endobj -1117 0 obj<>endobj -1118 0 obj[1117 0 R]endobj -1119 0 obj<>endobj -1120 0 obj<>endobj -1121 0 obj<>endobj -1122 0 obj<>endobj -1123 0 obj<>endobj -1124 0 obj<>endobj -1125 0 obj<>endobj -1126 0 obj<>endobj -1127 0 obj[1120 0 R -1122 0 R -1124 0 R +1083 0 R +1084 0 R +1085 0 R +1086 0 R]endobj +1088 0 obj<>endobj +1089 0 obj<>endobj +1090 0 obj<>endobj +1091 0 obj<>endobj +1092 0 obj<>endobj +1093 0 obj<>endobj +1094 0 obj<>endobj +1095 0 obj<>endobj +1096 0 obj<>endobj +1097 0 obj<>endobj +1098 0 obj[1089 0 R +1091 0 R +1093 0 R +1095 0 R +1097 0 R]endobj +1099 0 obj<>endobj +1100 0 obj<>endobj +1101 0 obj<>endobj +1102 0 obj<>endobj +1103 0 obj<>endobj +1104 0 obj<>endobj +1105 0 obj<>endobj +1106 0 obj<>endobj +1107 0 obj[1100 0 R +1102 0 R +1104 0 R +1106 0 R]endobj +1108 0 obj<>endobj +1109 0 obj<>endobj +1110 0 obj[1109 0 R]endobj +1111 0 obj<>endobj +1112 0 obj<>endobj +1113 0 obj[1112 0 R]endobj +1114 0 obj<>endobj +1115 0 obj<>endobj +1116 0 obj<>endobj +1117 0 obj<>endobj +1118 0 obj<>endobj +1119 0 obj<>endobj +1120 0 obj<>endobj +1121 0 obj<>endobj +1122 0 obj[1115 0 R +1117 0 R +1119 0 R +1121 0 R]endobj +1123 0 obj<>endobj +1124 0 obj<>endobj +1125 0 obj<>endobj +1126 0 obj<>endobj +1127 0 obj[1124 0 R 1126 0 R]endobj -1128 0 obj<>endobj -1129 0 obj<>endobj -1130 0 obj<>endobj -1131 0 obj<>endobj -1132 0 obj[1129 0 R -1131 0 R]endobj -1133 0 obj<>endobj -1134 0 obj<>endobj -1135 0 obj<>endobj -1136 0 obj<>endobj -1137 0 obj<>endobj -1138 0 obj<>endobj -1139 0 obj<>endobj -1140 0 obj<>endobj -1141 0 obj[1134 0 R -1136 0 R -1138 0 R +1128 0 obj<>endobj +1129 0 obj<>endobj +1130 0 obj<>endobj +1131 0 obj<>endobj +1132 0 obj<>endobj +1133 0 obj<>endobj +1134 0 obj<>endobj +1135 0 obj<>endobj +1136 0 obj[1129 0 R +1131 0 R +1133 0 R +1135 0 R]endobj +1137 0 obj<>endobj +1138 0 obj<>endobj +1139 0 obj<>endobj +1140 0 obj<>endobj +1141 0 obj[1138 0 R 1140 0 R]endobj -1142 0 obj<>endobj -1143 0 obj<>endobj -1144 0 obj<>endobj -1145 0 obj<>endobj -1146 0 obj[1143 0 R -1145 0 R]endobj -1147 0 obj<>endobj -1148 0 obj<>endobj -1149 0 obj<>endobj -1150 0 obj<>endobj -1151 0 obj<>endobj -1152 0 obj<>endobj -1153 0 obj<>endobj -1154 0 obj<>endobj -1155 0 obj<>endobj -1156 0 obj<>endobj -1157 0 obj<>endobj -1158 0 obj<>endobj -1159 0 obj<>endobj -1160 0 obj<>endobj -1161 0 obj<>endobj -1162 0 obj<>endobj -1163 0 obj<>endobj -1164 0 obj<>endobj -1165 0 obj<>endobj -1166 0 obj<>endobj -1167 0 obj<>endobj -1168 0 obj<>endobj -1169 0 obj<>endobj -1170 0 obj<>endobj -1171 0 obj<>endobj -1172 0 obj<>endobj -1173 0 obj<>endobj -1174 0 obj<>endobj -1175 0 obj<>endobj -1176 0 obj<>endobj -1177 0 obj<>endobj -1178 0 obj<>endobj -1179 0 obj<>endobj -1180 0 obj<>endobj -1181 0 obj<>endobj -1182 0 obj<>endobj -1183 0 obj<>endobj -1184 0 obj<>endobj -1185 0 obj<>endobj -1186 0 obj<>endobj -1187 0 obj<>endobj -1188 0 obj<>endobj -1189 0 obj<>endobj -1190 0 obj<>endobj -1191 0 obj<>endobj -1192 0 obj<>endobj -1193 0 obj<>endobj -1194 0 obj<>endobj -1195 0 obj<>endobj -1196 0 obj<>endobj -1197 0 obj<>endobj -1198 0 obj<>endobj -1199 0 obj<>endobj -1200 0 obj<>endobj -1201 0 obj<>endobj -1202 0 obj<>endobj -1203 0 obj<>endobj -1204 0 obj<>endobj -1205 0 obj<>endobj -1206 0 obj<>endobj -1207 0 obj<>endobj -1208 0 obj<>endobj -1209 0 obj<>endobj -1210 0 obj<>endobj -1211 0 obj<>endobj -1212 0 obj<>endobj -1213 0 obj<>endobj -1214 0 obj<>endobj -1215 0 obj<>endobj -1216 0 obj<>endobj -1217 0 obj<>endobj -1218 0 obj<>endobj -1219 0 obj<>endobj -1220 0 obj<>endobj -1221 0 obj<>endobj -1222 0 obj<>endobj -1223 0 obj<>endobj -1224 0 obj<>endobj -1225 0 obj<>endobj -1226 0 obj<>endobj -1227 0 obj<>endobj -1228 0 obj<>endobj -1229 0 obj<>endobj -1230 0 obj<>endobj -1231 0 obj<>endobj -1232 0 obj<>endobj -1233 0 obj<>endobj -1234 0 obj<>endobj -1235 0 obj<>endobj -1236 0 obj<>endobj -1237 0 obj<>endobj -1238 0 obj<>endobj -1239 0 obj<>endobj -1240 0 obj<>endobj -1241 0 obj<>endobj -1242 0 obj<>endobj -1243 0 obj<>endobj -1244 0 obj<>endobj -1245 0 obj<>endobj -1246 0 obj<>endobj -1247 0 obj<>endobj -1248 0 obj<>endobj -1249 0 obj<>endobj -1250 0 obj<>endobj -1251 0 obj<>endobj -1252 0 obj<>endobj -1253 0 obj<>endobj -1254 0 obj<>endobj -1255 0 obj<>endobj -1256 0 obj<>endobj -1257 0 obj<>endobj -1258 0 obj<>endobj -1259 0 obj<>endobj -1260 0 obj<>endobj -1261 0 obj<>endobj -1262 0 obj<>endobj -1263 0 obj<>endobj -1264 0 obj<>endobj -1265 0 obj<>endobj -1266 0 obj<>endobj -1267 0 obj<>endobj -1268 0 obj<>endobj -1269 0 obj<>endobj -1270 0 obj<>endobj -1271 0 obj<>endobj -1272 0 obj<>endobj -1273 0 obj<>endobj -1274 0 obj<>endobj -1275 0 obj<>endobj -1276 0 obj<>endobj -1277 0 obj<>endobj -1278 0 obj<>endobj -1279 0 obj<>endobj -1280 0 obj<>endobj -1281 0 obj<>endobj -1282 0 obj<>endobj -1283 0 obj<>endobj -1284 0 obj<>endobj -1285 0 obj<>endobj -1286 0 obj<>endobj -1287 0 obj<>endobj -1288 0 obj<>endobj -1289 0 obj<>endobj -1290 0 obj<>endobj -1291 0 obj<>endobj -1292 0 obj<>endobj -1293 0 obj<>endobj -1294 0 obj<>endobj -1295 0 obj<>endobj -1296 0 obj<>endobj -1297 0 obj<>endobj -1298 0 obj<>endobj -1299 0 obj<>endobj -1300 0 obj<>endobj -1301 0 obj<>endobj -1302 0 obj<>endobj -1303 0 obj<>endobj -1304 0 obj<>endobj -1305 0 obj<>endobj -1306 0 obj<>endobj -1307 0 obj<>endobj -1308 0 obj<>endobj -1309 0 obj<>endobj -1310 0 obj<>endobj -1311 0 obj<>endobj -1312 0 obj<>endobj -1313 0 obj<>endobj -1314 0 obj<>endobj -1315 0 obj<>endobj -1316 0 obj<>endobj -1317 0 obj<>endobj -1318 0 obj<>endobj -1319 0 obj<>endobj -1320 0 obj<>endobj -1321 0 obj<>endobj -1322 0 obj<>endobj -1323 0 obj<>endobj -1324 0 obj<>endobj -1325 0 obj<>endobj -1326 0 obj<>endobj -1327 0 obj<>endobj -1328 0 obj<>endobj -1329 0 obj<>endobj -1330 0 obj<>endobj -1331 0 obj<>endobj -1332 0 obj<>endobj -1333 0 obj<>endobj -1334 0 obj<>endobj -1335 0 obj<>endobj -1336 0 obj<>endobj -1337 0 obj<>endobj -1338 0 obj<>endobj -1339 0 obj<>endobj -1340 0 obj<>endobj -1341 0 obj<>endobj -1342 0 obj<>endobj -1343 0 obj<>endobj -1344 0 obj<>endobj -1345 0 obj<>endobj -1346 0 obj<>endobj -1347 0 obj<>endobj -1348 0 obj<>endobj -1349 0 obj<>endobj -1350 0 obj<>endobj -1351 0 obj<>endobj -1352 0 obj<>endobj -1353 0 obj<>endobj -1354 0 obj<>endobj -1355 0 obj<>endobj -1356 0 obj<>endobj -1357 0 obj<>endobj -1358 0 obj<>endobj -1359 0 obj<>endobj -1360 0 obj<>endobj -1361 0 obj<>endobj -1362 0 obj<>endobj -1363 0 obj<>endobj -1364 0 obj<>endobj -1365 0 obj<>endobj -1366 0 obj<>endobj -1367 0 obj<>endobj -1368 0 obj<>endobj -1369 0 obj<>endobj -1370 0 obj<>endobj -1371 0 obj<>endobj -1372 0 obj<>endobj -1373 0 obj<>endobj -1374 0 obj<>endobj -1375 0 obj<>endobj -1376 0 obj<>endobj -1377 0 obj<>endobj -1378 0 obj<>endobj -1379 0 obj<>endobj -1380 0 obj<>endobj -1381 0 obj<>endobj -1382 0 obj<>endobj -1383 0 obj<>endobj -1384 0 obj<>endobj -1385 0 obj<>endobj -1386 0 obj<>endobj -1387 0 obj<>endobj -1388 0 obj<>endobj -1389 0 obj<>endobj -1390 0 obj<>endobj -1391 0 obj<>endobj -1392 0 obj<>endobj -1393 0 obj<>endobj -1394 0 obj<>endobj -1395 0 obj<>endobj -1396 0 obj<>endobj -1397 0 obj<>endobj -1398 0 obj<>endobj -1399 0 obj<>endobj -1400 0 obj<>endobj -1401 0 obj<>endobj -1402 0 obj<>endobj -1403 0 obj<>endobj -1404 0 obj<>endobj -1405 0 obj<>endobj -1406 0 obj<>endobj -1407 0 obj<>endobj -1408 0 obj<>endobj -1409 0 obj<>endobj -1410 0 obj<>endobj -1411 0 obj<>endobj -1412 0 obj<>endobj -1413 0 obj<>endobj -1414 0 obj<>endobj -1415 0 obj<>endobj -1416 0 obj<>endobj -1417 0 obj<>endobj -1418 0 obj<>endobj -1419 0 obj<>endobj -1420 0 obj<>endobj -1421 0 obj<>endobj -1422 0 obj<>endobj -1423 0 obj<>endobj -1424 0 obj<>endobj -1425 0 obj<>endobj -1426 0 obj<>endobj -1427 0 obj<>endobj -1428 0 obj<>endobj -1429 0 obj<>endobj -1430 0 obj<>endobj -1431 0 obj<>endobj -1432 0 obj<>endobj -1433 0 obj<>endobj -1434 0 obj<>endobj -1435 0 obj<>endobj -1436 0 obj<>endobj -1437 0 obj<>endobj -1438 0 obj<>endobj -1439 0 obj<>endobj -1440 0 obj<>endobj -1441 0 obj<>endobj -1442 0 obj<>endobj -1443 0 obj<>endobj -1444 0 obj<>endobj -1445 0 obj<>endobj -1446 0 obj<>endobj -1447 0 obj<>endobj -1448 0 obj<>endobj -1449 0 obj<>endobj -1450 0 obj<>endobj -1451 0 obj<>endobj -1452 0 obj<>endobj -1453 0 obj<>endobj -1454 0 obj<>endobj -1455 0 obj<>endobj -1456 0 obj<>endobj -1457 0 obj<>endobj -1458 0 obj<>endobj -1459 0 obj<>endobj -1460 0 obj<>endobj -1461 0 obj<>endobj -1462 0 obj<>endobj -1463 0 obj<>endobj -1464 0 obj<>endobj -1465 0 obj<>endobj -1466 0 obj<>endobj -1467 0 obj<>endobj -1468 0 obj<>endobj -1469 0 obj<>endobj -1470 0 obj<>endobj -1471 0 obj<>endobj -1472 0 obj<>endobj -1473 0 obj<>endobj -1474 0 obj<>endobj -1475 0 obj<>endobj -1476 0 obj<>endobj +1143 0 obj<>endobj +1144 0 obj<>endobj +1145 0 obj<>endobj +1146 0 obj<>endobj +1147 0 obj<>endobj +1148 0 obj<>endobj +1149 0 obj<>endobj +1150 0 obj<>endobj +1151 0 obj<>endobj +1152 0 obj<>endobj +1153 0 obj<>endobj +1154 0 obj<>endobj +1155 0 obj<>endobj +1156 0 obj<>endobj +1157 0 obj<>endobj +1158 0 obj<>endobj +1159 0 obj<>endobj +1160 0 obj<>endobj +1161 0 obj<>endobj +1162 0 obj<>endobj +1163 0 obj<>endobj +1164 0 obj<>endobj +1165 0 obj<>endobj +1166 0 obj<>endobj +1167 0 obj<>endobj +1168 0 obj<>endobj +1169 0 obj<>endobj +1170 0 obj<>endobj +1171 0 obj<>endobj +1172 0 obj<>endobj +1173 0 obj<>endobj +1174 0 obj<>endobj +1175 0 obj<>endobj +1176 0 obj<>endobj +1177 0 obj<>endobj +1178 0 obj<>endobj +1179 0 obj<>endobj +1180 0 obj<>endobj +1181 0 obj<>endobj +1182 0 obj<>endobj +1183 0 obj<>endobj +1184 0 obj<>endobj +1185 0 obj<>endobj +1186 0 obj<>endobj +1187 0 obj<>endobj +1188 0 obj<>endobj +1189 0 obj<>endobj +1190 0 obj<>endobj +1191 0 obj<>endobj +1192 0 obj<>endobj +1193 0 obj<>endobj +1194 0 obj<>endobj +1195 0 obj<>endobj +1196 0 obj<>endobj +1197 0 obj<>endobj +1198 0 obj<>endobj +1199 0 obj<>endobj +1200 0 obj<>endobj +1201 0 obj<>endobj +1202 0 obj<>endobj +1203 0 obj<>endobj +1204 0 obj<>endobj +1205 0 obj<>endobj +1206 0 obj<>endobj +1207 0 obj<>endobj +1208 0 obj<>endobj +1209 0 obj<>endobj +1210 0 obj<>endobj +1211 0 obj<>endobj +1212 0 obj<>endobj +1213 0 obj<>endobj +1214 0 obj<>endobj +1215 0 obj<>endobj +1216 0 obj<>endobj +1217 0 obj<>endobj +1218 0 obj<>endobj +1219 0 obj<>endobj +1220 0 obj<>endobj +1221 0 obj<>endobj +1222 0 obj<>endobj +1223 0 obj<>endobj +1224 0 obj<>endobj +1225 0 obj<>endobj +1226 0 obj<>endobj +1227 0 obj<>endobj +1228 0 obj<>endobj +1229 0 obj<>endobj +1230 0 obj<>endobj +1231 0 obj<>endobj +1232 0 obj<>endobj +1233 0 obj<>endobj +1234 0 obj<>endobj +1235 0 obj<>endobj +1236 0 obj<>endobj +1237 0 obj<>endobj +1238 0 obj<>endobj +1239 0 obj<>endobj +1240 0 obj<>endobj +1241 0 obj<>endobj +1242 0 obj<>endobj +1243 0 obj<>endobj +1244 0 obj<>endobj +1245 0 obj<>endobj +1246 0 obj<>endobj +1247 0 obj<>endobj +1248 0 obj<>endobj +1249 0 obj<>endobj +1250 0 obj<>endobj +1251 0 obj<>endobj +1252 0 obj<>endobj +1253 0 obj<>endobj +1254 0 obj<>endobj +1255 0 obj<>endobj +1256 0 obj<>endobj +1257 0 obj<>endobj +1258 0 obj<>endobj +1259 0 obj<>endobj +1260 0 obj<>endobj +1261 0 obj<>endobj +1262 0 obj<>endobj +1263 0 obj<>endobj +1264 0 obj<>endobj +1265 0 obj<>endobj +1266 0 obj<>endobj +1267 0 obj<>endobj +1268 0 obj<>endobj +1269 0 obj<>endobj +1270 0 obj<>endobj +1271 0 obj<>endobj +1272 0 obj<>endobj +1273 0 obj<>endobj +1274 0 obj<>endobj +1275 0 obj<>endobj +1276 0 obj<>endobj +1277 0 obj<>endobj +1278 0 obj<>endobj +1279 0 obj<>endobj +1280 0 obj<>endobj +1281 0 obj<>endobj +1282 0 obj<>endobj +1283 0 obj<>endobj +1284 0 obj<>endobj +1285 0 obj<>endobj +1286 0 obj<>endobj +1287 0 obj<>endobj +1288 0 obj<>endobj +1289 0 obj<>endobj +1290 0 obj<>endobj +1291 0 obj<>endobj +1292 0 obj<>endobj +1293 0 obj<>endobj +1294 0 obj<>endobj +1295 0 obj<>endobj +1296 0 obj<>endobj +1297 0 obj<>endobj +1298 0 obj<>endobj +1299 0 obj<>endobj +1300 0 obj<>endobj +1301 0 obj<>endobj +1302 0 obj<>endobj +1303 0 obj<>endobj +1304 0 obj<>endobj +1305 0 obj<>endobj +1306 0 obj<>endobj +1307 0 obj<>endobj +1308 0 obj<>endobj +1309 0 obj<>endobj +1310 0 obj<>endobj +1311 0 obj<>endobj +1312 0 obj<>endobj +1313 0 obj<>endobj +1314 0 obj<>endobj +1315 0 obj<>endobj +1316 0 obj<>endobj +1317 0 obj<>endobj +1318 0 obj<>endobj +1319 0 obj<>endobj +1320 0 obj<>endobj +1321 0 obj<>endobj +1322 0 obj<>endobj +1323 0 obj<>endobj +1324 0 obj<>endobj +1325 0 obj<>endobj +1326 0 obj<>endobj +1327 0 obj<>endobj +1328 0 obj<>endobj +1329 0 obj<>endobj +1330 0 obj<>endobj +1331 0 obj<>endobj +1332 0 obj<>endobj +1333 0 obj<>endobj +1334 0 obj<>endobj +1335 0 obj<>endobj +1336 0 obj<>endobj +1337 0 obj<>endobj +1338 0 obj<>endobj +1339 0 obj<>endobj +1340 0 obj<>endobj +1341 0 obj<>endobj +1342 0 obj<>endobj +1343 0 obj<>endobj +1344 0 obj<>endobj +1345 0 obj<>endobj +1346 0 obj<>endobj +1347 0 obj<>endobj +1348 0 obj<>endobj +1349 0 obj<>endobj +1350 0 obj<>endobj +1351 0 obj<>endobj +1352 0 obj<>endobj +1353 0 obj<>endobj +1354 0 obj<>endobj +1355 0 obj<>endobj +1356 0 obj<>endobj +1357 0 obj<>endobj +1358 0 obj<>endobj +1359 0 obj<>endobj +1360 0 obj<>endobj +1361 0 obj<>endobj +1362 0 obj<>endobj +1363 0 obj<>endobj +1364 0 obj<>endobj +1365 0 obj<>endobj +1366 0 obj<>endobj +1367 0 obj<>endobj +1368 0 obj<>endobj +1369 0 obj<>endobj +1370 0 obj<>endobj +1371 0 obj<>endobj +1372 0 obj<>endobj +1373 0 obj<>endobj +1374 0 obj<>endobj +1375 0 obj<>endobj +1376 0 obj<>endobj +1377 0 obj<>endobj +1378 0 obj<>endobj +1379 0 obj<>endobj +1380 0 obj<>endobj +1381 0 obj<>endobj +1382 0 obj<>endobj +1383 0 obj<>endobj +1384 0 obj<>endobj +1385 0 obj<>endobj +1386 0 obj<>endobj +1387 0 obj<>endobj +1388 0 obj<>endobj +1389 0 obj<>endobj +1390 0 obj<>endobj +1391 0 obj<>endobj +1392 0 obj<>endobj +1393 0 obj<>endobj +1394 0 obj<>endobj +1395 0 obj<>endobj +1396 0 obj<>endobj +1397 0 obj<>endobj +1398 0 obj<>endobj +1399 0 obj<>endobj +1400 0 obj<>endobj +1401 0 obj<>endobj +1402 0 obj<>endobj +1403 0 obj<>endobj +1404 0 obj<>endobj +1405 0 obj<>endobj +1406 0 obj<>endobj +1407 0 obj<>endobj +1408 0 obj<>endobj +1409 0 obj<>endobj +1410 0 obj<>endobj +1411 0 obj<>endobj +1412 0 obj<>endobj +1413 0 obj<>endobj +1414 0 obj<>endobj +1415 0 obj<>endobj +1416 0 obj<>endobj +1417 0 obj<>endobj +1418 0 obj<>endobj +1419 0 obj<>endobj +1420 0 obj<>endobj +1421 0 obj<>endobj +1422 0 obj<>endobj +1423 0 obj<>endobj +1424 0 obj<>endobj +1425 0 obj<>endobj +1426 0 obj<>endobj +1427 0 obj<>endobj +1428 0 obj<>endobj +1429 0 obj<>endobj +1430 0 obj<>endobj +1431 0 obj<>endobj +1432 0 obj<>endobj +1433 0 obj<>endobj +1434 0 obj<>endobj +1435 0 obj<>endobj +1436 0 obj<>endobj +1437 0 obj<>endobj +1438 0 obj<>endobj +1439 0 obj<>endobj +1440 0 obj<>endobj +1441 0 obj<>endobj +1442 0 obj<>endobj +1443 0 obj<>endobj +1444 0 obj<>endobj +1445 0 obj<>endobj +1446 0 obj<>endobj +1447 0 obj<>endobj +1448 0 obj<>endobj +1449 0 obj<>endobj +1450 0 obj<>endobj +1451 0 obj<>endobj +1452 0 obj<>endobj +1453 0 obj<>endobj +1454 0 obj<>endobj +1455 0 obj<>endobj +1456 0 obj<>endobj +1457 0 obj<>endobj +1458 0 obj<>endobj +1459 0 obj<>endobj +1460 0 obj<>endobj +1461 0 obj<>endobj +1462 0 obj<>endobj +1463 0 obj<>endobj +1464 0 obj<>endobj +1465 0 obj<>endobj +1466 0 obj<>endobj +1467 0 obj<>endobj +1468 0 obj<>endobj +1469 0 obj<>endobj +1470 0 obj<>endobj +1471 0 obj<>endobj -1477 0 obj<>/XObject<<>>>>>>endobj -1478 0 obj<>stream +1472 0 obj<>/XObject<<>>>>>>endobj +1473 0 obj<>stream x+2T0BCs#c3\..}7K#4K=3cS`g`NvurT(JM.QpO.M+I, r endstream endobj -1479 0 obj<>/XObject<<>>>>/Annots 59 0 R>>endobj -1480 0 obj<>stream +1474 0 obj<>/XObject<<>>>>/Annots 59 0 R>>endobj +1475 0 obj<>stream x[rG}WLe==WiKl|'EYI_~n4Co[Ttx4@c&}ΒJG //闤*F2GڃE2~d2g2qv`E`Ir3aVH2W0๚ DT9es줴9EC-`D9 3|#tH\II$嘔O+@ sL$)#pEr^Nh>[Fe$4@ @` vTX~)Z 6A' vVP,Pf`+:nqf>y9' 8a0-?I ,JvyA蹚2m[6r~Tb#="k.J{0g+} DU<'+g`PE9Qŏ+iYQ%1E`r`qdʊ4s ͔30((9G%wTD%g\5DF)D@8F5,|3`(|Jk0XԏV`awX܎ܯ$ՙ-*Je1/JX"wZD}j!Y@2"8b=rRDΪ`>"G#r OB $iF- +U32y'YV$VzI g 4I5YNZ vDr:3Z@ @@ -2513,107 +2505,112 @@ x )آG{T_~7~bBSGKgv;|5c٭5y<]_6@h'Oh^tmԹOKqq"wg_'yp9-dJmc{P̄u2Lw%ߢΖ41Jg#U^AV"h}-ۭ|8JժݭxP !/^7f9%#[O (l^ʦA ߚD7Yp{f&؛ Xdu}W$godd$: zo_um]WݜN޼:h ۔pLZB}p{լx4FNe+??~' zni MX~F޵P\ `Se3EQ!5{ vɕ4Qu^Ǜ2>Oɇ٦]촻u?Z!%ܿ8JĉM%!qŏ^v]`TͶ9o;E RvI}Uߵ~uQ/MU~U~nF_h=;5>Jk;t> -_ѹEÌה^//>C(p5 ^x ߏ_?swZ>_M߮9.u 98 eO~Y\(5*.r̗u|iSQܫჅv"eiPC3dKY\*ozzsWzƻZMa;ʧvrzI_tT9G6|_t BHxrwI{H^P-ٔC-^rgD?z]Qyg҆_BY+A)DdPj0s{0>*`;]lxeN"j'=-07yɡoc Ëg6Ywُ8C3^ԃcfr3i쩰om}ePCgH8kgm)>,uûYN yB^]ԸfzH=~i ƔVЍOÞ^2/l:oACݮ;3(`*G\x-ﲂ0CIϿ6k~Vis 9>Ș|Rޱzv& N5_w{~$dE,U/~v>3Kzhu:ɣnendstream endobj -1481 0 obj<>/XObject<<>>>>/Annots 102 0 R>>endobj -1482 0 obj<>stream -x[]o[}C<$RJlR>((C!8=gvwf.Imi 8<<ܽ;W?)/~Um6?{9oyV {E;_n󬨪1;mT `G -rRd#˲@60rE1Y\m0WJdž0V=4rZ%e`3lq`:0qEއ}s`}XY4lC=Xc8JH`D(j>TI^X)رcI4cU=rvYUAP) 8γ8Bс+jP٠5m#0 6l` -7R}˵:8\ ss "`C s - sj8Fc2NBP1SPc;0XiZ,Q7hN!r:r*?$ #*Pc,WY1gT `9I.1ضmhxdY쑑 PA>r()ZüX6W--D~IcE\ju,kj ӊ%N8ёAeÇqrE+ei=FTB1غ1X6pi Mz ;3!X"IqAa9 %|RcȪ}: f: 9ڵٍ,CueIccœ -tK\oOyD CUE1!6r!փ* F.Tc*zulôXJHu4 -ԙÂN4Ul;ar⑒lXXaXi+bIXj?aCq0,)hzL;cu`؇i}(7qEmWc]aquX6I:3q"WjH`D"C=X{a.0u;ˊ N'r"%%=Ƃ!Eم3a}V4uDZCX>3ǖM8H @=6qr2A<y:Y8 D5$ BR -EbYT"s3:c.IƆ` Lb) &E\Jznu\.c =ix6ˤ3a0TA.)1Xb`*6aZgNQ68[àP9n!^I1m.`@?cxMʒ(s!]R8-ذ46DXJUQ+K1@pcf*b-`LETcYK> -Ygy0‰=RPP:3S؄g=*Xv̬Yq9 >A8q\7suw % >=*qC= )E= CI<1X)m`aXþ%}}KVEj=F1XXg%<>UcBoP#yd_k<lȅBȰ9]d#'8iѧ<`0&ca cXn1XgEDŦs%̢=5|3%FKxRRNC3q!׵3H:VdAp&nyq"] -( 3 Rpvf3q&<'fJ3)Nl(c!3pN ` C[̏3K99'KgrkqƭA7KVST峪22@KPӣ20*fK)b:qOйOpꧻg4 GߔEx| άM60؈BpRN8\$F&V s~Bp4 8"•'g.2A_1eHUAp0"0ጋ:U9ОƑF9PW DChr{~ yvv)GԼ~]=%?=&2;Z.6fٯQpOvPrӣfoXD$Oǯ0$7j..h3].cDa? mF$<cx8tPb%c(Μv:.oНh5bx:*ms-:2~;#lQѤ 7u9]EqVƽ{%w]wu\w O(5FS8̟1M( q$}[ *~5YWQ2 6LL&Ne_fG&d'[,v\pIJ,Ur._"r}ԲfbcIN7K2`/ιj|7?ǯD!ǛTT`=I^w/8ND#U\~b\ > -`qx=@Mf8觨qIettތf3KhS1; -r(;Ȯ)vń^lVˋ۱_'=U.R4( -^/ءە(z)Ug(vvt#Uhu) $0-KU5>{@/ɃZ<݌UMΖ`CW8yq?dl%H{@s -?,HT uǓy>oyIa>qK`EgLt݋UmhZfQDtJ|l˴>U,;і@0n}+MCh~.*NeH ڳV8U::m嗧zC*?NG!([O8 l>p ;31=Gjުj -^]kc*57H.6p5Sp曆7.+y=2(ɉ%=\7|A!;ym_s3A% hB#jwΊwcp}zA_Njy\տyE%Z/}mr+΀怪r4OwRW#pQ'BoԡLtwco_ћgo߼m-6Lvu2gbxSLN7WuVQŐttko -zU0Omu0|ω|%XB&n8'fqKxP -FHcWڢ⡡w̶u>LNƬuL͝;טmqU6YFS;dv]Cp{ƫp>G `!-Jwukz*m2g*{B*JAUԋ\_O%'JvE-8h=],C3/Q;$G@-\BvbAbm< hVZ'] zxjKߦGTnr}w=Yhk~J5G1⚤br!u =U|ڿwQmw9 -/mB^X ptjb'c#Buj~&ಡV;>Eaa@ {\zlGyyI5̝,ːTjrc(}}θk4uOb(z4·tߎ\710-mr率k Lmk$%l|w<{q/! b"ߕěًu2 oqnF&BWrxOtendstream -endobj -1483 0 obj<>/XObject<<>>>>/Annots 146 0 R>>endobj -1484 0 obj<>stream -x[vG+zYHfs1hdbe2[-"[#N~.PUmtzBϏl-fG <ɚYٟf\fd\f]}^P;ˬo;.|2 cdԔ1Ffm /"-uF8F$62q1d^ʐF2~*f Ѡeg`0EI.L#h-0aq cl&-VdlfaF 4 )deNk[NNM9tR6"aN,$Q+!#Ux92DV ,a]>bkBLZL  j$c9aS^#N!'N!A X4- өJ7ZO'r]'+m f2XldzƆ!ܸ5Ymx6%롮5iFJOiSOTAȠIƢ^׹tT۶Ig /(e neQUV,FLZAU\K,ⶄEGm m% ha 6 -]۫%v*$cN׺e,”8-aFLgtiet#׊c#㕍AE I`Kq Wڠr.KNt-c8gU)**=꥙q }v -OJf#qA j"w% 3jKXLzGԩ 3Ϊ}m;[$C\h7ch;.rphgAQlC'6)c!%, --H,ab3cM. -qdP}S%,Šo$0X#0&<(ۆ)a4 >)b hC )t6 Z(>A_U=ĆnЌPF.G~U31Ş`6tD7Vw XTTذ+jl@tvEѫqѩdN2lmMXb(Gg`g``Dm c ĞEOx_b /\Y`qzV#L._iUGP'71XD,XYg +ng Cy!j21ز,-a x3aLX`X"`5UĈ .v IƲrK, -"ʙ%, $LXHLgG,% E*:cSO)@L V),*Y`D,aV6=qO mxjUjѨoSHdԆqih(च8 -9$ѿmh8JC$7 \2n-d`վCєdxƩ/ZVСMF5[-J!:8UR(]ZhRPsDd)sg$NBz fo4ήkWӫy6ɞ |'ȥՙhvVHL#trU֝#4 ty5՗bU饩 .HZLd 9CJ(J~~t3P+ٰ[h]qYOl>kVoww`\tfֿ ;H$c}6v> 7$yMsu+38S?ھVLRشw#9җٰ[C:-3qd Ίwf~?z=ZQT'y6kw9ߨ֥Pcun_q"E2ڍ7N$|8`]w`˳1Yp׎=fy5]g)i0 55~%5Z,Fu0Td ^]VҨ%2m❼N?%ڪS/ql(* 7:+! R`bs,=:QFfA9? 9*65 :>JCJ\x5lQNgAV%!+OEFqw#bo~}:[j']:7!`|m8֎MGf>ۭ[ iG;i+#׺M~ZO4Eypz..Vf(iI2 ow¢0\m2!n,jw4 ePT0ˏ ]y bJ. $*my/ކ i|~X ٧y~|xCϫf?.ڂ\?y;_]BoRY j $Ovgvߡ/<|S%iw[>Qf77j㗋W ꩀSߝ$(P;GX2ۚ PBy鯱QԃVt4,/~,W.t{ -YE6:td:b- u -W Ʀ. ֓ƥt·D|^svXk.G[<$+5>89{CEJY)}kMxʧIn>ɾ[?aeχntduw:|?X,dS*endstream -endobj -1485 0 obj<>/XObject<<>>>>/Annots 189 0 R>>endobj -1486 0 obj<>stream -x[r }WCp=SD)Kňt)U< Krm.)fv)ɒvR3 43,I,i򤨓Y:I藤.;w$ >x"I8I[O*9H2lYc^$y l Y٤t3{ ;u`z sQ -C`VA(?I`5aXd0:;c2T;d۔Ca2{,s ``\P]IƊ)XQXƊ)ؠC٢3a2EMg0E)KqUu)(h\E8KFNe`vv`:a肙Hmf%RyL(aS& #@&rqBմ,s,Yw[2pYҴJ쑅`_eeڪ6ׯشk)s=Ez[jli7OyӔeD20 xr.VAzAQcUF.dp!΄z 6oc=[W :`^*~iJױz?2UT!Q3J#))HN8; !E"EX7BD,I\1 ^ၸ-F2ڜ$C@2KHlCMqhlnRNJMP%bRfq5"}ml K=%Oư_m!~)İH8z>]6HUW{/CQMyf;[(P -=w8\ur9rR 1\X8PC;G:8+qlZ"U SێNp>!I^M{X wQ3ȭF|ҭtC)5Zya/M(T'G|v0{[ip '}Ai\!=?Ӣn ?@uE~ -j3;@jA*>-\̶Qip9M5EĊVCpHᘌB^Fh7sJ 0D1Z1jp5ww>( ů`hEg+3`%O|?{sFX5 -|x5Q!|S$y`WeƩjuىP35y챎f'ɋww= 2ԜCyH+y޺E>&ı~eS垧>z -X%m%ƌdsoYc>刺-ێ!;u&*垒i79fqŹMXkC~rmϡnɋ9:^)A9cԍ<*i3l.W4Aj2PB:[vR`^›ΣnmОE8QB&*2;p >/G25QU۟ -.xǺJ9>Ġ9/-WO@'n &D&$<ěV -Z9Vf#IVϏaW@aGAI_COt R]3.N_??M׫gmrh Ԭhx|f?{;endstream -endobj -1487 0 obj<>/XObject<<>>>>/Annots 234 0 R>>endobj -1488 0 obj<>stream -x[Ms9W1{:m9&I^RDR{ayH-9*v*$A %uU2YHG)IRcHy0O._HrTE2G \$.O`k7*LSIA[Ր5lYjӳ`zTZ`,[=cX0/G LX6 -ȄLCNe1< EIi!ch 6\SМ)g ,lUӐڴ,V9&/y@C6`RaYVT5ĉIKDbҰIErMDM8 Ub U5lY5,`eY!p80($lJZL"-R,iF[^s..$yLvhFc [CaX֥ P] -'") + -D!sh Ұ$ Ćs0{JZL#7`k -?>` m=äDRfCCh`v%I q@Iz i#i1YF4`{`y#mYͼ)yR#\IѭذmGVRIA=F$[34(-(` yudE$@;gEg33z륤Ť'Eb`#m,ϳ>Рd҆Loi1 ȸ5,63hd 7 h[">#e`Ml[v2ѢP@RI6kXb!vl1ؚgNYEgȧ*^\!lB`# #ӀgV&$Z*8>re")ʄaYeYx1,+y%ejg 2SHZ ; n-[`UEn QȲ ^=WE *9^9ѩ(`Y"h,k0 gˊ)1(g H\4ϑ3C"Gb`Ȋ@Mh @M0Sbm{ CM W}f9 B;!3 -ƈYM#jN55S!0n9I_3%-F=`p*̋A&}S82$"qҐG< >@ y *aGõ$7Ćs36[Al9nsIE)m`s %y?: oi1XlaZ gG +& &#~hmGАAl9(VȡHZ~eUze"P$2[`*r$:V<ã*I|0&"F 9dP]+M7u~-g7no&~Ƀ@q:-#_ +J~񰦲jp,O"`J v=[SƅH[5-X.Ҫa9dq[) J^7va igݾs~+t9T"*qܬv<}-7 -`Z?Je]ES_7fN$f,EE f+FU Up*~Z(~G"NZ'.[/p~MTcuT}W_d+uPn<#vkgl O]T[f gZṂ4tFdA?)ȃ(ԕf&~'8 [=&~17ϴQĖ0@ %v? !æ@'.g?Fu?_LU3' jq\'[q/٤ ;@ӷ2Kɟq)BOxbԙ)*noylqX.9hǟ%uJI*!8)}ѭs LXL^;QVTQCա O jt\oJDG>5nofە617 {3U!й -48X>/?܋pxk?8g:g;n :8(pE~Ȣ;Z?^X^%_olJr11.yyvj CߪyaXœ9o78u'g:|cwggQҜ8ieF奓\pIas LuKOqۢA [9S N+*i=\|*DP˅GlV+;-s&~k+;eH\+ٌMљ1Fg5"3)CHPcQc'N"Hdy*|RC\df68TDF_ipKUUy#lQ;W &SieqDEu1.D:XjzĉtOz[~vs٘>ɰfvy'6&~Jҏ❦M؟>\ -3{l;V aw'%~ͿVV:OI*|Uogzp.3q-"7CWڊn68ǒ^Qp5W>a ehg_lWq;ು?}~:,zijҸQ(2~A5@" &%ICREc| ^{=ftB67oZ_EUznd"vsR8(*^.[S5^ iאT"C ܩ?P3O(#h`#J)GHNO䩼Ul?ش#f\ZfE C;kg7_ww1K1BP̞k ]w5^+k+zXO%Gx v99oyq߇_?_s:y尧33QR^Ӧ{$Mj.'*l l23Ƀ+R&(9 :}gIA>˄uȿ-\/TzSMTbgB|4IQ}W j?yOtv9.\ ytL?d^]bendstream -endobj -1489 0 obj<>/XObject<<>>>>/Annots 277 0 R>>endobj -1490 0 obj<>stream -x[MsW!UBj0sJiثGL9ރ/#rdq#re{@PtB*IՖ֓̐U&8i-\]Z Q3r)K3 rg1rI6!a@ Ɗ˷$ S>v3pt>rR \? Y`F%Ehm@zL>h;ayrb0+i1XtY%sp2r&$dfC@C8pvaK"-&i=5,Nc[r%IJ=E9萃 C?,&bUIL4Q2O;%ڱy~^ i T6NGa#FF9Hq~TII"4N#$UV.FBppCfZN!<:_vWSg'#@p0cg 8xn 8L*8)pe!E*)RJb;a,?6,DLhXψa#e`0rlЎ-`XذX2r*dž _0J -B+iy* 03:0r -SN!Sm)|O!3 Kql''ɼy"ixVXAe)ɰ\)$5B2,N!RD2>aHƣS @LɌ N?a2m;9f,(2ÉǕYj2 D9r -xHáyHƣB2m[)$Q5+r2.kiRN!&Cj p3` Mtcu dirq$+ºH.\ӋOlXoohmQo6ɨӳvo7K@,)}CE,|uˎoa8Ų2wwn0rutEU+|w} aj"en/jIcd4IUt*:꾲JuGrZ>>`^Or/'}:-j. ?77kNX龐JaSթ-?>׋WS3jv3Q(F`,C\rBbG2[9JӬYc;ޯk!5Rv69\?mU6٦^;Y\w/7-M-d 72ދlypu8wFD9y6F릢uܶ?,׋ {*Tm-o}(dMPͲA9x=~K49HdtLzL7QqW?-= b!u8% 躯wF\T1C4"d=U^tak\Pv3\˔!-T]e$+ʬ]_%vd`!u+ v ɯ˞S]ʡfy)lQQbú [׷njInf(bdl7ibP7V;0fXϷaM EBh;;o pJ;^k9V&]/j{ -@ Q{6v٠(uYa7jK86WTPݲJ؈Bh܆Ɛy_>bps AEzkS.o=-Hbs8-5ȍS bnwL{i-B0fT1xbnRv~]/%H -Evg{p^>\wLQyg® Q1J NGN4?%BzOUȖǚl.9QvIu6#xi7yk@e6?ؾ/ic_/_tCG=:|+֌Gb?0e1 v˛6&BIߠuR=oJ5ՙhPk1;{CJi_hƠ -2UGzJ4;lZ7c%vҲwgD/~Y:6~ׯ.79aa̩c!+zoEfo԰Ooz2GqF kS9wxLܧR6jSݗy+v3!\e{e\BV2lfwtsvbbonnNpʚ#O+gB$=_uskRcdsU4d"YRѭsoA->]ro>> M崱*KFpS˄=6Φg}Mpڰ\Y('9^ZӒ?LPTb'ů3FD %>\pQo;ofsC3'X-S,R6%j}+/mAlN>_ r2Ճh_OD[( -]l+Ip j2l?(k_W?'/JۿzgPZ{vwп!X&χ -9(Sl#_Ӗ|^x'hendstream -endobj -1491 0 obj<>/XObject<<>>>>/Annots 319 0 R>>endobj -1492 0 obj<>stream -x[KsGW-كy?er"LSC1!tZ$YNM4@>˒fI'EVg$Г.;w$ `\9JjR;Uҥq,&#=94`z$c]7&QE!PU@r4tMaYKbYmj2G٪yY%mI MZslYd0؎=l^%yVM -7cuFX1'& \MR+1ӌYV$ߍul&a(zLdlNђD.+25cR0&M -KcS)pYKC%lY(l`yY0T(،7mT -ĬcR.qÌ|=VCIJ;(N@ -Nt#=&KD",8E FI!6ௌulM0!Km`;RCǵ)Bx "N4A+u`JƊkQ47W ̵CB ) " Jz 2aR0leyree)7ZNCےű -(XaKJ6I박D.K1&E,z,*B-"ɍu.Ia1XDaYVXzV\4E\8prE(6FYQE k4%eV#=[Pqäe: 1%K. d@J8.Y%%=ؒCXvʤQ[M8?pClC}cK6V̉A Ru"Uc~^ّ$mЖ-rŒV$ĵ8#G7m ^2[0p4Ah:C(+^Nn߆ +b&ȜN_d= }~xlعŗuB47+]0fX>qchq/8Yzmqѭ0I4mhl$4lKT+B|W~`Nْ7|_,5X6n p~cz'ju;NȲ&䟺⧮=hCUQ4MNdR.b&9Y9$FcgH/4op؃8m>  dauLϑzJWo~}b3/޻f-ejM8x3[ޠ؈VN:-=a qlaW0^e_p;f:_WYϽS3¡ {fvaMJ><&Կ.uEt-vv,sꖺɰbJ% mٳGۑbAj3[COPbW"'Sg=P܇]www>N'g^Y%áǹAOx~w3˦)i^eCӎ֛%3nqԥSAlѱgYq#~eP4pӸz3W(|.jn\7BpţHs؍ |N 2W>^Ϩzw)8ҍzaS h&~oRzI:Z.xќIjQ7ޑ5yyĴ-~)視{DuP9hadjf؈Yh/hc}m1}].t=] --*.`n9 G>h8ǧQkܺK  ȐN]sOUFEΝyie+d|92AZ :?ie|8Zq6! 8ia -5uķG!'Σ G etB ed'ۓ(,TfӤuo=*:{vdjXpX}c|ES?iG?%~_0\-UxI;z~ ~}yvendstream -endobj -1493 0 obj<>/XObject<<>>>>>>endobj -1494 0 obj<>stream +1476 0 obj<>/XObject<<>>>>/Annots 102 0 R>>endobj +1477 0 obj<>stream +x[]s[ } ~KGVV-e܇t(C!8= Dz-9mg^ `ثߟYY̪6ϟ?o7Y[<"Yvyy֯{7yVTUlН8U!v(XJ62,{`#W^JzLiX)m+s${h8mJft`⊼1us`}XY az l`бAA%N$0u"W54/gpTKX!R11lUc0tZ>6%9Ty6 -D1غ lZsFY0r 1`#FzC+%>Mǿ9ЧCr3WA̙7l#z ')T[K0HΩ㘑)8IA al*` : et:a$D福B,'99gs(1ZUV3##CrbҪKz -aYa{d3sP%Yk:kTF⊢/IzLY.0XHc]BS788[ĝsP;Lqz :L벤IU݈K@:d7cӧ^3 Hˆ̜z vkfJ?f,2*U+i3)972E^"rzbApt׎3{]8ԟKs:HEdt"UC) @og3kAp83Hpq-T>SH HgCC) 83%prN 8$3(gb~A_ + 8CAprqA!'4N,YuN1%fzėj6=~J+Q9=tv1]\EoDNlPp0AVoy6 Ӓlg.i1u/Vwǣj9EY+֫JMZ>jyD\TeA1qf'ѻRP(4Rr+T֌$=h%+q{qJ^sq)/ۦY~y'<R:H)zRd1/{1~mnrm܊ɖI&{Ujg8xBwE~'| +F){uҼYAKs[5%W.c|OVz,J9LH(//y +qhjyTSF pEY4{6gP0Mk:{]jDJ.,UJ 5AWy{lPZN4c}hޜ9&74;tO>ͦӣ6h͒Zj},N~ﺯ +g|y)j͙v4\Y0ghu:R{/0׭px펕:tݳwo0ه?RIlMl?gp*v]^':(ah_wY$/DŏչG<6Ǵ/e'%Oйî}j\OыN>⻤(n kz3[G `!Jwukz*m2*{6N1T>ash?eh2(\v E>΢l49JoqjK sv06 (mqU0Рׯv4)m*t}>av7wדoS~V䇣qMdr1}𺆞*>U/]T|{v۲Yz}siq-uw< pJ͖ +?5:ԩLރˆnX,=§zv`jc;V޿>ϓ<$_CI>؛|ZMnpl^3//syfiVEϰx&WAvξ?t5:&&%;w]ts- mW?%ۃO`g/7%?lFw%fCb~7؆ǷKF&BWzxO"endstream +endobj +1478 0 obj<>/XObject<<>>>>/Annots 145 0 R>>endobj +1479 0 obj<>stream +x\v+f,aޘENQv,:Aaϭ; ˒ %>֝骮WGy6?yYdh'!OeVv<#ˬ8lR +GpuhBe{1r<l#k+ױYǖƄY@F(QIAYn)r@& μjF * +יd Kޫ#6h7uA2J^j$cVb E4౤U>6, aABNX_RdbqT%,K鬾@0 ^3$cL \mC +|ȖǙ1-aZشoVO۝$B2VOEQǜYA2ROE1P_sN2f0XMwi,a1Ie S0K,;KF%0 2ff 3ZBxq,q1a)`a(퉜&_qe{rظ"P`JYPb^e tX`c $Yb#0){/cx1% (%Gt6;q$H\D.xd,[ X`Qcmb`!e$KX6H*6gGLȚCQp栊\(pUD.U`IF2Ƃ ;KX,aXT!X`aFKXnY`̄U61v,llPZWJ\C21u0X,Y`'М% aBl"2ak +sD / QI)FzБdX9Pq!d%$M$(H +б2,iCDgEk![9AP}P(5 +D25IKէe .'f,cmK,aQZ"PEM% Ec%8V49ީ@CԱ2# %@Qp`ѓHiRo%  *~g Cle >, I]"L8X1D51X/JT + 08Rg,Y MuO +Agի#s$B,L>2!e0(@`k"( ccsT^$9X$ +d|8@b!8\C0~$NG2k? E0 +Ʃ9L;qARIZC\Z9h4"G_ /g7ZqV^uru& 2g|-D&.zꏐ|WGSm]t#oɓe6=J'e/B*ܼ4xtյ, 8v)h!@)BvwRBQLBmWYCqRӉ:6} f,_=og߮jƅݾIBI|6x@Pt6wQ:5{{c,tKZ1.&ET Fַo]7u$?m>4`Q6Qִ){UŇv2$[ԇd^!Jb{+=)p 7%LLljH }/RN%41OA4Z 7|EhLɎ-Ґ fjXh|/c/$ )b_Ȗ6> zi/AD8ZZOq͝OVrDU qLd9q[>+7n ")TJ"wme~$E%.!F w/ +>ж9CobС_m3/qHv/\iȷ:žbFWӷhpN>mĻ'Jv@3OC|w8jFL +wڒ ٘Q ElMBĞ+' t bos~84?cB2"ieW1{*UXl#X(}5mXrkt|UrS2Ϯ%uC>^ߧЎĬq(з}~v9@5؍{u41O3X^h k>XL76軬>f4hL:Kr ;T6a2M '|tqi| ?NC$Y +q7'IEv}A.Q:[y7^{i\ڬ~?8mݸ7 +B *KTk[)48bg 0ro:~m\>KkQ)ڡz9hdvwLq'[қ#G[R]/a~+Uf <|PɫO~[5N[,_>ףmǚendstream +endobj +1480 0 obj<>/XObject<<>>>>/Annots 190 0 R>>endobj +1481 0 obj<>stream +x[s ~_q}Hg*{謹qNQ-yҙN(JJ xM%L.XB6ƿ!k򬨳x4/_eVtmveVUq.QHEo`c^f9f"y (zz iU7Rc,Qr'UQT S h^Y75AnT8cs,]Z-4!{baWY:-6rmI)Jz[jli7)KX90qq9W: [ Yyl`=up1Xmo` +: {Ry a|1Xv=ǒsVug)@4q!NG4Ű tVJf*ЊYds{֌*7AW$dBN&4eHÈaӰ 1LS"|)h5/Fz 0O4}26r!4PI1mUТ:LvűO -) X&Hv``G.HX$&uh~7a uԡ3cp$/Nԉ\K%=H8Ұm}aRoC`D3{ jHcPqÔSrxb&L``\5Pɨ`i΍uLAg%J<$G}$AL`)XRBp9:Uaz%=ƴp,j`X^(£袉dbǤK]0ؖ::LAG"RKg0.a %=Ƣ0؆~+68Ң lEPc +c&;`,;YwR'@%$ G8w0i#Jr'#EMܶ C0aJ6TYY4Ha/2E#'\(1-XI$r{:Lla( +PcL[X6T;alu,LX5yeuNwVG\dFz +gc&e;cecEFJ(HƊHi,\`VEXݝcEH cC#=ƴ,,ѳ(u9[4rK5]zuqrmLl3i#eWc҅ eZ;g@b9.s٪YXlN1X,ge.дb WFA*;C8$=ō`ᖥg"fU,K00U"uz9%Qvx"1آDo@#fSGN 6Pc%k$%?7aI](ˁB p8@$~m0EiulK硱b#Ul;E&qbR8uHI dl`E=ۅR nc=9{`0+mX%rK(( S  euԡ:XI9a"3:83Gu*1拢 ,R=\:  2TKLlB +,"(++ 8ǥ tq^lAp8D_9 1ApǛd1VO .RhSlFnE֓ "DB(ՉϺPdpw1p /RC2ARџ8j!D9 rշoq+ xjM]̸ӏ\L.o*{^m/~(YQ'qINþy}37 9%$o~C2J`nX]n|=7koWk3ovm3zit+(eZs +7_2ٗZfUʻdt]W4 AWVk-RX)S` L(y;,/'4iү+Pn zZhzu=dU7{{;mږӡW''oS2>|Mޙܤ D#_]r4EКhmc;* 4);~юXTY5mt__qD{lvq;'Q3Sz/g$ޢJl7syʼnN.QQG,phPC;GG&.c +j7,2_ht$)?sV"1|ϭE<%s3Jɯ`6ݭ7Řc"s0;"Gz&HS_'WmNL4z+^(z㴐g#hwpR;mϩx[|Z8o>Bf0pHUPo5)? ʄCG +duz:yH?Y=?󯧲%r@bтv +5Z`[^bfk +P.t!UI}>9bbozfiO0&2UHE&vZ =,bA^4Agv%f(jӳy}8a_*hE50OVg8gE!u6d8\p^!|wtd쪲EhXh5w^DvY:|5;GfCx Mx3aQFXZ~(04%9" {l {ʁ>z +X%mzQ3C)oMZC8u&)@a~78HA|y7cZo8Lm}Fv|?&H5GE3/\ixCTt,Nx_a7(jsě:h[Y˒$Zm.% EN.|ʹ0+Q#aIK\#fL丙<9zW&şh():}w!c:JmI4|i3ɦbN܂x'hXc}ɪ]mԹ[ v}Ik| qp7loWJ.)uZFeKQ"iKd%jlj\8F;U3 tn7_3yxWDŸ{vax)XNkU!]:lf@-ߧ?aMZV/'Q 7n';i\'sR_X cEU6RWU(rf7=BmPq +5QPDiЗ_:nR}ֵ$Q}W:owMl5!7'a.&޴q冿ᢅU3vE/HbHcdS aJpM݌G;bDrR[lTv*Ays|aGj{zO(af^ G'O}QEqk{7۹~1ԍ>f?кY +oФzǿHW'q W|Z-RN[)Z?o)fthxi봟>7*@TkCzW.K|;޳'h}{\ҍhfoe<!4zHendstream +endobj +1482 0 obj<>/XObject<<>>>>/Annots 235 0 R>>endobj +1483 0 obj<>stream +x[[w8~ϯC\SKz˶}UlԶ2$3@tIΜ'Iv1wI&$.Oƣ1I2kLzUf?`R5f?'=`1i4aAs^%-&R4c1 $RevI8QDbaXbm[ؠxi +qPϹHZnkE,VԼePqP9L`JZA ϰ-J45,,ybY!p:+Du s0ẼH9vKdLɛM1p΍I~H©4ը`0KVta7\NήPRl\^$() ǙYn{LIixG`%ؖ6Ǽd<hP9,J$aI%gzN"IY?P;>gQ 0IixD,|䉬`ٱDVȾ #\+i1ut`ΞʠinAsEQbt,k0 Jn ]Y { .7(j:*s D9/iWȕnNŤ'ٌa  V, +ހUРḂu\ `+|`xUuXBbψ"k0 pdeuf {v0HQ2b|`Xr SVND6(D> Tq"k0r`bXI\ k0g^{er +:2 23PQ+[ze"+VLdEߖr(TDemnE,qϻn!"| +؉J}܈sUF+:wnwNjd=z#Sgr$ +t[RqJ.e-ع੺u355Au~:tߓz6[x8sR#"Z X xT. j)M{i(Y1o;xes&NƁRW:¯6uTd!r"b|Ŏ yO&wX/|˻0{;/H{dP%`Jo%y`y:|/"zQDg˻uw/!=IVb5"t9)<كi7 M+zEyKH2=%6vYQ/=r-VC!$K£V2>>y").BdM6n-3J"D|KGz"@nF_Od"^bn7b1SG:Dу} ^z7W$MXͪ +TB`P6=$TǗ2T]ԋb+것f=DK}2rz ^63XA$ynό M) .+ ;cMQ|5㼄BXuhAHxYˋH*|QҚUOǃt)n߸I7/ޓLT 5Y|u_'m0V 1l;qv6We۳{s/5|q݅O4}⹋.Bo&XF8]<2AeW|C;+ /LNqM_'L]endstream +endobj +1484 0 obj<>/XObject<<>>>>/Annots 278 0 R>>endobj +1485 0 obj<>stream +x[rG}WV]~yR䵣ʃ_HbBr!e;@wCk%7r̙F7h4=I?4hzOc< {IO2o*ʚi2xb**ii8WQOk"=PHlVYyZjzE^$@QC eBQ8!4!Ehܠ@:N@ZN $ -rBhMH 53R)͸dlxJ٤Hʱ}6N3edkCV11`|$X&(T00Na -ԐɼX8'&Clr-;~לfuj B*i1a`EBKUZ q t [%4ؘ 2PKHn#" ='3~eU@b9NxΉ7bզTrh!/P@,MZ*0!Ee@p\p@JC,rq5yrb4qM -Be1v"e%1d3B 4h R̚]@s܇rZ9r "PR:VC!2'=@aC׎Ieis44;1 8V@$&Sb4.,0/̼$2$@(+D LH6dqG И%-p^ F-^E)$cC2L tCԃo@nWWbД6 x@=BEY)['e@Xʱ@HI>-2 -A{ϱI;t1eWc 0"45B@:(KL>2v# `x#Vb0MKe5Wi]:p%B*~9Jr&c8貶`a̰8I)6{ksq|;D,SCZ }E`VŤIinyi9Oe+xorC,: (sLXDZ53BgmȦN%2 !6n:ϏX"a`(U5"!;`‰db%[ ִ5R$[ hGe1<͆`1[ LnLlXWQSf`1*/ɲU۲a0} =+V`zeZYL:S++X +)b ^`L2XǰEY A |ְ~ Sdzەeӣ}8 `x$Xze%®HS)$1BpHl;doС?47)$kfv +!7:MhFL N!8̦m<` 8E?p0sB<0r,@HF9br6LO+)$62:8@)br +5r +1)pv@p$3&:ƉGa4;FN2SD)IIc!)ZsLb @)RGh),#eGsXBՅCŁ +cFm)N!8t2bU 8I:/ຘ[;;(9h@$%)Dg@pX,ȣ$Gpqty͊*.\㲋_ovBNՄ &)5{zvmޡ̟)=Ce?hW[~E?~XYGʻiZ;scsݣT5A!]JSjXlYBrT~!<~LNÚ`)WUU=bٳ)MY:Ζ o">u}( +U!+zx-ͽٶ'q?_o~~?.55QvTh;3ICH҃ZҨHtsRqt +@ vA{\ՇvY(6fhl.p*[9/ሩ:A=mDA1 !d^/s\%Q>^E|o4ְ4<{'S{ܶ$)޼[8q |F}Qfh>x 2<~~ w +C.dz1 !æ ʤusl f*Y]xWSn*ypR;NjfFUe(:2ɗD Q(Q9)$%;KpNJdxrRݧHuQB;6{ÑRS}qTtwwz":V)MXL}}?[_\p} {}Y_H +.ٔl73v՗W Ǿ~sKjl༊nU&6:Fq|sXskR[ϼZÆRauGwM-dvMCFX yѬ__/nG OA\lU; +\]SoٮQޠp:ryG/+LX[Nj*]:^nFق80~Vvf><]rB +鷳҇gש/VA7%t0B2Lct{y5$rɀP3_, |R5=L?>vPUo;ofS7lP)05q !+*ǯo>OY #dkvUįDw=}Xw(x9Pb ++t>,0W$?'s%u>ï3BoF6ߪːml +4ށvչoWP/ä#߼^ 8 u^qx7|h-[gJ8BU1˳'|[EͶFkzWo,M<wN>B拂gNCjnDqy`>n `>|n6moPZ|t> ӬO*0 +c1> 火+6Ԛ/u%'v;yύC/|&K48}iF~A=g+͉\de[TqC}Z|'~endstream +endobj +1486 0 obj<>/XObject<<>>>>/Annots 317 0 R>>endobj +1487 0 obj<>stream +x[KsW΁}?rIT*d3&lA}Е(ʪRog1=.$ß bȉX#=آX: )l: kcSKnz%h]a8h9,9SZʜԁm) f` \a9Ƒܳӂh`auI~_ɸXSuqf`'{HڊP%ij%c++[,,<^.:pyFNO0&ބuDzX,)b]GdcWd|e=(~1a5%:: c"+y;I20SB9L^ӂ (ˑTi@Sr|DRU16$ֱ}[Ʊ +ұ(mǨe cقU` +P FۭIs,HHT0ؚٱ!d>kq%)1V3l`{uceR?pc6iਜI6cM6cD$ʔu.Gt,Rrh* %(rZ- 2ek#HW ,G[j*Yg_N:0r94"݊ϒ 6y j#EhKArKbsB *PFPMFg`B']]Ǵ֚L +5""P8aX~XYpE3hEjzV(0I!$㐌\` Yf EmCEL}30-'j$,sQ2ڭ``%c 0 +4A( &yd 20 bX*+bP=G Ll%=VʊBUњ \*VY``b(鱊UVĢ +1Jzbe6hb#'b85VĶ`ms&6pAXeE,R6QgM%pAXeEl%LGq3TlQ;ƊXs2.Qc,ozK u"cQ"q&PSI2bXz뻋w$.m?M>/p |Wa4u]4Ǜnw!\ 1' _ŧ8vE;D"6<_m.raKG"k-3,>1*N~3Y$: +"b ឞ}^W'a3c!,0YWi)>R(QO>~")Rj#MXd񫰦q3dM{8u7vz6| W?[8r_Cԇ.NQe+i1&ǖ}pEzAOܮ3[ diRNBB}O|ˡw:K1+ ۫__]d-8-#U:_l\\~;%.ZM Fzfn1iIn;=A\GnӢh|Ƶϥ-UtHyjӲ[ʾӨdތu 4O.!P[0cm)kIbW"'Srm+t8e5Zw i@ݙl&*W)ky= +~wtfT\>ESݮ>K㋰O:H܉G|{sp젣aŞ=b=m%4Ö:T8a_-qYO(LP7bNG؂KFsQsuu9j6Qv>M6nb`۰=u?i˅ktv>^.:kDžk~:j4^w>oeOBb44?$jmIG=8sgURD3V{Ġ%a9/% +(*2i Q =yçK|"NcG]vCpFDW{7:RuC2ԯrV8kTO!lV-m5\G"b34tuwk`oŖk".yPkuwTXq`n#9zQMڬuaaοoM4wqLP bu &xSK/;TB' +B!^ 9!.S +Rm|r켨_ } +_-b(m=$lOfo:A~5oD6;cp麑>bɧ[:,)+|'ۿ=w +e?$ybi30ݯc\+>/XObject<<>>>>>>endobj +1489 0 obj<>stream xA0 g;Gz3Ѹ?@H$"oN^LӤ{k_AR s"MpA[XlDŽf i+A/GBhrPC8$yײm'R?Us跡F.]Ƃ jq?xyƜ;endstream endobj -1495 0 obj<>/XObject<<>>>>/Annots 362 0 R>>endobj -1496 0 obj<>stream +1490 0 obj<>/XObject<<>>>>/Annots 360 0 R>>endobj +1491 0 obj<>stream x}YrH+2|9‚rˌdf,RX,"=*rO$ M(+O|'_?AM(O|4Ŗ itvYN2 l &Gj 6w?`gSoX'8" IAXaVŎU|sHª5k"E< VaH(LY+H_HA"0hw`u`g1_XO(YY{XUK0FYq7BI{9wG6d* Pa/$ ŵfQ@1*i&#^܎6C eZ0 k0sVvwd5fgx* ⍬%E uMBNx`g؊U؏3j 6 @@ -2629,59 +2626,50 @@ q !Ud-\Ҷ}YwM)9>hD8NGsuydpsupԣŗ#b[`zE]os[G 8F1n;)7n`v nD-EZs|ݚ. ތa(»nMpUxh=3{;7(FF߂'ƑM%)?!">[ƼQ3=4ybk4>osW1.C(.L->/XObject<<>>>>/Annots 414 0 R>>endobj -1498 0 obj<>stream -x[o+S>ex+P4*bYoňISe8oC -5>闋QQdVۋ`O?qX a aF8MP ; f -]m\dNaӾm=aѫ++#ѫ=acC5"d3G1T[6-TSSY;FDdfj#Z3r`3ji gYz+GŌ@tTX8ra 2eYfؼͬ`fV a3¢hdgV5b26&}V0,!YV%hcN FF-1fȖXO®6agșL)*&`dV5Ԋ*aaNlQXΚd67oR ˙U[9T ;[n2+v: -]^1 p,괲bKY -]{V)&㢷bX)fm(FŤkqQRL]caYl9})#$0u -V0,mX(+@ mʲ-6Il) &`X\++8@gRC5c0X8vLߺ^848*6w? \X^c4bfV/vE#udm0u&cO -=aV -q(,XfLHUlI/lN>V6,Vly9&IP16sa.l v#ύ`D o - -M,U JD"a63M&%>M̬drfG٣ULl4$Xĺ(y!"7Y0F̱Fyql;#\t1V0s(a$F (VXL`.lSY!+QmSpj?c Tf[Ʀ6ͨEj'Bmo,Eo3e -"l\5laW|'8 -2$罟9XCtɌkpOa BYS^Y0YI3(M*#،6V0,QOV5]lV03 BYaC SZ_(:1,{ -FeV0bB +IV1m2򭊅GNgl&v'`؉ \ar -6H+ٕ*Ű1IV1.(C/k-L3NL@L-̤D238{ԛ#WZ +"aHX;qf[$E \-?rh"2#l=aڰ҉幁PdV0 ˬ`XnB-Ÿ*AGXL١ -8N,łQl[X%A#*e“ -ލClY! -+0铸GQqȷaCfV1ok -e3`Xo `+ZU V6+e[`nNX)z)ud_mogRٔM3g`rV3$غĎ -%$-!`XLYs{Yđ\dbXz8Hq|] ie{m8aAѳ*:*GXؑsaO'̤bˏ]5 ˀ״b'V1,GqYQoeŰTbˏgZ9ƉG P Nɬ`XFkOV9dǩbX09yP"{U" &X6z]Y1,=JfYVpvl vp7NKG*1_lmY[`+VMX rV}UsUIY \cKVӘǠr(77,$]}m/ē -E~Y"—{_HKK{ۺ! <$ QmX{qmZs9qr6<-~&A#eh򡺯W5?Y:8@x^/J -.6 6$+BOlFO,8q)qMhdR:xmE| 5=u_mݽXWWW鹫] 2U/w ꮫ{ ֫7]O3_VURSz`b>yL*즥i-ݶ :˨夤몟 ~ĽTV-iIbo|piG{<MmE-T 1|ww1endstream -endobj -1499 0 obj<>/XObject<<>>>>/Annots 466 0 R>>endobj -1500 0 obj<>stream -x}YMWH+궳diXzx;4ؽU4m[^I)Ҙ7p("?*$sE.], B2sHe n]%A<[Y ve ;aqs:N#8-s6+ @@**h(O"(?25 &$#."J&d2AlrULǢ޳ςuqf G-[mg {AZ9 I -p f@9JoXU2l)yĔ k0Lm ޺$&V%`7$ ,f6c`̘(d $i1XqH9l4rck1Ù3ɳ`33 `SƲZLd1 %\Ι OF& -nIeen(qZ`#6dGiHX86g +gqertHLcXY"UhW=ָRAS,$)tb:B:"5`g|VyGC&)1X5,Zk|vP q VGgS1ǯa FwYΧ ]6Sg4+':l :j;rD#FԳ-g`y[)YZx!ȈYY>pY9KVMq)5$cUUS\G9.#A07ϪF$Ș(;Y «\'NZӒR0ZZy#A|cpaxCpsˉ֓åq .c(81OOyN799޷D㞓ˑvg raV 0g;Ap()&56COs\˧-W $ r7}[-fUߗ\>,|0 U]>Ȟ[gmK{v~ߴ݃Qnv}۬nvW |msx~qͺ:ZwR;j@BU[Vm]U؎moz$kw>bs>VIOeXUvߚVm}fnޭ$pjS1k\\({7dcƲ5ͮsUVUq%u)z;`2;_(c׷=21#^o\k6=д?N*Wr)%#e{x -)iqGw4 nQᇽ+ׅC[CZ<< G"`xw/w߿!{jvuw{q6DZwݴ+&ZM e~Nfy&M_9,T^+kMQ]BA \(Q2b ݃l_55N@MiGI`WvkYoDOqR2VG{׻ݻ㻗[ h-ǜIYxle[wG͢Yz~gNy?X9Jendstream -endobj -1501 0 obj<>/XObject<<>>>>/Annots 506 0 R>>endobj -1502 0 obj<>stream -x}XnF}WCy<$ƍE[L(R%)'%C-9>s٥YyGOALa:.~3vKq灼sմ/A -bRcaxU,"*| w)ʜغNl:ŖU=aְ exb ('N1o R'0%[Vai0uSnЬkBmaĤ JaO$ 376G VQad- AU* 6TH60o5ADLP0R404␭n~bnˁIvLQG lBw<<1dI?15$HU85z< }dĀ  -C5J9^*g2fV)OT4 K$TS"%Ԙ)sUDh厎];!LU3c^+N9=V]-"+tp+iW6?Xjp S8u~"+TE+`/dP@(ovt2G9ƥM:vx,]<ݐo$E`sçŮN>w8~ǽ-c{TwöC NЎcj~/a_vtwfME] sСyIi$vQU<NT5[OmGק=w}Eׯ.e\a+REޘw7Z*ñKZ߼a39{SeߏS<\ty-u{bNhDTQE4q8gsnOU-G VMUf&y7̾۝n#oOOӌY8Jsmٔ]^S< $2Du\D(^Kn-ԝw/Z~,բC)U?3p|OeoNRSU5g -s^txi/Te>k`8pBddXf]^Hr!4_@Do՟!:3endstream -endobj -1503 0 obj<>/XObject<<>>>>>>endobj -1504 0 obj<>stream +1492 0 obj<>/XObject<<>>>>/Annots 414 0 R>>endobj +1493 0 obj<>stream +x[v+)pD~ #Q`ɊgCfxDϷv]g {׾WU~{5JC8Misx5 |\fiF`zAt1b4;kv賆i<&v5 e du]cb0uòxPaV9R}3g cPG"XP5k+ˀEUlT,wdT&$PXLy\1H Ea .'򧰆a9,b +:1\{aI(@ s*a9YN1,`0,W3*a9dk3ueaְݎu ;akɃEְzSXǰLe1, +4;cSKc$@rXQ)`1PAΪ5 xgVtN-c@bc 2gqfǰ )10q$ıu K6}]ǰ=r/Ӭ +ӞUQcUܠGsyCmcg,cGc 2 f&P:tְ3iv Yu89NqIJ ]Xð֞a9Ku LuɼsugHB'++ѻfǰd`Y*8P|{iMV aX޶QE0Xǰ"V&XIЅhv sƤ-9\u$͕pU7S.ѸYq S|eV\ kbKV8ǂvl6jty^L + +Ѻ5 wY6.u,Vl Q:v,}rAF6N_&key;25Yǰ7r0,U: u mflvwyy d^^a w6{ױ;w ݽr^N(Ɔyu ָ4ZR`t=q ơnVeI5 7fc .ݺUa%Vv9D3_-teQ'_2C fafŜ19@l +RE# Zu%* 0lfYfFu9\%I^8,-# =c 8L'{z`X,aXZZ,aX~VFŠCzU6 +HD8^8S=b!. 9E-Į@RAQqR%Ⱃ}1. z=\pLB0p/;MdcÇ B__G{{͏I"m0m2Hjz;V9tc{J6W;w]:U>w۫:rE PӧW処==o:O~UiD?ujLhcJ1OU//316>}q[=o>ҁB?y:wϕK]ס%cRUn6mZZz|9?=SǕӹ߲jk rTw][_T= ~hnjKP;ϑ?*ǪZ7_$TD(}g$8amkzDoҜW|QPF'nUoIfp?kYrr37Uy󥹟Z{_qԇsK%s=Od*3>Uyh>'յ_wc¥MtK4Ǻ͝ڣDXP?MSn?.3t͌<*)Y'џPT~K;&#W>Tmͮ\4L޿?H??'opnnu(cxzlњ}]o_dg8xPxAxg;Nwiwsu6{)z0eRCB}g-eE iÑYٔ>\6<[x Nʋ*N 9_1jnUK:}mTn{ڦ55u&yL*SC*秧iPO !#MzB{ʻ’.'"zxztW{1*i3~?͏Ԭp9͇7:ဴ9(p_/+=sO(7\Nݫ~x\endstream +endobj +1494 0 obj<>/XObject<<>>>>/Annots 466 0 R>>endobj +1495 0 obj<>stream +x}Y]WH}W>˲H!!dc2̫hb[^IJR0s\GW"O䖱K2ޝAL}tVA<;- ֭r 4H\&$q<`I5 :AdYw.3[. 3g%(H$ 6Me 5ˆg]6͐jLlJqg °ONsRVE% e0Exoe&G 15X>5l3OcLű ql0g,g fyxxVGlP:^Zc%$QIA$Sd) GԐsbfj1Bı`S)g &[m \`bcyVEzQU5ʙz`8g (\Z vɍY=+yS%OH4dÊV$QgUhc0Fγ*ASCT Z {" LɼzbrY%gŰ 1%s`Jf`,۩,fb<i=ƲKp, +k0X3\Vj0rфi""i.<72͓XY@- !N1D3`b:pc8J=Fwx8,;J>_0!A]w}[OBXU>pwOe?Gsy#߸peziT6v[JFX~O"I8ÛۗS3do>\_\}l-@nД,8+z+zmW?Ẇ{^+cE~Y]\ f}ܡbӉq[3?_g^Oy $[ޞB#Wendstream +endobj +1496 0 obj<>/XObject<<>>>>/Annots 503 0 R>>endobj +1497 0 obj<>stream +xmXnF}WCyYޞ +iMFJW-&}ܑ̊d0r|>CǿҐ|f"7OI玂0QC˅`* 6NXk8  O5Xa8N* 63Ѭ; +umPq%$A) 6MT&G&I $"̏U(B CTA6YY50{M؍cs0r/P JNG aH8VaY!;6b?>G$A1-`R8l}h.S( p2HbAnd+120}]Ay,H* 8x0if0* bö2Hs +§/̤Ɯ OaX9^b5$PUq3+&2E0XNXcSd*PC6X, t5֐ exb>ffZUAJubU)JXy`՘XҞ4" +4NfD@PsshVu=7|#AR1,F05aC0#Ub@Pٲ`q"d* #+ֆk]E,H*!'\`* ӌ07ֱmYclYcxkO,+Gb֕t<>9w"I7r+N +s8dZrxj"Aְ`e0XWuf|C)]W@7޶k IAf&_䘏E)9n"H) î8UA}AH*̪8֪Ӿ 4yE` ?nxQAVa*tFtUΖ%S$%M"Jʮ )bEj Vuj}&eB +"_Y8˂#qeP#qkƯ:o_4؄b +,]-&x iKwӪ|;xy'*E + Dio4lMb٫Sذe["ߙ e`kƁdnYyq)"Kt?ҟfM!Gշ0Q}׿ s;E:\9mr}(r{,I;3Vs3 R~oadgb/䯃7n幈Gj'TSU7 mg +snAxba3 +1|tC}ʑtaY̽ U,ƾ(%5/ fpo^ǜ쟫?)]endstream +endobj +1498 0 obj<>/XObject<<>>>>>>endobj +1499 0 obj<>stream x+2T0BCs#c3\..}7K#4BHP$YSO=5/(1G!3$1''$3?O3$ BMr = !)f \CT&lendstream endobj -1505 0 obj<>/XObject<<>>>>/Annots 551 0 R>>endobj -1506 0 obj<>stream +1500 0 obj<>/XObject<<>>>>/Annots 548 0 R>>endobj +1501 0 obj<>stream xYr}WtKU+ Re;dJy$m}g/ӷi@ebIg/&?GLh"q4V֒Ql8k3;%3E 38΢Z vG Nh*yvAN jՓQfY.#l`4,xPEj1lB="D0"5szX.& S`Qs2ɏdY'$NJh'E_ dB=i1X`` $)Y&#,;xYwؘi8VA8IL=i12h: FQN5 ym6}};}9ihJ8ц޵oФAćmgP_ھ)=z=-?u~}tYg47UkE^+kYC)WMu[,Q)|i%,fo?.O!Jpn_ʟ?]r|X2DHbsBH>$sG>uw*vttuOnx( 2_] E3GĶv&/^N"Pz c,?\fݽK4msY:r,۸"qMOm02$)sGib3!)G2tOp>_WӦIvrퟫwopNrٵ}jF@RoSgab̿gZd>gt7cZ]- CW=Yq--<84-p,w(7ő4O:~xY~;O3>>/XObject<<>>>>/Annots 553 0 R>>endobj -1508 0 obj<>stream +1502 0 obj<>/XObject<<>>>>/Annots 550 0 R>>endobj +1503 0 obj<>stream x=n0 ysc aPUk+Jy &˖>[>>/XObject<<>>>>/Annots 556 0 R>>endobj -1510 0 obj<>stream +1504 0 obj<>/XObject<<>>>>/Annots 553 0 R>>endobj +1505 0 obj<>stream xV]OF}ϯڗ 8 Iԇ6jZT;w&;*+$sϹg^HC i67 fKlt8 TP8< f{q:lgoNN& FR5d6 &Q0:<8_Wg42E?ٜkji( GZӢseBKik|}h|I? zB̜E$°͂)R-U"^LZҩw fUM"A"/4*~VeBC^(Q6*jjˀ+ Gvdu!9N±vJ< (iMJWpPK6b(tV7TJź\]w] WcbyLJkPTѕQFezc?qLa0 B~gQ<Rlk6e<40o+ cU@8moAo}F=h:y#WGqzxcQTאLÂFb2ODѥdK^0U2#BLַсLW$LFF'nl؉TĀx#v`(f B xNơ' CݸD+\px;K8[I#1F_<XO8D22[F6vL6R+Y-x҆ia3&VJZ8 a2f_W*Ø ;h3֓=o73n]%fQ^cwn"bKA 5WkN:x:]C+6覢/(zg~#lk+ya%ޙ%cFM}yՎ#$F $іW±q%xBXi9nw4 :([id4kS%H;〞7eʮ:Owꤊ%*w/nKݍj&N"qCe.)?:$ ! ȟusc,aġ}$st^vW CPNI}͕Qմ̾wET7lk+TeKd*=B4pkۃNJߑ aWWA@D.$"~qYBaECvrb R vm)dyȉ_^<-̙W=. vFS7)Ӣ eҦX$Gd]"W-_C.XbTnWT*“ciJ{OW}i! ʵGSro 3.Zc9i-DW">g'w ctϩHd`jtPo>&s/9Cܯ3kpendstream endobj -1511 0 obj<>/XObject<<>>>>>>endobj -1512 0 obj<>stream +1506 0 obj<>/XObject<<>>>>>>endobj +1507 0 obj<>stream xVko6_qWl IJe~Àl]}m >mH\Rrl'%Hk}{ιz)F4RV] !MgdD G6`X3qL;Hd~~bp34٧-sBᐖY܉#hZ؊V(MBjڛB譤/CIf&^Nb~vd_^>3)Gvr_ 'sRK$_O,kBnmZTmIOkIARK(x#e:HZ^=To.ix~PKjMs)Qf%x*6RfZJo/yQBr8%16TLc36 ]*E"@H_0"K`B@윴jIyBW`PLqj1L]LƱnt/t3>o|Тo00&\:tȃb3Al(tFH {伉ӻ<-3UEi^vaۛJd *4jjTpnglNN9*ᢣ*K&[fi<GNȈ IFZ=y^|頂ơvz"LLI`  T\c}g} @@ -2716,8 +2704,8 @@ x *x"qltInK>KD%Q Ϩ2)W!/7juOwOn%d$ϤVrg秪U:*h`:{|L".?_gkEdM(P\c{?.xgNfd6}_]ᾰ`endstream endobj -1513 0 obj<>/XObject<<>>>>>>endobj -1514 0 obj<>stream +1508 0 obj<>/XObject<<>>>>>>endobj +1509 0 obj<>stream xW]o6}ϯKS Vbdzݐ4 `]ƛ1(@ITZ"UsIqn%ޏs9z0S|Bg3ʪfdJ9>O#dg''7>E$9-rBSZdGo^V?o/_8}>N.~řE~J*k7~E+geM6ZTkcJBe2Bd'ՍҎ UJNBNcUBRpLCV*Iզq4F l'k趠ZKFp4qn2Ofb-5mMKzX;95rqGZN6tă6VY_p>>/0UTY6sMΎ3L9+JH;ղikZlH$z{y-x%eBJT"mLZ[eADYʜ$ukZnd:Ӕyrm UbSI%I'Y+5T7&-e6)?@ 3mnrД mQ w,w7Ճ.z-Y9į".>q{9HKv)1$:%ː @@ -2728,12 +2716,12 @@ R z?1"ǻ0Nr^A 6vq-[>@ٷ79a&ۏW+3@kp Z$ Z![s~PОyD U{so?5y,rLɳԯXQVƯ[fҒj Q;Y 6zJl°O|;ȶG?2¤j*q*g /NNc17r.U&TShWw/b޻_6Z+q?kGR_LAB?\YwP>걵{]W Ķc2{rs/~ll_KzF7t>Mr<0oMްendstream endobj -1515 0 obj<>/XObject<<>>>>>>endobj -1516 0 obj<>stream +1510 0 obj<>/XObject<<>>>>>>endobj +1511 0 obj<>stream x]R]o0}WePH,D%[ire16".T|;#[cBvAFH(\#3^M}8F0$3T5x_zS8 ϧD^JcgL'U}0 q{l1ʼ8i$Yfi?4>U= .Vendstream endobj -1517 0 obj<>/XObject<<>>>>>>endobj -1518 0 obj<>stream +1512 0 obj<>/XObject<<>>>>>>endobj +1513 0 obj<>stream xWMo8W zi 4Nqvovئڋ\z%bCZoHJ/ @"͛ѿgsϜV >]ǫZެN.ϖ緛hqIL]nhS\IS% зVYin t+%/ɺ罳m3۷|nIyry-¦RJ[4|e[]V"~Q2TX5EPAj+LI8 !)TH[@ ]S9UFKYltD1KOle;<.m-aMHo%{Vκ_'mLAk2kDYJl>|_d#+I+B6G:)<vY>CPeMOʔ1>0Z0 alTdCeWBWb6g{d/T[ͮ9;|$ RsqH8 [Tz-g[m)OJ>=Iٱ췱: @@ -2745,8 +2733,8 @@ $  ;N5u*%d!#x2HV<V?w<*Pn+NaZ j>('Y)Kfch1F1T}=w431#;Kaxe6DG+&1c ʀ rDtrR}t#'b* JHH lfGahM)Lq Ad x7EgVfJ]#1c=ո~1EK!o>cPP&B_hи,Be [`~*q3ML $+Cm_"(-2yK/ TBw0@ }̤.,`9J`Mh1͢񝐚UXEo.kR#Pڿ%_H#Xs-f #?NC;1j),Nk`nH5Nj%xvTbEKbEaB"e0_Ʋ5F8VC\T=t$4i_((_!Qd✿~E%3 )XX3vDl th^ i׋>T>j9[]<~9v(endstream endobj -1519 0 obj<>/XObject<<>>>>>>endobj -1520 0 obj<>stream +1514 0 obj<>/XObject<<>>>>>>endobj +1515 0 obj<>stream xWOH_1Y$$)}]{BWפB6&b僚6iY+E xAL~bi48DDHi<N*F'|qpSZ`k2iD-á 7UaKEg$ m*;Z|1Űé|~Mb)kVHCKEW)V%zH_!2%<\zN=YCCx$بrk=.5Y PB AߙR~gJڟFMv ᓚ;IEJ*kGBo?/u)&:NIi{Ii0ƅR}<Ï69]Jй[]|"Ny>tVG5zUcrkuw`Jn(L"޶[ɶ @@ -2758,8 +2746,8 @@ h gҫmlrQf_`]id0wz$ûrQ aya ?p:a>39k >e"BIUFCV$8A޾h, *cX`.M!\#a%4|pa䅼LBDm6}f{Âzuaoch=pi[gi ###8NB7>ɤ\uK!n t;D= Vw?^<%N%')ƪkqfvB"xKߦ0Fw|2} e$1y *z{MWi#ڀұ {a;f#L"1cř]'gM1a|s^L#~Ob:c6~q3#Wendstream endobj -1521 0 obj<>/XObject<<>>>>>>endobj -1522 0 obj<>stream +1516 0 obj<>/XObject<<>>>>>>endobj +1517 0 obj<>stream xXSF_/!U X~! sT{k$vHｖBl0f_~vfr?39?3)PO/98G Vd^ŹKC=HaZ|ZheKLl46|MplɕmSdmڄ^j\֦Ͽ8;]:5QO(hU>Wbz@ɾl/=--<NeCL:ik1`9ɾ1UkSiKgEp0~ _`X MZi,C%+(4g&v.mhǁ[{R:"x]oq ;QiM ArF*]THD즋` {.;^awKpإwBH5V_$ VJ &~J6I4:/GcP7:D.CؖԔ=,: F:r^jr߼dF`OKZ6 &4ͼq$^x'X6Fr!x{(h/ ~%m7tFBPGۺQyM~eյ:lEǪ|w!Jިd}sJkɾ9#q!"FL◛¶hw}sx8v'{r= GITAF$S_6p27{z#q黺d4~߉_RL|]Ю:ļO,F 8$^@U4Y7XpO]{ ӕZ_dK <O]ndj<@-ϹK$`xâ0;ű0n>oEǝ^WM^?wGRu99?.0asvJW;/.endstream endobj -1523 0 obj<>/XObject<<>>>>>>endobj -1524 0 obj<>stream +1518 0 obj<>/XObject<<>>>>>>endobj +1519 0 obj<>stream xUmO0_qSh!)HhH@4MBBn4~wN eMZۤi{^AF)M/ BH4!ge8T~!> υӼ7dLփ^}3"1k4k-0ųAgN`w8^1+*dCtRvPE o$qU(#6,Eɉ߃3&^(pr7;xe$8>֭[%Uoa)0U3= o{ms)Յw}׻wRbt)5Ŏw<bUxzn ?DV~V'+xC$b~qNSǺيrpxn͚U%Y:~3MUy`neReAf+P+]ՆxG$Yp?=:=r3]$bg2BIY:F)!彯߉/9endstream endobj -1525 0 obj<>/XObject<>>>>>endobj -1526 0 obj<>stream +1520 0 obj<>/XObject<>>>>>endobj +1521 0 obj<>stream xWn8}W pjE/liBKŵD*$WgHɱU/(93gΌ.&4ƿ -4[PZ]1ͧdA%~OJ/hL8$7xGpdA }}G1s^,oh$XKK;U:7^Mb#|'ؘ,,$Y{k&+&tqhtfRI93K4yS-92ψWLATAД2'oZJm[{& NV$&5U-,劼 rX!'5D}ٜ.9{=!X{ǥ3W(K<"t,8՚ػt?ޜ;B$K R1YZ'? WeIFm\X92e0>$3F9FJY*mK ORd6 @@ -2791,8 +2779,8 @@ cFKG< *\4T$#ѡqΆ0OT0ˮoċc@U5~9S6a3G wE fWG;سJg~Y?^jx,Jd=TŬh̐ҝJq&(F5S"8YMHYid2On}0FB=rG8ajjД7hT0C7Ԕ-X(aEV~Vh^=畖u(ҟX=Zݯuu5&$#;|U7f;UpT @am䯕>E2^贃3+ב[|o«,Yt5_|Of t' aqiX_|% endstream endobj -1527 0 obj<>/XObject<<>>>>>>endobj -1528 0 obj<>stream +1522 0 obj<>/XObject<<>>>>>>endobj +1523 0 obj<>stream xW]S6}Wܷ/7BLXN-'Zd˕d v:0Ėt?9W`H i6` h<G#g<Ÿdp<Gi'p|L˔i0e<::ӟNq`@4LynJ-fFY4_n>/XObject<<>>>>>>endobj -1530 0 obj<>stream +1524 0 obj<>/XObject<<>>>>>>endobj +1525 0 obj<>stream xV]oF|X-ZdEn6 ȓy1uwv%I`Hُ/'9M✦s*6'lBg =ǯ״Y6C>f^/O\Pr -KBɄ(lV[®|*(V U+SRtTTk@'cK tF2niC]-08F^itA!8(\zQkQҟFZ{2kj]C @@ -2812,8 +2800,8 @@ rt zj)8sp6233As] Z}gg зPuyʋ$Oi&(&NyhF/8%<hsjh y04mRe +]KUw|z҇n/06D$.JW?be?I%jq$N<3zwN 4WP( -]!CH KX<9` 4yKqp VȏX^YkntqX@9{kjG+B)Z{+6bp|*l$vbt%êad%k_TYR9uǢᔶn?`k\iXyy治 9n)4>z.\QpJ8u4`\qh,[/__˓N.!,endstream endobj -1531 0 obj<>/XObject<<>>>>/Annots 571 0 R>>endobj -1532 0 obj<>stream +1526 0 obj<>/XObject<<>>>>/Annots 568 0 R>>endobj +1527 0 obj<>stream xXn+ ތ H M<1$psڴȦct7T7)r2@ S9zbZi2E#|r"|9FT8DSNW,8ZbuO:EsOQ4nxXPAx6q|أY4ix/MX.{#)͒lΗ.cO3.bj3V#9 >MFK?N _\ R&̗ ڤ.#$O,VkxQ!T#Sڝ~_DizJ{?nP{d AM~_=?u!JT[̊2/pA,xNs,ptF92S:8XZPvP{K1!u; 38{=}y!=f6FO}CgW\ײL̩rT k$5G6xzl e*}-I]$Hnєg(pEj` |Dj8U\ e[vRTtoA 8 8ݍ[L{E +!@HwaEicn(w 9Q.3YY;X0xnoaV+l},F4]L|.^ oNendstream endobj -1533 0 obj<>/XObject<<>>>>/Annots 578 0 R>>endobj -1534 0 obj<>stream +1528 0 obj<>/XObject<<>>>>/Annots 575 0 R>>endobj +1529 0 obj<>stream xWr6}WL3cyƦudI-y$! 1IhE߳)SƑlJٳπCM(ɏQ?hJ$SNSFs^O()/ WW#|6b/#iu4i8Ēlew+i%H=>-(DUYjdJf_i.͓4d 4g)6Y1%: F#ZDR&4KIfI˾*59R{p @)8N2% G0Jڈ PntpH"$9M[mi܆(履22q8=|GQoޜRZyHI|jZ |8pPXWf$K0mwW|\havP[L @@ -2839,16 +2827,16 @@ P 2Pӳmxv_&Bիvs8V](v>3S+W'٧39ZdB@`'4JS%程ntRpB@~reSҏ`8`>/XObject<<>>>>/Annots 593 0 R>>endobj -1536 0 obj<>stream +1530 0 obj<>/XObject<<>>>>/Annots 590 0 R>>endobj +1531 0 obj<>stream xVMo8W IJ%;|H`7&z$aK(GIf8ސ#f) h$ͼ" 9_ig ͗\zKrBhh[ޢ٢f x͢km%2U<{[vc:[4G~gk:?-\y>\5slo~T27ՌV١R۫mMyLUsb%+R/Q|m4I#MjvgvBrMqJkQ#|jYmH'N9 ~Ni䜧S%il$ΫW"oJ T*w%y%=sA-7=p␳l;~A@EwXp+6fš/awLD#9u!547$S Q&ŠJsl[uRгmżvo۶$o)ZM?]+LN[vν̣b_ۢ6Üa3S d0ԕ`BXZ],DЀ2Ř&\ cL#Sk;SN:U &SKZ7qQ'W  !=jߩA^hon' {#$<74$ gRdV'7%`{1G0sUQ1 *x>p<#:pꂘ&A2{63ns"J3Ǯ^:v}w{nN9Kԣ9-ð׿_R>6 V e >i&<͘y477 Q 0_}ڌ HJjendstream endobj -1537 0 obj<>/XObject<<>>>>/Annots 596 0 R>>endobj -1538 0 obj<>stream +1532 0 obj<>/XObject<<>>>>/Annots 593 0 R>>endobj +1533 0 obj<>stream xWn8}W Rb@K.BKT"U3|m&)Μs8vң.~z4`DiqM4N 'c㿕 $Y@[><:bcAdLuNӓza2/tntI%Ɯh]-(D <2RXQH/;=t,>ɥҒZ;*'iJgJ3^͔7Ox. h)XUC6BEL> d|DbyBu!QF ΍i9ZMX댏󁎧 1K|%~\Phx2ӧ$Jn8Bz%E,Ǯ@% h88cr ڋ\tEb!VhTW4e./0vuZkt\)S|gn왣q^64oʽcI/0rZ,"7~"Szet$Ac;z9?r ?@0DQ25[::'yỸu$ > ʐۺ`"7t:TP`ҹjTߙr˰Ҋ<)`Acj3yyRZ2G$͡H45CK a=6A2O::T"H:QfH=lamǼڱ?ZlyAk[5 =TyFX}s}[A0VXɃ3)r(V-*/AgZ.;D @@ -2858,13 +2846,13 @@ VǦq  C`?^i,0eʥ G8ta6}cgMOQ,[ޱ^na"OqBˋh5w;CBARQna58 Gzڂ ^JGafvKBOJnB~/A:s?IznZ BSӨI~54 K0a%`Fc~,nM)V=\hXR=H. z`*.!LT&Pv0mnx#뻻7{}# h5E}sn z!xI/cWU2n@9M/8~L\_&L?oEU'z kVkBPt^E=9rm_[_nw /fa\Gou&0V5=X5iSB"lo7]|=!c8&$j?`f'Jendstream endobj -1539 0 obj<>/XObject<<>>>>/Annots 599 0 R>>endobj -1540 0 obj<>stream +1534 0 obj<>/XObject<<>>>>/Annots 596 0 R>>endobj +1535 0 obj<>stream xX[oF~8pV)$ZIŎU$@#r(1!gؙ )ɔݦ"kօswnh@}h<Q?Y43RGO|AY4&!׳3 hBh2Yo,L+̓4]eJmm%9MJn_0n]MH~sR%2!]J#\eʟ/sKҩ?wэz1rԧ̒ P,FW$uFe$XB6G Z<+dnC<~YQ9]@s.6w/ڄ(:cncCTts!p^AEdT[J\=3}Ib6`,o0a!P-,gD#[Fo8ōӳ_6Zm+0v2t4x>O[<Y~4[V0 h]K)yޖIFx79tg4WEaxoǃ}$o4 3fv(^endstream endobj -1541 0 obj<>/XObject<<>>>>>>endobj -1542 0 obj<>stream +1536 0 obj<>/XObject<<>>>>>>endobj +1537 0 obj<>stream xVo6_qUiO*! ! H϶R^2mӺ&16vJٴ}6)mھi {l7$N ٺ{>tȋ!J|'),Y= `%q,0˚ Qb@l^jr(-$a "9d(ʵ[ؑ{R\VN,4Om!ZĚiGJ$7aVB l^X }!VXe @@ -2874,8 +2862,8 @@ S/ g*[4]jr&i> wT8 %Aۜ!ȃŚrV;|4UƳTL==T.+淘~V`ZmO}Û>,тux ϔU`VXx*v}/5(9R,C؏GA؋dE t;QR[日#{IQ8z1O5S)AP {~wd}|^dzE99Qr%%+ W>/XObject<>>>>>endobj -1544 0 obj<>stream +1538 0 obj<>/XObject<>>>>>endobj +1539 0 obj<>stream xWn6}WLqHl}^.v.b((DG6 )9A\ϜOblD)eIF4)%Gk$ncґ$xqO,ys'MY #E9(E6'ãnKQLwWlv$ﯯd|vvU0up҇͗ϿmƂq@;87*sU/\Bqɍ1,4,Av%i]KUS^|҉wRUyw1ehک(350m29<U#3 邌RA2QikCG8i"(9ez]jJ >F҃mH7m^T;U%.+ !e?aRMg4ΰ5 ](6ױw1 m#Ts2saE*܏#r ~J2Q5{ߐ~@EZJDYLPE% MD}dЍtV0Gޞ!TjB&CZBw|[F(u) #`üAP sRqd7L#[xr:.d2)hzڣ5x:\ic @@ -2887,54 +2875,48 @@ g M;"F"vm"g%j)]vpaUQ75͞,Jk~0!yj4 gn|]:7d ;u'.A6~{rORO%;b#Lŵg%9fc>Po͘3Kۚg_xM_NUǴ>"͌Mc7غ-15(I&c7(۝ﳾs.]Q`ztك3x u| FSXJ׸H|Y+a|{  ~,(nh~ UzU' z洹f~C?w nNp͚* t z% \۳it^Fe)-r_`  \k4ܩe%ЕWk`rV^{ZC‡c*^!tu*4v0Lp գ*zBpQ;ޏ L/w﹵nN}])ޫc$a40~>5;x/J;/_^rYΦs`k?,2endstream endobj -1545 0 obj<>/XObject<<>>>>>>endobj -1546 0 obj<>stream +1540 0 obj<>/XObject<<>>>>>>endobj +1541 0 obj<>stream xWmO8_1R6ZtwRIKgm3Ni5%gfyVzۇc߃t`4Ⱦ 'ҟlzp Uz "*1i8&P+SU{pq:.<,Ζ?Z={VQ,roH3a+0)o@R$2iƦ."-BH/Vm+ou֬)kHͱ'/n 6P>4Fv®EwͪS%-(ՏƥlFfA` :8ze>/ BfXT/0#d8l*@i4!{-<9$M#Mq:偈ta,>@ qAv7^ ްwa |Lйga6v;0HɭjHSS Bޜ.?*qB>_>>/XObject<<>>>>>>endobj -1548 0 obj<>stream +1542 0 obj<>/XObject<<>>>>>>endobj +1543 0 obj<>stream xS]o0}WG* F&m^*Mjw5P!$K{>qdqT9V%1XYohD5x MX8Aiw<'xW1ESjƠq Z=N ,Ȑ% TqC0[X?mND)]Pl6Zbb+H"/8(x6v*}vs@'azk;u/|g(V9Yw{$d `NR)TR;$GR+i٦m:ylz=IoƸ*,{! 9¦ޝR$}Mp~-=~ԁƇ5]tZ5;``r];d*!_=֌~6J)irMxIϣ^kV}5tt~$i3Aɹ!ub`UYz^/M#}endstream endobj -1549 0 obj<>/XObject<<>>>>>>endobj -1550 0 obj<>stream +1544 0 obj<>/XObject<<>>>>>>endobj +1545 0 obj<>stream x+2T0BCs#c3\..}7K#4BHP$YSO! U!?M!3$1''$3?O3$ BOzs=s3 -!)F #\C&endstream endobj -1551 0 obj<>/XObject<<>>>>/Annots 644 0 R>>endobj -1552 0 obj<>stream -x[oG+yX89^-/"Yki9&9pdG~S=.I,,<QuXΘ˨z,g9a9ChrW&5d&;p\Mǰ\Ȭ2J%Xaڱ+#hHyɔ83$sð339: ;73발1Q1,W%6VPQXY/& Xe ecXF|ǰt|BX[\̭lcceve e{_&:NYeN&:LL31,4{ KhI 4S۞aə:ɜXa20̒(c2=Kr: K^{Ye%1:VKsl$A{Kdf+9o vsx/vce"da20,/ *a:4;wfa(nLC΋<+, mVgجY-4CڬD#9)}g6B@F&==0,#Գ+jY -ci

8&A8{' 2c.NVzcr gX)gۀgJJYN*$栌4qH91ɽ9{#0t67+o/ﺶY=.umbzﻧ֛_ƩSG/oƁ|ZF_UVafOmz&_>Պ,^W/q:aqlwG oښ#.ݴ.Z.YۛO٬wzf ]J<26vQM^9}+s8q얱S}Vqə-_ x׶Mk?Ӿ٬:>z+ |`Q̓sȲUmxw|r·N]pPND3s뺳|y|j~p|A[~H[yV-o1#]8曢jdW lD/$埔$G\_)H)3cQjjYN.4kq[2$=-y ֫ze?s]-6|L IcT`~xOKqz{iJ'oo*Nw O`fWW>*P`T«gn|z^\VZ*&*e5^q/T jm}lR'_X~g Tv>yQxyl˺[N$jujѻK?v:c?ݼ$]ƛLWbpbŬ'J ^ 'G..vԣh-.Gq_K.S fJό:-Hz1s/~u*3;Q79'Yik9|,endstream -endobj -1553 0 obj<>/XObject<<>>>>/Annots 646 0 R>>endobj -1554 0 obj<>stream -xUQN0+X5~$s@q@jsI]5I YC\Yv<;/&!HXmLpA/Պ0p>b*\{H.YXbbغ0.1h=P_nՖۂXC*g)eKϮ Ag7s}wDw@R -Chإ#n(!^=_pJlx^.}hvÐ֩,KCQ܊&? )Oh'8*ZfͽgEqendstream -endobj -1555 0 obj<>/XObject<<>>>>>>endobj -1556 0 obj<>stream +1546 0 obj<>/XObject<<>>>>/Annots 641 0 R>>endobj +1547 0 obj<>stream +x[o+xDs8 _k[e`D,$GտwEAGGg]3rR1)byXmOƣ1I|I5r>mXrp~6TqnCQG#=NG3&dTqd5֑t‘KX'ѨvmX%i@jDDz ;/hb|4Mj dW229ٴH9iHM,ʬ0)&(1|Pƈj H[~8'AN,8Ia'&QacYaBeƗ>Gz KTh8Py*踁'm/TCsҬ9BMǰDUY?Pf˱Qb=VMFg.)̚PaKt"h$N" x*"cF.=0,8;Ƭ95Z/US:AԖ3Ia?~31줔;Xcvd.&'65{ ;)tǰCK05,?*VsYJF%cCCͱ+FK24!3aD jb=-*"(cftcV#hDuɴ8b3&sð 39: [əuX)׉AN;(3q2;B$1,&--B:AsHa̢ò9xP1k*rSС"HMLҀʢ$Huv88aXnͥc\i}) XjD( X&iˢҿGT B(#LD)y@vÈr{caX9췻'c;16q:,t39abYaY稨cXRK$6{CòsS3u1*{ʬð +:TJ,+0,ueҊƀuT {X$A{Kdg+9Hl vsD/Nceda820,/ *a:4;LtfaYhtn,C+ mW`خY,CڮD#)èg6B%@F&=eM=0,+ܳ+YJceh/cXðt葬ʭJF55U@ X3d.9ȇ9m9`-@X c-HaL+Cbc×أ\X8da󙁊ɬð|"uXFʬê XY+\O@H!sa%1Ö6f20,WeYa Uf09Pʠ4}ʉ@ؗgn2 +9Hk4eA, X1K_іfGXdX_2Ypr )lHQ-k1ܠ6[uEwHOV;qxHLz *IcJm`WdFS e=%!* Q/ؙY"ǑRkǰڳ1Jh+ X2D7NXSkЪ-~6dT˒ն,"mbd1Ek5*S +ḉːu3o*~6oR +(XSpM=edžY8b$pUZ VwYȁEB6F`"k@9[sPi<'EAsPW( ߾-A]O_<}<hŕm߬]{u,Ϟ2'<^aUB{tu߄.|u{o]kQYmazumk/^ֻOaod8kwfG<:.M#h|?ё]4:>4 t{^>ڻ#pqH C-p0*{[ndjabv#/6kN۠SV{[͠^5}c)g)!,el駾9Ϻ꺶?~7pn֫uFzrb>}h 7ś(TUm?}qr=qf8wq +_OK ??oz𡭷 k.qgow:/ɕw%);E~S@35}p :[ZtZ`}me)2Up-X}1J W*+|Ǥ^SaM3^őJa!I~ivkGG|Use?S-bL"lIcT}n7>z|8?u9t]5c/o Zo6ۺ |v n:<{y~eE}{O_aܫZ?Ӣòjwn8[metkmMeGi% |.Fvw+.']<_ՠ'v>£ .G7PO_M`7u|U 4.cAG̏ZtT]Rk \K]pRWl'W=endstream +endobj +1548 0 obj<>/XObject<<>>>>>>endobj +1549 0 obj<>stream xWn8}W IH]Ih[]!)_^Mju֧~4꬗ht=̮ht5ZIp0Y=.`r|Eӂ`oX{iiуKkX4 Ht|'̌ߏf.W:7EVxc?urkYxozּ!p0J/񷕒 Ԟ<|_ .x ))Y"gW\4\ .tw8c跦Jӽ,f7[SҶCvG>~? Mz>w"^o7gb81wӿuP &Dە!h!*U*ai$#_*oZZ87d,ո9\FYr?zV0 }f +LWRH>8qa8e~cASfD r"<!hLtC)Ė%٨BRirQ*^<gOc3Db#T)%ƚwMK#BN3\w0%# \8x4"QnK:| !;DRЃL$@AlLvJɇ/ ۟ym0y Zry zKa H]+{ȋ g˂PX殭D1R7֝P^}r+<"@ثl D5!1tDh@В= w` A1'#\0;a\ V75b0oeȑ$73jMQASm/G[)\Tq: 3F/;MW UA=:e\ݜu)Xԯ4(GB DY+XnkyQo' aؕmԻk߂V_qDݻf8O|:fGzxDEPwt(N@ٲPilOu5O^5]ƣl|yN쏳endstream += >O|:fGzxDEPwt(N@ٲPilOu5O^5]ƣl|y}N쏳endstream endobj -1557 0 obj<>/XObject<<>>>>>>endobj -1558 0 obj<>stream +1550 0 obj<>/XObject<<>>>>>>endobj +1551 0 obj<>stream xV]O8}ﯸ iG-VEZiafծi$NkHN%h(-=ss4 ~|Ai9DZWъgbMbގ.ocNi#bmFH06=W:7^ ;a3w7GR+$(3PJ?e"-9ixGGYĪhB2ZbnEwR闀^pN8?nQUqUY#ј݆Q:3GG9exϝ7/SJjO>`)⃸ #B92k[VҔ / ~8T Y7,1A9o\ZzMeBF+I?5"j4A=^E+{hްb]B֎=*,*hٛ+VO 2Nro!=odZ[βNh<Z{pѶ"YPI2:+XA͕I/(£gp+C(, \G鴨wFntD:XxZn_zD\^SgZ\= 8%,ὡ# Mw>Χ,?`覥tv}TD ,+GĜOgUTj !LP5%\^9_7]nfCmo{ίwW *eO҃'o&Z:B$pPԕ(XC YhwمA&K'w%wD0#n  R CPOS"hː/"xuCv-ي]Pxv{*2>뀾=,B1\` LfCiӐUV] Q9D5dlǷ[ -*H=k>/XObject<<>>>>>>endobj -1560 0 obj<>stream +1552 0 obj<>/XObject<<>>>>>>endobj +1553 0 obj<>stream xXMo7W t ز-;[/.%1%7$׊} K{(;o޼5]k_/OhY oUszRJ -/>Tj @@ -2943,49 +2925,42 @@ a 0 dxinLԽ㟓 C.GI <Nj^7>ɞI R3HJ_Cҏ8MHJl8g@v-$!a|Gq,P>YQ'\[ܡ ^^"IO):!luFr<g3KEU4ĝeU>N*4hnKzf'.^ْۛ6(ˠ@1/'3J:78@B{ROvXjt0w1g3P}e;Vo~$*g1K-i*6N&0N |9G$ɐi|`IaiB<ښyj=713dDALL8;Q I3{&k4"v; !Hn U:[ך\u^kUٹXKBܦ AOb=NY$/d V42E|El|#ȫlg-.y&Idn:q @p9OoiI -D  ;/[]睋] ZWcO(󳱋u})vaz653ys42jwhRyûev6_Ue ӡa{:G WQen6hi<{0m2 MxI8H=\1dC螲ǷoLz43ZE˔L{Ë7'.'$\/z5xܢG!i?KnmYmxْG1d\9r6(tmZ$IRa5΋(ȳ.Q}ؓK@=Zp9~.!W8,<^RGg^93߷5x1IUn4y\n* iSVoIY!7PEph~)MPD:upB@IxzКq{cLMn7b@QkZu jsX\ rmyE@_5]pw2s]2]#]ng{>̑-J&q]/%£naMN@̔{2*\5~:L. I/(}zVωAܪW1R9{0:rs=dO1Bv~n:7_'!,endstream +D  ;/[]睋] ZWcO(󳱋u})vaz653ys42jwhRyûev6_Ue ӡa{:G WQen6hi<{0m2 MxI8H=\1dC螲ǷoLz43ZE˔L{Ë7'.'$\/z5xܢG!i?KnmYmxْG1d\9r6(tmZ$IRa5΋(ȳ.Q}ؓK@=Zp9~.!W8,<^RGg^93߷5x1IUn4y\n* iSVoIY!7PEph~)MPD:upB@IxzКq{cLMn7b@QkZu jsX\ rmyE@_5]pw2s]2]#]ng{>̑-J&q]/%£naMN@̔{2*\5~:L. I/(}zVωAܪW1R9{0:rs=dO1Bv~n:77_'!,endstream endobj -1561 0 obj<>/XObject<<>>>>>>endobj -1562 0 obj<>stream -xTn0+>%@Hczh*zɅ(D*|w(-b(ܙs#㗣aD'Y%h2~X Q6|\(k0XykM@+^dҞ N -/ hT'SedtF 9HwDU^%>LQFs`eZubѱVǗޞvr(t0X!9h.@E&l ksRph1 Ma^$P!u|ü[|:\L]ߊ!IvkauFӬmxqHh⓳:I1Xro2 oendstream +1554 0 obj<>/XObject<<>>>>>>endobj +1555 0 obj<>stream +xTn0+>%@HkzH*zɅ(D*|w(-b(ܙ$C/C>bIwy\ϹD=+&KdOVE)BWFCjmeoBPKვW`"cT'\pVx m{ܾBZ 6w$,[$s_8?M񉱕Kك#)oT)vz"Ю5V*i,qfj}c®a .g:fb';=\p'!ޠ4){V2er.|,S'`pC틴Stő؈n+ UpUV6hD@g*96x҇Q(0>[ʵУ|6QW41XYAUAl婷g, + 4VH*6C6\E; ZBSI/3B0ij_߯38yd7wj͓,=>2DWGӃYGsg4h<^|nM3VeL̗IZGċe>/XObject<<>>>>/Annots 649 0 R>>endobj -1564 0 obj<>stream +1556 0 obj<>/XObject<<>>>>/Annots 644 0 R>>endobj +1557 0 obj<>stream xVr6+樭h%G6J묕J@ (aM\VުxS.% zz[g@} h6єd'}<ٿ|3$CLɜ LF_d|!~,|0E Ȑy:" Dvoע4'Q, GŘu9|G aw_;} н3%ݚ[h0z#.ߜ&!UjWETxbLAsb8K|Fewڙ$Vc8Cڑu_P+Eq̯gHS \V5OKln5j3+GNٍ\L`Iim 2D'"-tcX ƦX])9@5Z9D[,s,wxKE!% m+yN?e%V*O:6M .+׀׫QȞy =&BbHPzi-/0fSrwOP A1L_NTr {Z?,|CRX D+?k(OO -Yyڶ?]*kdq᝶JzcwoW#w1`i[[ Z)J(k>/XObject<<>>>>/Annots 694 0 R>>endobj -1566 0 obj<>stream +1558 0 obj<>/XObject<<>>>>/Annots 689 0 R>>endobj +1559 0 obj<>stream xWYoF~QQ<$Jn>$X@QyX+)e~3K ͵z!E1%ʼnxI8 љRAazӆO}p $7 &q f7n*IM}x6 Pt :ҳx3x(c!:^cvltDNj9ND8#.!/A''Ď.Gt?p$!,'hBtBxA<9鈎1039hBtZ`^;Xpq!u1?]Q0R>͓AE]V2{ܘ|$tPYLk< tMk*m0235A(1ZYVh[SzwuIYMMj2keT-^Q]?<U+~(EMaJzaYbVc?85;ح6v1`q`3VKZWYiec#tV-{=5YmqI'sKu56k#Vey$\)uV7meǿno-r?N]> =],xl#s@,>2_a;]Z:OӇ> -vk]ϬL)3& MXѫKrj\$ɪMM7݂.xssU}%|bn3a4d {h1kD-rR1_tg/̳!_YDé{R؛3\!MY'0 endstream -endobj -1567 0 obj<>/XObject<<>>>>>>endobj -1568 0 obj<>stream -xXے9} p3L {PU ]Hj=) -c.݀*/'OL͘F33*v7lD,b'k%oޯn4jgg9JшVE^eoW_n|0e8QrAS1뵴f^xe4ƚzO;+\ti[0KV/nD4𸣧*GRTՑ~^ ɗ}%&r[c=(ېHr ۘ V=Y[%l<-l#B~P'ho%}0;#%|p KP52!S -|n qx>=Řx6oO6097(sS M -¹%_^+ - -,6AQwWkNtP~Ο >ɽޚVMRHkM#{+#FfPUT֏;II$/:Ґ)C7 sŔ> cK4vY3i2h"uQuja_׾{BC,~cIPgԅ\/+pZ<$.ǫP\Y@71.У෵-(M1mʼn -$\6伱G!2uM 7y{h{h0%6$*gBh"n `r5ԎrAy%)ׁDʥ0GC)s+ ̒:*6.-]=D=$ -W(EkXCteԨ,-duLtӔg65 -G:Q}u+!\F r=Ţ?Dhg{ĈP@p^M :Rbp֣-DJׇtJ츼%B6qq^{=fbw{y +SЦÇQr`tRCNVV=:GB`{;邽}\?1endstream -endobj -1569 0 obj<>/XObject<>>>/Annots 697 0 R>>endobj -1570 0 obj<>stream +vk]ϬL)3& MXѫKrj\$ɪMM7݂.xssU}%|bn3a4d {h1kD-rR1_tg/̳!_YDé{R؛3\!Ŭ䏓0endstream +endobj +1560 0 obj<>/XObject<<>>>>>>endobj +1561 0 obj<>stream +xXr7}Wt"7FV%);Q%03 {F{ Yr۲l$/On՘F33*WlD,OJZ]]^ i>Ƙx6on6Y09Ww(sS Uw¹%_+ +,2AQw[kNW~!>ɝޚ⌖MR@+M#;+#FfPU*Llj?+kz~jHkbJTIr]%B4zfg:Nc5ڰu}kڽ}!}v6$Y( i3ZBQԗHO 8-DrU|G. Iy` qxxfiѦØ`HNEû;rX#ѐQd&L~k=d=43!VR0LFjG@"RxPdqAq{9וWfɊ YU]o~vV6Gx"M Q]+B!2jT~d `:&Bi Rz#.w.#aAybQy&=`D(rXDB/o1hĹYpY20v8@8RM2jYŰR1AvU!E|`ES<6ΕlN!_M<(t-ANgץ܁ A#{Uf22pxR9=8CdVI?4r?UB4FV`V2]g(R6@aK +OJ'MyT_(B.(WZ(湀B2TaЛ$ Eu +Sm'XrOE=qoAB?5,^< nqOn 0HIcR.y.H(\?t7*k)j' fk-?u&;6WHN(6 $Ia1Q +y&FeÓ}Ո +a&-i<2+Tuer毼qIf/,5͋]*b[-4}xx@3ޜ'md<_^d#FH[31w@iN`#,Mns@jM+EBŜ49]bRRq%>t.qv13T'Pւ|.d&F f;ݨO׭=ta=Xz+,覰^@ۭ^fs]rE㱇fՁާpң-DJׇtJ츼%B6qq^g=fbw;y +SЦCQr`tR}NVV=:G[%z~g7fs~y0endstream +endobj +1562 0 obj<>/XObject<>>>/Annots 692 0 R>>endobj +1563 0 obj<>stream xWko6_q[D8oI vm\ Dl$ҡ8ޯ߹$nuCx_QD}D4it: G4}8;:!e4b OJ7GÁ_pB(Q轋Fte7vںE4[_ɘfާY}/t)R2:KSXI\ ZN^Iı)uA9Y|K+_Ͼf\ ᄡ%hLm{D ?E=n4kDRZRa+'TN,Lb۶GUĦX+TMJ"f=¸ T*@r۽6rVQ2eX$}M fbKpRnv0= &atN@#8F!U[e<3녇50ukRqJ8"L:*O>q&ٺj͑ۓE[<$.wC$yf98쏝 A7Q RG$ Ĥ2~66skf́˾0H^04ij6\QpGS~nJ4s>/XObject<<>>>>/Annots 700 0 R>>endobj -1572 0 obj<>stream +1564 0 obj<>/XObject<<>>>>/Annots 695 0 R>>endobj +1565 0 obj<>stream xWkoGίr[HޅCC>b|a$;dfטs VUE3yιh2Ofp4M4U85NSIx:{+etnh4;WFҒl4ÃNzg4_"o nywAJ'Iu=+#EtMzIoDRimCyۺ/auDY& v+IV.+jd]mĖM|}OU8"&eɪj]n$Roѭ̓4OI_sF%HXOڬd.祒uækSi6ZJ: ۻUu.I"hc$(o\!?kH!3%;(ZF.]0@hsft8kT)=w"\cf% bR2pr'GF;ܸ}V,tIĵ+Z#F5KJRK?T0[G 1(d{k)F8F~ F:-r1mfK12)>rȼ.!Ugh |% H'n -ngP/r p,x.,,~KWFF&d N><[6X[PXP 8`#?ˍ Yx2-4 Sĭn(E0.QzE0[M#$%bf3=8NSFQnAA&>nvMcR54ʶ`0~}Tq1RkYtݽ6۵_ E([S6R^޾:h߽5:jONd\קM\ ݴ[^c84U6DfCo ,o./ 1[hE!tHɤ-ͯ:h2J')~?:,Bendstream +ngP/r p,x.,,~KWFF&d N><[6X[PXP 8`#?ˍ Yx2-4 Sĭn(E0.QzE0[M#$%bf3=8NSFQnAA&>nvMcR54ʶ`0~}Tq1RkYtݽ6۵_ E([S6R^޾:h߽5:jONd\קM\ ݴ[^c84U6DfCo ,o./ 1[hE!tHɤ-ͯ:h2J')~p_;t{Bendstream endobj -1573 0 obj<>/XObject<<>>>>>>endobj -1574 0 obj<>stream +1566 0 obj<>/XObject<<>>>>>>endobj +1567 0 obj<>stream xXmOHίC=%wPPA*tR$.׷&ͿgvpV*gyfF4MttBIq7:шK~t2-,zH)K1m PHcJFtʫ{oQh~%*i;ֲ$ >i+\n-brx$ht b|2!;p80mPl%`;ʥ6Y.{7JaB#IN౬shg EKN^=K' c 5J vbvOsJOh21~+sI`SZXVpiIj @@ -3018,23 +2993,22 @@ nh Ra#bui!O$iOXB0^q\[2tUJI u[c_;#--+3}W9a o!L]!qn|5tbm2U˜M˯/weh `-ԗw?,LsL(ޘJ,yU+QsNW䀴?KlNA:]N-# ,% b`tۜwNyESxǣ_3:pt?ǃgɳ *ac /$bNڍpƒ fU*ī‡- FOE+f8at/ Hpߍ0ÁgXmT -}V/)V aE0Tպ`t|Iy^a3Ncr -z)Vp}F_gg73twwsb,?<9a[M}{t7..URc#gӇI4dxMeڿ)Uݧ mKf5< 6u<9&'SfG|ϽD\endstream +}V/)V aE0Tպ`t|Iy^a3Ncr -z)Vp}F_gg73twwsb,?<9a[M}{t7..URc#gӇI4dxMeڿ)Uݧ mKf5< 6u<9&'Sf|Ͻ:\endstream endobj -1575 0 obj<>/XObject<<>>>>/Annots 703 0 R>>endobj -1576 0 obj<>stream -xX]s۶}ؗ;6m}Xy4ɭMd܁HPBM,@FֿY!:ɴpwq٥ ~'lAYuq6Y|)^VR z.KuLTd6MfUI5V+Noh5lqX]Me|ot:īuEmV_o.i2M`-VKd㻆 -e]C[IR5ĶĻI+̴qtP0yۙpӕxwaKu| C(#FKvuCWLJt4-eVFyNx+vNɜwk26c=H">/XObject<<>>>>/Annots 698 0 R>>endobj +1569 0 obj<>stream +xX]s۶}ؗ;6mJ>ri[O4;X߳)Ctim# +ٳKy ~SZLh:Invz,i\/+l=?]$(NiwUE||5*<{&6Z:`5ViZ%i]W4Moyz}qnFiJ/=$7w ʺv-Pk މmw{IVdiu蠚?`39&Wmk!+I–#ic+QGʍꆮ)LJt4-eVFyNx+vNɌwk26c=H"lh /jM[@Q^a+T 0#Y \B^ -k*z2k)Rx'1%岁 -yO ؚ- jczJIms+c_U ҂R{JS's' fA/q@ls K;mUO[xjh,p3 (ת&&J xX֋޵dP={oe2[V8a ,}zp `+KoC=C(DD+wʱ=J(š˞D+eT[@;t h$~ń<9u>$jڋVhR{8E唄zer47Ѫ2:y5ܗjҺބ}R+1t34٢6B^Wi=)sVxPElf0Y [ŀ -x=@#?yZ#~~"g 1{@03a'j 6Kǎ3群¨F~` wUS gW8w<~GoLciՌ7xAh' -¸c>n.~ f#mendstream -endobj -1577 0 obj<>/XObject<<>>>>/Annots 712 0 R>>endobj -1578 0 obj<>stream +Z6u-$vڊBH0eiUoh #‘}ly9\RM̹X|b` +A膱a+ǃ9UբQ[U|\.g1pfH!8<WsZ%(rmwM8Sc}_AnR|(J96s2(+3 ?Kߊ.Χ(ǫ<'pt є*S {݋MX} \* {97Y"<:s3B 7K>44X:bp!+l9HM4 5-s(^/鰇MORgJ/R5W5P)~p=8uGƷD!VfO;X% eO2D}~4 p?pbB|:m5E]+4[= ǢrJBB9щhU@K5|Ai|aoB>gP NlQ|bQ!/٫{l ðzƃ,`4G4*j5Єh'\(4<69t)82G{R*HTY.UDq)r3IMSڌ0{M>|)8O Fm`KN pK '{I=?k_whf x­>J=\x`1 'Ɛ0VAM .x{'ffY1ad ڝ.`dY(WU-PAogwZPֻA4Y1+YVO5">}]+<߀@нB|YEk{{#gi1^a9{9<7K@3Ez3;ӥŬ nta/XewVl(\3s7cQ +O*|W\|b''t T9K`ǜ;Q{9\>v̨9%F%7Cp|^◝"S|_Uw_|1Yˏ!9*7+7)]-nlփl1K%q,߮/~ fmendstream +endobj +1570 0 obj<>/XObject<<>>>>/Annots 707 0 R>>endobj +1571 0 obj<>stream xWr6}W웜P7v;i#ig Ti= 3Ǵybٳ_{gB) J8tGSьJ-VѸ+hݛWъ1x;~ C4'VK\tɌ/hNx-–3MotdbM&该}o_mcNe^ܩg2Orުm#AXd2;$yc G( OXRy<>|ҩ98{v^.-c;nv1'='EJ_/淣s8qdt>}C'wB 8}eJG=Agi8E Jh'Aoˆ'az*@f45*ۼE)Gk$PzOknM ߡ'S:'Bb[f6ՙ5%G@?e͇hF7432aYMENx2bjzGJaD(~Kə&^i}OC^"JTz܀>޼|TjC8F%N[qF6F)7&%/P\u\ji (W0dG"S}[á*G7ВV:@d@*k<5] @@ -3042,20 +3016,20 @@ G +iȤPn/=Ӂs֯/,POg%JS"I:Xv,mLZYP.e j2 Zs(, ) b>wp`l_vT`YUP)D- ^YjFWL;ݠ]P$4맭_PV*QETg TS[U-93-1 ȘfBG28w* !a}| M6[vbx9 2`QVlm1 8so5E5O\2([l!f/kG0p_`:\[SoN['uUnl6(jȼ29Cmʠ{Mp r/o ʚw~vmgy TAG\*SqŬ̀;Vn6@3SFH|{f<ԥ68L25rVYd(f}s5(L{:X^XQz"PkxKoZ2`h_M^i#}1$*LS*aj:(@'Qp)4ڽH@ U칪?iA**Ol,͡(xb;V$5Uq  :in{BwF+`0h -Yߧ{#"'ZZ8I4?jKY_3;eByNYAR^>Ppxw,5sh*8XUTEG05 JF#Y6 wTJSTpvR-sf"b4n0ރH+.& /S?8sc4iE>>|rށgz8<ŃUwP,;GX)e9!4p>O#b`_{`n}*( TO{3wahwtbL ˘ݛ 4Yऽi_rX0[΢bU.g1~ >endstream -endobj -1579 0 obj<>/XObject<<>>>>/Annots 729 0 R>>endobj -1580 0 obj<>stream -xXMsFWRRR"HI%ZȺR  en|R7=],3u4?c(NFoOoO]x>x2)|h<)//7'rduM'^#Soh{I.֟ޘW} ~X 4@O:AB\j#|s':J 7v 4l}ylYQcl=jsjKDZҘ6tbq t@ecπ!զ{􋩎u" -! 嵁/&tDc9rdpoL#wvy{gS!hvg)ҽfd$0&EjrwQdC"@bڲ>ˠU@ʅRrm]iR*s7˫8fyۨ)ā{H/ňPfV*Uk-0Ju~۩+Y,XBp9!;}W>Q9©;]<^Rm0:7kpuI(V/O>߭׫gpB6׹|ejPe{z`M zP:ke!@",*^ x$w!GB+{X>ݻS+T#k0zP*+/(,\2|ek)cJEZmXou Ii zlޠ|:˪G ;| 7?ỗsl57{4Y -vW3Ϩ#|͡DZPe-w\'++) 0^Q_^ L`ˣRg;Сe7?mph 2F;Z|-VIZm 7#gX,)б2`=)5ҁ(.2F&hzQ=,s kY=a:Al!C{]3L̠MtHea:GRi%[JTZl~K }i'g&juMP}C[=~)0.wCWY1W)_B[qy pо\A3ٿRZf[xP|Y) ȭT ^-nf}Gz燻P 3~6|-"C=Ӫ* -Sb?>'qET0YH՚6oB)nlS!~”^lS LT8`P8q -r|@s$>ɈLr04-% NBw!q莻JǼ1H1T \ŗ ɝ?Yx ]֔tuu}EK+ߝMO.)7ZLh0]~|BRaG\Jya٢O,'x.endstream -endobj -1581 0 obj<>/XObject<>>>/Annots 734 0 R>>endobj -1582 0 obj<>stream +Yߧ{#"'ZZ8I4?jKY_3;eByNYAR^>Ppxw,5sh*8XUTEG05 JF#Y6 wTJSTpvR-sf"b4n0ރH+.& /S?8sc4iE>>|rށgz8<ŃUwP,;GX)e9!4p>O#b`_{`n}*( TO{3wahwtbL ˘ݛ 4Yऽi_rX0[΢bU.gS6s4endstream +endobj +1572 0 obj<>/XObject<<>>>>/Annots 724 0 R>>endobj +1573 0 obj<>stream +xXMsFWRRR"HI%ZȺR  D鲿}_ Do{-Xf|9i>4Qt?ޞ3߻|-(dSJxdDSD^>QM^Ggf_9+U>pm|XM@{(MiLEtb t@O^ǞCr{􋩏u" +! 嵁/&tDc9rdpoL#wy{gS#hvk)ҽfd$0&Ejr{QdC"@bb}(A KKZŸ7&IcϭRT>j/ o& #rm6]ͬT"+[a\1ޝVq>LšvfYSуYq.xq:5QJA(=X +Z$mXou Ii zlޠ|:qeգÆA>b9wߛ=l,E 30_si6}9V2w\JJ?V*;R`ԡu_m^ L`ˣR[uC?1 :o D*dv|$"Z54"ڐ,un 'oGnkX8S(ced@z1a|-Sj"!vҁ(.2F&hzQ=,s k?A 6ࡽP&Cf&:M$DIJFX0#-%*-uJ?z7}a}ް}Z !d0ۄwJ- L賢$DCtYb; /YhUj vKrE5oL` +xgL)cT&UGw9i :MBצcgZ \VvV +D5"c-ݫ!r7o@7^C"Ӱ6ȶKl~W4Kw7ܹHf}3 cD8|fj 朖90,*!"]m<Sk/]5N %a>@RuQzswg| a*ai2Zsm ^=\߆Lt84)Pk +Uoh+ǯ7E n*+7>\H0;[Ͻ Gi=\W'eΗ:J(ffww~0J/߆]!g >/XObject<>>>/Annots 729 0 R>>endobj +1575 0 obj<>stream xXr}WtM^i%T0$gpg_=L1.l$0ӧOw{oL#3 MTԽQ6“?_>쒦E6󷊖tMi:f٨oqMcvy״}va%9^Ä;v;8Vk6qqyARѪ_W{u8u=ŭOr;)\F~}E)Sezj˿Y}h8fVe(x/EG;ʦФGS4*6WxM3OT5g6o]Ƕ/8X l4҄&%L*[Zh=C7qk \#4/f#d#"? uM&Z<:kU^9x]'IAlL`pPY֦*:EVc_ @@ -3069,10 +3043,10 @@ rB ɩbpQ{?)uڤJՉDgan$@Yѿ5@ެ4^0*Gت#t1nN[i1e dAY%=8/1]MNTK_af8W5@"y/C,i]8$8 s ,+xvUm-Jc[oy1VU]!܀uO5 m' IQԹ.Gֈ78=F Q2NI{LtاNCjwF䖗^oº]  kIPƻf'N?dXtKF={D', }_uVM1s 'FHW@TxU8pH?B (w(JBG0LUp;PD~ ijȈ+mixhFGdy*1G6Á I',#3Cnվ )hˢv~ 'Jgxv$.Ohm۷n0 X#\oq,? 9ο} 9vI;|3/ GXq|EN(D<*qLd --k;W5Mo|y 4#Ouɿӎ\Qax"YC5~_e s9|sV׷o޻o<ʽoq^Ҷ2],{YvF5aVzendstream +-k;W5Mo|y 4#Ouɿӎ\Qax"YC5~_e s9|sV׷o޻o<ʽoq^Ҷ2],{YvF5aVzendstream endobj -1583 0 obj<>/XObject<>>>>>endobj -1584 0 obj<>stream +1576 0 obj<>/XObject<>>>>>endobj +1577 0 obj<>stream xXnF}WCEK,iQNV@/+rimLrҎgfD;HA$^vfΜ3}=G4ɔ` i|zi2gk4_i4Kq0#b47>X_Nh4e-3©!-Åsv8P^g-&gB {g+=6)όK[qtꍭQJk6QfKe__4ev(ǺKS{\VUF ՍMr }2UfW讱mg,y\tM(h%"~4ßֺpbt8ϭ% Oƪ,Uٯ9@tIh s1[su;9+_* !_ n9!mwp::]ʸR^QYip7Ýr=r^ZxBbkYnW'!dpianA[I!T+4UYOn d?jE@ 0NM9Am87:^).b\p=5 Nwӏ<ӥEo#U8CkkjfO;7$F%-,n`zFudKzdع @@ -3083,10 +3057,10 @@ Tr ['?vkKaMpKlЧVMjm/qASD=ώzug7]?xb!< >Ϻ.jƦn0y}1w ]*BI -1s&[79=I-<.a1|*H {Q/$A:<{|k[`bb.# U/)|)ήNBǗg4\`2 u~{}_Py# Fj2j"yyy~ZT;s~xWbປu6X!L]3B4.VY2 ߎ3iOӭ1 oJ2 FxfBhZl*MQ}% 9z0ġ`{)ې*Xbq=ym4<'!,c l7*JJ@(@!^EdxzݱGǒ&sŠ/XR KM ȏ){,T8{ (YK+UL,&lX`j0{ {:JFV[o,V=P/_bӗ#p[vh+{QN|EeaWac)b03uُy( YTu6L=w%}S2$B+熾A5&,yV`*oE&o4iz?Bśsn4=L&9WMcUl̦ɔ~<_$pendstream +1s&[79=I-<.a1|*H {Q/$A:<{|k[`bb.# U/)|)ήNBǗg4\`2 u~{}_Py# Fj2j"yyy~ZT;s~xWbປu6X!L]3B4.VY2 ߎ3iOӭ1 oJ2 FxfBhZl*MQ}% 9z0ġ`{)ې*Xbq=ym4<'!,c l7*JJ@(@!^EdxzݱGǒ&sŠ/XR KM ȏ){,T8{ (YK+UL,&lX`j0{ {:JFV[o,V=P/_bӗ#p[vh+{QN|EeaWac)b03uُy( YTu6L=w%}S2$B+熾A5&,yV`*oE&o4iz?Bśsn4=L&9WMcUl̦)vyoendstream endobj -1585 0 obj<>/XObject<>>>>>endobj -1586 0 obj<>stream +1578 0 obj<>/XObject<>>>>>endobj +1579 0 obj<>stream xWioF_1uaT$ZeIP>@VQȥ1UK+}KJ2Eѱ;Ǜ7o_B_HN`HYpJ#V҃/Na0Q4 BurZw?LFpGfDaH(!gxJpHwZO6S1_|CVɄI\+I$>HWTjKX*jci!Q]UR!)%ESVZWJ+6[^JXU.I  }rfa8+Ȗ6F-5ue*O{KX4uѼ'RT>x2.ZS "-\&*Me%KKiO͏c0Z')8B[d2] Rb@l&X%|o$]9\н hq=t׊PmPņޫ2(B8)1ג:;'ry/ke2`mO-3vw *8UIat٢ lhLV|3a)a4FL{[6zt[uW%$B' -8K:42+e7+MqMi@ekgfw԰ Y#^W ;$r0쇍QRKc 0UېR3) QMqJׅ \h~w}҄t8?ǒK_hfcg^kU!Qat* > @@ -3098,61 +3072,64 @@ FK #G  |\5ء`o e,qb"<_2<QYVkZcˑx@3x"K iP8ƣ(? zy3q#- |w^LVch2 -&xţlM26endstream +&xţl2v5endstream endobj -1587 0 obj<>/XObject<>>>>>endobj -1588 0 obj<>stream +1580 0 obj<>/XObject<>>>>>endobj +1581 0 obj<>stream xWaoH_17q$ECW 8Rq'^'Klo]7Dߛ];n]N:݁*Jݙyޛɷ1wLΦ'hDi4|cI7Ϣ8ο9M^ĩWsޟGycZde:"%hCɋ^( -6%Abc&Dn2Wߝ<{]J"B0dU2#G?E@bO qğ__va<僀L B+Y:K{VNeU)[j^@ނl:"sc~?aH8DՎSo){PwmzmD&be`ꦑ +!(qţ1 Y49Eq'5Lhўjfl% W`c&Y4Љoh`_}ôQp\09 X&[)l9r֖΁OLX}px#˪7tw%]o@=丆'^ht+AB$,:8.]I+I4kYk̨\c:Q8 NX6^g%,+\.3%w~f UBhLTh93 "Dyt{,%bȰpG;V@a7@\x9e&À*py'x{\6 /*~e)"iȇJ*=X߮[--뇝FV+6B^J|Ǜ3^4ͣm jyl 0Ȣ ^•S O{Bau,#Q L5\5nt'D(cpZ>/XObject<<>>>>>>endobj -1590 0 obj<>stream -xW]oI|ϯh%A;N)p. CEh;k13qz>֎tLwWWW<tqBpD':3ʃWӃ7g4ӴĉM ӣMJ LCMA.-mtK?.iQ[Hj4VF&7(+;:H{8|1q0dxxG?Y5^[:RqZZjWVApy!U߇ V#1p&$jՄr8\bI|4FD-AFlȮdJJUcP8^ q׊z&=JaOUnpYONGi{Fύm{nuѣRW4 Lʆr#>\Ӆh^||E@EUmRƾծ - %qp`~r͡ZT bq {1/ϦD. Tg!ѸA:PH}=->QO ZIS+knO]ƨ,Ԋ/xck"oOv!0 3 ぶ܈\4G E -SU֬^I>U>PF>0߄cڐsNzփp|JeVj :L Ѷ _9>ڵ6E -] |B 7ےXI)CvAϴ[F]'%VŠTK21~~on,ZFݴ^/@,{NYwM73^33>ل x{D`+RnZJh"f?åYe4YƁQE.;}va~ps#1'! #r#ͷ)W'tOB_L·o~g  P/pa$9 s -9 hdGnwfMOU,AN-`@.A)I몉IMxzP[`f"_bAWt!^XFJcN/6ɲ,yȏArQ/TQ-=ً@e<ݶZb߀Upō&n3E/n:/.>:N^\tV +Ax^y&l:`9q-Nޟ G endstream +endobj +1582 0 obj<>/XObject<<>>>>>>endobj +1583 0 obj<>stream +xW]oI|ϯh%Aqx9%swg;ff6UNޟ'4Ÿ<1h8'xFRyjzpNNhZxrIӂhD,H746DSKKݒ* rxZ+͡4ɥ>J7_Lhp:#;<~VMז.(l庖C\^HtzBUH*ܡI>Z5\7X%QO΀ #m6dW2WB1z(E[zkE=0*7NpuȬקG'{ٴ^{FԶo=HкQBK q&eCbBZ4/>VU"_J碪6)c߇jW_G撸O80gJʎb?9Q-}psD1 ̸|\rPgS +X*[3]h os|(f:2Th|iЧ4G1ݗe8%4^K}U\K:x4PitMMg~ ߆f}5AA +zLґ4F@>2#ثF><0POG,)G9Y04-"Z;+a]?iW[4+4= +D6Z@|Ԩ'J7'.cTjEF<ѱ{NTS_Mچd@[nD.@v +j)P*kJSLÀ*Oot#\UoB1J mH@9' =A}>2`SpNUc&rh@ٯHhZOjQmI\}OG'CvAϴ[F]'%VŠTK21~~on,ZFݴ^/@,{NYwM73^33>ل x{D`+RnZJh"f?åYe4YƁQE.;}va~ps#1'! #r#ͷ)WtOC_ߌ.co~g  P/pa$9 s +9 hdGnwfMOU,AN-`@.A)I몉IMxzP[`f"_bAWt!^XFJcN/6ɲ,yȏArQ/TQ-=ً@e<ݶZb߀Upō&n3E/n:/.>:N^^lV M"r]F^}v -DLܳwq <$Tg6v8$dyrX) @sf`G/l;8 wwmWkW]0YRȠ']9IhprNӫ []x;)䬝P%dPDԻxdg@} -DѶ/_m`[]*`}u;ôo(>Mx4Qkc旋yZ|.@&דt {ʳyv^\ -k.*>6.@(9;pL0t1wQT Oe /Oi25V:oN8xnbtF2^a57)ռ5Azuô9/j輕Owr?] /&a8uI*endstream -endobj -1591 0 obj<>/XObject<>>>>>endobj -1592 0 obj<>stream -xWOH_1tVJ$@VT8ZrREILl&ofm'*]+{Ǜ7ofh#pBq~Fh&Ӆ/v8DO_F0~4dcXM~0E|<шf 19,!=,~5N"XkZ$fzF_];|j -:g0qԚ'~)H󔙥 oWJkiOG3JV+fWl>3bUнlȕ:NN`ښj=JW=kU=\8G4OC1=[ZNi@)y>-!fXǩ^ ww+kwwW''U$.6x8KAPiEWz pb*-<~б0Jn@*Wh^?832\{7,8hk*ZG͉s^ @ԖC2x^0aLj@q#@TXvGuoTHl{.u+Se S5l{^'[TŖ $Cmwg/a,Q{7kRDIȒtVೈ0OR#uHBJbySa.Rd}&ϜiK$ (n.nIpp9L, ʀ3KߧB o66om96T}QeY}t*ݽa&K{p^]HUSC0 :[HuRa?l*WE,TH+4VMN:6-}$p!"ծuO=WkcYY@
)bES-Z pF`oNTҹ.tm;:/=&1 -)"-bx -~^TӯCk@|M!&t!uze0P^DvWhQsB7eOkW$+JUӃz,13.;-X|14ýY&b׈;EVѝ!ÂΨlɪ qe-pb +?|x\dd[,b2Q΄ئ܂ypdf#d. 3-KuSfhX^4cG aDE}"]V6lN -oC|5tQUk<9Z(o9 CMgjT|n^j t qD $>X|Xd+Tm -j] -KX{\ q?u "4:/[z+nk@,v ,sc[zu |]s_S EwvјnzKi$X"BY{v]%l0MS`@f8#<͟">1w?_s-G-6)@yA6'CӱȒ2_YaQjQ`gԁǖ;7˽- S&9:psro5D#m7l'99 PozS[DێOkKMnE9/m3PAˈ:cV r5d:,ٌJ+`laŶWqL,{w [O-/a0bq{:Dv ջ1D2d jb:nCXxRtG\Oir[!_>oϯޝ؅v͉txݓy[UWń/Bm//lhzM''?>bendstream -endobj -1593 0 obj<>/XObject<>>>>>endobj -1594 0 obj<>stream +DLܳwq <$T6v8$dyrX) @sf`G/l;8 wwmWkW]0YRȠ']9qhpzA []x;)䬝P%dPD̻(1@/%xD٣m&^*zgZ7;wUviw9P|i"dO/]WLP1'qIbgc켸]T} +#m]P:shw= +a~9c=+A~I1'g4>5V:oN8xnrtF2Nݔj źaڜٗx5tJ';{/χIX)'_Ӄ?)endstream +endobj +1584 0 obj<>/XObject<>>>>>endobj +1585 0 obj<>stream +xWOH_1tVJ$@VT8ZrREILl&ofm'*]+xǛ7ofh#pBq~FhQtBat_Ӆ/v8DO_F0~4dcXMb2|<шf 19,!=,~5N"XkZ$fzF_];|j +:g0qԚ'~)H󔙥 oe}+M54ƧbID+}H6fC`*^Sa6JT'0mM\A*x#ɡFCU-O4eN{3,qfwT~Qۻɵ*JR|8KAPiEWz pb*-<~б0Jn@*Wh^?832\{7,8hk*ZG͉s^ @ԖC2x^0aLj@ϸ {pia,M:7cj*$6}=fκ)sY- bKXӡ0(CUʈνЛ5WBP$dIv+IYďkD'EΑ$C[Jg%1)I0x)P>Igδ%E7y]8X n}&e%S^7zyCZ㾎W:^q0 %Ei8wy.u)!Xd -$ҋ: ])6XRY*Ƃ٦@'eb>8jWOU㞫赃,, q@1"肩 + J#07}J*\ :gێ{KaDOIBHX3k+jqh=_){[>>3<Մ߂N1.}B,ʫȮCm"ur]hwʘ?ze=] +vzP%fEzC#}7DQq"#`8{Xp-Y1`U}E㧑oolv@ZLF7Й۔[pgixL6h"O6tӢEw umUDPK]Ml~KB]5PQ21^&!bqTꀒz߮ίWR!C+ahߪǦH t-&_M?]TC'9sy=sV" +[򂀅B=Z$]B> 2 _V +E`x$UZ^h*Wm{]x9KފZ B1w?_s-G-6)@yA6'CӱȒ2_YaQjQ`gԁǖ;7˽- S&9:psro5D#m7l'99 PozS[DێOkKMnE9/m3PAˈ:cV r5d:,ٌJ+`laŶWqL,{w [O-/a0bq{:Dv ջ1D2d jbu܆&!W( }&`C|ޞ_;{ϱ c팻 '󶒫&3 C_^^(NNp{ͣS~av?.bendstream +endobj +1586 0 obj<>/XObject<>>>>>endobj +1587 0 obj<>stream x}WkSί* [%T{7!<.CK#<iF;38>G0*9}ALCihBiyi48d<ÓxBsC(qfNgS|NJ?}4|]zFqL9MfSZdSCZGh%4J?ѭ5*)5=I茮h+4~YI%ØY4K8ѭR{%bK2#cIX+SO%xrSfOl,Kk_GSiejwLZHS& qhytRԕ*]h6JZ\ԅk,qJhNz+j+Q$bPƧ~Ub/o8I '>Za8(j!C*)32хp$|ZU#p:w Jy–HpԲrHF~-F7qaSK )ЈP7ԻOy:6ye'nmkЧze2RcBT|]Qk8J\Q1Jq򈫑?j8Hυ,a$\a,zF/]^ UUV sͥL^zQ-xe`Szea-J+p<0 ޠ<nNxlKh KŘzW?687iwSc{a0K`s[ў!Ss =9kE a?^XNOd0rշ)n(endstream -endobj -1595 0 obj<>/XObject<<>>>>>>endobj -1596 0 obj<>stream -xWn8+pI44rMTt$*f#*IRUmEǒ(̛'?ggt3Zr=;]W\J*gwQR%a)%J_o'QWZtTKY7ZUVvo^"duKxr@$zQێJUIG)T\x05Go.:!-rd$)4FkQXNu pēq&M=I @Q,R~2|KF!*kj-kO[a*.[rd^ \|c~F^Jjnh=衯ikG;J_ -*%l[CJ7TRSl}vXrs)oС%NUMhA#I>c o 2.ԦrՀ2!T -Q`OϿO#_}a<*0=32}`tT#$׀%ItZ'͒"A m[ ^Q 6bNth;FzRvrKPhQHhva&KFR#V1%P8d$j"-0ILBc@¼H_,‹L8@\'@%nE.(5Q 0IjnܾؾRI;h2vszmHKiո9^imXHn:&ohgIpUҦP,n)Y=<9T͠D!@ ƶmX >+ $g^N&xrZ™YT(c$.W $bC+"s<LP9vFl#\.Z݄DŽݐY#T7(mZz,_c=څtҴ NL4FU[L_+kv [G)XUJ -I(SptSp3' QnW\7F2\c$z1'R{=w! ~pJңgFb TȃOZqBp`:+l8w!NxEɱ \gsJ!d; YtJ`Pcp%UaaUZpoVrah[ns>/XObject<<>>>>/Annots 737 0 R>>endobj -1598 0 obj<>stream +1z^f)D JEa 0Hӷ0X*i2G>F7qaSK )ЈP7ԻOy:6ye'nmkЧze2RcBT|]Qk8J\Q1Jq򈫑?j8Hυ,a$\a,zF/]^ UUV sͥL^zQ-xe`Szea-J+p<0 ޠ<nNxlKh KŘzW?687iwSc{a0K`s[ў!Ss =9kE a?^XNOd0r{)d(endstream +endobj +1588 0 obj<>/XObject<<>>>>>>endobj +1589 0 obj<>stream +xWMo8We)8q>44rMTt$*f#*Iտ7d %Q7=N~Ζt%]r=;]W<ïT Z.))HnF/7“+-:,z͎K+rO;7X/y2e:^K~Nl@$zQێJUIG)T\x05Go.:!-rd$)4FkQXNu pēq&M=I @Q,R~2,MsSBdUZ֞*U]pjPɼ@ǹN3㍼+{C_;֎vZUJMpGU,nh+?y{y8:SsCK[|7#LF(ʭ}db]MeCϷ&1G>=&œy^U`a{f4eDT V]GH~1KN%EI9ܷ +`#m +Y!Y vT'VnHѢ-WdL& FZc,K+pHEZ&Mah +Zy "Y*pBO# `K܊]PjãA0abۿ$}}vNfeebMې:6qs߽zӰ۰"f5-tL޾W#GjrMߡX4S,zysX?-,ACs17@ލm۰A|vWHΎL,! +x3$lQƐ!HT%\>}; HLMņW8E6AS +x™B!xJ࿣Ow_/^A +@*eRH5,QKMcH>/XObject<<>>>>/Annots 732 0 R>>endobj +1591 0 obj<>stream xW]oJ}WԗTRInAʕ<,{c{:8UUkfΜ93tǟMt28>Vv38F#:L>e4FҌx i4C-%-lۘHżs|}F>͗i<\ʒ&}cK ?W]LNzn]ܖ:MqO8yW2Ld Aͤq]L 3h])KR)R$*_ pqB.5`bJw=ke(uH02,Cl |:[V,RIeRIp'S%#Hj!oR{}FÀnh9XWa޳E_{DVys$ȟIJ祒Z:.V̵ܸ¼Wy7npDkW'2Yvq~r8#NIϮF?φ %^+ݓl?t' @@ -3164,78 +3141,68 @@ a l$ Q6 =?JBO=eClqFgH_=Y݃G^-XٹVcBQ~Q+aw~ƭG7fCBCF zȥu>Y3Dj4a@"|k4v/qFu CMf{L6NɄDn 8jb INt4Jj_WB$|zgL 5 !ikr2D7^|<3a{/ v HGEuAʘj) 1vG`+6;\ N,u¿@ lh\t&5(-{F*&ad; -H4BJt)_Ô ̂9h.-€Cť6zi[֯)9L~0q3njG(`(耵?;;/A[X'? FQ4Oqz.|wBendstream +H4BJt)_Ô ̂9h.-€Cť6zi[֯)9L~0q3njG(`(耵?;;/A[X'? FQ4Oq:d;wBendstream endobj -1599 0 obj<>/XObject<<>>>>>>endobj -1600 0 obj<>stream +1592 0 obj<>/XObject<<>>>>>>endobj +1593 0 obj<>stream xWnH+C$ >eD$Y~V͐2Mۻ"0"in:H2h"iyOr:'CϦ<_eg/g2| '>dd jwYD[;|n,sIJI- ]}0 c p f. <׺1p{9~P^v¦ӕx+ -jSu&k{7!ax}K%ksb/YnŨR˯)Z_Uvov:s` $Tol@=L^mfu Fdv6$am sدR`ɣeL9Io?k8de菣endstream +Z1 gh8-nW8oTbp("PX̠r Vͮ2dmML²@D9,2m3HA E]'J{y;> $Tol@=L^mfu Fdv6$am sدR`ɣeL9Io?k8de菣endstream endobj -1601 0 obj<>/XObject<<>>>>>>endobj -1602 0 obj<>stream +1594 0 obj<>/XObject<<>>>>>>endobj +1595 0 obj<>stream xV]o6|Xb8p(hӴ6PMQPeN"7KIN( N3{-GTj^.knAJRe%$꩕&| 2pU[~eV7s!ޠӸ<:~2^.9 U[(8VAIWϠοB睫CpC # =ʆ`K-(8rll z} ``Ψ"`C)\]Ka!8.:!i<5Fo8c7/`v=IoGA|(zU)7szFN=Yvz={+kQNV=&Y&O9-7E,رLXo@o7$]wB{;~xYꦒPNyhɉ\4{ۆ p*wpq>NZ7 - D5Yްb=l/ 4U`TKr(jmrUfp*^g;!tB,e,k-]OQOY4 }H>dG5P(|0?5OlқW Nendstream -endobj -1603 0 obj<>/XObject<<>>>>>>endobj -1604 0 obj<>stream -xU]OF}ϯRf'1!mH[T==)m4Z -܏s=m?}h[ bLSsT٩$ ǴIPd6i -d;V%eIIZ,)Ԇ -UD<4y^fG&WRi4ѱRZ}xhJd8ԙ2Z[C2EF?Ǜc3_ڪlCF"X#j3{"83!>q9-@JtGx6ڒ2f]ԫ 4N7Ybr/0:*ePab˃<aGEmJ -i/;3ADeJyXࠑؚ8gJw{en/tEw͙Qd -Ou>)K%ڭREZ+e;ELz`8mbH4WFqؽb7Z7Whf&) ZBJV\ DVaȀrmz/ܑHm%KEbik$H[ilZ8@Ʊv-; X+u)KkxzMaia#N?j Ԯ<(& ]-7JƺN/B1tUKuu}QUNkFs/c])֚D N=#hĦ8b |X^H؝1`ULmy6@dkdT)k 쭬|5βX?wb >-~_y׷=| _E8{qVUG1b;Q1  !y,ǂn13Yj[ 1{r"J-(|%6U#sA_Crnc]g\"H4#>׻f\z4|q"`Ͻ1qn:㤫?>endstream -endobj -1605 0 obj<>/XObject<<>>>>>>endobj -1606 0 obj<>stream -xVmo"7_1KSذIJ.]:5`v 8{7U}ƻBhY3<3󌿟_LugM~7⹃ n?O,(]|n-{0CJn,i9V-LYZq;aNT6Ʀ=n3ך$9OjY)=mMiIYZ*ꭕ"I\$~yp&+IjŠ`|%F/N~iuzE~&#h-\Z*צ@ZE7SRj6=i)Sdd(tJ&K@)2K%k#AR T_r"icu V2q gIIDd[G18."&W!!yY9lRYZF^  HZJHB)&-\{U~xXV(E4,>XyDf9( J`'ZKP v!2y4A51xd3V|q' jv|3% -q3r|%n|]\0]ƗO!GLۻ#1U%"D5E!- n9Caԯb kP j< -V:GfQEc=;XJԅ ;õ\ۢFّ~ 'zl*_+|X n#{dPuHDJQ2۞0ܷh: c6gI -.62@);_1h\Rj ;CQp02Ӈ,A9BF ё{XA"R"iJ/8pPP! VY:4J( -UpZ8s^G7~2aF#=oz̡n/p J[?O@KL^\&Ԟy=skuzH˕s<뾙\X^^YDnQԵ `d9 aH T/.b09GQ?#7;P0x{lʱO ƌb"4^Ņi?*;eVSG wp -xcm 9ĦL6y e[ɵ9x.k bڣ. b\t|s9{kx^za@lo |S7z^4ldvٿ:xendstream -endobj -1607 0 obj<>/XObject<<>>>>>>endobj -1608 0 obj<>stream -x}_o0mlOU[:i6i4 !.o:ӈPsڿtEH'&(1#6A<8|W,p>|B"HEKPy1X -,mD1"I -~V.UwhP!h%xӽF2־)hz-JHt56¬Ѷ{ޅhM$Ҥ(Zilޑ[ӦdTҢⲱ(WJ7$,6W aM*Tڄt׮1B^JWн}++ۻ|_PiL0=^gݮzUp.vŏPN|%Oc;Pn^Gy꾔F,8@D=V) FI(j)/qaEWtO|NlDZr+Q6QwheZrw4yW܉NڝIl7٠YPoo!^җm)y˖hҠ?.5*:hy;1Jɦ2Z:yFendstream -endobj -1609 0 obj<>/XObject<<>>>>/Annots 748 0 R>>endobj -1610 0 obj<>stream -xWao6_q0ղe;i tòDl%%{GR"X Rݽ{~4Ÿc(d/y䒦$ê`2'#ޜLI\fw,cG,dJY6 i+oYYww -@N/W7 |Y/iUdK>|{' -Zj-HXtHzG*t%Tla0qa%4}bjl#~ѪVD wtA]h4:@3vpemSI:vAQ<ҽ}ZPp xwOQAHpB݊O#tb S.R}o?N;Vr];XnJ~ŔSD89CJz Qƺj#Y(+ӿV7ߍ*%9MN"؝nʂj}6VQ2[ICS3#$ZJ@~c(U-Ivږz-ʿSfr(1xvXSsC/nZbOmlW{{YT6'SLٶcMSf͵2@͑HʳώH!<%ǭ ޿&ڊ'&}v?\߱UЋSw9'4TVua۽0P(a?`Yw8`-0JTvsg`ڀJAD Spj1>H(*F%4h_Bm` -\3\E&gБ4IDs|=9zE8(HpNV(rǝp/ -.. ޟxrR%ta0Ƌ'kAz\d,$آ6{hv@W%8\ ~DyX" ØPXjqݙ4l x -77U%}],C`p+O֝.@AϨ?, *ɒlOq7ZڄV/x" sm\XZ$ۻ%‰@Fںr6 -o*Ŵz\l񤲮_.cs -3Gv&- UWMn+Bw!iTxϧxbא0Ųڋu;6 -46ZOKt|vw5b`Uʼnrt2VhPԎ_VLIK(ldcdyPE*Wl}Kvz6!_ꏚpz2Z2~VQxLjp8-m| -"hoȎC% oOZ}g,. .?5endstream -endobj -1611 0 obj<>/XObject<<>>>>/Annots 755 0 R>>endobj -1612 0 obj<>stream -xWn7}WLjI.PHQ6-j.7$׊g\Y^;E^9sף oD1MfWGl;?7lNlFn}bcw`2aQx84^LO/^~O`-.G40it:Y .AĈk2[iYCZ'ZS -[)Sӻ߯WX1M+N:M5ǷoSE_soWOx!vuLJښیnTpw{EQ+ );r1gs=}F6^6=h|ۚmz0=?<ȕ7k} 維Zv~sB4鍪B[xm7S (c/Lmyo״u&L͖NvݫnVU+ES#yEkSjBMy*pl΃u;ݘ|CV[ۖAIgT[WяQn6h6WqWj8J FIB;,G>Û얥ڑ%]'\r3U"aG-Cෘ/z -a]J@E:H Q9n\CݩJ_D}P.Ķ5,,d.1'/(=Jzz/zd"E('iNO!8^9 q66 T{ -i7Yv9Ldq4Mn~K;.X'EP*̺Q|& -uNGޞhCD|j4M[Ȣž8]ԥdi9ӦAmt>.RCE'}ڠXx~JI]߶Ρ,^9$Q}hඐ.~J_ҟ&-"rr;G"qPbIVZ3+ۺ+ ; ,z <{bʱb8BjB/Os\ ")7#]qp8ّ7)Uw- $ۡJz^SXr4Xv @$lU x5řںO;*TxSQyxBЫ0G~a k`pȈj{6K7oeuF=:y8u,,;yoZμ':8\N 1pactv*f*5 2L98JVJd◸.l(ҭ{1 /k}|;-w\Gg_fn48ĺ68m]cpAҠ}F1'mJ[' "+ǼMKP8`"uqWɕɝvzŕN -ch} X[P [)V"P^Lgvе# -a=R?5D"hblÄx̎ѵ#1HA5|/q4\$fp]Lh6C72oפ8Yl>@8OlK yˣ?`endstream -endobj -1613 0 obj<>/XObject<<>>>>/Annots 760 0 R>>endobj -1614 0 obj<>stream -x]Rn0+1W)7N|%f Mگ-B >fgvAYDA(B܎_߂DJB&aƉƨ!c>-L|.MB%"&E6 -(rR/cJi5)y: QPTwqV9[aSp){(j:B!'5OT!RT);̺Uv44xa*Ϥ2% oۧe^c:69~8M{xwKţ97HYGR:3 ^k/KFjӒӰ'UG]]=}PnmS]"M|pxvA eHf"9+߮Wxi.{Gegy{K_X쌫[8'V1.Rɜ^adĩ"endstream -endobj -1615 0 obj<>/XObject<<>>>>>>endobj -1616 0 obj<>stream -x+2T0BCs#c3\..}7K#4BHP$YSO$3?/1G!9?/-3( jP04hՅ%DhWH@.0B)endstream -endobj -1617 0 obj<>/XObject<<>>>>/Annots 805 0 R>>endobj -1618 0 obj<>stream + D5Yްb=l/ 4U`TKr(jmrUfp*^g;!tB,e,k-]OQOY4 }H>dG5P(|0?5OlϦ|j+Mendstream +endobj +1596 0 obj<>/XObject<<>>>>>>endobj +1597 0 obj<>stream +xVn7|WJu*$[[Aa}v)-]rCr +Esȕe]"%X\ CmvhإI;iE]YXw.Gš ?LNn&3hMںE奥QB +]3t]u_Rgd>g%-=Lm)>ilrF(455rNTHf(̒葩>i} ٦5ME񉢤}i|a|܏>Mmzi'<ʯ8 [:S%[9x#ڒ)ѿ? D/b;4]a,,A t`ڜk3L8XR/5eUGLM=}jnW|b[Gsp'$TEMoUV=s?jWTƃ֍ncL9>/XObject<<>>>>>>endobj +1599 0 obj<>stream +xuT]o@|WRZW!OQZiS):k|s#4{gٝٽߣ&Na>ю&lEz/+lr5 VU/PUL`% V4F~@ҴG%9'[qN6XT'=&0`fē`]shuFjPhUɍ7l#R\x*cn-5zwp5ȵ k%z&X7)D-VYNx?ioyZ9iOoD~JUꝅiPY4gzlh +xէ3=Z "6zN{ wJ +XJavڝ6%/'-T\66xutHRIE7LiⶔeP6іAsXj ՜'SQ s|tOUryOguЬw(PCX;AU= Ϳ(oCq^ze2U%=oNaAlAwNHCZn>/XObject<<>>>>/Annots 743 0 R>>endobj +1601 0 obj<>stream +xWo6a3$eˑ=`2V{+ehJKRqIŊb0$HBw|we_1cSV F< ьYPE|~Ub0OxoN$xn#ww8R2Gc6OyX9;NS@Ɍbw6ruEcw?vmzDYʼSol ؜_^ p!{E+}nvj0Mxap֐0+m-VAPY mŞSAZ +Rx? +Є?i,5Q438Y\{,6^>ڠ4nCMK=R3R@2n<>/XObject<>>>/Annots 754 0 R>>endobj +1603 0 obj<>stream +xWr6}Wl֙Nlj;qJ"! (hYH>t2 ={o>O '^ÛohLi2'*?V9yM;wVҪ3 oAQ⊯5׼;o؝Γa.}zɈqłk쎦ɸ:˻߀xOf3{ӥOx8c6Q`  sw@<W@4Vc {v^!8}Zy2" "=(-3L!?n7/1n_B;'쟐7 :Ň"zt>͋*-9.{)o$iOgob @a@Lzr5D.6֚T:G_` O *voLi#^^ +>j.D+yijJ }f",YJJM 2Zx)כ VS+ +vfB̅%ޤ&?ӚvV ]S x|ӂC>.RPa%!&y' +XYzcvQW,,\hiޙ2h &6y#j4-&yz :xl/SN@sW-Vx8p!C zP O!E(_fҡ>>aJgiBM2LKU)Zv[2޴p*cSsXͪK-U;ns)38/6*"VdglFL]֚>JȅoZpj2ՊഭbǑf -(6c{rn@3z£YKmKqajD'8ctQ x_dOB{Tr~GBPAhEQCs0xϴP7̹Pgj"'3Cʿ<Bl\ `A'FmH`JdrY +"bִle@)HF00ĩNʙx +Rp{xqJnǍJYp+X<&%нW!)4Gt96h~0[L5(ŠQHǢBBVne2!*}pbdZ./ }8F8-LOr chY521 +-؇A|9utUN#DEZ;Z@loGFqi mxla-gct%fL h<^0J/@U= n'f /һEPh⸲! y yGC幄9,q[-%\Sqe+t9j>l>1nXQ4 Lϕyhf2`mv|}K8t-oJb2[;b<F&}լ(4Lp RR"P@Yy$ |ڛ1gd: 3~=/endstream +endobj +1604 0 obj<>/XObject<<>>>>>>endobj +1605 0 obj<>stream +x+2T0BCs#c3\..}7K#4BHP$YSO$3?/1G!9?/-3( jP04hՅ%DhWH%@.0})endstream +endobj +1606 0 obj<>/XObject<<>>>>/Annots 799 0 R>>endobj +1607 0 obj<>stream xZKsW!`x$~J*DB"b`в}0 *ZEn$s|6o*Jf+Xg;xwWnR\gfZ`Re\O.VTSdz2pra2fK3*X0a vb0`l-bh` BшPϦ "l4G ClH(,2ňYy"i4@ΧGR1,q L,A`3،iY`3-KxjwN,qYgs4 +^1)\Z"oǐeL+vWkYX9K}Lj4 "ρ5FSCޫ U`llKv,:riq^Arb]1 vEׄ9U򱩄 vOY`Aѐg``W1X5cW~v܀bf_(~\.X,@1ZH* 0X`1(_`#QXbY1$bFY`;AX,YH#va)DˍWHL" H+` w˔< @@ -3247,17 +3214,17 @@ F0# SXWwN`'Ɔ,4^X`WX`>f8Y,JhԬ7~d}h&;=|x$܁Vn`}/pG2FJ#RpyV0ť}2w?X,HN B{h ?U w+ Y u=+;^`C##5Zܽe"k>TX/?y-?2@I!S&),`$iѥQ12BM\+ШAIHHtAT1X.zifňSvZl&+,WIL-y0DQs"k9QB8<r156̃y!$iL"7m)o rvFa}h0Y6IN.@$ @p{$ș/:o#={5|nt A _ 9_[88 >p'~}8p񽾗## 8J1pbž/(7BƗ 8\?G]>՛\Ȗ+w?7WMW_g15 xm~.o][|/|;5E]޹sOyչQUjwjnˏ]Ѵ ]7+mjhsN$خµbS>{Oy~_?54E:_<6yWV˭ZVuU=ͷ=YT^A:Eu~(ܯE[OL-)sU7~{A5.[3=j3_)͛]qH_D٦)E<- tնfwA보¾Cߡ{VeP Y w]t>rG|Zz %!_nnC>\r}o%Kiy7hG6é m]^m&j[k;y #0LSgd-6]}dNqG_($swYEq omc(NsZn0hpV|~h8P#Q@ȶ>QFIHϡ2Ӱ#<"OwS4C]lB޻e?kS, 4hH`& N -I"|_? h|Cu}H\zy180~w|leSlyv‹Q(H!u={^6-m?,TG\I4bmMpsџSg9λ)Ox/{iݼ8[4:(pLN3G8L~ <;>8: 5-bZ9n`F ,w_MSCUnۮ8)ЗvH| @V tuFVhܞǺ^dͺ2hZN2pA=uտo WEk6GxR5儆-#x7_/yq.Ӳ#^&d)wo$l.,~? ->endstream +I"|_? h|Cu}H\zy180~w|leSlyv‹Q(H!u={^6-m?,TG\I4bmMpsџSg9λ)Ox/{iݼ8[4:(pLN3G8L~ <;>8: 5-bZ9n`F ,w_MSCUnۮ8)ЗvH| @V tuFVhܞǺ^dͺ2hZN2pA=uտo WEk6GxR5儆-#x7_/yq.Ӳ#^&d)wo$l.lN;?]s +;endstream endobj -1619 0 obj<>/XObject<<>>>>/Annots 857 0 R>>endobj -1620 0 obj<>stream +1608 0 obj<>/XObject<<>>>>/Annots 851 0 R>>endobj +1609 0 obj<>stream xYr|Wc*)%Kde+]+DBvI R}9rvϹ_fH~"W.zw!gEB/rsE#غ w. 1`8H-TUzx1#*lf9+` tV5g 4 " Y 2;GaPbYv,vqBsiD=`ˈyY՜$ѬYiX*g$MXLxe0t5{%U4`ϑ]9K,j$H31}`Yq,k0#Z+YvdNЌgq@ vB{2fgԮԜ0^*YړfDFʆ8Yz1rH/ G@IwK05P]deSXՋ> AԪ$' '.@0-H,h1XCdD-qC^`+TݕI!ԢRHIZ H=k0|gVWHEc:CmƕjXg^V5Dz4Y)Q" ` f$l}̞`-2<@B-:3iTxNFs v:^`D~Z 6I4[ YM\02re4 (?L7cLd ;s2.5OZLw#E5?5,#Y.YNgD\:>e'<+iI dI2F2 %H"* ,Dw)gB_!]̤T^5c@T$. Y\le fXt/k1 Wg5q1oՎ cwb C3^ͬ`%h7_h.x%H4x=kX٠j&Y7FD`xyY5WaGVh6^\5,.Ȳ3"5^*x dQ} -LzLRAbVFSȳe>TȊS,!Ia1R"3CS4D̀B$Ұp92ce)b%\)H#\A '3&8ܕS0,z̲Q I]A S15|P*']HQ7 OƁrwOUn ܗʗܩة/}Atrqۺjq._6Cnkh: c\!}>mݙ`$l6u[u.g4{IaޕFlN4_]Ӻ0cأЕKeΟ/P]7rlFˎ\;Ҫ͔ܺPėY{ڵ]Knz~qӟ*MaWCL~wk'nQrFe9M9- Jk)e4ikwM~&Hah/om%ے~}y9~oK6{j&CJ2] O1% |xbǮ?vv"㫌qy[9SUٽTޟ eG>~owky@ڡmȡ5֗6 >0 /wVauzhbUtssJ"ү定θzXvm -vZ-bk]XSG}퍻n[=g P퀈ׯ^8轵mC'N;6|~? {;Dy_2b+׻o=("aΨ¨7qy׶oƦחC|Lo? i"s#=÷Ő?vwu2?3y2So_xuySn4wee.h:]Hm@/ayJ[_]uendstream +LzLRAbVFSȳe>TȊS,!Ia1R"3CS4D̀B$Ұp92ce)b%\)H#\A '3&8ܕS0,z̲Q I]A S15|P*']HQ7 OƁrwOUn ܗʗܩة/}Atrqۺjq._6Cnkh: c\!}>mݙ`$l6u[u.g4{IaޕFlN4_]Ӻ0cأЕKeΟ/P]7rlFˎ\;Ҫ͔ܺPėY{ڵ]Knz~qӟ*MaWCL~wk'nQrFe9M9- Jk)e4ikwM~&Hah/om%ے~}y9~oK6{j&CJ2] O1% |xbǮ?vv"㫌qy[9SUٽTޟ eG>~owky@ڡmȡ5֗6 >0 /wVauzhbUtssJ"ү定θzXvm -vZ-bk]XSG}퍻n[=g P퀈ׯ^8轵mC'N;6|~? {;Dy_2b+׻o=("aΨ¨7qy׶oƦחC|Lo? i"s#=÷Ő?vwu2?3y2So_xuySn4wee.h:]Hm@/ayD[_]uendstream endobj -1621 0 obj<>/XObject<<>>>>/Annots 901 0 R>>endobj -1622 0 obj<>stream +1610 0 obj<>/XObject<<>>>>/Annots 895 0 R>>endobj +1611 0 obj<>stream x}XrF+搪$AؗSʖ#UsHBL j$T6=YǿdRSm緋$|)nLzfPpc02Ej 6*fj 6 @* 6ͽH oLG6,r{IH26lRvvl*Ko&"< d314bf=4NQ )`キsl( rϜ }~&m_!)$F kX0VO3^pBPWALs&?qRDk:!["asfA_'fR U"$䚱SAw`SNbf bm:($H,I2!$,;`k,)TzKT]lv}w{Hwhަ{hC{͓L -|X{RpH*}OV, YjJN_*wXQ@5SKҚr}6!`f/f|~>/룬g1n۪+H գBKeUMf#1p"v *Uҗx6K71_ (yU .ϼ/E?mTzKT]lv}w{Hwhަ{hC{͓L -|X{RpH*}OV, YjJN_*wXQ@5SKҚr}6!`f/f|~>/룬g1n۪+H գBKeUMf#1p"v *Uҗx6K71_ (yU .ϼ/E?m>/XObject<<>>>>>>endobj -1624 0 obj<>stream +1612 0 obj<>/XObject<<>>>>>>endobj +1613 0 obj<>stream xVr6+DHє&4nڨ/ hH%@Hi;m<Iaݷ*bZ%(тmt[I{!YǗ~^RXjMۂ-ŋ>h'pJgta-iMҳrW %)P?z'  e%qDE(8%(E[Cک\)<ҾӹSFjB+[[2š:CR]%=@!k@1B/C\’S88BsӂΦyŒ9ģMeh`"<_$*/VZgh6K87RQ4]Jw/4 vpF_CVAD+ؔG0ɵiA8b;%N89vE9Byvvmݸ!q8D otueB;d`ԇ1NpT ' j{A#t-=^o0rUs; =@ذ;B*<^#Fo| /-.(9ZE1+*A9*qw8 $DCNxw q'w&;  -8ϓݷ"TwR`0곱S?4Ejq:8)`IoB<樼R5pRbɎ@Էߊl#kߐz_-0wbJU=d^z f}endstream +8ϓݷ"TwR`0곱S?4Ejq:8)`IoB<樼R5pRbɎ@Էߊl#kߐz_-0wbJU=[2W^}e}endstream endobj -1625 0 obj<>/XObject<<>>>>>>endobj -1626 0 obj<>stream +1614 0 obj<>/XObject<<>>>>>>endobj +1615 0 obj<>stream xWn8}W ڇuXİSlnu/y%b#.IRen/h*s;gΌ~^h3ZfIiu5M͓9-+<_+)/Eb6_|~s5ٌ69,+d)mґYa {$c)S.+ҤL֓/$Uy R*,I%i>Rj*|ߑѾ){q5m$J/4NvU?IlH$tF; O\=ˌr$"qn/Wi] 9I ӕԞL ڡT$t+Nk{i^^=dA}F˾Yta|B|Sު9Ei(7pN\p @@ -3286,68 +3253,75 @@ x C Kw Wɚ*D0_$(ni=YqW@_/HG萰i 8Elg-J+ ͱ@P rp繴k/yYɐW :z~a} K̴ǐ{ʆL"/FHR bcDžZލx-@ 仹L>]z u#Y;"1mQDgMT=GT ]OcݓYBj1sU#eer a}eg弭S1C[2mZ{Mͯ2-[;N5+H˶\ʉUN-˩c]3R V演FMl_^[7*]<eh iq -_NRu@y_p\`W1ݷ?(@U$nב/Bh3^G֍Ζ\rln?*xgҚ70h渽0^M1 ]-Qj+~/Aendstream +_NRu@y_p\`W1ݷ?(@U$nב/Bh3^G֍Ζ\rln?*xgҚ70h渽0^M1 ]-Qj ~>endstream endobj -1627 0 obj<>/XObject<<>>>>>>endobj -1628 0 obj<>stream -xW]o7|X(uP[_v%%H il7RuGIOYֿ,yk6aX#wggwgɯG=G> ([u]:u}: ?+i~t9=\uM1CNX4;݈*ْ2jQY4Wl~9)<`h~K:(%IR0clNKPY$|}ss‘V\Vzt~[ܬ#5U[<&/K[FXvм8H[# ҙ -Gn9r~% YǖCkcA1[uDM$i;(x{0PZMfez[f{}?suN^l~9ة'$ 9I+-Э2RH ϯIJxT<׹y0mS!9䖦*rI<:4 - NS%X,B aC{].->qQۨ¢^[UMquD:S(!WJ.6F;M( y-hI(~͉LR8tD*Kc} 浠Cwܒ +1616 0 obj<>/XObject<<>>>>>>endobj +1617 0 obj<>stream +xWS7_|(L 6ɤ4$Lc3LGmtt}+lsۦ0 [AѰOʖvN{v·ǟ4;t&3CNX$;݈*ق2gj^Y4SlMtah~K*~(%IfR0clN PY$|ss‘V\Rztdž[ܬ#5U]<&/ YFXv{мK[# ҙ +Gn9r~ idž}+c6A1uDM$i7;(x{0PZMfecz[f;}?suF^l~ة$9IK--2RH ϯIJxT<׹y0)mS!*rJ<:4 + NS%,XB aC{].->qQۨ¢^[VMquD:S(!WJ.ִB;M( y-hA(~͉TB8tD*Kc} 浠Cwܒ mFL!cE0 ;( -fI -ɦ 'b֎n X@Etm[KJg屡IVK+@z䑚vmJ<+vܫ +,lNf'Dҵ]krF,UILZv{Q0$gRcv;-yc<S sB03PB;jDsķԵ8%TCY'EjaUBs#7QړαTqNRr -/6îHsB7#\*-@ŸXKMtNd$ عzEaygQb0?nU.G@~7<0v{1̻9 ܈bNfQXe*7I?fJS P}I-n*:Vr.~4S&eMFj9(*6JId O,lȰÝ:vC -`i_qTLv+a [![q`.X SbBgX*`RaxC> awπq7c$-2b sՊN0%=+8rH:$(*f]`GY9Υ`k\\cD -&+aM\SFb~SF 0ƣb0q|uB9dX07Eaxe]l1m/..Z)ұV_Ahbo$Ҟ߮o\߽vJ?(Jkƌ3DGMglҪƵ.3>VhG )iۏxMoƘ:/-|3 R5gooQT 'Y8I2gi{z·`{)L F菣$ŐTendstream -endobj -1629 0 obj<>/XObject<<>>>>>>endobj -1630 0 obj<>stream -xXr8}WtədTى3ZR*E$dELb* -@w>}Gc.h2> Gt6%H*zqtyDhQ%SF#Zd'<=|ym4MFѽ%쬔uȜ[UEXv[|?`<^O,3IB5Q7N^JtCsix[;KFo?:CBO*yrlQRwh\) \TT;D*CzP|- K-H:BUpHbǍ̴-Fk^8c#mB:x}77drJX -t، \~vkl2/n?H w)ZXn6ٻ /]/Pt4C l%Gv;⹋GA[JN3PYa]sҷ$zKElZషғ#_+}b7h qJϦ?:BaW@: c/2u<H O*F!}-8/ir  3g%d8}z@7H1oy^ݵǨY:>/x(QHEDV_zB@_80@(axNf,Vrʞʡ ;ty<#6֨Z-|x~<Y+/=Q[)Eyr:fX{& -%j o{YqH? jKS$D F9F1 =|ٝL#eKϊ*ވN"Lkl*R37w C[ҭϙFＡ VbKo=A*Y;2EOJJ@%@$PTSNj, 3zU|4Cb"+t>}'K0=$B5=qvG\zt-,Yv:~6`F}Q0dv-vno?«[ +V5i;΍D(|(r>[ =͗ A&eދ Ood?QYg:tH289M{ -(g~7/Y)N -Zn{q'B$Fv㠖^L" CN_0*Qn2͌zv%F ]u֒1QFkα>bcUqd>/XObject<<>>>>>>endobj -1632 0 obj<>stream +fIL ɦ wbVn X@Etm9[ Jg屦qVK+@z䑚ݚvmR6 #%_+E:M\D3xݛnW%\N f8,Ot4(5|ʆK-hT2ÜLp9p? +=B;2\NI~wozS[l/~iqؐ>/XObject<<>>>>>>endobj +1619 0 obj<>stream +xX]sۺ}ӉdvemgĹ_I$߳ P陴7e `wϞ=ϣ1Lgt>: Gtv~׋+~=ïӴχ7/#K4›phDz=>ǯOA?tAUvVtN-JW <%v~8`<^/,3VٲNAҮlM3xw6S%+vn?u356:Пe # G9 ۖ@FSm + +>ΨRYajw8b6즦zRxǤv4/'ip:·gl5c𘂥̨`liS [5`+-H啩Ru1h6j6Ɏꐝd%fkD)V(dcBA TytED0l ;jS++3KIP}?|

p&9xLIF#ڧyW;.u/+g5K1ǰ !P)Dz|4^+@-("fUK +rHU af3-AX">&ԕ=eC@vt 6ƙJ-|x~:Yg늳)~BFk7vQ!ٷ0^;)j fZdz›]EcV=s߂݇Oi* ڲvx @?QzyQEy|Kow'~ !Ti,⾉7 +55Ma܍/]Жl#"O6G,:}{yTڷ\?[87.<+>n+ 췚<@E lloy$WT|;]wԋ ޫh¯zwP w3`O{n9^ 1J07&96j{3FyLwӺi=d6`Fu`:So1[l}WwvW̝_NX87P QPm$[ {,؍ۯSzkLW&LoK~ϵ$dhpr71(Ɠ^0ݾfW8e?*P ?<N~HD@L Aӟf3 &2J8 [8%hU6Bd +v?KF [+͘_ͤslؔ}\ &iL`0ΎȢ,J|?1"%fp>"q.>a8*x;_y.|-zVƢ,zPg2W4梉ujZIS nKyǐvI:? % Um!cڟ*BФyVcCǸQg;txX-^ H-,`XG BŞU7Oy@z.s#ybg…EEdX_AҖe \RT])v:=M,7ٓ f3L=֥"yfC +}? $KC2 ұYkGkA,>=|ɉ rLt@!LV92P(2.A4/2s8rPiB mI|1`ϧVU(qX3U-#kU2?j;Nr N:"~q1'g%m+H p!t#NrrɄOJUendstream +endobj +1620 0 obj<>/XObject<<>>>>>>endobj +1621 0 obj<>stream xXko_18HGpQ@Vo (VRkrw%-&M;"8sPic8/U+QR%h8(Ɏƣ鐒}[$ *T)?%3s'x(Y+~ed9)M tn6 Gd,/ 6yt5M$M-×4}cHir>#:K#:#f'3J;j&yns|_DVZ*dkDZ e]HCP]3$TK[[!5\Ͼ-5]kWAI !hPUhY~탺? sH7ZZ7e'_]]҃ʬqhpֽ3=܇:H '3r˭v vtSr~C&HK#vȞ =byGyG+S 333U621\[>՟MA)BvKnmHzuCFw`Y^TeZFGYPS[Tei6oe }u':46w:Y 6J)\YXOek`?j-ׁʔKmXx(LZ9n +\J~#ػ~(F-!j{rAhOé5񰘶Y6Pc|mvo>J6''n=|%7_~rt6vJp,=p=l}2}OE2gt5ڍ6J7=ȵuml~eNw^`lMm's̍ ľӎ (Kzm;m?29-4Plcb!cZ ǰܹƨdHnTQ~t^$uy}p>} V)E,f-mFfP~ó JGkŒ,fEex) aR!e[Q͙oo0$cR \- @?D>3?e4#܈Rl0Vk D탛hM 񒭿()癲۲O:a!ܞnޖ- $.ig|. )KEXl<E@Zý(F_7'K:c7&#Q3&(տP7)jPnɼ.oF1'쒈ir}6}B`#r1{+Deq@-hh`^_Ny\YhR`!<]shu,U6՝װqN -7 Ѽ7,ނ}9I2:Yh^X)‹ǻz6cypz[V/j8M;i궮Uf-;kMd[]JRJP4h.M5\G6tH[R.08Џ߃Y$ձF3LPð&xU[Vo7( : /ů%=v/.n\heM[CIYIuHwܮ>RVy\! Ͳ owJ{L}q(4' æЫjE 68ЅÍʺ5@7c!(|wٽ//_G[7ϝO.Fx%_Mň&?7N#endstream -endobj -1633 0 obj<>/XObject<<>>>>>>endobj -1634 0 obj<>stream -xWn8}W MI}5Xݢ-1TEN~ϐov lΜ9sfKviԣРihp1rI {9h O\G`;w:DTPv^&m -Q(0d3+ ZZ &wmy+](DR"*d8yӺ-[M,b5/"I*IJ[䢐DYPVbC!wSɦuvz ҦNtr =~t{㸆m,"p7|8qW2 >LV&"1c[# D"jǖg;C#c;B ;tl -iNL\U0n8}0= ì'*J4;r g Y1RM*E]{_}"i);@O|V8&c:;qEޘ-r9m)[ MsIqЖ՝ISA($y00Y%eN8-dޕZJ,T#'h@WqKAz8"ZLܶhW 4y+&)ܨ"}eT82li`pІoRTn4s q DA&%kݓ?KNV|ۥZ._n"joTw&2Ngtħm:D"su?.PoeQfi~P5 ~YC~k!FB S՝|AuHf0hRKP֧M0Leq=2;xjbTJۢ+EJ@ӀRe9;(0%JJL ;9@Jg}vhY\ew^3W̙2zf>#q6+ 4m\0ؼ䃷x/w՘cd܍`uEuYF+8m0O)oINu|ly/<ĉ]4rj|GKI%S"v:6vzzN LHb:1|/(tOUIBN@Z(k~ث7'M$hȭ|; =H@\p1fBC}WV'՟y$g1WՏl:o*ZN];t3;i罁~Q2;}nJ u7aaxW4n*jv|Ӌ*}?985QI/~^8uMa4†-.G ?rendstream -endobj -1635 0 obj<>/XObject<<>>>>>>endobj -1636 0 obj<>stream -xXn8+.fl'0dҠ=&J-6TKRS`$ }sei9.jIYu6Kf\̓-W?_>ݜMg6[ܴ9ٌ69ůҖl[צq}16?ft1%80'g`K23 Ȱ&='eFZKf?eM;;?|]-X׋>=[wmuABT`e]Y'RBK_U*ƻJ|7ȥN$R,'yMߕ U"+U)G"5iQa\%2݇Oښ$ίK32IPKRL->#Ե);ɖ/"sTIW `ڑy't] -D\J ϵq>A>RITTJM;߂ٌWfM1OmH%'ifYSW'<@eŃ!dJ6 qt>nm(˷-%kphɹ(\P0pI\dS-݄Z]2|kQ-jiB,r%r#! $2_"oCԕ8\La?dR: ]h@*Zto''[&6բw~|:FjrW$6pŐe+$Cdtv;9Ȟ ͉iLjֆ@kH䝾J1%؁mX/ - -1F`^H>SGF`Y#;?Bv#87 L]؞+_PńHX?=] -=Dn*{I`Uqg6zTjA̐!wghטxEI#^؂@2v2H-[*R6 y?N%+!k,$%aPth0,dRK0H²Ew7WT1"MVKSFb+bbda+c qZv%=3TX6J ~4Y[]!AvB'Gahd2aVXLIӂC0tвX50syzƓO2E<4rڲ2V -MW,T)RU2=F"0 -I4Ϛy8M]#҉ύ>0j׆iiZRH[qkOZthU'(6<:dCS_:pLHg;}2=yaz#ٙp mAgygOj7<v]owc Vi٦*eR׹Yԃ"hFp]75g|nr Ĥw.,ABFƭ„\% xl>(J1o:)2;2yro B A%͙E}iac>sZY:&*=Ŀ|r;oZGfCs8#^P- "P˓`"䎤lYq'[qge -}B%e||Z@zmXx K8tNO'oR?z(vj @ DŽ#6Iuwq}5]3Y[!^8njOW^"Y-d>n>4߇endstream -endobj -1637 0 obj<>/XObject<<>>>>/Annots 908 0 R>>endobj -1638 0 obj<>stream +7 Ѽ7,ނ}9I2:Yh^X)‹ǻz6cypz[V/j8M;i궮Uf-;kMd[]JRJP4h.M5\G6tH[R.08Џ߃Y$ձF3LPð&xU[Vo7( : /ů%=v/.n\heM[CIYIuHwܮ>RVy\! Ͳ owJ{L}q(4' æЫjE 68ЅÍʺ5@7c!(|wٽ//_G[7ϝO.Fx%_M??M~o)endstream +endobj +1622 0 obj<>/XObject<<>>>>>>endobj +1623 0 obj<>stream +xWn8}W M:N}5Xݢ-1TIN~Pov lΜ9sfKvG!EQաA`t=YI {9h O\G`;#| ; +S~N( ;/Z6ȕєr- DRc]}Ys(Z ++\ևQλl7SdIblH4K$$)\nE.$!|)Ć\jܧ&MZ-@tyჶKM?<<'- =YSd9yq\6EiJvǛv>xEBLNڕ﹡gɊDse { 6`IL$gW;<>;!eSMtr=c2.?Nqaaf\ԡT +4 .UfinD)$ۇ6[>6]K'@1bCFɥq)PUbjOxR x H@3'**/5yŜ)g3lmQΧ!o +2xnj/厠3y̜,WKQzzVJ? N@{[RS[YWĉ]4rjd,', +t!;:{70!=hK.G)/N +8V>)4k /VN{Vd-o=a x`6D:u0PmUs0b-O<3oիG.XZN};3;iA[=qVe;}~Jw7aaxW4~*jv|QUwQÏe˜]__у5^'nMTpGˁ/:&0 .†-G zrendstream +endobj +1624 0 obj<>/XObject<<>>>>>>endobj +1625 0 obj<>stream +xX]OH}W\@`}U /c{OgRMȿsc (|ܯsνӟ's{Nt:%3Z.ɂW?,\'oNgtMkܴ9ٌS_;c=vuuCɌ +Ftkl{yyI?|fqAy0vv䳻B:vGOxj +MHy'OYp5/z'v;o֭9Xjz[=F9=X6V[*UoL$QIYOTV=1Ann￮Ȫ +&r%sݷQaIKb/ צwj.S%(ZL% η = ێ>!D[›y.жv&? +RA<%6D]=*ͅLZGCgL cc3gڕī"Za  lU?5+)nkWuLV'n̐5lR @@>e.+ /=*]mK0@²EwP> (bE &ALgVRo# 11 1njZv%=3TXF ~0Y[MAvۘ +a`4j\JB#HCb%G5&2E<4rڲ2IH+KҖYepG=+SԔ zh]CF6exNlC׈tsćٴa@RV܀)ړM 6 +es5/\ӷH$OAGi6]'!WF7R_! @`mV8kN8{Tu-\_ g֦ԑsEhFp]7g|zĤ7.,ABFƽ„!mICq: ЧE)M'XfG& T2 ~Z$wߜ_ԧ2GgϚ@`:LyHr?7`- #`'`DB̰Y-` +<&BHWw~Evf]VИ'^[6/OΧׇy sVs}2 bVw}~Lx+!Ozsx$M?^EKί.h^ވϷ7v<ҝ +]pκg3~7-r]\.O5endstream +endobj +1626 0 obj<>/XObject<<>>>>/Annots 902 0 R>>endobj +1627 0 obj<>stream xXQs6~ׯ2cђ,K!IN3~HBM,ZvAB v:& .EhfՒj4ͦx~tMzʖTlnFzƪ͗ײs=K"[WXe ZW7vnAmvz^Ѧ`<6xԑZIۼ9AT+)<)&ۑ|R[/kgIa+&W8K+tnhJU6XeϙT鬾R~ Cc쓧^{SեNVyD~Ʀk˂W.^:'JT7.ܕ?,>g/E#",: ϤT)"Ȕ ڶ [ƼWhuYmHWd<%xc`DVˮ,)#nf98:'?,؞!߿|?lE2a;X or˻cd1f+&gp5N,^qjUkZ1.-}h=Z!dߨ d$KՇbORO&^TjI2 h{¥O+3ۣFr'u6Zھpc;ci  O_nhA.EZ90A6qZ r5޽C>kԧ/&g4`U^:+ ZeI$/57eyrgH wCCSlTxATϴ">"; Ei/{I#xh\]3wziN$\TVm6ؖinpQ#TD} uS4PcƷ$B#ږ#y3k磡|oCYCy%ߛqSx`Y>,؀z8S# A=TZmAS9ɊER$SCu݆QP' uxUH#FCL̈́Mڡģ6rmQ N (62:ds/gS ho <EOd @LI !9Gm'!96"V.㚰PY`TjoE/IsqLl!}(ȅ*j@Q~p-%*2+]rXgCӷ/t|G -v(C%hc*.0݉fۘMcMPwnу* s)MGUN)R:ia?]gDj([8b[+x'Xo^xu.ޡYMqi@9yy9g 2z'q 4Yh02$Ovqb!: ]ye줸*CP ;Y&JJ' X'}3:YLU2VTmETEj7>BLαmcX EN(w4\݅VܹǏ$K/c>:QALw5soPnw U V'My_Kz/Ƅ!%j\]?tvӹ"&Lnє0u1 /w7wjڀ2[ je~g=vO.hh \\MF E=ʾ2SĻs7[kANW?~ OoݺlX_Si> l⋣&)E1/2жZ+#~yuu鎸ˀ` .NƲZjx[]񫏛?Goendstream +v(C%hc*.0݉fۘMcMPwnу* s)MGUN)R:ia?]gDj([8b[+x'Xo^xu.ޡYMqi@9yy9g 2z'q 4Yh02$Ovqb!: ]ye줸*CP ;Y&JJ' X'}3:YLU2VTmETEj7>BLαmcX EN(w4\݅VܹǏ$K/c>:QALw5soPnw U V'My_Kz/Ƅ!%j\]?tvӹ"&Lnє0u1 /w7wjڀ2[ je~g=vO.hh \\MF E=ʾ2SĻs7[kANW?~ OoݺlX_Si> l⋣&)E1/2жZ+#~yuu鎸ˀ` .NƲZjx[M蟣lendstream endobj -1639 0 obj<>/XObject<<>>>>/Annots 913 0 R>>endobj -1640 0 obj<>stream +1628 0 obj<>/XObject<<>>>>/Annots 907 0 R>>endobj +1629 0 obj<>stream xWMoFW |r%YR `IkJFP".%RiE8xYL}i2ᘒituh4?ZRpߟ1Ń14 qVA4gC>fqv=#Zdk<Ň9"UGh$k^jgaAHv-+'"#V0`unvRʫ*HӜREBjEHmp=32JTQOO# _*cvJ>_>Isǡc&okS8~ lT!'=}xA?vh'.Z @@ -3359,128 +3333,123 @@ x _l px6v_;_thǵDQc -y'Am MΚm -x;Msm/ M yZL1æC 9-_\w7jAI!acdMSd?-8Dendstream -endobj -1641 0 obj<>/XObject<<>>>>>>endobj -1642 0 obj<>stream -xV[SF~W>ЙH%Kt$}6-d:YKkDu+~{ %0ivҧ4)RV &I8x1~N '0~h$z7~#JsB^<-JE5ׅ̩+Y". ]YUr]{Zm(>S<̤XТ/Hףăp|gg8S-xeu)QV%SRףCc.6g(gąlZ5++up}%俸ȚR/ֲ?amų)/7Gbf(Rs RW2NA d]sH*W8߉ma~6=DJ|]G (#9r2SظQ,mv 'hA%FE@.,$8xg)C&s3ALњWkb'] dίoS)rV4M0[!{tVi3݂=vڲyhE&[ر4GoYrк{ҖmJL -*s ̜rd˴l6 -VNӇ~(Eam Hz,3fdMfTvF``;ʟV`(`Ȝ"CtjP}} eU{DoKyCmhюC#];.ѥqk0<KnsCfF8঺1ׄ sK`ڍS`P6HP٩W_zwC9a^6ₕevW]\!"Z- #gn^uf‹?c1x3|F.yah' t|!URpWe@SIjɳ:cn F\RBv 1Dw*4=~.h:K~!iW̸za0zc-]]D.0C Q=aj,_8};rZX% c94st43 >/XObject<<>>>>>>endobj -1644 0 obj<>stream -xWMo8W rru7- Emvq+*)o%NE|MsA)]^QVLz7Oiv=)~? uSX|iUo5!cȣK^ZM%[[9˒hX44j̋]A7 P˘h _~ Kj+N6׾K}*vAm)W뒬3Gj9 ҭĥpX kk9g$ИL\Ro,ʔ>BN%*jPLYDHRCPH7t]Ǯak9H8H;^h;#Qo6)$o*ǭ]^ؑ 8C3de|P3(J`SW>RbL Wi|]qlUB>{6Fp="C޲7mgxҺ*cJzňUOolP" D7j X84JToq4ۮ&[vnp8hFخpvP=ެss;GgyŖD*|)Upy7u% =(Ϝa_ds-菻Ol+OV!l)Wf7{tB``|&Ӷ"eʣXX( {a]7G3@A:Tyt7a;}juMW;ft4ckh~ht|&2 "rU>`\r!A+zH avd-&ԥˀ f WI8heI"d\Jz~ +P5`DfwkSUU C@dK`[L,xpco:;'>pV.lFaUGΗ#RY8N58ʩXڊ{i $o3XZGaTЙ '^v dm2g-$vhyy8)f .ePG~B;A&UIZ$6"; ot$Yo;Cww< -~+$[<} ͟y).l<Ƶ[u"endstream -endobj -1645 0 obj<>/XObject<<>>>>>>endobj -1646 0 obj<>stream -xXMSH+|2&^JEhgF3-Rlf_noFz(?8bt'10LΦf3Z%p8]*&88>U4Co<˔\*^kA+) g2B͝ĕd7fώ*f(YCP6*ɕJ6{tDBL.U&uT ingk76ne'f`$Di_p&T׸]Cfw( DNou!M^St-31T6hӯd_}rᡲp0K!rfs硯)L-\-}[nS gi&Ck7lH9֐GN5?Az~E<.ci#J%Y&©dßp, -El D,P -kk Z‰o7Jak!p$lUڸWґNljlSж_ƜUC!e2Z0 mtj0B7Ftfk3&;[rOY93q7W6>NAmq% -{i]Ç]D#c2U0,ޭ( fԴڅٟ@pYe/?/A'+[ygv)Y4DD:=*ΣHZ'4xNὨռnܸ* a)U^Ӝ9,ũDCh?|y -@]~,}&&vi6 Å9kh0@]5EE܎:P;ny>T{. Eö'ԩ r) -? OLJ7>(#y|! mdT< ~nb(2Y00jXRmt&ҕA$ 73Pr|4zBmmMSY]mê_#ŋ2ʑ*T¯-_|`Lv8kbr ^aڍu2gyAfpuoY?nx(7XGn9 nmVf$bF}]tqA;dw21fY^yeO,/ƃ!F[ZCYo [hvvȶmLѽԆU 9_)Ҫ vx'{ǐV^`|8>֬0=fiuԪ,ʍmHW/>(U&'qPBTȺvMCs)/q!#MG6l -ykQp -~<>?J>_Χ)^kdW?L@endstream -endobj -1647 0 obj<>/XObject<<>>>>/Annots 918 0 R>>endobj -1648 0 obj<>stream -xWr6+vt2cӒ-KroJݴ4vk|HPBL @-J:kX}vlJ⊮ghBm4r+Ipu|h~=M5TN''of+9]ͱ -?Kgoiu -H >gyBxHzVE/c]UV3՗!)FqUl]Tk1'ʊ_@qGq -<̑c>O{vBۭkbQR2i(uYTWMNPUyomx;X;͓Ezw):2Ći ӵo[<'%xӣl.(40$x`/6P.D.nypx%=M6c荏Ԉhu%+fkaѕx;ہ3tVr.9.k\qJiE]t\hZ;/ -h1_J݋%e}ٿ"'0endstream -endobj -1649 0 obj<>/XObject<<>>>>/Annots 927 0 R>>endobj -1650 0 obj<>stream -xWo6~_qoqTv!Śŏ}%*f+H}GhIb8;}w, tQ/ϟ$ZjTur~U,\cwmtC7u`~duIdsX[ܰ 4Ǜilnf$e?ӻ^DvjlgWKJmY6shŴMY+~zvlYY%tIZNYC"|^zddʞ.o9N2#aH@ʒν^(Ț^yX%Gw`urxt/GyIHW5.kÿ-4 /5F]NY) -*[B:Z:snEd'J0 :P/*s8 ک>*Q-Q; :GH[1X*[IeV{(':S]=ֺ9\u]d]CM -; kP.~_mH'\k\׭~BUhMg'R {ذ0]圷{aDAT׵4TcYErM9KNCg?1gU׫n̓<} F壯 }A8x"BWcjIxC~dSi¯4!lRQ?&.8` *; @ދ+X_Gps|tzlｫL2>DqT#L)JG_@1&ՎNqױʃqb<mc3:hyLRcω5XO$ϧd7DqܙlQڝ\4ޓȋsjjo`(xh#,߁k?`‘v#/DM3K<5>ڝ9'+qFGC -LY*(^J{ ~t1{wU73 j\ԾAǔ7^q̇qhYcb2UJ8Rg7j{TӉ/ϩAiu'{VqnCo7gƏn/MxGjmp^돀~iS)xo|D7wc:'4`1T{]-hA-+}1 endstream -endobj -1651 0 obj<>/XObject<<>>>>>>endobj -1652 0 obj<>stream -xOo0 DO)иv%S`nЋ"+V[$A%;K]6"| -WrJvg9-lNw6l5^;AEA%!OS)ǕvJ -tY4.P뤢[)w -B:*%* -pUA9T^vcjDg) &y*\2 Pl>S WWѮmtH QSVl<'R ʓ'%u0Ixp5/.jQַOVV{s%u=bMrb@̤0F$4Z| ;LwșxYBWG9xJ\lpo>Q%|CTADFBJ=DHihHqJ<IJ#? ~bR}3:#jz=C&"0 GyV^#%Daqs:9  -eSQjFD(B[g<,Ϥ_wѮ^9|Ύ %B>gx`|%(`-ULLv55" L,$v M_+[p֒E  a;?V{.{vgh]S X6ONfFt}򖉸>'G>~e|'rG;~>+tU)~}U,YhV/ۏo鳳?"VvbMe~WIy\@U?+G_FBendstream -endobj -1653 0 obj<>/XObject<<>>>>>>endobj -1654 0 obj<>stream -xW]o6}ϯ@6Z#iC۵O+![hDK[IC~s量is^ZhƛZV4+f3[|Qj3J9o*xY~X}6WK8R{+@b"-U)27suX! JK{/i>o.+thVЬOܼ۠*w% G{Y#Z4 -irߕ/I=j]"%XՒޝ Ϧ - yP$02 y{%a3ȥ&'*+U8g@VdzdTR9^¶F8Vxs퍭+Jn21J_NU~4{ꊬT&b6Hbv - -A^l5` 1? -6|Rm6QBvQW(,/Y(WE%V@YnVI -! -KuCdunIAWTꜞjRuh+X !!acO@qKPْ֚ђ -%x)4˜(^HVsQR( UjƂLaСB"GYObW8o$W$=7+͜c\q5Wendstream -endobj -1655 0 obj<>/XObject<<>>>>/Annots 930 0 R>>endobj -1656 0 obj<>stream -xXnF}W PQX}pPihWR܄2K.)Q) - rv.gї wB)]P\\#:yhv;S3R~~bvMzMU%Nj7 "9-nUڍ6 %‰>^.>U_G\FQDo:2z'?rLR:i8fPw[,ٷd*Ψz[X}iK'TNLe!Jp,Ņ[]TOUY?Q'K=zi^]n)s-Ņ=oMrDQ,JZJuQijC5[(&w#QZ@P&*^7#Mf;jD儕?ݷc B5v2HXW;M2Qȁ"WB(]6 ],KU6*=[efr@Vr1 42>k \z4'"O6_ՎHwP-V-jV -^dm#x-ݍqŭq WC)X{EyEU 7k6Gډ^2f -o*ܯ J$kX&:cbfN}6^ qe?a+o1֠dpLgY4/ -endstream -endobj -1657 0 obj<>/XObject<<>>>>/Annots 935 0 R>>endobj -1658 0 obj<>stream -xTMs0W[ii{J'%Q*$Wq`= iOHYDqJe;[KJ4(35j@o0(AJK!$i=[A}r6̝!3g;؞2W^2*a seނz$Dz:w4ތj/V;caJWWHm缻y!zdw V=v_} ̫agSnYѽOp/[?.x%Ax5voPendstream -endobj -1659 0 obj<>/XObject<<>>>>/Annots 942 0 R>>endobj -1660 0 obj<>stream +x;Msm/ M yZL1æC 9-_\w7jAI!acdMS$fg&endstream +endobj +1630 0 obj<>/XObject<<>>>>>>endobj +1631 0 obj<>stream +xV[SF~W>ЙH%Ǘ $}6-d:YKkDu+~{ %0ivҧ4)RV &I8x1~N '0~h$z7~#JsB^<-JE5ׅ̩+Y". ]YUr]{Zm(>S<̤XТ/Hףăp|gg8S-xe[u)QV%SRףCc.6g(gąlZ5++up}%俸ȚR/ֲ?amų)/7Gbf(Rs RW2NA d]sH*8߉*0{?}tN"%k.XãRDHm g9IQ)lܨv 6;qD̓ | XVh3!湍YVؙ hͫ5͓@׷\+Ql^R=:+ݴn;om<4wfxX  GoYrк{–mJL -*s ̜rd˴l6 +VNӇ~(Eam Hz,3fdMfTvF``;ʟV`(`Ȝ"CtjP}} eU{DWk\v~ +q64h!q8 5ZN7 ra!3#opSkB[p%0F)kU(`U$Z+/?x 0h/Ieq2+H..ÐJU–z@7c:3Eyű>#0bu:Z*)8+2$Y 1q.)!;cx; sNn?B 4[\[ϴ+Qf\]={݀Uv}.I}y~0o5/vf_f-_vN1TZ9dQ=[3o>}J&ǻx8WGσ\&C4ejj^ϡ+ǬdG3uC&V_aҘNgӔܗvr/i~d' ~^\F~ҠKZXC n_[2BYf89A-ޢ&`4G1*=os%6endstream +endobj +1632 0 obj<>/XObject<<>>>>>>endobj +1633 0 obj<>stream +xWR9}+T1bvJlp.32͌4x{xTmQPƣG?NhZ`6r:>5r7h%-s&ׅdJ_OW&,3M esfloh~#,!еw%}0 |,3p_(VBGG֝@_7xMgƛfGQ{L7_L/_3ed´fƓUy i6$˴rR Kz'Qml}TӘ8i[kؽjǠ+Sr.)כ3Gjҭ%SнV \5g%ИVze)F֦ԗJbt*Uye,UU=)]GWb` +$Bn;@ώ@O(i +IƛǢqW+fw$! x! cTnS%_VM1ovCѦ> Z1 }EnauB%0 h+ gSZ2dV^0%SDZOo0NfzE f-{':zgBW\ pOj +Ss=-"$L1F4c{GMWӟv8ȯ(0186i!R ^յVLTxh!K}&+p|`\̗% a'yN*VށRG`fyPxt6uK`dޘ=Zol`[2ހGp#T^-wLwVT!8AF\ʽRvn\ *A[ހiȔE}Ät}3o~;efe GnkcAMV)ƪJEieĠ|zA0<Eɧ-qn޽x/ +COT[p^%Jí(n 7*IW?hzO{92!¡a*&w3L(7\E6#jy!V=ا] ޅ2H8c]>U<: `S7/i&>b56Yy\C,F?aVC>4&; 77Y=dݲ] -jiKױKE(52=M}C8.0mH9܄Tv0,ԗ*4༎aʥt +*V v"bDf;6rm $u{ Ё-5zRT+N1^0yAt2TMt"­K RuY8N5-8ʩڊ#$G#7 DPf3 %1$M woE9k!H>r.W +oWa-oa:^Df}Kendstream +endobj +1634 0 obj<>/XObject<<>>>>>>endobj +1635 0 obj<>stream +xWMsHWtqTa-۱\M BEf@GϨ?^~dBcLh19EۓhLw.<ůkt4;,hbV`2FYReOQ$m(VFFNlJg+h2 N DKi]83Re^P`66ugf`"'Dh_p&D]Rl4bAtICzs8pceTdLBuou:[||p8S#LlN΍$Tp=\P-}~-ש,v-nI3 q8߱#kC%2PU2d`Z9e,mdT7IqI2sjόs_E{"VE~ىldRȅ-cZX`T=T. l#d<ƽp1؈VeYU]YX45@3ڏ+}YOTx3a`&\|ﶀk9^nlbـ1 ֻCI;$Oȓ+[ +T!hR :ou>He3ֲ3HɈnAcv +`ƞo. HFUF6Y)ސzQN"PV9dб*1RLty'*hMH8Kږ7l;0A|!Y34=z-RC]vl?T!sA~m9@eCm|lX03(2ZKdhFUxTGa0d`xB|osN0J{n^2]zQ:; (#y|! md:D|Qdڳ``^%L c14YnZ?"?i[' GAH'Tjê_#ŋ2ʑ(T¯5_|dMG~~?tw1o9/Yhevg2ȼ z5:7|g!ܜ76_+0b}F}2]tqӗNۥ2ܵ1fY^ye/,/ƃ!FZj]Yo kh6XHLѼԆU 9_)* v%{ǐjXyRX*̫b"x>QfN(7)#]aT\,] S&v5 ;&ą DcW}Q9/=oۃ凫Kz0+zw<  ibnKl1-؉.flfu'8endstream +endobj +1636 0 obj<>/XObject<<>>>>/Annots 912 0 R>>endobj +1637 0 obj<>stream +xWMs6WeƖ-[ޜi3p|HPBL @ֿ[(ҝi'#ݷo?NtsZ]ՒbvA+|/nV ,z̮zvI-ON̂t*/ޯO?N^izNzF_L[T.XJIeJi 2ڽ]a]fK n#ȩ1xJvBoj'ŕ˴&)_lic^N_!8OKrdR[U :&mHNj%cwb+ALY;OCT]Y4Ms\@V l#kLǜ I~*ުg0G|[Y0ҚD5-Y!VrǷ3Zj!EK뽩aFZu.p$BȖ {v.c"efT`B {N0G`y>8#](E>*%fϯQ͝ptG*byJ ̾w;~+5lO[?z,RWS_x0KQCibgkNY;kD~H&T*g*YƯ#"fndG RXFKu=iR-TQ*]% -I4{Kɓet"@"Q NtHLQ ut;9I3e7yFUx iDngd`Nzj*j&w2,z8Sµ+fP[m,xd B+V>W7c + /!mw%I +j3ԗTfi"}?cp^]npCX;3P&~(jodRp$fd2{x0#:{(QgHE7KcTäӂ$FϏU)$GZQ9GD)Nmw9>8Nv~8 +Ih^Dl,/,=J@0GYcr}Iwy03j:|? JvA:>ZA c;qq)y\^ݔs;3S[:` +*kr& ֶzPv(CjHaI<"kkCvϺp-_飬'ց,.dCLUWG΀9C@p 5y4(n }(\,vH*C + +zi6cM-oߠ_|7 ~W77xA+B s4V؁na抖+p-nw63I]ik=k7.}K]wT^]_'Cendstream +endobj +1638 0 obj<>/XObject<<>>>>/Annots 921 0 R>>endobj +1639 0 obj<>stream +xWnF+XldI.ЃąMZzeE.MH]FVovIuQ@.wv͛7_Gh1|!޴?2,`F9M 2zu:&y8w<4GgΖ%뽺,9[ 'g^MyfAYE4`2ZnP&/%݌V)/J!{cdaȲ%KMke F>c7ȸ*S.XwZ-2!aH`%z0J%)[ㅶ}J`j^ 2?7x$t!mxFmO քY[)h|f*V6Ä2ȥuv 7U#*v hwarf6RW۫.̕1J0L2€A>[zZq8OuY'$Tax>o0KF'5trv#,$s*X4[#0YYt]93ùglBhM2q:/ȢGr}U<$,ۉ tq֏ OpCvpҽhM~zi 3Tu>(rP/R.-t+"mB `.YsuRVxw +5+3Jx#4q֬kDS9[ br6TnJ|3ZHN~ͩ{z l?b?lVhGbRQe{[\/QCݸ=@)&9}/=/F9{U$.Y8DN"5\ +!PP SZ5 +2Frk F8][arm%ѬR +ATmQXSVp$օ-urCN lC秚G9%鵞P!s/0v~J11[T.Yc@tw7~vQM={_50l#C[@ y?_Ng~F`}QT\cdED E'\Wz39rp%U;iw&}Ǧ7>/XObject<<>>>>>>endobj +1641 0 obj<>stream +xSMo0 W=Ijv[aj`^hYR& G:vv=taY)齧_Q + =)KXe (i\ox\$m-kHS(jڒmr(*$B̔-(hlhe|Ym56M>/XObject<<>>>>>>endobj +1643 0 obj<>stream +xW]o6}ϯ@6Z#iCڵO+![hDKJ[IC~s量isZ.l-fVͲ +c)v^Z/2hFmUzK_oX*Vg3zI.T -!/rѼcϗ)l6VkAB,ٻXfWtlOܾ۠T*w5 G{YUF +irߕOI=*]"% +ۭXWnNSJrp| +sv@`pMF/1&f<Ί6$vc +MC5] U=|Iy1=6&h߄9e/W b7'>cG5ny1mȪqN>?Nx,lnQb=z1 /H~z7"^a+fJ䱉 */@ _s?P:B!!Z) +| +tv=VC[oY-ܴVZvSe#Yђ,0xwՅ?c {pۍ<&9+5ƛ{DK#^ +l \-3j4e'-kآߒ,^4b.1m6K坅+q ?j%ށ"cVQDT_tFXQІkq.߈})%7hu!OBl˸Sew/nk15nFꛧ\wsi8bT>S9CŞactBaоT:Ct̯?"%_lyuoV 5:6:]endstream +endobj +1644 0 obj<>/XObject<<>>>>/Annots 924 0 R>>endobj +1645 0 obj<>stream +xXnF}W PQX}pPihWR܄2K.)Q) + rv.g wB)]P\\#:f4)I)?x1&t=Á&*ś h{Lx`ɂ*aFRXI->U_G\FQDo:2z'?|G2rB'u./prM̠Xo=;TQmD0XN2xTVf$l+']홰-2evu5UD efX#N*Q('3k|a_m7ŔJ*W}{PEB"NX 6[G?~7N{*ZV R(Z {L)>ȩ蝣XRy`+tˑF!9-i8d ;;蓮8V ɒL]lɻʆmu jU澽5UA".],q/-*K4ed oI{LPxeQ˚>߅!40й|q8|4n xZT5B<9*_!(1r,*T9b".*!HeVFi޺ ;f2FiW+z3P" ޷/^-oE_q룐15"R>tNp|hk0k[΃],k \z4'"O6_ՎHwP-V-jV +^dm#x-ݍqŭa WC)X{EyEU 7k6Gډ^2f +o*ܯ J$kX&:cbfNC6^ qe{?b+o1֠dpLgY4/Eendstream +endobj +1646 0 obj<>/XObject<<>>>>/Annots 929 0 R>>endobj +1647 0 obj<>stream +xTMs0W[&@iڞIkfrEa +ɕD\'}}+~" +(iR 4K<_é6eP'Hi)Bz:$gsKqx,'4 4 2J Geg83W'Qt>NΈfIgoׄzyFEիRQ<|u~ j!f^ՕNhE81)"ֹ+'J8ZEk!Tj2}֪ %t_ jc]7)I+~k:#z6 S{ImtK OZ-P.wH1x('jn*>8zfpoqrbmi x@èppbYNj=+eX7X- aH6:T,K)5+Z)-6J0=Q׬6aB3P Q;;e,%Sh%=,*ViPO@ߵ sgȃLl/'q >/XObject<<>>>>/Annots 936 0 R>>endobj +1649 0 obj<>stream xVM6W Cs v!(uuD[L$%);}CJdQh$97fLiSZh~KY5$/ -*Z̓EQ곢t,gI2j+ɬgm2wp:cOOqqf}O mvvM l/-M 5+'AUf3;OoV9U)_l>&4-etv^V䭔d4=*lpS%BiI!ÆXJP07ZTE9k0BK}!EZJzz8NCoY?ʆ #ʌީ}tR`7kېc>W.zqHOЯ:֪# :](GT6R 9:%9Hh#u4x9J)ѳB%u%*V *Mu%0t|[457jl]o"H_#p<-Q>v8N%ߙͯjيH(K?3wv`JM2jhEbϢ:5W{仒~uOˆ6d2tUC@&2HKt: 3#Z(l+p1$ -BgΨW-n_`BXAsj:ڣzj9ӜM&~Y6G"ՇUPLc2_7 ݷeepEnlOÿ"ALz# 2+zzx˸ݠ{.A@^ XKf3.ĹYFptvL'TG#Dm֣Uqb\(ogC<6eZbA[/vܶx8QzL{V&rZj;BVXBћM%(uCM#.AX[VR*kS>a%,`-/:ƌ3ظ.㠛Qyͬa֞\A"T)!m`@3uE0ِ+~%ӤeqLRU*E#,GKh֞B׆cR)*K{ X˥Q ys&jb,Vdu{)w`?o džendstream -endobj -1661 0 obj<>/XObject<<>>>>>>endobj -1662 0 obj<>stream -xuAo0 -j7v=r۰vEZm,y~OӭA ae7"d=[ ZtEsc: YfEYFr˂gocO 6jC<6:^W±޶ IE>I{^m_f J5ngzwg_>he[cL"d0RƿTXb6}~[endstream -endobj -1663 0 obj<>/XObject<>>>/Annots 949 0 R>>endobj -1664 0 obj<>stream -xWMSHW5UXrn]vة9Dd/z4ccFc/!~"t: !l?>G·`D%$8u -%AwG r.PZR{h k6.' - >^x蝦6L+8,8Yf3•Ft_QMJ}6wNq8 -jjit=(rG12ѷAUݨfIR".B -#Oh*ʅ ӹ4D%EUʇVt)*eJC\U#3v?AİZ >_ҼXnSD)3Zsrtkh-kL Ť'nDu+m({>SQ&pj@fHWdbDAy[YD'kZn UEI oٕr]@ --2Fzf5)Wz<$, vZ(g]2Y*)W+`$HfqW+ |EM;EȲs! 庸2?&dŇKk3i)Sy9F˦Y Cb:AlP.yƼ!92GQ2,g% CF;sH>U[fޟl TJNבt;}wڦ-sY -J R] h -y#x~݋!x|s2nz,(7\[C^|icoc5z7 ?RU[th4ZFrmuA3шTX, -I\.b< FOh-% -YRVdt` TWy˚Dbۆ6K2*C+t,KhT~qUUHNg]N(F,صiWKm`5ymg;Q 肣0=r5WYGza5\KH&zbK&@7֟07|w4e*xw#̘zRIi- &{v^=|yD&= Zsq;A3l`i+ -m!٠1';v6hmIĽ|Xo3 -]mŖ{ 0}r`ZPhJ*'o}$*[PBI]T)s>+.Tp:2L0ۃIJ@89Gvt'Z2G3c%=|&<_v}}Ċ`b>',V4zߒʌlrC/XY1q= Eyߢ|q݁8vSV%{:QɈ->ZqKendstream -endobj -1665 0 obj<>/XObject<>>>/Annots 960 0 R>>endobj -1666 0 obj<>stream -xWkoF_q[D5 -q쮁X*ڢ^,FXdBrҊ;CR:܇> Ϙxi63i6f!wi-h rYKwbA <8ʆOp9ԞSE3.=ݻ=q;ةËdomt?[Eқsk>kdq̀v2 @(w+y<9wi0ǻ1 lL!XM[IZ>^t-`@&ӫΧDXo sE̷ CQ8O iU-pMl3yV%̡id%J9+(5eFi TA+gx~W'c "Ӿù9F2ldDF9owHgE#gjP]2R_}$IkJ"b"G6|a.ZR5sB PW ^n}t<0Sɜ<5&U\|թDÅ?gXP z!cY4,#]WM1l0Ys=Ì&ي!G56]Z!BJ@yPUCv 1ơn-K,ZJ:3.6_Ł -i dC9ڍ: vL\77Ѝ7K?D{h&)֪91wJc.}jfjp+^HQR#Fm*,f:Gt,l +#YZ~D@P>{ЃifRU).|4`ց<6Tj#ЄXqyb:#.QNv~7"N+vս2ޡsch Sq8{&tD]KpB]pA@XW' /ڭmWc>NJ1Mah>xyJK̨(KQ'H %kQXf՜yqhTQ4vKf)bZzHdA)ȭD'fQ.+,s=?Ѓmq+$w,hm}" ?wN[Lj)2, oߖ>5IǝY  i톼5m:= {{9 or>ZNu'E+D75_;}8}ҫQDzRnXzf~l6_?޾׌.lx6pBAxә]\J2~yE5>;Yv8NiIDɛxA -[4b.0? xLendstream -endobj -1667 0 obj<>/XObject<<>>>>/Annots 963 0 R>>endobj -1668 0 obj<>stream +BgΨW-n_`BXAsj:ڣzj9ӜM&~Y6G"ՇUPLc2_7 ݷeepEnlOÿ"ALz# 2+zzx˸ݠ{.A@^ XKf3.ĹYFptvL'TG#Dm֣Uqb\(ogC<6eZbA[/vܶx8QzL{V&rZj;BVXBћM%(uCM#.AX[VR*kS>a%,`-/:ƌ3ظ.㠛Qyͬa֞\A"T)!m`@3uE0ِ+~%ӤeqLRU*E#,GKh֞B׆cR)*K{ X˥Q ys&jb,Vdu{)wϛohendstream +endobj +1650 0 obj<>/XObject<<>>>>>>endobj +1651 0 obj<>stream +xuAo0 -j7v=r۰)vEZm,y~OӭA ae7"d=[ ZtEsc: `e[cL"d0RƿTXb2A_?=endstream +endobj +1652 0 obj<>/XObject<>>>/Annots 943 0 R>>endobj +1653 0 obj<>stream +xWMsH+UF A8wm rXrD`}=(۔Fc'~BD4SRtWv~L`Bi0A ݷfp4Q< ";waiLݷݽ8OO*IY ٸ0)DxpL4}aݽxӿ3Ob6#\I+eE(J*h֬׺O}7_ҢXnf3*E!SZ\rrtch#+L Ť'nDy+](>&p1j@HWbDNYSZD'Zn U&yJ =oٕ2]@*s-RFz(Sz?w~4\?CZBMR&AMdxBGy/ Wir~Q?D\_uap:'#-% +V2HpU7>HT1MH R(u^<>W tD^$4.5KDN7ʀd ꦗdRc z `돍l$j-CChi[nTb U2K~oz}֋Sy+@%]p &eְ&Xꦦ +̠P! +%&_xlTe9` +KvmjxJ,a?m{̓}VbNT( $5~6G@(h+ EՖS(H¦V,o 3(vFZ%9"-WlyV2_I7s*~yyۗW+.H =54q ZY ;9 .ƳC}BN]]_]1?8.f)6o&p_gꡩlOg]r `YiӲ+mL@Y|}yE=SVɕAyn7;(bcs}!\|GYg~on86*TR``y%:Aimb8p)r0۠L=]) #4H{v!<-˜-XC [|k]@\t-'<9-c'@*h2 +&݇![z?| ZuqHendstream +endobj +1654 0 obj<>/XObject<>>>/Annots 954 0 R>>endobj +1655 0 obj<>stream +xWkoF_q[D%QF:5qKE[ԋňLH3CZsgHQ` px_Ч|bB9E| 'sD/P5DYLU TYL"U:smdNHRf.>O7Hp0\֢BGLȌ_~DiciP)5h˘[YdӍTa3iyZv+ʑR츯i4K/-5Gߖ\ms3-@yT\"ŸuD^R,KY@t͋qkǬa aϮFFO+զ[B6aT lE^K g?ƐYzKu]%Jc53cea/B$Ө CTZ3SУ_azb,^R +K}" (Dj=4^ng[>0l*u5KQyhBy8[Q<^rcm1[?ؑkK|';m?̉_c'r |;I[^fGйs4z8=qG?:V%P.h8 ENVt߶+1kk'zǦ4Ks>/XObject<<>>>>/Annots 957 0 R>>endobj +1657 0 obj<>stream xW]oF|ׯX-ɲ$;n(>ȓt1SxwvHSSA`1;;4ل3kl:i2>x8f*y}) `Mi<~ M+vCItq|j9}7+`Hyt>"{sE *-UQLzGIaV4WRƺlɮE'46wUiBeQ_/tG4[l48U^R4sg'z;T g"NamY͞N!4qI~4?,`LK(0G%NUשqeRul/͢. q`4mĕ&MikĹ+j`]LL 0qlx:תПOEIʍB5ۨ6񋜖Ҿ*Bt{JJUO/%(̙ckbm18B_ţ*GÇ3NQv#C*guͲ-|S{W`w'vvAhp:z85h>nuN[F*bfYk.:7{ ]PƮ$,`GLm`S=9rG3uCv<]E]xH!⸍N3drhJIء1B\̎L񆙆2raŕ% Y.h9a5 T..D~ !ՙZr+iɏ}66 +S R @@ -3492,10 +3461,10 @@ j OYDGzִ| %r(S;#`#:h5)&ݓ'Z'GR9f.KZ֪PG"VuUTf[T,7Zbg61}箊7G)@>.|'G-WKYĎmE<mA;ف e W "rp/_Z߅F^~XfdAbX(SѕF28f6/Tre[5cSbQX6Fy ^" -=-#,+g#&O|gIY32[dÇ+״\5#1Ԅ l_Q!]5 \KXnOwo”x~u潱AKN;B\5ѪaU+tfDoYQyx~(dU~ &(Bfu3F4RkS7a*v"9zv.t0rZJmO|bh2F9oF˛K~a 1KW?tMm*;1o:endstream +=-#,+g#&O|gIY32[dÇ+״\5#1Ԅ l_Q!]5 \KXnOwo”x~u潱AKN;B\5ѪaU+tfDoYQyx~(dU~ &(Bfu3F4RkS7a*v"9zv.t0rZJmO|bh2F9oF˛K~a 1KW?tMm*;;g.:uendstream endobj -1669 0 obj<>/XObject<<>>>>/Annots 974 0 R>>endobj -1670 0 obj<>stream +1658 0 obj<>/XObject<<>>>>/Annots 968 0 R>>endobj +1659 0 obj<>stream xXmOHί;5 zG{C^!p&K Ԃ@lvwg^" @@ -3503,49 +3472,47 @@ z it`EJ E}+\7&F $<+!sYJʴ^Ij$L˒ncI Y6TdQDVT)eJ"bIR.s%R sh^0|}}N맬]MS_}b-Zr0ZVx0L7/PtS*%[lɀVEZѠ=`Y*DCu$yU˦+QE!1Jdk/ UF{u, WR7"qh ,T5(`֐S+@R'[H.ԭj~2оDYz0YYjv18ɫه2LYf ®7ϭd<ߏn۩K6˅ jO\'4{{E5"dDt5q!F\ Iv=ar?җY\Yx?a~td'r>_V]éIUMʓ={N?]3zsyMӷ>]<)Si}2s..|'%~ie2g['}4?^DjX.ڠAMσ -@t{(:i5B$Mw0KmTo+e!VysXYJ\(ךf%bV`Z7Ac%>ka `Ki*k`ϵB)E0etMUg]-JSg1}V-ܬ @9\U 3`7*̅JpèYAi7]󜼗ɪAu/鲒eky(M$-fբAe^AeN|R%O8N7q;_ǻ`9n<ܰ"!pW w`0yF3fu֍15o)?PPL07˖kpo"=K=mZֽځ =9&x)VǮ;لW HUZT+Oi8"A7h=lS}(LDbDvc\F#0|w-#/Pbvc*/[2M)D-Uc"ߎk(Le&]!{#C-+QsXҭLs繪!;CEJ^vZ2C8k P&\ d]wǦЩ,3}uh ْЅ20Y?WTe}K5Zi 5adlw`%C0<*.e>8~Me.agSVAfZ4H\<!a]HY:dg/4+?FY.}G kW凈0OB$ʴu1hK^]d1ŇQЂܴh<_a&h :deƳ aK;e|۶gp0WG,l޿B!.endstream +@t{(:i5B$Mw0KmTo+e!VysXYJ\(ךf%bV`Z7Ac%>ka `Ki*k`ϵB)E0etMUg]-JSg1}V-ܬ @9\U 3`7*̅JpèYAi7]󜼗ɪAu/鲒eky(M$-fբAe^AeN|R%O8N7q;_ǻ`9n<ܰ"!pW w`0yF3fu֍15o)?PPL07˖kpo"=K=mZֽځ =9&x)VǮ;لW HUZT+Oi8"A7h=lS}(LDbDvc\F#0|w-#/Pbvc*/[2M)D-Uc"ߎk(Le&]!{#C-+QsXҭLs繪!;CEJ^vZ2C8k P&\ d]wǦЩ,3}uh ْЅ20Y?WTe}K5Zi 5adlw`%C0<*.e>8~Me.agSVAfZ4H\<!a]HY:dg/4+?FY.}G kW凈0OB$ʴu1hK^]d1ŇQЂܴh<_a&h :deƳ aK;e|۶gp0WGx6s_$!+endstream endobj -1671 0 obj<>/XObject<<>>>>>>endobj -1672 0 obj<>stream +1660 0 obj<>/XObject<<>>>>>>endobj +1661 0 obj<>stream xVkO8_q#V&MHe Z`i5~7vg;c;{$c-6>{BOcHVp:)q Άe<@L}}fY˔Ad´#a#7+ztEC/@AzQ:$p2@@ sa&z-wK T&$¾?u@gEuЌAH2w {&]皜݁TpEq 1@C.PgG].EU ̱r*J]pqpŪLq$#03_3bO*6e+@]\_YLXɓy|:Ba[s'^Ssyyc&_dz6QSlim2v9X՜?%0݃9Ok`{y0fZB ut ㅇூj: t.e`6/z񘷀fa?~N[@|ZM%q]ϕ8|L 0H~ ,/P{DGFձYf(WS3Ia5,\{ Yj0wy=|]JNv^p +6S6N|l'R{g, noBL޲w$-p/ @25(@ƈNA@xnkKv}%8;e.jpc ¢ nZ=< r*"+}Uv0QIhp;H97ܬ;!S>kTH4}cG83;/qxح8#{?.q/N ̳BBJbN[X4,JPD!]{BGRH ׇ>+R RWmV׉ 2sOFn\qW?hò(( lsW)(ylvA Hv%e(mtuAʶYq2mzJ[$Lm[ɔp&,am٬ 3Vב֚ -TV'WeA$$%"1-"<Ui%1exf~y<_YbD&MS6ڡ7S'C274nKendstream +TV'WeA$$%"1-"<Ui%1exf~y<_YbD&MS6ڡ7S'C27 sl ̆Qendstream endobj -1673 0 obj<>/XObject<<>>>>/Annots 979 0 R>>endobj -1674 0 obj<>stream +1662 0 obj<>/XObject<<>>>>/Annots 973 0 R>>endobj +1663 0 obj<>stream xWMs6WQF%w=m7a&=%L3i `}>&lIY9'c>Z4Xѯmџ*@g~ݫ8V[Ti5,@șH(۝1iIWժr ߈/'̈&JHm[%G:6>8x=,@O Na(8sE,;K83`w1+hM|"dO i ` zy(nHojk?^LVendstream +T],/րK# HDMBqVɚ׸.WXcU/K/oe yQnH"_Eu(IJBqx8P%>Z4Xѯmџ*@g~ݫ8V[Ti5,@șH(۝1iIWժr ߈/'̈&JHm[%G:6>8x=,@O Na(8sE,;K83`w1+hM|"dO i ` zy(nHojk?|t?ؑendstream endobj -1675 0 obj<>/XObject<<>>>>>>endobj -1676 0 obj<>stream +1664 0 obj<>/XObject<<>>>>>>endobj +1665 0 obj<>stream xWko6_qO)ˏS`ҴY5kzhPBRVa}Rbs4!MFtvNi~4Hx7I4N~V= -aq>śpz0Yzрz,g aBd4J"=$Q֔V /*eC~ؗ)v##t5簙U<ƹJ:]fٝUCp1?wW?4GQp7D+!Hdȸؕ(RH2Yh;Ej*kYK<@cT Go! Z"H%BZʢM,qa,@¦kJе$'pJTo3REAoő3:,q Yts?ivLp-ӑ~@rm~tx܄'coZ;X^ Vb#i%*mDWh*ZZiݩ(*Sz0|Q9\k̚Jtb 5Đ_jUxdrQb5 ,.(׵"g kl<^}+Q|4Wi` ZB #rOx,d X'v#RŖV_Oə@Z&b`I c -C<pXv [{bkpSH<ōAYY w&欹8άW_ U(I>IT*^Ob 9\㥠RV|Z@N4;N_JFYw4CzmN;9: pL 4Oo] /crrnOJ!>ƢYa:#i}^B3y +߱65sk6 jxiN0Е؂0Xv詒X4q\6Z ,=dgeC*}]f}ǷLDlWªM^MT(y`DXkTЦXo)PSoJT$MX>"ϴ1gEJ_޾[#}0i_mز&!rr@Ǔq29BbfgG *s!endstream +C<pXv [{bkpSH<ōAYY w&欹8άW_ U(I>IT*^Ob 9\㥠RV|Z@N4;N_JFYw4CzmN;9: pL 4Oo] /crrnOJ!>ƢYa:#i}^B3y +߱65sk6 jxiN0Е؂0Xv詒X4q\6Z ,=dgeC*}]f}ǷLDlWªM^MT(y`DXkTЦXo)PSoJT$MX>"ϴ1gEJ_޾[#}0i_mز&!rr@Ǔq29B|zfgG *!endstream endobj -1677 0 obj<>/XObject<<>>>>>>endobj -1678 0 obj<>stream +1666 0 obj<>/XObject<<>>>>>>endobj +1667 0 obj<>stream xWmOFί){  %QS --WUaml]s9U}f6mr/ط;33뻝1|BJQ4hMhv8#iv30#Z,!qp{4EO]-ki I. -QDNG*J' i.A`r?qXY4+NhX[3U9+C*ڳfD(:ܖΫN#)Icy{_>QaINW[2"E/D tHq.)KQ9sdrE ٍu kkG -o[~(Ʌ2z#JGJTLA3$.*P2X#e^R6l@#ހwJ6Eζ.|-66(YyicJ&jdJpY) -i_CHc*ĆlGy-m(6I tc l؟UVb+bWi#UK?XcjU⍗MmkXpt"VY@S ˥(]#7Ǧ^t iy{BCXr{{㲻PtVV\:ҒbA.Hw5΅$RGfR s UA8ˉ+"fj1ry: /l+si觻HWt"61Eصr2PɆ{fڍWƎ lܳ"/I<󌯽>=! sޅϺz,02k9"TqGh4(℁0G4A4C1IDd\Vܝxd̜'$5eܵ20nwlLmbT*X^YaP׆qEDtFV@$cH lR? NWTCPd7~v[ Zl {f>mV) *:UDު'q4 Ùc: |¿pq --| -`<3>o㡽zـ|n~|'8͎xi꿛?e"sbޖzn ) |ΟZZ>);Y5'b|G)ZGߞѹ7|{߆{r - #~2Ϣ!Db痝UK#6endstream -endobj -1679 0 obj<>/XObject<<>>>>>>endobj -1680 0 obj<>stream +-WUaml]s9U}f6mr/ط;o<31'4=E#Fфfs\O1;o;#:H G#Z$ղFںeJ4 q$2tҐ6Wx&P(\`2fJ;k'4ƪ敡{YV3xnK]'KH-)Icyƶ}QaI0o +d LyJV:$\X]8ʥsgiLTVLU"]F׆:YT5ŵ#-sB{#J~p*YL(sp2q/irk)n@owJ6EagD,<ߴ5l%T2JIXCHc*Ćlŏt/ZڨQ:9l=  1GE,sع +*m jCzc8bk^olj^Ãщ̲(*X.E t0M芥A">+lg{ F +Œk|O -=B2GKGst7˥%.Hgk I@GfR w U"@ˉ+"fj93y: /l+si`pNs`觻HWt"61Ek2Ue4L 'њo7^3qϲfl 3>{Ѓ3=! 9B g]=,02k9_g*ɸh4(℁fhh0c*Dɸ^;5_~<3s>x .֔e +rjbtMe3ʶQU[;`m<=YaPŒMrø"":#x 1$rxd)T+E Vd7~v۠ Zl {f>mV) *:WDޫ'1S~:Pۓ`xRVSmOW"Uȣhk=SDwy9~e@Y^$B4, кh׬?aP)e)&g +DefKЌH:Ȃ C,ӟ_G24eIbZ+ U)E +ԧOL[7׳HS<:-Tuf'ºv 'Ϩ~ NB'g_R} i0N.C8_1]]VB>_n8\>dj0j^ l@_>s7?>g'8͎xi꿛Vos"D½-}I){p':jU4je" Ϫ96<N<:\΍S;6,&`>.,b*A~U-#3endstream +endobj +1668 0 obj<>/XObject<<>>>>>>endobj +1669 0 obj<>stream xWkoF_ 6*y&yiYE~|gHaM$۝]}=ǴtNIq6G49ͮie|Q<9}ay6xL {̯L G#Z&ˍ(QDLMjި4m}iL E˚V;y$7xR25Z\-و)r\نU]y⸪L6uėȡjE?q vLִw7y|~m믍Iև=dF*W5vq$[q=~k]kV#J oJh׵q'Eu %REh퀗7֣r6>H_-gq|[kDf^7(# iJtAb~2lgg -<Tߏ\d~!jd2y(ah~c>/XObject<<>>>>>>endobj -1682 0 obj<>stream -xW]OJ}WL!R^ TЕ6ofwMĵ~H33s̙Ό;!-(vOɜ'K<Ӕ］9xC988CF0N6ݛ͓yr_vE^aB%ۆ ofxtp{TY(wNSS\ SL/f[Ԇ -ŃnWzFgxBSnZLgbJ䐝{mHکюm7hJmU)~'M'jz$m%G%\8ۅqNJ= 1&: 刜/BĂ[>" -wS本%d7֖Mdj -jSΔ6Fx`ʒV2! ym[GTx}&Szӓa&B'`K"@15JRBDnbbYC?*KT^qvj; EK&5;j$+YTAwHK , p1{O3PKH 9Lnx䉠ֹt{{̶6.7ƾUe5l-X]LkϤJ5 -ߣRnaJ C?LÈ5sD]2HUC QJ87=X6*7X1:t`I.b=fSU0ם#/mYڵTDu~5bڝR$oziI -qG@ -f΂1i!0%w J&sVbkθ=Ȍg]ߘd]k}H[v1Ly慦cm3ċ =Pg[m붎Q؁ 41M푎IFPb$ؾ<#PKTȄ#3%j +HMLD' ʖe@9O&uxP\jx ۯ~s<=S"0.Ues|Wjk4̐ϲ'_ /A,"@6-|W H#|k 5%g;! Cx?!N!Ccs]}!z -Wjrd uki QZ"[ubr-E7gޞ΄9i[hU[r8Q>/XObject<<>>>>>>endobj -1684 0 obj<>stream +<Tߏ\d~!jd2y(ah~c>/XObject<<>>>>>>endobj +1671 0 obj<>stream +xWkOJίRbH-EUK@[ ]ickvפ̬M\Cry9sf3V;d7ɂGx>)y{qB渲m7_$MBy] Ֆl6 BSe}ܵ>8L}OrlN35HmR*ԓr]MI; +kZ+Ouk2M8M;:PېSM)gۚ-hJmU)~'M'j<`/ "r[U Wvva"i6[O_?cr3EXc[Ї6@DF1EooɺQN|cmDn:L!ĺ-~륦,iű*p1ߍ6JOŌNz28Q٤4 x!s|ҮuL Ԭ5Ѵ[6[kL.9qf XK~x`Gnfm@~ZZ[i)T19kwgg̥pk {Nޣ\ *QR4&TGƃTVш#?+/n RIߜB <=wcDqT\mˌF1edWYJ(d]rd\lh٥60ud:hxAV34%J3Rn_ilDbQf2nbXxG҃~UTu~OY~6ͫM3?˭4 H~{GDoHB`YFt|GPLNF<)W}C(zmIäxG͖DP1{0;*Hգi<Σ Zs4>s_0e$ОGzmHGׁ*@lkr3n[PUO[+{41SZFa{TbU؍;L|P?X3Gt%T5d`eT{xQcer5<?C 6lO"`=}N{OV;s^wcG6|/eiRQwykwJIpHaB'(&K\V8,"8C5$d0gU,FIYkS۪8x8^jaIֵGtn\Xyl^h:ݦ:OKɛ + uƾ,n@~$阔ae-F[Cj0EDHeL82]Ў0ޤ4A|K>/XObject<<>>>>>>endobj +1673 0 obj<>stream xTn@|W*UIM0~tFC}<`m喤;wrV%ݏYD!>LhfaRt :X yp&/%N5E1e['I08 V}UOtk] ]w=Ebپ:ܐ앸7U]TrI@\ɞ;,lkL] {th`EuBfd4M>R7VqXB۪ 2 >;UBvitrB|4(獵F }! @@ -3577,75 +3538,84 @@ N {.Vvp^K ݹ& #Ў[rv=\`]`I c>0J#0G .tId:~wOWLz] kh U~^1 -wP!}?endstream -endobj -1685 0 obj<>/XObject<<>>>>>>endobj -1686 0 obj<>stream -xWMoFWLuh,ّ-5IXiuKr)mJrݥ%e-(|yfdFg3U'g]'tq9:Mɫh]byIp Ojv4{돫[Z9SSomg10[Fdcܘ%tSg6 f2YVk[U}]ݘ=VScT6PTzO& -LJeh2;)U\-3B{@Q.t%yU紵;/oK뵮6J-` J7%?,v=?(\S !>:;O C;4Z9`΄y*Mt'4mS?͞w'"Dt) d8 dF]:'h@(ة,[lD>7(c'zMj4x 9gznV+ܴfDP7B#2t9D9*Z٠=Pw:nԒ3Dr|A2@6&k#OP#ʒ+03Wp̓Fw0%Ժ -/Ͱe޾\+ ,fF'yf"ŸвSn^;G[scaMzS}2SJ@L!q %O}"S2mK -鈫{wbg2U -zh8 Lm CĽVu%mkqօٴx*KBe?Jz-7lJA6]L+p茳m_tٕ 6 -F6Ә\/(Pcko{)|(fu. .6MAk3+Z“oMPi; bƒ\f?]ZAIlgޯ!BRq7qŲח3рFs ]fD=x è -qRd%xK,#y;M -}}@@@0*y)@Fg0\C3$=ϣ/d/1@JS7jtlt&RG}Zc^Jlj2 17ju&dExJqE2z,J:)7 BO.n&[|gdu Cw[t~cbG"ebZ͸c ̀W\ܨ.v{5RXƲvjkm V= +`hx fJ1+O DLpgr^T`PŒY`KaF$ZPzcwfVabVscux+Я݈Q񈹁 # 9?y/^G6=',~A;/GU"| q#"|}dX5O>;n3gLVقi${RI@QdE;^_}-'7},^,/2K6䷓Eendstream -endobj -1687 0 obj<>/XObject<>>>>>endobj -1688 0 obj<>stream -xXr8|W̲*uˤDJdV98x{ LBb -`ҊdU$ 0=4фwJI~/i2(~5ǫ˲09e,G=nq4Sb')- -&ZBZJ8'kIKUJ#" Qe47MU.je4݋A"yveI6L)Φl?/_,TGIn#6c$~hSӉKcsyB(N]xHq:8DٺhF۹Zn|8$cVԲ`W,2gHn~=}=$BqkTj["EU-qț¾LO%ҙ[U:Pʧ6cNJ{"ɔ.[@^l;.P̖=*^JcU{x^]N ku5y!MhwٰC@]ѐyS>et: }͒yhd- Yqkۄ\m߬$w۵g%Vh\"?Y˴OU)ryOijȒ*K b|(ph(s44@{+#8 N`>կWI {6F?Mh*^ =PS߆"eK׹itr~_렲mkazRdEo~x7џ!pFŵZڞ}>|qPEljJaQXYƦYZ.Q\TR?{PgiE;5O̸GtتOsn -=2faKMfٿ#nJR=rwJ^˫;+PtQ8fDd> C:: F *:)zhrc(ޡb*6Dcm5~k#8bMWK3Z7o³w_B_=bM#؆dQ5y+ ^ZwR n(* = r KsShs9xo0r`㟐N.xwe%\!TWSJ4T4{]gThT!0jMKXƢ-[$}a3m 4ou G|iVy( mk.c%0,H}wX? Q &Q6f+PQ/#4Zg5eU\ ndn*,/x=[㰜d'wo42Sރk -;_U}BqaxlVY֪ -7xhtsakYhL6ɸy%0c_\%U ^η>У -b--xp!w+c0p/ !_SP*w~hDMLiF^K/:Bzjx*Z"&,wlwuwd،ޛ<(PtBOh>+Ń*`Sgy}_z{[tCLdwYЌ_\P'6( -^ -OҴzt{?7,+b{Z*L>_%;FD'נ Uı g(,tOM%ͭ{ o:Np6_"j-*YȜkmSUz Ot2 wo~qg)endstream -endobj -1689 0 obj<>/XObject<<>>>>>>endobj -1690 0 obj<>stream -xWkoG_qE`]`W75#5mUR4ffsgBqMT[q`sw'}O([ c~VRq;ROt"],'hgKTZR%E.}@RT)AVWάWY$)C\eҹ.-eF2Oq NgoOzooo+I-QU`Z){H*ˬ|+`p6,Iv\URSa,2sGZVzA5#*ReK$jo!w&'[)Ve(2cs6, TI#'Y3JlݵpRd2IE2arWEm5gRWx!FV.D Dyxi9[t,OšF %9P{x7u<k@ IB|auSNztl҃a:d= Qq/eܟ?e:c@Xr= mbhd rLg c -.x ]0mVu. .%r `*𭕴Og\3N$,p-ZxR-hkj Nd&~#Bc=@7>DC{S(d՚[I<> gM\dOԞWְ k;|"q0jD?fjf EULS=b8Ioj}N 4܃&-eYF}< JX夙AaYb`ʬfN!02⤛PG,&E#jJ(p$P V 8J2wxߡf'^yTNxS 2A6!_D%*խT;Ry B h<^fZ^3nQc -.^E#m,*xJ tB8r5:Ebgh`Ąz-M'p1d4سORV(- =S]-k܇X]:199jONu+Y߬,p8[l 6 mQ'p]@4Y[je܁:9!x,|trOrؘX`! 2Fx)Ξ6G yn # s",?)>]c^4".S A7߰%ZH.94q]8-'%JIz0^8z RP-v'W7Q0=C]ͤ<\!vK"!V@4q<^_?5‹M?Э6(Yhw{c{!5ZB2!R~>_^Oogw,rr{wL^v={ `kTT|Pi>@+ `bI)~/nM5o̡Yn4}`jib67Ͽ6N(~?>z:=.omoe{QL4ۣ F%[nMV؄%#MvWqnR t\ד -Iendstream -endobj -1691 0 obj<>/XObject<<>>>>>>endobj -1692 0 obj<>stream -xVo08K-i-e@"Ȉ'^4iI٦i lǜJξ;怍Mh!jפvڳ ).;mٶ $2 [4< F! ݱXtlq[9~E۹rVK[7=͏2JP@@%$- -"U s|4YpLπK'\*I|97PTt6*9rz -Z JC\M۟;wCwx5 Ίk =ZE!yTyĘẐ~f |3^BFpϠSi l/(rXoa8x?7ޝzfxCFO -PBrX1 sqK&'\j&j:L#C9s⃦5h l-6:$h) _@=,xQ]G Õ\qLZܖW:9A*G-fϿz~r{4nTAW'}aٝ^!X#hac/;4 慭\sn, ذuAPݱMͶi}{aendstream -endobj -1693 0 obj<>/XObject<<>>>>>>endobj -1694 0 obj<>stream -xWQS8~W/"^dqg(t/ 4׶&rI +wP쯗C62 ?ឳendstream +endobj +1674 0 obj<>/XObject<<>>>>>>endobj +1675 0 obj<>stream +xWMoFWLuh,Y-5IXiuKr)mJrݥ%e-(|yfdJ3.U'9/.K_.{NSqj}2~AsZX^:'?ǓV5A;>O-7t6u.<)nLycxtNiwtL|tVcmFtAWtw~VyJuf+MM[*wFi(XT'xRD &S%2a4^*Pq֙vA!= (ss{YOCwڷZdjG`Mu[ߍE`0 xU +Ok)v[xx{KL۝ˡRnVhgvX\}s/{*L&Bj@Kn@3tYo>c.#I#ơ'u8Nܘ{XT|TR0:p5,}H\6}z_LA{ےs:f*ٶnƵBp^Z;N%"SldB/;q-w]DerZ#iua6-J@gR:Pg=4Ҁ^t.bĺ{,wY5c!Ŋ;:likv? Av, CCgQ4&j( +i%rD8 6lSК D[TN9$Oqp+ƻk@@@0*y)@Fg0\C3$=ϣ/d/1@JS7jtlt&RG}Zc^Jlj2 17AJ: P5eX&u +Rrw_p0 =)Fʛ\oefwց8 > m5[Ďjy薱uk66XlFuvSr#󚸧*]Zk6"EڜFb0s +*X;\~UF?b|gǏG QY\x!~?5p<V?A`y˯ڱ}i5>y{u>!`3x#ReǍyw0q9`LuwM#ވw=ܓO"+$$;n?cq'eh/lo'Bendstream +endobj +1676 0 obj<>/XObject<>>>>>endobj +1677 0 obj<>stream +xX]s8|eUIԧ]{[xT6V/0 I)H+_=%Ӵo YF4 'oS:M+IMd>c.FqzzDiJ%̦(h Zk) +iI*tT%-U))6jGUl6Vt/Q% 8&acxAP+RomF&я؜Ï_MM'R/ EVl;EXdtQfN ls8aQV="qk6tsKRijsED;:MhV*r5t̒UHQ +HVz#v̀x{#InjYl8k,wZZQ˂_}sʜ!?[ ǁ]R9(ly>3ث /k8A T(韸UZ|jgy{zIiO]6?AܸVUu <532G%׫_ɜz78\jqo>޼ ~K ua48i2Ѱ`.z0T= 7aLSg& lOCE'-lɊ{^&xjSf%;ޮ%Pg<+F{Z͹)d|4-os7q GGvGz͟WwVh֣q̈c0(@u}Eut&!zTt(S@PJC% {Ě`F ɢj6:V&2#(?Z5PT5@z^ &zyr?[=$(s&GbKo`l?!;/Fו\ԅʘKC26h![i>3"z%ђfCa՚JE[H3H(f$@h)A;҆)K/,Q>䙭:] ;J`Y2 t{L?*BmV_>Fly}iάkl˪8;;%p us?UUu]/t,ey둿$<{ۦaOJ@@+8.DlphE E K }b0e.D(MOs|â"f*<\liDt¹_{ A0OXEQ2e4^޼5p _'|<4̆V_E6y(66UetL'p8FGg&endstream +endobj +1678 0 obj<>/XObject<<>>>>>>endobj +1679 0 obj<>stream +xWn7}W 9Ю.%@j؍[- +]xܐ\)=CUΥ j#"vΜ;ClBYu2H4O3_L5YIlL! `H|rApo0y֝RiIt{VBW0Jv^e=2:<9rMI犦,˜?%8=P2*,Q8l@/m@z4Nnj4"X|9<!Jv5c󇖿lCgp6hP[.'\(SY=е cl#CL|EKh4HD˫m\3 +|$= 8& G軔 ښ6a%._trpȹĘn͖~S(d՚[I<~ŏjB =G\,x*^[2lBl#o3 ǭŒghjyݫ7U&2!N| R'A $C ;p eE,jaږfZe9Y͜BedIaAG,&E#jR%ۃleE aE|L5Y$*1W%1352Y( 飔uJBϔx!|GNLV{bړSSF%4뛕NgrdaN'p˖}y]Fe + FD IЅ#0k5ŐqD+agU-0,bvjl*TÊE'2Das&1cv͛p s;}Κ0m>g"nl׷W)>m&P0|tt {e](O!gߙ.h2'_pJ?a K2G$ݼO߹e+ﾘɯ' +fIendstream +endobj +1680 0 obj<>/XObject<<>>>>>>endobj +1681 0 obj<>stream +xV_o0S%Ֆ4) h>4H-d/nb$lSs[a VeNd%gߝw怍3h!jWvڷ]l ? y`:?_E۹rUK[ז=c%TL N da9>CǬ`8 +g@% .B큤B(B*:QU D^q b%! pONp&ϝx{!ƻE +gŵ>"ېLZ/!KgP4 T]bs,0z?ޝzfxݏCFO +PBrX>/XObject<<>>>>>>endobj +1683 0 obj<>stream +xWQS8~W/"pqgX(t/ 4׶&rI -Ut:m|9ΗZ`_ .Π݁ }j͡ .ބ`[mO@_Oc~N5̖mu̮Lė4(CʄdgBU ,beҬ~FƄ$8_cv;M;q ? cJݱK1 # W OfY@ !/s[y?SsқzIY)NpC?^]X2Fa. x?-˚W $#* -tOGy[~Di=nrE_̪z]A֌? V^:LLw31saSwwNߪj~dϰO޼뵧 -W+EICr;/xBys p'p[0b4PM/ S?6jq((w< $ !IP塜QNyv9 gLI!Kz"6>3_A%CYZ̬sq`X}<|kXwY$DȄ?hrli(̹QWϻiR&!C,4[tpaU`XVCI*,WtVb}<agI閦_K 3"*E%#2l6뵥ԩ7Ս8"Sb4pCt5xv!TC|4Z#oLcE^Ag.- 9{WKVw)Di"᛹=kCٹ>K~a"fE@@TE6J:pn/ W1A57['s]+ϫӻK} %ْ3dYѓ>%]K8U4]hԷUsa6~a3%i[w% -,X)kB0/lMVo}x!@?̨睮zqRmg_DMendstream -endobj -1695 0 obj<>/XObject<<>>>>>>endobj -1696 0 obj<>stream -xVs0~ر/tn@z郵1*'O B#g&Eh6: ɗoոt?k+G ؽk8ܷkkwɸ5_i?uSvK o*@, -r͔2(%diFٜW*߽iqi9!d+1%xѧUֵ9Lo_<_"pEl>M )SJBQhNlgusMj#^5Rkb&gk3i2\wt}wQ(k.Wq(!kx(BP *i9b}2ӌ1=Xy`yQv̦rAH/i<\)ͽ$ \^kVPN'$Bk=^XCk r7}[zG|W_HQ>h"hPg(|Th8$\azQ"IuOX)z[nw?؊endstream -endobj -1697 0 obj<>/XObject<<>>>>>>endobj -1698 0 obj<>stream -xW_S0їzNZ=gDZі+> 釿@RH N.dw??`ٹOk3RF#o7#ːEq ȯ\@>9е!W"6{{B ,hҽrTP'7S70HƲ)'JM[G76r&ctiFk[ȱTt [L.G+‡gOpOaJK tR}clpg۳*Xu )`/S8Lj۟Gt\?h?~B+zG -~E8_W@ڞ K ϫ'–g.+'Wq_2࿈!=SCYMըWא޳XPߒ%9h:1qM^h+hW QmFҬecؙNܩ=k_n_K-UTIj7VYT—RrL[TnJUKoz],pue"4jFjqN+Т]J>&ocx -iJC_5ܲ:藜պ%MY&('m`LDMuB,Om:zˠ[%eʖ5= 0[18a W|ϼ0yBÀ% V0a>IK7t緍q5Q(8)j` Nzz3Ɲ]endstream +Ut:m|9ΗZ`_ :gо }j́ _[.ބ`[mO@_Oc~N5̖mu̮Lė4(CʄdgBU ,beҬ~FƄ$8_cv;M;q ? cJݱK1 # W OfY@ !/sa ǣNIo90 S\;þs?^]X2Fa. x?-˚W $#* +tOGy[~Di=nrE_̪z]A֌? V^:LLw}81saS3aU-JaM1ykOW0Gw^TP!Rzp'ᨷa$i^~& mrGN/QQxM3@HIB򓢿 C9[-VrΘq#dMC ( ,D,m}f˃|)KnYd8`y 6- +I G5!$#`Ps<wJLB#Xh*#$f‚!T!bY I&,bTr:_)UZ! RdeX&%[~m[/-̈ H\זRzT7fD̊d Oas.&*%kBCsh$FފϙNJ\Z"ҙ{WKVw)Di"᛹=kCٹ>K~a"fE@@TE6J:pn/ W1A57['s0u]+ϫӻK} %ْ3dYѓ>%]K8#kijoEDzmjYgJݷJ=YR֤ʏ`vlMVon-6rC~cQ;V碋qkW59^ڿAD1endstream endobj -1699 0 obj<>/XObject<<>>>>>>endobj -1700 0 obj<>stream -xW[o8~WL4Ϊ+1-t->$qBc;t6Hhu_Ώ yk:;38b#}y<|p;-ﮞQ}n[FA H^w -px$EH#TL! " R)A c. ˔ףH)^"(QaL#݋I%Tj5j #gidčiR)t!yJ-W3 y& W=*Ҁ$a#ieEWeBc{@s͝ȞCtO|$P+pPDBЄ/i!k-kجo0c)*(.=pkH0p,5XoK>x飖 r04fTP7#pMqru-HoX-}Ϭ KJP^@* $^T)ȥdѺҜGXZ]4G( "%Z5)OՑ")A{f9as,aƅ " c2W SuG4|AO=M?ktmGbvoM/aUo]x& - oGI0!]]{.+d)W?cQ^ כ}[5^o=%&x:M:nY֗s;m꞊MTrN,V f|Z.HTMs'Ї5Ra!"2g^a;aE\?}Nc" NUݼn jۃ;Jem2LZeMYm Z߳係/ٹw{ɤw󵇷,DCW<s_a;ޱ^M \Ƅu#$Ջ Z~uendstream +1684 0 obj<>/XObject<<>>>>>>endobj +1685 0 obj<>stream +xVs0~ر/tn@=郵1*'O B#g&Eh6: ɗotOոtgN_5]#mv5tP ]w5dܚQ:e{%Ç7 KEi\fJg~rN4#lΏ+V^jfs*vh O ++(YÏS`R|b`  $# Ӓ|!8t&7+sf Lձ́5_I7(aR:W螀T=?SBE^}tlJw苍p|rhESGܓSzTd+1%xѧUֵ9Lo_<_"pEl>M )SJBQhNlgusMj#^5Rkb&gk3i2\wt}wQ(k.Wq(!kx(BP *i9b}2ӌ1=Xy`yQv̦rAH/i<\)ͽ$ \^kVPN'$Bkjzer7}[zG|W_HQ>h"hP]]Skk8$\azQ"iTvzX)3aߍ|endstream endobj -1701 0 obj<>/XObject<<>>>>/Annots 986 0 R>>endobj -1702 0 obj<>stream +1686 0 obj<>/XObject<<>>>>>>endobj +1687 0 obj<>stream +xW_S0їzNZ=gDZі+> 釿@RH N.dw??`ٹOk3RF#o7#ːEq ȯ\@>9е!W"6{{B ,hҽrTP'7S70HƲ)'JM[G76r&ctiFk[ȱTt [L.G+‡gOpOaJK tR}clpg۳*Xu )`/S8Lj۟Gt\?h?~B+zG +~E8_W@ڞ K ϫ'–g.+'Wq_2࿈!=SCYMըWא޳XPߒ%9h:1qM^h+hW QmFҬecؙNܩ=k_n_K-UTIj7VYT—RrL[TnJUKoz],pue"4jFjqN+Т]J>&ocx +iJC_5ܲ:藜պ%MY&('m`LDMuB,Om:zˠ[%eʖ5= 0[18a W|ϼ0yBÀ% V0a>IK7t緍q5Q(8)j` Nzz3zb_Zendstream +endobj +1688 0 obj<>/XObject<<>>>>>>endobj +1689 0 obj<>stream +xW[S8~ϯ8c6-8P v&L )qyE,p,Wa2Ï#NO-]g&;ӹ?Zׁ#8>p> 'N؈|߇ ly^?-܎uq~ݛ$|iTևM !g*$)t<+sSȤHEdTJP.򂫘K%C2{uRJ#JTHbF բ@Zșs?!qc&aDԃa +$]@H$=hu$RK 8aI"BUOe4`$IXdxZ`DQ0enx?؞9\sg)56#")/,I- +(4syZK906tE+X +/J= oܚ< k 8 ے)|e,4q< M'bT 27H$\S>\},6@j] h~VK3łjzhaTF*oSA~rs]Ѣصkps{ 6[[W!(ߣBo<:ÛfL.nHW3tEXTW|=6:;ZM4.%@l|keO N[܎@e l婹b'+U\r&D+;+5q mjTXmܷWuNX;׵ko-/XfSUu7[®ARoz]LcӬo6Axn{ c65 .t:Kszc^xGr2]-?P%sc:/_ΉwAWk:1a)N~~Gַֿ`uendstream +endobj +1690 0 obj<>/XObject<<>>>>/Annots 980 0 R>>endobj +1691 0 obj<>stream xWnF}W +IEZhbRR0ȕĘ䲻K+*=|Q\ʰ-r93gΜY}R ?! S¾ߧpmjIK# ?\G۰nSFqPuҬZk 5iZ9voSukqiD!nͣ3rwտoAvR[ŋXT;6ʤ]']NOjF:q __p#p_]_M\xw7&=QQ' ]<_5N" oܒcₓkco*z$7 &ג^(gUNDgo3r4{zi6A.1++ck=>Q0F?:]rW Vȝ;2I"i*.amap10IVJ(T^M7aUZBR>JDNInHSBF"a`jcNxkCcZ8^A); mu0P!4$M(䈼A(qT !'_zW9blxY ҍHkiu"oˠ7kRGy,t ex[iA#Mav nNC(&ܒi_6fO3(ZhDeaL2}ZӧS\XHW=-ʑ-SQiieLRi,(]V  ޴Cc# uªzOR&u܀>#3YDL֍!vޠE|.~׮1a h~endstream + @fNgg Y<}DR#*a~Xtހ /}ń4ɂg\. =;:bo|55x$2hq@ v/FgjM!m\d<|ߩ zvL}y ;xVo&׿>DL֍!vޠE|.~׮1aFendstream endobj -1703 0 obj<>/XObject<>>>/Annots 995 0 R>>endobj -1704 0 obj<>stream +1692 0 obj<>/XObject<>>>/Annots 989 0 R>>endobj +1693 0 obj<>stream xWnH+ -:cn;@0HƱ$(ca_ZdSld3MɚWMj9s ҵz, Ft5:wLYQr7UIxx6uW%p/ ޺N`nɄn5}&Fӫ0aMw3?J -F77ᘺ+~qqݍ)IhzFG". -YeIU;iޝ/p0\0"e#J4T -+͓tl-kj-Y2&sdWD5QJi?Ȩdk{O4٠L0rHh'/pCdpu%J(7n_MUBmVPpjHmdDI?b2$WҶAVcҽtR8iJפs:~χхѴpyE&,ONzSBY%i))ՍB -U+0jJvtb@!:cs$m)3/2mX2$v{Dgp@DmӫܒS]}UKRf srywSo&a$jpڴp8tFqeLy<_)Ue*u65q>,N'0xhveF|r̮hmk Z?#nHcMu$ٶiX[NgC'Knʓpdf -je^iɗf U%o{7Vԯ}Ә| @C7=t|,=+pAJ/5KGT8ӕM$g$ m{aݟz}R@BhV"&"f@dҴ1Dв]AP^Vkɬ'VG/ptݱN>/XObject<>>>/Annots 998 0 R>>endobj -1706 0 obj<>stream +:cnZ 'Ad5|iMmt7%k~^5e!6 Kիҏb'4xFiu1>whz;gEMW%gid> ]Qg$xk<D)iMf0aMw7?JpgpB?{>N(IhfNG2. YeIU;i\.q0\02e#J4T ++ͣtl-j-Y2& dWDv5QJiw?Ȩdk{O4٠L0qHh'pCdQJ8ŝPntE_U>{^ڬ TK T'81eIƨҶAVc'hKNJRp^WaZjm1H$Cu*IjSf$e:*eH "t!)&,Q Wn#Y:ë*!$(v$PijMMHjm=ia茨-h Aə0up}Sh]hljT|X +#3avo{'ʌBJ}RQS!6d+~"wOZ8zৗp dۦцc]8s9,)Ñ)){_fI'TixXcT(Z P}OZ"'~Wg<:u +*m +b,Q L.߷WOx*R-puYі ZiCK OI[HsFAv Ay[5Fo$Xt:hr+vֽTޯwMG520.G,a漱3]n$ḄQ8<{\r񾈪i$oO^玓<@|JWpԚrFfb30t}T OAe ' Vy@E4=EVxåO)IN@Wr&ref5^= sKV#yFl= oqg2qP𗚄'J4,\UQIu0Tu1v<r2ɥKEQe&: d_A!G/sIJ.}|ˀg˅!x'llnE6;Z_x=^>/XObject<>>>/Annots 992 0 R>>endobj +1695 0 obj<>stream xWo8b/u#(ikvX h$"ea{Cʉ콽AmK"9of޼8Q=ň.?zјA4䇝ioHךu.6|||6b?QFA*9/`h0>VggzXO#4i8]ZĭmKUXzUƾmS" '*_n$%ʲDmunTEKK+]Xnȭe@-al.垂9_<] {~Mxnzxpn,$rMLPci^WKt4JmmT 0nt6*=X /`D'P<_VZgª8hV*u#2'%t&HpAMճKʼg;7]z9 1&շf _gW z8\6ص.Hz铙A 5k9W#-Tp{}0] `Isro0fI"LJg2Qb'yQy6x<y_Y,zJ凐Bڡ!l K;e7a6'PW2l" dqUOsDo>ojp,R_"ENFkײ e*(UnI,geŵ0&쉩`Jd>{c @@ -3677,29 +3644,31 @@ Y& B=4;19DgSv]YG^>uJ Qwdɶ1agl GNQx('N Bғ^0s$$pМPQ&`^:2o@_qEѐu g^|oQ2/~Trwcgcrk|?uϝͨL\ e qmwg`8?Lcp9@Shg;K*Y'h--XiHN -&|^*_id#^k,Xr[W#iתH"LR+6$3ۈs3>" 4˞WI?a2Y\a4( ?{q~Kx<Fh4C>{Q,ξ8(k@endstream -endobj -1707 0 obj<>/XObject<<>>>>>>endobj -1708 0 obj<>stream -xWmOFίKa p\"RA[EEm%h޻`{:򡿽5!UC${vggݛ?:b|7<Ʉ+h8ǴHO~kMѫOWt-Si67嚮 V*[{Gz墄>?(U%-5-gkw7xrL~߮]:5[?Mߊ*fiTBxReɁrK*]6Ԫ',9a 2_TQR$mlKZ9IQřdC,ݹ^qqX"R:d,vt9gxz#+f೿4 M,q!^ƹ)1OOg 8x/z< ) zk8mvOι: -i7&qZj )TtK'p"Nj-՝w r!Sj&uSo2 RkƱ^NFr˽uk9_)m478D̾Fv(>8E7zL'2#a \XБ.*jSuʝBE++ P@נoϞ MuU-U2utʁcWY3Vm\MʵlȎDO7G E$m3 e@\a.H -H^ଶ2eJI}`pcZ> fURBݑx!gAe[a34稒2rMh`=pNZlˁ -yI;[[rl6蝒 D?3;D%iimFm&Ms'kbsLҵaQ'L!j'$1t<[hk@~!я?LQG fHh -4Hz:g7b383oS7v );.lRd:L-c;ಇv"$A!0v5ES+4״k"Bo#@+Q[޾ N}@@;v-eucY=ɶ5_9s3}m٪:v'GA(%}1y^D 8kH,L+v[VɮN YD?KhpN#& )vJݍ>MW2eu$'Sg:UcD$nqg|A2eV)cЁ  mf%gRhN&=Ħ֖aP˘|9'LSHwJ}U\0!-1>B' L(X rT;4EꘃR&:sPKWUcx5S`a)yS;E] ͻ~/>ka8x5k;w'*@Ɍ9,'$7OZ{s%OJmCS/VQ )WX9<> \MD*9`?yQ5%1Φ~Ke@¦M -m,Z$b?9MNzk}h>#A :@oRA9͓_up9ǽuendstream -endobj -1709 0 obj<>/XObject<<>>>>/Annots 1001 0 R>>endobj -1710 0 obj<>stream +&|^*_id#^k,Xr[W#iתH"LR+6$3ۈs3>" 4˞WI?a2Y\a4( ?{q~Kx<Fh4C>;Ng_ 8 +k=endstream +endobj +1696 0 obj<>/XObject<<>>>>>>endobj +1697 0 obj<>stream +xWmOFίKa A"RA[EEm%h޻`{:򡿽5!UC${vggݛ?:b|7dBNi8ǴHO~kMѫOWt-Si67嚮 V*[{Gz墄>?(U%-5-gkw7xrL~߮]:5[?Mߊ*fiTBxReɁrK*]6Ԫ'</wrM)6ZOmLI!SJ\S8B,l + 2 pts~;ӳ~Θ\+S;s@$pɕ<NԖ=\m}.A!$bJmڤuPF[^j8vKrV.BtPn= rP5E71egf_)PpXb$,1 :eXAVmbPThU#xU{bepS7IJsj7C&UT|C9p*ksfUVfV a)S\km9B!?0iwk[S2gf`G9-c#Ѩmi6xMluWΡI64\#D-ē?sgⵕ7s t2`/1q)3:h 6MBOYrtgmF$wDžZʙL%\cq\wN]!!_74ƮƠctv ]]]D-~h`e2jk;Qi !TvTCPV̰.c, >ٶ:"?znc/-[UD_H:q/Fw?ڋha in*5#iS93+('c N{¤!EzN>@1ч} Jfdv:]̪"e:$5 P +MɤG2 *vO ֖zJNI0ﻊ &:ľ%Ga KZBXjvTHsQDg +1TbɴjQtF} +,l6%"y|}`k2yEv7,O!|Sd[aV>qr &l7I͓o1\ #$y%:)jV5WSoO1O~Ke@¦M +m,Z$Ob?9INzk}h>#A :@oRAϒ_up9׋{uendstream +endobj +1698 0 obj<>/XObject<<>>>>/Annots 995 0 R>>endobj +1699 0 obj<>stream xW]o6}ϯf,Ɏ2keXq Pm1H⺿~R&6`h'Ls%?e;㜦s*4Id͏{,(;'sjh:͒|xWe-V4?9E (Vr$4ɏފ“YQ^\V'Zk%yC;*I+ca$+%qgO ϒ"اKx~1t,?|N4ϲYvrN4KӿPF^,MNY~5˳fY?|q>N.* s#ltYRk}[ZGX+h3vƍJ{aZ%%-fY(> Gw$*~U#cU4#S`,Ms4c4k 4 yΏxU D3:h)sə] /Et@ZĆG{sfRhX F "P:/*wuyB l3Xiluj":ĎՃw`=A7/wgIUqq~x+gf3Sbڧ7\N8IO4?`Mn5Pyza'he%>Nq+(_T|w@y9Llf6?IG9.l"=g/{ tendstream +寸QJ ZVx,>7/wgIUqq~x+gf3Sbڧ7\N8IO4?`Mn5Pyza'he%>Nq+(_T|w@y9Llf6?IG9.l"󳗋s䇰endstream endobj -1711 0 obj<>/XObject<>>>>>endobj -1712 0 obj<>stream +1700 0 obj<>/XObject<>>>>>endobj +1701 0 obj<>stream xXko_1.I˯qR^dIh7IaߛM?PE3$f[X$"53̌ϣ>ӧ ǔy:O~:pqT/_66 ao t0bQG4_ K{c"-̋I; AOyz6|~};|w{IE-iO+I{?##K)u,`9ķIUup[[ӵKad0Eݏ 0UY'EAz +S)5my&at]^Sz]d$N2uUsPV,IeO+VH92Q ܨjeئQOKGR 38K8;Ԗ˻@ >Fs0I'۝#G&^[7 A ymT%̶r{;Z)dumr o~Q,x+  2 6|IRXʤ/k(-e2^_Tn GSO ~Uh|zFW3S igǁUQ2P&xҕ.zM„D*', uV(ԄKo= NƔQKi9 5 lEaWY,̉NƷ~1򷩮>@sۯ]9(û+OYpP`!"di&CЏw;K&5h)_; GX~b(aд>'3!d% -~q~ Xaho{:?{3yڛ i|>N ̮|bz^avW:=>QJ?sJUʠAkzX6s6藣rH1endstream -endobj -1713 0 obj<>/XObject<<>>>>>>endobj -1714 0 obj<>stream -xXob*Jdvc5ΩKIwrײ͐+%DΏ7o hDgoDcL)-g4L%Jf~49F4_%33}h5mMzC斚~pZ/7w'*+Z\{ZUsGM0itmf -(+ckn HԨZg{81U-MMf?Vnˡ%gOp!LYSwTDHr&_c*V?y zd4_#WWXjR{X_#-f)LjI(Sz]+KRU8Fy@'I')YW -[U#{]{|+RG*ZkR VkUe'" ʤt*VR)-k#{+KiS͒)m7&>Pw!.klͰu+;|R0w!;_gC8]ҚX??d(6ɚdAVLQᅏ54I]uS鞔^RYi뀢P*Ԡ \PMWCuH1 -\UMñPU,Ϥ0x4RsAht,+jPo#8'/ JԬ\^C?S|"2rwk0֍5t s'C]KgunwdEF턈&l=ǙWRNS9M-?MY+AGP0{V0!(aTG8ṙ3 ~,)b^h ls,/=Zfie-0x:;_Iьrdds2&3'ZIb;* w:PwAק5Zg*Bޅzi6cǤ2PW +.ƃԵ^W06*`tRgQ=(aCZ굱` &:2 K` -U/$:VĨ\x (]ҁ+Ps&ah_"#<3&@;rpXQg  57X0[ț)fZ|wcm@SVV-B+f<Ѷ5s4V,wsTXbB+rgNtYڍ5XQ2)9 Cdi<~R6E4̡ ьwdn7";'x1>ǽ6x~YLt~1U#DfԢ F2?M/ 3$Bh8~X[g=JPJGd @r.aǹ8ml(O@p Hu# UۍGy3#mx jp+1^[IһҤ`U Mo*xí a# EbCE+>/9YJv_"@Л>>u&HwTSh-qUs1 j^K2Y|q7lơv{%>@90:-Ml>/XObject<>>>>>endobj -1716 0 obj<>stream +~q~ Xaho{:?{3yڛ i|>N ̮|bz^avW:=>QJ?sJUʠAkzX6s6/GrH7endstream +endobj +1702 0 obj<>/XObject<<>>>>>>endobj +1703 0 obj<>stream +xXn}WT,@ ]!,%29$ۚOψb>{-mEX&rԩj~?jL)%ɰ?d?/fWsKM듛/4bg+Z!-uUgvR!u+Mw_?8]|$]gxvoeo4fWY>FW/7wg3JKKZL{Z.sGM0iMumj +(Jc+o HĨJ8)u-uE?V)nˡtH +p!)MQQwTDHնr&_c*V;y zhQ~BZ|?:>-S?~?PtT]j_0 *Q;qN03d]~ j(lrar )gl+lITvN"D +s]RoThK;B:(2Xan +K:₇kAQ,%uO6L.Oi5Yלʼ{ q68I\m+%Ь]* ɀ D8gT +| &CHZ^ +玲bB: /|lA噥6uUSt,o?GФPcWp]~^lRwJ̇e73h']-U)ݝ_*7j +SpAQxu`JLf=dY*ń#qV Z[BgQDz 8~P<Pbdilvї^,;eUyHX=$t+Pvg@/Q4m`Niʖ=pYy5!Em5^ +ShQb_tUgM*M sACu#Gb0~:❓!&Pɦ=WBBߣ%lPP{ +mΌWY#U(GvK6s*eic1#:}/S+aŇ +<>[P.}?YxẲys侸]sZV. [Q~`k +Za>k{Uƛ=^P #rs.d jO֙$ + 'ge?w[aP]ي +`ɨl;—cĐ 8 J+ }@Qb27v/Pa. RF/˸sGD?eO%߿r-'kv#ଧ^ +\I,|HV.%8w}m>JP"ahk܃`oqٹS}r(@C~ۣ‘6<Q~Z٘_$W]iR0sc7%k G`Vq⑅"foe;y%~QBo ֩ ROwX9T9!0Ex r<,ɜOkݰ|vO7Pv8-po a)~MӤ5a?|y~뒚y|sFjxLqj4?N 1endstream +endobj +1704 0 obj<>/XObject<>>>>>endobj +1705 0 obj<>stream xWkoF_` ,eKu$-#-~8GёwL6)"p Q؝]h3Zi*arqfތNWNV<ǟ6 fplE|:MrtQڋʑT$KJM$T+E* iLT!+gsEQV-3Hcq/"+]S?ۼMi<[ MzYrE6WW;Qn4O!>IPTkCJɟu PQY'U|:|-|os:hΉ$O~oX9PL6U1]5WRzZMDEۦJek9O+s ERB1Z]2>XJo/NVg*KaB*Przڐ e?,.%k=(sVR-,i5E>M٘^4ڲ8Rh}  P5`ψjH@6M,[U%,9 !XR`1J%Xwj@{;8ycu{Wʶr+c z njWڔ` RItLkq|+?M}Haput Jnvȳ SD!ƠzACxat=c +ZXϨ^DRkg-z/V Z@m:yyZ"ʝ/&+],3f>][~-׬JOCr/vsKA||l>-F`DExyR!K]&0W:FclE&}+q䀖K]Cf67WD`Vwp.//`Zz : 䓘d6_FCϗI]]xP/Ph/[٢,0>_T#U:΄QA3(koyl(Aq L@S(q$HJ'ү g8RntnE}%Nt:zw@;ja84#?ŝDG%k0H^1_b 7(0  Ԏ>N4dpػxW00ifj4V{zЙ1C@ȆaJxm]0^ǰwh9JB;z)9d5oXB.6{3 -`.ʢhҴ'̆3:85WU[^%F`\@U,ipxX0>/XObject<>>>>>endobj -1718 0 obj<>stream +1706 0 obj<>/XObject<>>>>>endobj +1707 0 obj<>stream xuU]F}W\]eW6`Q6ٮm6ZP E{=R\a[!q?ι^?Ih8}Htg xgxNmkO)ei4洔8eq-QT]Kmu%UK%Il6SPhkVOd M{jZcALaEq6EQa͚횂Ѧ[L]jNYBt#Y0]Di֫! pDYRj 1Q`t Oq;3v@LM-drmu]ݐ@uFɋ8ڶ;UV(s] >t6T/۶1baFiY4vÚNOޒ̚8:5R?x]KVys'[ut|_@Fv%XgT RQ\ YՀʚBIWtP0"QJvT@iM?m ? l:ހ7(S@ODޤ5 GR9DKFK!HWr%ѤX\]@FDqiJ'-xMU-[^r5仜En_%G*y*7b?XT~أ>/XObject<<>>>>>>endobj -1720 0 obj<>stream -xWMoFW rrP[dYvzK08n =".%(M-6l͛ד\k. \IR\.j~5[/Sk‹bx>y,.dF֩$rU5j&ɌNWuF7V>ϓ 9_,aTT>!7vS_Gق`>7*iⱥ5BDZ[m㬸,:&wY3 -Gv6%mz%W'äFRJ^ E2gpGVbY vgjgKm/apxޘR䳖/cF>Sx :m;+Lɵ솳LX]K|;BxyЯo(I얜!f6}6ՔGA+P@Th0εEks%Rm,F7k8~V0ɱƁ6?T-E-N#Bćw#ȥJKL;-tκ%'p#ȍFX4G=̰٠>(dMUѮ"GPFnv '|J,FW@g#vKW۰&u -(dmQL/uNagbbpWwXv P߶XȨ `hŸ q'~G[* C<1 -D!W\H%Qq`|w#ɉCwYL:U@I##l̓vOvqc,c1$4eL(=bu6{L|m5&y@|É81Pn*; v+ Zhcd3yqX,) EB -=>/XObject<<>>>>>>endobj -1722 0 obj<>stream -xWMsHWtq2Uc1GCZ Yb -4D3_g$Q5ݯ{}2~.V'錮/y q6lz[,|\_,ohfN'߽rPO8-Qrxh#6ζ5'rpGm,p],5}u2%[gv6M&nu (IVC&#UJY#FK5SyCv>0{1]T&[m[O8STPCʸ/3ҞM.8ĭgXWzr?8<Oi] ~v;@7ei;dQfLʴSiL 4Ζ%  MTktږ} iAk߲©rʤ*2- >٭΄ZL`[H@ZlRšQw6kmO{;$] [(@AfG8MH>E3 -r͉.u- c+daY}g]&lj:, GT|c[8>MzjПhڋWt媡Px+g+#)4edsFuR=E)7R60NX30l{*mZ:S 1D['.}y;pgA2 X(GQO]]nN7EX$e FmM2Ŝ; -TȐQPΠd`dQN8L%n2_)X`CNŶtbE;~հ=(7Q{ VBĜb z +Q$c 2CVpҝNv1P4BkU#=w+ RT. C)^O;PE$G\%s5?1fI$H60d~ \ cjRHg<Ƭn(dJ+3B uO P S*{„2VJ-A-eBGcW3,cX7b\pw s Z$DL*WFLCgᥣ"edb2pKL}g4p(@3!(JU86=SjcJ.AcCC+7(AĢ>!:, -.4ڨv?%/a"nF+'eVG58JP\REX"'oLĻo3ʢ^lNöVCA`b)RK6eņЮS v\1Bmm{R8/p7*T@}`-$eeX'^NWUƥ~q+xmZv* -:C,*3Ѝ)6 EWUx0Q8pݺbҎ> C);5()VAl00mU@j9!'/ֳD)}E&Dž fork(hZxqgJw7YtvB! C[1C7ޡӽT\=/xxb5e;=_閗WwWd~-š *φnfX뙼3O:)ǭendstream -endobj -1723 0 obj<>/XObject<<>>>>>>endobj -1724 0 obj<>stream +$0{pwi46cٱQЮɶleS~!Nļri/k-endstream +endobj +1708 0 obj<>/XObject<<>>>>>>endobj +1709 0 obj<>stream +xWMoFW zrИd[vzK08n =".%ŨM-6l͛דk!KXIZ'rJ./hË2Y_]zZaku}#L`Ow[b'kr3mmfr~\Ζ0ql&n -dpHƷJxRحmQqV\6λ#mѸn[ndR(FSa2 )%? !E  nvŪZ4Vڶ^rP5N䳖/cF!SxuvW`[hyPF"i5QĻa!օOM+4BLU܎<,K/VmMpYWj`qĝnv&޴i a͜fRq6>k1Zy4>S05XKp\2l4CkKYc;YUv/%;p)|ͶbÛ5^ ~O"vAht2~_<:5vB범GzP?4DvZ24άxtg g=ev_S!F]g7|?QB-9C8Mx}6ӔGAkP@Th0ue6hs%Rm,F跅8~8ɩƁ6?T,E-N#BZćw#ĥ*L;-tκ%'p#ȍFX4G=̰٨>(wdMUɮ"'PFnv 'è|J,FW@gv KW۰& +(]Y΀tNagb$b1i+;v,;hh[@| dcb\3-x\ !"㐫:Kר8?0}! {,tW+ ɤU`X K +d'kr1b|2&yLJ:` E G}L|4&y@|É81Pn*; v+ ZhcdթBp8lq~cht)_NwF¶,al]\YVFNJiTw G Ȱ;9b+Y15j ƄЛ7OOW ?Osi Фruq"- >y}_5endstream +endobj +1710 0 obj<>/XObject<<>>>>>>endobj +1711 0 obj<>stream +xWrH+8ı1GCZ Yb +4D3ޯ3(Țn>ft3t2~^-os?N&|pNo}0_\O`|}f byCx:uz+j +EBE)Z~-9bQl[Jyb/wٶ› 7z[_'S:]"uvr}ZF[M>R%;يuDuPispbr96vj;#%\|H +MxYi ٜQ]hTGoQ!  2J5NT 鉋gA^nYct7QSvG;MaIHBbfAij[Ӡz1Nq6:2d3(X:+YS(΄?1S[`pDW4X@мS-XN_5,d#McC71(!LUh#,tSg4=o "Zd/H:+8C P +ӎ,GɀQ2W{\MOA?$7 >d1 #)B:1ȘZԀ"1 + +:0 C])L2VJ-A-eBGcW3,cX7b\pw s Z$DL*WFLCgᥣ"edb2pKL}g4p(@3!(JU86=SjcJ.AcCC+7(AĢ>!:, +.4ڨv?#/a"nF+'eVG58JP\REX"'oLĻo3ʢ^lNöVCA`b)RK6eņЮ3 v\1Bmm{R8/p7*T@}`-$eeX'^NWUƥ~q+xmZv* +:C,*3Ѝ)6 EWUx0Q8pݺbҎ> C);5()VAl00mU@j9!'/ֳD }E&Dž fork(hZxqgBw7YtvB! C[1C7ޡT\=/xxb5e;=_閗MWwWd~-š *χoXzLޙ듿N)Ǫendstream +endobj +1712 0 obj<>/XObject<<>>>>>>endobj +1713 0 obj<>stream xX]o6}ϯK3 QlqҾ [lv Dl(Q%xޯ߹$rv($x?=~=t3(l4f4XIex1]g˓ˏoi\_`jJq4u1sIZxIh|N QmP,o$RV䞶ozTuau^Gt1& 5x %pȥ3LzH.iW9T*Yٶ}q"dV)5mFۉJVpB'ʵ57.6qDq>Q -R_(PU\8Sgn/&0*9ǘL T%|Kdd,sRe)o'jIcaQ_dveɓ ?*D|QETPNƂpi{+vqF?5 @@ -3765,50 +3747,58 @@ oR le.Z=vՃqX]_);phV>cbL/;ܢ>,X@ Z'B3sӢ:aQ"mje$>GՇ;8R7(&R `ղFܽOB9zoLpKhM\ eQ_UcU6&V)$]~ Rv.cV($<2 >c+b6}m%қA[mSۄ^@]Ia&7 r]CC@C18$k$xP%&wni#Bqzh"ƀ OcB Ud>ap†]#1\ p SKÁ`YPբ[<b!{rBwކ(~E$~ݱ]A2s^UyҬ@EݴF"Ÿ YiDz:F:Ga;҄%E)bDh̑1yXW0Pg:#8=-~8ojp9?#~cc 2vzz04a?lrO?K*ast7^pk) VA tj`i!i;$D~t=cPd4q 1H!k 7Fc,JS`Eyהּӌu^e!B}.cSm@Cyӎ4+~˃8<(ƪe6k(  vҩqNqnFr]V@1D6p_}հ -9 xϜ\>h *#J5-^6´ZXj ּF/ae*rؼM }v'/Q3p1{vҠZO+ b8m/{I['lphAp8|xͮowqݛ7tc݁e/m6"8͟'j!endstream -endobj -1725 0 obj<>/XObject<<>>>>/Annots 1004 0 R>>endobj -1726 0 obj<>stream -xXQS7~W[ ؀!o%ФMBgCf:Iw#aξ208N~|1~Ft> qqLg'#|^s`h./NN^Gb ^wgMNqhM㓋b}XNI~ѻSh:sj9u34DjTOR5;S S ),[>d]c\/_A5~G'oٖHl.D^I׏7SM6*^lW~}lXri{ I-uPlmf`k6tk+DyZ*rQ. [4YKLE=2)6jC@AݩIq -8һ]16 -jݧN 'cAaG@Y!iʣ }4٧d,t=R(,`'cNAwɞ I2҆EUsNJ]W!Rje`FJ -/ x¬/|FbԈi}ٲ%]b>+["DհBYA_$}`5]Bs6Y3E F"jH1,&&CмBTa5b7^' Y%PxT`(-Xe*}Lw&7I@.Q&mύsncA7R]^E3^)BHdWl%*D׭Rv D+p{PuWYc 6hj[|69,ؿ`7+fnD9`VؘфW;Ԥ"y!D+?4Ig/q^[4G1S}pPwЩl5E@|w,DsB5L!/M55zF㟔q]"쫇VIA%( dGN6.qr)FYba F+/("ǵͭ]Ʀ+!GQ1nk/\,er": 0B@d#7g;I<0' dئeJX W.::PNLsJG=UAmXlx,ٜukn"k +D 2vCI/Ά4ucl$qY8I'džm34 Bf5!p8ڈdr)ɸMeQkK@ y¬tum'a -CMmtۦѤo0CU747\Ш?p&C8_:1KtjŃ 8@+ҹ>M?uDc$ ]ZM,Ζ~͆`q$u˺J$18@`F6ПֵO4O(p95z7w+K\N'tV8@ 8-WP7$1h 9nݕ0 E+7V^\@]^Qv0hݽ՗f᎚M{rq}̢Txj@.1$A0cC]7+XM7&M].Kh88"UBZ}=_C0{xo8>/XObject<<>>>>/Annots 1007 0 R>>endobj -1728 0 obj<>stream -xXMs6WlOQf$˖q8vur$!5 iUo$M1N;ؖ,v߾}sߜ Z().fьfъ.7kRӎ巋u4r-l]7rz˫h_}jmXE*{X^:bz{I9mwvY6PfMFx2)ұ4UImU t:̳wdvtr5) U{c2]RjY7@EL$u\@Bޯ[˜4X ||)f|a+%{0Aϔg hLjM~z| UzБfȥ.9gKû]Geb{e1( -N-aף*Xv}bj-ǀ<H29Ora/-bͯi"WU6)%3jR$lT%̾\ ! 8>.Kd!A9OqK>t~ erfi3"G/:1X%OTESAQZqAJ+O$?JҾH })b*ɧa -U;E&p=% - dC1QFcN K?1 d7VNQYQiԿjHx,*½bͳ@R{ ѣ}}t!}p!cJ7V+.jDG @ӹBE֡;|RH|{#y~{rXAG=$qjEn0v?$},]U8ccT}J҅R=I{Q,;`D,"\~1Hgh"' QR;C8Zd5@ ;;@7uGV5t]&`CZč~ ,4.΍MnVA "njQ9?84輰ѾLEzJlR$4nƅICv{w%=f!|t$(ӐVv^BFl_rΠqVì%T"@^;tˈn>(o [G=:*h&p.gzە̢d+]ͅkb&ܪ -@O0 :ɓL݁7x< 'd\ ۮ,a蓆rM.'u\uu wG+U&$Nz @N'nԖP0BjEjk&_BULZ9^( cVqw:fǾghGʇ[c ϱFKdƃ{#f|v>T^m@R13IF>`pw nܡAd9!,?\[M6 yu䁤ULa`j.rV%H -vU3}9;I盜)˓mD } G7k.hӚ&R2m]!aP^M&o61]?bkF)(<4'.<0ICfT<Hd+?@wTЗ;Ѡ-y +F9o01 ei[v>2S0v<IJ*dKQx3Rs郗g3^H ^aMA[yH1Ȣ`Wٸڳ 8_eTäG -,iڄwa C$z"{7iLֳk~q D>a{ſ qendstream -endobj -1729 0 obj<>/XObject<<>>>>/Annots 1014 0 R>>endobj -1730 0 obj<>stream -xW]o6}@1eɎۀt]>@I͆=R`?~Öx] -u.()ple3)\:ϯ5?#v i>l^~7fs64X d)O -nG^4q[,cOz9JN5]rF,Fًܓ= OZ5}K~9@L$u_~'TOE0 b%/0,(y2T.Wc`RSGfP.V*uT. ۛoDb$J\%7?0fp+tk e߈-tO0IgXCf:}dFlZ(+cj(z*gj+BU(Jo+P0Hagyv vɐ]1g4lneWپ8#ؙ!oøEjw@/4%gh<Wxch0~H\7c#41z#  O Aq2 ==r*HM)H#BX:1SZ&;r@ Z)+M,1ݫZXG ,;i\ -5b*VXzi\{la8W^[͟ ĽvslrKRJF Rj԰?VJ\ VtGUlčP~`3ulXIBbF5<‹؛On| 0 QZ3% :zF6*It:̽,)"9ĈɐC(ykT:\ W %_5  /ǎl/^x`r5oO -KaI§|eizM,GPGdendstream -endobj -1731 0 obj<>/XObject<<>>>>/Annots 1025 0 R>>endobj -1732 0 obj<>stream +9 xϜ\>h *#J5-^6´ZXj ּF/ae*rؼM }v'/Q3p1{vҠZO+ b8m/{I['lphAp8|xͮowqݛ7tc݁e/m6"8b?/O~?jendstream +endobj +1714 0 obj<>/XObject<<>>>>/Annots 998 0 R>>endobj +1715 0 obj<>stream +xXQS7~W[ CJIi&Їtl $G՝208N~|1~Ft6)qqL'#|N9o0''K/ƣi1~/F Zu*"FI1z;;z7шf x;=?iVZ7NSMfeHt-UcZ945²q>@5&,TieTc^ptfmiqB䅞}x7mlL]le#6`yf*Wq7M1RY 6j^ VaKW; L`OL4rp*z*W-ذC;R [Խ!X!m{ѝ:PƑ- iuV[>-lt2L8<;z +LSU]>-| `/ BdE<s +L5H6/ZsHUz̌Vv8ou ~6eجTC-#4RZVxof}20 +ykf _#àT(rf(`Qq{7pg,cRv9E:٤.O/Қ_[Hd٣h6f\dO @ +2 +±#Kڵ2e)5bk_CIy#VHAA.Q5,{Pe) h8-+칾 hNQ1k~R62HD)ؤsY~!W +@"f]Xl뤁8+Vvb*X>ʢVW + 9PE 6ih%5ڤq.{,ZJK٫Hw~ E`vCI,~Z󊍲VE"3۝<@ +0Aa(1}.R\s/b.s*r}ÆMmELfr,l56 +3O4<6)f|-gHj1 +MFY.ih&d6y)0c,+,P 5Wh+SiyMS'ec\Dj@(a=lm?DdZg .eY2Q \JxXgxB q-rskרJ``Tb̅K):C\ /NIB-30i2uCf&x I(Y'i9ntsu)u ң6+ @6>uDc$ ]ZM,V~Æ`q$u˺J$18@`F6Пֵ4(p93z7w+ \N'tZ8@ 8-WP7$1[h nݕ0 E+7V^\@ܽ L`&{/w tK53F*e[ +H=\bHBՃ`n"m *oL wqp~By&;8^ `pxv LOǘyh‡:k_|endstream +endobj +1716 0 obj<>/XObject<<>>>>/Annots 1001 0 R>>endobj +1717 0 obj<>stream +xXMs8WTIԗ-ٵ-'Rr$!cAT*eׯ_7ŒJEe-~^i Mzbݴr~1˫h;\|f]WzփUpן=mt9KzKTBY.2ʔXkKMi ++Hѻo:]UD۪4;:uR=%jR@HYWex8;}bA ( h.5c5;aM*޳7 ԸG|nVd'> ++lŧ-R\}0ȒKCgJ4+S"Zyރ}>0tLR?Μ¥]C`>B #12T'뎰x{QhTXW,{Ո>F|cO\S l$L{T}'9p lu-oh&,7U6)%3iS$lT%͡\ ! 8>.Kd!Q9O/yG}əX(Ąb Fָ-50 a˭8/ A2ʌgwf.ĥ* *uݡ[FtAxc>rWD3E 0pq8plm/gUXk.\3VWzbit~׹EwHg_tܾT\o8![Ju-p` C45 nr9ar~hXEm}>R]!qcpb={ȅy:U+V[bҢ/qb@Y ~]uG۾#6==\=c[>P>0@|x5Z&3 F̝K50㳣xxwQԦLlԚ$Ec.qʠ|儰pmUؾ^X0UI,]K(6f^rw tn79S('ۄPRnon &g]UGͤdB i'ݛL<]b~2RP2cyh(A'k)N\xaLgrL8y AcV A<+o,1A-;(G@Wr,#Na>b">6w|ea>/XObject<<>>>>/Annots 1008 0 R>>endobj +1719 0 obj<>stream +xW]o6}@1eɎۀt]<@I͆=R`?~Öx] -u.()ple3)\:ϯ5?#v i>l^~?fs64X dR6܎2kia4KYrir+Xw²g/_pO24@䊕\°ģSͻ8v\)IM)!قB\K [Ppn?Oixq[(]rX˜Э4{J}#ڎwR kx=$a !-o;y] ,k`p9PRUVl +WQ/Vda2Ur,;.%C ~vǜӰyZ]f@cg &BM\~BT`.\⍡`vk"IHpH04?:4{wx̞a~g[p'ESfGg^@1 ٵ6NDWxQBT(z  +[po$5$Ci[/j7XKؑC2Ϯ*Øds/N~6Ez>M +D؇y5vF+Nw' gPs,#٣{D#J=PZp~GUU~XV|7aZuTJvWՅZb&]lA݉/8U:'ڻ?%N,ο${VFlY; +nFȔWa;GsܜŨv ʵP8% +3x6)ĸpnx#0X8< Q\ugry-ĚKmP{=:r{@Я &eDGGa8b%lidjt8E+}\T r8 ѕÍ@+Sۏըa!|.(鎰cو:鱅gK0$ذh:TŌbUukx>\|| 0 QZ3% :zF6*It:̽,)"9ĈɐC(ykT:\ W %_5 /ǎl/^x`r5oO +KaI§|ei _FP)aendstream +endobj +1720 0 obj<>/XObject<<>>>>/Annots 1019 0 R>>endobj +1721 0 obj<>stream xVko6_qעŲ؎`&)2M( -ѶRTI)KR$.8`H1~t b~ 9bD 4DP]X ֆ{&i8ESxM[Lͺ0K>x$>hʡ%7na`p)Hv2ŗ,JZ晥?TkJܗ6R䊖F7}=Gp7z\s^oDߝW( &RQZ^Pk K~% =o?ݙTxAvԢ EA{ZRRf2|AJnh%p54~~݅eUZJ2Mـ@@ՃWWya/9̅]) \jR3D"N;wqNA.4p&[K aWؼ\\-)euR|A]ӝ#Zޏ~zty{[gS`@qэO ^ۖk<+sDus ڳL%QHowP!/RZ0p|D7ta=uү9kNE1`߹?w2s10VZCy:ٕn^0@^.ۓyuvkjyL=oT. eBP G>ik_|mizn 9# -vYx.rNMM^!u2s;t}i@lY*ڏѼЙ敶6d}/\ SEnlLxO{enRt}w&虇ۂl5>2J"[@Vi7a:-u& 9\!'LwYiyQ[ke p1HW07Uuȁ '_STSe[KG'`и{L"4)RsNqnH+Iߺ8gL.4,('+,1nKpa-6hayR+rp2A hLB!(A,1lȪmp>/XObject<<>>>>>>endobj -1734 0 obj<>stream +1722 0 obj<>/XObject<<>>>>>>endobj +1723 0 obj<>stream xVmoFίHp:1BN:UIwQ/nJeװá@JU<@?\u7(u}o⿤nÚ?5  G (@5'uZA}"z+B5F!vw`4LL*ݴ'!@,284x7R(iš9EWD-4)hoxw݁7F9DK -RH TB|'BfD3!"ΝmژX_ @@ -3818,184 +3808,185 @@ I 1g !q!sΑHv$BFLA5Q/-8q21K2gJrSmj_ҍgjN#Uiv8: | mNs Ÿ4Z494c]0sFW@m!q\rB3(+)Vn z9 {Ts,C [&CSڎ9waD\&tӍƮ)rߪLMe|k~{(~yx}=^.Tus  -">EUsSfPG4|>/XObject<<>>>>>>endobj -1736 0 obj<>stream -xVmo6_6g^*ncH"l%b#H ))s(+b6"^;=σ>FHˁ;l~lӧbXNw95iDs}q:Abi.ONsۺWo'?aɄt V{<} --4wT^!+O+um]ooYaU |3iU%șcؗ9LD3wFnBIŕP%7Xf5M 'өnk:ULtRzV|]kԊȱe-,s:S74h:v)ATnVmj)jyBDgi8,};~"׽lkNn{dΝGp_Y?Pw>5z^b8&C>/XObject<<>>>>>>endobj -1738 0 obj<>stream -xV]o6}Hlʲmdi=dÀ-6cTI*Flζt8"׹ܫϝIi:ф3`G=Mw|e8HS6>>w&3| ng/o)n7.NWT kEϵ4"6dydy>/XObject<<>>>>>>endobj -1740 0 obj<>stream -xXn8}W /ȗN@Rt E?(hPKRu{mYQAvΙٔ&͌攗glBUvM׷7_'iufq6~wM)-V82EAx|2E>Z9[RXK:_|ey?Q̃uuF6UfLy?RZ_Jۍ6AYCvE5\EXMLrz˼r*TڢgPY_]Mi+Pvcde'C~Z8ٞ$`Pt -I+:߬#!gsW 7r)Z -z| x}M>L٫*ɦL}I\TN3ROPV.Fb,CaeEEfVz26 -#kad}| -W]_Svi]7UX^N~܂AMb|3H ~o*w .[gN[NP乭L8Ѯ4E^~ - ^?0ŀCSFNV^dZJ" qJM=l+Ni  -id -ҕJ?CR H"LAIa2stpi`^=N,h(BJN$b}WȊ shLEF63{G>g@^rK'ȸ)q/8a6JA% 禟 u;L=lݔkImK[iF:]_Ăm$4ԘJ'*h-qs-7UTcj̊l3,- hN7 -n΄tmN%y-Hl!'iֲPv㞋ׁ%G&(Cmh_JPC@m/95x=}t .Uɴ]/o&X Q{{7=}fW3|ήg Hx;oendstream -endobj -1741 0 obj<>/XObject<<>>>>>>endobj -1742 0 obj<>stream -xWێH}+J!4[FBQfZi%QnCGvӗLo1dFca}ԩtB/ЬxDW U00U[V1 )Q9ɞ<-jpSN[}FQӃ $1LٱïR$2M%DKYZ@Fb#maZmdƿV7XUYžXXƄkڢ9 I}aK9* mа{b0>e++k2Tt2ɳ\j1؅R21C@tyD޼[I Gf~a񦽻}|vg`ݣ;g=,Nkc0ѡN[p:zp7ɇ7֡ KNdWREK~4c9^ϫ[fc7cv^?n{ 9J!*#i\*Sdjp^ś1/{VP)͜nVô<܄C<*3r~J~flOOjCy>if>Z xsKcUο(Kendstream -endobj -1743 0 obj<>/XObject<<>>>>>>endobj -1744 0 obj<>stream -xVn6|W`|-4M.ڇ-Q2w%RKRw%ʼnZ`m2gf =Ŕf1%`bGS/x=ů"ZZ?ntI 9%^1mn>4r}ɕ&Q+EADQ#'*Z_*Q>}ۋșhB2esM66 -;nNwܯ=IL|ڟIRcol`vNIC4fHΐHS蝡BiI"%J{J o ғU(-#9(Sjm!䆤]C.j9/ܛ=d뼰V rʕQb~gM] -D8˛3}A\>!&ټ?8OT>D |" -@A;-0,U¡gi7B{I;SI )%j{o93lQ/ي?YB80'o6خW\Ңi`ҝ~P/ * Xo"K -"E Nv-(|Nʯiu{`PeQ]]q^е*H=?u30,W0rLӝIB6;Ĩp,A>~n_Qbzi=:56i:\D g/Cևq`xPq=& R4Ԯ.riW݂`RY ~d9+(];p0*`Դ=8g,SI]`D3O<^-`sF- ám\c<% Η-mb+jQg - _a]66ph1%[̾ ā<_XhAL  rfUǃ*ј)]疡vPXα*+~旒JI,&_a9p&4\DtmtRpo iځո 8:;QtZ.ZSY%;XLᚘN̂(>ag8)J3˜]̎adhh4nžX |$;Sf1"( Qeb/#[vA& 0ZzfY;e1/xE|%K7&K8a薻vۇ1?-2/xtӘO1~Mendstream -endobj -1745 0 obj<>/XObject<<>>>>>>endobj -1746 0 obj<>stream -xWQOH~Wx)H7(W rR鴱^]߮4!1<*Jpo'S¿)-f4>Jz>Onv3xM|qsӓ˯hvEiP7[JsB+\ξi"ǺnsZy ƮX -^_2](kdJ3<6MF[r5M#ErÏ<'ۭ?94Y 5v-MVRVm@L2TJc(`!]Lcp*u*i pPZeζ-UK -z TJnlKk2-QnM [ rֵ(%\<Ry|hpU* (ydE -.Dw'= }q0Ϋ8<{I*JkˍweTq՚Y;ȇ e]:䚥~C|+ R'!/_6VC sĴg=_.>~ qv|2u (Be^WuBY'|<"B2tkԔ\'t? ֠+))d-1(s ^eEg3@ -S-/E?σ}i%]>%ʠ3waME&u$1JvF5KjL㊇z_5zXȗu KYP=DջS#R -T>҂n{蓢l젽ky= *Tf*b0{D;SmU.Cv*8x 5\8'*Ufr4}|99Oَ _vnjxZUk@{!%crWs+f<1!V@mmImXcGLz}0jbE 4:$T&PeNjeᭆ y&";̎8HRwQ-vv4g+h:Pݹ3M%(r^"=?} ۅoũ#(ʲ#~)=(>fV 1㣂i^wΎ -Ju2JZ#&[j=tWr |\xR轅Wԟ# Jm'wZuY^sr La@$G/ ,ezzq(.(|${.' "2>9^A 1%èMh1Yq~HZ*ayG{Y|L]pE{2D2:l| -䝌QZ'gd91UD׊Td:ZcچON {}g)HΆ{On} 8YY0p}+>`m)j+cxXtՐ9%H –ų zЭfKI2q+Z\謐7GbNQyX;pyvfӿT`KaN4!itMW:n˯RO|Znx18L_'3endstream -endobj -1747 0 obj<>/XObject<<>>>>>>endobj -1748 0 obj<>stream -xWr6|Wx:S{F-ɖN!M$XTidd vft3Zi::Oiq9Otq99M|p74[ѦV˫mr6NfdЃi+mٵ֧oxfXMd'O -[ʭ-{vkF]YTmRW)Դ7eI;]6b;jʞM@ƽ\ݖ1R?lAsT9ޖRm[mU+{gsn)uv:)Fխ'Zs2iyQ#REǰ6M2`MA#ƌ'veNIAj-/ kժ‡g_?++U-5p>*ǯExln|S(zճ2;G \C~jm\ -("SxTةP̶*xivu{Ϫ4y~poϺU*Eenֵش8>P'x!ɹau^:@jm*>,u/`9735{rvZUz)+ s:a]mh,'-i4Q4A̡ sy-ͰbxȊ*-B9jRӶ4T4/(fEyO>aMP|T&y–@ ri3H~!B4 -v?쏇y M9V9=ix:/?x^ ak-٣URTyXԍZ"Ass!aO -~@O0j8+ zpZ:c S0>gFp0XB,pT?{;xKrqQD"FFkM\ea9$hM:.Aח؅P-Pp?^~wky=*)1ƛX[ُ'l\ڮ/% -@QD0]c+R]$2 AH*hbO;ڲr#wx-jAs~-?f]3}U/_7G Zendstream -endobj -1749 0 obj<>/XObject<<>>>>>>endobj -1750 0 obj<>stream -xXn6}W[쬓 @m}1Pms#(^dYRȴHr04_L#O(ٜ̞N>^Q|NOKL.1Hi CzJzEtwji()1dE.KZzgT.糧vNq Fֻ~w2$(ћmQʔR'Wy)TR7UVm&i_V[Ika2;eɇij,DFRXi}˵Tb JZafP&E!O"OQl22k7*'7D!tp iX@ar:ĥZUf4D޵΍Je'ֿT[Ke<<>s3gat컏~M׏[XIasXAo)@x[Ovi:o1|G?3~4:pPU~CV/kc1Qg |6i%רK4qs_uϱ+ |ZaoHSoekKCڝ bJ&Nsy/ӨO3Q-^ ,C/z 6SK0/DGW ⠱'`/a:'rt=1ԾhjL]$33gӭut}(ȺI LuHe^]- H -*YDw; 1aލޠaTqd_NALg5TRZMͶe36 ڒE㹞\T4,Tr#}rٮ]SÓZ3تmd)T9k9ɹ:+NfS?g, eK3k1C2e42?x芥~}:oendstream -endobj -1751 0 obj<>/XObject<<>>>>>>endobj -1752 0 obj<>stream -xW[OF~ϯ8P%^_hHUB/HȗxIC\-%j-y{)HDJtRKy7 -EB[Ev[¿]冞t^jƥ"#6KS\V дU^(TAqZjgݭ^c;azGxÛt -=BcZaTo:Ekk4Vzgp-GCzER46[&\R0BHun,rRqHSxKn.€#j~{,W=qbNs."iN\~ f?xLȃQXʌ` qtセ3NtHm0D~.T<i"X^Βl&3MeF?wRӢ(S>*+bLW(RMM-y7.&,yP ɹ$&$TߺΊBm\p>%ʞ8ѕH³n5ZT[Mh@IW*x5ij 9ZT(p? glZyw_8endstream -endobj -1753 0 obj<>/XObject<<>>>>>>endobj -1754 0 obj<>stream -xWnF}W he@J -0VRژU./ -4uj4o;s̙ߣf,r4f4q<9?1_%)]F7'Ǵʱdq~FlFt|(VRaRQP)+d?7zTQF(k62SoVG3(YTTO[(Jo?ԮRF@)2aIlI`S9iVi $3 7yX8-: %@,G&o0y\e.pBrJ"gB'SQAAY(!"lPI.ٶ2Z}F[ZK$Ec ^6픮hLՄm,qgV񨡚"λ$bG91ۇr -A(˨WjEghɜ)5-B~U'i*!<S=R^M mn|}?- aۊhľ0@8i'0=FTb샟b|3#NDžs -ZOzZ/h8#+Sr4Ӄ̼w7itGs("A)=-\V]}pfqSOrC>Ltľ:L[?˦ʚXd;A`/$sfU* 2ﶂAxW JKW]T]2ŽoPMK|t,:N:نlP#Nk}^ {Z`=^4[o= z[#7Jڛ$,i妎ɖPH5V j]?Ѧf- -Vj@N-bVSۙO$7hNd90HEq&BDeD>cd.·*lGv`>r-L-4=\`U"zUA7[o6ۮwJ@|a kL| =ʷ:ZלlUhN*m5՗̏UG)YaZ4d}y98VMȒ!?fV5}`X}/ ŷLDWWodS`4C=4t(k󬕎UǠ -Ϻzؿ2[HfkTJ|uX)C-W(Ik~Z{&3IX_&^Gt* m{=9o5^;|/v|q{yAT#ϿCLr.!'hq೑_lz5u#>/XObject<<>>>>>>endobj -1756 0 obj<>stream -xWnF}W "ɶl;(<4}XK Q=q`8wr̜?1oL:RZF]\H{IՇs)qezuIIF8>Q+H+I$+kjT(j]6 Q*!X/Rk,d:m+o\E*BɷވOF:ե%51^ni-L]ZԒyb鮦Z[[,xn8It:_waގbLT-cɼP2ͪHWIUڛy[HW8qZ - T[+ihѴS -ys)pƮII:ʢ&65'NTsN[jGBl )b 3ꆪrҲ>.[`+RݙW6|'aⱳ);-HkIrBs´䒋POy12z0K>f.h0+DcRLo,]_FfC2DS-Q֢2\V!jC6eA%&7kY(pjŐkJK>\ ɓчf -Whu%HǮp%x} 3Gy+ Em[~$n(89H?z{O""L+dt=ӉBeyB⻦czl!r'׮bBk!=gq+R"DNEQ2_l m6JB[Q EӐȎBtd 8rN'h8k\Q\Q0&C^^"Sǜ듶wGzIdBC Uz/ՇkCYg~/!PϏl &zYVYw"? @2}B=S%!5L6<t/,+|x~,'qo/c֐%hWB:Rl!ipt8G=Ypl@9b*y0m]QS20eK\-9Hf`|{it>͈q)pe!N1-%!&.B5 9lO9@j=*?EiJ`Y pD@V-<> `azܽ[)qiN.I&ͮήN-A]S:pN㓛Aom|PB_p,Gp8H"B2"kR1 -ېɀd;8+n}ޱ_BeDaOHs~ xvǓ`@fCK$]%czq,N=-Jxrlgӥ /Xn?Madmx:Û+o - U𯜻A0W$|z5^L|liOz}VGendstream -endobj -1757 0 obj<>/XObject<<>>>>>>endobj -1758 0 obj<>stream +">EUsSfPG4|>/XObject<<>>>>>>endobj +1725 0 obj<>stream +xVn8}WF,])`,vc!DWl$AReX˙~08BR|G &C>%êw2y>0_F4?)H1OFh^,cχdn.0||K8pv!ʸYyǏederj%nnXt#DY!Q2]E#<{AF&e9de%bE U#Y! +:i V[ͧN([jJ٨Sq=rᵞ:}u/#t:{+9u:0C=zJ$S2X!F"˒).MUVirSW #yAR5θĸ[Ҁ٭gNPU 6-D )/yK3/ 8+[NbOVYYKZ9] :jɹa rc7rC2K{8퍀, RӐD]|EI\kҨl8N<.vӚ\`RWkkLRD5/oa@9M bI2KBnjd$5'g1I`wo\w88hb!$R蘬S +3CxcvV6aڙW#8),dxcHCxw`U Ӭf]>scswpV3]7f&KP Sj1bjcU\t[+鐵:h`"Hd}Oyy^>/XObject<<>>>>>>endobj +1727 0 obj<>stream +xV]o6}HlJmdn=dÀ-6cTIFlζt8"׹ܫϝb$4pLiщYLGӉdFNt[/j<ŗ&iv?tb6AUTtIѩVX\K#2ZjC NV0').K.H9~}yl#O2YQpK&[٣ QJjEݒWkۣ6u٣FZRZ$ "jk\<|B3[?30bV~ $~~yM"$UrU +d4m{6>Wks޿? 9Ay#ܑ\Ǯ9r | u+"QTbY 3_yF[婻݌(ITȫGryYlSUF(yN :=y*FKZLBqM,+ C`RMɘ]!C +*82K1\lRˎCM靖`w+ϪJGw-q7RKU|n!YۇDM8%TB a衶@!8qE5ZL|7N$W5,[mTtu AygFKnBw(9rr Jd5Nw\y,E1kتJa7$V6B-yAn;c(־7/xrWsaEendstream +endobj +1728 0 obj<>/XObject<<>>>>>>endobj +1729 0 obj<>stream +xXn8}W /ȗN@Rt E?(hPKRu{lYQAvΙٔ&͌攗glBUvM׷7_'iufq6~wM)-V82EAx|2E>Z9[RXK:_|e2Q̃uuF6UfLy?RZ_Jۍ6AYCvE5\EXMLrz˼r*TڢgPY_]Mi+PvcN?N0hpʳ=Ip 5{UHR_qf)$=N$ O_P!HK 56oUChkzs2g&f2;'Ƿ~#sR9}J=U.BuX1; 9)Ó#(dl #-#kad}| -W!AG + mvi]ډ* /'V`n&`>7˻DK֙yn+N`+M@V/R  ^?0ŀC*n#'+/Y2%8hij$դD[D6֕Bi5  -id +ҕJ?CR H"LAid0 +X҈%2m {*E 68@ݲ Q IO sHoEFӽ#γ@^rKOUybR}4q*q/8a6joK@?M5L(rxl'|0Flu*߁Mۖ=ٍt*Ih-T͵PTQmfV`a)l)@s}ԄvR5PpCv&tkp-aw{"xFN`- a'\,182A +EoCRbU):mqi/?I% td?vrQ4"(Yk]чxCӟcMbKj>nrеAȫRa U_S*nCP<;ikIg;X8/gV>@L21xyWHÝK˻X=1ŤswB-d-f:VI94aG7n1kovnX͈?M ⟏f|!cX+@si1->=-)[}H7X01 qOʨ~A5y#89alqR{IBޛ8]j\BW^{Ogt4Q{ ^6f3m@Cg,us|Aa,%?ewkhZ_]'biy ص-6~6[7`=/JqoJQo)M6^x|>:}zkd]./o&X Qs{7=}fW3|Φo?HZ;lendstream +endobj +1730 0 obj<>/XObject<<>>>>>>endobj +1731 0 obj<>stream +xWێF}+JKioaQ&  iԴ۸Wv/;|}mf2 SN]\B!LG0 x̦xbޯ{CX'%Ma.XӁ/Hli V+m Ljd\0 a +L6VŖa.3v̀1b۬ +`2JѐHȋTs"oV7`%3Qp +T"KqJ "NP'6`,ր hJĎ,=Grqjf}A+AlO N`~(aSWWdq++bc+~X#~P TZLԷ~J7f|j] .C0dX;yT1ע9omth:\mF.M"uÊեƣRYpo51n1;7=qrMr +E!3e8_՛h^ 2wS9۬9#Y} #<@xTgĨٞZӞ"͆4H{5D3/zY-ֽܳ?{ +Kendstream +endobj +1732 0 obj<>/XObject<<>>>>>>endobj +1733 0 obj<>stream +xV]o6}@lَ-M@da@@KV"Us))NT؀&Iޏs9ALc|ǴtNI9Gc̣ ͖ Jt|-O-LƳO| FcM%^1mn>4I>JLѢ QPۑIm?~YF(ELLY*\?r="B]"kOSkG'r9p`'5Q7Ni*S3T(-Id@iVmV\z +e$6sJM-$U֔w>ܐkE;{lԖ֢ +DN2J2﬩]KTUÂgysڢ/ˇ"4d^RhΚfb6 HT* k=rڕh`TV(ahzeÅst)Yk +J&7,+ +8)5m/A+z*TRf>OuKl2ܶuK!Cph)OIec xkʣZԙe9ȴ5wWا \7tL/q 6Z5_yx|U`k +h4fFe"50slm84-0ndy+,:NQ|IYkEDF'ExjXpsY K +iL 5UKS5d,xV 0%1y/kjJ6VpM&y Gb0eV!RXU&2lTop + .g^񬼜2ܾ뫻W`g\tcna}Cr6_F yd' |~Jendstream +endobj +1734 0 obj<>/XObject<<>>>>>>endobj +1735 0 obj<>stream +xWMOH+J\` FBLXa)EZqono=yUm3*" իWL +t35eUrE< >5m2_OO.~B]R\JvTM=Moz6:w`욌:O(ӛb@4?cӄo%W쟍,h:${:SpJ@jʚPjGd%eѶ )K*t*ZNU4bNH^t1wB]R 1Xl !R*Q됰O4)_:ƶv {R{ ִKe:o)w`]R+-eLJڑZPNYϐHvP4RA.p{Sg j3D8`qWFW\陵É| 9]ըc@;N,o^OL<@_ y1?҄ +lT^K$n?t)t4dȎf[\lhj[rCU[1r9QшPh4Aoyve8vS{Bw]#Xjs)#95pv";?ݻi'`$#:dfHMe QXxʊbUCG e<6 +[ +R"y4C-'a ƭkEz +BrBj:8>#u8EiQ`G;MRu-9tڟ[8ѭ_7-^pV.޾J|u[ 6[0'|endstream +endobj +1736 0 obj<>/XObject<<>>>>>>endobj +1737 0 obj<>stream +xWr6|Wx:S{F-ɖN!M$XTidd vft3Zi::Oiq9Otq9 +o6GgiMW3miV"֦e獭O7ͰWOl[ʭv}"5l,_W*6 +Sjڛ.zVeO`_& HhӾ\ݖ1R?lAs--sw -zmmu)mq:)Fޑ9@x޸_T1 {%I\5_& p)9b̨~¸jlW줚 oɿ4\&gR*|?3 Rb}Pr\T?5b1/W=+S + Spĸ5F@PA"2Ձg xA쏝zlKa*lWc,tV{|֕R-*{p euƦőu:O1 aOΝ~9QE˪`:4F㚾 X\xUC(7~GkU2U^mCP{*Z94NQ`O~CwwcT_GuӀ1>4HBZY<6.-{kAVTqoQEȥl$Pѻi"4/Ԩ͊s$d+|ÚKL >y–@ ri5H~!B4 +F׀LF@kp{B9j uDa*)|<,FfHP ѹH't? @Fsh&5ĕaik=8Vjs1)A-0>gFp0XB,pT={طx豊Lޱ-X^ TT~>/XObject<<>>>>>>endobj +1739 0 obj<>stream +xXn6}W[Xv @m}1Pms#(^dYRȴHr04_L#O(ٜ̞NoP|AOKL0Hi CzJzetwji()1dE.KZzgT.糧vAq Fֻ~w2$(ћmQʔR'Wy)TR7UVm&i_V[Ika2;eɇij,DFRXi}˵Tb JZafP&E!O"OQl22k7*'7D!tp iX@ar:ĥZUf4D޵΍Je'ֿT[Ke<<>/n7g޻ς芏=w9u/0)Û 渱:e ۧSށ:^׃QVէ?NubAW%~foitND_־oWbwu/yAlJQYiz?' + Srԍss +uWxf"AAI" d^.l@zXx(Nkﲴ-ԘC RpϹ\3i[ r;*͡ȩɩ! !}hV֩P6HXx [wwߛIzZLBEX 52xmȴxsf[$8B_'ՋM2>ҳZgc.ҀH<㰷Z=c09̻xj!eHnuR5 %269/hm%A$h]~owa*:WJcYdʵ.T)JD`'2zQhm^a. +; +m.m]payG[Tap>@FWlԢ/ @UpkOGXFKwsí @5rpiϠ侴ɔ+*^+C/pmqTs# w)gʖ>_2yap3+T*KY)xQ^j/j^b5.qKVD&W١k֣k}=P~E 5-N1{i\w0+ f}ا^[y>/XObject<<>>>>>>endobj +1741 0 obj<>stream +xW[OF~ϯ8P%ء!V a[nKV !_%3;gظ +R6 {|s?w!F4S͖7o-`<"a0i]I\D"/Ǚ8?^~ i*)fbt7o e$RF"etRKy7DB;En;¿[喞t^jƥ"+6[ )6S}*4mt*UPm^L5'lBHoxNQ@SbO+, [hx )C;sp_?Z׆bMKpD4"]]x-"ֹu* GVև#yO2y \,€#j~{,WqaV9bPnvqyME 'o.W?Zr&0)a=ՎNt`\xwةuFVhBe*Q9SU_ĽkYC$q ت"N +`Z]B}GzE +kI@ E;%5!9גD[WY^5YYU\b07/ΧCBQ'tIYx֮}TJUT_ttrW㎦bBa8+fQے\`/^ZO:i3ohnE=*rxtق3:Dj`=_kQqW=^Olfih((g@n.>u7\3}s{,>kgr.JK-gUԾ֖f7w?o꫈Mo+UƀXb)>TFj .JܡJ +v f+V;!0NGUJ,X$8@ No[~5AsʨkˡQ%]|xNA"wAymʬauѭj 8dE4- d )eh nMa"}UXaf"򠘂U}ferXc[ǜapR(22"^is޼x1klcVU_GPW fN06=pJYW'o9Ʒ+4eԅ 0E}JJdv4eR}`8g7}7ҕU0%Ͼ2ztȟGipؗOq O,d< Fh);_~8endstream +endobj +1742 0 obj<>/XObject<<>>>>>>endobj +1743 0 obj<>stream +xWnF}W he@4J -0VRژU./ +4uj4o;s̙_f"r4f4q<[^௒֣3cZXX^:#>:*-0!TTT +dEɌ8]M#=DKH1~:49]+ sY5Sӭ +7#`Mח>^Ǜ /9R|y?8:7=MQC0XNhSxY +:G y~1>"i/n~p_xG¼{+fI/-$L^?WYc+ ܥGYɥo{mTng*mPP-J:i BVe-m{R}I/HvJP4C&MjBgvBL]d83\xPddmN#CBPsSe+u 3bN䔚rϖpIB?ɪLF4M)Ķ67>ԖgmE4b_lA jZZncjg e1O1ڙG^p9Ydx-Sǧn@=-̗OL@qvz)9bf^;y4gUٔooWwHmI.r838y'Si!&:b?PeSeMazR 2ZIw 0jn`@9֪R]hw;Ѡ_%..ma)Ʀ%Gihh|Gt'lK(za܄t'ʍh +>Xt=ְVy-@쉷GwAh%LMe E4}krSdMFA(|+ d.|h^l +RouW]Wk+MG:H_J + 'W +"8z!;Ble2u[#B;0;@ .z [t[}bmm%l鄀& +y[{Xz+N 6*4݂]5ϙwrgyb=jѤ[<n[w7!KgVGjYay.2]Z_w}CM` ЬСͳV:֡*>/XObject<<>>>>>>endobj +1745 0 obj<>stream +xWnF}W "ɶl;(<4}XK RQ=q`8wr̜?1oL:RZF]\H{IՇs)qezuIIF8>Q6+H+I$+ZT(.d Q*!X/RYtԬ$1.T4V/o g F7:ե% kcpR-LSE-,:tH_8}hJw1we9=¹[ˎGd9=l,y8D^ZK2t}AOɐMD"GYR:pZi[q\YT|eRKRC}'K +-߾p"&OF)G_ՕD#5 H;79m,|mAch P0wzГWL'zIy vGևȝ]ń>n!5C6{VE։xÝd2qeCs|?}m*0;!H +! : pNOAqր0(/aL0^ۇd?D <'l'9'm3t>ɄڱșA/^+«4z8_Cﱻ 36?t{LpSȳԳ8D~ptd;dz.-0JBjl>' sy,^XV0'~=EڭM-XON6_J4l ˕KFѮם8tRl!ipt8G=Ypl@9b*y0m]QS20eK\-9Hf`|{i>͈q)pe!N1-%!&.B5 9lOk%xs,@6z930T~ͯӨJ`Y pD@V-<> `azܽ[)qiN.I&@gWD⮩8jMwA7Ƕ >(ϯAe#8TaqM`|ZXEi!HxƀOn`5S)Fimd@xnG>[/20'aS9LvEW<Ƀ v0 g%.18R%D96؍҄,euadmx:Û+o + U𯜻A0W$|z5^L|qriOz}Mendstream +endobj +1746 0 obj<>/XObject<<>>>>>>endobj +1747 0 obj<>stream xWKoFW | X%ْ\n²H%\KZѿ7KFm.4A`ٙ1Ch<(ƠlGWJJz7>ᐂG&)1aS.꘶&Vu,tZT$E&?tiIPp{#Q*HdXו,),Fgʣsϧp썐!߻QTGŖn)-bE06~0q̥Ja؊bS}̡7i}s kz8Y6kd]+YlR)W(JvLZQZPJZ)SKkz8(PHv/E B-Q7%QY6i"T O *S=/ CI(IQ9ڧ3;ᚓmlzt5lw^/i+JȲƿYi&6o &2veؖx5WOTuZHlD_4JR܅:E3M 2a܇;({i}I" }.W ];|W eLLYt%ʪ~"绛5SBсjZHx틸[HZ<#n錮qVi6&ՠMs'N5A'O T9-UU^uo ͽ g h`菍h ԣ4gMZ1fax -;]T1%>VK+MmZWVx q:4R,QgerD+`/h3*@ih(mE,4₇9Uc&ݧrFN7wK2>4pdbV7qk|,릀-,p!e. _݆K|FtTwu2kWu['8cbVK@Һ1vvjd7#)]aYўᦲxF6%@W،Y8;gf(3n=bY/m3 3;5 ͤup}Z^/(U'`^,>/XObject<<>>>>>>endobj -1760 0 obj<>stream -xWMoFWLurѷC6FT|Y+qcrWVfR\μy^ ͆4RZ^>Mwɘ?oi#.˫h0I2eF2̒yB]%ʵZSk*ua V4+Y2U'SWj/{<+iX(,BqvKxvwTŸOJ9ާ(ϝJ_tM2֓"۔k]NUds\u3mSMk;_]SdWMr4vBݨi!|5+zՁ -?ul[}>]5֮_{pVIw8E;[3Gm Vp|Nކ! xA^qXw -~BKFc ]z]QEqɁ P
"J𮿧zWwwp!4.{XkxYmgF+c&7ew2BWɣA\ *WI.4hqm)ݔMI]6IiAErAZUuK6dU - Ib%IR|}@+$!;Wk[  -?G/逢cCWuN),ݐdB)zp=ϵH a!3 Ϩ~RDS⛵k( 1#ŨMNWe -r؆#S~dU -휱Xpe>J^ ]YjAE>n:NHx?%1ܖ V(vH6Օ9>wD&'\&`iAEv_S{r{6`+T@C)f 0ۥ6P.(ڇEU"hGBkK(qc*Fb<$"fU8|8zNV&SR^}1z"v>>!@zx6(S!O>/XObject<<>>>>>>endobj -1762 0 obj<>stream +;]T1%>VK+MmZWVx q:4R,QgerD+`/h3*@ih(mE,4₇9Uc&ݧrFN7wK2>4pdbV7qk|,릀-,p!e. _݆K|FtTwu2kWu['8cbVK@Һ1vvjd7#)]aYўᦲxF6%@W،Y8;gf(3n=bY/m3 3;5 ͤup}Z^/(U'`^,>/XObject<<>>>>>>endobj +1749 0 obj<>stream +xWnF}WL6uCl46J  +eEč]KZ,)Kk( ;!9s̅^ M4PZ^>Mfͦ<N<.>~ؚLɌROz0Mf }vUj얼*׊jGkMuTՇ7X XN \r>R{9 i]ULBih} eI:\Ƴk|BTϱ>Fɐ}TkJ٦\܆vR% lZSijz^?|"\j2vzoa9( qiwץ4J^&Ra^CEyu7T |dpV2^-uqE1s +A?#kۑ5X;`Req16;X`m jSbV`P aWDDwvi^9kЭOqۭF;!|d-当4X?HmP&:l1'3^}fҥh3A및\t}#̶شhcK̶E5VOE:Yi$vǧ Ye5n6T6×r  Éo=)O,Fiy׭8endstream +endobj +1750 0 obj<>/XObject<<>>>>>>endobj +1751 0 obj<>stream xVMo8W ri -Xd9[nrɅ(DjEj>(EaMrͼ7wSWL%JEF5w[<%Bd w×51r$t !dBI, d3x*}cmD -3bMCҝt7,ɝ&<`V4m-XmP! -Jĕ5hSGIBr\eJ/IXRŐq08iDA+i̋6G-][4g?ʑk EUImI::"#U+BYtzH8' -iҢa)=^td 뙒`YUW\ 7ܔ| !%;Qxܯ$ѩAݞP?Ĭ6N2i=l挧ZPYˬ}QvֶF ŽZvKjJ{ ʋe"(e ,I?QAs3jSUuꄨ#b2W?5J2f7jG~IOG!LJx ]5p o"$Do8 -8gpԓ*=u~d:?ZS?2<&"hC0zMM(+X:n=SsN{Q]X®apKpMSDє%mԎS@X01ES:zgfg/c [zd9=N58?Nfށi,:ŝT!@w7>oxYZ 2SC@-!^k?թeH{rXR&P۴x}Pf?}D滄9~6iS>Á`]כ]Z?h,B峟endstream -endobj -1763 0 obj<>/XObject<<>>>>>>endobj -1764 0 obj<>stream +X>A@MwaBKF""U5~P(EaMrͼ7wSWL5e" +#Z]V IEz!M6vp_|8}$9!A>Ԣ6ۂLPV*%lFOZth3aqX)Hێ|%:lԩ$emEK4(B\pf8ujq(%+IPn*l%\ GKcFipNp'^䬶=hB98$ IԵԖA)s2c :ˡ*u@硷s]Y&-֑3$`EGF) Ɵ尯K䊂:\sSn%0tlt0DVTqDAw;BIfF;9O$J=yDCe#BEYFf8Pjj+- bjd&D!j/D +oL¨F:Ɔ,?UUߩ^?"&Skq#[gaPLfPzF'bFScBcrM18C Ǜ0B3=; Jju^:4 ɺ. ,y1=\!ST5, JC7L|թ9l=(gC`0D%q{@86Yhʊ]ƶum) ,9ESzzgfg/c ;zt;=ږN5?Nfwށ,:ÝT1H:2({egjbRG.Ne:x!T&T!q +2KtBvhv5nmJ&꛵ݘdmXp^FMt[B^*?pBdzendstream +endobj +1752 0 obj<>/XObject<<>>>>>>endobj +1753 0 obj<>stream xV]o6}ϯ)q}趺lPD\JC "^ޏs=rUAd{%ɚ+<jWIyz,ݼ"m _5m+ o{RNfNE77Ԛjl{W\&\Fu7XADW4]oG+MBg1VA2hQ=eUHɐPlD?*Y2tH8^+AZ{n_{aQOwVXXdJ>$8:B#jQGE!C)рp[;4o4>\:mkhD Ռ$ ӭnetv1 -9$zaE,tsxN5J}SnfD V;hxՃjwF9=hF]z^`s'00G&t&i!c&D􉇏@}Ѯ@j0}.L |1LLyzkĻ,Axҝ5wb煗&y?'g@&<ԵV)7ȑbvnA`Rt 2^7fC_=޳|u|@,{y,,˲YNU6e؛C}@w

{TsrNV7r9ߞ~/8Gendstream +9$zaE,tsxN5J}SnfD V;hxՃjwF9=hF]z^`s'00G&t&i!c&D􉇏@}Ѯ@j0}.L |1LLyzkĻ,Axҝ5wb煗&y?'g@&<ԵV)7ȑbvnA`Rt 2^7fC_=޳|u|@,{y,,˲YNU6e؛C}@w

8.1. Installing the required packages for DebianSetup your smb.conf
8.2. Installing the required packages for RedHatSetup your /etc/krb5.conf
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.6. 8.4. Test your server setup
8.7. 8.5. Testing with smbclient
8.8. 8.6. Notes
9.1. Joining an NT Domain with Samba 3.0
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?
10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.3. Name resolution as used within MS Windows networking
10.4. How browsing functions and how to deploy stable and dependable browsing using Samba
10.5. MS Windows security options and how to configure Samba for seemless integration
10.6. Conclusions

{TsrNV7o~?8Dendstream endobj -1765 0 obj<>/XObject<<>>>>/Annots 1030 0 R>>endobj -1766 0 obj<>stream +1754 0 obj<>/XObject<<>>>>/Annots 1024 0 R>>endobj +1755 0 obj<>stream xVMo8W ziK?m6E{(PeH쨇[e ̛ u ? -S7~œK]K.K^*.l5xOJ{t7؎!"C-ہ~J^V)CmAta#sʄǐ{42kzm{ NE)|l?])L0cgbt3V#"  !EvNYhըi#muC1Dd| M?0Kik .N1"`-8zĴS?BnD"zqܨ+7TLAދ ںNnCO)ԣhv r/{ztNoG.Yys4tt^łAa֨AtnZ(e1}4ބ.r@!O5 ᖒGf`r=S*tYvgdx^^Z(XiG3x^n'ƍq>ԁN*`bxj4?gT / m5OչW;0$jq=w{X6p LCCC [l2Ȧ?Wj 3}״ykb۪bs su8OvיKERVt8xXܰ y!S+C^) %57ʶXKh -e(Az2{(A|)Xc @v݊COd7UFd.w;vW6︞hsFxbx/xe ْތFRJ'endstream -endobj -1767 0 obj<>/XObject<<>>>>/Annots 1033 0 R>>endobj -1768 0 obj<>stream -xeQr08dN[vzEEQji+v: z#cSP}2^wIfb-X\p^NG8ےU m&M=n+4-)BQ+^ gpӼpZl{Cxe<3;A<[ s }*?tmJKA1D׳a#t_x^B !A7h #mœ>/XObject<<>>>>>>endobj -1770 0 obj<>stream -xWnF}WL"hhsiI -eEĵI.D) 3sΙ>Y?KdbtqssIW'gn)_jZ <)+9ihyOF5T?~^}<]=`>obUN?9a)W'ѬçJP>#AMN閔%$T-ֵhUI*zcd먑%Ok(=9!,h<J[y7[Iޑ{DžnBԵ,C1)f dq,˯ N(cy$Y qp8R7B`௏f Mxf $?Sj[+>v -wr%ǽUO!ZYGxn,pňVYIe"*NGi3˭n$0ت7UM"ֽRđ3IO६khC3YΎx/Y $k::*C!(%g`^`z !h ; -IK> K.H1Aߐ0'?0C>.5RwQO[8׊*Pi囝Z@힃/0,`OGmTF#JeSx kdL0>wqV(71HX@|ACcp@8FpkϢpKzXx5kM$E (}1 - -`FeotO=Azބ^"Σ}<e|;AIg֗e |9 cS3"hDžYvaPOjFnKqO -u70P/6e UM,Or{1)>(os(tT[o{oNޥ>=8{iܟΨ쎧:Iٰ#.3>~rT`C^ZMqt^Ftn>/XObject<<>>>>>>endobj -1772 0 obj<>stream -xV]o6}ϯS -N6k`-J$6蒔]KuAs9\~9?S傊dMh>d __ NS%ӫy6.gX4vk匷}zsNizsvxs贽n=n>PT(R݇VT)T55pUdn[y7vhK;ˈiն;*&elT)4*0|UQmUi(ӪzpE7WڍN?r%UX֨D'޿AqN-9wyت^ HVo;5-WcvzgkS6k4^*9A~^?I;{~5U. -kɀ4rә̧d]M%4՚r;k'1hHӗQ'M) 6pj{Z2;P,ۍ &S9|U)Ͻ{Z>j 2:kݗFwX؍ zXZl0WR|8 -p _PG/V^QD;$6>ѴΣ7`ESlJ@,Rg#U)frK(Ad 2""W>wxEENZON T2:]L^D=N?J iGȮa[(&,`8o6XJu)RG -c[@I03NCွ DBK>Ά]$+)S_0Lq#_8RcѺ<Ĕ$FYC[IO׀S";T-9IMSp!0,q^"Ρ:^`YЋ$Qbp㤵 =+|&?;Ooy/)#nĴ!i#v娲^}9łUY2# ЏN&oё %B4_׭E|d*j0P\{S8m%G&ɷ0+qO7?{x\f_ҷpqBR4}!i -g\VaJjāx1Kuv`` -Ϧr!9*\J c`Ԟ ҖK1n1͸C1sSx/wqB?!a @ÇG =qmW7Hx:$dSĞ섃Wl(gq ( {q{jo>_\gW3\qy'|ɯ't $endstream -endobj -1773 0 obj<>/XObject<<>>>>>>endobj -1774 0 obj<>stream -xVMo6W |is!An( -BIōDjE*ME$q͛7*)~bZhFSZhFH6Z\z1_..7hurs~{Â☶9P6kfD)mm,gٔQg'KBjr$[K᳜2eH茴t%4֒@9VU͘ -̑tOr$\fjJxhISiAF -'&cV 1\gQ|ocJZ<;RFUR;Ʌƌ#g I+\DBpdgcS% |:j -}'p7h\B;]ةh-Лы4)hJV9[%7H4{`1Ll-"$^RMȾsdh\[*RK/+F8*񢪶"mv-ǐB{KYs A ~Poj -ۈB)4aa LJ-xU"ȳ QkY|BGC J*R~5(-:߳@-OOI"y{8]]%Dhz7zq!04gX uai.|{f _^IK'<ބRpZ|YT$t'dnǂǽS 1f1%{A/%Z9{{94ft2 $sb%t*n UBMASaK:Ku? -F9Nˈ~1;*b.A5M .5dF7Taj-wߘ\=B@Ws^`tBE}Cl{ay.\Wn*$jRdԈ>/XObject<<>>>>>>endobj +1759 0 obj<>stream +xWnF}WL"he/EK[4uZDEP/+r%Mrݥe}%7Maذȝs\ɒYUN+*EEk$mO~\M[i]/𤘾D礡~2]\y~ r ^>f#>EU jvGWnpJ,GjeFJR#[Gt.nZY?‚ศDwxP[`Yw\oK*D]2qӘm6@8͢|]pVH5 'v tx'of1 +}4HHo0O( m>/XObject<<>>>>>>endobj +1761 0 obj<>stream +xV]O8}W\Haf݁٥J#I<$qv=-%B@{Li)]lNEw0&t>ds:~JLGqNͳsf6V`TLv:4Mk5)[uڍ+녞OZxP>bzm$$exڀ;VS(D'R8ڂT`ȥ/G~(Rt`'ch-9_֔cntp M_Fۓ7t.XNFKˌnAjk76GLU<$Tne7qե^dE0n\Ѓ +`DFXktgWcF N0ub*5UNdsLObSMk>Ieܴߟ" +'~IW"fM[<@v ƿ] +/F0ayI42VH?"Uj2_;8'8A""4LY +Y,} 2_<+l_IV9C_0L#_8RcѺ<Ĕ$FYC[IϦ׀S" A$g&)IZ8l89X^?YD#DIUj̓RSGsαX%I&8imz$u +_Nۗ7bH_̏TF;QrTY6͜^Zb,}dT7ぼOHigH!GV">L25^RZ()xz|P#[ΌE𕸧Xһ=<2/8lC)>L ZKE3Q.+t0p5@K +<{:;wZSMK9ji.{K^ 0jxwiK|ϥfܡvƹAA\׸0 C H8֍$DLTvjd^d~pc2E9dbKv׫6F۸=|E[/>/XObject<<>>>>>>endobj +1763 0 obj<>stream +xVMo6W |iC v@Q J,n$R+Rq_7udoz($@ 3o޼yW3gF9-bJi4x6ܬܿXo&K'V۫46xmF@46ʒyM)ZMd)Ѿ\!Rf,L':#-I"M$PU*E3B7ZTmZЮD@a!2t,֟ŋrLIg ^j٨Jj'28PԘqN:rRxکJ!xyPICE 8{UqP W 㬶NVNw{Etݠxv6JAk/$SZ7-eiRF rZKnhTy4b,4ZFIK|N53+}:ѸU^V6Z˝q UEUmE" +[!+P>?k)TRShr@![ Dgֲ(#ҏ4-$UFjPP[tgi1_[! +Ej +0+sqѻ@PK5joe3h1C`"aiϰlAh6\ ;2FIK'<ބRpZ|YT$tf27McW 1f1%{A/%Z9thx=pMrs:9:T7*{Vʠ%̥ﺟlvUDHWr1c plzf .5dF7Taj-wߘ\=B@Ws^`tBE}Cl{ay.\Wn*$*)2ja|U0=4H=MHqQ2؎Xaڌ{D~-Z`ziY< +1tVG~OF]`ɢƁ7źF6W'(GnWB`4v`+֩`G'lТ5]˿ôMho{e P +yeΛ~ػ7 aytG5 Rɤq/xÁzz˫mXz𱟷W_iq۞endstream +endobj +1764 0 obj<>/XObject<<>>>>>>endobj +1765 0 obj<>stream xV]sF}KXA1LLZfM<"`cIܕMޯsϹw9 .4S>_1&<6/a0:~!:y ROB~t&2]4Spm# q-%wR 6N&‘Ωb/8dӱiϖ7+2 .vqu;I bx0p<[JxW9dijtNae96h-c9 @@ -4007,19 +3998,20 @@ L ̰7Q\@:$FGn<-j^~x$9O@8P"KY$`zylA&J=ϵ mخ=XR2U<7u T[#/M@6Du|<C;J)TgĺʂՎCsl <2{\F[Lxa; Jl>ᬎN3ʔSXVbHզh\/Ay4A۪Ozqqendstream +51} \گ㸹oؾ=#}9p}-9 |Ol}(q|N*xaه $]gZ:Xf92ƧH wr旲s=?9+^8zNS[p'6<|L-qsRY8ugK>y4A۪%'1N8q +endstream endobj -1777 0 obj<>/XObject<<>>>>>>endobj -1778 0 obj<>stream +1766 0 obj<>/XObject<<>>>>>>endobj +1767 0 obj<>stream xmUMSHWBjc1lr[]92F@QfF8}=X։)(i=u}WLҜn!"AYG6k*7}FqL 5KB/.mJzid۾~׊:GҾ1MI2sS5uT$lJY Ei!hQ 'ʓ%.'?X~sQXkJe}L  G$55zA u/28[8L`p=F)89,&4zp,Ftj}s^k4%4eZ>\ "8@:(ј_ aP}r!~D9ѿyf?'rL~||I} lcF}ܒp`j&  0M'хxSܛ - 8c€š4V|)Oˊǐi7%s\MJz:|7״ D6/kQ^$}e&W Q%R,~endstream + 8c€š4V|)Oˊǐi7%s\MJz:|7״ D6/kQ^$}e&W Q%{endstream endobj -1779 0 obj<>/XObject<>>>>>endobj -1780 0 obj<>stream +1768 0 obj<>/XObject<>>>>>endobj +1769 0 obj<>stream xW]s6|)YyKe;$NjPH0}Ғf&mc,BE4FƋId>sRQz>ua< E ĶmxIW>a0%>,(QlNqB7'܊U%Ea@R -MdZFgz gs>6b믺H̾ɯP6+Y0啿 [6shkJ*eWI95)Tϳ͝ўϸ\Hִny,{͋u.# OK&sy=\k-x'[֕E_mvcG_-㺄tLޣhӓ[<;ݢD+7@%t̓pqt7b7Dvf?[O;m;E _'y0:p:>tendstream +̷$ip9{ sXFo5)Tϳ͝ўϸ\Hִny,{͋u.# OK&sy=\k-x'[֕E_mvcG_-㺄tLޣhӓ[<;ݢD+7@%t̓pqt7b7Dvf?[O;m;E _'y0:p2_endstream endobj -1781 0 obj<>/XObject<>>>>>endobj -1782 0 obj<>stream +1770 0 obj<>/XObject<>>>>>endobj +1771 0 obj<>stream xW]oJ}ϯTo4IoQBVT-f7K=kmnu[EM;gΙŏOÀzץAw ?9RҾ8ϟz^g/J g~  NޝߧpÃ] h,$EI7H:[}}w qHU.H͍Hr2kI%mUa*+t,r$ fAF%ڣ{)Ld8Vq:Cb4\tz*b-(V$+Ti&=E@"U|eҐ1eҬբq\6b_JM(2I4&5 Jη>rMEF[z\}L6b\ g\Ja,V $DRUE㑒 Z`K[JU̎`7Gd]CTU ̂$%+__o~Oϣ 3._##\YRD"C &ƒsznWR۔21[إ,Uv-%'$r8J̴YW:_m\Y(\FYxvKߣ@aHHAιI[:2}ͨ'g<$# i&KP}Ub<)swjƑYK*3aP:+*<1KȱH.?}=_On.hv.|iĥji)(:J0 )u9^sm.3GCC$89>ն` |ıL͜i @@ -4041,70 +4033,76 @@ x r@/baDǡ6gϟyAueu sp剆[tK_屌^g+cPֹ*՝,7!W4W%;EY2kю_& -C)HH$qG+ɣgze۬FdVh<l]"{vK1gCȥyƳL ֿ£/+:?g ν}>JL+)VVU.PmkZ5.9y1VGI5Ǣȗ\$%>/XObject<>>>>>endobj -1784 0 obj<>stream -xV]oH}W\l*jӦjw%^&ggʿsǶBtUAuνOH1%E 0P<}~yz׏`X³Q0dJIsz=0ɘ)xOhߦ"m6'I֥Y\˄Dhz$SLJFŃ!`jnXr{'R/AGt*KdTg) [p$z8,煮Rw٧^8@%kΑ?JJzeC. F0՗% -2J嶔d2y$-7HTtc;ZoQ++'HZ 8.NtMIS#II 8]B&WɖiTL>Q`w/LJ|aRR8eb1M u?e΅vmb 1] :wx;`ʽFfj0]P.!6 6)G63U2t\fTn7sٟ`YϷ^|Bܬ*;9a2iڂ@7v?e@aḲ"[|\B@GfwID C)l/gx#/CpVY<7aq98-J }8 -#75ߦq6|4ADj -;oǞI3_zhE=zݓi_|冋] {!9&JX?]{|Z{0 bo?7ϋfcBdXȲɛ 4Btr #1ZOq;V $nܰeRQզU_vhLzHYA|Ѩó lz{>%;PÚT<^d^c 7( hRIG$GX8ռ4xgendstream -endobj -1785 0 obj<>/XObject<<>>>>>>endobj -1786 0 obj<>stream -xWMo7WMIڵ"9rH04) -BRZ\rKr-pW- ;~pf޼fEA3,zAU{1rZf%~ܸ^.(b:?~uq 3ZmdUM0ÕŇFuI*)mNkr],Ws䳪_bJ._U2GTãUc"94T$]SàrzVQx2ITyqxA92mCR.Q4Ӟ6qJFs*s~m|h'vrD:ktF2.&eƭVYLRaDAqhjo-!ߧhjM{`Ir:|=zzuJw˩[R.iטV+$`6BNCdx N>$RmB=7I2$NF5ʠ/{z-7dm 4g"a60xW1/?9/knJ~Bc 'z7g%C&XD(ѥiQ6 NRTJ!ٔ9ҏlK87 [*;({ZP(7쪄0u,d娧4 4ͤ:)kb},7o/ ca]{)]GA3d@1A㡘RG+ɣgze۬FdVh<l]"{vK1gCȥyƳL ֿ£/+:?g ν}>JL+)VVU.PmkZ5.9y1VGI5Ǣȗ\$%>/XObject<>>>>>endobj +1773 0 obj<>stream +xVNH}W ;Wen+4 C2])/݉{=6j"d"+@ vwΩ:R?!M");?(QƣA痧7. }}XF/q/<N'ᯔ/:C +CZl<"!i]-T͆R$IPQ$T8I2QɄ*o$Y?%gL/w(!I0DyM'ϋ裿_YIfEЉq>Y2'͡9]S(Nx}TDGgg7Do񨾤,WqU*8#iAbBKȔ|mw_YY>XR!p3\t ;5%M$'%t] +aL[RfSR2@ACc4C{ar(+J,ɕVy 'r9Z'bt<>w` {)MU0] P.!6 6)G65U0t\fTn7sٟ`YϷ^|B̬+;9a2iڂ@7v?ե@a⸲"[|\B@GfwE C)t/gx#/CpVY,3ay98-J }8 +#75ߦʲq6|4ADbr;oǞq3_zhe4{x@@/Mk~=رu8r)aI86v}iѯ6s'J=}=Wgn-$y|6/02[ƚ[tZ<loNDx$9hkQFsU\.Mu;?ښ托rxp7u`H?ͫ-6_,0oOo'a%Iz@ )ˬ_F/ZmZo7{z>8E4l2ݞx԰W/YlyOԛ|Q4W`4xDZp8gW?4xdendstream +endobj +1774 0 obj<>/XObject<<>>>>>>endobj +1775 0 obj<>stream +xWMo7WMIڕ";rH04) +BRZ\rKr-pW- ;~pf޼fEA3t]|IU{1rZKM1^N?Qtq~*g V5! W%,t>;ծwyo/Ϫ~G)ݺ|Wx]PQ i"T蚒TgZƓLʻ ʑi;r1SZ5U1Uёɸ0b:jUTEƩ1iT<Zg1fHơOHE(|5}Ek'~JTm:C#׹3֒* .o^J]cZ0jpD +8^Ӄ=$B68H i~$xʐ8֤c+顷ܐ_.Arpa e6&&^ń¿vO䄳 J+v Y304)ޜ˗̶hcwHZDEۀ8ISQPn+HfSzH?*Zm/k&ތZdH6CoiẠX@ZX ) s5QOU=h:ZhIuRcE!JY.nB^~lR r@ghu/s%3_̗ܛ?/Aendstream + 8[0;r`k %ygUWV~~@Sa@[=RWe3O >>/XObject<<>>>>>>endobj -1788 0 obj<>stream +1776 0 obj<>/XObject<<>>>>>>endobj +1777 0 obj<>stream xVn8+@S -]b0]MgASF"5$sI~ƈDqιoV͖$4b|~]|P,ljhqNyN,+ڔ)mͧlGٽ -A=u- izQ*ebQ`؞J<<0%}Hucs)Ϣي7o)YVM+Ld9UrRb!|" @ٖǔl}[6M#eK4Q=!&s [ʝ]ˏ0 U$zH[gP!g8EY&n`IhF*tpP,!|G9R"[d3>=>"_q+2師, p9ϊ*[#w:mn9&Gڮ.!oIj,ˮURﴌ0]zD@0!Tj/э^p* C飘!Tہ!Q\CߺNҧ#˝ Z:\C*C$ꍥҢwۗHt+_{le=3UwE/Y/p|_e&S<2uG5NSD$5Fɠ9 !b>"J؂ +vjEj&Yz5c-EP&zAbl^yjT}3A8xh*^a "E/.FCʚCc;ش>mGPϪLؐ mx|RkpU=f+{ xZqgLROi;yDCP*>|FAЂVk,U@W1 {1~W]Gm%\T>Zc[g{6ru>{U;Q*kLg. ðM fgj6SMFSޣ jM$Dޚu%;Q/lpWzwpXоL<_uIBז"@u|]=3RaV%XO+~SzF,q |Uz_s]RDň>wQNlunO=^Ur~YhQ,;?ӣ߰Gʎl7>/XObject<<>>>>/Annots 1036 0 R>>endobj -1790 0 obj<>stream -xVn6}W e‘mQٴ٦vۍ_hHV IͶ@$phsΙ33?#Zi2 !V>xFl9=~\K.S9m$J(LJV-U%MUV{t=xЅwX^&vx8"TR4w@(rEAuDX_]|PmdMU8FPLHHвb, |/zFB #(c'#mu E&靬 -\Ԝ_D)č|Qd}P,l|ϐcNlvp2 Q!UJ`e); |Dnt .K]YOP-M { J+,HW+OQ4#t Jq)EAfG#AUi>MZtΜ\p.xad6)5YD9H3Hz0"c,ݢmƊ4[G`,r6!!9%G@pI'O78!4Cm|߷>$pġĺ6k'e HD_88%\#40,mWXcpȓTHVP+dT&ϤyuƬ>SEP)]y "K*mn`\ t ەi đ0I98h)6TVDle :ƫ5Nlw(|!@iA n+:{>ʔ43N&|y>\# p-0Ōig Ŗ-La?|澎x:4| 0~)i{QpWR4ᡴP9#-{W1tGs8-W{x))!-<Z.eb5Lϭ@?%P"y umV%9>GfR(Թ \bY'c-8P0][Ix#%\̊i|=#ѿ~^yKy$ϸ6ŭ,øܬÃs|[Xo`ߌe'W\hǬO%u^|[<̩w<{suB~]=JcKQtDӮ%JObT /4L/Uo-Nɹ/--?^S1xoOOendstream -endobj -1791 0 obj<>/XObject<<>>>>/Annots 1084 0 R>>endobj -1792 0 obj<>stream -x}nH~ut"JL L=m3lh9H5IS"P2y*]nƿ-nE3~3㗫8.OQ.Ϣvjf.O([͢7[!w8\p] A`h,b%)IE*J yJ,\2H썒Āa糩+Ma5$3i6Ӳ`BXaWS5x$D Z KkYY]MvHG,]Φ ޻*X cgaϾAGQj= kP_j}GYa X_AװZߑY5 xfYɳ. k1,vfFbfȕ"_߀aiDXa K-T!^MZ V v- -,`U2l0yNeYaxbbX y0 ]W5X껜Y0.v? ĺ5X*XU` -eRk0y++k(FYF,GV`-E3e-eX,\(mu':Wp,B'-`jj3J& -$PjFbT:Z,Fh4 PmLGZYݰC=0 5s+V 4+R`4nFbWnZ5 A`XVYp6׃@Vt|aֳPH=9 (3 $ z -Ƭ7) *zT0@0’ym,9` j 1O)JHLƔabS:߰T e ]dS0Orĩs"@8k;@ pg$A֖VSO'y׮b~2g~\Ei>yiy!d#@qNoC" N?PNrE)rr~mD@S87r޾g|ga|to֯nP֛{ٽ~/OS?5 Ͽz(wkOO)Ó:~ۢono/̉k9s -_G«j~zWJc0l{UCr&Ub]}=;v^~O܍L d|svnؖHMܧ=Hrݻ5\ѹdm`Rq'}~U7`럽)gOgvl s^I"YuݱܷZ?kvUS~rc#z9C4dݡ%jVh]C5헪~Rw52zgOUlBmgǮt/=ܽs]_m݇j6]ǦⰣ]ٗ.:|۹m#1Vb8]~.X, "h<<$S?X Ͻd$Sp٦ǝuS3gʐƟV?!xx3{p_u$}ɥ׻od\z.4]slQn6Z=x(fHE5#<cө/m^  2;V͠]Umwd9IY[}ã1b煀3]6lU&s<Aўu3bN֪ޏ(>oo& u!;!;>]NٸL$>/˖]CކeOnW~-wݼ Q` `ʶmg5 k=ֵ^.yWSU&MXxYU^v'5< /kH3\&=sE"njTK$T%L*9{.zЯG'./(w|pOm"χ_]Qendstream -endobj -1793 0 obj<>/XObject<<>>>>/Annots 1092 0 R>>endobj -1794 0 obj<>stream -xm]O0+Υ^P~@ㅉJ=#cCƟi,˚;< /Y Ď֋^N,:oˡlMWMXk<=fx,m[}I-J 1Waw?z/endstream -endobj -1795 0 obj<>/XObject<<>>>>>>endobj -1796 0 obj<>stream -x}Vao6_q>V>uIXqPesH)ũڵEK"޽{'cf)]L)NFɈe2|)"|];$I~]vEVLgsZ#;Q{i)$4֋*?Ym㶳tЫ|p/O&T$+V)./mO~'Ii/D&Iexs\S[ە#m<q/bTjSʄV;Zę^(^rZfPr2b$- SRXgmd•qBˇoɘ%S^rbGK; -Oe R}gQfe*Q%؁*yi$ǧQS޿}wg`ݘbG5BvyLmeV69?K!gl\ j1~P|`iEA`LÓ 0`@!$-SŒ -8Bxz.DEp ( fE,z_j.Nۡ>x`%*ߔMgtBb>|IucfmjO:#\q^8>/XObject<<>>>>>>endobj -1798 0 obj<>stream -xV]o6}H"َC[?l@ E$U~:ylK+}eh1YN .INS|2ޘ͒zt!kZ@ʗ8)(iJk>S*ο ]?RdiĎl ϯ 6`0x#qa'Fٛw'++|1"0ޅ;emib6|%IK*A-mNx"9p -8Q㣂$lٷ$~y(-^|Gz`j=;Y^ҋb3+ĭ`^H5۠pG{ӄ5M9Qo\8j:VNK3sBhikyriTA[kG]H"4z/11]`kHZ Q7 -U!qupOJjѷݧ՟H{i42Z=z=8 eK?%;TئIL:|K7R-/1C M~YhppGVFxiMN Ƈ\5pI޸l͠Y70H(~">JzcVX`#=!R(o>FEcCuv)8} Rx~Y4J0q' # Tn7?YѬgYaj&ux| }.gZ!ENx%P -HldRa7uhə?uZhXi'} }XQK5SkZ</IʴL]- (y*Cl6J Ć{GwB9nkGB&$P{6_-ne9h\( E;ÛޢtIaH?(wj7 gW~=<tmendstream -endobj -1799 0 obj<>/XObject<<>>>>>>endobj -1800 0 obj<>stream -xm1o0w~)S:ڎ1d$J+u6:`RG`Mʲ$wp:F8LC9͒nthI9LC]sSbC` 0p23BN.޶pFER:ۧrp_iVnCW%77`bΆa_ٶfKd)4-6(eC+Fjhi;>Χ9W`:ԃ:L͊''?cendstream -endobj -1801 0 obj<>/XObject<<>>>>/Annots 1103 0 R>>endobj -1802 0 obj<>stream +A=u- izQ*ebQ`؞J<<0%}Hucs)Ϣي7o)YVM+Ld9UrRb!|" @ٖǔl}[6M#eK4Q=!&s [ʝ]ˏ0 U$zH[gP!g8EY&n`IhF*tpP,!|G9R"[d3>=>"_q+2師, p9ϊ*[#w:mn9&Gڮ.!oIj,ˮURﴌ0]zD@0!Tj/э^p* C飘!Tہ!Q\CߺNҧ#˝ Z:\C*C$ꍥҢwۗHt+_{le=3UwE/Y/p|_e&S<2uG5NSD$5Fɠ9 !b>"J؂ +vjEj&Yz5c-EP&zAbl^yjT}3A8xh*^a "E/.FCʚCc;ش>mGPϪLؐ mx|RkpU=f+{ xZqgLROi;yDCP*>|FAЂVk,U@W1 {1~W]Gm%\T>Zc[g{6ru>{U;Q*kLg. ðM fgj6SMFSޣ jM$Dޚu%;Q/lpWzwpXоL<_uIBז"@u|]=3RaV%XO+~SzF,q |Uz_s]RDň>wQNlunO=^Ur~YhQ,;?ӣ߰Gʎl7>/XObject<<>>>>/Annots 1030 0 R>>endobj +1779 0 obj<>stream +xV[o6~8Kn4[l@5mkHU؏wH5݀!H$.~h-4SR+?e<Td6G῜x?N.%M |㷒]woh<!%Rw3Vv/J++ObCeNk\rgG z28a(O{aI HP))Fx.! %(x2E.6X^Id֩6l%q&%I*ԎriqwL t= )ﰜv{0&۩U *5np7"Z$ZG% F1t +() XVlrda{߲ŋ3{!XbɈGyaTPɪ@ZuEBIGt&+xԈ|`=b2 g@}Y+vd=%j23`n1ϐry}R;ܾK7QTdIژ~ _kgBalv%wf2}8qDФ\:h)6TVDle <ƫ5'J' >T{24}g} +_ik eqD9N&|y>\# p-0Ōig Ŗ-La?|澎x:Zj`a(nGfv_IIҶXh<̷i\q;d[^i#.Nb"]{k,[~K.S2ttٶZ\;6|>/XObject<<>>>>/Annots 1078 0 R>>endobj +1781 0 obj<>stream +x}rFs*ArodejFrHPš߯{LTm_a4__Ks_̢"Ny˳(9/˓$V(>V2.W {tQ`nFeK̄S (ũĐ.D|{\,+L5$U k%5DvL7@H%@~px;Aa BJeJ(,Rl~+HH(jWQjcpgF>NEj`o' ;Me ]i$&I9Ű-. 2{&a_a)-+k~-]$+af.#6 &ub|oh|z;O<װQViXw5wdsƁa F3 Y`C(Z 6i1#kd0 k0,O-k09c*6Z,'-fhȔ)GJo4vXa K-d!^MZ T v- J/`U2l0qNeYaxbbX75V`4 3 kw9`9t%kdP{!K,K`WVbQ,;e-&Yw)bX⼐>et𰡙" 7.7OQ*5,c`() +6[ K)Ld &펲æ{` $hi.kJl0,Ck0,C`X̉fC{'}:!H}6X`4dx5rU2 /ɂa 殮T`&+kXǫ6+u䑷0,= >&5F ŰȲF) +صmdI1PhfGbTQX%ǹa PhfF[ " İ += 5sҚ"#ʄ5X$#Z,vvhXaic:ڵKɍ>:%Jaxl cSP|bg7 @"T2f$ #$ +zY 0`c@#9*aG \;S{ RH5A`X/,k0J%A;E#:V>(SRbˡ D2rT1hƝyЖlʻ!H2(U7F RJVC'y +rV+P!ᴇ|z~BAnT.p*LJ?Ā 7p*8߳{K9#p<拥{.Y3rWe~%jֿ/vk+R;4mھxvUC4|i8r~0 Dw ;%VU}?E/onٯrG#˿l*v)6_ a5SٺwnLź{;&W~KܵD s׼uQnmxhK%s>Krݻ5\ѹhm`q'}yS7`۟)gSO'vl s^I YuݡSY{_luU];z}cDzw-'UBw I~iگUjiZO2ןNFmgk֧t/_߾u]_mj6]Ʀ⨣]ٗ.z~ٹm#0V\t~oJbDc}|~2lvUDat`M7y% {q?:vޟN}iZͶMj4ꢭ,?/5!{' K2:LqwE +a(e_edzK!AQu!NM[z_NBNq[\{x>/XObject<<>>>>/Annots 1087 0 R>>endobj +1783 0 obj<>stream +xmN@g t.]b\4-)3cH| ?<F3= 2$H%:5)q{ܑWⰯO4= H+%v=S4#e;];W΄4LYZʥT$⦜c[/dJS]J||=W#˂WWbΎ?7 FX*PTm' fM#SDhN<| +r)g;< sFaM_|~4W6N]f% ^cy=TmcG̰?SXNU+ɴZ y(+}endstream +endobj +1784 0 obj<>/XObject<<>>>>>>endobj +1785 0 obj<>stream +x}Vo6} 8vO].C,<D\$R%D"%w޽{ד! H'd@E2|#YIy0]FI2~}urFZH2i &]D奥$^lT_lpzwhOIBo%BѦwF\DQ755O]9c^pWB&ae NBiU2UJ1`# ((LoIjǿJ/i8k*O W +F ,'cLyԑ*B`B>}eI> +g{JG*,nhߛ)!&媐z.}zpq0[ș ;NQR)~qu5lp5ƈu*|,d[ab` }4SEd%e3> J4%d ^vLUؗc-_(ǐu2lkXvA~DVD! ^'فp0)u-*<)v4HE ;DX>tG`䥑NοIN}bhy^ֽKtcYPZ[ ˛C30iQgl?Ov54xdSB qMT,r$ujjlZ!G hf߶Vs.(Ng@1,JfЁ7G8O?c0'юg-k6jm|j`qnxVUXӜhӁlZ='Kp]7Vxbo;Px26j( Z*.Ej }nqNuH. ]c.ѝ%X]*v SB 5CE?őٛc˪w\۫H\I ;gm #KC _epCAZIbf`a" Nm pY*Q0fh/f +c{E-6{p;zJve{l[K/Ma\!T^'Lflb2`p0苟la_\ d:O#ܺ|8V'EFendstream +endobj +1786 0 obj<>/XObject<<>>>>>>endobj +1787 0 obj<>stream +xV]o6}H"َC[?l@ E$U~:y6KK}ebJx=J^/`6K凔i])_ )Om~p9:vۯo/Xv4Ji;޲m0<0pAf੎ąƞeoޝtz\~SNy}xt$5~Q,(f;E#c9*d:G +<*Ad:塴Pxgiz +pJ/!z%Ϭy#lFM41DpWS`ܪX9- i%GUsd+UQm)v! д뽐to Ol_F!i-DA+S L=)EwV"adh {,B$i, ~LC_Ra&e39S P9.`KĂ74QeQb! Z!F2v^ doWw5u:-LkRs%UE7f#/ (u7n~Z`!nHY|x Օy@fHhoKeeDz(ev>/XObject<<>>>>>>endobj +1789 0 obj<>stream +xm?O0wS2icĀ8USoϋBeIݻ+t$J\!)ޣf;LM%L…q49G` -`df|; +*$>I)Z`MhO0 ǩHzBl>/XObject<<>>>>/Annots 1098 0 R>>endobj +1791 0 obj<>stream xWn7}W bV]Kav+44R. %1撛%׊^=C$[ !A%93gΜ=9:4RoHY~rӰ7wc~'X7wYwÁ^ʩ?&iw }}39͗`8|Jvv%u D fA֯v5Q4޽=}t=8⦳Z9[2kP T2SK2K[+kxՄ:^?UЭȔ֭w@_%4_WKdY_M3Y>#Lh-kj=VwrK^:OʓXq>)GAsn0r-E *su (W$M2fmӋw6‘/Nr@󜼍kT %LxJT#\<вV,d`|FGv=g!\2PPKGV^oI0\4C8zժTpDLW x| m->76:BT $qEO(; |'x^~\dk#]8@na 9e)\`?$]TZ?[[1eeu2EQ p.o'$N(l9_+U2&dl6( @@ -4115,74 +4113,78 @@ x "M@#(HuA6%S{ޘbGUf&s (c i!]VO"KGHs5q U~ |\n=qrxЀa[\,G]?^>jwrOn@'H-^Uee5 Cę endstream +oƇ}8}g&|e8F ' ;endstream endobj -1803 0 obj<>/XObject<<>>>>/Annots 1112 0 R>>endobj -1804 0 obj<>stream +1792 0 obj<>/XObject<<>>>>/Annots 1107 0 R>>endobj +1793 0 obj<>stream xWo6~_qR,GɚIk0,@KV"5QbE=iU[$^LtpBi@hWϽ4,g^FQr̛~7sZE JMƚECoFjT5IRzSJ7ήöM/\4(S2htc#oF0}s~+>NH^W;bk+')tS(ծBRjjʂy- 5JFhc6(H|"Z$6vO*OD^(z|O0^4{~F:L!p{-slJMgenȵ}:tec$X'YմP_Uy󻷓Uf iSu{_c44W T*Xdt)3&09H6S^&rVOP\`.A3q{;5Z ߝvDD:m+ OP9" i㫛𕡑eC-@lŊGo=y%t?*>M$YW揯svysʑTP\OB5$!! <B6BORp]Պc TiYT6ϨMFjZ.E˚{RB)>7 -~> 5-ꝳ83օ&07c@r׶SZ+VH€OtEvݙ[WDao3eX{1/ǫ &d*t4@B6SKV@2ײxnq/AlBUm0F1 ^y:u/=ǵ'$)Vwa&[>UB !y}B#L3]w\ݬpgpd+K޳'vϱe{DHıH u0E6L;rx8yu 2^x7hX>HT{a^޿+fCVIAuEs!CYUFƌ~S&ofٝj/@m&mwWîdڴA֏;OT}qWJ _a_,iUg{ fSm^V-?˸޵>ˠhmlsw E -l21^{4 n[ܵuefh83,Ɂ/T]t}$/?/5 ~ Tʽ"eV=I(xN4ᛇޚ-1/a8\|/GIx>/XObject<<>>>>/Annots 1115 0 R>>endobj -1806 0 obj<>stream -xWn8}W R/K -Cb;Ej,(H+Rq{DȢ#\Ϝ:R4QDaz:4w0b1G :×.7yJy*x⍚WIz@.1MGNeo%I'͒ᓡ(֐)(6yҡG;⤁FF$2RYTfV$T6$YMv+U^+ί/3r,s[+Qq4w4Ǻ"Y%1;2J쥵a^3BfޙiUi Qaۆ;k<"-H2 0EhS ^n/hzng4D%J xCΊ%|i#'w")dV0dtY @ m˅T e]S6tVW< "#"W@2rf4I*vaJ>wFuu3j0~a#v15ȲH9s?M3QmCznu \Leck :Sa2fj]^:ffEh'#@)^1 dlj76Dj&@d,2uF 0u'UfW! ίj{OPLY[!tr5BYL<]PNY0sEeL |!m EpX䞭 pVCKļQQ¢ãw˸Ҥ)RLkX_Wt1lO +F:np+C\uF|X $KC#gǖnŽ?h C^8V]ٱctGG: $Wkw9 $̮(UO=D 63催oBeنi (|ڣҳX9^7lDA92uiiz*a{U՛ -gSW񛸻x[8 y&aqm9㩍ug`؎Z]xKzL˛ŗ.a*Q1;ǤOWwW1aoY|o?w.؈1 F*'c;O:+$endstream -endobj -1807 0 obj<>/XObject<<>>>>/Annots 1118 0 R>>endobj -1808 0 obj<>stream -xVr6}WEInLn=ĊX~}l+qS˺b={c5yLg3J(xג2~۟{xh2 4ϣE*h'(>vn^Mh7SME$BAeP [l۟~RTjLe#T\ T2`,+>AW81xE)pA҇DqT(u- ) -JZ5(eG sy`T\P^E"Q#gFt{}WR+w~`-[FtSi6ڼR<8^$L.~N>afcɮuzy%I5{I*ޑ<@Z+I0}{xzy -O]Cr|mUZA&^xw:IHP$LpeZ=4agiAZ(~meugzX.lj-l2'74J>( H_?@aQuxIтCKd=Ł^]a8T{x5 Ǜ%/&ujqn>9&@_v8< - 1';#W_lͦ?2 t} RӢendstream -endobj -1809 0 obj<>/XObject<<>>>>/Annots 1127 0 R>>endobj -1810 0 obj<>stream -xW]o6}KS V,q<-n@Wlb@_hXKFRw.)يbC$2u9^IL3nN%dwxfZ54WѦ{*q2|"Z NV[X.w{Mw1^\nf2'vfu>1fV d5߬1w7_joeg1g^o'7ouF ִM=6&zIC_uKNSZ~j K`?~^JDEz焪咬(wnLt.߶rgmuo"(GY躔4VN14^pnB ⽿HPcU'cOUt7u.颾8$0DJܝahM3@ۛo3:mTCUpl_L 0RHVGet%Gs ׫7Jc.d,A#d^$Lz[QXM -XLʽU%۞7 -tF;#*8ם$B@gTT:a`%*L4PˁHYs^TTe#Hg^KOgRr/H}&9(wexyk-,ES<$Tx -;C1FD$f}: Zj^k`Mʢ^Ca)}Sͼk\bF |\04؊e$Ctv9=+ b>Vvu4`\k>hgGώSP&A_|-X$EG?-S+JG*UG6 ܗ7|ZX^ᕣDYC{ώu쾗y?Us -{J (=ntĘǩ&™~DWӝ)`LM4ClJ_T4| -)|ẅ́nW}塻|?FԹJ  .R~fP/ozi2%љ(d<򂩅Ms5~N<=O&@Akyd ŲLQߐ6%hH/Dק~sU1TJ[Fd3< D@@Xmür'OH6ƢJp5?pOs0N+ We$9w^[e0'#  -5ch׿||v0Ğ)a-Gh[}[r?}b.t~K Ͻ{mvsawl'NH3endstream -endobj -1811 0 obj<>/XObject<<>>>>/Annots 1132 0 R>>endobj -1812 0 obj<>stream -xVM6:@%[-{&is(fDL$R!)oAHǛf*eS^P^-%W㿕T~^iA-eE)3|En~v*잭[Zsgy|Uhqc}jbAYF)+T!m{Iy6u¹c+N;X+$,O0?yk{Ii[xz9ǹ9#sDIE7 ?;nEjf5 &g6{A5 V -/B,G*E*-JB ;?9ے$Too]$n -]jj  -bitio',ckz7i2Epv2:M%̔0"hܣ+)#rzޛVa3_d !kr F<6 Tʉʝ+#$EMCN^+4Uiڨ"4.AeKG9Q(Aj=0  MGD; QIH USMNiajc8+D&TgΊ62tkmHrfIcCcrЙN!g8&y0y-N ;:/[Pb/]˗d/ &ipGҁLɒg:o XRm&bQ=ga"S=.;#HѮdXS<`09`no4qjAc9efC= Q9CM_9 aDrz߭e뜊b(&'d̔=?~tL'd58N:-H謘q7W^ P endstream -endobj -1813 0 obj<>/XObject<<>>>>>>endobj -1814 0 obj<>stream -xWOH_1>\#v@zZJ=N*6lw5!ٵ r Ώ7oL~d4oF)dB'Yxz_簑ѪrA`g2U>_ޮP$]ZHRyQUqwnsx %Jڙ"kk+ -45V*:)ɔt%7juT)xnF~#TE2q6KOVIG[UU@FZ7}!;/5N+̅kCk߰S6$H6#y+ DT@jB9ἴoSPDxv$t5'uA4(1Yx%_=yc m }FA\ŅaQF=!G!ݍefH - ޽&#N qD4}x;t}nBli -yj2bLY2d@0By -酪~di<Zq6LEBhIJ$$Xoq["sZ7D!xc #_996 !1Ia+LVhYy7'Syzx)GȨ+,R,j7 Z- k1`X0hU~eRZy%*+~.iiM=h@6߉,MU-'+^RB5OWGsKZlVZ-7gcn@Eۃ%wP M0(K6;M}ހ@%iǏPcx -.!(Z7vNSBcalE6 jRsPҋ~/0Hq}Q 5"G08;Lcݴ4y(!4,oP@xܼΦARdz:ŤM| /}u&XK0R%2PCapuͣny'r$}?(?_6n kk͞ "P>.>Ыwku -9l 4;B:$*V]dWo=mjYCv(>deV =0i_M#eiJ^=T7yb=-rEyf+F9v97"Y%@=G T-Ne.<ӻ_.\70=;;|ݨDɎK~)`cYYv a6ǷAxF|{yLy_/&bxL'%glσ.endstream -endobj -1815 0 obj<>/XObject<<>>>>>>endobj -1816 0 obj<>stream -xUMO1W ꡩJ3,~zt k[ wloZ$=3y3=!wv%Ty0_sAeU&݃z~CC\P,O~\]|DOpz%тVrs0{a-:4\u2:B![*HC)V jH ԍ fyIմE,ltѽ\z`; b;'4][T6r#:Znjw*;6@ QE?)N0$}4p[ {5)H 3R{Ҟ}©.LOT-ۀB F; wBJ,I$ߚp79@9q1af/] -'ydi\&Kȳ0" b<+ te$ -%ƒpl)i -?V7k/EN M?t)??4KkwAxjxzޖM)q W+n@.&M[b*c Bȼ`^R[(pcQ3EjZ hW |dm'ѦgAپ{vUCACӯ`MՅ -rPcbgyErs}r~zF"wpyX4qgۀaFӱv ̫ERG(8 -C=6;endstream -endobj -1817 0 obj<>/XObject<<>>>>/Annots 1141 0 R>>endobj -1818 0 obj<>stream +~> 5-ꝳ83օ&07c@r׶SZ+VH€OtEvݙ[WDao3eX{1/ǫ &d*t4@B6SKV@2ײxnq/AlBUm0F1 ^y:u/=ǵ'$)Vwa&[>UB !y}B#L3]w\ݬpgpd+K޳'vϱe{DHıH u0E6L;rx8yu 2^x7hX>HT{a^޿+fCVIAuEs!CYUFƌ~S&ofٝj/@m&mwWîdڴA֏;OT}qWJ _a_,iUg{ fSm^V-?˸޵>ˠhmlsw E -l21^{4 n[ܵuefh83,Ɂ/T]t}$/?/5 ~ Tʽ"eV=I(xN4ᛇޚ-1/a8\|/GIx>/XObject<<>>>>/Annots 1110 0 R>>endobj +1795 0 obj<>stream +xW]OH}W\ҬD*$B%nӕVc{L=gLȿsvUUsϽuң.O1I ?p? 'n@׭~p7ݾwQZ9 {Oqs?\#?9S%?l[IRɁs$cEdh+"J5c +tgu\[4>ȈDF* s̊&$nk%~JY2(W27%ZJsoAs,"Uc#$a ^Z:=!dF:;9^eޛήvlS>Aߓ/ق*P s]y}6IH0W4v{{>y{wpY,Vӯҟ.71?;4zĕtPƭY-D5~R۹2ize#Ah"nTʜv˜# +"۸DZXk"0+= +@o yuR1LJStk.2B~!]ӆ|Ȉe*0 #'>/TH2:?\N$d"ЅLۆfv),9C|h4pOʞH :MCT.fJf|Oc 8>dP¨N3[J +L6m2rV)ji_87xDE7pTgU2(AEp`FAH)Q7\H'zl??5 <0@SƄ4c&Y,/3x9YL)^gջ9 T*1 J8+NA܉Lld~J`SYӵd%@1Nh/B +RIvTuOEJY \.0zN \!ҌVR&j)&΀!U\H "̹79jңo,G!ۆb[>D4@ Rt*dTgպ(A&luf'Ch̘OF SP6?cp +>om LXe8Yꆍ<8a*4OүB _CckG% xes+bt1yzVtD9yW.Ft?C߹뺍3 + G)37+HG7-4G{@ qcy莎ur HrH]Q䫞zAlfY߄ʲ QUG/gsnؾ׉t-r$d52!,T Z;7Ϧf7qw·q*L& rSng`؎Z=xKzL˛ŗ.a*Q17d@s7.. ]''c R(8>^ca1WN,wu/ !endstream +endobj +1796 0 obj<>/XObject<<>>>>/Annots 1113 0 R>>endobj +1797 0 obj<>stream +xVr6}WDI.NfXv$V,LM$d{e[Zօ$vYݛ -b:SRјfgw-)Xz7'ќ8RI": Wtǎmz)M&8lAԹ&߮.sF!|^-/O6¢_r89E \F׫׫N5eҘvy=뙷3s䍸5RV;yo=TZU]!1mDQPKybPFɱ{hoWItǏf))cfغ$6R2JʤK^mJ ['mHd՝VJnVRmu9I"KUw ZY?5MoԆS_x)KZ{#ZboQDcs . +"kQ kmB#=&?#ђLZ$'=ǃ&h-ʝ8JS5Ö`).d@8}*PR7(ԔB-:9\rX6;Юm56HD*ԽDN&I@ssM5:a\Wb۾+ܓɄc@Z^lO-c٢x(<x&l[Un->-q!dsÙ`ŔTQ2ͻ"꡸F0κʓ/qbʪ$vX]SpBx]Ii)(2waRKmѨ +%RD)U7ί?F>d@oME$BAeP [l۟}RTjLe#T\ T2`,+>AW81xE)pA҇DqT(u- ) +JZ5(eG sy`T\P^E"Q#g1Ft{}WRF+w~`-[tSi6ڼR<8^$L.~N>afcɮuzy%I5{I*ޑ<@Z+I0}{xz9!9Ib~rj*A x?;nQXZ`&2 ,Ą嘘^|Oz"1_Mҫ SWGa1,P6e!6n8ee?g04۠G-J`2ںJ p|je_,P6O6^qPn%$/s ɰ:^h%x2@0M=:5@ލ87T/;[xnS 拏&sNi6sI(}bNv-.PQY4>/XObject<<>>>>/Annots 1122 0 R>>endobj +1799 0 obj<>stream +xW]o6}KS V,q<-֮@[lb@_hXKFRw.)يbC$2u9^IL3vN%dǧxfZ54W]TdӛE7\o#)ocy6)-ױČwh>Z :Zczw:Z,8<٫ h6$sQ;iVniJtYBÇW/7a87_DTN\.Ɋr+$@rm+V9F&RyKY9:HcsME*H / 5VU;2X%QH.`"]G$Zz&TA 9lbh{s8xW9&qH94^ɔ#UˊduPFW\rDQ9}|110K4B"eWlEa5+`E,U%۞7 +tF[#*8׭$B@gTT:a`%*L4PˁHYs^TTe#Hg^KOgRrk/H]:9(wexyk ,ES<$Txl ;E1FH$f}: ZjN+`Mʢ^Ca)}Wͼmv\bF |\04؊e$Ctv9=+ b>Vvu;7`k>hgGώSP&A_~-X$EG?-S+JG*U6 ܗ7|ZY^ᕃDYC{Ὕu쾗y?NUs +J (=ntĘǩ&™~DSӭ)N`LM4ClJ_T4| +)~s3zbӔVp#h-rsa1CCua:Ͻ{mfsbwm&NHendstream +endobj +1800 0 obj<>/XObject<<>>>>/Annots 1127 0 R>>endobj +1801 0 obj<>stream +xVM6:@%[vOm6ihQ @@KD"oH:IIX|yo2_F9+*ګY:jɿ5~o%U׿u*P\5tofoVu {ni1q*5v٣]0Ǎew۫em+NfYӶ !h[L&IX -;IO`%L_F3JRdQ;b%6@qXDt',=)GE:XA,-xN?1drB}lM/MhNF)p#"V{Ԝp%{DU۵ie:E6R2,pzlcL(ܙ:O2L.hd-i4]w 9ޛVxUrcTiiˋи.a `G\0p0 +6vzH6$_D%!5WM96;J Uʂ/vP5{+xsȄ)"Ծ!O#t2u' ա3@C*< l!qL `Z28)wt^LE-]֦?L=;M|nydhx0qYP?CT=`nNrx3v!߹wt +OMN Q+LNze;<)z~&N zvq,VtGBg5|{տPHendstream +endobj +1802 0 obj<>/XObject<<>>>>>>endobj +1803 0 obj<>stream +xV[o6~ϯ8kbɗ8 ]0 @Z"]J[b}QFCdthJE}4L4g?ǯSTl"NjK/ϗG'(ѲD씖Px8e1p/ʺNZlixQU01n%10ɧ阃^O{ے(nfMu$hԭmC5%]z%‰Z7*ػoJ^d4F8UE+UQ+~گRxEWk,(\=k+[ZD!AR73Q3(4K魭wu7aayvSvi?Ȗ37IxEȧe[\ ЌŠ(ґO-HਹGo:\&o%m[)gXTew2Lx @G]v*R *@jbnSZɍҵO:PXOwmSi:N?~p&y6e;Lv(ɲkHH$UA [+ +ɄP”zqdl$a[M~_\^ꜗ P˵A r҃_ )VX;D;2  r='=X#k_K+z?ݿ\O(AGqrѷXHk~EC [a8$CX[k>/XObject<<>>>>>>endobj +1805 0 obj<>stream +xWOH_1R81>Q!JN{M^wwMov$DZQ؝y͛σ) 'h@ :??#) QO4CyLӔf0i;D0Nl1KI)G?9=&k*j(km%9MNR!!a)Х%m(3MRk>7Gά8~iBЕ9 +I%ƅ,#goD.e|s2/DKJePVoCVy4|M|t} \L9%}DNDީ;)o/t\rK!d5K !5>hTG?pARÒ +,~mM[Urg⿴ sg'>$X /s+Hnkr 'n, $^q|FA3K,a!D<|L>_myňfr=*}OyD +j{X?z0j l;bW{ꝹZ^#{Ȯ`o[zl6!@Y?Z8jލ0T) @b?cbTl¼c`GaUDe0heK[nJ$]!q: lxP͔ԉwK㼩y0[9"M-;{0G5Ԃ%@(=G T! NY.=.STGs݃;)fT"y-; vSVǶe͟`_h{@p]$BFC4]E)}ךC{et.@ct +[)+V,0UWJajlή7f:]A61rz]μ}ensa{%EHS%yx:nXS%9f 8LA{fn%9ÚMvʆFx?G,e7Z?o&w<!M`_>\ҭяP(>:${;G?i/ 07}MΣ|p!_p"endstream +endobj +1806 0 obj<>/XObject<<>>>>>>endobj +1807 0 obj<>stream +xTM0WL UganTGL6Nm&~ǘt= $f޼Sg0-I%Q y9UxyiՆ EI/5$YQ%oXm+ 0 +%TOT+4lNJyޣ>GQ`w5p"4\; F Ե[%P7lgD|sBd J\Z0}FB\qoƥakNRIV:GcQx\;U)fK <0fpP]v;%/>r) uo >/XObject<<>>>>/Annots 1136 0 R>>endobj +1809 0 obj<>stream x}W]6|X(z. hI M BK+9JTI|%%O Cɜf7-7דY6Ó6fTrɖO*[ffx9ndhlM*bfX+D]mop-!S9ϗ QVs}inXˈѴ--f+fK"'կj;Zd[n;q&|P Cg.6i~(ldbZiC({OuHIJ>a<2<{ҞYwѓ9ʴ:O3z"B_tl @@ -4198,10 +4200,10 @@ F XZvbDI5tj&MW0 B3hP%^-j} ՠ`q?\4s-qXX%Ir#*H%yH^a H~WGˌޱ`6bq@ĕ l `+GB\ ֱqg G]˅ ѢfG(;# ZqAe*yJ혖QtpĴg" A4J=%>9m`lıMPV;T02[M߯E6oҫlWnMqG+lhxF/ɵR ).0=Ғ_;4md׆Q[y"Fԏ(=Cq!q()p5kg  GeuxRM%Ӏ'Y0=Uicq'|ѿ}!6%}(_\h= ؎pM+xsa}h]Ldx]Gw;8%XեJ*ByivǴU8֢,aZwN=5\]>/XObject<<>>>>>>endobj -1820 0 obj<>stream +1810 0 obj<>/XObject<<>>>>>>endobj +1811 0 obj<>stream xWn7+TbYe)Ѓڀ&M@_#.\ݵܵ}( ̼yoɌ39],)O)]^_Liq}7h*b6Ya6>N4ѪD BVV8=9]8|bZk;+GDZ&we8&R8^"wү&R<8o"MZSB7)tTܓ*ZEʴvD]qmD1ɜw|IT)RqO T@7{H*X|Jcu"vNFsA+b-R}(HQ43ɕK[P@Tq(Fܡb {ՁO4@\߹6ZT]LVy(#,gRj|.`_Lg86 @@ -4213,33 +4215,32 @@ B Ȃ>^:=&ߡɸDUCkLECȔ11jûP;@.ފʒ)} Si[X?aG02y%qjDž=E >Qf$믝tm$(ۄ] VFFUtslo ~wapZqAk^RE-oQ ]Wi|{u$Xe|%OG]C0(MrM(tQ=| ab1lN# PAqGsfz€hk[Gzu9;WzW`⯙_q8#qIGnC2yluqm`F ,j-pa&&7Ъtq#ȏ"rCC"fu2Ff+Iw@ay6|mԑeOҳWAn~E\Ԉ+xWK#Wf6Ypޣ;sU񮣑eVH#Ym~,|~+4t=GQBbEt4O?s/j7f&ljQtִ K;mn͖#} `d-_ M3'-ZaSCr# H0Zykm|ӋQYs-H1$8\!֛﮻7%~]_r_axX~醾KQgWӏgby=Y^ŮRP]y/dendstream -endobj -1821 0 obj<>/XObject<<>>>>>>endobj -1822 0 obj<>stream -xVn6}W .k ^' ػ4 >p%bM*)y3ڪ [̙3hJLlFSJˣI4EtN3=ï$u0?N?&G M(윒/U!FZG(wBOZO}zdǰFk6m邦tvl`QTP#ALNti)ƖzZe|f)i9iE؆vhAZ=I}\&t2dS:feIHJʅQT]#kXަIiQp/v+v@{cT8H!Woh|Cծ0(3xHU?c3tV* -VɌAJy5- -Td4] G*jSZ5 -V.V0o@ s^@Q(7Q%_px#骟 a6{0ҩZߧP;tU.=lۓwnJztdU.֞~^T/W< >`/F&Gݕch07jo꺚eEe CNI-c_̈́.zIZNFSY ~l9Z֢)`6ᑕ IW1-݊@x2;7|^Q:YEoa[n>Nۯ^_fuzCXGoJt$6 @Y_Yi-xSJ#Hfe*ճȺް&.xfIhr[г*fS\Y̺_D?<K8MEF ;P[G$/N$A1DzI˳giOQ.G +eP]ÉYbA2ˆK&FZH)Pc8 xQ.Cr0*zQN>&paB'3 +aJnGys, -BXjqR9a |>tΏi0{%>/XObject<<>>>>>>endobj -1824 0 obj<>stream +ݡr[8!19a#mq8 _+{>u9;WzW`⯙_q8#qIGnC2yluqm`F ,j-pa&&7Ъtq#ȏ"rCC"fu2Ff+Iw@ay6|mԑeOҳWAn~E\Ԉ+xWK#Wf6Ypޣ;sU񮣑eVH#Ym~,|~+4t=GQBbEt4O?s/j7f&ljQtִ K;mn͖#} `d-_ M3'-ZaSCr# H0Zykm|ӋQYs-H1$8\!֛﮻7%~]_r_axX~醾KQgWӏgby=Y^ŮrΧoW' Pendstream +endobj +1812 0 obj<>/XObject<<>>>>>>endobj +1813 0 obj<>stream +xVn6}W Rhac]REeM*Iy3ڪ [̙3hBcLlJSʫq2ErN3=ůT8u0;ON?dG )+윲/N4^Z'$9Qm;?iٟ,^7#tV~Ъm&tzl`픣RiIP#ALI^:`ZEMyCBBxgҐYZ$3u Ok$sӻ,& 5[-+BR$ +^D} SV0w^6M#0Қ4捿kv_Vl>qBjtߦɜδ6T_'rݠ|4hMPLdF۩Jia%84r*P:zjע +g; Pw6 +MtڛAǾjډ( +F]!p¤Dք /fL$QPYL#ԩG?XaA -w0JC|O$~ZinIBڬiov>-)]}XPy-J7-i@'u͗5]ih*hzz%R@L ? #+o*xixܬ̥zAY7_A=krBmVɭD)u = `;E,ŬE)PJgtXdqIOm|;@ +IҸ0 \xMW: ߰>hGeKQuxospXE\x0*zQN>&N~cÔݖs `Y>fkoRwH(0qCMgH`+DWRS!J 48ָw ԽB?mEZ^!o$`[/x$j'ZR)ckEXxRðk%t?ܨ5֑691ˠ$,Hth\9}Ӿuv(i7yw//ƟZ19evOendstream +endobj +1814 0 obj<>/XObject<<>>>>>>endobj +1815 0 obj<>stream xW[OH~WeAh>+$eKR%^Lg~sƆ`AngsgJ|MdFGsI:)~ ^Ss9Ǵ(1e~_ Ʉ4=Jg)-thh4ZjrW}.}-һZF^ˀ˛֚ enUIkpt;O`Te V͋[iqq{xuKZDȺg^MՑQU_t6OBצj]P3|CZU­Qz@ՏA%X!MAu TtY 9OԦR~/7w/EaġnC4Pnpm dԟ8:SY!IS^+aZdv_'fEk+y &" cVPLyX1e*Ȉ^< mkz2J7rUmMŰGa_6Ykŗ ^J] -W L(TXvr2?} =68#w:DQF9W8xaɰuG"8 TAP/byJv$fK ͇P-RgʓV3 늷Dz@JK?^6H삕u"nktr^y`G) gJ@Ah;1Mol5['K+4Y1$E:L^|&þp70 '2So__g*[ʙo?j1^r}8Yf\8!ظ__-.oK4b0M*O'4Hc|Ekx~PQzID:LZ["mQAA+yRs%Vh&/NUE$g6.:QZT7/˶+H -'L3ꈙ{ҦBؐIG'#g'˵qֈnF3:CS9HOHoc2ol[g{ziTI-JH@ZtS9rT c U n Lj-0 i.bwO }wDZP/^78(3]_OS@&لq&>:CMBDȼ=69w{ʐHX?Ԫ58pj hYrPmjʆ݌Xʹw4RZA1@pl(S!EIR493⑺ž/# Gf{&_OY94uzDgt}q9.>!>&L`pta{x=yb篝Yendstream +'L3ꈙ{ҦBؐIG'#g'˵qֈnF3:CS9HOHoc2ol[g{ziTI-JH@ZtS9rT c U n Lj-0 i.bwO }wDZP/^78(3]_OS@&لq&>:CMBDȼ=69w{ʐHX?Ԫ58pj hYrPmjʆ݌Xʹw4RZA1@pl(S!EIR493⑺ž/# Gf{&_OY94uzDgt}q9.>!>&L`pta{x=_;Eendstream endobj -1825 0 obj<>/XObject<<>>>>>>endobj -1826 0 obj<>stream +1816 0 obj<>/XObject<<>>>>>>endobj +1817 0 obj<>stream xV]OH}W"&_oRfZi%$4ۓΌܙIH]ZTAbߏs9~;Ft>Ɍ` ?s9#_Ld(,?LN?Mi4D҂x84?^UPFJ%C61XR*YHWo6R/d`lW$,݋&үC&(-lwzitCF~@%Փj,-6<ل*?ыL-Td3/\d@ɾT+Hr@%Z;ƥ4uF8b E[Ћt$"kmjAEZ*;dG> dx S#tgF"qHk{X:A别\#sв=.Χ@| :iJKY"F]CU_PկRľp~! #-*ȉ*.h@(`;'dP*4sxpIi w5[q4R&SbBc"76YQe\a{9k,EWㅭ&(]vLeJj D+mNn[ΆiuVUXd^Z$VBA@O\lC搀X/CjJW0XQ w-VBU h'QA;Qw&|T|9stWU1d V"3 .w[^{3n0Rv͞N^)73`p6θ@]h+DMlT]S+ycD}c!Ow J~yV rdxU 8}EamlS -v띵ţNP_,}rzz:4?႟Oh6:9 Z}y[<ƙlC_q~:=dZendstream +v띵ţNP_,}rzz:4?႟Oh6:9 Z}y[<ƙlC_f~+]dFendstream endobj -1827 0 obj<>/XObject<<>>>>>>endobj -1828 0 obj<>stream +1818 0 obj<>/XObject<<>>>>>>endobj +1819 0 obj<>stream x}Wo6 ` v$[tmd -QTIɎ#)Yv%XxɌN;9-(NN'tv>,|ysYI+]+%>d㧧trBw5t;NlN8=jj I*p"Vinh:>|}9477Ӓ+L[flOJRmMU72XT f,?l20IMwLijZK^îҍ[ieibB׹?'~BBgw}" ozhQ7dF1-h/Cy1:5zdsFӉn !|*(@N=-5$A1]I7 E`HZOUX{_O4:h\yZ[F_Af|*` '3G=PFB|Ll㺮NHwǓG &n?aWOh(mTڢ^R%M-Yh?̶={9C-fݿt%3%Hygjzd;V?ZΣb$ , ֐>Lw#]Sr[*7xȴJ_;c2a!$l -M!$B Eb*J|;(Ò5a_~qգQqz vC/`Ux c^ _-jǍsĻ(ɂP4v;}O?.{l-.ݾtn^&m+X<><}W'/dq1l击Nendstream -endobj -1829 0 obj<>/XObject<<>>>>/Annots 1146 0 R>>endobj -1830 0 obj<>stream -xWnF}WLiQ)9:mk+ VRbB\Ҋgf^DHۙ3BoH!"A0hCO'_)i0}h<}0+'`5GgCǧ,(La(B8ؕQLojLaHD A,/]ܮ(rDb+Zۦ8ϴ驏]#]۷< xLi0 -iWәmgxȦz)EL:mP4}OOˇ!d?mCniw=FE'@:l m5v'ZkuI\iM}K D.u"UoiJiYťY8Pkd7P+d_枊l8 ,# -lH۶q$z7 -/ݥzOvԾw,<DRM e5U ~-]BgQyU' <[S-.g|>0Qx q֋sITQsNgp®ܡh"hK-H^A.|PF+HlǮ ڤRr[@L R ?+THme]<cVkR 酬Wgy.`_ldWZ ٷo)2 -; -v_^rYTCKeJթM9;Sh8 m3ЗB)ᆶᡙ-m0r0x@ZG-*(gW; !ZUfK{2P$H8Xlg4F&RYA%o) _Azږ^tpDxꖘ;M\̳ʳd+G=BESWPND5.l1[50Ѝw3 4쒾^aaRte[yg5>=.V\?뜧QSMx jΐ~WKy+)/wot=B[Ar7rbLvlv-sFŅﰄ Rptq5|9AB;MYڪ#ԗ~J0y|Xz<oWq@".P #tt?fJZ26 P;> DhDB[KUN p3Y굹R?i^]{#ְ#nDpc$ZUX[C3ߖ,𥙻xy7K- -C͵~M˺.ߟlWm}dbciF~*1/~sjF3Q4>^~~𣍛o@|xsx28{g8@uH~:\Ύ~=Q;endstream -endobj -1831 0 obj<>endobj -1832 0 obj<>endobj -1833 0 obj<>endobj -1834 0 obj<>endobj -1835 0 obj<>endobj -1836 0 obj<>endobj -1837 0 obj<>endobj -1838 0 obj<>endobj -1839 0 obj<>endobj -1840 0 obj<>endobj -1841 0 obj<>endobj -1842 0 obj<>endobj -1843 0 obj<>endobj -1844 0 obj<>endobj -1845 0 obj<>endobj -1846 0 obj<>endobj -1847 0 obj<>endobj -1848 0 obj<>endobj -1849 0 obj<>endobj -1850 0 obj<>endobj -1851 0 obj<>endobj -1852 0 obj<>endobj -1853 0 obj<>endobj -1854 0 obj<>endobj -1855 0 obj<>endobj -1856 0 obj<>endobj -1857 0 obj<>endobj -1858 0 obj<>endobj -1859 0 obj<>endobj -1860 0 obj<>endobj -1861 0 obj<>endobj -1862 0 obj<>endobj -1863 0 obj<>endobj -1864 0 obj<>endobj -1865 0 obj<>endobj -1866 0 obj<>endobj -1867 0 obj<>endobj -1868 0 obj<>endobj -1869 0 obj<>endobj -1870 0 obj<>endobj -1871 0 obj<>endobj -1872 0 obj<>endobj -1873 0 obj<>endobj -1874 0 obj<>endobj -1875 0 obj<>endobj -1876 0 obj<>endobj -1877 0 obj<>endobj -1878 0 obj<>endobj -1879 0 obj<>endobj -1880 0 obj<>endobj -1881 0 obj<>endobj -1882 0 obj<>endobj -1883 0 obj<>endobj -1884 0 obj<>endobj -1885 0 obj<>endobj -1886 0 obj<>endobj -1887 0 obj<>endobj -1888 0 obj<>endobj -1889 0 obj<>endobj -1890 0 obj<>endobj -1891 0 obj<>endobj -1892 0 obj<>endobj -1893 0 obj<>endobj -1894 0 obj<>endobj -1895 0 obj<>endobj -1896 0 obj<>endobj -1897 0 obj<>endobj -1898 0 obj<>endobj -1899 0 obj<>endobj -1900 0 obj<>endobj -1901 0 obj<>endobj -1902 0 obj<>endobj -1903 0 obj<>endobj -1904 0 obj<>endobj -1905 0 obj<>endobj -1906 0 obj<>endobj -1907 0 obj<>endobj -1908 0 obj<>endobj -1909 0 obj<>endobj -1910 0 obj<>endobj -1911 0 obj<>endobj -1912 0 obj<>endobj -1913 0 obj<>endobj -1914 0 obj<>endobj -1915 0 obj<>endobj -1916 0 obj<>endobj -1917 0 obj<>endobj -1918 0 obj<>endobj -1919 0 obj<>endobj -1920 0 obj<>endobj -1921 0 obj<>endobj -1922 0 obj<>endobj -1923 0 obj<>endobj -1924 0 obj<>endobj -1925 0 obj<>endobj -1926 0 obj<>endobj -1927 0 obj<>endobj -1928 0 obj<>endobj -1929 0 obj<>endobj -1930 0 obj<>endobj -1931 0 obj<>endobj -1932 0 obj<>endobj -1933 0 obj<>endobj -1934 0 obj<>endobj -1935 0 obj<>endobj -1936 0 obj<>endobj -1937 0 obj<>endobj -1938 0 obj<>endobj -1939 0 obj<>endobj -1940 0 obj<>endobj -1941 0 obj<>endobj -1942 0 obj<>endobj -1943 0 obj<>endobj -1944 0 obj<>endobj -1945 0 obj<>endobj -1946 0 obj<>endobj -1947 0 obj<>endobj -1948 0 obj<>endobj -1949 0 obj<>endobj -1950 0 obj<>endobj -1951 0 obj<>endobj -1952 0 obj<>endobj -1953 0 obj<>endobj -1954 0 obj<>endobj -1955 0 obj<>endobj -1956 0 obj<>endobj -1957 0 obj<>endobj -1958 0 obj<>endobj -1959 0 obj<>endobj -1960 0 obj<>endobj -1961 0 obj<>endobj -1962 0 obj<>endobj -1963 0 obj<>endobj -1964 0 obj<>endobj -1965 0 obj<>endobj -1966 0 obj<>endobj -1967 0 obj<>endobj -1968 0 obj<>endobj -1969 0 obj<>endobj -1970 0 obj<>endobj -1971 0 obj<>endobj -1972 0 obj<>endobj -1973 0 obj<>endobj -1974 0 obj<>endobj -1975 0 obj<>endobj -1976 0 obj<>endobj -1977 0 obj<>endobj -1978 0 obj<>endobj -1979 0 obj<>endobj -1980 0 obj<>endobj -1981 0 obj<>endobj -1982 0 obj<>endobj -1983 0 obj<>endobj -1984 0 obj<>endobj -1985 0 obj<>endobj -1986 0 obj<>endobj -1987 0 obj<>endobj -1988 0 obj<>endobj -1989 0 obj<>endobj -1990 0 obj<>endobj -1991 0 obj<>endobj -1992 0 obj<>endobj -1993 0 obj<>endobj -1994 0 obj<>endobj -1995 0 obj<>endobj -1996 0 obj<>endobj -1997 0 obj<>endobj -1998 0 obj<>endobj -1999 0 obj<>endobj -2000 0 obj<>endobj -2001 0 obj<>endobj -2002 0 obj<>endobj -2003 0 obj<>endobj -2004 0 obj<>endobj -2005 0 obj<>endobj -2006 0 obj<>endobj -2007 0 obj<>endobj -2008 0 obj<>endobj -2009 0 obj<>endobj -2010 0 obj<>endobj -2011 0 obj<>endobj -2012 0 obj<>endobj -2013 0 obj<>endobj -2014 0 obj<>endobj -2015 0 obj<>endobj -2016 0 obj<>endobj -2017 0 obj<>endobj -2018 0 obj<>endobj -2019 0 obj<>endobj -2020 0 obj<>endobj -2021 0 obj<>endobj -2022 0 obj<>endobj -2023 0 obj<>endobj -2024 0 obj<>endobj -2025 0 obj<>endobj -2026 0 obj<>endobj -2027 0 obj<>endobj -2028 0 obj<>endobj -2029 0 obj<>endobj -2030 0 obj<>endobj -2031 0 obj<>endobj -2032 0 obj<>endobj -2033 0 obj<>endobj -2034 0 obj<>endobj -2035 0 obj<>endobj -2036 0 obj<>endobj -2037 0 obj<>endobj -2038 0 obj<>endobj -2039 0 obj<>endobj -2040 0 obj<>endobj -2041 0 obj<>endobj -2042 0 obj<>endobj -2043 0 obj<>endobj -2044 0 obj<>endobj -2045 0 obj<>endobj -2046 0 obj<>endobj -2047 0 obj<>endobj -2048 0 obj<>endobj -2049 0 obj<>endobj -2050 0 obj<>endobj -2051 0 obj<>endobj -2052 0 obj<>endobj -2053 0 obj<>endobj -2054 0 obj<>endobj -2055 0 obj<>endobj -2056 0 obj<>endobj -2057 0 obj<>endobj -2058 0 obj<>endobj -2059 0 obj<>endobj -2060 0 obj<>endobj -2061 0 obj<>endobj -2062 0 obj<>endobj -2063 0 obj<>endobj -2064 0 obj<>endobj -2065 0 obj<>endobj -2066 0 obj<>endobj -2067 0 obj<>endobj -2068 0 obj<>endobj -2069 0 obj<>endobj -2070 0 obj<>endobj -2071 0 obj<>endobj -2072 0 obj<>endobj -2073 0 obj<>endobj -2074 0 obj<>endobj -2075 0 obj<>endobj -2076 0 obj<>endobj -2077 0 obj<>endobj -2078 0 obj<>endobj -2079 0 obj<>endobj -2080 0 obj<>endobj -2081 0 obj<>endobj -2082 0 obj<>endobj -2083 0 obj<>endobj -2084 0 obj<>endobj -2085 0 obj<>endobj -2086 0 obj<>endobj -2087 0 obj<>endobj -2088 0 obj<>endobj -2089 0 obj<>endobj -2090 0 obj<>endobj -2091 0 obj<>endobj -2092 0 obj<>endobj -2093 0 obj<>endobj -2094 0 obj<>endobj -2095 0 obj<>endobj -2096 0 obj<>endobj -2097 0 obj<>endobj -2098 0 obj<>endobj -2099 0 obj<>endobj -2100 0 obj<>endobj -2101 0 obj<>endobj -2102 0 obj<>endobj -2103 0 obj<>endobj -2104 0 obj<>endobj -2105 0 obj<>endobj -2106 0 obj<>endobj -2107 0 obj<>endobj -2108 0 obj<>endobj -2109 0 obj<>endobj -2110 0 obj<>endobj -2111 0 obj<>endobj -2112 0 obj<>endobj -2113 0 obj<>endobj -2114 0 obj<>endobj -2115 0 obj<>endobj -2116 0 obj<>endobj -2117 0 obj<>endobj -2118 0 obj<>endobj -2119 0 obj<>endobj -2120 0 obj<>endobj -2121 0 obj<>endobj -2122 0 obj<>endobj -2123 0 obj<>endobj -2124 0 obj<>endobj -2125 0 obj<>1<>8<>9<>13<>14<>16<>20<>24<>36<>37<>39<>41<>43<>60<>63<>66<>69<>70<>73<>83<>88<>91<>93<>104<>121<>134<>143<>146<>147<>151<>154<>156<>157<>159<>162<>166<>170<>172<>]>>>>endobj +M!$B Eb*J|;(Ò5a_~qգQqz vC/`Ux c^ _-jǍsĻ(ɂP4v;}O?.{l-.ݾtn^&m+X<><}W'/dq1l`wN:endstream +endobj +1820 0 obj<>/XObject<<>>>>/Annots 1141 0 R>>endobj +1821 0 obj<>stream +xWnF}WLiQ%9:mk3 VRbB\Ҋgf^DY;3gF4ߐCM(.&I0l*MNk/FpL^`~<\ !OYP8Q8 D8bW +N&o?DG'Wc +CR2M)JDvs4hm<Ӧ>fnttOoF_ .xǣ01g(8 (Ү3mgxȦz)ELo vq'psxSt{!M\SY٢u"A(*s+[%lpPU2pt¡,*_eYkX;6yQZnR2*gr6W +@e&U:_j$l1+IvF|ؾ Qp q֋B眝٣*j ]9Cr+@:[']0pI\WЂARg/`Jm }?uvi +Xp*p8YB +h3M--'_6pL^g&P^ȺquK9 mP!$k-[agW\V:R{ujzNkgbK= +`0JՎ.PV'J &s-^fQkdb+uj/Oo0 Q Ӷ4TLǮG(ȏ΍nq<@;ssFMw Ղΐ~WKV꼥ֽOwoxx-!}ܪ]K\paq;,!HTe6]\E 'H(c)K[uw<_Fo)<!VFەqУ XBvݏò-lO K(\rj`R햂>I,pwi#8K3 +7Oj<+ޡ + `9jے4sW>ofvEVzZ@M˺.ߟl6 +x>gm24k~*1_ lDW+/mxbtpτdLN,vz7Q;endstream +endobj +1822 0 obj<>endobj +1823 0 obj<>endobj +1824 0 obj<>endobj +1825 0 obj<>endobj +1826 0 obj<>endobj +1827 0 obj<>endobj +1828 0 obj<>endobj +1829 0 obj<>endobj +1830 0 obj<>endobj +1831 0 obj<>endobj +1832 0 obj<>endobj +1833 0 obj<>endobj +1834 0 obj<>endobj +1835 0 obj<>endobj +1836 0 obj<>endobj +1837 0 obj<>endobj +1838 0 obj<>endobj +1839 0 obj<>endobj +1840 0 obj<>endobj +1841 0 obj<>endobj +1842 0 obj<>endobj +1843 0 obj<>endobj +1844 0 obj<>endobj +1845 0 obj<>endobj +1846 0 obj<>endobj +1847 0 obj<>endobj +1848 0 obj<>endobj +1849 0 obj<>endobj +1850 0 obj<>endobj +1851 0 obj<>endobj +1852 0 obj<>endobj +1853 0 obj<>endobj +1854 0 obj<>endobj +1855 0 obj<>endobj +1856 0 obj<>endobj +1857 0 obj<>endobj +1858 0 obj<>endobj +1859 0 obj<>endobj +1860 0 obj<>endobj +1861 0 obj<>endobj +1862 0 obj<>endobj +1863 0 obj<>endobj +1864 0 obj<>endobj +1865 0 obj<>endobj +1866 0 obj<>endobj +1867 0 obj<>endobj +1868 0 obj<>endobj +1869 0 obj<>endobj +1870 0 obj<>endobj +1871 0 obj<>endobj +1872 0 obj<>endobj +1873 0 obj<>endobj +1874 0 obj<>endobj +1875 0 obj<>endobj +1876 0 obj<>endobj +1877 0 obj<>endobj +1878 0 obj<>endobj +1879 0 obj<>endobj +1880 0 obj<>endobj +1881 0 obj<>endobj +1882 0 obj<>endobj +1883 0 obj<>endobj +1884 0 obj<>endobj +1885 0 obj<>endobj +1886 0 obj<>endobj +1887 0 obj<>endobj +1888 0 obj<>endobj +1889 0 obj<>endobj +1890 0 obj<>endobj +1891 0 obj<>endobj +1892 0 obj<>endobj +1893 0 obj<>endobj +1894 0 obj<>endobj +1895 0 obj<>endobj +1896 0 obj<>endobj +1897 0 obj<>endobj +1898 0 obj<>endobj +1899 0 obj<>endobj +1900 0 obj<>endobj +1901 0 obj<>endobj +1902 0 obj<>endobj +1903 0 obj<>endobj +1904 0 obj<>endobj +1905 0 obj<>endobj +1906 0 obj<>endobj +1907 0 obj<>endobj +1908 0 obj<>endobj +1909 0 obj<>endobj +1910 0 obj<>endobj +1911 0 obj<>endobj +1912 0 obj<>endobj +1913 0 obj<>endobj +1914 0 obj<>endobj +1915 0 obj<>endobj +1916 0 obj<>endobj +1917 0 obj<>endobj +1918 0 obj<>endobj +1919 0 obj<>endobj +1920 0 obj<>endobj +1921 0 obj<>endobj +1922 0 obj<>endobj +1923 0 obj<>endobj +1924 0 obj<>endobj +1925 0 obj<>endobj +1926 0 obj<>endobj +1927 0 obj<>endobj +1928 0 obj<>endobj +1929 0 obj<>endobj +1930 0 obj<>endobj +1931 0 obj<>endobj +1932 0 obj<>endobj +1933 0 obj<>endobj +1934 0 obj<>endobj +1935 0 obj<>endobj +1936 0 obj<>endobj +1937 0 obj<>endobj +1938 0 obj<>endobj +1939 0 obj<>endobj +1940 0 obj<>endobj +1941 0 obj<>endobj +1942 0 obj<>endobj +1943 0 obj<>endobj +1944 0 obj<>endobj +1945 0 obj<>endobj +1946 0 obj<>endobj +1947 0 obj<>endobj +1948 0 obj<>endobj +1949 0 obj<>endobj +1950 0 obj<>endobj +1951 0 obj<>endobj +1952 0 obj<>endobj +1953 0 obj<>endobj +1954 0 obj<>endobj +1955 0 obj<>endobj +1956 0 obj<>endobj +1957 0 obj<>endobj +1958 0 obj<>endobj +1959 0 obj<>endobj +1960 0 obj<>endobj +1961 0 obj<>endobj +1962 0 obj<>endobj +1963 0 obj<>endobj +1964 0 obj<>endobj +1965 0 obj<>endobj +1966 0 obj<>endobj +1967 0 obj<>endobj +1968 0 obj<>endobj +1969 0 obj<>endobj +1970 0 obj<>endobj +1971 0 obj<>endobj +1972 0 obj<>endobj +1973 0 obj<>endobj +1974 0 obj<>endobj +1975 0 obj<>endobj +1976 0 obj<>endobj +1977 0 obj<>endobj +1978 0 obj<>endobj +1979 0 obj<>endobj +1980 0 obj<>endobj +1981 0 obj<>endobj +1982 0 obj<>endobj +1983 0 obj<>endobj +1984 0 obj<>endobj +1985 0 obj<>endobj +1986 0 obj<>endobj +1987 0 obj<>endobj +1988 0 obj<>endobj +1989 0 obj<>endobj +1990 0 obj<>endobj +1991 0 obj<>endobj +1992 0 obj<>endobj +1993 0 obj<>endobj +1994 0 obj<>endobj +1995 0 obj<>endobj +1996 0 obj<>endobj +1997 0 obj<>endobj +1998 0 obj<>endobj +1999 0 obj<>endobj +2000 0 obj<>endobj +2001 0 obj<>endobj +2002 0 obj<>endobj +2003 0 obj<>endobj +2004 0 obj<>endobj +2005 0 obj<>endobj +2006 0 obj<>endobj +2007 0 obj<>endobj +2008 0 obj<>endobj +2009 0 obj<>endobj +2010 0 obj<>endobj +2011 0 obj<>endobj +2012 0 obj<>endobj +2013 0 obj<>endobj +2014 0 obj<>endobj +2015 0 obj<>endobj +2016 0 obj<>endobj +2017 0 obj<>endobj +2018 0 obj<>endobj +2019 0 obj<>endobj +2020 0 obj<>endobj +2021 0 obj<>endobj +2022 0 obj<>endobj +2023 0 obj<>endobj +2024 0 obj<>endobj +2025 0 obj<>endobj +2026 0 obj<>endobj +2027 0 obj<>endobj +2028 0 obj<>endobj +2029 0 obj<>endobj +2030 0 obj<>endobj +2031 0 obj<>endobj +2032 0 obj<>endobj +2033 0 obj<>endobj +2034 0 obj<>endobj +2035 0 obj<>endobj +2036 0 obj<>endobj +2037 0 obj<>endobj +2038 0 obj<>endobj +2039 0 obj<>endobj +2040 0 obj<>endobj +2041 0 obj<>endobj +2042 0 obj<>endobj +2043 0 obj<>endobj +2044 0 obj<>endobj +2045 0 obj<>endobj +2046 0 obj<>endobj +2047 0 obj<>endobj +2048 0 obj<>endobj +2049 0 obj<>endobj +2050 0 obj<>endobj +2051 0 obj<>endobj +2052 0 obj<>endobj +2053 0 obj<>endobj +2054 0 obj<>endobj +2055 0 obj<>endobj +2056 0 obj<>endobj +2057 0 obj<>endobj +2058 0 obj<>endobj +2059 0 obj<>endobj +2060 0 obj<>endobj +2061 0 obj<>endobj +2062 0 obj<>endobj +2063 0 obj<>endobj +2064 0 obj<>endobj +2065 0 obj<>endobj +2066 0 obj<>endobj +2067 0 obj<>endobj +2068 0 obj<>endobj +2069 0 obj<>endobj +2070 0 obj<>endobj +2071 0 obj<>endobj +2072 0 obj<>endobj +2073 0 obj<>endobj +2074 0 obj<>endobj +2075 0 obj<>endobj +2076 0 obj<>endobj +2077 0 obj<>endobj +2078 0 obj<>endobj +2079 0 obj<>endobj +2080 0 obj<>endobj +2081 0 obj<>endobj +2082 0 obj<>endobj +2083 0 obj<>endobj +2084 0 obj<>endobj +2085 0 obj<>endobj +2086 0 obj<>endobj +2087 0 obj<>endobj +2088 0 obj<>endobj +2089 0 obj<>endobj +2090 0 obj<>endobj +2091 0 obj<>endobj +2092 0 obj<>endobj +2093 0 obj<>endobj +2094 0 obj<>endobj +2095 0 obj<>endobj +2096 0 obj<>endobj +2097 0 obj<>endobj +2098 0 obj<>endobj +2099 0 obj<>endobj +2100 0 obj<>endobj +2101 0 obj<>endobj +2102 0 obj<>endobj +2103 0 obj<>endobj +2104 0 obj<>endobj +2105 0 obj<>endobj +2106 0 obj<>endobj +2107 0 obj<>endobj +2108 0 obj<>endobj +2109 0 obj<>endobj +2110 0 obj<>endobj +2111 0 obj<>endobj +2112 0 obj<>endobj +2113 0 obj<>endobj +2114 0 obj<>1<>8<>9<>13<>14<>16<>20<>24<>36<>37<>38<>40<>42<>59<>62<>64<>66<>67<>70<>80<>85<>88<>90<>101<>118<>131<>140<>143<>144<>148<>151<>153<>154<>156<>159<>163<>168<>170<>]>>>>endobj xref -0 2126 +0 2115 0000000000 65535 f 0000000015 00000 n 0000000247 00000 n @@ -4673,14 +4674,14 @@ xref 0000013798 00000 n 0000013902 00000 n 0000014006 00000 n -0000014110 00000 n -0000014214 00000 n +0000014109 00000 n +0000014213 00000 n 0000014317 00000 n -0000014421 00000 n -0000014525 00000 n -0000014629 00000 n -0000014732 00000 n -0000014835 00000 n +0000014420 00000 n +0000014523 00000 n +0000014626 00000 n +0000014730 00000 n +0000014834 00000 n 0000014938 00000 n 0000015042 00000 n 0000015146 00000 n @@ -4697,9 +4698,9 @@ xref 0000016290 00000 n 0000016394 00000 n 0000016498 00000 n -0000016602 00000 n -0000016706 00000 n -0000016810 00000 n +0000016601 00000 n +0000016705 00000 n +0000016809 00000 n 0000016913 00000 n 0000017017 00000 n 0000017121 00000 n @@ -4707,1988 +4708,1977 @@ xref 0000017329 00000 n 0000017432 00000 n 0000017534 00000 n -0000017636 00000 n -0000017997 00000 n -0000018100 00000 n -0000018204 00000 n -0000018308 00000 n -0000018411 00000 n -0000018515 00000 n -0000018619 00000 n -0000018723 00000 n -0000018826 00000 n -0000018930 00000 n -0000019034 00000 n -0000019137 00000 n -0000019241 00000 n -0000019345 00000 n -0000019449 00000 n -0000019553 00000 n -0000019657 00000 n -0000019761 00000 n -0000019865 00000 n -0000019969 00000 n -0000020073 00000 n -0000020177 00000 n -0000020281 00000 n -0000020385 00000 n -0000020489 00000 n -0000020593 00000 n -0000020697 00000 n -0000020801 00000 n -0000020905 00000 n -0000021009 00000 n -0000021113 00000 n -0000021217 00000 n -0000021321 00000 n -0000021425 00000 n -0000021528 00000 n -0000021632 00000 n -0000021736 00000 n -0000021840 00000 n -0000021944 00000 n -0000022048 00000 n -0000022152 00000 n -0000022256 00000 n -0000022359 00000 n -0000022712 00000 n -0000022815 00000 n -0000022919 00000 n -0000023023 00000 n -0000023127 00000 n -0000023231 00000 n -0000023335 00000 n -0000023439 00000 n -0000023543 00000 n -0000023647 00000 n -0000023751 00000 n -0000023855 00000 n -0000023959 00000 n -0000024063 00000 n -0000024167 00000 n -0000024271 00000 n -0000024375 00000 n -0000024479 00000 n -0000024583 00000 n -0000024686 00000 n -0000024790 00000 n -0000024894 00000 n -0000024998 00000 n -0000025102 00000 n -0000025206 00000 n -0000025310 00000 n -0000025414 00000 n -0000025518 00000 n -0000025622 00000 n -0000025726 00000 n -0000025830 00000 n -0000025934 00000 n -0000026037 00000 n -0000026141 00000 n -0000026245 00000 n -0000026349 00000 n -0000026453 00000 n -0000026557 00000 n -0000026661 00000 n -0000026765 00000 n -0000026869 00000 n -0000026972 00000 n -0000027074 00000 n -0000027176 00000 n -0000027278 00000 n -0000027647 00000 n -0000027750 00000 n -0000027854 00000 n -0000027958 00000 n -0000028062 00000 n -0000028166 00000 n -0000028270 00000 n -0000028374 00000 n -0000028478 00000 n -0000028582 00000 n -0000028685 00000 n -0000028789 00000 n -0000028893 00000 n -0000028997 00000 n -0000029101 00000 n -0000029205 00000 n -0000029309 00000 n -0000029413 00000 n -0000029516 00000 n -0000029620 00000 n -0000029724 00000 n -0000029828 00000 n -0000029932 00000 n -0000030036 00000 n -0000030140 00000 n -0000030243 00000 n -0000030347 00000 n -0000030451 00000 n -0000030554 00000 n -0000030657 00000 n -0000030761 00000 n -0000030865 00000 n -0000030969 00000 n -0000031073 00000 n -0000031177 00000 n -0000031281 00000 n -0000031384 00000 n -0000031488 00000 n -0000031592 00000 n -0000031696 00000 n -0000031799 00000 n -0000031901 00000 n -0000032003 00000 n -0000032356 00000 n -0000032459 00000 n -0000032563 00000 n -0000032667 00000 n -0000032771 00000 n -0000032875 00000 n -0000032979 00000 n -0000033083 00000 n -0000033187 00000 n -0000033291 00000 n -0000033394 00000 n -0000033498 00000 n -0000033602 00000 n -0000033706 00000 n -0000033810 00000 n -0000033914 00000 n -0000034018 00000 n -0000034122 00000 n -0000034226 00000 n -0000034329 00000 n -0000034433 00000 n -0000034537 00000 n -0000034641 00000 n -0000034745 00000 n -0000034849 00000 n -0000034953 00000 n -0000035056 00000 n -0000035160 00000 n -0000035264 00000 n -0000035368 00000 n -0000035472 00000 n -0000035576 00000 n -0000035680 00000 n -0000035784 00000 n -0000035888 00000 n -0000035992 00000 n -0000036096 00000 n -0000036200 00000 n -0000036304 00000 n -0000036408 00000 n -0000036512 00000 n -0000036616 00000 n -0000036961 00000 n -0000037014 00000 n -0000037101 00000 n -0000037155 00000 n -0000037241 00000 n -0000037296 00000 n -0000037383 00000 n -0000037450 00000 n -0000037536 00000 n -0000037639 00000 n -0000037743 00000 n -0000037847 00000 n -0000037951 00000 n -0000038055 00000 n -0000038159 00000 n -0000038263 00000 n -0000038367 00000 n -0000038471 00000 n -0000038575 00000 n -0000038679 00000 n -0000038783 00000 n -0000038887 00000 n -0000038991 00000 n -0000039095 00000 n -0000039199 00000 n -0000039303 00000 n -0000039407 00000 n -0000039511 00000 n -0000039615 00000 n -0000039719 00000 n -0000039823 00000 n -0000039927 00000 n -0000040031 00000 n -0000040134 00000 n -0000040238 00000 n -0000040342 00000 n -0000040446 00000 n -0000040550 00000 n -0000040654 00000 n -0000040758 00000 n -0000040861 00000 n -0000040963 00000 n -0000041065 00000 n -0000041386 00000 n -0000041490 00000 n -0000041594 00000 n -0000041698 00000 n -0000041802 00000 n -0000041906 00000 n -0000042010 00000 n -0000042114 00000 n -0000042218 00000 n -0000042322 00000 n -0000042426 00000 n -0000042530 00000 n -0000042634 00000 n -0000042738 00000 n -0000042842 00000 n -0000042946 00000 n -0000043050 00000 n -0000043154 00000 n -0000043258 00000 n -0000043362 00000 n -0000043466 00000 n -0000043570 00000 n -0000043674 00000 n -0000043778 00000 n -0000043882 00000 n -0000043986 00000 n -0000044089 00000 n -0000044193 00000 n -0000044297 00000 n -0000044401 00000 n -0000044505 00000 n -0000044609 00000 n -0000044713 00000 n -0000044817 00000 n -0000044921 00000 n -0000045025 00000 n -0000045129 00000 n -0000045233 00000 n -0000045337 00000 n -0000045441 00000 n -0000045545 00000 n -0000045649 00000 n -0000045753 00000 n -0000045857 00000 n -0000045961 00000 n -0000046065 00000 n -0000046169 00000 n -0000046273 00000 n -0000046377 00000 n -0000046480 00000 n -0000046582 00000 n -0000046684 00000 n -0000047109 00000 n -0000047213 00000 n -0000047317 00000 n -0000047421 00000 n -0000047525 00000 n -0000047629 00000 n -0000047733 00000 n -0000047837 00000 n -0000047941 00000 n -0000048045 00000 n -0000048149 00000 n -0000048253 00000 n -0000048357 00000 n -0000048461 00000 n -0000048565 00000 n -0000048669 00000 n -0000048773 00000 n -0000048877 00000 n -0000048981 00000 n -0000049085 00000 n -0000049189 00000 n -0000049293 00000 n -0000049397 00000 n -0000049501 00000 n -0000049605 00000 n -0000049709 00000 n -0000049813 00000 n -0000049917 00000 n -0000050021 00000 n -0000050125 00000 n -0000050229 00000 n -0000050333 00000 n -0000050437 00000 n -0000050541 00000 n -0000050645 00000 n -0000050749 00000 n -0000050853 00000 n -0000050957 00000 n -0000051061 00000 n -0000051165 00000 n -0000051269 00000 n -0000051373 00000 n -0000051477 00000 n -0000051581 00000 n -0000051685 00000 n -0000051789 00000 n -0000051893 00000 n -0000051997 00000 n -0000052101 00000 n -0000052204 00000 n -0000052306 00000 n -0000052408 00000 n -0000052833 00000 n -0000052937 00000 n -0000053041 00000 n -0000053145 00000 n -0000053249 00000 n -0000053353 00000 n -0000053457 00000 n -0000053561 00000 n -0000053665 00000 n -0000053769 00000 n -0000053872 00000 n -0000053976 00000 n -0000054080 00000 n -0000054184 00000 n -0000054288 00000 n -0000054392 00000 n -0000054496 00000 n -0000054600 00000 n -0000054704 00000 n -0000054808 00000 n -0000054912 00000 n -0000055016 00000 n -0000055120 00000 n -0000055224 00000 n -0000055328 00000 n -0000055432 00000 n -0000055536 00000 n -0000055640 00000 n -0000055744 00000 n -0000055848 00000 n -0000055952 00000 n -0000056056 00000 n -0000056160 00000 n -0000056264 00000 n -0000056368 00000 n -0000056472 00000 n -0000056576 00000 n -0000056680 00000 n -0000056784 00000 n -0000056888 00000 n -0000057217 00000 n -0000057320 00000 n -0000057424 00000 n -0000057528 00000 n -0000057632 00000 n -0000057736 00000 n -0000057840 00000 n -0000057944 00000 n -0000058048 00000 n -0000058152 00000 n -0000058256 00000 n -0000058360 00000 n -0000058463 00000 n -0000058567 00000 n -0000058671 00000 n -0000058775 00000 n -0000058879 00000 n -0000058983 00000 n -0000059087 00000 n -0000059190 00000 n -0000059294 00000 n -0000059398 00000 n -0000059502 00000 n -0000059606 00000 n -0000059710 00000 n -0000059814 00000 n -0000059918 00000 n -0000060022 00000 n -0000060126 00000 n -0000060230 00000 n -0000060334 00000 n -0000060438 00000 n -0000060542 00000 n -0000060646 00000 n -0000060750 00000 n -0000060854 00000 n -0000060958 00000 n -0000061062 00000 n -0000061166 00000 n -0000061270 00000 n -0000061374 00000 n -0000061478 00000 n -0000061581 00000 n -0000061683 00000 n -0000061785 00000 n -0000062154 00000 n -0000062258 00000 n -0000062283 00000 n -0000062332 00000 n -0000062419 00000 n -0000062444 00000 n -0000062500 00000 n -0000062587 00000 n -0000062656 00000 n -0000062743 00000 n -0000062794 00000 n -0000062881 00000 n -0000062966 00000 n -0000063053 00000 n -0000063109 00000 n -0000063196 00000 n -0000063246 00000 n -0000063333 00000 n -0000063385 00000 n -0000063471 00000 n -0000063544 00000 n -0000063600 00000 n -0000063687 00000 n -0000063735 00000 n -0000063821 00000 n -0000063869 00000 n -0000063956 00000 n -0000063997 00000 n -0000064038 00000 n -0000064125 00000 n -0000064169 00000 n -0000064256 00000 n -0000064301 00000 n -0000064388 00000 n -0000064432 00000 n -0000064519 00000 n -0000064563 00000 n -0000064650 00000 n -0000064692 00000 n -0000064779 00000 n -0000064827 00000 n -0000064914 00000 n -0000064987 00000 n -0000065035 00000 n -0000065120 00000 n -0000065145 00000 n -0000065198 00000 n -0000065282 00000 n -0000065307 00000 n -0000065410 00000 n -0000065514 00000 n -0000065618 00000 n -0000065722 00000 n -0000065826 00000 n -0000065929 00000 n -0000066032 00000 n -0000066136 00000 n -0000066240 00000 n -0000066344 00000 n -0000066448 00000 n -0000066552 00000 n -0000066656 00000 n -0000066760 00000 n -0000066864 00000 n -0000066968 00000 n -0000067072 00000 n -0000067176 00000 n -0000067280 00000 n -0000067384 00000 n -0000067488 00000 n -0000067591 00000 n -0000067695 00000 n -0000067799 00000 n -0000067903 00000 n -0000068007 00000 n -0000068111 00000 n -0000068215 00000 n -0000068319 00000 n -0000068423 00000 n -0000068527 00000 n -0000068630 00000 n -0000068734 00000 n -0000068838 00000 n -0000068942 00000 n -0000069046 00000 n -0000069150 00000 n -0000069254 00000 n -0000069358 00000 n -0000069462 00000 n -0000069566 00000 n -0000069668 00000 n -0000069770 00000 n -0000069872 00000 n -0000070241 00000 n -0000070345 00000 n -0000070370 00000 n -0000070418 00000 n -0000070505 00000 n -0000070530 00000 n -0000070578 00000 n -0000070665 00000 n -0000070710 00000 n -0000070796 00000 n -0000070839 00000 n -0000070925 00000 n -0000070966 00000 n -0000071052 00000 n -0000071101 00000 n -0000071187 00000 n -0000071233 00000 n -0000071319 00000 n -0000071364 00000 n -0000071450 00000 n -0000071502 00000 n -0000071588 00000 n -0000071638 00000 n -0000071724 00000 n -0000071770 00000 n -0000071856 00000 n -0000071899 00000 n -0000071985 00000 n -0000072029 00000 n -0000072115 00000 n -0000072158 00000 n -0000072244 00000 n -0000072289 00000 n -0000072375 00000 n -0000072413 00000 n -0000072499 00000 n -0000072541 00000 n -0000072627 00000 n -0000072670 00000 n -0000072756 00000 n -0000072794 00000 n -0000072880 00000 n -0000072922 00000 n -0000073008 00000 n -0000073052 00000 n -0000073138 00000 n -0000073185 00000 n -0000073271 00000 n -0000073319 00000 n -0000073406 00000 n -0000073599 00000 n -0000073648 00000 n -0000073734 00000 n -0000073759 00000 n -0000073806 00000 n -0000073893 00000 n -0000073918 00000 n -0000074033 00000 n -0000074120 00000 n -0000074145 00000 n -0000074227 00000 n -0000074314 00000 n -0000074399 00000 n -0000074486 00000 n -0000074541 00000 n -0000074628 00000 n -0000074684 00000 n -0000074771 00000 n -0000074820 00000 n -0000074868 00000 n -0000074955 00000 n -0000075029 00000 n -0000075116 00000 n -0000075184 00000 n -0000075271 00000 n -0000075325 00000 n -0000075412 00000 n -0000075480 00000 n -0000075567 00000 n -0000075641 00000 n -0000075728 00000 n -0000075776 00000 n -0000075863 00000 n -0000075920 00000 n -0000076007 00000 n -0000076088 00000 n -0000076143 00000 n -0000076230 00000 n -0000076311 00000 n -0000076398 00000 n -0000076431 00000 n -0000076484 00000 n -0000076571 00000 n -0000076596 00000 n -0000076644 00000 n -0000076731 00000 n -0000076773 00000 n -0000076860 00000 n -0000076903 00000 n -0000076990 00000 n -0000077040 00000 n -0000077127 00000 n -0000077175 00000 n -0000077262 00000 n -0000077319 00000 n -0000077362 00000 n -0000077449 00000 n -0000077503 00000 n -0000077590 00000 n -0000077635 00000 n -0000077722 00000 n -0000077763 00000 n -0000077820 00000 n -0000077907 00000 n -0000078003 00000 n -0000078089 00000 n -0000078122 00000 n -0000078225 00000 n -0000078329 00000 n -0000078433 00000 n -0000078537 00000 n -0000078641 00000 n -0000078745 00000 n -0000078849 00000 n -0000078953 00000 n -0000079057 00000 n -0000079161 00000 n -0000079265 00000 n -0000079369 00000 n -0000079473 00000 n -0000079577 00000 n -0000079681 00000 n -0000079785 00000 n -0000079889 00000 n -0000079993 00000 n -0000080097 00000 n -0000080200 00000 n -0000080304 00000 n -0000080408 00000 n -0000080512 00000 n -0000080616 00000 n -0000080720 00000 n -0000080824 00000 n -0000080928 00000 n -0000081032 00000 n -0000081136 00000 n -0000081239 00000 n -0000081343 00000 n -0000081447 00000 n -0000081551 00000 n -0000081654 00000 n -0000081758 00000 n -0000081862 00000 n -0000081965 00000 n -0000082069 00000 n -0000082173 00000 n -0000082277 00000 n -0000082381 00000 n -0000082484 00000 n -0000082586 00000 n -0000082688 00000 n -0000083057 00000 n -0000083161 00000 n -0000083265 00000 n -0000083369 00000 n -0000083473 00000 n -0000083577 00000 n -0000083681 00000 n -0000083785 00000 n -0000083889 00000 n -0000083993 00000 n -0000084097 00000 n -0000084201 00000 n -0000084305 00000 n -0000084409 00000 n -0000084513 00000 n -0000084617 00000 n -0000084720 00000 n -0000084824 00000 n -0000084928 00000 n -0000085032 00000 n -0000085136 00000 n -0000085240 00000 n -0000085344 00000 n -0000085448 00000 n -0000085552 00000 n -0000085655 00000 n -0000085759 00000 n -0000085863 00000 n -0000085967 00000 n -0000086071 00000 n -0000086175 00000 n -0000086279 00000 n -0000086383 00000 n -0000086487 00000 n -0000086591 00000 n -0000086695 00000 n -0000086799 00000 n -0000086903 00000 n -0000087007 00000 n -0000087111 00000 n -0000087215 00000 n -0000087319 00000 n -0000087423 00000 n -0000087526 00000 n -0000087630 00000 n -0000087734 00000 n -0000087838 00000 n -0000087942 00000 n -0000088046 00000 n -0000088149 00000 n -0000088251 00000 n -0000088353 00000 n -0000088778 00000 n -0000088882 00000 n -0000088986 00000 n -0000089090 00000 n -0000089194 00000 n -0000089297 00000 n -0000089401 00000 n -0000089505 00000 n -0000089609 00000 n -0000089713 00000 n -0000089817 00000 n -0000089921 00000 n -0000090025 00000 n -0000090129 00000 n -0000090232 00000 n -0000090335 00000 n -0000090439 00000 n -0000090543 00000 n -0000090647 00000 n -0000090751 00000 n -0000090855 00000 n -0000090959 00000 n -0000091063 00000 n -0000091167 00000 n -0000091271 00000 n -0000091375 00000 n -0000091478 00000 n -0000091582 00000 n -0000091686 00000 n -0000091790 00000 n -0000091894 00000 n -0000091998 00000 n -0000092102 00000 n -0000092206 00000 n -0000092309 00000 n -0000092413 00000 n -0000092517 00000 n -0000092621 00000 n -0000092725 00000 n -0000092829 00000 n -0000092933 00000 n -0000093036 00000 n -0000093140 00000 n -0000093244 00000 n -0000093605 00000 n -0000093653 00000 n -0000093740 00000 n -0000093787 00000 n -0000093873 00000 n -0000093920 00000 n -0000094006 00000 n -0000094047 00000 n -0000094092 00000 n -0000094179 00000 n -0000094224 00000 n -0000094310 00000 n -0000094343 00000 n -0000094389 00000 n -0000094474 00000 n -0000094520 00000 n -0000094603 00000 n -0000094636 00000 n -0000094680 00000 n -0000094767 00000 n -0000094818 00000 n -0000094905 00000 n -0000094954 00000 n -0000095041 00000 n -0000095089 00000 n -0000095175 00000 n -0000095224 00000 n -0000095279 00000 n -0000095365 00000 n -0000095390 00000 n -0000095443 00000 n -0000095530 00000 n -0000095580 00000 n -0000095667 00000 n -0000095700 00000 n -0000095819 00000 n -0000095905 00000 n -0000095948 00000 n -0000096035 00000 n -0000096078 00000 n -0000096165 00000 n -0000096206 00000 n -0000096269 00000 n -0000096356 00000 n -0000096414 00000 n -0000096501 00000 n -0000096595 00000 n -0000096681 00000 n -0000096722 00000 n -0000096765 00000 n -0000096851 00000 n -0000096899 00000 n -0000096986 00000 n -0000097027 00000 n -0000097114 00000 n -0000097158 00000 n -0000097245 00000 n -0000097289 00000 n -0000097375 00000 n -0000097432 00000 n -0000097478 00000 n -0000097565 00000 n -0000097590 00000 n -0000097639 00000 n -0000097726 00000 n -0000097780 00000 n -0000097867 00000 n -0000097918 00000 n -0000098005 00000 n -0000098059 00000 n -0000098146 00000 n -0000098196 00000 n -0000098281 00000 n -0000098338 00000 n -0000098388 00000 n -0000098475 00000 n -0000098539 00000 n -0000098626 00000 n -0000098659 00000 n -0000098736 00000 n -0000098822 00000 n -0000098912 00000 n -0000098998 00000 n -0000099087 00000 n -0000099173 00000 n -0000099214 00000 n -0000099285 00000 n -0000099371 00000 n -0000099503 00000 n -0000099589 00000 n -0000099663 00000 n -0000099749 00000 n -0000099846 00000 n -0000099932 00000 n -0000099981 00000 n -0000100046 00000 n -0000100133 00000 n -0000100158 00000 n -0000100223 00000 n -0000100311 00000 n -0000100338 00000 n -0000100401 00000 n -0000100490 00000 n -0000100517 00000 n -0000100567 00000 n -0000100656 00000 n -0000100683 00000 n -0000100732 00000 n -0000100821 00000 n -0000100872 00000 n -0000100958 00000 n -0000101003 00000 n -0000101089 00000 n -0000101134 00000 n -0000101179 00000 n -0000101267 00000 n -0000101318 00000 n -0000101406 00000 n -0000101457 00000 n -0000101545 00000 n -0000101595 00000 n -0000101683 00000 n -0000101731 00000 n -0000101819 00000 n -0000101882 00000 n -0000101972 00000 n -0000102060 00000 n -0000102124 00000 n -0000102212 00000 n -0000102248 00000 n -0000102310 00000 n -0000102398 00000 n -0000102425 00000 n -0000102481 00000 n -0000102570 00000 n -0000102597 00000 n -0000102701 00000 n -0000102806 00000 n -0000102911 00000 n -0000103016 00000 n -0000103121 00000 n -0000103226 00000 n -0000103331 00000 n -0000103435 00000 n -0000103540 00000 n -0000103645 00000 n -0000103750 00000 n -0000103855 00000 n -0000103960 00000 n -0000104065 00000 n -0000104170 00000 n -0000104275 00000 n -0000104380 00000 n -0000104485 00000 n -0000104590 00000 n -0000104695 00000 n -0000104800 00000 n -0000104905 00000 n -0000105009 00000 n -0000105114 00000 n -0000105219 00000 n -0000105324 00000 n -0000105429 00000 n -0000105534 00000 n -0000105639 00000 n -0000105744 00000 n -0000105849 00000 n -0000105953 00000 n -0000106058 00000 n -0000106163 00000 n -0000106268 00000 n -0000106373 00000 n -0000106478 00000 n -0000106583 00000 n -0000106687 00000 n -0000106792 00000 n -0000106897 00000 n -0000107002 00000 n -0000107107 00000 n -0000107212 00000 n -0000107316 00000 n -0000107419 00000 n -0000107522 00000 n -0000107963 00000 n -0000108068 00000 n -0000108173 00000 n -0000108278 00000 n -0000108383 00000 n -0000108488 00000 n -0000108593 00000 n -0000108698 00000 n -0000108779 00000 n -0000108835 00000 n -0000108923 00000 n -0000108992 00000 n -0000109080 00000 n -0000109156 00000 n -0000109245 00000 n -0000109316 00000 n -0000109404 00000 n -0000109484 00000 n -0000109573 00000 n -0000109636 00000 n -0000109719 00000 n -0000109807 00000 n -0000109883 00000 n -0000109972 00000 n -0000110046 00000 n -0000110135 00000 n -0000110214 00000 n -0000110303 00000 n -0000110357 00000 n -0000110406 00000 n -0000110495 00000 n -0000110522 00000 n -0000110571 00000 n -0000110660 00000 n -0000110687 00000 n -0000110737 00000 n -0000110826 00000 n -0000110890 00000 n -0000110979 00000 n -0000111043 00000 n -0000111132 00000 n -0000111187 00000 n -0000111276 00000 n -0000111330 00000 n -0000111399 00000 n -0000111487 00000 n -0000111543 00000 n -0000111632 00000 n -0000111668 00000 n -0000111717 00000 n -0000111806 00000 n -0000111871 00000 n -0000111960 00000 n -0000112016 00000 n -0000112105 00000 n -0000112153 00000 n +0000017887 00000 n +0000017990 00000 n +0000018094 00000 n +0000018198 00000 n +0000018302 00000 n +0000018405 00000 n +0000018509 00000 n +0000018613 00000 n +0000018716 00000 n +0000018820 00000 n +0000018924 00000 n +0000019028 00000 n +0000019132 00000 n +0000019236 00000 n +0000019340 00000 n +0000019444 00000 n +0000019548 00000 n +0000019652 00000 n +0000019756 00000 n +0000019860 00000 n +0000019964 00000 n +0000020068 00000 n +0000020172 00000 n +0000020276 00000 n +0000020380 00000 n +0000020484 00000 n +0000020588 00000 n +0000020692 00000 n +0000020796 00000 n +0000020900 00000 n +0000021004 00000 n +0000021107 00000 n +0000021211 00000 n +0000021315 00000 n +0000021419 00000 n +0000021523 00000 n +0000021627 00000 n +0000021731 00000 n +0000021835 00000 n +0000021939 00000 n +0000022042 00000 n +0000022146 00000 n +0000022249 00000 n +0000022351 00000 n +0000022453 00000 n +0000022822 00000 n +0000022925 00000 n +0000023029 00000 n +0000023133 00000 n +0000023237 00000 n +0000023341 00000 n +0000023445 00000 n +0000023549 00000 n +0000023653 00000 n +0000023757 00000 n +0000023861 00000 n +0000023965 00000 n +0000024069 00000 n +0000024173 00000 n +0000024277 00000 n +0000024380 00000 n +0000024484 00000 n +0000024588 00000 n +0000024692 00000 n +0000024796 00000 n +0000024900 00000 n +0000025004 00000 n +0000025108 00000 n +0000025212 00000 n +0000025316 00000 n +0000025420 00000 n +0000025524 00000 n +0000025628 00000 n +0000025731 00000 n +0000025835 00000 n +0000025939 00000 n +0000026043 00000 n +0000026147 00000 n +0000026251 00000 n +0000026355 00000 n +0000026459 00000 n +0000026563 00000 n +0000026666 00000 n +0000026769 00000 n +0000026873 00000 n +0000026977 00000 n +0000027081 00000 n +0000027184 00000 n +0000027286 00000 n +0000027388 00000 n +0000027757 00000 n +0000027860 00000 n +0000027964 00000 n +0000028068 00000 n +0000028172 00000 n +0000028276 00000 n +0000028379 00000 n +0000028483 00000 n +0000028587 00000 n +0000028691 00000 n +0000028795 00000 n +0000028899 00000 n +0000029003 00000 n +0000029107 00000 n +0000029210 00000 n +0000029314 00000 n +0000029418 00000 n +0000029522 00000 n +0000029626 00000 n +0000029730 00000 n +0000029834 00000 n +0000029937 00000 n +0000030041 00000 n +0000030145 00000 n +0000030248 00000 n +0000030351 00000 n +0000030455 00000 n +0000030559 00000 n +0000030663 00000 n +0000030767 00000 n +0000030871 00000 n +0000030975 00000 n +0000031078 00000 n +0000031182 00000 n +0000031286 00000 n +0000031390 00000 n +0000031494 00000 n +0000031598 00000 n +0000031702 00000 n +0000031806 00000 n +0000031909 00000 n +0000032011 00000 n +0000032113 00000 n +0000032466 00000 n +0000032569 00000 n +0000032673 00000 n +0000032777 00000 n +0000032881 00000 n +0000032985 00000 n +0000033088 00000 n +0000033192 00000 n +0000033296 00000 n +0000033400 00000 n +0000033504 00000 n +0000033608 00000 n +0000033712 00000 n +0000033816 00000 n +0000033920 00000 n +0000034024 00000 n +0000034127 00000 n +0000034231 00000 n +0000034335 00000 n +0000034439 00000 n +0000034543 00000 n +0000034647 00000 n +0000034751 00000 n +0000034854 00000 n +0000034958 00000 n +0000035062 00000 n +0000035166 00000 n +0000035270 00000 n +0000035374 00000 n +0000035478 00000 n +0000035582 00000 n +0000035686 00000 n +0000035790 00000 n +0000035894 00000 n +0000035998 00000 n +0000036102 00000 n +0000036206 00000 n +0000036310 00000 n +0000036414 00000 n +0000036735 00000 n +0000036788 00000 n +0000036875 00000 n +0000036929 00000 n +0000037015 00000 n +0000037070 00000 n +0000037157 00000 n +0000037224 00000 n +0000037310 00000 n +0000037413 00000 n +0000037517 00000 n +0000037621 00000 n +0000037725 00000 n +0000037829 00000 n +0000037933 00000 n +0000038037 00000 n +0000038141 00000 n +0000038245 00000 n +0000038349 00000 n +0000038453 00000 n +0000038557 00000 n +0000038661 00000 n +0000038765 00000 n +0000038869 00000 n +0000038973 00000 n +0000039077 00000 n +0000039181 00000 n +0000039285 00000 n +0000039389 00000 n +0000039493 00000 n +0000039597 00000 n +0000039701 00000 n +0000039805 00000 n +0000039908 00000 n +0000040012 00000 n +0000040116 00000 n +0000040220 00000 n +0000040324 00000 n +0000040428 00000 n +0000040532 00000 n +0000040635 00000 n +0000040737 00000 n +0000040839 00000 n +0000041160 00000 n +0000041264 00000 n +0000041368 00000 n +0000041472 00000 n +0000041576 00000 n +0000041680 00000 n +0000041784 00000 n +0000041888 00000 n +0000041992 00000 n +0000042096 00000 n +0000042200 00000 n +0000042304 00000 n +0000042408 00000 n +0000042512 00000 n +0000042616 00000 n +0000042720 00000 n +0000042824 00000 n +0000042928 00000 n +0000043032 00000 n +0000043136 00000 n +0000043240 00000 n +0000043344 00000 n +0000043448 00000 n +0000043552 00000 n +0000043656 00000 n +0000043758 00000 n +0000043862 00000 n +0000043966 00000 n +0000044070 00000 n +0000044174 00000 n +0000044278 00000 n +0000044382 00000 n +0000044486 00000 n +0000044590 00000 n +0000044694 00000 n +0000044798 00000 n +0000044902 00000 n +0000045006 00000 n +0000045110 00000 n +0000045214 00000 n +0000045318 00000 n +0000045422 00000 n +0000045526 00000 n +0000045630 00000 n +0000045734 00000 n +0000045838 00000 n +0000045942 00000 n +0000046046 00000 n +0000046150 00000 n +0000046254 00000 n +0000046358 00000 n +0000046461 00000 n +0000046563 00000 n +0000046665 00000 n +0000047106 00000 n +0000047210 00000 n +0000047314 00000 n +0000047418 00000 n +0000047522 00000 n +0000047626 00000 n +0000047730 00000 n +0000047834 00000 n +0000047938 00000 n +0000048042 00000 n +0000048146 00000 n +0000048250 00000 n +0000048354 00000 n +0000048458 00000 n +0000048562 00000 n +0000048666 00000 n +0000048770 00000 n +0000048874 00000 n +0000048978 00000 n +0000049082 00000 n +0000049186 00000 n +0000049290 00000 n +0000049394 00000 n +0000049498 00000 n +0000049602 00000 n +0000049706 00000 n +0000049810 00000 n +0000049914 00000 n +0000050018 00000 n +0000050122 00000 n +0000050226 00000 n +0000050330 00000 n +0000050434 00000 n +0000050538 00000 n +0000050642 00000 n +0000050746 00000 n +0000050850 00000 n +0000050954 00000 n +0000051058 00000 n +0000051162 00000 n +0000051266 00000 n +0000051370 00000 n +0000051474 00000 n +0000051578 00000 n +0000051682 00000 n +0000051786 00000 n +0000051890 00000 n +0000051994 00000 n +0000052098 00000 n +0000052201 00000 n +0000052303 00000 n +0000052405 00000 n +0000052830 00000 n +0000052934 00000 n +0000053038 00000 n +0000053142 00000 n +0000053246 00000 n +0000053350 00000 n +0000053454 00000 n +0000053557 00000 n +0000053661 00000 n +0000053765 00000 n +0000053869 00000 n +0000053973 00000 n +0000054077 00000 n +0000054181 00000 n +0000054285 00000 n +0000054389 00000 n +0000054493 00000 n +0000054597 00000 n +0000054701 00000 n +0000054805 00000 n +0000054909 00000 n +0000055013 00000 n +0000055117 00000 n +0000055221 00000 n +0000055325 00000 n +0000055429 00000 n +0000055533 00000 n +0000055637 00000 n +0000055741 00000 n +0000055845 00000 n +0000055949 00000 n +0000056053 00000 n +0000056157 00000 n +0000056261 00000 n +0000056365 00000 n +0000056469 00000 n +0000056573 00000 n +0000056878 00000 n +0000056981 00000 n +0000057085 00000 n +0000057189 00000 n +0000057293 00000 n +0000057397 00000 n +0000057501 00000 n +0000057605 00000 n +0000057709 00000 n +0000057813 00000 n +0000057917 00000 n +0000058021 00000 n +0000058124 00000 n +0000058228 00000 n +0000058332 00000 n +0000058436 00000 n +0000058540 00000 n +0000058644 00000 n +0000058748 00000 n +0000058851 00000 n +0000058955 00000 n +0000059059 00000 n +0000059163 00000 n +0000059267 00000 n +0000059371 00000 n +0000059475 00000 n +0000059579 00000 n +0000059683 00000 n +0000059787 00000 n +0000059891 00000 n +0000059995 00000 n +0000060099 00000 n +0000060203 00000 n +0000060307 00000 n +0000060411 00000 n +0000060515 00000 n +0000060619 00000 n +0000060723 00000 n +0000060827 00000 n +0000060931 00000 n +0000061035 00000 n +0000061139 00000 n +0000061242 00000 n +0000061344 00000 n +0000061446 00000 n +0000061815 00000 n +0000061919 00000 n +0000061944 00000 n +0000061993 00000 n +0000062080 00000 n +0000062105 00000 n +0000062161 00000 n +0000062248 00000 n +0000062317 00000 n +0000062404 00000 n +0000062455 00000 n +0000062542 00000 n +0000062627 00000 n +0000062714 00000 n +0000062770 00000 n +0000062857 00000 n +0000062907 00000 n +0000062994 00000 n +0000063046 00000 n +0000063132 00000 n +0000063205 00000 n +0000063261 00000 n +0000063348 00000 n +0000063396 00000 n +0000063482 00000 n +0000063530 00000 n +0000063617 00000 n +0000063658 00000 n +0000063699 00000 n +0000063786 00000 n +0000063830 00000 n +0000063917 00000 n +0000063962 00000 n +0000064049 00000 n +0000064093 00000 n +0000064180 00000 n +0000064224 00000 n +0000064311 00000 n +0000064353 00000 n +0000064440 00000 n +0000064488 00000 n +0000064575 00000 n +0000064648 00000 n +0000064696 00000 n +0000064781 00000 n +0000064806 00000 n +0000064859 00000 n +0000064943 00000 n +0000064968 00000 n +0000065071 00000 n +0000065175 00000 n +0000065279 00000 n +0000065383 00000 n +0000065487 00000 n +0000065590 00000 n +0000065693 00000 n +0000065797 00000 n +0000065901 00000 n +0000066005 00000 n +0000066109 00000 n +0000066213 00000 n +0000066317 00000 n +0000066421 00000 n +0000066525 00000 n +0000066629 00000 n +0000066733 00000 n +0000066837 00000 n +0000066941 00000 n +0000067045 00000 n +0000067149 00000 n +0000067252 00000 n +0000067356 00000 n +0000067460 00000 n +0000067564 00000 n +0000067668 00000 n +0000067772 00000 n +0000067876 00000 n +0000067980 00000 n +0000068084 00000 n +0000068188 00000 n +0000068291 00000 n +0000068395 00000 n +0000068499 00000 n +0000068603 00000 n +0000068707 00000 n +0000068811 00000 n +0000068915 00000 n +0000069019 00000 n +0000069123 00000 n +0000069227 00000 n +0000069330 00000 n +0000069434 00000 n +0000069537 00000 n +0000069906 00000 n +0000069954 00000 n +0000070041 00000 n +0000070066 00000 n +0000070114 00000 n +0000070201 00000 n +0000070246 00000 n +0000070332 00000 n +0000070375 00000 n +0000070461 00000 n +0000070502 00000 n +0000070588 00000 n +0000070637 00000 n +0000070723 00000 n +0000070769 00000 n +0000070855 00000 n +0000070900 00000 n +0000070986 00000 n +0000071038 00000 n +0000071124 00000 n +0000071174 00000 n +0000071260 00000 n +0000071306 00000 n +0000071392 00000 n +0000071435 00000 n +0000071521 00000 n +0000071565 00000 n +0000071651 00000 n +0000071694 00000 n +0000071780 00000 n +0000071825 00000 n +0000071911 00000 n +0000071949 00000 n +0000072035 00000 n +0000072077 00000 n +0000072163 00000 n +0000072206 00000 n +0000072292 00000 n +0000072330 00000 n +0000072416 00000 n +0000072458 00000 n +0000072544 00000 n +0000072588 00000 n +0000072674 00000 n +0000072721 00000 n +0000072807 00000 n +0000072855 00000 n +0000072942 00000 n +0000073135 00000 n +0000073184 00000 n +0000073270 00000 n +0000073295 00000 n +0000073342 00000 n +0000073429 00000 n +0000073454 00000 n +0000073569 00000 n +0000073656 00000 n +0000073681 00000 n +0000073763 00000 n +0000073850 00000 n +0000073935 00000 n +0000074022 00000 n +0000074077 00000 n +0000074164 00000 n +0000074220 00000 n +0000074307 00000 n +0000074356 00000 n +0000074404 00000 n +0000074491 00000 n +0000074565 00000 n +0000074652 00000 n +0000074720 00000 n +0000074807 00000 n +0000074861 00000 n +0000074948 00000 n +0000075016 00000 n +0000075103 00000 n +0000075177 00000 n +0000075264 00000 n +0000075312 00000 n +0000075399 00000 n +0000075456 00000 n +0000075543 00000 n +0000075624 00000 n +0000075679 00000 n +0000075766 00000 n +0000075847 00000 n +0000075934 00000 n +0000075967 00000 n +0000076020 00000 n +0000076107 00000 n +0000076132 00000 n +0000076180 00000 n +0000076267 00000 n +0000076309 00000 n +0000076396 00000 n +0000076439 00000 n +0000076526 00000 n +0000076576 00000 n +0000076663 00000 n +0000076711 00000 n +0000076798 00000 n +0000076855 00000 n +0000076898 00000 n +0000076985 00000 n +0000077039 00000 n +0000077126 00000 n +0000077171 00000 n +0000077258 00000 n +0000077315 00000 n +0000077401 00000 n +0000077497 00000 n +0000077582 00000 n +0000077639 00000 n +0000077742 00000 n +0000077846 00000 n +0000077950 00000 n +0000078054 00000 n +0000078158 00000 n +0000078262 00000 n +0000078366 00000 n +0000078470 00000 n +0000078574 00000 n +0000078678 00000 n +0000078782 00000 n +0000078886 00000 n +0000078990 00000 n +0000079094 00000 n +0000079198 00000 n +0000079302 00000 n +0000079406 00000 n +0000079510 00000 n +0000079614 00000 n +0000079717 00000 n +0000079821 00000 n +0000079925 00000 n +0000080029 00000 n +0000080133 00000 n +0000080237 00000 n +0000080341 00000 n +0000080445 00000 n +0000080549 00000 n +0000080653 00000 n +0000080756 00000 n +0000080860 00000 n +0000080964 00000 n +0000081068 00000 n +0000081171 00000 n +0000081275 00000 n +0000081379 00000 n +0000081482 00000 n +0000081586 00000 n +0000081690 00000 n +0000081794 00000 n +0000081898 00000 n +0000082001 00000 n +0000082103 00000 n +0000082205 00000 n +0000082574 00000 n +0000082678 00000 n +0000082782 00000 n +0000082886 00000 n +0000082990 00000 n +0000083094 00000 n +0000083198 00000 n +0000083302 00000 n +0000083406 00000 n +0000083510 00000 n +0000083614 00000 n +0000083718 00000 n +0000083822 00000 n +0000083926 00000 n +0000084030 00000 n +0000084134 00000 n +0000084237 00000 n +0000084341 00000 n +0000084445 00000 n +0000084549 00000 n +0000084653 00000 n +0000084757 00000 n +0000084861 00000 n +0000084965 00000 n +0000085069 00000 n +0000085172 00000 n +0000085276 00000 n +0000085380 00000 n +0000085484 00000 n +0000085588 00000 n +0000085692 00000 n +0000085796 00000 n +0000085900 00000 n +0000086004 00000 n +0000086108 00000 n +0000086212 00000 n +0000086316 00000 n +0000086420 00000 n +0000086524 00000 n +0000086628 00000 n +0000086732 00000 n +0000086836 00000 n +0000086940 00000 n +0000087043 00000 n +0000087147 00000 n +0000087251 00000 n +0000087355 00000 n +0000087459 00000 n +0000087563 00000 n +0000087666 00000 n +0000087768 00000 n +0000087870 00000 n +0000088295 00000 n +0000088399 00000 n +0000088503 00000 n +0000088607 00000 n +0000088711 00000 n +0000088814 00000 n +0000088918 00000 n +0000089022 00000 n +0000089126 00000 n +0000089230 00000 n +0000089334 00000 n +0000089438 00000 n +0000089542 00000 n +0000089646 00000 n +0000089749 00000 n +0000089852 00000 n +0000089956 00000 n +0000090060 00000 n +0000090164 00000 n +0000090268 00000 n +0000090372 00000 n +0000090476 00000 n +0000090580 00000 n +0000090684 00000 n +0000090788 00000 n +0000090892 00000 n +0000090995 00000 n +0000091099 00000 n +0000091203 00000 n +0000091307 00000 n +0000091411 00000 n +0000091515 00000 n +0000091619 00000 n +0000091723 00000 n +0000091826 00000 n +0000091930 00000 n +0000092034 00000 n +0000092138 00000 n +0000092242 00000 n +0000092346 00000 n +0000092450 00000 n +0000092553 00000 n +0000092657 00000 n +0000092761 00000 n +0000093122 00000 n +0000093170 00000 n +0000093257 00000 n +0000093304 00000 n +0000093390 00000 n +0000093437 00000 n +0000093523 00000 n +0000093564 00000 n +0000093609 00000 n +0000093696 00000 n +0000093741 00000 n +0000093827 00000 n +0000093860 00000 n +0000093906 00000 n +0000093992 00000 n +0000094038 00000 n +0000094121 00000 n +0000094154 00000 n +0000094198 00000 n +0000094285 00000 n +0000094336 00000 n +0000094423 00000 n +0000094472 00000 n +0000094559 00000 n +0000094607 00000 n +0000094693 00000 n +0000094742 00000 n +0000094797 00000 n +0000094883 00000 n +0000094908 00000 n +0000094961 00000 n +0000095048 00000 n +0000095098 00000 n +0000095185 00000 n +0000095218 00000 n +0000095337 00000 n +0000095423 00000 n +0000095466 00000 n +0000095553 00000 n +0000095596 00000 n +0000095683 00000 n +0000095724 00000 n +0000095787 00000 n +0000095874 00000 n +0000095932 00000 n +0000096019 00000 n +0000096113 00000 n +0000096199 00000 n +0000096240 00000 n +0000096283 00000 n +0000096369 00000 n +0000096417 00000 n +0000096504 00000 n +0000096545 00000 n +0000096632 00000 n +0000096676 00000 n +0000096763 00000 n +0000096807 00000 n +0000096893 00000 n +0000096950 00000 n +0000096996 00000 n +0000097083 00000 n +0000097108 00000 n +0000097157 00000 n +0000097244 00000 n +0000097298 00000 n +0000097385 00000 n +0000097436 00000 n +0000097523 00000 n +0000097577 00000 n +0000097664 00000 n +0000097714 00000 n +0000097799 00000 n +0000097856 00000 n +0000097906 00000 n +0000097993 00000 n +0000098057 00000 n +0000098144 00000 n +0000098177 00000 n +0000098254 00000 n +0000098340 00000 n +0000098430 00000 n +0000098516 00000 n +0000098605 00000 n +0000098691 00000 n +0000098732 00000 n +0000098803 00000 n +0000098889 00000 n +0000099021 00000 n +0000099107 00000 n +0000099181 00000 n +0000099267 00000 n +0000099364 00000 n +0000099450 00000 n +0000099499 00000 n +0000099564 00000 n +0000099651 00000 n +0000099676 00000 n +0000099741 00000 n +0000099828 00000 n +0000099853 00000 n +0000099915 00000 n +0000100002 00000 n +0000100027 00000 n +0000100076 00000 n +0000100164 00000 n +0000100191 00000 n +0000100240 00000 n +0000100329 00000 n +0000100380 00000 n +0000100466 00000 n +0000100511 00000 n +0000100597 00000 n +0000100642 00000 n +0000100687 00000 n +0000100775 00000 n +0000100826 00000 n +0000100914 00000 n +0000100965 00000 n +0000101053 00000 n +0000101103 00000 n +0000101191 00000 n +0000101239 00000 n +0000101327 00000 n +0000101390 00000 n +0000101480 00000 n +0000101568 00000 n +0000101632 00000 n +0000101720 00000 n +0000101756 00000 n +0000101818 00000 n +0000101906 00000 n +0000101933 00000 n +0000101989 00000 n +0000102078 00000 n +0000102105 00000 n +0000102209 00000 n +0000102314 00000 n +0000102419 00000 n +0000102524 00000 n +0000102629 00000 n +0000102734 00000 n +0000102839 00000 n +0000102943 00000 n +0000103048 00000 n +0000103153 00000 n +0000103258 00000 n +0000103363 00000 n +0000103468 00000 n +0000103573 00000 n +0000103678 00000 n +0000103783 00000 n +0000103888 00000 n +0000103993 00000 n +0000104098 00000 n +0000104203 00000 n +0000104308 00000 n +0000104413 00000 n +0000104517 00000 n +0000104622 00000 n +0000104727 00000 n +0000104832 00000 n +0000104937 00000 n +0000105042 00000 n +0000105147 00000 n +0000105252 00000 n +0000105357 00000 n +0000105462 00000 n +0000105566 00000 n +0000105671 00000 n +0000105776 00000 n +0000105881 00000 n +0000105986 00000 n +0000106091 00000 n +0000106196 00000 n +0000106300 00000 n +0000106405 00000 n +0000106510 00000 n +0000106615 00000 n +0000106720 00000 n +0000106824 00000 n +0000106927 00000 n +0000107030 00000 n +0000107471 00000 n +0000107576 00000 n +0000107681 00000 n +0000107786 00000 n +0000107891 00000 n +0000107996 00000 n +0000108101 00000 n +0000108206 00000 n +0000108311 00000 n +0000108401 00000 n +0000108457 00000 n +0000108545 00000 n +0000108614 00000 n +0000108702 00000 n +0000108778 00000 n +0000108867 00000 n +0000108938 00000 n +0000109026 00000 n +0000109106 00000 n +0000109195 00000 n +0000109258 00000 n +0000109341 00000 n +0000109429 00000 n +0000109505 00000 n +0000109594 00000 n +0000109668 00000 n +0000109757 00000 n +0000109836 00000 n +0000109925 00000 n +0000109979 00000 n +0000110028 00000 n +0000110117 00000 n +0000110144 00000 n +0000110193 00000 n +0000110282 00000 n +0000110309 00000 n +0000110359 00000 n +0000110448 00000 n +0000110512 00000 n +0000110601 00000 n +0000110665 00000 n +0000110754 00000 n +0000110809 00000 n +0000110898 00000 n +0000110952 00000 n +0000111021 00000 n +0000111109 00000 n +0000111165 00000 n +0000111254 00000 n +0000111290 00000 n +0000111339 00000 n +0000111428 00000 n +0000111493 00000 n +0000111582 00000 n +0000111638 00000 n +0000111727 00000 n +0000111775 00000 n +0000111864 00000 n +0000111918 00000 n +0000111973 00000 n +0000112062 00000 n +0000112117 00000 n +0000112206 00000 n 0000112242 00000 n -0000112296 00000 n -0000112351 00000 n -0000112440 00000 n -0000112495 00000 n -0000112584 00000 n -0000112620 00000 n -0000112656 00000 n -0000112692 00000 n -0000118297 00000 n -0000118342 00000 n -0000118387 00000 n -0000118432 00000 n -0000118477 00000 n -0000118522 00000 n -0000118567 00000 n -0000118612 00000 n -0000118657 00000 n -0000118702 00000 n -0000118747 00000 n -0000118792 00000 n -0000118837 00000 n -0000118882 00000 n -0000118927 00000 n -0000118972 00000 n -0000119017 00000 n -0000119062 00000 n -0000119107 00000 n -0000119152 00000 n -0000119197 00000 n -0000119242 00000 n -0000119287 00000 n -0000119332 00000 n -0000119377 00000 n -0000119422 00000 n -0000119467 00000 n -0000119512 00000 n -0000119557 00000 n -0000119602 00000 n -0000119647 00000 n -0000119692 00000 n -0000119737 00000 n -0000119782 00000 n -0000119827 00000 n -0000119872 00000 n -0000119917 00000 n -0000119962 00000 n -0000120007 00000 n -0000120052 00000 n -0000120097 00000 n -0000120142 00000 n -0000120187 00000 n -0000120232 00000 n -0000120277 00000 n -0000120322 00000 n -0000120367 00000 n -0000120412 00000 n -0000120457 00000 n -0000120502 00000 n -0000120547 00000 n -0000120592 00000 n -0000120637 00000 n -0000120682 00000 n -0000120727 00000 n -0000120772 00000 n -0000120817 00000 n -0000120862 00000 n -0000120907 00000 n -0000120952 00000 n -0000120997 00000 n -0000121042 00000 n -0000121087 00000 n -0000121132 00000 n -0000121177 00000 n -0000121222 00000 n -0000121267 00000 n -0000121312 00000 n -0000121357 00000 n -0000121402 00000 n -0000121447 00000 n -0000121492 00000 n -0000121537 00000 n -0000121582 00000 n -0000121627 00000 n -0000121672 00000 n -0000121717 00000 n -0000121762 00000 n -0000121807 00000 n -0000121852 00000 n -0000121897 00000 n -0000121942 00000 n -0000121987 00000 n -0000122032 00000 n -0000122077 00000 n -0000122122 00000 n -0000122167 00000 n -0000122212 00000 n -0000122257 00000 n -0000122302 00000 n -0000122347 00000 n -0000122392 00000 n -0000122437 00000 n -0000122482 00000 n -0000122527 00000 n -0000122572 00000 n -0000122617 00000 n -0000122662 00000 n -0000122707 00000 n -0000122752 00000 n -0000122797 00000 n -0000122842 00000 n -0000122887 00000 n -0000122932 00000 n -0000122977 00000 n -0000123022 00000 n -0000123067 00000 n -0000123112 00000 n -0000123157 00000 n -0000123202 00000 n -0000123247 00000 n -0000123292 00000 n -0000123337 00000 n -0000123382 00000 n -0000123427 00000 n -0000123472 00000 n -0000123517 00000 n -0000123562 00000 n -0000123607 00000 n -0000123652 00000 n -0000123697 00000 n -0000123742 00000 n -0000123787 00000 n -0000123832 00000 n -0000123877 00000 n -0000123922 00000 n -0000123967 00000 n -0000124012 00000 n -0000124057 00000 n -0000124102 00000 n -0000124147 00000 n -0000124192 00000 n -0000124237 00000 n -0000124282 00000 n -0000124327 00000 n -0000124372 00000 n -0000124417 00000 n -0000124462 00000 n -0000124507 00000 n -0000124552 00000 n -0000124597 00000 n -0000124642 00000 n -0000124687 00000 n -0000124732 00000 n -0000124777 00000 n -0000124822 00000 n -0000124867 00000 n -0000124912 00000 n -0000124957 00000 n -0000125002 00000 n -0000125047 00000 n -0000125092 00000 n -0000125137 00000 n -0000125182 00000 n -0000125227 00000 n -0000125272 00000 n -0000125317 00000 n -0000125362 00000 n -0000125407 00000 n -0000125452 00000 n -0000125497 00000 n -0000125542 00000 n -0000125587 00000 n -0000125632 00000 n -0000125677 00000 n -0000125722 00000 n -0000125767 00000 n -0000125812 00000 n -0000125857 00000 n -0000125902 00000 n -0000125947 00000 n -0000125992 00000 n -0000126037 00000 n -0000126082 00000 n -0000126127 00000 n -0000126172 00000 n -0000126217 00000 n -0000126262 00000 n -0000126307 00000 n -0000126352 00000 n -0000126397 00000 n -0000126442 00000 n -0000126487 00000 n -0000126532 00000 n -0000126577 00000 n -0000126622 00000 n -0000126667 00000 n -0000126712 00000 n -0000126757 00000 n -0000126802 00000 n -0000126847 00000 n -0000126892 00000 n -0000126937 00000 n -0000126982 00000 n -0000127027 00000 n -0000127072 00000 n -0000127117 00000 n -0000127162 00000 n -0000127207 00000 n -0000127252 00000 n -0000127297 00000 n -0000127342 00000 n -0000127387 00000 n -0000127432 00000 n -0000127477 00000 n -0000127522 00000 n -0000127567 00000 n -0000127612 00000 n -0000127657 00000 n -0000127702 00000 n -0000127747 00000 n -0000127792 00000 n -0000127837 00000 n -0000127882 00000 n -0000127927 00000 n -0000127972 00000 n -0000128017 00000 n -0000128062 00000 n -0000128107 00000 n -0000128152 00000 n -0000128197 00000 n -0000128242 00000 n -0000128287 00000 n -0000128332 00000 n -0000128377 00000 n -0000128422 00000 n -0000128467 00000 n -0000128512 00000 n -0000128557 00000 n -0000128602 00000 n -0000128647 00000 n -0000128692 00000 n -0000128737 00000 n -0000128782 00000 n -0000128827 00000 n -0000128872 00000 n -0000128917 00000 n -0000128962 00000 n -0000129007 00000 n -0000129052 00000 n -0000129097 00000 n -0000129142 00000 n -0000129187 00000 n -0000129232 00000 n -0000129277 00000 n -0000129322 00000 n -0000129367 00000 n -0000129412 00000 n -0000129457 00000 n -0000129502 00000 n -0000129547 00000 n -0000129592 00000 n -0000129637 00000 n -0000129682 00000 n -0000129727 00000 n -0000129772 00000 n -0000129817 00000 n -0000129862 00000 n -0000129907 00000 n -0000129952 00000 n -0000129997 00000 n -0000130042 00000 n -0000130087 00000 n -0000130132 00000 n -0000130177 00000 n -0000130222 00000 n -0000130267 00000 n -0000130312 00000 n -0000130357 00000 n -0000130402 00000 n -0000130447 00000 n -0000130492 00000 n -0000130537 00000 n -0000130582 00000 n -0000130627 00000 n -0000130672 00000 n -0000130717 00000 n -0000130762 00000 n -0000130807 00000 n -0000130852 00000 n -0000130897 00000 n -0000130942 00000 n -0000130987 00000 n -0000131032 00000 n -0000131077 00000 n -0000131122 00000 n -0000131167 00000 n -0000131212 00000 n -0000131257 00000 n -0000131302 00000 n -0000131347 00000 n -0000131392 00000 n -0000131437 00000 n -0000131482 00000 n -0000131527 00000 n -0000131572 00000 n -0000131617 00000 n -0000131662 00000 n -0000131707 00000 n -0000131752 00000 n -0000131797 00000 n -0000131842 00000 n -0000131887 00000 n -0000131932 00000 n -0000131977 00000 n -0000132022 00000 n -0000132067 00000 n -0000132112 00000 n -0000132157 00000 n -0000132202 00000 n -0000132247 00000 n -0000132292 00000 n -0000132337 00000 n -0000132382 00000 n -0000132427 00000 n -0000132472 00000 n -0000132517 00000 n -0000132562 00000 n -0000132607 00000 n -0000132652 00000 n -0000132697 00000 n -0000132742 00000 n -0000132787 00000 n -0000132832 00000 n -0000132877 00000 n -0000132922 00000 n -0000132967 00000 n -0000134609 00000 n -0000134770 00000 n -0000134939 00000 n -0000135132 00000 n -0000139029 00000 n -0000139223 00000 n -0000143650 00000 n -0000143844 00000 n -0000148198 00000 n -0000148392 00000 n -0000152436 00000 n -0000152630 00000 n -0000156208 00000 n -0000156402 00000 n -0000159997 00000 n -0000160191 00000 n -0000163343 00000 n +0000112278 00000 n +0000112314 00000 n +0000117919 00000 n +0000117964 00000 n +0000118009 00000 n +0000118054 00000 n +0000118099 00000 n +0000118144 00000 n +0000118189 00000 n +0000118234 00000 n +0000118279 00000 n +0000118324 00000 n +0000118369 00000 n +0000118414 00000 n +0000118459 00000 n +0000118504 00000 n +0000118549 00000 n +0000118594 00000 n +0000118639 00000 n +0000118684 00000 n +0000118729 00000 n +0000118774 00000 n +0000118819 00000 n +0000118864 00000 n +0000118909 00000 n +0000118954 00000 n +0000118999 00000 n +0000119044 00000 n +0000119089 00000 n +0000119134 00000 n +0000119179 00000 n +0000119224 00000 n +0000119269 00000 n +0000119314 00000 n +0000119359 00000 n +0000119404 00000 n +0000119449 00000 n +0000119494 00000 n +0000119539 00000 n +0000119584 00000 n +0000119629 00000 n +0000119674 00000 n +0000119719 00000 n +0000119764 00000 n +0000119809 00000 n +0000119854 00000 n +0000119899 00000 n +0000119944 00000 n +0000119989 00000 n +0000120034 00000 n +0000120079 00000 n +0000120124 00000 n +0000120169 00000 n +0000120214 00000 n +0000120259 00000 n +0000120304 00000 n +0000120349 00000 n +0000120394 00000 n +0000120439 00000 n +0000120484 00000 n +0000120529 00000 n +0000120574 00000 n +0000120619 00000 n +0000120664 00000 n +0000120709 00000 n +0000120754 00000 n +0000120799 00000 n +0000120844 00000 n +0000120889 00000 n +0000120934 00000 n +0000120979 00000 n +0000121024 00000 n +0000121069 00000 n +0000121114 00000 n +0000121159 00000 n +0000121204 00000 n +0000121249 00000 n +0000121294 00000 n +0000121339 00000 n +0000121384 00000 n +0000121429 00000 n +0000121474 00000 n +0000121519 00000 n +0000121564 00000 n +0000121609 00000 n +0000121654 00000 n +0000121699 00000 n +0000121744 00000 n +0000121789 00000 n +0000121834 00000 n +0000121879 00000 n +0000121924 00000 n +0000121969 00000 n +0000122014 00000 n +0000122059 00000 n +0000122104 00000 n +0000122149 00000 n +0000122194 00000 n +0000122239 00000 n +0000122284 00000 n +0000122329 00000 n +0000122374 00000 n +0000122419 00000 n +0000122464 00000 n +0000122509 00000 n +0000122554 00000 n +0000122599 00000 n +0000122644 00000 n +0000122689 00000 n +0000122734 00000 n +0000122779 00000 n +0000122824 00000 n +0000122869 00000 n +0000122914 00000 n +0000122959 00000 n +0000123004 00000 n +0000123049 00000 n +0000123094 00000 n +0000123139 00000 n +0000123184 00000 n +0000123229 00000 n +0000123274 00000 n +0000123319 00000 n +0000123364 00000 n +0000123409 00000 n +0000123454 00000 n +0000123499 00000 n +0000123544 00000 n +0000123589 00000 n +0000123634 00000 n +0000123679 00000 n +0000123724 00000 n +0000123769 00000 n +0000123814 00000 n +0000123859 00000 n +0000123904 00000 n +0000123949 00000 n +0000123994 00000 n +0000124039 00000 n +0000124084 00000 n +0000124129 00000 n +0000124174 00000 n +0000124219 00000 n +0000124264 00000 n +0000124309 00000 n +0000124354 00000 n +0000124399 00000 n +0000124444 00000 n +0000124489 00000 n +0000124534 00000 n +0000124579 00000 n +0000124624 00000 n +0000124669 00000 n +0000124714 00000 n +0000124759 00000 n +0000124804 00000 n +0000124849 00000 n +0000124894 00000 n +0000124939 00000 n +0000124984 00000 n +0000125029 00000 n +0000125074 00000 n +0000125119 00000 n +0000125164 00000 n +0000125209 00000 n +0000125254 00000 n +0000125299 00000 n +0000125344 00000 n +0000125389 00000 n +0000125434 00000 n +0000125479 00000 n +0000125524 00000 n +0000125569 00000 n +0000125614 00000 n +0000125659 00000 n +0000125704 00000 n +0000125749 00000 n +0000125794 00000 n +0000125839 00000 n +0000125884 00000 n +0000125929 00000 n +0000125974 00000 n +0000126019 00000 n +0000126064 00000 n +0000126109 00000 n +0000126154 00000 n +0000126199 00000 n +0000126244 00000 n +0000126289 00000 n +0000126334 00000 n +0000126379 00000 n +0000126424 00000 n +0000126469 00000 n +0000126514 00000 n +0000126559 00000 n +0000126604 00000 n +0000126649 00000 n +0000126694 00000 n +0000126739 00000 n +0000126784 00000 n +0000126829 00000 n +0000126874 00000 n +0000126919 00000 n +0000126964 00000 n +0000127009 00000 n +0000127054 00000 n +0000127099 00000 n +0000127144 00000 n +0000127189 00000 n +0000127234 00000 n +0000127279 00000 n +0000127324 00000 n +0000127369 00000 n +0000127414 00000 n +0000127459 00000 n +0000127504 00000 n +0000127549 00000 n +0000127594 00000 n +0000127639 00000 n +0000127684 00000 n +0000127729 00000 n +0000127774 00000 n +0000127819 00000 n +0000127864 00000 n +0000127909 00000 n +0000127954 00000 n +0000127999 00000 n +0000128044 00000 n +0000128089 00000 n +0000128134 00000 n +0000128179 00000 n +0000128224 00000 n +0000128269 00000 n +0000128314 00000 n +0000128359 00000 n +0000128404 00000 n +0000128449 00000 n +0000128494 00000 n +0000128539 00000 n +0000128584 00000 n +0000128629 00000 n +0000128674 00000 n +0000128719 00000 n +0000128764 00000 n +0000128809 00000 n +0000128854 00000 n +0000128899 00000 n +0000128944 00000 n +0000128989 00000 n +0000129034 00000 n +0000129079 00000 n +0000129124 00000 n +0000129169 00000 n +0000129214 00000 n +0000129259 00000 n +0000129304 00000 n +0000129349 00000 n +0000129394 00000 n +0000129439 00000 n +0000129484 00000 n +0000129529 00000 n +0000129574 00000 n +0000129619 00000 n +0000129664 00000 n +0000129709 00000 n +0000129754 00000 n +0000129799 00000 n +0000129844 00000 n +0000129889 00000 n +0000129934 00000 n +0000129979 00000 n +0000130024 00000 n +0000130069 00000 n +0000130114 00000 n +0000130159 00000 n +0000130204 00000 n +0000130249 00000 n +0000130294 00000 n +0000130339 00000 n +0000130384 00000 n +0000130429 00000 n +0000130474 00000 n +0000130519 00000 n +0000130564 00000 n +0000130609 00000 n +0000130654 00000 n +0000130699 00000 n +0000130744 00000 n +0000130789 00000 n +0000130834 00000 n +0000130879 00000 n +0000130924 00000 n +0000130969 00000 n +0000131014 00000 n +0000131059 00000 n +0000131104 00000 n +0000131149 00000 n +0000131194 00000 n +0000131239 00000 n +0000131284 00000 n +0000131329 00000 n +0000131374 00000 n +0000131419 00000 n +0000131464 00000 n +0000131509 00000 n +0000131554 00000 n +0000131599 00000 n +0000131644 00000 n +0000131689 00000 n +0000131734 00000 n +0000131778 00000 n +0000131823 00000 n +0000131868 00000 n +0000131913 00000 n +0000131958 00000 n +0000132003 00000 n +0000132048 00000 n +0000132093 00000 n +0000132138 00000 n +0000132183 00000 n +0000132228 00000 n +0000132273 00000 n +0000132318 00000 n +0000132363 00000 n +0000132408 00000 n +0000132453 00000 n +0000132498 00000 n +0000132543 00000 n +0000132588 00000 n +0000134212 00000 n +0000134373 00000 n +0000134542 00000 n +0000134735 00000 n +0000138632 00000 n +0000138826 00000 n +0000143256 00000 n +0000143450 00000 n +0000147800 00000 n +0000147994 00000 n +0000151993 00000 n +0000152187 00000 n +0000155810 00000 n +0000156004 00000 n +0000159812 00000 n +0000160006 00000 n +0000162906 00000 n +0000163067 00000 n +0000163301 00000 n 0000163504 00000 n -0000163738 00000 n -0000163941 00000 n -0000166521 00000 n -0000166696 00000 n -0000170340 00000 n -0000170515 00000 n -0000173018 00000 n -0000173193 00000 n -0000174969 00000 n -0000175130 00000 n -0000175318 00000 n -0000175521 00000 n -0000178152 00000 n -0000178327 00000 n -0000178592 00000 n -0000178795 00000 n -0000180229 00000 n -0000180446 00000 n -0000181900 00000 n -0000182097 00000 n -0000183949 00000 n -0000184109 00000 n -0000184604 00000 n -0000184774 00000 n -0000186514 00000 n -0000186702 00000 n -0000188191 00000 n -0000188370 00000 n -0000190346 00000 n -0000190525 00000 n -0000191467 00000 n -0000191696 00000 n -0000193565 00000 n -0000193762 00000 n -0000195301 00000 n -0000195498 00000 n -0000196994 00000 n -0000197217 00000 n -0000199386 00000 n -0000199589 00000 n -0000201482 00000 n -0000201696 00000 n -0000202997 00000 n -0000203229 00000 n -0000204902 00000 n -0000205115 00000 n -0000207019 00000 n -0000207227 00000 n -0000208505 00000 n -0000208744 00000 n -0000210263 00000 n -0000210451 00000 n -0000211763 00000 n -0000211951 00000 n -0000212498 00000 n -0000212659 00000 n -0000212849 00000 n -0000213052 00000 n -0000216173 00000 n -0000216348 00000 n -0000216696 00000 n -0000216885 00000 n -0000218508 00000 n -0000218696 00000 n -0000220068 00000 n -0000220238 00000 n -0000222193 00000 n -0000222353 00000 n -0000223034 00000 n -0000223247 00000 n -0000224669 00000 n -0000224883 00000 n -0000226452 00000 n -0000226650 00000 n -0000228572 00000 n -0000228837 00000 n -0000230548 00000 n -0000230761 00000 n -0000232329 00000 n -0000232536 00000 n -0000234565 00000 n -0000234797 00000 n -0000236825 00000 n -0000237038 00000 n -0000239006 00000 n -0000239218 00000 n -0000241199 00000 n -0000241453 00000 n -0000243716 00000 n -0000243946 00000 n -0000245991 00000 n -0000246222 00000 n -0000248131 00000 n -0000248342 00000 n -0000250218 00000 n -0000250387 00000 n -0000252226 00000 n -0000252448 00000 n -0000254446 00000 n -0000254697 00000 n -0000256661 00000 n -0000256830 00000 n -0000258360 00000 n -0000258554 00000 n -0000260133 00000 n -0000260313 00000 n -0000262054 00000 n -0000262243 00000 n -0000263444 00000 n -0000263623 00000 n -0000264712 00000 n -0000264909 00000 n -0000266280 00000 n -0000266459 00000 n -0000267185 00000 n -0000267417 00000 n -0000268891 00000 n -0000269094 00000 n -0000270903 00000 n -0000271087 00000 n -0000271622 00000 n -0000271783 00000 n -0000271974 00000 n -0000272186 00000 n -0000275133 00000 n -0000275308 00000 n -0000277928 00000 n -0000278103 00000 n -0000279934 00000 n -0000280132 00000 n -0000281493 00000 n -0000281691 00000 n -0000283380 00000 n -0000283568 00000 n -0000285250 00000 n -0000285429 00000 n -0000287531 00000 n -0000287710 00000 n -0000289483 00000 n -0000289662 00000 n -0000291343 00000 n -0000291532 00000 n -0000293380 00000 n -0000293593 00000 n -0000295624 00000 n -0000295837 00000 n -0000297389 00000 n -0000297578 00000 n -0000298852 00000 n -0000299059 00000 n -0000300832 00000 n -0000301030 00000 n -0000302793 00000 n -0000303006 00000 n -0000304714 00000 n -0000304917 00000 n -0000306297 00000 n -0000306486 00000 n -0000307375 00000 n -0000307563 00000 n -0000309089 00000 n -0000309292 00000 n -0000311000 00000 n -0000311203 00000 n -0000312020 00000 n -0000312233 00000 n -0000313719 00000 n -0000313899 00000 n -0000314663 00000 n -0000314927 00000 n -0000316651 00000 n -0000316897 00000 n -0000318788 00000 n -0000319011 00000 n -0000320801 00000 n -0000321024 00000 n -0000322899 00000 n -0000323078 00000 n -0000324302 00000 n -0000324534 00000 n -0000326203 00000 n -0000326382 00000 n -0000327962 00000 n -0000328141 00000 n -0000329688 00000 n -0000329867 00000 n -0000331371 00000 n -0000331550 00000 n -0000333215 00000 n -0000333385 00000 n -0000334131 00000 n -0000334329 00000 n -0000336147 00000 n -0000336380 00000 n -0000338436 00000 n -0000338625 00000 n -0000340281 00000 n -0000340451 00000 n -0000341213 00000 n -0000341383 00000 n -0000342488 00000 n -0000342658 00000 n -0000343478 00000 n -0000343648 00000 n -0000344465 00000 n -0000344635 00000 n -0000345797 00000 n -0000346020 00000 n -0000347673 00000 n -0000347899 00000 n -0000349582 00000 n -0000349827 00000 n -0000351718 00000 n -0000351887 00000 n -0000353633 00000 n -0000353818 00000 n -0000355568 00000 n -0000355824 00000 n -0000357801 00000 n -0000358000 00000 n -0000360224 00000 n -0000360435 00000 n -0000362202 00000 n -0000362403 00000 n -0000363421 00000 n -0000363610 00000 n -0000365304 00000 n -0000365483 00000 n -0000367228 00000 n -0000367416 00000 n -0000369252 00000 n -0000369447 00000 n -0000371359 00000 n -0000371591 00000 n -0000373693 00000 n -0000373906 00000 n -0000375343 00000 n -0000375557 00000 n -0000377006 00000 n -0000377213 00000 n -0000378450 00000 n -0000378629 00000 n -0000379616 00000 n -0000379804 00000 n -0000380936 00000 n -0000381124 00000 n -0000382625 00000 n -0000382813 00000 n -0000383895 00000 n -0000384084 00000 n -0000385416 00000 n -0000385586 00000 n -0000387260 00000 n -0000387439 00000 n -0000389223 00000 n -0000389402 00000 n -0000391047 00000 n -0000391216 00000 n -0000392530 00000 n -0000392718 00000 n -0000394284 00000 n -0000394472 00000 n -0000396091 00000 n -0000396279 00000 n -0000397679 00000 n -0000397849 00000 n -0000399482 00000 n -0000399652 00000 n -0000400665 00000 n -0000400862 00000 n -0000402073 00000 n -0000402277 00000 n -0000403623 00000 n -0000403809 00000 n -0000404285 00000 n -0000404473 00000 n -0000405961 00000 n -0000406131 00000 n -0000407638 00000 n -0000407808 00000 n -0000409207 00000 n -0000409377 00000 n -0000410926 00000 n -0000411095 00000 n -0000412058 00000 n -0000412279 00000 n -0000413813 00000 n -0000414034 00000 n -0000415641 00000 n -0000415863 00000 n -0000417113 00000 n -0000417292 00000 n -0000418837 00000 n -0000419016 00000 n -0000420253 00000 n -0000420457 00000 n -0000421869 00000 n -0000422064 00000 n -0000424693 00000 n -0000424869 00000 n -0000425319 00000 n -0000425498 00000 n -0000427026 00000 n -0000427214 00000 n -0000428182 00000 n -0000428352 00000 n -0000428682 00000 n -0000428878 00000 n -0000430608 00000 n -0000430822 00000 n -0000432506 00000 n -0000432701 00000 n -0000434408 00000 n -0000434621 00000 n -0000436109 00000 n -0000436304 00000 n -0000437886 00000 n -0000438109 00000 n -0000439474 00000 n -0000439671 00000 n -0000441208 00000 n -0000441396 00000 n -0000442275 00000 n -0000442479 00000 n -0000444215 00000 n -0000444403 00000 n -0000446145 00000 n -0000446324 00000 n -0000447723 00000 n -0000447902 00000 n -0000449600 00000 n -0000449779 00000 n -0000451259 00000 n -0000451438 00000 n -0000453224 00000 n -0000453428 00000 n -0000455079 00000 n -0000455138 00000 n -0000455241 00000 n -0000455406 00000 n -0000455488 00000 n -0000455596 00000 n -0000455719 00000 n -0000455831 00000 n -0000456009 00000 n -0000456130 00000 n -0000456290 00000 n -0000456408 00000 n -0000456505 00000 n -0000456657 00000 n -0000456797 00000 n -0000456975 00000 n -0000457130 00000 n -0000457232 00000 n -0000457332 00000 n -0000457541 00000 n -0000457642 00000 n -0000457785 00000 n -0000457931 00000 n +0000166084 00000 n +0000166268 00000 n +0000169848 00000 n +0000170023 00000 n +0000172517 00000 n +0000172692 00000 n +0000174374 00000 n +0000174535 00000 n +0000174723 00000 n +0000174926 00000 n +0000177557 00000 n +0000177732 00000 n +0000177997 00000 n +0000178200 00000 n +0000179634 00000 n +0000179851 00000 n +0000181305 00000 n +0000181502 00000 n +0000183354 00000 n +0000183514 00000 n +0000184009 00000 n +0000184179 00000 n +0000185919 00000 n +0000186107 00000 n +0000187596 00000 n +0000187775 00000 n +0000189751 00000 n +0000189930 00000 n +0000190872 00000 n +0000191101 00000 n +0000192970 00000 n +0000193167 00000 n +0000194706 00000 n +0000194903 00000 n +0000196399 00000 n +0000196622 00000 n +0000198791 00000 n +0000198994 00000 n +0000200887 00000 n +0000201101 00000 n +0000202402 00000 n +0000202634 00000 n +0000204307 00000 n +0000204520 00000 n +0000206424 00000 n +0000206632 00000 n +0000207910 00000 n +0000208149 00000 n +0000209668 00000 n +0000209856 00000 n +0000211168 00000 n +0000211356 00000 n +0000211903 00000 n +0000212064 00000 n +0000212254 00000 n +0000212466 00000 n +0000215515 00000 n +0000215704 00000 n +0000217327 00000 n +0000217515 00000 n +0000218887 00000 n +0000219057 00000 n +0000221012 00000 n +0000221172 00000 n +0000221853 00000 n +0000222066 00000 n +0000223488 00000 n +0000223702 00000 n +0000225271 00000 n +0000225469 00000 n +0000227391 00000 n +0000227656 00000 n +0000229367 00000 n +0000229580 00000 n +0000231148 00000 n +0000231355 00000 n +0000233384 00000 n +0000233616 00000 n +0000235644 00000 n +0000235857 00000 n +0000237825 00000 n +0000238037 00000 n +0000240018 00000 n +0000240272 00000 n +0000242535 00000 n +0000242765 00000 n +0000244810 00000 n +0000245041 00000 n +0000246950 00000 n +0000247161 00000 n +0000249037 00000 n +0000249206 00000 n +0000251045 00000 n +0000251267 00000 n +0000253265 00000 n +0000253516 00000 n +0000255480 00000 n +0000255649 00000 n +0000257180 00000 n +0000257374 00000 n +0000258953 00000 n +0000259133 00000 n +0000260874 00000 n +0000261063 00000 n +0000262264 00000 n +0000262461 00000 n +0000263778 00000 n +0000263966 00000 n +0000264835 00000 n +0000265067 00000 n +0000266490 00000 n +0000266725 00000 n +0000268641 00000 n +0000268802 00000 n +0000268993 00000 n +0000269205 00000 n +0000272152 00000 n +0000272327 00000 n +0000274947 00000 n +0000275122 00000 n +0000276953 00000 n +0000277151 00000 n +0000278513 00000 n +0000278711 00000 n +0000280400 00000 n +0000280588 00000 n +0000282270 00000 n +0000282449 00000 n +0000284550 00000 n +0000284729 00000 n +0000286502 00000 n +0000286681 00000 n +0000288362 00000 n +0000288551 00000 n +0000290399 00000 n +0000290612 00000 n +0000292643 00000 n +0000292856 00000 n +0000294408 00000 n +0000294597 00000 n +0000295870 00000 n +0000296077 00000 n +0000297826 00000 n +0000298024 00000 n +0000299752 00000 n +0000299965 00000 n +0000301652 00000 n +0000301865 00000 n +0000303414 00000 n +0000303583 00000 n +0000304163 00000 n +0000304351 00000 n +0000305877 00000 n +0000306080 00000 n +0000307788 00000 n +0000307991 00000 n +0000308808 00000 n +0000309021 00000 n +0000310507 00000 n +0000310687 00000 n +0000311450 00000 n +0000311714 00000 n +0000313438 00000 n +0000313684 00000 n +0000315575 00000 n +0000315798 00000 n +0000317588 00000 n +0000317811 00000 n +0000319686 00000 n +0000319865 00000 n +0000321089 00000 n +0000321321 00000 n +0000322990 00000 n +0000323169 00000 n +0000324749 00000 n +0000324928 00000 n +0000326473 00000 n +0000326652 00000 n +0000328156 00000 n +0000328335 00000 n +0000330001 00000 n +0000330171 00000 n +0000330917 00000 n +0000331115 00000 n +0000332933 00000 n +0000333166 00000 n +0000335221 00000 n +0000335410 00000 n +0000337066 00000 n +0000337236 00000 n +0000337998 00000 n +0000338168 00000 n +0000339273 00000 n +0000339443 00000 n +0000340263 00000 n +0000340433 00000 n +0000341250 00000 n +0000341420 00000 n +0000342582 00000 n +0000342805 00000 n +0000344459 00000 n +0000344685 00000 n +0000346367 00000 n +0000346612 00000 n +0000348503 00000 n +0000348672 00000 n +0000350418 00000 n +0000350602 00000 n +0000352352 00000 n +0000352608 00000 n +0000354585 00000 n +0000354784 00000 n +0000357007 00000 n +0000357218 00000 n +0000358986 00000 n +0000359187 00000 n +0000360205 00000 n +0000360394 00000 n +0000362087 00000 n +0000362266 00000 n +0000364011 00000 n +0000364199 00000 n +0000366035 00000 n +0000366229 00000 n +0000368141 00000 n +0000368373 00000 n +0000370477 00000 n +0000370690 00000 n +0000372127 00000 n +0000372341 00000 n +0000373790 00000 n +0000373997 00000 n +0000375234 00000 n +0000375413 00000 n +0000376400 00000 n +0000376588 00000 n +0000377720 00000 n +0000377908 00000 n +0000379409 00000 n +0000379597 00000 n +0000380680 00000 n +0000380869 00000 n +0000382202 00000 n +0000382372 00000 n +0000384046 00000 n +0000384225 00000 n +0000386009 00000 n +0000386188 00000 n +0000387833 00000 n +0000388002 00000 n +0000389317 00000 n +0000389505 00000 n +0000391071 00000 n +0000391259 00000 n +0000392878 00000 n +0000393066 00000 n +0000394465 00000 n +0000394635 00000 n +0000396269 00000 n +0000396439 00000 n +0000397452 00000 n +0000397649 00000 n +0000398860 00000 n +0000399064 00000 n +0000400410 00000 n +0000400596 00000 n +0000401072 00000 n +0000401260 00000 n +0000402750 00000 n +0000402920 00000 n +0000404427 00000 n +0000404597 00000 n +0000405996 00000 n +0000406166 00000 n +0000407716 00000 n +0000407885 00000 n +0000408848 00000 n +0000409069 00000 n +0000410603 00000 n +0000410824 00000 n +0000412430 00000 n +0000412652 00000 n +0000413901 00000 n +0000414080 00000 n +0000415625 00000 n +0000415804 00000 n +0000417041 00000 n +0000417245 00000 n +0000418655 00000 n +0000418850 00000 n +0000421553 00000 n +0000421729 00000 n +0000422199 00000 n +0000422378 00000 n +0000423906 00000 n +0000424094 00000 n +0000425062 00000 n +0000425232 00000 n +0000425563 00000 n +0000425759 00000 n +0000427488 00000 n +0000427702 00000 n +0000429386 00000 n +0000429581 00000 n +0000431288 00000 n +0000431501 00000 n +0000432989 00000 n +0000433184 00000 n +0000434766 00000 n +0000434989 00000 n +0000436353 00000 n +0000436541 00000 n +0000437709 00000 n +0000437906 00000 n +0000439456 00000 n +0000439644 00000 n +0000440288 00000 n +0000440492 00000 n +0000442228 00000 n +0000442416 00000 n +0000444159 00000 n +0000444338 00000 n +0000445736 00000 n +0000445915 00000 n +0000447613 00000 n +0000447792 00000 n +0000449273 00000 n +0000449452 00000 n +0000451238 00000 n +0000451442 00000 n +0000453091 00000 n +0000453150 00000 n +0000453253 00000 n +0000453418 00000 n +0000453500 00000 n +0000453608 00000 n +0000453731 00000 n +0000453843 00000 n +0000454021 00000 n +0000454142 00000 n +0000454302 00000 n +0000454420 00000 n +0000454517 00000 n +0000454669 00000 n +0000454809 00000 n +0000454987 00000 n +0000455142 00000 n +0000455244 00000 n +0000455344 00000 n +0000455553 00000 n +0000455654 00000 n +0000455797 00000 n +0000455943 00000 n +0000456059 00000 n +0000456226 00000 n +0000456338 00000 n +0000456512 00000 n +0000456615 00000 n +0000456788 00000 n +0000456909 00000 n +0000457039 00000 n +0000457165 00000 n +0000457280 00000 n +0000457388 00000 n +0000457535 00000 n +0000457640 00000 n +0000457759 00000 n +0000457888 00000 n 0000458047 00000 n -0000458214 00000 n -0000458326 00000 n -0000458500 00000 n -0000458603 00000 n -0000458776 00000 n -0000458897 00000 n -0000459027 00000 n -0000459153 00000 n -0000459268 00000 n -0000459376 00000 n -0000459523 00000 n -0000459628 00000 n -0000459747 00000 n -0000459876 00000 n -0000460035 00000 n -0000460169 00000 n -0000460306 00000 n -0000460438 00000 n -0000460587 00000 n -0000460719 00000 n -0000460867 00000 n -0000460968 00000 n -0000461096 00000 n -0000461214 00000 n -0000461368 00000 n -0000461499 00000 n -0000461645 00000 n -0000461746 00000 n -0000461844 00000 n -0000461968 00000 n -0000462080 00000 n -0000462257 00000 n -0000462366 00000 n -0000462491 00000 n -0000462637 00000 n -0000462739 00000 n -0000462911 00000 n -0000463110 00000 n -0000463221 00000 n -0000463336 00000 n -0000463480 00000 n -0000463688 00000 n -0000463822 00000 n -0000463976 00000 n -0000464101 00000 n -0000464232 00000 n -0000464365 00000 n -0000464496 00000 n -0000464671 00000 n -0000464806 00000 n -0000464959 00000 n -0000465104 00000 n -0000465329 00000 n -0000465440 00000 n -0000465555 00000 n -0000465748 00000 n -0000465891 00000 n -0000466007 00000 n -0000466165 00000 n -0000466322 00000 n -0000466453 00000 n -0000466574 00000 n -0000466751 00000 n -0000466885 00000 n -0000467033 00000 n -0000467151 00000 n -0000467281 00000 n -0000467451 00000 n -0000467545 00000 n -0000467672 00000 n -0000467799 00000 n -0000467895 00000 n -0000468081 00000 n -0000468207 00000 n -0000468342 00000 n -0000468475 00000 n -0000468602 00000 n -0000468714 00000 n -0000468906 00000 n -0000469004 00000 n -0000469190 00000 n -0000469294 00000 n -0000469418 00000 n -0000469540 00000 n -0000469652 00000 n -0000469848 00000 n -0000469964 00000 n -0000470088 00000 n -0000470206 00000 n -0000470324 00000 n -0000470429 00000 n -0000470618 00000 n -0000470841 00000 n -0000470980 00000 n -0000471143 00000 n -0000471280 00000 n -0000471383 00000 n -0000471589 00000 n -0000471748 00000 n -0000471896 00000 n -0000472024 00000 n -0000472205 00000 n -0000472315 00000 n -0000472430 00000 n -0000472575 00000 n -0000472739 00000 n -0000472889 00000 n -0000473107 00000 n -0000473212 00000 n -0000473344 00000 n -0000473465 00000 n -0000473672 00000 n -0000473800 00000 n -0000473885 00000 n -0000474051 00000 n -0000474155 00000 n -0000474312 00000 n -0000474423 00000 n -0000474568 00000 n -0000474710 00000 n -0000474860 00000 n -0000474977 00000 n -0000475141 00000 n -0000475252 00000 n -0000475392 00000 n -0000475519 00000 n -0000475636 00000 n -0000475775 00000 n -0000475881 00000 n -0000476015 00000 n -0000476147 00000 n -0000476292 00000 n -0000476419 00000 n -0000476551 00000 n -0000476681 00000 n -0000476806 00000 n -0000476914 00000 n -0000477085 00000 n -0000477189 00000 n -0000477324 00000 n -0000477452 00000 n -0000477626 00000 n -0000477728 00000 n -0000477878 00000 n -0000478028 00000 n -0000478153 00000 n -0000478359 00000 n -0000478459 00000 n -0000478577 00000 n -0000478742 00000 n -0000478833 00000 n -0000478994 00000 n -0000479120 00000 n -0000479263 00000 n -0000479390 00000 n -0000479530 00000 n -0000479666 00000 n -0000479774 00000 n -0000479948 00000 n -0000480054 00000 n -0000480174 00000 n -0000480286 00000 n -0000480403 00000 n -0000480505 00000 n -0000480682 00000 n -0000480794 00000 n -0000480925 00000 n -0000481049 00000 n -0000481216 00000 n -0000481333 00000 n -0000481463 00000 n -0000481603 00000 n -0000481740 00000 n -0000481876 00000 n -0000482012 00000 n -0000482149 00000 n -0000482261 00000 n -0000482432 00000 n -0000482554 00000 n -0000482714 00000 n -0000482813 00000 n -0000482928 00000 n -0000483030 00000 n -0000483191 00000 n -0000483295 00000 n -0000483394 00000 n -0000483525 00000 n -0000483700 00000 n -0000483803 00000 n -0000483923 00000 n -0000484038 00000 n -0000484152 00000 n -0000484267 00000 n -0000484381 00000 n -0000484496 00000 n -0000484614 00000 n -0000484731 00000 n -0000484837 00000 n -0000485015 00000 n -0000485118 00000 n -0000485274 00000 n -0000485382 00000 n -0000485508 00000 n -0000485628 00000 n -0000485729 00000 n -0000485836 00000 n -0000486000 00000 n -0000486104 00000 n -0000486237 00000 n -0000486369 00000 n -0000486491 00000 n -0000486620 00000 n -0000486727 00000 n -0000486893 00000 n -0000487015 00000 n -0000487125 00000 n -0000487239 00000 n -0000487400 00000 n -0000487496 00000 n -0000487610 00000 n -0000487720 00000 n -0000487851 00000 n -0000487984 00000 n -0000488085 00000 n -0000488263 00000 n -0000488373 00000 n -0000488527 00000 n -0000488696 00000 n -0000488884 00000 n -0000489065 00000 n -0000489221 00000 n -0000489387 00000 n -0000489519 00000 n -0000489666 00000 n -0000489805 00000 n -0000489939 00000 n -0000490063 00000 n -0000490184 00000 n -0000490303 00000 n -0000490473 00000 n -0000490635 00000 n -0000490741 00000 n -0000490858 00000 n -0000491009 00000 n -0000491136 00000 n -0000491292 00000 n -0000491410 00000 n -0000491540 00000 n -0000491704 00000 n -0000491808 00000 n -0000491926 00000 n -0000492044 00000 n -0000492165 00000 n -0000492301 00000 n -0000492400 00000 n -0000492555 00000 n -0000492659 00000 n -0000492776 00000 n -0000492926 00000 n -0000493026 00000 n -0000493140 00000 n -0000493254 00000 n -0000493368 00000 n -0000493482 00000 n -0000493596 00000 n -0000493710 00000 n -0000493824 00000 n -0000493938 00000 n -0000494054 00000 n -0000494156 00000 n -0000494270 00000 n +0000458181 00000 n +0000458318 00000 n +0000458450 00000 n +0000458599 00000 n +0000458731 00000 n +0000458879 00000 n +0000458980 00000 n +0000459108 00000 n +0000459226 00000 n +0000459380 00000 n +0000459511 00000 n +0000459657 00000 n +0000459758 00000 n +0000459856 00000 n +0000459980 00000 n +0000460092 00000 n +0000460269 00000 n +0000460378 00000 n +0000460503 00000 n +0000460649 00000 n +0000460751 00000 n +0000460923 00000 n +0000461122 00000 n +0000461233 00000 n +0000461348 00000 n +0000461492 00000 n +0000461700 00000 n +0000461834 00000 n +0000461988 00000 n +0000462113 00000 n +0000462244 00000 n +0000462377 00000 n +0000462508 00000 n +0000462683 00000 n +0000462818 00000 n +0000462971 00000 n +0000463116 00000 n +0000463341 00000 n +0000463452 00000 n +0000463567 00000 n +0000463760 00000 n +0000463903 00000 n +0000464019 00000 n +0000464177 00000 n +0000464334 00000 n +0000464465 00000 n +0000464586 00000 n +0000464763 00000 n +0000464873 00000 n +0000465003 00000 n +0000465173 00000 n +0000465267 00000 n +0000465394 00000 n +0000465521 00000 n +0000465617 00000 n +0000465803 00000 n +0000465929 00000 n +0000466062 00000 n +0000466189 00000 n +0000466301 00000 n +0000466493 00000 n +0000466591 00000 n +0000466777 00000 n +0000466881 00000 n +0000467005 00000 n +0000467127 00000 n +0000467239 00000 n +0000467435 00000 n +0000467551 00000 n +0000467675 00000 n +0000467793 00000 n +0000467911 00000 n +0000468016 00000 n +0000468205 00000 n +0000468428 00000 n +0000468567 00000 n +0000468730 00000 n +0000468867 00000 n +0000468970 00000 n +0000469176 00000 n +0000469335 00000 n +0000469483 00000 n +0000469611 00000 n +0000469792 00000 n +0000469902 00000 n +0000470017 00000 n +0000470162 00000 n +0000470326 00000 n +0000470476 00000 n +0000470694 00000 n +0000470799 00000 n +0000470931 00000 n +0000471052 00000 n +0000471259 00000 n +0000471387 00000 n +0000471472 00000 n +0000471638 00000 n +0000471742 00000 n +0000471899 00000 n +0000472010 00000 n +0000472155 00000 n +0000472297 00000 n +0000472447 00000 n +0000472564 00000 n +0000472728 00000 n +0000472839 00000 n +0000472979 00000 n +0000473106 00000 n +0000473223 00000 n +0000473362 00000 n +0000473468 00000 n +0000473602 00000 n +0000473734 00000 n +0000473879 00000 n +0000474006 00000 n +0000474138 00000 n +0000474268 00000 n +0000474393 00000 n +0000474501 00000 n +0000474672 00000 n +0000474776 00000 n +0000474911 00000 n +0000475039 00000 n +0000475213 00000 n +0000475315 00000 n +0000475465 00000 n +0000475615 00000 n +0000475740 00000 n +0000475946 00000 n +0000476046 00000 n +0000476164 00000 n +0000476329 00000 n +0000476420 00000 n +0000476581 00000 n +0000476707 00000 n +0000476850 00000 n +0000476977 00000 n +0000477117 00000 n +0000477253 00000 n +0000477361 00000 n +0000477535 00000 n +0000477641 00000 n +0000477761 00000 n +0000477873 00000 n +0000477990 00000 n +0000478092 00000 n +0000478269 00000 n +0000478381 00000 n +0000478512 00000 n +0000478636 00000 n +0000478803 00000 n +0000478920 00000 n +0000479050 00000 n +0000479190 00000 n +0000479327 00000 n +0000479463 00000 n +0000479599 00000 n +0000479736 00000 n +0000479848 00000 n +0000480019 00000 n +0000480141 00000 n +0000480301 00000 n +0000480400 00000 n +0000480515 00000 n +0000480617 00000 n +0000480778 00000 n +0000480882 00000 n +0000480981 00000 n +0000481112 00000 n +0000481287 00000 n +0000481390 00000 n +0000481510 00000 n +0000481625 00000 n +0000481739 00000 n +0000481854 00000 n +0000481968 00000 n +0000482083 00000 n +0000482201 00000 n +0000482318 00000 n +0000482424 00000 n +0000482602 00000 n +0000482705 00000 n +0000482861 00000 n +0000482969 00000 n +0000483095 00000 n +0000483215 00000 n +0000483316 00000 n +0000483423 00000 n +0000483587 00000 n +0000483691 00000 n +0000483824 00000 n +0000483956 00000 n +0000484078 00000 n +0000484207 00000 n +0000484314 00000 n +0000484480 00000 n +0000484602 00000 n +0000484712 00000 n +0000484826 00000 n +0000484987 00000 n +0000485083 00000 n +0000485197 00000 n +0000485307 00000 n +0000485438 00000 n +0000485571 00000 n +0000485672 00000 n +0000485850 00000 n +0000485960 00000 n +0000486114 00000 n +0000486283 00000 n +0000486471 00000 n +0000486652 00000 n +0000486808 00000 n +0000486974 00000 n +0000487106 00000 n +0000487253 00000 n +0000487392 00000 n +0000487526 00000 n +0000487650 00000 n +0000487771 00000 n +0000487890 00000 n +0000488060 00000 n +0000488222 00000 n +0000488328 00000 n +0000488445 00000 n +0000488596 00000 n +0000488761 00000 n +0000488886 00000 n +0000489042 00000 n +0000489160 00000 n +0000489290 00000 n +0000489454 00000 n +0000489558 00000 n +0000489676 00000 n +0000489794 00000 n +0000489915 00000 n +0000490051 00000 n +0000490150 00000 n +0000490305 00000 n +0000490409 00000 n +0000490526 00000 n +0000490676 00000 n +0000490776 00000 n +0000490890 00000 n +0000491004 00000 n +0000491118 00000 n +0000491232 00000 n +0000491346 00000 n +0000491460 00000 n +0000491574 00000 n +0000491688 00000 n +0000491804 00000 n +0000491906 00000 n +0000492020 00000 n trailer -<<44d39a97f681ab9eaa30845c7407c375>]>> +<<1e4bf6963641260076121f20f04b0c49>]>> startxref -495224 +492974 %%EOF diff --git a/docs/docbook/projdoc/ADS-HOWTO.sgml b/docs/docbook/projdoc/ADS-HOWTO.sgml index 887ecd74c2..a98fe14e31 100644 --- a/docs/docbook/projdoc/ADS-HOWTO.sgml +++ b/docs/docbook/projdoc/ADS-HOWTO.sgml @@ -14,67 +14,10 @@ This is a rough guide to setting up Samba 3.0 with kerberos authentication again Windows2000 KDC. -Pieces you need before you begin: - - -a Windows 2000 server. -samba 3.0 or higher. -the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work. -the OpenLDAP development libraries. - - - - -Installing the required packages for Debian - -On Debian you need to install the following packages: - - -libkrb5-dev -krb5-user - - - - - -Installing the required packages for RedHat - -On RedHat this means you should have at least: - - -krb5-workstation (for kinit) -krb5-libs (for linking with) -krb5-devel (because you are compiling from source) - - - -in addition to the standard development environment. - -Note that these are not standard on a RedHat install, and you may need -to get them off CD2. - - - -Compile Samba -If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR. +Setup your <filename>smb.conf</filename> -After you run configure make sure that include/config.h it - generates contains - lines like this: - - -#define HAVE_KRB5 1 -#define HAVE_LDAP 1 - - -If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it. - -Then compile and install Samba as usual. You must use at least the - following 3 options in smb.conf: +You must use at least the following 3 options in smb.conf: realm = YOUR.KERBEROS.REALM @@ -93,13 +36,13 @@ In case samba can't figure out your ads server using your realm name, use the You do *not* need a smbpasswd file, and older clients will be authenticated as if "security = domain", although it won't do any harm and allows you to have local users not in the domain. - I expect that the above - required options will change soon when we get better active - directory integration. - + I expect that the above required options will change soon when we get better + active directory integration. + + -Setup your /etc/krb5.conf +Setup your <filename>/etc/krb5.conf</filename> The minimal configuration for krb5.conf is: @@ -187,12 +130,11 @@ specify the -k option to choose kerberos authentication. Notes -You must change administrator password at least once after DC install, - to create the right encoding types +You must change administrator password at least once after DC +install, to create the right encoding types w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs? - diff --git a/docs/docbook/projdoc/Compiling.sgml b/docs/docbook/projdoc/Compiling.sgml index 49aafebec0..ac98f34a32 100644 --- a/docs/docbook/projdoc/Compiling.sgml +++ b/docs/docbook/projdoc/Compiling.sgml @@ -217,6 +217,64 @@ on this system just substitute the correct package name if you find this version a disaster! + + + Compiling samba with Active Directory support + + In order to compile samba with ADS support, you need to have installed + on your system: + + the MIT kerberos development libraries (either install from the sources or use a package). The heimdal libraries will not work. + the OpenLDAP development libraries. + + + If your kerberos libraries are in a non-standard location then + remember to add the configure option --with-krb5=DIR. + + After you run configure make sure that include/config.h it generates contains lines like this: + + +#define HAVE_KRB5 1 +#define HAVE_LDAP 1 + + + If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure out why and fix + it. + + + Installing the required packages for Debian + + On Debian you need to install the following packages: + + + libkrb5-dev + krb5-user + + + + + + Installing the required packages for RedHat + + On RedHat this means you should have at least: + + + krb5-workstation (for kinit) + krb5-libs (for linking with) + krb5-devel (because you are compiling from source) + + + + in addition to the standard development environment. + + Note that these are not standard on a RedHat install, and you may need + to get them off CD2. + + + + + diff --git a/docs/docbook/projdoc/DOMAIN_MEMBER.sgml b/docs/docbook/projdoc/DOMAIN_MEMBER.sgml index b178bfd2c2..8ac3520384 100644 --- a/docs/docbook/projdoc/DOMAIN_MEMBER.sgml +++ b/docs/docbook/projdoc/DOMAIN_MEMBER.sgml @@ -45,9 +45,7 @@ security = line in the [global] section of your smb.conf to read: - security = domain or - security = ads depending on if the PDC is - NT4 or running Active Directory respectivly. + security = domain Next change the workgroup = line in the [global] section to read: @@ -86,7 +84,7 @@ In order to actually join the domain, you must run this command: - root# net join -S DOMPDC + root# net rpc join -S DOMPDC -UAdministrator%password as we are joining the domain DOM and the PDC for that domain @@ -123,19 +121,6 @@ clients to begin using domain security! - -Samba and Windows 2000 Domains - - - -Many people have asked regarding the state of Samba's ability to participate in -a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows -2000 domain operating in mixed or native mode. The steps above apply -to both NT4 and Windows 2000. - - - - Why is this better than security = server? @@ -178,11 +163,11 @@ to both NT4 and Windows 2000. reply, the Samba server gets the user identification information such as the user SID, the list of NT groups the user belongs to, etc. - NOTE: Much of the text of this document + Much of the text of this document was first published in the Web magazine LinuxWorld as the article Doing - the NIS/NT Samba. + the NIS/NT Samba. diff --git a/docs/docs-status b/docs/docs-status index 28b88f428f..7b1eaa4bfd 100644 --- a/docs/docs-status +++ b/docs/docs-status @@ -1,6 +1,7 @@ If you'd like to work on any of these, please contact jerry@samba.org or jelmer@samba.org. Outdated docs: +Manifest docs/announce - out of date (announces 2.2.0) - should it go away? docs/history - needs updating (is current up to 1998 - merge with 10year.html ?) docs/docbook/manpages/net.8.sgml - Still not finished @@ -8,8 +9,6 @@ docs/docbook/manpages/rpcclient.1.sgml - Command documentation might be outdated docs/docbook/manpages/samba.7.sgml - Listing of samba programs is not complete docs/docbook/manpages/smbcontrol.1.sgml - Document -s, samsync, samrepl, pool-usage, dmalloc-mark, dmalloc-log-changed, shutdown, change_id docs/docbook/manpages/smb.conf.5.sgml - 'restrict anonymous' isn't documented properly -docs/docbook/projdoc/DOMAIN_MEMBER.sgml - Needs update to 3.0 -docs/docbook/projdoc/ADS-HOWTO.sgml - seems outdated (it says we require 'ads server' when in ads mode, though that's not true, according to the manpages...) docs/docbook/projdoc/Integrating-with-Windows.sgml - Should slowly go a way. Contains a little bit information about wins, a little bit about domain membership, a little about winbind, etc docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml docs/docbook/projdoc/Printing.sgml - Cups is not documented, smbprint, printing /to/ a windows server... - Kurt Pfeifle diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index d9125d5aad..ea080fbd79 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -353,42 +353,38 @@ HREF="#ADS" >

11.1. Viewing and changing UNIX permissions using the NT security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask parameters
11.7. Interaction with the standard Samba file attribute mapping
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13.1. Instructions
14.1. Introduction
14.2. Configuration
14.3. The Imprints Toolset
14.4. Diagnosis
15.1. Introduction
15.2. CUPS - RAW Print Through Mode
15.3. The CUPS Filter Chains
15.4. CUPS Print Drivers and Devices
15.5. Limiting the number of pages users can print
15.6. Advanced Postscript Printing from MS Windows
15.7. Auto-Deletion of CUPS spool files
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.4. How Winbind Works
16.5. Installation and Configuration
16.6. Limitations
16.7. Conclusion
17.1. Overview of browsing
17.2. Browsing support in samba
17.3. Problem resolution
17.4. Browsing across subnets
17.5. Setting up a WINS server
17.6. Setting up Browsing in a WORKGROUP
17.7. Setting up Browsing in a DOMAIN
17.8. Forcing samba to be the master
17.9. Making samba the domain master
17.10. Note about broadcast addresses
17.11. Multiple interfaces
18.1. Introduction and configuration
18.2. Included modules
18.3. VFS modules available elsewhere
20.1. Comparisons
20.2. Socket options
20.3. Read size
20.4. Max xmit
20.5. Log level
20.6. Read raw
20.7. Write raw
20.8. Slow Clients
20.9. Slow Logins
20.10. Client tuning
21.1. Windows '9x
21.2. Windows NT 4
21.3. Windows 2000/XP
22.1. Introduction
22.2. Using host based protection
22.3. Using interface protection
22.4. Using a firewall
22.5. Using a IPC$ share deny
22.6. Upgrading Samba
23.1. What are charsets and unicode?
23.2. Samba and charsets
24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
24.5. AIX
25.1. Macintosh clients?
25.2. OS2 Client
25.3. Windows for Workgroups
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26.1. Access Samba source code via CVS
26.2. Accessing the samba sources via rsync and ftp
26.3. Building the Binaries
26.4. Starting the smbd and nmbd
27.1. Introduction
27.2. General info
27.3. Debug levels
27.4. Internal errors
27.5. Attaching to a running process
27.6. Patches
28.1. Introduction
28.2. Assumptions
28.3. Tests
28.4. Still having troubles?
8.1. Installing the required packages for DebianSetup your smb.conf
8.2. Installing the required packages for RedHatSetup your /etc/krb5.conf
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.5.1. 8.3.1. Possible errors
8.6. 8.4. Test your server setup
8.7. 8.5. Testing with smbclient
8.8. 8.6. Notes
9.1. Joining an NT Domain with Samba 3.0
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?

This is a rough guide to setting up Samba 3.0 with kerberos authentication against a Windows2000 KDC.

Pieces you need before you begin:

a Windows 2000 server.
samba 3.0 or higher.
the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.

8.1. Installing the required packages for Debian

On Debian you need to install the following packages:

libkrb5-dev
krb5-user

8.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need -to get them off CD2.

8.3. Compile Samba8.1. Setup your smb.conf

If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h it - generates contains - lines like this:

#define HAVE_KRB5 1
-#define HAVE_LDAP 1

If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

Then compile and install Samba as usual. You must use at least the - following 3 options in smb.conf:

You must use at least the following 3 options in smb.conf:

You do *not* need a smbpasswd file, and older clients will
   be authenticated as if "security = domain", although it won't do any harm
   and allows you to have local users not in the domain.
-  I expect that the above
-  required options will change soon when we get better active
-  directory integration.

8.4. Setup your /etc/krb5.conf8.2. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

8.5. Create the computer account8.3. Create the computer account

As a user that has write permission on the Samba private directory @@ -7281,8 +7152,8 @@ CLASS="SECT2" >

8.5.1. Possible errors8.3.1. Possible errors

8.6. Test your server setup8.4. Test your server setup

On a Windows 2000 client try

8.7. Testing with smbclient8.5. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba @@ -7339,12 +7210,12 @@ CLASS="SECT1" >

8.8. Notes8.6. Notes

You must change administrator password at least once after DC install, - to create the right encoding types

You must change administrator password at least once after DC +install, to create the right encoding types

w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs?

9.1. Joining an NT Domain with Samba 3.0

security = domain or - security = ads depending on if the PDC is - NT4 or running Active Directory respectivly.

Next change the root# net join -S DOMPDC +>net rpc join -S DOMPDC -UAdministrator%password

9.2. Samba and Windows 2000 Domains

Many people have asked regarding the state of Samba's ability to participate in -a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows -2000 domain operating in mixed or native mode. The steps above apply -to both NT4 and Windows 2000.

9.3. Why is this better than security = server?9.2. Why is this better than security = server?

Currently, domain security in Samba doesn't free you from @@ -7623,13 +7475,27 @@ CLASS="COMMAND" authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such as the user SID, the list of NT groups the user belongs to, etc.

NOTE: Much of the text of this document was first published in the Web magazine Doing the NIS/NT Samba.

Introduction

10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.2.1. /etc/hosts
10.2.2. /etc/resolv.conf
10.2.3. /etc/host.conf
10.2.4. /etc/nsswitch.conf
10.3. Name resolution as used within MS Windows networking
10.3.1. The NetBIOS Name Cache
10.3.2. The LMHOSTS file
10.3.3. HOSTS file
10.3.4. DNS Lookup
10.3.5. WINS Lookup
10.4. How browsing functions and how to deploy stable and dependable browsing using Samba
10.5. MS Windows security options and how to configure Samba for seemless integration
10.5.1. Use MS Windows NT as an authentication server
10.5.2. Make Samba a member of an MS Windows NT security domain
10.5.3. Configure Samba as an authentication server
10.6. Conclusions
11.1. Viewing and changing UNIX permissions using the NT security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.4.1. File Permissions
11.4.2. Directory Permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask parameters
11.7. Interaction with the standard Samba file attribute mapping
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13.1. Instructions
13.1.1. Notes
14.1. Introduction
14.2. Configuration
14.2.1. Creating [print$]
14.2.2. Setting Drivers for Existing Printers
14.2.3. Support a large number of printers
14.2.4. Adding New Printers via the Windows NT APW
14.2.5. Samba and Printer Ports
14.3. The Imprints Toolset
14.3.1. What is Imprints?
14.3.2. Creating Printer Driver Packages
14.3.3. The Imprints server
14.3.4. The Installation Client
14.4. Diagnosis
14.4.1. Introduction
14.4.2. Debugging printer problems
14.4.3. What printers do I have?
14.4.4. Setting up printcap and print servers
14.4.5. Job sent, no output
14.4.6. Job sent, strange output
14.4.7. Raw PostScript printed
14.4.8. Advanced Printing
14.4.9. Real debugging
15.1. Introduction
15.2. CUPS - RAW Print Through Mode
15.3. The CUPS Filter Chains
15.4. CUPS Print Drivers and Devices
15.4.1. Further printing steps
15.5. Limiting the number of pages users can print
15.6. Advanced Postscript Printing from MS Windows
15.7. Auto-Deletion of CUPS spool files
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.3.1. Target Uses
16.4. How Winbind Works
16.4.1. Microsoft Remote Procedure Calls
16.4.2. Microsoft Active Directory Services
16.4.3. Name Service Switch
16.4.4. Pluggable Authentication Modules
16.4.5. User and Group ID Allocation
16.4.6. Result Caching
16.5. Installation and Configuration
16.5.1. Introduction
16.5.2. Requirements
16.5.3. Testing Things Out
16.6. Limitations
16.7. Conclusion
17.1. Overview of browsing
17.2. Browsing support in samba
17.3. Problem resolution
17.4. Browsing across subnets
17.4.1. How does cross subnet browsing work ?
17.5. Setting up a WINS server
17.6. Setting up Browsing in a WORKGROUP
17.7. Setting up Browsing in a DOMAIN
17.8. Forcing samba to be the master
17.9. Making samba the domain master
17.10. Note about broadcast addresses
17.11. Multiple interfaces
18.1. Introduction and configuration
18.2. Included modules
18.2.1. audit
18.2.2. recycle
18.2.3. netatalk
18.3. VFS modules available elsewhere
18.3.1. DatabaseFS
18.3.2. vscan
20.1. Comparisons
20.2. Socket options
20.3. Read size
20.4. Max xmit
20.5. Log level
20.6. Read raw
20.7. Write raw
20.8. Slow Clients
20.9. Slow Logins
20.10. Client tuning
21.1. Windows '9x
21.2. Windows NT 4
21.2.1. Side bar Notes
21.2.2. Mandatory profiles
21.2.3. moveuser.exe
21.2.4. Get SID
21.3. Windows 2000/XP
22.1. Introduction
22.2. Using host based protection
22.3. Using interface protection
22.4. Using a firewall
22.5. Using a IPC$ share deny
22.6. Upgrading Samba
23.1. What are charsets and unicode?
23.2. Samba and charsets

10.1. Agenda

10.2. Name Resolution in a pure Unix/Linux world

10.2.1. /etc/hosts

10.2.2. /etc/resolv.conf

10.2.3. /etc/host.conf

10.2.4. /etc/nsswitch.conf

10.3. Name resolution as used within MS Windows networking

10.3.1. The NetBIOS Name Cache

10.3.2. The LMHOSTS file

10.3.3. HOSTS file

10.3.4. DNS Lookup

10.3.5. WINS Lookup

10.4. How browsing functions and how to deploy stable and dependable browsing using Samba

10.5. MS Windows security options and how to configure Samba for seemless integration

10.5.1. Use MS Windows NT as an authentication server

10.5.2. Make Samba a member of an MS Windows NT security domain

10.5.3. Configure Samba as an authentication server

10.5.3.1. Users

10.5.3.2. MS Windows NT Machine Accounts

10.6. Conclusions

11.1. Viewing and changing UNIX permissions using the NT security dialogs

New in the Samba 2.0.4 release is the ability for Windows - NT clients to use their native security settings dialog box to - view and modify the underlying UNIX permissions.

Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions.

Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and @@ -9573,11 +9442,11 @@ CLASS="SECT1" >

11.2. How to view file security on a Samba share

From an NT 4.0 client, single-click with the right +>From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click on the Properties entry at the bottom of - the menu. This brings up the normal file properties dialog - box, but with Samba 2.0.4 this will have a new tab along the top - marked Security. Click on this tab and you +> and you will see three buttons,

11.3. Viewing file ownership

There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected - to a Samba 2.0.4 server as root to change the ownership of + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the

11.4. Viewing file or directory permissions

11.4.1. File Permissions

11.4.2. Directory Permissions

11.5. Modifying file or directory permissions

"Add" - button will not return a list of users in Samba 2.0.4 (it will give + button will not return a list of users in Samba (it will give an error message of "The remote procedure call failed @@ -9973,13 +9841,14 @@ CLASS="SECT1" >

11.6. Interaction with the standard Samba create mask parameters

Note that with Samba 2.0.5 there are four new parameters - to control this interaction. These are :

There are four parameters + to control interaction with the standard Samba create mask parameters. + These are :

create mask parameter to provide compatibility with Samba 2.0.4 - where this permission change facility was introduced. To allow a user to - modify all the user/group/world permissions on a file, set this parameter +> parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777.

Next Samba checks the changed permissions for a file against @@ -10075,8 +9943,7 @@ CLASS="PARAMETER" >force create mode parameter to provide compatibility - with Samba 2.0.4 where the permission change facility was introduced. +> parameter. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000.

force directory mode parameter to provide - compatibility with Samba 2.0.4 where the permission change facility - was introduced.

parameter.

In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users @@ -10164,37 +10029,13 @@ CLASS="PARAMETER" CLASS="PARAMETER" >force directory security mode = 0

As described, in Samba 2.0.4 the parameters :

create mask

force create mode

directory mask

force directory mode

were used instead of the parameters discussed here.

11.7. Interaction with the standard Samba file attribute mapping

12.1. Samba and PAM

12.2. Distributed Authentication

12.3. PAM Configuration in smb.conf

13.1. Instructions

13.1.1. Notes

14.1. Introduction

14.2. Configuration

14.2.1. Creating [print$]

14.2.2. Setting Drivers for Existing Printers

14.2.3. Support a large number of printers

14.2.4. Adding New Printers via the Windows NT APW

14.2.5. Samba and Printer Ports

14.3. The Imprints Toolset

14.3.1. What is Imprints?

14.3.2. Creating Printer Driver Packages

14.3.3. The Imprints server

14.3.4. The Installation Client

14.4. Diagnosis

14.4.1. Introduction

14.4.2. Debugging printer problems

14.4.3. What printers do I have?

14.4.4. Setting up printcap and print servers

14.4.5. Job sent, no output

14.4.6. Job sent, strange output

14.4.7. Raw PostScript printed

14.4.8. Advanced Printing

14.4.9. Real debugging

15.1. Introduction

15.2. CUPS - RAW Print Through Mode

15.3. The CUPS Filter Chains

15.4. CUPS Print Drivers and Devices

15.4.1. Further printing steps

15.5. Limiting the number of pages users can print

15.6. Advanced Postscript Printing from MS Windows

15.7. Auto-Deletion of CUPS spool files

16.1. Abstract

16.2. Introduction

16.3. What Winbind Provides

16.3.1. Target Uses

16.4. How Winbind Works

16.4.1. Microsoft Remote Procedure Calls

16.4.2. Microsoft Active Directory Services

16.4.3. Name Service Switch

16.4.4. Pluggable Authentication Modules

16.4.5. User and Group ID Allocation

16.4.6. Result Caching

16.5. Installation and Configuration

16.5.1. Introduction

16.5.2. Requirements

16.5.3. Testing Things Out

16.5.3.1. Configure and compile SAMBA

16.5.3.2. Configure nsswitch.conf

16.5.3.3. Configure smb.conf

16.5.3.4. Join the SAMBA server to the PDC domain

16.5.3.5. Start up the winbindd daemon and test it!

16.5.3.6. Fix the init.d startup scripts

16.5.3.6.1. Linux

16.5.3.6.2. Solaris

16.5.3.6.3. Restarting

16.5.3.7. Configure Winbind and PAM

16.5.3.7.1. Linux/FreeBSD-specific PAM configuration

16.5.3.7.2. Solaris-specific configuration

16.6. Limitations

16.7. Conclusion

17.1. Overview of browsing

17.2. Browsing support in samba

17.3. Problem resolution

17.4. Browsing across subnets

17.4.1. How does cross subnet browsing work ?

17.5. Setting up a WINS server

17.6. Setting up Browsing in a WORKGROUP

17.7. Setting up Browsing in a DOMAIN

17.8. Forcing samba to be the master

17.9. Making samba the domain master

17.10. Note about broadcast addresses

17.11. Multiple interfaces

18.1. Introduction and configuration

18.2. Included modules

18.2.1. audit

18.2.2. recycle

18.2.3. netatalk

18.3. VFS modules available elsewhere

18.3.1. DatabaseFS

18.3.2. vscan

20.1. Comparisons

20.2. Socket options

20.3. Read size

20.4. Max xmit

20.5. Log level

20.6. Read raw

20.7. Write raw

20.8. Slow Clients

20.9. Slow Logins

20.10. Client tuning

21.1. Windows '9x

21.2. Windows NT 4

21.2.1. Side bar Notes

21.2.2. Mandatory profiles

21.2.3. moveuser.exe

21.2.4. Get SID

21.3. Windows 2000/XP

22.1. Introduction

22.2. Using host based protection

22.3. Using interface protection

22.4. Using a firewall

22.5. Using a IPC$ share deny

22.6. Upgrading Samba

23.1. What are charsets and unicode?

23.2. Samba and charsets

24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
24.5. AIX
24.5.1. Sequential Read Ahead
25.1. Macintosh clients?
25.2. OS2 Client
25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?
25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?
25.2.3. Are there any other issues when OS/2 (any version) is used as a client?
25.2.4. How do I get printer driver download working for OS/2 clients?
25.3. Windows for Workgroups
25.3.1. Use latest TCP/IP stack from Microsoft
25.3.2. Delete .pwl files after password change
25.3.3. Configure WfW password handling
25.3.4. Case handling of passwords
25.3.5. Use TCP/IP as default protocol
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26.1. Access Samba source code via CVS
26.1.1. Introduction
26.1.2. CVS Access to samba.org
26.2. Accessing the samba sources via rsync and ftp
26.3. Building the Binaries
26.3.1. Compiling samba with Active Directory support
26.4. Starting the smbd and nmbd
26.4.1. Starting from inetd.conf
26.4.2. Alternative: starting it as a daemon
27.1. Introduction
27.2. General info
27.3. Debug levels
27.4. Internal errors
27.5. Attaching to a running process
27.6. Patches
28.1. Introduction
28.2. Assumptions
28.3. Tests
28.3.1. Test 1
28.3.2. Test 2
28.3.3. Test 3
28.3.4. Test 4
28.3.5. Test 5
28.3.6. Test 6
28.3.7. Test 7
28.3.8. Test 8
28.3.9. Test 9
28.3.10. Test 10
28.3.11. Test 11
28.4. Still having troubles?

24.1. HPUX

24.2. SCO Unix

24.3. DNIX

24.4. RedHat Linux Rembrandt-II

24.5. AIX

24.5.1. Sequential Read Ahead

25.1. Macintosh clients?

25.2. OS2 Client

25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?

25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?

25.2.3. Are there any other issues when OS/2 (any version) is used as a client?

25.2.4. How do I get printer driver download working for OS/2 clients?

25.3. Windows for Workgroups

25.3.1. Use latest TCP/IP stack from Microsoft

25.3.2. Delete .pwl files after password change

25.3.3. Configure WfW password handling

25.3.4. Case handling of passwords

25.3.5. Use TCP/IP as default protocol

25.4. Windows '95/'98

25.5. Windows 2000 Service Pack 2

26.1. Access Samba source code via CVS

26.1.1. Introduction

26.1.2. CVS Access to samba.org

26.1.2.1. Access via CVSweb

26.1.2.2. Access via cvs

26.2. Accessing the samba sources via rsync and ftp

26.3. Building the Binaries

if you find this version a disaster!

26.3.1. Compiling samba with Active Directory support

In order to compile samba with ADS support, you need to have installed + on your system: +

the MIT kerberos development libraries (either install from the sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.

+ +

If your kerberos libraries are in a non-standard location then + remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h it generates contains lines like this:

#define HAVE_KRB5 1
+#define HAVE_LDAP 1
+

If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure out why and fix + it.

26.3.1.1. Installing the required packages for Debian

On Debian you need to install the following packages:

libkrb5-dev
krb5-user

+

26.3.1.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

+

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need + to get them off CD2.

26.4. Starting the smbd and nmbd

26.4.1. Starting from inetd.conf

26.4.2. Alternative: starting it as a daemon

27.1. Introduction

27.2. General info

27.3. Debug levels

27.4. Internal errors

27.5. Attaching to a running process

27.6. Patches

28.1. Introduction

28.2. Assumptions

28.3. Tests

28.3.1. Test 1

28.3.2. Test 2

28.3.3. Test 3

28.3.4. Test 4

28.3.5. Test 5

28.3.6. Test 6

28.3.7. Test 7

28.3.8. Test 8

28.3.9. Test 9

28.3.10. Test 10

28.3.11. Test 11

28.4. Still having troubles?

Date: Mon, 31 Mar 2003 21:48:59 +0000 Subject: Update some info and typos in PAM-Authentication-And-Samba (This used to be commit a4bbe4acf7262361931764a6c6cdd56a05fe86d4) --- docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml b/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml index adcd059bc2..d6fe6760b5 100644 --- a/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml +++ b/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml @@ -152,8 +152,7 @@ session required /lib/security/pam_pwdb.so nodelay password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf - -Note: PAM allows stacking of authentication mechanisms. It is +PAM allows stacking of authentication mechanisms. It is also possible to pass information obtained within one PAM module through to the next module in the PAM stack. Please refer to the documentation for your particular system implementation for details regarding the specific @@ -164,7 +163,7 @@ authentication to be configured in a single central file. The on the basis that it allows for easier administration. As with all issues in life though, every decision makes trade-offs, so you may want examine the PAM documentation for further helpful information. - + @@ -174,9 +173,9 @@ PAM documentation for further helpful information. The astute administrator will realize from this that the combination of pam_smbpass.so, -winbindd, and rsync (see -http://rsync.samba.org/) -will allow the establishment of a centrally managed, distributed +winbindd, and a distributed +passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware programs and applications. This arrangement can have particularly potent advantages compared with the @@ -196,7 +195,7 @@ The following is from the on-line help for this option in SWAT; -When Samba 2.2 is configure to enable PAM support (i.e. +When Samba is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior -- cgit From 65d7f6afbad8a1a38d99612a96229e8ff1ba77a2 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 1 Apr 2003 10:56:23 +0000 Subject: reversed the sense of the TCON test, now that we know that win2003 fixes this. This means that TCON fails on win2000, but passes on Samba and win2003 (This used to be commit 591a500ed77870bc72acb94f2fd24070b7d617b6) --- source3/torture/torture.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/source3/torture/torture.c b/source3/torture/torture.c index d6ae58c522..5935c8c06e 100644 --- a/source3/torture/torture.c +++ b/source3/torture/torture.c @@ -954,10 +954,10 @@ static BOOL run_tcon_test(int dummy) cli->cnum = cnum2; if (cli_write(cli, fnum1, 0, buf, 130, 4) == 4) { - printf("server allows write with wrong TID\n"); - } else { - printf("* server fails write with wrong TID : %s\n", cli_errstr(cli)); + printf("* server allows write with wrong TID\n"); ret = False; + } else { + printf("server fails write with wrong TID : %s\n", cli_errstr(cli)); } @@ -965,10 +965,10 @@ static BOOL run_tcon_test(int dummy) cli->cnum = cnum3; if (cli_write(cli, fnum1, 0, buf, 130, 4) == 4) { - printf("server allows write with invalid TID\n"); - } else { - printf("* server fails write with invalid TID : %s\n", cli_errstr(cli)); + printf("* server allows write with invalid TID\n"); ret = False; + } else { + printf("server fails write with invalid TID : %s\n", cli_errstr(cli)); } /* try a write with an invalid vuid */ @@ -976,10 +976,10 @@ static BOOL run_tcon_test(int dummy) cli->cnum = cnum1; if (cli_write(cli, fnum1, 0, buf, 130, 4) == 4) { - printf("server allows write with invalid VUID\n"); - } else { - printf("* server fails write with invalid VUID : %s\n", cli_errstr(cli)); + printf("* server allows write with invalid VUID\n"); ret = False; + } else { + printf("server fails write with invalid VUID : %s\n", cli_errstr(cli)); } cli->cnum = cnum1; @@ -2179,7 +2179,7 @@ static BOOL run_attrtest(int dummy) struct cli_state *cli; int fnum; time_t t, t2; - const char *fname = "\\attrib.tst"; + const char *fname = "\\attrib123456789.tst"; BOOL correct = True; printf("starting attrib test\n"); -- cgit From d84acbc8aac11fa7f80de6de8b9c5b70b1c084d3 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 1 Apr 2003 11:12:42 +0000 Subject: changed the order of checking whether a SID is a UID or a GID in posix acls. This is needed because sid_to_uid always claims that the sid is a user, due ot a change I made some months back. This change was suggested by Chere Zhou, but is really an interim measure. Chere is looking at a longer term solution. (This used to be commit b3edfa91964d2edfd1692fa58f98de00405e14c4) --- source3/smbd/posix_acls.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c index 01e3c31ba7..d4d966a636 100644 --- a/source3/smbd/posix_acls.c +++ b/source3/smbd/posix_acls.c @@ -1003,12 +1003,12 @@ static BOOL create_canon_ace_lists(files_struct *fsp, if (nt4_compatible_acls()) psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY; - } else if (sid_to_uid( ¤t_ace->trustee, ¤t_ace->unix_ug.uid, &sid_type)) { - current_ace->owner_type = UID_ACE; - current_ace->type = SMB_ACL_USER; } else if (sid_to_gid( ¤t_ace->trustee, ¤t_ace->unix_ug.gid, &sid_type)) { current_ace->owner_type = GID_ACE; current_ace->type = SMB_ACL_GROUP; + } else if (sid_to_uid( ¤t_ace->trustee, ¤t_ace->unix_ug.uid, &sid_type)) { + current_ace->owner_type = UID_ACE; + current_ace->type = SMB_ACL_USER; } else { fstring str; -- cgit From 916ef755d37994b1ebeb0bb956502bc9c59e161d Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 1 Apr 2003 11:25:34 +0000 Subject: Fix build of shared xml/mysql modules (This used to be commit 860e4c45619bcd99c6e4a1eb980c5b8dac79b6c0) --- source3/configure.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/source3/configure.in b/source3/configure.in index 98e01f5bd5..38716aee18 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -2277,10 +2277,12 @@ fi ######################################################## # Compile with MySQL support? AM_PATH_MYSQL([0.11.0],[default_shared_modules="$default_shared_modules pdb_mysql"],[]) +CFLAGS="$CFLAGS $MYSQL_CFLAGS" ######################################################## # Compile with XML support? AM_PATH_XML2([2.0.0],[default_shared_modules="$default_shared_modules pdb_xml"],[]) +CFLAGS="$CFLAGS $XML_CFLAGS" ################################################# # check for automount support @@ -3376,9 +3378,9 @@ AC_ARG_WITH(shared-modules, fi ]) SMB_MODULE(pdb_xml, modules/xml.o, bin/xml.so, PDB, - [ CFLAGS="$CFLAGS $XML_CFLAGS"; LIBS="$LIBS $XML_LIBS" ] ) + [ LIBS="$LIBS $XML_LIBS" ] ) SMB_MODULE(pdb_mysql, modules/mysql.o, bin/mysql.so, PDB, - [ CFLAGS="$CFLAGS $MYSQL_CFLAGS"; LIBS="$LIBS $MYSQL_LIBS" ] ) + [ LIBS="$LIBS $MYSQL_LIBS" ] ) SMB_MODULE(pdb_ldap, passdb/pdb_ldap.o, bin/ldapsam.so, PDB, [ LIBS="$LIBS $LDAP_LIBS" ] ) SMB_MODULE(pdb_smbpasswd, passdb/pdb_smbpasswd.o, bin/smbpasswd.so, PDB) -- cgit From c5ff6930821faed19640af87a7e285a061175f63 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 1 Apr 2003 14:58:42 +0000 Subject: fix potential handle leak in _spoolss_open_printer_ex(); final fix for CR2102; reviewed by jra (This used to be commit 3d37e1ece913707f346c3c2459c3c42192a3a1a7) --- source3/rpc_server/srv_spoolss_nt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 9c9dd438b3..c2729001e4 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -1623,8 +1623,10 @@ Can't find printer handle we created for printer %s\n", name )); /* NT doesn't let us connect to a printer if the connecting user doesn't have print permission. */ - if (!get_printer_snum(p, handle, &snum)) + if (!get_printer_snum(p, handle, &snum)) { + close_printer_handle(p, handle); return WERR_BADFID; + } se_map_standard(&printer_default->access_required, &printer_std_mapping); -- cgit From d8f954d909fa3b1c7b2cb79113ae284d9ef42b96 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 1 Apr 2003 17:06:16 +0000 Subject: Use instead of NOTE (gives much nicer output) (This used to be commit 3e10d92746c645ae22756bca92046b2e26087ad2) --- docs/docbook/manpages/smb.conf.5.sgml | 31 +++++++++++----------- docs/docbook/smbdotconf/misc/homedirmap.xml | 4 +-- docs/docbook/smbdotconf/printing/printcapname.xml | 4 +-- docs/docbook/smbdotconf/security/hostsequiv.xml | 4 +-- .../smbdotconf/security/nonunixaccountrange.xml | 4 +-- .../docbook/smbdotconf/security/passwordserver.xml | 4 +-- docs/docbook/smbdotconf/smb.conf.5.xml | 4 +-- docs/docbook/smbdotconf/wins/winsserver.xml | 4 +-- 8 files changed, 29 insertions(+), 30 deletions(-) diff --git a/docs/docbook/manpages/smb.conf.5.sgml b/docs/docbook/manpages/smb.conf.5.sgml index 90b636fc87..6cdfba11ea 100644 --- a/docs/docbook/manpages/smb.conf.5.sgml +++ b/docs/docbook/manpages/smb.conf.5.sgml @@ -287,11 +287,11 @@ alias|alias|alias|alias... components (if there are more than one) are separated by vertical bar symbols ('|'). - NOTE: On SYSV systems which use lpstat to determine what + On SYSV systems which use lpstat to determine what printers are defined on the system you may be able to use "printcap name = lpstat" to automatically obtain a list of printers. See the "printcap name" option - for more details. + for more details. @@ -3019,8 +3019,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' that copes with different map formats and also Amd (another automounter) maps. - NOTE :A working NIS client is required on - the system for this option to work. + A working NIS client is required on + the system for this option to work. See also nis homedir , domain logons @@ -3163,14 +3163,14 @@ df $1 | tail -1 | awk '{print $2" "$4}' hosts equiv may be useful for NT clients which will not supply passwords to Samba. - NOTE : The use of hosts equiv + The use of hosts equiv can be a major security hole. This is because you are trusting the PC to supply the correct username. It is very easy to get a PC to supply a false username. I recommend that the hosts equiv option be only used if you really know what you are doing, or perhaps on a home network where you trust your spouse and kids. And only if you really trust - them :-). + them :-). Default: no host equivalences Example: hosts equiv = /etc/hosts.equiv @@ -5102,10 +5102,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise. - NOTE: These userids never appear on the system and Samba will never + These userids never appear on the system and Samba will never 'become' these users. They are used only to ensure that the algorithmic RID mapping does not conflict with normal users. - + Default: non unix account range = <empty string> @@ -5704,10 +5704,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode. - NOTE: Using a password server + Using a password server means your UNIX box (running Samba) is only as secure as your password server. DO NOT CHOOSE A PASSWORD SERVER THAT - YOU DON'T COMPLETELY TRUST. + YOU DON'T COMPLETELY TRUST. Never point a Samba server at itself for password serving. This will cause a loop and could lock up your Samba @@ -6154,10 +6154,10 @@ print5|My Printer 5 that the second alias has a space in it gives a hint to Samba that it's a comment. - NOTE: Under AIX the default printcap + Under AIX the default printcap name is /etc/qconfig. Samba will assume the file is in AIX qconfig format if the string - qconfig appears in the printcap filename. + qconfig appears in the printcap filename. Default: printcap name = /etc/printcap Example: printcap name = /etc/myprintcap @@ -8294,12 +8294,11 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ You should point this at your WINS server if you have a multi-subnetted network. - NOTE. You need to set up Samba to point + You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet - browsing to work correctly. + browsing to work correctly. - See the documentation file BROWSING - in the docs/ directory of your Samba source distribution. + See the documentation file Browsing in the samba howto collection. Default: not enabled Example: wins server = 192.9.200.1 diff --git a/docs/docbook/smbdotconf/misc/homedirmap.xml b/docs/docbook/smbdotconf/misc/homedirmap.xml index 87a59204a2..41e6ca5ea1 100644 --- a/docs/docbook/smbdotconf/misc/homedirmap.xml +++ b/docs/docbook/smbdotconf/misc/homedirmap.xml @@ -15,8 +15,8 @@ that copes with different map formats and also Amd (another automounter) maps. - NOTE :A working NIS client is required on - the system for this option to work. + A working NIS client is required on + the system for this option to work. See also nis homedir , domain logons diff --git a/docs/docbook/smbdotconf/printing/printcapname.xml b/docs/docbook/smbdotconf/printing/printcapname.xml index fcfeada54c..0025624d25 100644 --- a/docs/docbook/smbdotconf/printing/printcapname.xml +++ b/docs/docbook/smbdotconf/printing/printcapname.xml @@ -36,10 +36,10 @@ print5|My Printer 5 that the second alias has a space in it gives a hint to Samba that it's a comment. - NOTE: Under AIX the default printcap + Under AIX the default printcap name is /etc/qconfig. Samba will assume the file is in AIX qconfig format if the string - qconfig appears in the printcap filename. + qconfig appears in the printcap filename. Default: printcap name = /etc/printcap Example: printcap name = /etc/myprintcap diff --git a/docs/docbook/smbdotconf/security/hostsequiv.xml b/docs/docbook/smbdotconf/security/hostsequiv.xml index 68d6d628e8..084d8268ef 100644 --- a/docs/docbook/smbdotconf/security/hostsequiv.xml +++ b/docs/docbook/smbdotconf/security/hostsequiv.xml @@ -11,14 +11,14 @@ hosts equiv may be useful for NT clients which will not supply passwords to Samba. - NOTE : The use of hosts equiv + The use of hosts equiv can be a major security hole. This is because you are trusting the PC to supply the correct username. It is very easy to get a PC to supply a false username. I recommend that the hosts equiv option be only used if you really know what you are doing, or perhaps on a home network where you trust your spouse and kids. And only if you really trust - them :-). + them :-). Default: no host equivalences Example: hosts equiv = /etc/hosts.equiv diff --git a/docs/docbook/smbdotconf/security/nonunixaccountrange.xml b/docs/docbook/smbdotconf/security/nonunixaccountrange.xml index a8e426649e..baa9a783b0 100644 --- a/docs/docbook/smbdotconf/security/nonunixaccountrange.xml +++ b/docs/docbook/smbdotconf/security/nonunixaccountrange.xml @@ -8,10 +8,10 @@ This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise. - NOTE: These userids never appear on the system and Samba will never + These userids never appear on the system and Samba will never 'become' these users. They are used only to ensure that the algorithmic RID mapping does not conflict with normal users. - + Default: non unix account range = <empty string> diff --git a/docs/docbook/smbdotconf/security/passwordserver.xml b/docs/docbook/smbdotconf/security/passwordserver.xml index df50ac8f8a..b803816d88 100644 --- a/docs/docbook/smbdotconf/security/passwordserver.xml +++ b/docs/docbook/smbdotconf/security/passwordserver.xml @@ -20,10 +20,10 @@ the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode. - NOTE: Using a password server + Using a password server means your UNIX box (running Samba) is only as secure as your password server. DO NOT CHOOSE A PASSWORD SERVER THAT - YOU DON'T COMPLETELY TRUST. + YOU DON'T COMPLETELY TRUST. Never point a Samba server at itself for password serving. This will cause a loop and could lock up your Samba diff --git a/docs/docbook/smbdotconf/smb.conf.5.xml b/docs/docbook/smbdotconf/smb.conf.5.xml index e37add4206..edb94573df 100644 --- a/docs/docbook/smbdotconf/smb.conf.5.xml +++ b/docs/docbook/smbdotconf/smb.conf.5.xml @@ -292,11 +292,11 @@ alias|alias|alias|alias... components (if there are more than one) are separated by vertical bar symbols ('|'). - NOTE: On SYSV systems which use lpstat to determine what + On SYSV systems which use lpstat to determine what printers are defined on the system you may be able to use "printcap name = lpstat" to automatically obtain a list of printers. See the "printcap name" option - for more details. + for more details. diff --git a/docs/docbook/smbdotconf/wins/winsserver.xml b/docs/docbook/smbdotconf/wins/winsserver.xml index ba49f687f6..2a644d3f09 100644 --- a/docs/docbook/smbdotconf/wins/winsserver.xml +++ b/docs/docbook/smbdotconf/wins/winsserver.xml @@ -8,9 +8,9 @@ You should point this at your WINS server if you have a multi-subnetted network. - NOTE. You need to set up Samba to point + You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet - browsing to work correctly. + browsing to work correctly. See the documentation file BROWSING in the docs/ directory of your Samba source distribution. -- cgit From 63c87884d494b22b6b7f055ed75dc259c2997e79 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 1 Apr 2003 19:48:15 +0000 Subject: - Update documentation of 'wins server' (add info about tags, namespaces) (This used to be commit 1a3f8a5f8ad97b2d431b22fbda74cc3f2400e2f9) --- docs/docbook/manpages/smb.conf.5.sgml | 16 ++++++++++++++- docs/docbook/projdoc/Browsing.sgml | 32 ++++++++++++++--------------- docs/docbook/projdoc/upgrading-to-3.0.sgml | 12 ++++------- docs/docbook/smbdotconf/wins/winsserver.xml | 19 +++++++++++++---- 4 files changed, 50 insertions(+), 29 deletions(-) diff --git a/docs/docbook/manpages/smb.conf.5.sgml b/docs/docbook/manpages/smb.conf.5.sgml index 6cdfba11ea..2fbd27b934 100644 --- a/docs/docbook/manpages/smb.conf.5.sgml +++ b/docs/docbook/manpages/smb.conf.5.sgml @@ -8294,14 +8294,28 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ You should point this at your WINS server if you have a multi-subnetted network. + If you want to work in multiple namespaces, you can + give every wins server a 'tag'. For each tag, only one + (working) server will be queried for a name. The tag should be + seperated from the ip address by a colon. + + You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet browsing to work correctly. + See the documentation file Browsing in the samba howto collection. Default: not enabled - Example: wins server = 192.9.200.1 + Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61 + For this example when querying a certain name, 192.19.200.1 will + be asked first and if that doesn't respond 192.168.2.61. If either + of those doesn't know the name 192.168.3.199 will be queried. + + + Example: wins server = 192.9.200.1 192.168.2.61 + diff --git a/docs/docbook/projdoc/Browsing.sgml b/docs/docbook/projdoc/Browsing.sgml index aeb3b477c5..60512c3cd1 100644 --- a/docs/docbook/projdoc/Browsing.sgml +++ b/docs/docbook/projdoc/Browsing.sgml @@ -534,10 +534,10 @@ options in the [global] section of the smb.conf file : - domain master = yes - local master = yes - preferred master = yes - os level = 65 +domain master = yes +local master = yes +preferred master = yes +os level = 65 @@ -559,10 +559,10 @@ smb.conf file : - domain master = no - local master = yes - preferred master = yes - os level = 65 +domain master = no +local master = yes +preferred master = yes +os level = 65 @@ -588,10 +588,10 @@ options in the [global] section of the smb.conf file : - domain master = no - local master = no - preferred master = no - os level = 0 +domain master = no +local master = no +preferred master = no +os level = 0 @@ -619,10 +619,10 @@ file : - domain master = no - local master = yes - preferred master = yes - os level = 65 +domain master = no +local master = yes +preferred master = yes +os level = 65 diff --git a/docs/docbook/projdoc/upgrading-to-3.0.sgml b/docs/docbook/projdoc/upgrading-to-3.0.sgml index f227556151..cd0ec2064d 100644 --- a/docs/docbook/projdoc/upgrading-to-3.0.sgml +++ b/docs/docbook/projdoc/upgrading-to-3.0.sgml @@ -24,16 +24,12 @@ In 3.0, the following configuration options have been removed. -printer driver -printer driver file -printer driver location +printer driver (replaced by new driver procedures) +printer driver file (replaced by new driver procedures) +printer driver location (replaced by new driver procedures) use rhosts postscript +client code page (replaced by dos charset) - -The first three options have been replaced by new driver procedures. -Please read the printing documentation. - - diff --git a/docs/docbook/smbdotconf/wins/winsserver.xml b/docs/docbook/smbdotconf/wins/winsserver.xml index 2a644d3f09..ebdb3016c7 100644 --- a/docs/docbook/smbdotconf/wins/winsserver.xml +++ b/docs/docbook/smbdotconf/wins/winsserver.xml @@ -8,14 +8,25 @@ You should point this at your WINS server if you have a multi-subnetted network. + If you want to work in multiple namespaces, you can + give every wins server a 'tag'. For each tag, only one + (working) server will be queried for a name. The tag should be + seperated from the ip address by a colon. + + You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet browsing to work correctly. - See the documentation file BROWSING - in the docs/ directory of your Samba source distribution. + See the documentation file Browsing in the samba howto collection. + + Default: not enabled + Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61 + For this example when querying a certain name, 192.19.200.1 will + be asked first and if that doesn't respond 192.168.2.61. If either + of those doesn't know the name 192.168.3.199 will be queried. + - Default: not enabled - Example: wins server = 192.9.200.1 + Example: wins server = 192.9.200.1 192.168.2.61 -- cgit From a4fe384f1d3ba07c4b91c7c5530e862b41355555 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 2 Apr 2003 00:03:52 +0000 Subject: OHKAWA Yuichi (kuri@makino.ecei.tohoku.ac.jp) points out that using decoded.length after it's been zero'ed out by data_blob_free() doesn't give you the original length... Andrew Bartlett (This used to be commit 647a720cfb06bdf0dfc8fcdcab50aadcceb0494d) --- source3/lib/util_str.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c index 4d955c59a7..e2f9f19f58 100644 --- a/source3/lib/util_str.c +++ b/source3/lib/util_str.c @@ -1662,10 +1662,10 @@ void base64_decode_inplace(char *s) { DATA_BLOB decoded = base64_decode_data_blob(s); memcpy(s, decoded.data, decoded.length); - data_blob_free(&decoded); - /* null terminate */ s[decoded.length] = '\0'; + + data_blob_free(&decoded); } /** -- cgit From 0dbf84b8666f053bcd1cef8d5389c7cb5ca7cbd6 Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Wed, 2 Apr 2003 00:04:36 +0000 Subject: More of the documentation overhaul. More to follow. (This used to be commit 8333c4709e239a7b8bef6f7a5050a7f8a1ffbe7d) --- docs/docbook/projdoc/Browsing-Quickguide.sgml | 75 ++ docs/docbook/projdoc/Integrating-with-Windows.sgml | 443 +----------- .../projdoc/PAM-Authentication-And-Samba.sgml | 111 +-- docs/docbook/projdoc/Samba-BDC-HOWTO.sgml | 2 +- docs/docbook/projdoc/Samba-PDC-HOWTO.sgml | 761 +-------------------- docs/docbook/projdoc/ServerType.sgml | 7 + docs/docbook/projdoc/samba-doc.sgml | 16 +- docs/docbook/projdoc/security_level.sgml | 222 +++++- 8 files changed, 428 insertions(+), 1209 deletions(-) diff --git a/docs/docbook/projdoc/Browsing-Quickguide.sgml b/docs/docbook/projdoc/Browsing-Quickguide.sgml index 0a5cf72038..adf20b7386 100644 --- a/docs/docbook/projdoc/Browsing-Quickguide.sgml +++ b/docs/docbook/projdoc/Browsing-Quickguide.sgml @@ -84,6 +84,81 @@ minutes to stabilise, particularly across network segments. + +How browsing functions and how to deploy stable and +dependable browsing using Samba + + + +As stated above, MS Windows machines register their NetBIOS names +(i.e.: the machine name for each service type in operation) on start +up. Also, as stated above, the exact method by which this name registration +takes place is determined by whether or not the MS Windows client/server +has been given a WINS server address, whether or not LMHOSTS lookup +is enabled, or if DNS for NetBIOS name resolution is enabled, etc. + + + +In the case where there is no WINS server all name registrations as +well as name lookups are done by UDP broadcast. This isolates name +resolution to the local subnet, unless LMHOSTS is used to list all +names and IP addresses. In such situations Samba provides a means by +which the samba server name may be forcibly injected into the browse +list of a remote MS Windows network (using the "remote announce" parameter). + + + +Where a WINS server is used, the MS Windows client will use UDP +unicast to register with the WINS server. Such packets can be routed +and thus WINS allows name resolution to function across routed networks. + + + +During the startup process an election will take place to create a +local master browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the domain master browser. This +domain browsing has nothing to do with MS security domain control. +Instead, the domain master browser serves the role of contacting each local +master browser (found by asking WINS or from LMHOSTS) and exchanging browse +list contents. This way every master browser will eventually obtain a complete +list of all machines that are on the network. Every 11-15 minutes an election +is held to determine which machine will be the master browser. By the nature of +the election criteria used, the machine with the highest uptime, or the +most senior protocol version, or other criteria, will win the election +as domain master browser. + + + +Clients wishing to browse the network make use of this list, but also depend +on the availability of correct name resolution to the respective IP +address/addresses. + + + +Any configuration that breaks name resolution and/or browsing intrinsics +will annoy users because they will have to put up with protracted +inability to use the network services. + + + +Samba supports a feature that allows forced synchonisation +of browse lists across routed networks using the "remote +browse sync" parameter in the smb.conf file. This causes Samba +to contact the local master browser on a remote network and +to request browse list synchronisation. This effectively bridges +two networks that are separated by routers. The two remote +networks may use either broadcast based name resolution or WINS +based name resolution, but it should be noted that the "remote +browse sync" parameter provides browse list synchronisation - and +that is distinct from name to address resolution, in other +words, for cross subnet browsing to function correctly it is +essential that a name to address resolution mechanism be provided. +This mechanism could be via DNS, /etc/hosts, +and so on. + + + + Use of the "Remote Announce" parameter diff --git a/docs/docbook/projdoc/Integrating-with-Windows.sgml b/docs/docbook/projdoc/Integrating-with-Windows.sgml index a4e79fd42b..8a5c0c40f2 100644 --- a/docs/docbook/projdoc/Integrating-with-Windows.sgml +++ b/docs/docbook/projdoc/Integrating-with-Windows.sgml @@ -18,48 +18,46 @@ Integrating MS Windows networks with Samba - -Agenda - -To identify the key functional mechanisms of MS Windows networking -to enable the deployment of Samba as a means of extending and/or -replacing MS Windows NT/2000 technology. +This section deals with NetBIOS over TCP/IP name to IP address resolution. If you +your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this +section does not apply to your installation. If your installation involves use of +NetBIOS over TCP/IP then this section may help you to resolve networking problems. + -We will examine: + NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS + over Logical Link Control (LLC). On modern networks it is highly advised + to NOT run NetBEUI at all. Note also that there is NO such thing as + NetBEUI over TCP/IP - the existence of such a protocol is a complete + and utter mis-apprehension. + - - Name resolution in a pure Unix/Linux TCP/IP - environment - - - Name resolution as used within MS Windows - networking - - - How browsing functions and how to deploy stable - and dependable browsing using Samba - - - MS Windows security options and how to - configure Samba for seemless integration - + +Since the introduction of MS Windows 2000 it is possible to run MS Windows networking +without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS +name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over +TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be +used and UDP port 137 and TCP port 139 will not. + - Configuration of Samba as: - - A stand-alone server - An MS Windows NT 3.x/4.0 security domain member - - An alternative to an MS Windows NT 3.x/4.0 Domain Controller - - - - + + +When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then +the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet +Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic). + + - + +When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that +disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires +Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). +Use of DHCP with ADS is recommended as a further means of maintaining central control +over client workstation network configuration. + @@ -555,381 +553,4 @@ of the WINS server. - - -How browsing functions and how to deploy stable and -dependable browsing using Samba - - - -As stated above, MS Windows machines register their NetBIOS names -(i.e.: the machine name for each service type in operation) on start -up. Also, as stated above, the exact method by which this name registration -takes place is determined by whether or not the MS Windows client/server -has been given a WINS server address, whether or not LMHOSTS lookup -is enabled, or if DNS for NetBIOS name resolution is enabled, etc. - - - -In the case where there is no WINS server all name registrations as -well as name lookups are done by UDP broadcast. This isolates name -resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse -list of a remote MS Windows network (using the "remote announce" parameter). - - - -Where a WINS server is used, the MS Windows client will use UDP -unicast to register with the WINS server. Such packets can be routed -and thus WINS allows name resolution to function across routed networks. - - - -During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local -master browser (found by asking WINS or from LMHOSTS) and exchanging browse -list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By the nature of -the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser. - - - -Clients wishing to browse the network make use of this list, but also depend -on the availability of correct name resolution to the respective IP -address/addresses. - - - -Any configuration that breaks name resolution and/or browsing intrinsics -will annoy users because they will have to put up with protracted -inability to use the network services. - - - -Samba supports a feature that allows forced synchonisation -of browse lists across routed networks using the "remote -browse sync" parameter in the smb.conf file. This causes Samba -to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the "remote -browse sync" parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on. - - - - - -MS Windows security options and how to configure -Samba for seemless integration - - -MS Windows clients may use encrypted passwords as part of a -challenege/response authentication model (a.k.a. NTLMv1) or -alone, or clear text strings for simple password based -authentication. It should be realized that with the SMB -protocol the password is passed over the network either -in plain text or encrypted, but not both in the same -authentication requets. - - - -When encrypted passwords are used a password that has been -entered by the user is encrypted in two ways: - - - - An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. - - - The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is - then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. - - - - -You should refer to the -Password Encryption chapter in this HOWTO collection -for more details on the inner workings - - - -MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x -and version 4.0 pre-service pack 3 will use either mode of -password authentication. All versions of MS Windows that follow -these versions no longer support plain text passwords by default. - - - -MS Windows clients have a habit of dropping network mappings that -have been idle for 10 minutes or longer. When the user attempts to -use the mapped drive connection that has been dropped, the client -re-establishes the connection using -a cached copy of the password. - - - -When Microsoft changed the default password mode, they dropped support for -caching of the plain text password. This means that when the registry -parameter is changed to re-enable use of plain text passwords it appears to -work, but when a dropped mapping attempts to revalidate it will fail if -the remote authentication server does not support encrypted passwords. -This means that it is definitely not a good idea to re-enable plain text -password support in such clients. - - - -The following parameters can be used to work around the -issue of Windows 9x client upper casing usernames and -password before transmitting them to the SMB server -when using clear text authentication. - - - - passsword level = integer - username level = integer - - - -By default Samba will lower case the username before attempting -to lookup the user in the database of local system accounts. -Because UNIX usernames conventionally only contain lower case -character, the username level parameter -is rarely even needed. - - - -However, password on UNIX systems often make use of mixed case -characters. This means that in order for a user on a Windows 9x -client to connect to a Samba server using clear text authentication, -the password level must be set to the maximum -number of upper case letter which could appear -is a password. Note that is the server OS uses the traditional -DES version of crypt(), then a password level -of 8 will result in case insensitive passwords as seen from Windows -users. This will also result in longer login times as Samba -hash to compute the permutations of the password string and -try them one by one until a match is located (or all combinations fail). - - - -The best option to adopt is to enable support for encrypted passwords -where ever Samba is used. There are three configuration possibilities -for support of encrypted passwords: - - - - -Use MS Windows NT as an authentication server - - -This method involves the additions of the following parameters -in the smb.conf file: - - - - encrypt passwords = Yes - security = server - password server = "NetBIOS_name_of_PDC" - - - - -There are two ways of identifying whether or not a username and -password pair was valid or not. One uses the reply information provided -as part of the authentication messaging process, the other uses -just and error code. - - - -The down-side of this mode of configuration is the fact that -for security reasons Samba will send the password server a bogus -username and a bogus password and if the remote server fails to -reject the username and password pair then an alternative mode -of identification of validation is used. Where a site uses password -lock out after a certain number of failed authentication attempts -this will result in user lockouts. - - - -Use of this mode of authentication does require there to be -a standard Unix account for the user, this account can be blocked -to prevent logons by other than MS Windows clients. - - - - - -Make Samba a member of an MS Windows NT security domain - - -This method involves additon of the following paramters in the smb.conf file: - - - - encrypt passwords = Yes - security = domain - workgroup = "name of NT domain" - password server = * - - - -The use of the "*" argument to "password server" will cause samba -to locate the domain controller in a way analogous to the way -this is done within MS Windows NT. - - - -In order for this method to work the Samba server needs to join the -MS Windows NT security domain. This is done as follows: - - - - On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. - - - Next, on the Linux system execute: - smbpasswd -r PDC_NAME -j DOMAIN_NAME - - - - -Use of this mode of authentication does require there to be -a standard Unix account for the user in order to assign -a uid once the account has been authenticated by the remote -Windows DC. This account can be blocked to prevent logons by -other than MS Windows clients by things such as setting an invalid -shell in the /etc/passwd entry. - - - -An alternative to assigning UIDs to Windows users on a -Samba member server is presented in the Winbind Overview chapter in -this HOWTO collection. - - - - - - - -Configure Samba as an authentication server - - -This mode of authentication demands that there be on the -Unix/Linux system both a Unix style account as well as an -smbpasswd entry for the user. The Unix system account can be -locked if required as only the encrypted password will be -used for SMB client authentication. - - - -This method involves addition of the following parameters to -the smb.conf file: - - - -## please refer to the Samba PDC HOWTO chapter later in -## this collection for more details -[global] - encrypt passwords = Yes - security = user - domain logons = Yes - ; an OS level of 33 or more is recommended - os level = 33 - -[NETLOGON] - path = /somewhare/in/file/system - read only = yes - - - -in order for this method to work a Unix system account needs -to be created for each user, as well as for each MS Windows NT/2000 -machine. The following structure is required. - - - -Users - - -A user account that may provide a home directory should be -created. The following Linux system commands are typical of -the procedure for creating an account. - - - - # useradd -s /bin/bash -d /home/"userid" -m "userid" - # passwd "userid" - Enter Password: <pw> - - # smbpasswd -a "userid" - Enter Password: <pw> - - - - -MS Windows NT Machine Accounts - - -These are required only when Samba is used as a domain -controller. Refer to the Samba-PDC-HOWTO for more details. - - - - # useradd -s /bin/false -d /dev/null "machine_name"\$ - # passwd -l "machine_name"\$ - # smbpasswd -a -m "machine_name" - - - - - - - -Conclusions - - -Samba provides a flexible means to operate as... - - - - A Stand-alone server - No special action is needed - other than to create user accounts. Stand-alone servers do NOT - provide network logon services, meaning that machines that use this - server do NOT perform a domain logon but instead make use only of - the MS Windows logon which is local to the MS Windows - workstation/server. - - - An MS Windows NT 3.x/4.0 security domain member. - - - - An alternative to an MS Windows NT 3.x/4.0 - Domain Controller. - - - - - - diff --git a/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml b/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml index d6fe6760b5..7608f821cf 100644 --- a/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml +++ b/docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml @@ -11,8 +11,6 @@ - - (Jun 21 2001) @@ -42,6 +40,19 @@ PAM is configured either through one file /etc/pam.conf (So or by editing individual files that are located in /etc/pam.d. + + + If the PAM authentication module (loadable link library file) is located in the + default location then it is not necessary to specify the path. In the case of + Linux, the default location is /lib/security. If the module + is located other than default then the path may be specified as: + + + eg: "auth required /other_path/pam_strange_module.so" + + + + The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable @@ -51,20 +62,20 @@ by commenting them out except the calls to pam_pwdb.so. -#%PAM-1.0 -# The PAM configuration file for the `login' service -# -auth required pam_securetty.so -auth required pam_nologin.so -# auth required pam_dialup.so -# auth optional pam_mail.so -auth required pam_pwdb.so shadow md5 -# account requisite pam_time.so -account required pam_pwdb.so -session required pam_pwdb.so -# session optional pam_lastlog.so -# password required pam_cracklib.so retry=3 -password required pam_pwdb.so shadow md5 + #%PAM-1.0 + # The PAM configuration file for the `login' service + # + auth required pam_securetty.so + auth required pam_nologin.so + # auth required pam_dialup.so + # auth optional pam_mail.so + auth required pam_pwdb.so shadow md5 + # account requisite pam_time.so + account required pam_pwdb.so + session required pam_pwdb.so + # session optional pam_lastlog.so + # password required pam_cracklib.so retry=3 + password required pam_pwdb.so shadow md5 @@ -73,19 +84,19 @@ sample system include: -$ /bin/ls /lib/security -pam_access.so pam_ftp.so pam_limits.so -pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so -pam_cracklib.so pam_group.so pam_listfile.so -pam_nologin.so pam_rootok.so pam_tally.so -pam_deny.so pam_issue.so pam_mail.so -pam_permit.so pam_securetty.so pam_time.so -pam_dialup.so pam_lastlog.so pam_mkhomedir.so -pam_pwdb.so pam_shells.so pam_unix.so -pam_env.so pam_ldap.so pam_motd.so -pam_radius.so pam_smbpass.so pam_unix_acct.so -pam_wheel.so pam_unix_auth.so pam_unix_passwd.so -pam_userdb.so pam_warn.so pam_unix_session.so + $ /bin/ls /lib/security + pam_access.so pam_ftp.so pam_limits.so + pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so + pam_cracklib.so pam_group.so pam_listfile.so + pam_nologin.so pam_rootok.so pam_tally.so + pam_deny.so pam_issue.so pam_mail.so + pam_permit.so pam_securetty.so pam_time.so + pam_dialup.so pam_lastlog.so pam_mkhomedir.so + pam_pwdb.so pam_shells.so pam_unix.so + pam_env.so pam_ldap.so pam_motd.so + pam_radius.so pam_smbpass.so pam_unix_acct.so + pam_wheel.so pam_unix_auth.so pam_unix_passwd.so + pam_userdb.so pam_warn.so pam_unix_session.so @@ -110,13 +121,13 @@ source distribution. -#%PAM-1.0 -# The PAM configuration file for the `login' service -# -auth required pam_smbpass.so nodelay -account required pam_smbpass.so nodelay -session required pam_smbpass.so nodelay -password required pam_smbpass.so nodelay + #%PAM-1.0 + # The PAM configuration file for the `login' service + # + auth required pam_smbpass.so nodelay + account required pam_smbpass.so nodelay + session required pam_smbpass.so nodelay + password required pam_smbpass.so nodelay @@ -125,13 +136,13 @@ Linux system. The default condition uses pam_pwdb.so. -#%PAM-1.0 -# The PAM configuration file for the `samba' service -# -auth required /lib/security/pam_pwdb.so nullok nodelay shadow audit -account required /lib/security/pam_pwdb.so audit nodelay -session required /lib/security/pam_pwdb.so nodelay -password required /lib/security/pam_pwdb.so shadow md5 + #%PAM-1.0 + # The PAM configuration file for the `samba' service + # + auth required /lib/security/pam_pwdb.so nullok nodelay shadow audit + account required /lib/security/pam_pwdb.so audit nodelay + session required /lib/security/pam_pwdb.so nodelay + password required /lib/security/pam_pwdb.so shadow md5 @@ -143,13 +154,13 @@ program. -#%PAM-1.0 -# The PAM configuration file for the `samba' service -# -auth required /lib/security/pam_smbpass.so nodelay -account required /lib/security/pam_pwdb.so audit nodelay -session required /lib/security/pam_pwdb.so nodelay -password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf + #%PAM-1.0 + # The PAM configuration file for the `samba' service + # + auth required /lib/security/pam_smbpass.so nodelay + account required /lib/security/pam_pwdb.so audit nodelay + session required /lib/security/pam_pwdb.so nodelay + password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf PAM allows stacking of authentication mechanisms. It is diff --git a/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml b/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml index e3bee32db0..46e69e4ba9 100644 --- a/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml +++ b/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml @@ -13,7 +13,7 @@ -How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain +Samba Backup Domain Controller to Samba Domain Control diff --git a/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml b/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml index 53dae21775..c8a20ba8d9 100644 --- a/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml +++ b/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml @@ -68,27 +68,32 @@ PDC functionality. - domain logons for Windows NT 4.0 / 200x / XP Professional clients. + Domain logons for Windows NT 4.0 / 200x / XP Professional clients. - placing Windows 9x / Me clients in user level security + Placing Windows 9x / Me clients in user level security - retrieving a list of users and groups from a Samba PDC to + Retrieving a list of users and groups from a Samba PDC to Windows 9x / Me / NT / 200x / XP Professional clients - roaming user profiles + Roaming Profiles - Windows NT 4.0-style system policies + Network/System Policies + + +Roaming Profiles and System/Network policies are advanced network administration topics +that are covered separately in this document. + The following functionalities are new to the Samba 3.0 release: @@ -587,18 +592,17 @@ version of Windows. I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your + can not log you on (C000019B), Please try again or consult your system administrator" when attempting to logon. - This occurs when the domain SID stored in - private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. + This occurs when the domain SID stored in the secrets.tdb database + is changed. The most common cause of a change in domain SID is when + the domain name and/or the server name (netbios name) is changed. + The only way to correct the problem is to restore the original domain + SID or remove the domain client from the domain and rejoin. The domain + SID may be reset using either the smbpasswd or rpcclient utilities. @@ -675,128 +679,6 @@ version of Windows. - - - - - - -System Policies and Profiles - - - -Much of the information necessary to implement System Policies and -Roving User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft. - - - -Here are some additional details: - - - - - - - What about Windows NT Policy Editor? - - - - To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - - - - The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - - - - - - - Can Win95 do Policies? - - - - Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... - - - - If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. - - - - - - - How do I get 'User Manager' and 'Server Manager' - - - - Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? - - - - Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes - - - - Server Manager - - User Manager for Domains - - Event Viewer - - - - Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE - - - - The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE - - - - - - - - - - - -DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba - - - - Possibly Outdated Material - - - This appendix was originally authored by John H Terpstra of - the Samba Team and is included here for posterity. - - - - - -NOTE : -The term "Domain Controller" and those related to it refer to one specific -method of authentication that can underly an SMB domain. Domain Controllers -prior to Windows NT Server 3.1 were sold by various companies and based on -private extensions to the LAN Manager 2.1 protocol. Windows NT introduced -Microsoft-specific ways of distributing the user authentication database. -See DOMAIN.txt for examples of how Samba can participate in or create -SMB domains based on shared authentication database schemes other than the -Windows NT SAM. - - - -Windows NT Server can be installed as either a plain file and print server -(WORKGROUP workstation or server) or as a server that participates in Domain -Control (DOMAIN member, Primary Domain controller or Backup Domain controller). -The same is true for OS/2 Warp Server, Digital Pathworks and other similar -products, all of which can participate in Domain Control along with Windows NT. - - - -To many people these terms can be confusing, so let's try to clear the air. - - - -Every Windows NT system (workstation or server) has a registry database. -The registry contains entries that describe the initialization information -for all services (the equivalent of Unix Daemons) that run within the Windows -NT environment. The registry also contains entries that tell application -software where to find dynamically loadable libraries that they depend upon. -In fact, the registry contains entries that describes everything that anything -may need to know to interact with the rest of the system. - - - -The registry files can be located on any Windows NT machine by opening a -command prompt and typing: - - - -C:\WINNT\> dir %SystemRoot%\System32\config - - - -The environment variable %SystemRoot% value can be obtained by typing: - - - -C:\WINNT>echo %SystemRoot% - - - -The active parts of the registry that you may want to be familiar with are -the files called: default, system, software, sam and security. - - - -In a domain environment, Microsoft Windows NT domain controllers participate -in replication of the SAM and SECURITY files so that all controllers within -the domain have an exactly identical copy of each. - - - -The Microsoft Windows NT system is structured within a security model that -says that all applications and services must authenticate themselves before -they can obtain permission from the security manager to do what they set out -to do. - - - -The Windows NT User database also resides within the registry. This part of -the registry contains the user's security identifier, home directory, group -memberships, desktop profile, and so on. - - - -Every Windows NT system (workstation as well as server) will have its own -registry. Windows NT Servers that participate in Domain Security control -have a database that they share in common - thus they do NOT own an -independent full registry database of their own, as do Workstations and -plain Servers. - - - -The User database is called the SAM (Security Access Manager) database and -is used for all user authentication as well as for authentication of inter- -process authentication (i.e. to ensure that the service action a user has -requested is permitted within the limits of that user's privileges). - - - -The Samba team have produced a utility that can dump the Windows NT SAM into -smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and -/pub/samba/pwdump on your nearest Samba mirror for the utility. This -facility is useful but cannot be easily used to implement SAM replication -to Samba systems. - - - -Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers -can participate in a Domain security system that is controlled by Windows NT -servers that have been correctly configured. Almost every domain will have -ONE Primary Domain Controller (PDC). It is desirable that each domain will -have at least one Backup Domain Controller (BDC). - - - -The PDC and BDCs then participate in replication of the SAM database so that -each Domain Controlling participant will have an up to date SAM component -within its registry. - - - - diff --git a/docs/docbook/projdoc/ServerType.sgml b/docs/docbook/projdoc/ServerType.sgml index 41b1c0ed2f..91478740d6 100644 --- a/docs/docbook/projdoc/ServerType.sgml +++ b/docs/docbook/projdoc/ServerType.sgml @@ -44,6 +44,13 @@ discussions regarding "security mode". The smb.conf configuration parameters that control security mode are: "security = user" and "security = share". + +No special action is needed other than to create user accounts. Stand-alone +servers do NOT provide network logon services, meaning that machines that +use this server do NOT perform a domain logon but instead make use only of +the MS Windows logon which is local to the MS Windows workstation/server. + + Samba tends to blur the distinction a little in respect of what is a stand alone server. This is because the authentication database may be diff --git a/docs/docbook/projdoc/samba-doc.sgml b/docs/docbook/projdoc/samba-doc.sgml index 1a2e285596..8784bad1b7 100644 --- a/docs/docbook/projdoc/samba-doc.sgml +++ b/docs/docbook/projdoc/samba-doc.sgml @@ -22,11 +22,11 @@ - + ]> @@ -102,30 +102,30 @@ for various environments. -Optional configuration +Advanced Configuration Introduction Samba has several features that you might want or might not want to use. The chapters in this part each cover one specific feature. -&IntegratingWithWindows; +&AdvancedNetworkManagment; &NT-Security; +&GROUP-MAPPING-HOWTO; &Samba-PAM; -&MS-Dfs-Setup; &PRINTER-DRIVER2; &CUPS; &WINBIND; +&IntegratingWithWindows; &BROWSING; +&MS-Dfs-Setup; &VFS; -&GROUP-MAPPING-HOWTO; -&SPEED; -&GroupProfiles; &SecuringSamba; &unicode; Appendixes +&SPEED; &Portability; &Other-Clients; &Compiling; @@ -133,4 +133,4 @@ part each cover one specific feature. &Diagnosis; - + diff --git a/docs/docbook/projdoc/security_level.sgml b/docs/docbook/projdoc/security_level.sgml index 00dcc6e83b..fd0fef90fe 100644 --- a/docs/docbook/projdoc/security_level.sgml +++ b/docs/docbook/projdoc/security_level.sgml @@ -8,8 +8,15 @@ +Samba as Stand-Alone ServerSamba as Stand-Alone server (User and Share security level) + +In this section the function and purpose of Samba's security +modes are described. + + + +User and Share security level A SMB server tells the client at startup what "security level" it is @@ -23,6 +30,9 @@ can only tell the client what is available and whether an action is allowed. + +User Level Security + I'll describe user level security first, as its simpler. In user level security the client will send a "session setup" command directly after @@ -53,6 +63,11 @@ maintain multiple authentication contexts in this way (WinDD is an example of an application that does this) + + + +Share Level Security> + <para> Ok, now for share level security. In share level security the client authenticates itself separately for each share. It will send a @@ -79,6 +94,11 @@ usernames". If a match is found then the client is authenticated as that user. </para> +</sect2> + +<sect2> +<title>Server Level Security + Finally "server level" security. In server level security the samba server reports to the client that it is in user level security. The @@ -113,4 +133,204 @@ That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support. + +Configuring Samba for Seemless Windows Network Integration + + +MS Windows clients may use encrypted passwords as part of a challenege/response +authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple +password based authentication. It should be realized that with the SMB protocol +the password is passed over the network either in plain text or encrypted, but +not both in the same authentication requests. + + + +When encrypted passwords are used a password that has been entered by the user +is encrypted in two ways: + + + + An MD4 hash of the UNICODE of the password + string. This is known as the NT hash. + + + The password is converted to upper case, + and then padded or trucated to 14 bytes. This string is + then appended with 5 bytes of NULL characters and split to + form two 56 bit DES keys to encrypt a "magic" 8 byte value. + The resulting 16 bytes for the LanMan hash. + + + + +MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 +pre-service pack 3 will use either mode of password authentication. All +versions of MS Windows that follow these versions no longer support plain +text passwords by default. + + + +MS Windows clients have a habit of dropping network mappings that have been idle +for 10 minutes or longer. When the user attempts to use the mapped drive +connection that has been dropped, the client re-establishes the connection using +a cached copy of the password. + + + +When Microsoft changed the default password mode, support was dropped for caching +of the plain text password. This means that when the registry parameter is changed +to re-enable use of plain text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate it will fail if the remote +authentication server does not support encrypted passwords. This means that it +is definitely not a good idea to re-enable plain text password support in such clients. + + + +The following parameters can be used to work around the issue of Windows 9x client +upper casing usernames and password before transmitting them to the SMB server +when using clear text authentication. + + + + passsword level = integer + username level = integer + + + +By default Samba will lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower case character, the username level parameter +is rarely needed. + + + +However, passwords on UNIX systems often make use of mixed case characters. +This means that in order for a user on a Windows 9x client to connect to a Samba +server using clear text authentication, the password level +must be set to the maximum number of upper case letter which could +appear is a password. Note that is the server OS uses the traditional DES version +of crypt(), then a password level of 8 will result in case +insensitive passwords as seen from Windows users. This will also result in longer +login times as Samba hash to compute the permutations of the password string and +try them one by one until a match is located (or all combinations fail). + + + +The best option to adopt is to enable support for encrypted passwords +where ever Samba is used. There are three configuration possibilities +for support of encrypted passwords: + + + + +Use MS Windows NT as an authentication server + + +This method involves the additions of the following parameters in the smb.conf file: + + + + encrypt passwords = Yes + security = server + password server = "NetBIOS_name_of_PDC" + + + + +There are two ways of identifying whether or not a username and +password pair was valid or not. One uses the reply information provided +as part of the authentication messaging process, the other uses +just and error code. + + + +The down-side of this mode of configuration is the fact that +for security reasons Samba will send the password server a bogus +username and a bogus password and if the remote server fails to +reject the username and password pair then an alternative mode +of identification of validation is used. Where a site uses password +lock out after a certain number of failed authentication attempts +this will result in user lockouts. + + + +Use of this mode of authentication does require there to be +a standard Unix account for the user, this account can be blocked +to prevent logons by other than MS Windows clients. + + + + + + +Domain Level Security + + +When samba is operating in security = domain mode this means that +the Samba server has a domain security trust account (a machine account) and will cause +all authentication requests to be passed through to the domain controllers. + + + +Samba as a member of an MS Windows NT security domain + + +This method involves additon of the following paramters in the smb.conf file: + + + + encrypt passwords = Yes + security = domain + workgroup = "name of NT domain" + password server = * + + + +The use of the "*" argument to "password server" will cause samba to locate the +domain controller in a way analogous to the way this is done within MS Windows NT. +This is the default behaviour. + + + +In order for this method to work the Samba server needs to join the +MS Windows NT security domain. This is done as follows: + + + + On the MS Windows NT domain controller using + the Server Manager add a machine account for the Samba server. + + + Next, on the Linux system execute: + smbpasswd -r PDC_NAME -j DOMAIN_NAME + + + + +Use of this mode of authentication does require there to be a standard Unix account +for the user in order to assign a uid once the account has been authenticated by +the remote Windows DC. This account can be blocked to prevent logons by other than +MS Windows clients by things such as setting an invalid shell in the +/etc/passwd entry. + + + +An alternative to assigning UIDs to Windows users on a Samba member server is +presented in the Winbind Overview chapter +in this HOWTO collection. + + + + + + +ADS Level Security + + +For information about the configuration option please refer to the entire section entitled +Samba as an ADS Domain Member. + + + + -- cgit From 938982737509745b57152452a7983bed0fb2fd3b Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Wed, 2 Apr 2003 00:05:38 +0000 Subject: And yet another doco update. Yet more to follow soon. (This used to be commit d309f39f6422aabd4ee95753d7cf5d07512dd345) --- docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 779 +++++++++++++++++++++++++ docs/docbook/projdoc/GroupProfiles.sgml | 289 --------- 2 files changed, 779 insertions(+), 289 deletions(-) create mode 100644 docs/docbook/projdoc/AdvancedNetworkAdmin.sgml delete mode 100644 docs/docbook/projdoc/GroupProfiles.sgml diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml new file mode 100644 index 0000000000..c03acb4b90 --- /dev/null +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -0,0 +1,779 @@ + + + + John HTerpstra + + Samba Team +

+ jht@samba.org +
+ + + + + April 1 2003 + + + +System Policies + + +Much of the information necessary to implement System Policies and +Roaming User Profiles in a Samba domain is the same as that for +implementing these same items in a Windows NT 4.0 domain. +You should read the white paper Implementing +Profiles and Policies in Windows NT 4.0 available from Microsoft. + + + +Here are some additional details: + + + + + + What about Windows NT Policy Editor? + + + + To create or edit ntconfig.pol you must use + the NT Server Policy Editor, poledit.exe which + is included with NT Server but not NT Workstation. + There is a Policy Editor on a NTws + but it is not suitable for creating Domain Policies. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need poledit.exe, common.adm and winnt.adm. It is convenient + to put the two *.adm files in c:\winnt\inf which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'. + + + + The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. + + + + + + Can Win95 do Policies? + + + + Install the group policy handler for Win9x to pick up group + policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of + times and see if Win98 picks up group policies. Unfortunately this needs + to be done on every Win9x machine that uses group policies.... + + + + If group policies don't work one reports suggests getting the updated + (read: working) grouppol.dll for Windows 9x. The group list is grabbed + from /etc/group. + + + + + + How do I get 'User Manager' and 'Server Manager' + + + + Since I don't need to buy an NT Server CD now, how do I get + the 'User Manager for Domains', the 'Server Manager'? + + + + Microsoft distributes a version of these tools called nexus for + installation on Windows 95 systems. The tools set includes + + + + Server Manager + + User Manager for Domains + + Event Viewer + + + + Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE + + + + The Windows NT 4.0 version of the 'User Manager for + Domains' and 'Server Manager' are available from Microsoft via ftp + from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE + + + + + +Creating Group Prolicy Files + + +Windows '9x + +You need the Win98 Group Policy Editor to +set Group Profiles up under Windows '9x. It can be found on the Original +full product Win98 installation CD under +tools/reskit/netadmin/poledit. You install this +using the Add/Remove Programs facility and then click on the 'Have Disk' +tab. + + + +Use the Group Policy Editor to create a policy file that specifies the +location of user profiles and/or the My Documents etc. +stuff. You then save these settings in a file called +Config.POL that needs to be placed in +the root of the [NETLOGON] share. If your Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the +Win9x/Me registry of the machine that is logging on. + + + +All of this is covered in the Win98 Resource Kit documentation. + + + +If you do not do it this way, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings. + + + + + + +Roaming Profiles + + + +NOTE! Roaming profiles support is different for Win9X and WinNT. + + + + +Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features. + + + +Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory. + + + + +WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT. + + + +Windows NT Configuration + + +To support WinNT clients, in the [global] section of smb.conf set the +following (for example): + + + +logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath + + + +The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable. + + + + +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path. + + + + + + +Windows 9X Configuration + + +To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter. + + + +By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file: + + + +logon home = \\%L\%U\.profiles + + + +then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). + + + +Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home". + + + + + + +Win9X and WinNT Configuration + + +You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example: + + + +logon home = \\%L\%U\.profiles +logon path = \\%L\profiles\%U + + + + +I have not checked what 'net use /home' does on NT when "logon home" is +set as above. + + + + + +Windows 9X Profile Setup + + +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders. + + + +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. + + + + + + On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + + + + + + + On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + + + + + + +Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me. + + + +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. + + + +Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'. + + + +Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created. + + + +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. + + + +If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. + + + +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". + + + + + + instead of logging in under the [user, password, domain] dialog, + press escape. + + + + + + run the regedit.exe program, and look in: + + + + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + + + + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + + + + [Exit the registry editor]. + + + + + + WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). + + + + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + + + + + + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + + + + + + + log off the windows 95 client. + + + + + + check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + + + + + + +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports. + + + +If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace. + + + + + +Windows NT Workstation 4.0 + + +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter. + + + +There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter. + + + +The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) + + + +In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. + + + +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. + + + +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. + + + + + + +Windows NT/200x Server + + +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. + + + + + +Sharing Profiles between W9x/Me and NT4/200x/XP workstations + + +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. + + + +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home. + + + +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. + + + + + + +Windows NT 4 + + +Unfortunately, the Resource Kit info is Win NT4 or 200x specific. + + + +Here is a quick guide: + + + + + +On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'. + + + +Select a user profile you want to migrate and click on it. + + +I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC. + + +Click the 'Copy To' button. + +In the box labelled 'Copy Profile to' add your new path, eg: +c:\temp\foobar + +Click on the button labelled 'Change' in the "Permitted to use" box. + +Click on the group 'Everyone' and then click OK. This closes the +'chose user' box. + +Now click OK. + + + +Follow the above for every profile you need to migrate. + + + +Side bar Notes + + +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page. + + +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. + + + + + +Mandatory profiles + + +The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN. + + + + + +moveuser.exe + + +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. + + + + + +Get SID + + +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. + + + +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList + + + +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. + + + + + + + +Windows 2000/XP + + +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: + + + + +Log on as the LOCAL workstation administrator. + + + +Right click on the 'My Computer' Icon, select 'Properties' + + + +Click on the 'User Profiles' tab + + + +Select the profile you wish to convert (click on it once) + + + +Click on the button 'Copy To' + + + +In the "Permitted to use" box, click on the 'Change' button. + + + +Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible. + + +You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword. + + + +To make the profile capable of being used by anyone select 'Everyone' + + + +Click OK. The Selection box will close. + + + +Now click on the 'Ok' button to create the profile in the path you +nominated. + + + + +Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool. + + + + +Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. + + + + + + +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is: + +"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders" + +...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. + + + +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): + + + + + +On the XP workstation log in with an Administrator account. + + +Click: "Start", "Run" +Type: "mmc" +Click: "OK" + +A Microsoft Management Console should appear. +Click: File, "Add/Remove Snap-in...", "Add" +Double-Click: "Group Policy" +Click: "Finish", "Close" +Click: "OK" + +In the "Console Root" window: +Expand: "Local Computer Policy", "Computer Configuration", +"Administrative Templates", "System", "User Profiles" +Double-Click: "Do not check for user ownership of Roaming Profile +Folders" +Select: "Enabled" +Click: OK" + +Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed). + +Reboot + + + + + + + diff --git a/docs/docbook/projdoc/GroupProfiles.sgml b/docs/docbook/projdoc/GroupProfiles.sgml deleted file mode 100644 index 8bdf98059a..0000000000 --- a/docs/docbook/projdoc/GroupProfiles.sgml +++ /dev/null @@ -1,289 +0,0 @@ - - - - JohnTerpstra - - - JelmerVernooij - - - JohnRussell - -
apca72@dsl.pipex.com
- - - - -Creating Group Prolicy Files - - -Windows '9x - -You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -tools/reskit/netadmin/poledit. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab. - - - -Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the My Documents etc. -stuff. You then save these settings in a file called -Config.POL that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on. - - - -All of this is covered in the Win98 Resource Kit documentation. - - - -If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings. - - - -The following all refers to Windows NT/200x profile migration - not to policies. -We need a separate section on policies (NTConfig.Pol) for NT4/200x. - - - - -Windows NT 4 - - -Unfortunately, the Resource Kit info is Win NT4 or 200x specific. - - - -Here is a quick guide: - - - - - -On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'. - - - -Select a user profile you want to migrate and click on it. - - -I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC. - - -Click the 'Copy To' button. - -In the box labelled 'Copy Profile to' add your new path, eg: -c:\temp\foobar - -Click on the button labelled 'Change' in the "Permitted to use" box. - -Click on the group 'Everyone' and then click OK. This closes the -'chose user' box. - -Now click OK. - - - -Follow the above for every profile you need to migrate. - - - -Side bar Notes - - -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page. - - -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. - - - - - -Mandatory profiles - - -The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN. - - - - - -moveuser.exe - - -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. - - - - - -Get SID - - -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. - - - -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList - - - -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. - - - - - - - -Windows 2000/XP - - -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: - - - - -Log on as the LOCAL workstation administrator. - - - -Right click on the 'My Computer' Icon, select 'Properties' - - - -Click on the 'User Profiles' tab - - - -Select the profile you wish to convert (click on it once) - - - -Click on the button 'Copy To' - - - -In the "Permitted to use" box, click on the 'Change' button. - - - -Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible. - - -You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword. - - - -To make the profile capable of being used by anyone select 'Everyone' - - - -Click OK. The Selection box will close. - - - -Now click on the 'Ok' button to create the profile in the path you -nominated. - - - - -Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool. - - - - -Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. - - - - - - -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is: - -"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders" - -...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. - - - -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): - - - - - -On the XP workstation log in with an Administrator account. - - -Click: "Start", "Run" -Type: "mmc" -Click: "OK" - -A Microsoft Management Console should appear. -Click: File, "Add/Remove Snap-in...", "Add" -Double-Click: "Group Policy" -Click: "Finish", "Close" -Click: "OK" - -In the "Console Root" window: -Expand: "Local Computer Policy", "Computer Configuration", -"Administrative Templates", "System", "User Profiles" -Double-Click: "Do not check for user ownership of Roaming Profile -Folders" -Select: "Enabled" -Click: OK" - -Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed). - -Reboot - - - - - -- cgit From f6f96c2966ee3c96cb8188ce832aa822146de337 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 2 Apr 2003 02:26:01 +0000 Subject: Subtle changes to message handling after ENUMJOBS. Jeremy. (This used to be commit 48f3bf0ea51b9fd09dfb017870e32ca4a8cc4b8c) --- source3/printing/notify.c | 5 +- source3/printing/printing.c | 94 ++++++++++++++++++++++++++++---- source3/rpc_server/srv_spoolss_nt.c | 103 +++++++++++++++++++++++++++++++++--- 3 files changed, 183 insertions(+), 19 deletions(-) diff --git a/source3/printing/notify.c b/source3/printing/notify.c index 50c5ce39f6..641f951bdd 100644 --- a/source3/printing/notify.c +++ b/source3/printing/notify.c @@ -27,6 +27,7 @@ static TALLOC_CTX *send_ctx; static struct notify_queue { struct notify_queue *next, *prev; struct spoolss_notify_msg *msg; + struct timeval tv; char *buf; size_t buflen; } *notify_queue_head = NULL; @@ -81,7 +82,8 @@ again: len += tdb_pack(buf + len, buflen - len, "f", msg->printer); - len += tdb_pack(buf + len, buflen - len, "ddddd", + len += tdb_pack(buf + len, buflen - len, "ddddddd", + (uint32)q->tv.tv_sec, (uint32)q->tv.tv_usec, msg->type, msg->field, msg->id, msg->len, msg->flags); /* Pack data */ @@ -259,6 +261,7 @@ in notify_queue\n", msg->type, msg->field, msg->printer)); return; } copy_notify2_msg(pnqueue->msg, msg); + gettimeofday(&pnqueue->tv, NULL); pnqueue->buf = NULL; pnqueue->buflen = 0; diff --git a/source3/printing/printing.c b/source3/printing/printing.c index cff6eb62ef..06941c67dd 100644 --- a/source3/printing/printing.c +++ b/source3/printing/printing.c @@ -24,6 +24,7 @@ /* Current printer interface */ static struct printif *current_printif = &generic_printif; +static BOOL remove_from_jobs_changed(int snum, uint32 jobid); /* the printing backend revolves around a tdb database that stores the @@ -663,9 +664,11 @@ static int traverse_fn_delete(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data, void if (jobid == u_jobid) break; } - if (i == ts->qcount) + if (i == ts->qcount) { + DEBUG(10,("traverse_fn_delete: pjob %u deleted due to !smbjob\n", + (unsigned int)jobid )); pjob_delete(ts->snum, jobid); - else + } else ts->total_jobs++; return 0; } @@ -675,9 +678,11 @@ static int traverse_fn_delete(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data, void /* if a job is not spooled and the process doesn't exist then kill it. This cleans up after smbd deaths */ - if (!process_exists(pjob.pid)) + if (!process_exists(pjob.pid)) { + DEBUG(10,("traverse_fn_delete: pjob %u deleted due to !process_exists (%u)\n", + (unsigned int)jobid, (unsigned int)pjob.pid )); pjob_delete(ts->snum, jobid); - else + } else ts->total_jobs++; return 0; } @@ -700,9 +705,13 @@ static int traverse_fn_delete(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data, void is currently traversing the printing tdb and deleting jobs. Don't delete the job if it was submitted after the lpq_time. */ - if (pjob.starttime < ts->lpq_time) + if (pjob.starttime < ts->lpq_time) { + DEBUG(10,("traverse_fn_delete: pjob %u deleted due to pjob.starttime (%u) < ts->lpq_time (%u)\n", + (unsigned int)jobid, + (unsigned int)pjob.starttime, + (unsigned int)ts->lpq_time )); pjob_delete(ts->snum, jobid); - else + } else ts->total_jobs++; } else @@ -872,6 +881,37 @@ static void store_queue_struct(struct tdb_print_db *pdb, struct traverse_struct return; } +static TDB_DATA get_jobs_changed_data(struct tdb_print_db *pdb) +{ + TDB_DATA data, key; + + key.dptr = "INFO/jobs_changed"; + key.dsize = strlen(key.dptr); + ZERO_STRUCT(data); + + data = tdb_fetch(pdb->tdb, key); + if (data.dptr == NULL || data.dsize == 0 || (data.dsize % 4 != 0)) { + SAFE_FREE(data.dptr); + ZERO_STRUCT(data); + } + + return data; +} + +static void check_job_changed(int snum, TDB_DATA data, uint32 jobid) +{ + unsigned int i; + unsigned int job_count = data.dsize / 4; + + for (i = 0; i < job_count; i++) { + uint32 ch_jobid; + + memcpy(&ch_jobid, data.dptr + (i*4), 4); + if (ch_jobid == jobid) + remove_from_jobs_changed(snum, jobid); + } +} + /**************************************************************************** Update the internal database from the system print queue for a queue. ****************************************************************************/ @@ -886,6 +926,7 @@ static void print_queue_update(int snum) struct traverse_struct tstruct; fstring keystr, printer_name, cachestr; TDB_DATA data, key; + TDB_DATA jcdata; struct tdb_print_db *pdb; fstrcpy(printer_name, lp_const_servicename(snum)); @@ -975,6 +1016,9 @@ static void print_queue_update(int snum) fill in any system job numbers as we go */ + + jcdata = get_jobs_changed_data(pdb); + for (i=0; isysjob = queue[i].job; pjob->status = queue[i].status; - pjob_store(snum, jobid, pjob); + check_job_changed(snum, jcdata, jobid); } + SAFE_FREE(jcdata.dptr); + /* now delete any queued entries that don't appear in the system queue */ tstruct.queue = queue; @@ -1364,6 +1410,10 @@ static BOOL remove_from_jobs_changed(int snum, uint32 jobid) tdb_chainunlock(pdb->tdb, key); SAFE_FREE(data.dptr); release_print_db(pdb); + if (ret) + DEBUG(10,("remove_from_jobs_changed: removed jobid %u\n", (unsigned int)jobid )); + else + DEBUG(10,("remove_from_jobs_changed: Failed to remove jobid %u\n", (unsigned int)jobid )); return ret; } @@ -1406,8 +1456,18 @@ static BOOL print_job_delete1(int snum, uint32 jobid) /* Delete the tdb entry if the delete suceeded or the job hasn't been spooled. */ - if (result == 0) + if (result == 0) { + const char *printername = lp_const_servicename(snum); + struct tdb_print_db *pdb = get_print_db_byname(printername); + int njobs = 1; + + if (!pdb) + return False; pjob_delete(snum, jobid); + /* Ensure we keep a rough count of the number of total jobs... */ + tdb_change_int32_atomic(pdb->tdb, "INFO/total_jobs", &njobs, -1); + release_print_db(pdb); + } return (result == 0); } @@ -1790,6 +1850,8 @@ static BOOL add_to_jobs_changed(struct tdb_print_db *pdb, uint32 jobid) data.dptr = (char *)&jobid; data.dsize = 4; + DEBUG(10,("add_to_jobs_changed: Added jobid %u\n", (unsigned int)jobid )); + return (tdb_append(pdb->tdb, key, data) == 0); } @@ -1998,7 +2060,6 @@ BOOL print_job_end(int snum, uint32 jobid, BOOL normal_close) pjob->spooled = True; pjob->status = LPQ_QUEUED; pjob_store(snum, jobid, pjob); - remove_from_jobs_changed(snum, jobid); /* make sure the database is up to date */ if (print_cache_expired(snum)) @@ -2031,6 +2092,10 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun int max_reported_jobs = lp_max_reported_jobs(snum); BOOL ret = False; + /* make sure the database is up to date */ + if (print_cache_expired(snum)) + print_queue_update(snum); + *pcount = 0; *ppqueue = NULL; @@ -2055,6 +2120,8 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun if (cgdata.dptr != NULL && (cgdata.dsize % 4 == 0)) extra_count = cgdata.dsize/4; + DEBUG(5,("get_stored_queue_info: qcount = %u, extra_count = %u\n", (unsigned int)qcount, (unsigned int)extra_count)); + /* Allocate the queue size. */ if (qcount == 0 && extra_count == 0) goto out; @@ -2091,9 +2158,13 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun struct printjob *pjob; memcpy(&jobid, &cgdata.dptr[i*4], 4); + DEBUG(5,("get_stored_queue_info: changed job = %u\n", (unsigned int)jobid)); pjob = print_job_find(snum, jobid); - if (!pjob) + if (!pjob) { + DEBUG(5,("get_stored_queue_info: failed to find changed job = %u\n", (unsigned int)jobid)); + remove_from_jobs_changed(snum, jobid); continue; + } queue[total_count].job = jobid; queue[total_count].size = pjob->size; @@ -2102,6 +2173,7 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun queue[total_count].priority = 1; fstrcpy(queue[total_count].fs_user, pjob->user); fstrcpy(queue[total_count].fs_file, pjob->jobname); + total_count++; } /* Sort the queue by submission time otherwise they are displayed @@ -2109,6 +2181,8 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun qsort(queue, total_count, sizeof(print_queue_struct), QSORT_CAST(printjob_comp)); + DEBUG(5,("get_stored_queue_info: total_count = %u\n", (unsigned int)total_count)); + if (max_reported_jobs && total_count > max_reported_jobs) total_count = max_reported_jobs; diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index c2729001e4..71d7530410 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -1031,9 +1031,10 @@ done: /*********************************************************************** **********************************************************************/ -static BOOL notify2_unpack_msg( SPOOLSS_NOTIFY_MSG *msg, void *buf, size_t len ) +static BOOL notify2_unpack_msg( SPOOLSS_NOTIFY_MSG *msg, struct timeval *tv, void *buf, size_t len ) { + uint32 tv_sec, tv_usec; size_t offset = 0; /* Unpack message */ @@ -1041,8 +1042,9 @@ static BOOL notify2_unpack_msg( SPOOLSS_NOTIFY_MSG *msg, void *buf, size_t len ) offset += tdb_unpack((char *)buf + offset, len - offset, "f", msg->printer); - offset += tdb_unpack((char *)buf + offset, len - offset, "ddddd", - &msg->type, &msg->field, &msg->id, &msg->len, &msg->flags); + offset += tdb_unpack((char *)buf + offset, len - offset, "ddddddd", + &tv_sec, &tv_usec, + &msg->type, &msg->field, &msg->id, &msg->len, &msg->flags); if (msg->len == 0) tdb_unpack((char *)buf + offset, len - offset, "dd", @@ -1054,6 +1056,9 @@ static BOOL notify2_unpack_msg( SPOOLSS_NOTIFY_MSG *msg, void *buf, size_t len ) DEBUG(3, ("notify2_unpack_msg: got NOTIFY2 message, type %d, field 0x%02x, flags 0x%04x\n", msg->type, msg->field, msg->flags)); + tv->tv_sec = tv_sec; + tv->tv_usec = tv_usec; + if (msg->len == 0) DEBUG(3, ("notify2_unpack_msg: value1 = %d, value2 = %d\n", msg->notify.value[0], msg->notify.value[1])); @@ -1063,6 +1068,58 @@ static BOOL notify2_unpack_msg( SPOOLSS_NOTIFY_MSG *msg, void *buf, size_t len ) return True; } +/* ENUMJOB last timestamp list. */ +struct ejts_list { + struct ejts_list *next, *prev; + char *printer_name; + struct timeval tv; +}; + +static struct ejts_list *ejts_head; + +static struct ejts_list *find_enumjobs_timestamp(const char *printer_name) +{ + struct ejts_list *ejtsl; + + for( ejtsl = ejts_head; ejtsl; ejtsl = ejtsl->next) + if (strequal(ejtsl->printer_name, printer_name)) + return ejtsl; + return NULL; +} + +static void set_enumjobs_timestamp(int snum) +{ + const char *printer_name = lp_const_servicename(snum); + struct ejts_list *ejtsl = find_enumjobs_timestamp(printer_name); + + if (!ejtsl) { + ejtsl = (struct ejts_list *)malloc(sizeof(struct ejts_list)); + if (!ejtsl) + return; + ejtsl->printer_name = strdup(printer_name); + if (!ejtsl->printer_name) { + SAFE_FREE(ejtsl); + return; + } + DLIST_ADD(ejts_head, ejtsl); + } + + gettimeofday(&ejtsl->tv, NULL); +} + +static int timeval_diff(struct timeval *tv1, struct timeval *tv2) +{ + if (tv1->tv_sec > tv2->tv_sec) + return 1; + if (tv1->tv_sec < tv2->tv_sec) + return -1; + if (tv1->tv_usec > tv2->tv_usec) + return 1; + if (tv1->tv_usec < tv2->tv_usec) + return -1; + return 0; +} + /******************************************************************** Receive a notify2 message list ********************************************************************/ @@ -1104,8 +1161,9 @@ static void receive_notify2_message_list(int msg_type, pid_t src, void *msg, siz * call. Therefore messages are grouped according to printer handle. */ - for ( i=0; i len) { DEBUG(0,("receive_notify2_message_list: bad message format (len > buf_size) !\n")); return; @@ -1122,9 +1180,32 @@ static void receive_notify2_message_list(int msg_type, pid_t src, void *msg, siz /* unpack messages */ ZERO_STRUCT( notify ); - notify2_unpack_msg( ¬ify, msg_ptr, msg_len ); + notify2_unpack_msg( ¬ify, &msg_tv, msg_ptr, msg_len ); msg_ptr += msg_len; + /* See if it is still relevent. */ + if (notify.type == JOB_NOTIFY_TYPE) { + BOOL status_is_deleting = False; + + if (notify.field == JOB_NOTIFY_STATUS && (notify.notify.value[0] & (JOB_STATUS_DELETING|JOB_STATUS_DELETED))) + status_is_deleting = True; + + if (!status_is_deleting) { + struct ejts_list *ejtsl = find_enumjobs_timestamp(notify.printer); + + if (ejtsl && (timeval_diff(&ejtsl->tv, &msg_tv) > 0)) { + + DEBUG(10, ("receive_notify2_message_list: enumjobs ts = %u, %u, msg ts = %u, %u discarding\n", + (unsigned int)ejtsl->tv.tv_sec, (unsigned int)ejtsl->tv.tv_usec, + (unsigned int)msg_tv.tv_sec, (unsigned int)msg_tv.tv_usec )); + + /* Message no longer relevent. Ignore it. */ + if ( notify.len != 0 ) + SAFE_FREE( notify.notify.data ); + continue; + } + } + } /* add to correct list in container */ notify_msg_ctr_addmsg( &messages, ¬ify ); @@ -6352,6 +6433,7 @@ WERROR _spoolss_enumjobs( pipes_struct *p, SPOOL_Q_ENUMJOBS *q_u, SPOOL_R_ENUMJO uint32 offered = q_u->offered; uint32 *needed = &r_u->needed; uint32 *returned = &r_u->returned; + WERROR wret; int snum; print_status_struct prt_status; @@ -6373,15 +6455,20 @@ WERROR _spoolss_enumjobs( pipes_struct *p, SPOOL_Q_ENUMJOBS *q_u, SPOOL_R_ENUMJO DEBUGADD(4,("count:[%d], status:[%d], [%s]\n", *returned, prt_status.status, prt_status.message)); if (*returned == 0) { + set_enumjobs_timestamp(snum); SAFE_FREE(queue); return WERR_OK; } switch (level) { case 1: - return enumjobs_level1(queue, snum, buffer, offered, needed, returned); + wret = enumjobs_level1(queue, snum, buffer, offered, needed, returned); + set_enumjobs_timestamp(snum); + return wret; case 2: - return enumjobs_level2(queue, snum, buffer, offered, needed, returned); + wret = enumjobs_level2(queue, snum, buffer, offered, needed, returned); + set_enumjobs_timestamp(snum); + return wret; default: SAFE_FREE(queue); *returned=0; -- cgit From f6155befed845fa49c6cea43547677cbd9a3bd8d Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Wed, 2 Apr 2003 05:22:55 +0000 Subject: Fixing typos. Who put them typos in there? Argh! (This used to be commit 57d5a6862872be985bda67431f44a1f8491e3a81) --- docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 9 +++++---- docs/docbook/projdoc/Samba-PDC-HOWTO.sgml | 1 + docs/docbook/projdoc/samba-doc.sgml | 4 ++-- docs/docbook/projdoc/security_level.sgml | 2 +- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml index c03acb4b90..5180901fd3 100644 --- a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -14,9 +14,11 @@ April 1 2003 - System Policies + +Basic System Policy Info + Much of the information necessary to implement System Policies and Roaming User Profiles in a Samba domain is the same as that for @@ -154,8 +156,8 @@ copy of the registry it stores on each Win9x/Me machine. Hence, you will occasionally notice things changing back to the original settings. - + @@ -497,7 +499,6 @@ turns a profile into a mandatory one. The case of the profile is significant. The file must be called NTuser.DAT or, for a mandatory profile, NTuser.MAN. - @@ -774,6 +775,6 @@ changed). + - diff --git a/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml b/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml index c8a20ba8d9..7aabca948f 100644 --- a/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml +++ b/docs/docbook/projdoc/Samba-PDC-HOWTO.sgml @@ -94,6 +94,7 @@ PDC functionality. Roaming Profiles and System/Network policies are advanced network administration topics that are covered separately in this document. + The following functionalities are new to the Samba 3.0 release: diff --git a/docs/docbook/projdoc/samba-doc.sgml b/docs/docbook/projdoc/samba-doc.sgml index 8784bad1b7..c002214b77 100644 --- a/docs/docbook/projdoc/samba-doc.sgml +++ b/docs/docbook/projdoc/samba-doc.sgml @@ -26,7 +26,7 @@ - + ]> @@ -108,7 +108,7 @@ for various environments. Samba has several features that you might want or might not want to use. The chapters in this part each cover one specific feature. -&AdvancedNetworkManagment; +&AdvancedNetworkAdmin; &NT-Security; &GROUP-MAPPING-HOWTO; &Samba-PAM; diff --git a/docs/docbook/projdoc/security_level.sgml b/docs/docbook/projdoc/security_level.sgml index fd0fef90fe..e3d7c6ac1f 100644 --- a/docs/docbook/projdoc/security_level.sgml +++ b/docs/docbook/projdoc/security_level.sgml @@ -66,7 +66,7 @@ example of an application that does this) -Share Level Security> +<title>Share Level Security Ok, now for share level security. In share level security the client -- cgit From 4cec26daf801392ce2490833e962c8b56115d486 Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Wed, 2 Apr 2003 05:23:36 +0000 Subject: Update to current projdoc level. (This used to be commit 979283d6e91b68e1b52dbcffc52dd3750025fa23) --- docs/Samba-HOWTO-Collection.pdf | 10478 +++++++++++++++++++------------------- 1 file changed, 5250 insertions(+), 5228 deletions(-) diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 137d634c8f..85dcb89cb4 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -20,48 +20,48 @@ endobj 16 0 obj<]/Interpolate true/Filter/FlateDecode/Width 24/Height 24/BitsPerComponent 8/Length 223 >>stream xUQ0 58@4wo%wR+8C+N"]ׂ*W ,D1|Ši"%~0)܁1lN!31T4HԆ<<~Z>yn.H>LKb؎џ'4Y}-?f&tA{27L}On4KI" PBhïG]z$>.mcoendstream endobj -17 0 obj<>endobj -18 0 obj<>endobj -19 0 obj<>endobj -20 0 obj<>endobj -21 0 obj<>endobj -22 0 obj<>endobj -23 0 obj<>endobj -24 0 obj<>endobj -25 0 obj<>endobj -26 0 obj<>endobj -27 0 obj<>endobj -28 0 obj<>endobj -29 0 obj<>endobj -30 0 obj<>endobj -31 0 obj<>endobj -32 0 obj<>endobj -33 0 obj<>endobj -34 0 obj<>endobj -35 0 obj<>endobj -36 0 obj<>endobj -37 0 obj<>endobj -38 0 obj<>endobj -39 0 obj<>endobj -40 0 obj<>endobj -41 0 obj<>endobj -42 0 obj<>endobj -43 0 obj<>endobj -44 0 obj<>endobj -45 0 obj<>endobj -46 0 obj<>endobj -47 0 obj<>endobj -48 0 obj<>endobj -49 0 obj<>endobj -50 0 obj<>endobj -51 0 obj<>endobj -52 0 obj<>endobj -53 0 obj<>endobj -54 0 obj<>endobj -55 0 obj<>endobj -56 0 obj<>endobj -57 0 obj<>endobj -58 0 obj<>endobj +17 0 obj<>endobj +18 0 obj<>endobj +19 0 obj<>endobj +20 0 obj<>endobj +21 0 obj<>endobj +22 0 obj<>endobj +23 0 obj<>endobj +24 0 obj<>endobj +25 0 obj<>endobj +26 0 obj<>endobj +27 0 obj<>endobj +28 0 obj<>endobj +29 0 obj<>endobj +30 0 obj<>endobj +31 0 obj<>endobj +32 0 obj<>endobj +33 0 obj<>endobj +34 0 obj<>endobj +35 0 obj<>endobj +36 0 obj<>endobj +37 0 obj<>endobj +38 0 obj<>endobj +39 0 obj<>endobj +40 0 obj<>endobj +41 0 obj<>endobj +42 0 obj<>endobj +43 0 obj<>endobj +44 0 obj<>endobj +45 0 obj<>endobj +46 0 obj<>endobj +47 0 obj<>endobj +48 0 obj<>endobj +49 0 obj<>endobj +50 0 obj<>endobj +51 0 obj<>endobj +52 0 obj<>endobj +53 0 obj<>endobj +54 0 obj<>endobj +55 0 obj<>endobj +56 0 obj<>endobj +57 0 obj<>endobj +58 0 obj<>endobj 59 0 obj[17 0 R 18 0 R 19 0 R @@ -105,47 +105,47 @@ endobj 57 0 R 58 0 R]endobj 60 0 obj<>endobj -61 0 obj<>endobj -62 0 obj<>endobj -63 0 obj<>endobj -64 0 obj<>endobj -65 0 obj<>endobj -66 0 obj<>endobj -67 0 obj<>endobj -68 0 obj<>endobj -69 0 obj<>endobj -70 0 obj<>endobj -71 0 obj<>endobj -72 0 obj<>endobj -73 0 obj<>endobj -74 0 obj<>endobj -75 0 obj<>endobj -76 0 obj<>endobj -77 0 obj<>endobj -78 0 obj<>endobj -79 0 obj<>endobj -80 0 obj<>endobj -81 0 obj<>endobj -82 0 obj<>endobj -83 0 obj<>endobj -84 0 obj<>endobj -85 0 obj<>endobj -86 0 obj<>endobj -87 0 obj<>endobj -88 0 obj<>endobj -89 0 obj<>endobj -90 0 obj<>endobj -91 0 obj<>endobj -92 0 obj<>endobj -93 0 obj<>endobj -94 0 obj<>endobj -95 0 obj<>endobj -96 0 obj<>endobj -97 0 obj<>endobj -98 0 obj<>endobj -99 0 obj<>endobj -100 0 obj<>endobj -101 0 obj<>endobj +61 0 obj<>endobj +62 0 obj<>endobj +63 0 obj<>endobj +64 0 obj<>endobj +65 0 obj<>endobj +66 0 obj<>endobj +67 0 obj<>endobj +68 0 obj<>endobj +69 0 obj<>endobj +70 0 obj<>endobj +71 0 obj<>endobj +72 0 obj<>endobj +73 0 obj<>endobj +74 0 obj<>endobj +75 0 obj<>endobj +76 0 obj<>endobj +77 0 obj<>endobj +78 0 obj<>endobj +79 0 obj<>endobj +80 0 obj<>endobj +81 0 obj<>endobj +82 0 obj<>endobj +83 0 obj<>endobj +84 0 obj<>endobj +85 0 obj<>endobj +86 0 obj<>endobj +87 0 obj<>endobj +88 0 obj<>endobj +89 0 obj<>endobj +90 0 obj<>endobj +91 0 obj<>endobj +92 0 obj<>endobj +93 0 obj<>endobj +94 0 obj<>endobj +95 0 obj<>endobj +96 0 obj<>endobj +97 0 obj<>endobj +98 0 obj<>endobj +99 0 obj<>endobj +100 0 obj<>endobj +101 0 obj<>endobj 102 0 obj[60 0 R 61 0 R 62 0 R @@ -188,49 +188,48 @@ endobj 99 0 R 100 0 R 101 0 R]endobj -103 0 obj<>endobj -104 0 obj<>endobj -105 0 obj<>endobj -106 0 obj<>endobj -107 0 obj<>endobj -108 0 obj<>endobj -109 0 obj<>endobj -110 0 obj<>endobj -111 0 obj<>endobj -112 0 obj<>endobj -113 0 obj<>endobj -114 0 obj<>endobj -115 0 obj<>endobj -116 0 obj<>endobj -117 0 obj<>endobj -118 0 obj<>endobj -119 0 obj<>endobj -120 0 obj<>endobj -121 0 obj<>endobj -122 0 obj<>endobj -123 0 obj<>endobj -124 0 obj<>endobj -125 0 obj<>endobj -126 0 obj<>endobj -127 0 obj<>endobj -128 0 obj<>endobj -129 0 obj<>endobj -130 0 obj<>endobj -131 0 obj<>endobj -132 0 obj<>endobj -133 0 obj<>endobj -134 0 obj<>endobj -135 0 obj<>endobj -136 0 obj<>endobj -137 0 obj<>endobj -138 0 obj<>endobj -139 0 obj<>endobj -140 0 obj<>endobj -141 0 obj<>endobj -142 0 obj<>endobj -143 0 obj<>endobj -144 0 obj<>endobj -145 0 obj[103 0 R +103 0 obj<>endobj +104 0 obj<>endobj +105 0 obj<>endobj +106 0 obj<>endobj +107 0 obj<>endobj +108 0 obj<>endobj +109 0 obj<>endobj +110 0 obj<>endobj +111 0 obj<>endobj +112 0 obj<>endobj +113 0 obj<>endobj +114 0 obj<>endobj +115 0 obj<>endobj +116 0 obj<>endobj +117 0 obj<>endobj +118 0 obj<>endobj +119 0 obj<>endobj +120 0 obj<>endobj +121 0 obj<>endobj +122 0 obj<>endobj +123 0 obj<>endobj +124 0 obj<>endobj +125 0 obj<>endobj +126 0 obj<>endobj +127 0 obj<>endobj +128 0 obj<>endobj +129 0 obj<>endobj +130 0 obj<>endobj +131 0 obj<>endobj +132 0 obj<>endobj +133 0 obj<>endobj +134 0 obj<>endobj +135 0 obj<>endobj +136 0 obj<>endobj +137 0 obj<>endobj +138 0 obj<>endobj +139 0 obj<>endobj +140 0 obj<>endobj +141 0 obj<>endobj +142 0 obj<>endobj +143 0 obj<>endobj +144 0 obj[103 0 R 104 0 R 105 0 R 106 0 R @@ -270,53 +269,53 @@ endobj 140 0 R 141 0 R 142 0 R -143 0 R -144 0 R]endobj -146 0 obj<>endobj -147 0 obj<>endobj -148 0 obj<>endobj -149 0 obj<>endobj -150 0 obj<>endobj -151 0 obj<>endobj -152 0 obj<>endobj -153 0 obj<>endobj -154 0 obj<>endobj -155 0 obj<>endobj -156 0 obj<>endobj -157 0 obj<>endobj -158 0 obj<>endobj -159 0 obj<>endobj -160 0 obj<>endobj -161 0 obj<>endobj -162 0 obj<>endobj -163 0 obj<>endobj -164 0 obj<>endobj -165 0 obj<>endobj -166 0 obj<>endobj -167 0 obj<>endobj -168 0 obj<>endobj -169 0 obj<>endobj -170 0 obj<>endobj -171 0 obj<>endobj -172 0 obj<>endobj -173 0 obj<>endobj -174 0 obj<>endobj -175 0 obj<>endobj -176 0 obj<>endobj -177 0 obj<>endobj -178 0 obj<>endobj -179 0 obj<>endobj -180 0 obj<>endobj -181 0 obj<>endobj -182 0 obj<>endobj -183 0 obj<>endobj -184 0 obj<>endobj -185 0 obj<>endobj -186 0 obj<>endobj -187 0 obj<>endobj -188 0 obj<>endobj -189 0 obj<>endobj -190 0 obj[146 0 R +143 0 R]endobj +145 0 obj<>endobj +146 0 obj<>endobj +147 0 obj<>endobj +148 0 obj<>endobj +149 0 obj<>endobj +150 0 obj<>endobj +151 0 obj<>endobj +152 0 obj<>endobj +153 0 obj<>endobj +154 0 obj<>endobj +155 0 obj<>endobj +156 0 obj<>endobj +157 0 obj<>endobj +158 0 obj<>endobj +159 0 obj<>endobj +160 0 obj<>endobj +161 0 obj<>endobj +162 0 obj<>endobj +163 0 obj<>endobj +164 0 obj<>endobj +165 0 obj<>endobj +166 0 obj<>endobj +167 0 obj<>endobj +168 0 obj<>endobj +169 0 obj<>endobj +170 0 obj<>endobj +171 0 obj<>endobj +172 0 obj<>endobj +173 0 obj<>endobj +174 0 obj<>endobj +175 0 obj<>endobj +176 0 obj<>endobj +177 0 obj<>endobj +178 0 obj<>endobj +179 0 obj<>endobj +180 0 obj<>endobj +181 0 obj<>endobj +182 0 obj<>endobj +183 0 obj<>endobj +184 0 obj<>endobj +185 0 obj<>endobj +186 0 obj<>endobj +187 0 obj<>endobj +188 0 obj<>endobj +189 0 obj[145 0 R +146 0 R 147 0 R 148 0 R 149 0 R @@ -358,53 +357,53 @@ endobj 185 0 R 186 0 R 187 0 R -188 0 R -189 0 R]endobj -191 0 obj<>endobj -192 0 obj<>endobj -193 0 obj<>endobj -194 0 obj<>endobj -195 0 obj<>endobj -196 0 obj<>endobj -197 0 obj<>endobj -198 0 obj<>endobj -199 0 obj<>endobj -200 0 obj<>endobj -201 0 obj<>endobj -202 0 obj<>endobj -203 0 obj<>endobj -204 0 obj<>endobj -205 0 obj<>endobj -206 0 obj<>endobj -207 0 obj<>endobj -208 0 obj<>endobj -209 0 obj<>endobj -210 0 obj<>endobj -211 0 obj<>endobj -212 0 obj<>endobj -213 0 obj<>endobj -214 0 obj<>endobj -215 0 obj<>endobj -216 0 obj<>endobj -217 0 obj<>endobj -218 0 obj<>endobj -219 0 obj<>endobj -220 0 obj<>endobj -221 0 obj<>endobj -222 0 obj<>endobj -223 0 obj<>endobj -224 0 obj<>endobj -225 0 obj<>endobj -226 0 obj<>endobj -227 0 obj<>endobj -228 0 obj<>endobj -229 0 obj<>endobj -230 0 obj<>endobj -231 0 obj<>endobj -232 0 obj<>endobj -233 0 obj<>endobj -234 0 obj<>endobj -235 0 obj[191 0 R +188 0 R]endobj +190 0 obj<>endobj +191 0 obj<>endobj +192 0 obj<>endobj +193 0 obj<>endobj +194 0 obj<>endobj +195 0 obj<>endobj +196 0 obj<>endobj +197 0 obj<>endobj +198 0 obj<>endobj +199 0 obj<>endobj +200 0 obj<>endobj +201 0 obj<>endobj +202 0 obj<>endobj +203 0 obj<>endobj +204 0 obj<>endobj +205 0 obj<>endobj +206 0 obj<>endobj +207 0 obj<>endobj +208 0 obj<>endobj +209 0 obj<>endobj +210 0 obj<>endobj +211 0 obj<>endobj +212 0 obj<>endobj +213 0 obj<>endobj +214 0 obj<>endobj +215 0 obj<>endobj +216 0 obj<>endobj +217 0 obj<>endobj +218 0 obj<>endobj +219 0 obj<>endobj +220 0 obj<>endobj +221 0 obj<>endobj +222 0 obj<>endobj +223 0 obj<>endobj +224 0 obj<>endobj +225 0 obj<>endobj +226 0 obj<>endobj +227 0 obj<>endobj +228 0 obj<>endobj +229 0 obj<>endobj +230 0 obj<>endobj +231 0 obj<>endobj +232 0 obj<>endobj +233 0 obj<>endobj +234 0 obj[190 0 R +191 0 R 192 0 R 193 0 R 194 0 R @@ -446,51 +445,51 @@ endobj 230 0 R 231 0 R 232 0 R -233 0 R -234 0 R]endobj -236 0 obj<>endobj -237 0 obj<>endobj -238 0 obj<>endobj -239 0 obj<>endobj -240 0 obj<>endobj -241 0 obj<>endobj -242 0 obj<>endobj -243 0 obj<>endobj -244 0 obj<>endobj -245 0 obj<>endobj -246 0 obj<>endobj -247 0 obj<>endobj -248 0 obj<>endobj -249 0 obj<>endobj -250 0 obj<>endobj -251 0 obj<>endobj -252 0 obj<>endobj -253 0 obj<>endobj -254 0 obj<>endobj -255 0 obj<>endobj -256 0 obj<>endobj -257 0 obj<>endobj -258 0 obj<>endobj -259 0 obj<>endobj -260 0 obj<>endobj -261 0 obj<>endobj -262 0 obj<>endobj -263 0 obj<>endobj -264 0 obj<>endobj -265 0 obj<>endobj -266 0 obj<>endobj -267 0 obj<>endobj -268 0 obj<>endobj -269 0 obj<>endobj -270 0 obj<>endobj -271 0 obj<>endobj -272 0 obj<>endobj -273 0 obj<>endobj -274 0 obj<>endobj -275 0 obj<>endobj -276 0 obj<>endobj -277 0 obj<>endobj -278 0 obj[236 0 R +233 0 R]endobj +235 0 obj<>endobj +236 0 obj<>endobj +237 0 obj<>endobj +238 0 obj<>endobj +239 0 obj<>endobj +240 0 obj<>endobj +241 0 obj<>endobj +242 0 obj<>endobj +243 0 obj<>endobj +244 0 obj<>endobj +245 0 obj<>endobj +246 0 obj<>endobj +247 0 obj<>endobj +248 0 obj<>endobj +249 0 obj<>endobj +250 0 obj<>endobj +251 0 obj<>endobj +252 0 obj<>endobj +253 0 obj<>endobj +254 0 obj<>endobj +255 0 obj<>endobj +256 0 obj<>endobj +257 0 obj<>endobj +258 0 obj<>endobj +259 0 obj<>endobj +260 0 obj<>endobj +261 0 obj<>endobj +262 0 obj<>endobj +263 0 obj<>endobj +264 0 obj<>endobj +265 0 obj<>endobj +266 0 obj<>endobj +267 0 obj<>endobj +268 0 obj<>endobj +269 0 obj<>endobj +270 0 obj<>endobj +271 0 obj<>endobj +272 0 obj<>endobj +273 0 obj<>endobj +274 0 obj<>endobj +275 0 obj<>endobj +276 0 obj<>endobj +277 0 obj[235 0 R +236 0 R 237 0 R 238 0 R 239 0 R @@ -530,47 +529,51 @@ endobj 273 0 R 274 0 R 275 0 R -276 0 R -277 0 R]endobj -279 0 obj<>endobj -280 0 obj<>endobj -281 0 obj<>endobj -282 0 obj<>endobj -283 0 obj<>endobj -284 0 obj<>endobj -285 0 obj<>endobj -286 0 obj<>endobj -287 0 obj<>endobj -288 0 obj<>endobj -289 0 obj<>endobj -290 0 obj<>endobj -291 0 obj<>endobj -292 0 obj<>endobj -293 0 obj<>endobj -294 0 obj<>endobj -295 0 obj<>endobj -296 0 obj<>endobj -297 0 obj<>endobj -298 0 obj<>endobj -299 0 obj<>endobj -300 0 obj<>endobj -301 0 obj<>endobj -302 0 obj<>endobj -303 0 obj<>endobj -304 0 obj<>endobj -305 0 obj<>endobj -306 0 obj<>endobj -307 0 obj<>endobj -308 0 obj<>endobj -309 0 obj<>endobj -310 0 obj<>endobj -311 0 obj<>endobj -312 0 obj<>endobj -313 0 obj<>endobj -314 0 obj<>endobj -315 0 obj<>endobj -316 0 obj<>endobj -317 0 obj[279 0 R +276 0 R]endobj +278 0 obj<>endobj +279 0 obj<>endobj +280 0 obj<>endobj +281 0 obj<>endobj +282 0 obj<>endobj +283 0 obj<>endobj +284 0 obj<>endobj +285 0 obj<>endobj +286 0 obj<>endobj +287 0 obj<>endobj +288 0 obj<>endobj +289 0 obj<>endobj +290 0 obj<>endobj +291 0 obj<>endobj +292 0 obj<>endobj +293 0 obj<>endobj +294 0 obj<>endobj +295 0 obj<>endobj +296 0 obj<>endobj +297 0 obj<>endobj +298 0 obj<>endobj +299 0 obj<>endobj +300 0 obj<>endobj +301 0 obj<>endobj +302 0 obj<>endobj +303 0 obj<>endobj +304 0 obj<>endobj +305 0 obj<>endobj +306 0 obj<>endobj +307 0 obj<>endobj +308 0 obj<>endobj +309 0 obj<>endobj +310 0 obj<>endobj +311 0 obj<>endobj +312 0 obj<>endobj +313 0 obj<>endobj +314 0 obj<>endobj +315 0 obj<>endobj +316 0 obj<>endobj +317 0 obj<>endobj +318 0 obj<>endobj +319 0 obj<>endobj +320 0 obj[278 0 R +279 0 R 280 0 R 281 0 R 282 0 R @@ -607,55 +610,55 @@ endobj 313 0 R 314 0 R 315 0 R -316 0 R]endobj -318 0 obj<>endobj -319 0 obj<>endobj -320 0 obj<>endobj -321 0 obj<>endobj -322 0 obj<>endobj -323 0 obj<>endobj -324 0 obj<>endobj -325 0 obj<>endobj -326 0 obj<>endobj -327 0 obj<>endobj -328 0 obj<>endobj -329 0 obj<>endobj -330 0 obj<>endobj -331 0 obj<>endobj -332 0 obj<>endobj -333 0 obj<>endobj -334 0 obj<>endobj -335 0 obj<>endobj -336 0 obj<>endobj -337 0 obj<>endobj -338 0 obj<>endobj -339 0 obj<>endobj -340 0 obj<>endobj -341 0 obj<>endobj -342 0 obj<>endobj -343 0 obj<>endobj -344 0 obj<>endobj -345 0 obj<>endobj -346 0 obj<>endobj -347 0 obj<>endobj -348 0 obj<>endobj -349 0 obj<>endobj -350 0 obj<>endobj -351 0 obj<>endobj -352 0 obj<>endobj -353 0 obj<>endobj -354 0 obj<>endobj -355 0 obj<>endobj -356 0 obj<>endobj -357 0 obj<>endobj -358 0 obj<>endobj -359 0 obj<>endobj -360 0 obj[319 0 R -321 0 R -323 0 R -325 0 R +316 0 R +317 0 R +318 0 R +319 0 R]endobj +321 0 obj<>endobj +322 0 obj<>endobj +323 0 obj<>endobj +324 0 obj<>endobj +325 0 obj<>endobj +326 0 obj<>endobj +327 0 obj<>endobj +328 0 obj<>endobj +329 0 obj<>endobj +330 0 obj<>endobj +331 0 obj<>endobj +332 0 obj<>endobj +333 0 obj<>endobj +334 0 obj<>endobj +335 0 obj<>endobj +336 0 obj<>endobj +337 0 obj<>endobj +338 0 obj<>endobj +339 0 obj<>endobj +340 0 obj<>endobj +341 0 obj<>endobj +342 0 obj<>endobj +343 0 obj<>endobj +344 0 obj<>endobj +345 0 obj<>endobj +346 0 obj<>endobj +347 0 obj<>endobj +348 0 obj<>endobj +349 0 obj<>endobj +350 0 obj<>endobj +351 0 obj<>endobj +352 0 obj<>endobj +353 0 obj<>endobj +354 0 obj<>endobj +355 0 obj<>endobj +356 0 obj<>endobj +357 0 obj<>endobj +358 0 obj<>endobj +359 0 obj<>endobj +360 0 obj<>endobj +361 0 obj<>endobj +362 0 obj<>endobj +363 0 obj[322 0 R +324 0 R 326 0 R -327 0 R 328 0 R 329 0 R 330 0 R @@ -687,64 +690,64 @@ endobj 356 0 R 357 0 R 358 0 R -359 0 R]endobj -361 0 obj<>endobj -362 0 obj<>endobj -363 0 obj<>endobj -364 0 obj<>endobj -365 0 obj<>endobj -366 0 obj<>endobj -367 0 obj<>endobj -368 0 obj<>endobj -369 0 obj<>endobj -370 0 obj<>endobj -371 0 obj<>endobj -372 0 obj<>endobj -373 0 obj<>endobj -374 0 obj<>endobj -375 0 obj<>endobj -376 0 obj<>endobj -377 0 obj<>endobj -378 0 obj<>endobj -379 0 obj<>endobj -380 0 obj<>endobj -381 0 obj<>endobj -382 0 obj<>endobj -383 0 obj<>endobj -384 0 obj<>endobj -385 0 obj<>endobj -386 0 obj<>endobj -387 0 obj<>endobj -388 0 obj<>endobj -389 0 obj<>endobj -390 0 obj<>endobj -391 0 obj<>endobj -392 0 obj<>endobj -393 0 obj<>endobj -394 0 obj<>endobj -395 0 obj<>endobj -396 0 obj<>endobj -397 0 obj<>endobj -398 0 obj<>endobj -399 0 obj<>endobj -400 0 obj<>endobj -401 0 obj<>endobj -402 0 obj<>endobj -403 0 obj<>endobj -404 0 obj<>endobj -405 0 obj<>endobj -406 0 obj<>endobj -407 0 obj<>endobj -408 0 obj<>endobj -409 0 obj<>endobj -410 0 obj<>endobj -411 0 obj<>endobj -412 0 obj<>endobj -413 0 obj<>endobj -414 0 obj[361 0 R -362 0 R -363 0 R -364 0 R +359 0 R +360 0 R +361 0 R +362 0 R]endobj +364 0 obj<>endobj +365 0 obj<>endobj +366 0 obj<>endobj +367 0 obj<>endobj +368 0 obj<>endobj +369 0 obj<>endobj +370 0 obj<>endobj +371 0 obj<>endobj +372 0 obj<>endobj +373 0 obj<>endobj +374 0 obj<>endobj +375 0 obj<>endobj +376 0 obj<>endobj +377 0 obj<>endobj +378 0 obj<>endobj +379 0 obj<>endobj +380 0 obj<>endobj +381 0 obj<>endobj +382 0 obj<>endobj +383 0 obj<>endobj +384 0 obj<>endobj +385 0 obj<>endobj +386 0 obj<>endobj +387 0 obj<>endobj +388 0 obj<>endobj +389 0 obj<>endobj +390 0 obj<>endobj +391 0 obj<>endobj +392 0 obj<>endobj +393 0 obj<>endobj +394 0 obj<>endobj +395 0 obj<>endobj +396 0 obj<>endobj +397 0 obj<>endobj +398 0 obj<>endobj +399 0 obj<>endobj +400 0 obj<>endobj +401 0 obj<>endobj +402 0 obj<>endobj +403 0 obj<>endobj +404 0 obj<>endobj +405 0 obj<>endobj +406 0 obj<>endobj +407 0 obj<>endobj +408 0 obj<>endobj +409 0 obj<>endobj +410 0 obj<>endobj +411 0 obj<>endobj +412 0 obj<>endobj +413 0 obj<>endobj +414 0 obj<>endobj +415 0 obj<>endobj +416 0 obj<>endobj +417 0 obj[364 0 R 365 0 R 366 0 R 367 0 R @@ -793,62 +796,62 @@ endobj 410 0 R 411 0 R 412 0 R -413 0 R]endobj -415 0 obj<>endobj -416 0 obj<>endobj -417 0 obj<>endobj -418 0 obj<>endobj -419 0 obj<>endobj -420 0 obj<>endobj -421 0 obj<>endobj -422 0 obj<>endobj -423 0 obj<>endobj -424 0 obj<>endobj -425 0 obj<>endobj -426 0 obj<>endobj -427 0 obj<>endobj -428 0 obj<>endobj -429 0 obj<>endobj -430 0 obj<>endobj -431 0 obj<>endobj -432 0 obj<>endobj -433 0 obj<>endobj -434 0 obj<>endobj -435 0 obj<>endobj -436 0 obj<>endobj -437 0 obj<>endobj -438 0 obj<>endobj -439 0 obj<>endobj -440 0 obj<>endobj -441 0 obj<>endobj -442 0 obj<>endobj -443 0 obj<>endobj -444 0 obj<>endobj -445 0 obj<>endobj -446 0 obj<>endobj -447 0 obj<>endobj -448 0 obj<>endobj -449 0 obj<>endobj -450 0 obj<>endobj -451 0 obj<>endobj -452 0 obj<>endobj -453 0 obj<>endobj -454 0 obj<>endobj -455 0 obj<>endobj -456 0 obj<>endobj -457 0 obj<>endobj -458 0 obj<>endobj -459 0 obj<>endobj -460 0 obj<>endobj -461 0 obj<>endobj -462 0 obj<>endobj -463 0 obj<>endobj -464 0 obj<>endobj -465 0 obj<>endobj -466 0 obj[415 0 R -416 0 R -417 0 R -418 0 R +413 0 R +414 0 R +415 0 R +416 0 R]endobj +418 0 obj<>endobj +419 0 obj<>endobj +420 0 obj<>endobj +421 0 obj<>endobj +422 0 obj<>endobj +423 0 obj<>endobj +424 0 obj<>endobj +425 0 obj<>endobj +426 0 obj<>endobj +427 0 obj<>endobj +428 0 obj<>endobj +429 0 obj<>endobj +430 0 obj<>endobj +431 0 obj<>endobj +432 0 obj<>endobj +433 0 obj<>endobj +434 0 obj<>endobj +435 0 obj<>endobj +436 0 obj<>endobj +437 0 obj<>endobj +438 0 obj<>endobj +439 0 obj<>endobj +440 0 obj<>endobj +441 0 obj<>endobj +442 0 obj<>endobj +443 0 obj<>endobj +444 0 obj<>endobj +445 0 obj<>endobj +446 0 obj<>endobj +447 0 obj<>endobj +448 0 obj<>endobj +449 0 obj<>endobj +450 0 obj<>endobj +451 0 obj<>endobj +452 0 obj<>endobj +453 0 obj<>endobj +454 0 obj<>endobj +455 0 obj<>endobj +456 0 obj<>endobj +457 0 obj<>endobj +458 0 obj<>endobj +459 0 obj<>endobj +460 0 obj<>endobj +461 0 obj<>endobj +462 0 obj<>endobj +463 0 obj<>endobj +464 0 obj<>endobj +465 0 obj<>endobj +466 0 obj<>endobj +467 0 obj<>endobj +468 0 obj<>endobj +469 0 obj[418 0 R 419 0 R 420 0 R 421 0 R @@ -895,47 +898,42 @@ endobj 462 0 R 463 0 R 464 0 R -465 0 R]endobj -467 0 obj<>endobj -468 0 obj<>endobj -469 0 obj<>endobj -470 0 obj<>endobj -471 0 obj<>endobj -472 0 obj<>endobj -473 0 obj<>endobj -474 0 obj<>endobj -475 0 obj<>endobj -476 0 obj<>endobj -477 0 obj<>endobj -478 0 obj<>endobj -479 0 obj<>endobj -480 0 obj<>endobj -481 0 obj<>endobj -482 0 obj<>endobj -483 0 obj<>endobj -484 0 obj<>endobj -485 0 obj<>endobj -486 0 obj<>endobj -487 0 obj<>endobj -488 0 obj<>endobj -489 0 obj<>endobj -490 0 obj<>endobj -491 0 obj<>endobj -492 0 obj<>endobj -493 0 obj<>endobj -494 0 obj<>endobj -495 0 obj<>endobj -496 0 obj<>endobj -497 0 obj<>endobj -498 0 obj<>endobj -499 0 obj<>endobj -500 0 obj<>endobj -501 0 obj<>endobj -502 0 obj<>endobj -503 0 obj[467 0 R -468 0 R -469 0 R -470 0 R +465 0 R +466 0 R +467 0 R +468 0 R]endobj +470 0 obj<>endobj +471 0 obj<>endobj +472 0 obj<>endobj +473 0 obj<>endobj +474 0 obj<>endobj +475 0 obj<>endobj +476 0 obj<>endobj +477 0 obj<>endobj +478 0 obj<>endobj +479 0 obj<>endobj +480 0 obj<>endobj +481 0 obj<>endobj +482 0 obj<>endobj +483 0 obj<>endobj +484 0 obj<>endobj +485 0 obj<>endobj +486 0 obj<>endobj +487 0 obj<>endobj +488 0 obj<>endobj +489 0 obj<>endobj +490 0 obj<>endobj +491 0 obj<>endobj +492 0 obj<>endobj +493 0 obj<>endobj +494 0 obj<>endobj +495 0 obj<>endobj +496 0 obj<>endobj +497 0 obj<>endobj +498 0 obj<>endobj +499 0 obj<>endobj +500 0 obj<>endobj +501 0 obj[470 0 R 471 0 R 472 0 R 473 0 R @@ -965,54 +963,54 @@ endobj 497 0 R 498 0 R 499 0 R -500 0 R -501 0 R -502 0 R]endobj -504 0 obj<>endobj -505 0 obj<>endobj -506 0 obj<>endobj -507 0 obj<>endobj -508 0 obj<>endobj -509 0 obj<>endobj -510 0 obj<>endobj -511 0 obj<>endobj -512 0 obj<>endobj -513 0 obj<>endobj -514 0 obj<>endobj -515 0 obj<>endobj -516 0 obj<>endobj -517 0 obj<>endobj -518 0 obj<>endobj -519 0 obj<>endobj -520 0 obj<>endobj -521 0 obj<>endobj -522 0 obj<>endobj -523 0 obj<>endobj -524 0 obj<>endobj -525 0 obj<>endobj -526 0 obj<>endobj -527 0 obj<>endobj -528 0 obj<>endobj -529 0 obj<>endobj -530 0 obj<>endobj -531 0 obj<>endobj -532 0 obj<>endobj -533 0 obj<>endobj -534 0 obj<>endobj -535 0 obj<>endobj -536 0 obj<>endobj -537 0 obj<>endobj -538 0 obj<>endobj -539 0 obj<>endobj -540 0 obj<>endobj -541 0 obj<>endobj -542 0 obj<>endobj -543 0 obj<>endobj -544 0 obj<>endobj -545 0 obj<>endobj -546 0 obj<>endobj -547 0 obj<>endobj -548 0 obj[504 0 R +500 0 R]endobj +502 0 obj<>endobj +503 0 obj<>endobj +504 0 obj<>endobj +505 0 obj<>endobj +506 0 obj<>endobj +507 0 obj<>endobj +508 0 obj<>endobj +509 0 obj<>endobj +510 0 obj<>endobj +511 0 obj<>endobj +512 0 obj<>endobj +513 0 obj<>endobj +514 0 obj<>endobj +515 0 obj<>endobj +516 0 obj<>endobj +517 0 obj<>endobj +518 0 obj<>endobj +519 0 obj<>endobj +520 0 obj<>endobj +521 0 obj<>endobj +522 0 obj<>endobj +523 0 obj<>endobj +524 0 obj<>endobj +525 0 obj<>endobj +526 0 obj<>endobj +527 0 obj<>endobj +528 0 obj<>endobj +529 0 obj<>endobj +530 0 obj<>endobj +531 0 obj<>endobj +532 0 obj<>endobj +533 0 obj<>endobj +534 0 obj<>endobj +535 0 obj<>endobj +536 0 obj<>endobj +537 0 obj<>endobj +538 0 obj<>endobj +539 0 obj<>endobj +540 0 obj<>endobj +541 0 obj<>endobj +542 0 obj<>endobj +543 0 obj<>endobj +544 0 obj<>endobj +545 0 obj<>endobj +546 0 obj[502 0 R +503 0 R +504 0 R 505 0 R 506 0 R 507 0 R @@ -1053,116 +1051,119 @@ endobj 542 0 R 543 0 R 544 0 R -545 0 R -546 0 R -547 0 R]endobj -549 0 obj<>endobj -550 0 obj[549 0 R]endobj -551 0 obj<>endobj -552 0 obj<>endobj -553 0 obj[552 0 R]endobj -554 0 obj<>endobj -555 0 obj<>endobj -556 0 obj<>endobj -557 0 obj<>endobj -558 0 obj<>endobj -559 0 obj<>endobj -560 0 obj<>endobj -561 0 obj<>endobj -562 0 obj<>endobj -563 0 obj<>endobj -564 0 obj<>endobj -565 0 obj<>endobj -566 0 obj<>endobj -567 0 obj<>endobj -568 0 obj[555 0 R -557 0 R -559 0 R -561 0 R -563 0 R -565 0 R -567 0 R]endobj -569 0 obj<>endobj -570 0 obj<>endobj -571 0 obj<>endobj -572 0 obj<>endobj -573 0 obj<>endobj -574 0 obj<>endobj -575 0 obj[570 0 R -572 0 R -574 0 R]endobj -576 0 obj<>endobj -577 0 obj<>endobj -578 0 obj<>endobj -579 0 obj<>endobj -580 0 obj<>endobj -581 0 obj<>endobj -582 0 obj<>endobj -583 0 obj<>endobj -584 0 obj<>endobj -585 0 obj<>endobj -586 0 obj<>endobj -587 0 obj<>endobj -588 0 obj<>endobj -589 0 obj<>endobj -590 0 obj[577 0 R -579 0 R -581 0 R -583 0 R -585 0 R -587 0 R -589 0 R]endobj -591 0 obj<>endobj -592 0 obj<>endobj -593 0 obj[592 0 R]endobj -594 0 obj<>endobj -595 0 obj<>endobj -596 0 obj[595 0 R]endobj -597 0 obj<>endobj -598 0 obj<>endobj -599 0 obj<>endobj -600 0 obj<>endobj -601 0 obj<>endobj -602 0 obj<>endobj -603 0 obj<>endobj -604 0 obj<>endobj -605 0 obj<>endobj -606 0 obj<>endobj -607 0 obj<>endobj -608 0 obj<>endobj -609 0 obj<>endobj -610 0 obj<>endobj -611 0 obj<>endobj -612 0 obj<>endobj -613 0 obj<>endobj -614 0 obj<>endobj -615 0 obj<>endobj -616 0 obj<>endobj -617 0 obj<>endobj -618 0 obj<>endobj -619 0 obj<>endobj -620 0 obj<>endobj -621 0 obj<>endobj -622 0 obj<>endobj -623 0 obj<>endobj -624 0 obj<>endobj -625 0 obj<>endobj -626 0 obj<>endobj -627 0 obj<>endobj -628 0 obj<>endobj -629 0 obj<>endobj -630 0 obj<>endobj -631 0 obj<>endobj -632 0 obj<>endobj -633 0 obj<>endobj -634 0 obj<>endobj -635 0 obj<>endobj -636 0 obj<>endobj -637 0 obj<>endobj -638 0 obj<>endobj -639 0 obj<>endobj -640 0 obj<>endobj -641 0 obj[597 0 R +545 0 R]endobj +547 0 obj<>endobj +548 0 obj<>endobj +549 0 obj[547 0 R +548 0 R]endobj +550 0 obj<>endobj +551 0 obj<>endobj +552 0 obj[551 0 R]endobj +553 0 obj<>endobj +554 0 obj<>endobj +555 0 obj<>endobj +556 0 obj<>endobj +557 0 obj<>endobj +558 0 obj<>endobj +559 0 obj<>endobj +560 0 obj<>endobj +561 0 obj<>endobj +562 0 obj<>endobj +563 0 obj<>endobj +564 0 obj<>endobj +565 0 obj<>endobj +566 0 obj<>endobj +567 0 obj[554 0 R +556 0 R +558 0 R +560 0 R +562 0 R +564 0 R +566 0 R]endobj +568 0 obj<>endobj +569 0 obj<>endobj +570 0 obj<>endobj +571 0 obj<>endobj +572 0 obj<>endobj +573 0 obj<>endobj +574 0 obj[569 0 R +571 0 R +573 0 R]endobj +575 0 obj<>endobj +576 0 obj<>endobj +577 0 obj<>endobj +578 0 obj<>endobj +579 0 obj<>endobj +580 0 obj<>endobj +581 0 obj<>endobj +582 0 obj<>endobj +583 0 obj<>endobj +584 0 obj<>endobj +585 0 obj<>endobj +586 0 obj<>endobj +587 0 obj<>endobj +588 0 obj<>endobj +589 0 obj[576 0 R +578 0 R +580 0 R +582 0 R +584 0 R +586 0 R +588 0 R]endobj +590 0 obj<>endobj +591 0 obj<>endobj +592 0 obj[591 0 R]endobj +593 0 obj<>endobj +594 0 obj<>endobj +595 0 obj[594 0 R]endobj +596 0 obj<>endobj +597 0 obj<>endobj +598 0 obj<>endobj +599 0 obj<>endobj +600 0 obj<>endobj +601 0 obj<>endobj +602 0 obj<>endobj +603 0 obj<>endobj +604 0 obj<>endobj +605 0 obj<>endobj +606 0 obj<>endobj +607 0 obj<>endobj +608 0 obj<>endobj +609 0 obj<>endobj +610 0 obj<>endobj +611 0 obj<>endobj +612 0 obj<>endobj +613 0 obj<>endobj +614 0 obj<>endobj +615 0 obj<>endobj +616 0 obj<>endobj +617 0 obj<>endobj +618 0 obj<>endobj +619 0 obj<>endobj +620 0 obj<>endobj +621 0 obj<>endobj +622 0 obj<>endobj +623 0 obj<>endobj +624 0 obj<>endobj +625 0 obj<>endobj +626 0 obj<>endobj +627 0 obj<>endobj +628 0 obj<>endobj +629 0 obj<>endobj +630 0 obj<>endobj +631 0 obj<>endobj +632 0 obj<>endobj +633 0 obj<>endobj +634 0 obj<>endobj +635 0 obj<>endobj +636 0 obj<>endobj +637 0 obj<>endobj +638 0 obj<>endobj +639 0 obj<>endobj +640 0 obj<>endobj +641 0 obj<>endobj +642 0 obj[596 0 R +597 0 R 598 0 R 599 0 R 600 0 R @@ -1205,211 +1206,211 @@ endobj 637 0 R 638 0 R 639 0 R -640 0 R]endobj -642 0 obj<>endobj -643 0 obj<>endobj +640 0 R +641 0 R]endobj +643 0 obj<>endobj 644 0 obj[643 0 R]endobj -645 0 obj<>endobj -646 0 obj<>endobj -647 0 obj<>endobj -648 0 obj<>endobj -649 0 obj<>endobj -650 0 obj<>endobj -651 0 obj<>endobj -652 0 obj<>endobj -653 0 obj<>endobj -654 0 obj<>endobj -655 0 obj<>endobj -656 0 obj<>endobj -657 0 obj<>endobj -658 0 obj<>endobj -659 0 obj<>endobj -660 0 obj<>endobj -661 0 obj<>endobj -662 0 obj<>endobj -663 0 obj<>endobj -664 0 obj<>endobj -665 0 obj<>endobj -666 0 obj<>endobj -667 0 obj<>endobj -668 0 obj<>endobj -669 0 obj<>endobj -670 0 obj<>endobj -671 0 obj<>endobj -672 0 obj<>endobj -673 0 obj<>endobj -674 0 obj<>endobj -675 0 obj<>endobj -676 0 obj<>endobj -677 0 obj<>endobj -678 0 obj<>endobj -679 0 obj<>endobj -680 0 obj<>endobj -681 0 obj<>endobj -682 0 obj<>endobj -683 0 obj<>endobj -684 0 obj<>endobj -685 0 obj<>endobj -686 0 obj<>endobj -687 0 obj<>endobj -688 0 obj<>endobj -689 0 obj[646 0 R -648 0 R -650 0 R -652 0 R -654 0 R -656 0 R -658 0 R -660 0 R -662 0 R -664 0 R -666 0 R -668 0 R -670 0 R -672 0 R -674 0 R -676 0 R -678 0 R -680 0 R -682 0 R -684 0 R -686 0 R -688 0 R]endobj -690 0 obj<>endobj -691 0 obj<>endobj -692 0 obj[691 0 R]endobj -693 0 obj<>endobj -694 0 obj<>endobj -695 0 obj[694 0 R]endobj -696 0 obj<>endobj -697 0 obj<>endobj -698 0 obj[697 0 R]endobj -699 0 obj<>endobj -700 0 obj<>endobj -701 0 obj<>endobj -702 0 obj<>endobj -703 0 obj<>endobj -704 0 obj<>endobj -705 0 obj<>endobj -706 0 obj<>endobj -707 0 obj[700 0 R -702 0 R -704 0 R -706 0 R]endobj -708 0 obj<>endobj -709 0 obj<>endobj -710 0 obj<>endobj -711 0 obj<>endobj -712 0 obj<>endobj -713 0 obj<>endobj -714 0 obj<>endobj -715 0 obj<>endobj -716 0 obj<>endobj -717 0 obj<>endobj -718 0 obj<>endobj -719 0 obj<>endobj -720 0 obj<>endobj -721 0 obj<>endobj -722 0 obj<>endobj -723 0 obj<>endobj -724 0 obj[709 0 R -711 0 R -713 0 R -715 0 R +645 0 obj<>endobj +646 0 obj<>endobj +647 0 obj<>endobj +648 0 obj<>endobj +649 0 obj[646 0 R +648 0 R]endobj +650 0 obj<>endobj +651 0 obj<>endobj +652 0 obj<>endobj +653 0 obj<>endobj +654 0 obj[651 0 R +653 0 R]endobj +655 0 obj<>endobj +656 0 obj<>endobj +657 0 obj[656 0 R]endobj +658 0 obj<>endobj +659 0 obj<>endobj +660 0 obj<>endobj +661 0 obj<>endobj +662 0 obj<>endobj +663 0 obj<>endobj +664 0 obj<>endobj +665 0 obj<>endobj +666 0 obj<>endobj +667 0 obj<>endobj +668 0 obj<>endobj +669 0 obj<>endobj +670 0 obj<>endobj +671 0 obj<>endobj +672 0 obj<>endobj +673 0 obj<>endobj +674 0 obj<>endobj +675 0 obj<>endobj +676 0 obj<>endobj +677 0 obj<>endobj +678 0 obj<>endobj +679 0 obj<>endobj +680 0 obj<>endobj +681 0 obj<>endobj +682 0 obj<>endobj +683 0 obj<>endobj +684 0 obj<>endobj +685 0 obj<>endobj +686 0 obj<>endobj +687 0 obj<>endobj +688 0 obj<>endobj +689 0 obj<>endobj +690 0 obj<>endobj +691 0 obj<>endobj +692 0 obj<>endobj +693 0 obj<>endobj +694 0 obj<>endobj +695 0 obj<>endobj +696 0 obj<>endobj +697 0 obj<>endobj +698 0 obj<>endobj +699 0 obj<>endobj +700 0 obj<>endobj +701 0 obj<>endobj +702 0 obj[659 0 R +661 0 R +663 0 R +665 0 R +667 0 R +669 0 R +671 0 R +673 0 R +675 0 R +677 0 R +679 0 R +681 0 R +683 0 R +685 0 R +687 0 R +689 0 R +691 0 R +693 0 R +695 0 R +697 0 R +699 0 R +701 0 R]endobj +703 0 obj<>endobj +704 0 obj<>endobj +705 0 obj[704 0 R]endobj +706 0 obj<>endobj +707 0 obj<>endobj +708 0 obj[707 0 R]endobj +709 0 obj<>endobj +710 0 obj<>endobj +711 0 obj<>endobj +712 0 obj<>endobj +713 0 obj[710 0 R +712 0 R]endobj +714 0 obj<>endobj +715 0 obj<>endobj +716 0 obj<>endobj +717 0 obj<>endobj +718 0 obj<>endobj +719 0 obj<>endobj +720 0 obj<>endobj +721 0 obj<>endobj +722 0 obj<>endobj +723 0 obj<>endobj +724 0 obj<>endobj +725 0 obj<>endobj +726 0 obj<>endobj +727 0 obj<>endobj +728 0 obj<>endobj +729 0 obj<>endobj +730 0 obj[715 0 R 717 0 R 719 0 R 721 0 R -723 0 R]endobj -725 0 obj<>endobj -726 0 obj<>endobj -727 0 obj<>endobj -728 0 obj<>endobj -729 0 obj[726 0 R -728 0 R]endobj -730 0 obj<>endobj -731 0 obj<>endobj -732 0 obj[731 0 R]endobj -733 0 obj<>endobj -734 0 obj<>endobj -735 0 obj<>endobj -736 0 obj<>endobj -737 0 obj<>endobj -738 0 obj<>endobj -739 0 obj<>endobj -740 0 obj<>endobj -741 0 obj<>endobj -742 0 obj<>endobj -743 0 obj[734 0 R -736 0 R -738 0 R -740 0 R -742 0 R]endobj -744 0 obj<>endobj -745 0 obj<>endobj -746 0 obj<>endobj -747 0 obj<>endobj -748 0 obj<>endobj -749 0 obj<>endobj -750 0 obj<>endobj -751 0 obj<>endobj -752 0 obj<>endobj -753 0 obj<>endobj -754 0 obj[745 0 R -747 0 R -749 0 R -751 0 R -753 0 R]endobj -755 0 obj<>endobj -756 0 obj<>endobj -757 0 obj<>endobj -758 0 obj<>endobj -759 0 obj<>endobj -760 0 obj<>endobj -761 0 obj<>endobj -762 0 obj<>endobj -763 0 obj<>endobj -764 0 obj<>endobj -765 0 obj<>endobj -766 0 obj<>endobj -767 0 obj<>endobj -768 0 obj<>endobj -769 0 obj<>endobj -770 0 obj<>endobj -771 0 obj<>endobj -772 0 obj<>endobj -773 0 obj<>endobj -774 0 obj<>endobj -775 0 obj<>endobj -776 0 obj<>endobj -777 0 obj<>endobj -778 0 obj<>endobj -779 0 obj<>endobj -780 0 obj<>endobj -781 0 obj<>endobj -782 0 obj<>endobj -783 0 obj<>endobj -784 0 obj<>endobj -785 0 obj<>endobj -786 0 obj<>endobj -787 0 obj<>endobj -788 0 obj<>endobj -789 0 obj<>endobj -790 0 obj<>endobj -791 0 obj<>endobj -792 0 obj<>endobj -793 0 obj<>endobj -794 0 obj<>endobj -795 0 obj<>endobj -796 0 obj<>endobj -797 0 obj<>endobj -798 0 obj<>endobj -799 0 obj[755 0 R -756 0 R +723 0 R +725 0 R +727 0 R +729 0 R]endobj +731 0 obj<>endobj +732 0 obj<>endobj +733 0 obj<>endobj +734 0 obj<>endobj +735 0 obj[732 0 R +734 0 R]endobj +736 0 obj<>endobj +737 0 obj<>endobj +738 0 obj[737 0 R]endobj +739 0 obj<>endobj +740 0 obj<>endobj +741 0 obj<>endobj +742 0 obj<>endobj +743 0 obj<>endobj +744 0 obj<>endobj +745 0 obj<>endobj +746 0 obj<>endobj +747 0 obj<>endobj +748 0 obj<>endobj +749 0 obj[740 0 R +742 0 R +744 0 R +746 0 R +748 0 R]endobj +750 0 obj<>endobj +751 0 obj<>endobj +752 0 obj<>endobj +753 0 obj<>endobj +754 0 obj<>endobj +755 0 obj<>endobj +756 0 obj<>endobj +757 0 obj<>endobj +758 0 obj<>endobj +759 0 obj<>endobj +760 0 obj[751 0 R +753 0 R +755 0 R 757 0 R -758 0 R -759 0 R -760 0 R -761 0 R +759 0 R]endobj +761 0 obj<>endobj +762 0 obj<>endobj +763 0 obj<>endobj +764 0 obj<>endobj +765 0 obj<>endobj +766 0 obj<>endobj +767 0 obj<>endobj +768 0 obj<>endobj +769 0 obj<>endobj +770 0 obj<>endobj +771 0 obj<>endobj +772 0 obj<>endobj +773 0 obj<>endobj +774 0 obj<>endobj +775 0 obj<>endobj +776 0 obj<>endobj +777 0 obj<>endobj +778 0 obj<>endobj +779 0 obj<>endobj +780 0 obj<>endobj +781 0 obj<>endobj +782 0 obj<>endobj +783 0 obj<>endobj +784 0 obj<>endobj +785 0 obj<>endobj +786 0 obj<>endobj +787 0 obj<>endobj +788 0 obj<>endobj +789 0 obj<>endobj +790 0 obj<>endobj +791 0 obj<>endobj +792 0 obj<>endobj +793 0 obj<>endobj +794 0 obj<>endobj +795 0 obj<>endobj +796 0 obj<>endobj +797 0 obj<>endobj +798 0 obj<>endobj +799 0 obj<>endobj +800 0 obj<>endobj +801 0 obj<>endobj +802 0 obj<>endobj +803 0 obj<>endobj +804 0 obj<>endobj +805 0 obj[761 0 R 762 0 R 763 0 R 764 0 R @@ -1446,65 +1447,65 @@ endobj 795 0 R 796 0 R 797 0 R -798 0 R]endobj -800 0 obj<>endobj -801 0 obj<>endobj -802 0 obj<>endobj -803 0 obj<>endobj -804 0 obj<>endobj -805 0 obj<>endobj -806 0 obj<>endobj -807 0 obj<>endobj -808 0 obj<>endobj -809 0 obj<>endobj -810 0 obj<>endobj -811 0 obj<>endobj -812 0 obj<>endobj -813 0 obj<>endobj -814 0 obj<>endobj -815 0 obj<>endobj -816 0 obj<>endobj -817 0 obj<>endobj -818 0 obj<>endobj -819 0 obj<>endobj -820 0 obj<>endobj -821 0 obj<>endobj -822 0 obj<>endobj -823 0 obj<>endobj -824 0 obj<>endobj -825 0 obj<>endobj -826 0 obj<>endobj -827 0 obj<>endobj -828 0 obj<>endobj -829 0 obj<>endobj -830 0 obj<>endobj -831 0 obj<>endobj -832 0 obj<>endobj -833 0 obj<>endobj -834 0 obj<>endobj -835 0 obj<>endobj -836 0 obj<>endobj -837 0 obj<>endobj -838 0 obj<>endobj -839 0 obj<>endobj -840 0 obj<>endobj -841 0 obj<>endobj -842 0 obj<>endobj -843 0 obj<>endobj -844 0 obj<>endobj -845 0 obj<>endobj -846 0 obj<>endobj -847 0 obj<>endobj -848 0 obj<>endobj -849 0 obj<>endobj -850 0 obj<>endobj -851 0 obj[800 0 R +798 0 R +799 0 R +800 0 R 801 0 R 802 0 R 803 0 R -804 0 R -805 0 R -806 0 R +804 0 R]endobj +806 0 obj<>endobj +807 0 obj<>endobj +808 0 obj<>endobj +809 0 obj<>endobj +810 0 obj<>endobj +811 0 obj<>endobj +812 0 obj<>endobj +813 0 obj<>endobj +814 0 obj<>endobj +815 0 obj<>endobj +816 0 obj<>endobj +817 0 obj<>endobj +818 0 obj<>endobj +819 0 obj<>endobj +820 0 obj<>endobj +821 0 obj<>endobj +822 0 obj<>endobj +823 0 obj<>endobj +824 0 obj<>endobj +825 0 obj<>endobj +826 0 obj<>endobj +827 0 obj<>endobj +828 0 obj<>endobj +829 0 obj<>endobj +830 0 obj<>endobj +831 0 obj<>endobj +832 0 obj<>endobj +833 0 obj<>endobj +834 0 obj<>endobj +835 0 obj<>endobj +836 0 obj<>endobj +837 0 obj<>endobj +838 0 obj<>endobj +839 0 obj<>endobj +840 0 obj<>endobj +841 0 obj<>endobj +842 0 obj<>endobj +843 0 obj<>endobj +844 0 obj<>endobj +845 0 obj<>endobj +846 0 obj<>endobj +847 0 obj<>endobj +848 0 obj<>endobj +849 0 obj<>endobj +850 0 obj<>endobj +851 0 obj<>endobj +852 0 obj<>endobj +853 0 obj<>endobj +854 0 obj<>endobj +855 0 obj<>endobj +856 0 obj<>endobj +857 0 obj[806 0 R 807 0 R 808 0 R 809 0 R @@ -1548,57 +1549,44 @@ endobj 847 0 R 848 0 R 849 0 R -850 0 R]endobj -852 0 obj<>endobj -853 0 obj<>endobj -854 0 obj<>endobj -855 0 obj<>endobj -856 0 obj<>endobj -857 0 obj<>endobj -858 0 obj<>endobj -859 0 obj<>endobj -860 0 obj<>endobj -861 0 obj<>endobj -862 0 obj<>endobj -863 0 obj<>endobj -864 0 obj<>endobj -865 0 obj<>endobj -866 0 obj<>endobj -867 0 obj<>endobj -868 0 obj<>endobj -869 0 obj<>endobj -870 0 obj<>endobj -871 0 obj<>endobj -872 0 obj<>endobj -873 0 obj<>endobj -874 0 obj<>endobj -875 0 obj<>endobj -876 0 obj<>endobj -877 0 obj<>endobj -878 0 obj<>endobj -879 0 obj<>endobj -880 0 obj<>endobj -881 0 obj<>endobj -882 0 obj<>endobj -883 0 obj<>endobj -884 0 obj<>endobj -885 0 obj<>endobj -886 0 obj<>endobj -887 0 obj<>endobj -888 0 obj<>endobj -889 0 obj<>endobj -890 0 obj<>endobj -891 0 obj<>endobj -892 0 obj<>endobj -893 0 obj<>endobj -894 0 obj<>endobj -895 0 obj[852 0 R +850 0 R +851 0 R +852 0 R 853 0 R 854 0 R 855 0 R -856 0 R -857 0 R -858 0 R +856 0 R]endobj +858 0 obj<>endobj +859 0 obj<>endobj +860 0 obj<>endobj +861 0 obj<>endobj +862 0 obj<>endobj +863 0 obj<>endobj +864 0 obj<>endobj +865 0 obj<>endobj +866 0 obj<>endobj +867 0 obj<>endobj +868 0 obj<>endobj +869 0 obj<>endobj +870 0 obj<>endobj +871 0 obj<>endobj +872 0 obj<>endobj +873 0 obj<>endobj +874 0 obj<>endobj +875 0 obj<>endobj +876 0 obj<>endobj +877 0 obj<>endobj +878 0 obj<>endobj +879 0 obj<>endobj +880 0 obj<>endobj +881 0 obj<>endobj +882 0 obj<>endobj +883 0 obj<>endobj +884 0 obj<>endobj +885 0 obj<>endobj +886 0 obj<>endobj +887 0 obj<>endobj +888 0 obj[858 0 R 859 0 R 860 0 R 861 0 R @@ -1627,230 +1615,228 @@ endobj 884 0 R 885 0 R 886 0 R -887 0 R -888 0 R -889 0 R -890 0 R -891 0 R -892 0 R -893 0 R -894 0 R]endobj -896 0 obj<>endobj -897 0 obj<>endobj -898 0 obj<>endobj -899 0 obj<>endobj -900 0 obj<>endobj -901 0 obj<>endobj -902 0 obj[897 0 R -899 0 R -901 0 R]endobj -903 0 obj<>endobj -904 0 obj<>endobj -905 0 obj<>endobj -906 0 obj<>endobj -907 0 obj[904 0 R -906 0 R]endobj -908 0 obj<>endobj -909 0 obj<>endobj -910 0 obj<>endobj -911 0 obj<>endobj -912 0 obj[909 0 R -911 0 R]endobj -913 0 obj<>endobj -914 0 obj<>endobj -915 0 obj<>endobj -916 0 obj<>endobj -917 0 obj<>endobj -918 0 obj<>endobj -919 0 obj<>endobj -920 0 obj<>endobj -921 0 obj[914 0 R -916 0 R -918 0 R -920 0 R]endobj -922 0 obj<>endobj -923 0 obj<>endobj -924 0 obj[923 0 R]endobj -925 0 obj<>endobj -926 0 obj<>endobj -927 0 obj<>endobj -928 0 obj<>endobj -929 0 obj[926 0 R -928 0 R]endobj -930 0 obj<>endobj -931 0 obj<>endobj -932 0 obj<>endobj -933 0 obj<>endobj -934 0 obj<>endobj -935 0 obj<>endobj -936 0 obj[931 0 R -933 0 R -935 0 R]endobj -937 0 obj<>endobj -938 0 obj<>endobj -939 0 obj<>endobj -940 0 obj<>endobj -941 0 obj<>endobj -942 0 obj<>endobj -943 0 obj[938 0 R +887 0 R]endobj +889 0 obj<>endobj +890 0 obj<>endobj +891 0 obj<>endobj +892 0 obj<>endobj +893 0 obj[890 0 R +892 0 R]endobj +894 0 obj<>endobj +895 0 obj<>endobj +896 0 obj[895 0 R]endobj +897 0 obj<>endobj +898 0 obj<>endobj +899 0 obj<>endobj +900 0 obj<>endobj +901 0 obj[898 0 R +900 0 R]endobj +902 0 obj<>endobj +903 0 obj<>endobj +904 0 obj<>endobj +905 0 obj<>endobj +906 0 obj<>endobj +907 0 obj<>endobj +908 0 obj<>endobj +909 0 obj<>endobj +910 0 obj[903 0 R +905 0 R +907 0 R +909 0 R]endobj +911 0 obj<>endobj +912 0 obj<>endobj +913 0 obj<>endobj +914 0 obj<>endobj +915 0 obj[912 0 R +914 0 R]endobj +916 0 obj<>endobj +917 0 obj<>endobj +918 0 obj<>endobj +919 0 obj<>endobj +920 0 obj<>endobj +921 0 obj<>endobj +922 0 obj[917 0 R +919 0 R +921 0 R]endobj +923 0 obj<>endobj +924 0 obj<>endobj +925 0 obj<>endobj +926 0 obj<>endobj +927 0 obj<>endobj +928 0 obj<>endobj +929 0 obj<>endobj +930 0 obj<>endobj +931 0 obj<>endobj +932 0 obj<>endobj +933 0 obj[924 0 R +926 0 R +928 0 R +930 0 R +932 0 R]endobj +934 0 obj<>endobj +935 0 obj<>endobj +936 0 obj[935 0 R]endobj +937 0 obj<>endobj +938 0 obj<>endobj +939 0 obj<>endobj +940 0 obj<>endobj +941 0 obj<>endobj +942 0 obj<>endobj +943 0 obj<>endobj +944 0 obj<>endobj +945 0 obj<>endobj +946 0 obj<>endobj +947 0 obj[938 0 R 940 0 R -942 0 R]endobj -944 0 obj<>endobj -945 0 obj<>endobj -946 0 obj<>endobj -947 0 obj<>endobj -948 0 obj<>endobj -949 0 obj<>endobj -950 0 obj<>endobj -951 0 obj<>endobj -952 0 obj<>endobj -953 0 obj<>endobj -954 0 obj[945 0 R -947 0 R -949 0 R -951 0 R -953 0 R]endobj -955 0 obj<>endobj -956 0 obj<>endobj -957 0 obj[956 0 R]endobj -958 0 obj<>endobj -959 0 obj<>endobj -960 0 obj<>endobj -961 0 obj<>endobj -962 0 obj<>endobj -963 0 obj<>endobj -964 0 obj<>endobj -965 0 obj<>endobj -966 0 obj<>endobj -967 0 obj<>endobj -968 0 obj[959 0 R -961 0 R +942 0 R +944 0 R +946 0 R]endobj +948 0 obj<>endobj +949 0 obj<>endobj +950 0 obj<>endobj +951 0 obj<>endobj +952 0 obj[949 0 R +951 0 R]endobj +953 0 obj<>endobj +954 0 obj<>endobj +955 0 obj<>endobj +956 0 obj<>endobj +957 0 obj<>endobj +958 0 obj<>endobj +959 0 obj[954 0 R +956 0 R +958 0 R]endobj +960 0 obj<>endobj +961 0 obj<>endobj +962 0 obj<>endobj +963 0 obj<>endobj +964 0 obj<>endobj +965 0 obj<>endobj +966 0 obj<>endobj +967 0 obj<>endobj +968 0 obj[961 0 R 963 0 R 965 0 R 967 0 R]endobj -969 0 obj<>endobj -970 0 obj<>endobj -971 0 obj<>endobj -972 0 obj<>endobj -973 0 obj[970 0 R -972 0 R]endobj -974 0 obj<>endobj -975 0 obj<>endobj -976 0 obj<>endobj -977 0 obj<>endobj -978 0 obj<>endobj -979 0 obj<>endobj -980 0 obj[975 0 R -977 0 R -979 0 R]endobj -981 0 obj<>endobj -982 0 obj<>endobj -983 0 obj<>endobj -984 0 obj<>endobj -985 0 obj<>endobj -986 0 obj<>endobj -987 0 obj<>endobj -988 0 obj<>endobj -989 0 obj[982 0 R +969 0 obj<>endobj +970 0 obj<>endobj +971 0 obj[970 0 R]endobj +972 0 obj<>endobj +973 0 obj<>endobj +974 0 obj[973 0 R]endobj +975 0 obj<>endobj +976 0 obj<>endobj +977 0 obj[976 0 R]endobj +978 0 obj<>endobj +979 0 obj<>endobj +980 0 obj[979 0 R]endobj +981 0 obj<>endobj +982 0 obj<>endobj +983 0 obj<>endobj +984 0 obj<>endobj +985 0 obj<>endobj +986 0 obj<>endobj +987 0 obj[982 0 R 984 0 R -986 0 R -988 0 R]endobj -990 0 obj<>endobj -991 0 obj<>endobj -992 0 obj[991 0 R]endobj -993 0 obj<>endobj -994 0 obj<>endobj -995 0 obj[994 0 R]endobj -996 0 obj<>endobj -997 0 obj<>endobj -998 0 obj[997 0 R]endobj -999 0 obj<>endobj -1000 0 obj<>endobj -1001 0 obj[1000 0 R]endobj -1002 0 obj<>endobj -1003 0 obj<>endobj -1004 0 obj<>endobj -1005 0 obj<>endobj -1006 0 obj<>endobj -1007 0 obj<>endobj -1008 0 obj[1003 0 R -1005 0 R -1007 0 R]endobj -1009 0 obj<>endobj -1010 0 obj<>endobj -1011 0 obj<>endobj -1012 0 obj<>endobj -1013 0 obj<>endobj -1014 0 obj<>endobj -1015 0 obj<>endobj -1016 0 obj<>endobj -1017 0 obj<>endobj -1018 0 obj<>endobj -1019 0 obj[1010 0 R -1012 0 R -1014 0 R -1016 0 R -1018 0 R]endobj -1020 0 obj<>endobj -1021 0 obj<>endobj -1022 0 obj<>endobj -1023 0 obj<>endobj -1024 0 obj[1021 0 R -1023 0 R]endobj -1025 0 obj<>endobj -1026 0 obj<>endobj -1027 0 obj[1026 0 R]endobj -1028 0 obj<>endobj -1029 0 obj<>endobj -1030 0 obj[1029 0 R]endobj -1031 0 obj<>endobj -1032 0 obj<>endobj -1033 0 obj<>endobj -1034 0 obj<>endobj -1035 0 obj<>endobj -1036 0 obj<>endobj -1037 0 obj<>endobj -1038 0 obj<>endobj -1039 0 obj<>endobj -1040 0 obj<>endobj -1041 0 obj<>endobj -1042 0 obj<>endobj -1043 0 obj<>endobj -1044 0 obj<>endobj -1045 0 obj<>endobj -1046 0 obj<>endobj -1047 0 obj<>endobj -1048 0 obj<>endobj -1049 0 obj<>endobj -1050 0 obj<>endobj -1051 0 obj<>endobj -1052 0 obj<>endobj -1053 0 obj<>endobj -1054 0 obj<>endobj -1055 0 obj<>endobj -1056 0 obj<>endobj -1057 0 obj<>endobj -1058 0 obj<>endobj -1059 0 obj<>endobj -1060 0 obj<>endobj -1061 0 obj<>endobj -1062 0 obj<>endobj -1063 0 obj<>endobj -1064 0 obj<>endobj -1065 0 obj<>endobj -1066 0 obj<>endobj -1067 0 obj<>endobj -1068 0 obj<>endobj -1069 0 obj<>endobj -1070 0 obj<>endobj -1071 0 obj<>endobj -1072 0 obj<>endobj -1073 0 obj<>endobj -1074 0 obj<>endobj -1075 0 obj<>endobj -1076 0 obj<>endobj -1077 0 obj<>endobj -1078 0 obj[1031 0 R +986 0 R]endobj +988 0 obj<>endobj +989 0 obj<>endobj +990 0 obj<>endobj +991 0 obj<>endobj +992 0 obj<>endobj +993 0 obj<>endobj +994 0 obj<>endobj +995 0 obj<>endobj +996 0 obj<>endobj +997 0 obj<>endobj +998 0 obj[989 0 R +991 0 R +993 0 R +995 0 R +997 0 R]endobj +999 0 obj<>endobj +1000 0 obj<>endobj +1001 0 obj<>endobj +1002 0 obj<>endobj +1003 0 obj<>endobj +1004 0 obj<>endobj +1005 0 obj[1000 0 R +1002 0 R +1004 0 R]endobj +1006 0 obj<>endobj +1007 0 obj<>endobj +1008 0 obj<>endobj +1009 0 obj<>endobj +1010 0 obj[1007 0 R +1009 0 R]endobj +1011 0 obj<>endobj +1012 0 obj<>endobj +1013 0 obj[1012 0 R]endobj +1014 0 obj<>endobj +1015 0 obj<>endobj +1016 0 obj[1015 0 R]endobj +1017 0 obj<>endobj +1018 0 obj<>endobj +1019 0 obj<>endobj +1020 0 obj<>endobj +1021 0 obj<>endobj +1022 0 obj<>endobj +1023 0 obj<>endobj +1024 0 obj<>endobj +1025 0 obj<>endobj +1026 0 obj<>endobj +1027 0 obj<>endobj +1028 0 obj<>endobj +1029 0 obj<>endobj +1030 0 obj<>endobj +1031 0 obj<>endobj +1032 0 obj<>endobj +1033 0 obj<>endobj +1034 0 obj<>endobj +1035 0 obj<>endobj +1036 0 obj<>endobj +1037 0 obj<>endobj +1038 0 obj<>endobj +1039 0 obj<>endobj +1040 0 obj<>endobj +1041 0 obj<>endobj +1042 0 obj<>endobj +1043 0 obj<>endobj +1044 0 obj<>endobj +1045 0 obj<>endobj +1046 0 obj<>endobj +1047 0 obj<>endobj +1048 0 obj<>endobj +1049 0 obj<>endobj +1050 0 obj<>endobj +1051 0 obj<>endobj +1052 0 obj<>endobj +1053 0 obj<>endobj +1054 0 obj<>endobj +1055 0 obj<>endobj +1056 0 obj<>endobj +1057 0 obj<>endobj +1058 0 obj<>endobj +1059 0 obj<>endobj +1060 0 obj<>endobj +1061 0 obj<>endobj +1062 0 obj<>endobj +1063 0 obj<>endobj +1064 0 obj[1017 0 R +1018 0 R +1019 0 R +1020 0 R +1021 0 R +1022 0 R +1023 0 R +1024 0 R +1025 0 R +1026 0 R +1027 0 R +1028 0 R +1029 0 R +1030 0 R +1031 0 R 1032 0 R 1033 0 R 1034 0 R @@ -1882,9 +1868,27 @@ endobj 1060 0 R 1061 0 R 1062 0 R -1063 0 R -1064 0 R -1065 0 R +1063 0 R]endobj +1065 0 obj<>endobj +1066 0 obj<>endobj +1067 0 obj<>endobj +1068 0 obj<>endobj +1069 0 obj<>endobj +1070 0 obj<>endobj +1071 0 obj<>endobj +1072 0 obj<>endobj +1073 0 obj<>endobj +1074 0 obj<>endobj +1075 0 obj<>endobj +1076 0 obj<>endobj +1077 0 obj<>endobj +1078 0 obj<>endobj +1079 0 obj<>endobj +1080 0 obj<>endobj +1081 0 obj<>endobj +1082 0 obj<>endobj +1083 0 obj<>endobj +1084 0 obj[1065 0 R 1066 0 R 1067 0 R 1068 0 R @@ -1896,422 +1900,414 @@ endobj 1074 0 R 1075 0 R 1076 0 R -1077 0 R]endobj -1079 0 obj<>endobj -1080 0 obj<>endobj -1081 0 obj<>endobj -1082 0 obj<>endobj -1083 0 obj<>endobj -1084 0 obj<>endobj -1085 0 obj<>endobj -1086 0 obj<>endobj -1087 0 obj[1079 0 R +1077 0 R +1078 0 R +1079 0 R 1080 0 R 1081 0 R 1082 0 R -1083 0 R -1084 0 R -1085 0 R -1086 0 R]endobj -1088 0 obj<>endobj -1089 0 obj<>endobj -1090 0 obj<>endobj -1091 0 obj<>endobj -1092 0 obj<>endobj -1093 0 obj<>endobj -1094 0 obj<>endobj -1095 0 obj<>endobj -1096 0 obj<>endobj -1097 0 obj<>endobj -1098 0 obj[1089 0 R -1091 0 R -1093 0 R -1095 0 R -1097 0 R]endobj -1099 0 obj<>endobj -1100 0 obj<>endobj -1101 0 obj<>endobj -1102 0 obj<>endobj -1103 0 obj<>endobj -1104 0 obj<>endobj -1105 0 obj<>endobj -1106 0 obj<>endobj -1107 0 obj[1100 0 R -1102 0 R -1104 0 R -1106 0 R]endobj +1083 0 R]endobj +1085 0 obj<>endobj +1086 0 obj<>endobj +1087 0 obj<>endobj +1088 0 obj<>endobj +1089 0 obj<>endobj +1090 0 obj<>endobj +1091 0 obj<>endobj +1092 0 obj<>endobj +1093 0 obj<>endobj +1094 0 obj<>endobj +1095 0 obj[1086 0 R +1088 0 R +1090 0 R +1092 0 R +1094 0 R]endobj +1096 0 obj<>endobj +1097 0 obj<>endobj +1098 0 obj<>endobj +1099 0 obj<>endobj +1100 0 obj<>endobj +1101 0 obj<>endobj +1102 0 obj<>endobj +1103 0 obj<>endobj +1104 0 obj[1097 0 R +1099 0 R +1101 0 R +1103 0 R]endobj +1105 0 obj<>endobj +1106 0 obj<>endobj +1107 0 obj[1106 0 R]endobj 1108 0 obj<>endobj -1109 0 obj<>endobj +1109 0 obj<>endobj 1110 0 obj[1109 0 R]endobj -1111 0 obj<>endobj -1112 0 obj<>endobj -1113 0 obj[1112 0 R]endobj -1114 0 obj<>endobj -1115 0 obj<>endobj -1116 0 obj<>endobj -1117 0 obj<>endobj -1118 0 obj<>endobj -1119 0 obj<>endobj -1120 0 obj<>endobj -1121 0 obj<>endobj -1122 0 obj[1115 0 R -1117 0 R -1119 0 R -1121 0 R]endobj -1123 0 obj<>endobj -1124 0 obj<>endobj -1125 0 obj<>endobj -1126 0 obj<>endobj -1127 0 obj[1124 0 R -1126 0 R]endobj -1128 0 obj<>endobj -1129 0 obj<>endobj -1130 0 obj<>endobj -1131 0 obj<>endobj -1132 0 obj<>endobj -1133 0 obj<>endobj -1134 0 obj<>endobj -1135 0 obj<>endobj -1136 0 obj[1129 0 R -1131 0 R -1133 0 R -1135 0 R]endobj -1137 0 obj<>endobj -1138 0 obj<>endobj -1139 0 obj<>endobj -1140 0 obj<>endobj -1141 0 obj[1138 0 R -1140 0 R]endobj -1142 0 obj<>endobj -1143 0 obj<>endobj -1144 0 obj<>endobj -1145 0 obj<>endobj -1146 0 obj<>endobj -1147 0 obj<>endobj -1148 0 obj<>endobj -1149 0 obj<>endobj -1150 0 obj<>endobj -1151 0 obj<>endobj -1152 0 obj<>endobj -1153 0 obj<>endobj -1154 0 obj<>endobj -1155 0 obj<>endobj -1156 0 obj<>endobj -1157 0 obj<>endobj -1158 0 obj<>endobj -1159 0 obj<>endobj -1160 0 obj<>endobj -1161 0 obj<>endobj -1162 0 obj<>endobj -1163 0 obj<>endobj -1164 0 obj<>endobj -1165 0 obj<>endobj -1166 0 obj<>endobj -1167 0 obj<>endobj -1168 0 obj<>endobj -1169 0 obj<>endobj -1170 0 obj<>endobj -1171 0 obj<>endobj -1172 0 obj<>endobj -1173 0 obj<>endobj -1174 0 obj<>endobj -1175 0 obj<>endobj -1176 0 obj<>endobj -1177 0 obj<>endobj -1178 0 obj<>endobj -1179 0 obj<>endobj -1180 0 obj<>endobj -1181 0 obj<>endobj -1182 0 obj<>endobj -1183 0 obj<>endobj -1184 0 obj<>endobj -1185 0 obj<>endobj -1186 0 obj<>endobj -1187 0 obj<>endobj -1188 0 obj<>endobj -1189 0 obj<>endobj -1190 0 obj<>endobj -1191 0 obj<>endobj -1192 0 obj<>endobj -1193 0 obj<>endobj -1194 0 obj<>endobj -1195 0 obj<>endobj -1196 0 obj<>endobj -1197 0 obj<>endobj -1198 0 obj<>endobj -1199 0 obj<>endobj -1200 0 obj<>endobj -1201 0 obj<>endobj -1202 0 obj<>endobj -1203 0 obj<>endobj -1204 0 obj<>endobj -1205 0 obj<>endobj -1206 0 obj<>endobj -1207 0 obj<>endobj -1208 0 obj<>endobj -1209 0 obj<>endobj -1210 0 obj<>endobj -1211 0 obj<>endobj -1212 0 obj<>endobj -1213 0 obj<>endobj -1214 0 obj<>endobj -1215 0 obj<>endobj -1216 0 obj<>endobj -1217 0 obj<>endobj -1218 0 obj<>endobj -1219 0 obj<>endobj -1220 0 obj<>endobj -1221 0 obj<>endobj -1222 0 obj<>endobj -1223 0 obj<>endobj -1224 0 obj<>endobj -1225 0 obj<>endobj -1226 0 obj<>endobj -1227 0 obj<>endobj -1228 0 obj<>endobj -1229 0 obj<>endobj +1111 0 obj<>endobj +1112 0 obj<>endobj +1113 0 obj<>endobj +1114 0 obj<>endobj +1115 0 obj<>endobj +1116 0 obj<>endobj +1117 0 obj<>endobj +1118 0 obj<>endobj +1119 0 obj[1112 0 R +1114 0 R +1116 0 R +1118 0 R]endobj +1120 0 obj<>endobj +1121 0 obj<>endobj +1122 0 obj<>endobj +1123 0 obj<>endobj +1124 0 obj[1121 0 R +1123 0 R]endobj +1125 0 obj<>endobj +1126 0 obj<>endobj +1127 0 obj<>endobj +1128 0 obj<>endobj +1129 0 obj<>endobj +1130 0 obj<>endobj +1131 0 obj<>endobj +1132 0 obj<>endobj +1133 0 obj[1126 0 R +1128 0 R +1130 0 R +1132 0 R]endobj +1134 0 obj<>endobj +1135 0 obj<>endobj +1136 0 obj<>endobj +1137 0 obj<>endobj +1138 0 obj[1135 0 R +1137 0 R]endobj +1139 0 obj<>endobj +1140 0 obj<>endobj +1141 0 obj<>endobj +1142 0 obj<>endobj +1143 0 obj<>endobj +1144 0 obj<>endobj +1145 0 obj<>endobj +1146 0 obj<>endobj +1147 0 obj<>endobj +1148 0 obj<>endobj +1149 0 obj<>endobj +1150 0 obj<>endobj +1151 0 obj<>endobj +1152 0 obj<>endobj +1153 0 obj<>endobj +1154 0 obj<>endobj +1155 0 obj<>endobj +1156 0 obj<>endobj +1157 0 obj<>endobj +1158 0 obj<>endobj +1159 0 obj<>endobj +1160 0 obj<>endobj +1161 0 obj<>endobj +1162 0 obj<>endobj +1163 0 obj<>endobj +1164 0 obj<>endobj +1165 0 obj<>endobj +1166 0 obj<>endobj +1167 0 obj<>endobj +1168 0 obj<>endobj +1169 0 obj<>endobj +1170 0 obj<>endobj +1171 0 obj<>endobj +1172 0 obj<>endobj +1173 0 obj<>endobj +1174 0 obj<>endobj +1175 0 obj<>endobj +1176 0 obj<>endobj +1177 0 obj<>endobj +1178 0 obj<>endobj +1179 0 obj<>endobj +1180 0 obj<>endobj +1181 0 obj<>endobj +1182 0 obj<>endobj +1183 0 obj<>endobj +1184 0 obj<>endobj +1185 0 obj<>endobj +1186 0 obj<>endobj +1187 0 obj<>endobj +1188 0 obj<>endobj +1189 0 obj<>endobj +1190 0 obj<>endobj +1191 0 obj<>endobj +1192 0 obj<>endobj +1193 0 obj<>endobj +1194 0 obj<>endobj +1195 0 obj<>endobj +1196 0 obj<>endobj +1197 0 obj<>endobj +1198 0 obj<>endobj +1199 0 obj<>endobj +1200 0 obj<>endobj +1201 0 obj<>endobj +1202 0 obj<>endobj +1203 0 obj<>endobj +1204 0 obj<>endobj +1205 0 obj<>endobj +1206 0 obj<>endobj +1207 0 obj<>endobj +1208 0 obj<>endobj +1209 0 obj<>endobj +1210 0 obj<>endobj +1211 0 obj<>endobj +1212 0 obj<>endobj +1213 0 obj<>endobj +1214 0 obj<>endobj +1215 0 obj<>endobj +1216 0 obj<>endobj +1217 0 obj<>endobj +1218 0 obj<>endobj +1219 0 obj<>endobj +1220 0 obj<>endobj +1221 0 obj<>endobj +1222 0 obj<>endobj +1223 0 obj<>endobj +1224 0 obj<>endobj +1225 0 obj<>endobj +1226 0 obj<>endobj +1227 0 obj<>endobj +1228 0 obj<>endobj +1229 0 obj<>endobj 1230 0 obj<>endobj -1231 0 obj<>endobj -1232 0 obj<>endobj -1233 0 obj<>endobj -1234 0 obj<>endobj -1235 0 obj<>endobj -1236 0 obj<>endobj -1237 0 obj<>endobj -1238 0 obj<>endobj -1239 0 obj<>endobj -1240 0 obj<>endobj -1241 0 obj<>endobj -1242 0 obj<>endobj -1243 0 obj<>endobj -1244 0 obj<>endobj -1245 0 obj<>endobj -1246 0 obj<>endobj -1247 0 obj<>endobj -1248 0 obj<>endobj -1249 0 obj<>endobj -1250 0 obj<>endobj -1251 0 obj<>endobj -1252 0 obj<>endobj -1253 0 obj<>endobj -1254 0 obj<>endobj -1255 0 obj<>endobj -1256 0 obj<>endobj -1257 0 obj<>endobj -1258 0 obj<>endobj -1259 0 obj<>endobj -1260 0 obj<>endobj -1261 0 obj<>endobj -1262 0 obj<>endobj -1263 0 obj<>endobj -1264 0 obj<>endobj -1265 0 obj<>endobj -1266 0 obj<>endobj -1267 0 obj<>endobj -1268 0 obj<>endobj -1269 0 obj<>endobj -1270 0 obj<>endobj -1271 0 obj<>endobj -1272 0 obj<>endobj -1273 0 obj<>endobj -1274 0 obj<>endobj -1275 0 obj<>endobj -1276 0 obj<>endobj -1277 0 obj<>endobj -1278 0 obj<>endobj -1279 0 obj<>endobj -1280 0 obj<>endobj -1281 0 obj<>endobj -1282 0 obj<>endobj -1283 0 obj<>endobj -1284 0 obj<>endobj -1285 0 obj<>endobj -1286 0 obj<>endobj -1287 0 obj<>endobj -1288 0 obj<>endobj -1289 0 obj<>endobj -1290 0 obj<>endobj -1291 0 obj<>endobj -1292 0 obj<>endobj -1293 0 obj<>endobj -1294 0 obj<>endobj -1295 0 obj<>endobj -1296 0 obj<>endobj -1297 0 obj<>endobj -1298 0 obj<>endobj -1299 0 obj<>endobj -1300 0 obj<>endobj -1301 0 obj<>endobj -1302 0 obj<>endobj -1303 0 obj<>endobj -1304 0 obj<>endobj -1305 0 obj<>endobj -1306 0 obj<>endobj -1307 0 obj<>endobj -1308 0 obj<>endobj -1309 0 obj<>endobj -1310 0 obj<>endobj -1311 0 obj<>endobj -1312 0 obj<>endobj -1313 0 obj<>endobj -1314 0 obj<>endobj -1315 0 obj<>endobj -1316 0 obj<>endobj -1317 0 obj<>endobj -1318 0 obj<>endobj -1319 0 obj<>endobj -1320 0 obj<>endobj -1321 0 obj<>endobj -1322 0 obj<>endobj -1323 0 obj<>endobj -1324 0 obj<>endobj -1325 0 obj<>endobj -1326 0 obj<>endobj -1327 0 obj<>endobj -1328 0 obj<>endobj -1329 0 obj<>endobj -1330 0 obj<>endobj -1331 0 obj<>endobj -1332 0 obj<>endobj -1333 0 obj<>endobj -1334 0 obj<>endobj -1335 0 obj<>endobj -1336 0 obj<>endobj -1337 0 obj<>endobj -1338 0 obj<>endobj -1339 0 obj<>endobj -1340 0 obj<>endobj -1341 0 obj<>endobj -1342 0 obj<>endobj -1343 0 obj<>endobj -1344 0 obj<>endobj -1345 0 obj<>endobj -1346 0 obj<>endobj -1347 0 obj<>endobj -1348 0 obj<>endobj -1349 0 obj<>endobj -1350 0 obj<>endobj -1351 0 obj<>endobj -1352 0 obj<>endobj -1353 0 obj<>endobj -1354 0 obj<>endobj -1355 0 obj<>endobj -1356 0 obj<>endobj -1357 0 obj<>endobj -1358 0 obj<>endobj -1359 0 obj<>endobj -1360 0 obj<>endobj -1361 0 obj<>endobj -1362 0 obj<>endobj -1363 0 obj<>endobj -1364 0 obj<>endobj -1365 0 obj<>endobj -1366 0 obj<>endobj -1367 0 obj<>endobj -1368 0 obj<>endobj -1369 0 obj<>endobj -1370 0 obj<>endobj -1371 0 obj<>endobj -1372 0 obj<>endobj -1373 0 obj<>endobj -1374 0 obj<>endobj -1375 0 obj<>endobj -1376 0 obj<>endobj -1377 0 obj<>endobj -1378 0 obj<>endobj -1379 0 obj<>endobj -1380 0 obj<>endobj -1381 0 obj<>endobj -1382 0 obj<>endobj -1383 0 obj<>endobj -1384 0 obj<>endobj -1385 0 obj<>endobj -1386 0 obj<>endobj -1387 0 obj<>endobj -1388 0 obj<>endobj -1389 0 obj<>endobj -1390 0 obj<>endobj -1391 0 obj<>endobj -1392 0 obj<>endobj -1393 0 obj<>endobj -1394 0 obj<>endobj +1231 0 obj<>endobj +1232 0 obj<>endobj +1233 0 obj<>endobj +1234 0 obj<>endobj +1235 0 obj<>endobj +1236 0 obj<>endobj +1237 0 obj<>endobj +1238 0 obj<>endobj +1239 0 obj<>endobj +1240 0 obj<>endobj +1241 0 obj<>endobj +1242 0 obj<>endobj +1243 0 obj<>endobj +1244 0 obj<>endobj +1245 0 obj<>endobj +1246 0 obj<>endobj +1247 0 obj<>endobj +1248 0 obj<>endobj +1249 0 obj<>endobj +1250 0 obj<>endobj +1251 0 obj<>endobj +1252 0 obj<>endobj +1253 0 obj<>endobj +1254 0 obj<>endobj +1255 0 obj<>endobj +1256 0 obj<>endobj +1257 0 obj<>endobj +1258 0 obj<>endobj +1259 0 obj<>endobj +1260 0 obj<>endobj +1261 0 obj<>endobj +1262 0 obj<>endobj +1263 0 obj<>endobj +1264 0 obj<>endobj +1265 0 obj<>endobj +1266 0 obj<>endobj +1267 0 obj<>endobj +1268 0 obj<>endobj +1269 0 obj<>endobj +1270 0 obj<>endobj +1271 0 obj<>endobj +1272 0 obj<>endobj +1273 0 obj<>endobj +1274 0 obj<>endobj +1275 0 obj<>endobj +1276 0 obj<>endobj +1277 0 obj<>endobj +1278 0 obj<>endobj +1279 0 obj<>endobj +1280 0 obj<>endobj +1281 0 obj<>endobj +1282 0 obj<>endobj +1283 0 obj<>endobj +1284 0 obj<>endobj +1285 0 obj<>endobj +1286 0 obj<>endobj +1287 0 obj<>endobj +1288 0 obj<>endobj +1289 0 obj<>endobj +1290 0 obj<>endobj +1291 0 obj<>endobj +1292 0 obj<>endobj +1293 0 obj<>endobj +1294 0 obj<>endobj +1295 0 obj<>endobj +1296 0 obj<>endobj +1297 0 obj<>endobj +1298 0 obj<>endobj +1299 0 obj<>endobj +1300 0 obj<>endobj +1301 0 obj<>endobj +1302 0 obj<>endobj +1303 0 obj<>endobj +1304 0 obj<>endobj +1305 0 obj<>endobj +1306 0 obj<>endobj +1307 0 obj<>endobj +1308 0 obj<>endobj +1309 0 obj<>endobj +1310 0 obj<>endobj +1311 0 obj<>endobj +1312 0 obj<>endobj +1313 0 obj<>endobj +1314 0 obj<>endobj +1315 0 obj<>endobj +1316 0 obj<>endobj +1317 0 obj<>endobj +1318 0 obj<>endobj +1319 0 obj<>endobj +1320 0 obj<>endobj +1321 0 obj<>endobj +1322 0 obj<>endobj +1323 0 obj<>endobj +1324 0 obj<>endobj +1325 0 obj<>endobj +1326 0 obj<>endobj +1327 0 obj<>endobj +1328 0 obj<>endobj +1329 0 obj<>endobj +1330 0 obj<>endobj +1331 0 obj<>endobj +1332 0 obj<>endobj +1333 0 obj<>endobj +1334 0 obj<>endobj +1335 0 obj<>endobj +1336 0 obj<>endobj +1337 0 obj<>endobj +1338 0 obj<>endobj +1339 0 obj<>endobj +1340 0 obj<>endobj +1341 0 obj<>endobj +1342 0 obj<>endobj +1343 0 obj<>endobj +1344 0 obj<>endobj +1345 0 obj<>endobj +1346 0 obj<>endobj +1347 0 obj<>endobj +1348 0 obj<>endobj +1349 0 obj<>endobj +1350 0 obj<>endobj +1351 0 obj<>endobj +1352 0 obj<>endobj +1353 0 obj<>endobj +1354 0 obj<>endobj +1355 0 obj<>endobj +1356 0 obj<>endobj +1357 0 obj<>endobj +1358 0 obj<>endobj +1359 0 obj<>endobj +1360 0 obj<>endobj +1361 0 obj<>endobj +1362 0 obj<>endobj +1363 0 obj<>endobj +1364 0 obj<>endobj +1365 0 obj<>endobj +1366 0 obj<>endobj +1367 0 obj<>endobj +1368 0 obj<>endobj +1369 0 obj<>endobj +1370 0 obj<>endobj +1371 0 obj<>endobj +1372 0 obj<>endobj +1373 0 obj<>endobj +1374 0 obj<>endobj +1375 0 obj<>endobj +1376 0 obj<>endobj +1377 0 obj<>endobj +1378 0 obj<>endobj +1379 0 obj<>endobj +1380 0 obj<>endobj +1381 0 obj<>endobj +1382 0 obj<>endobj +1383 0 obj<>endobj +1384 0 obj<>endobj +1385 0 obj<>endobj +1386 0 obj<>endobj +1387 0 obj<>endobj +1388 0 obj<>endobj +1389 0 obj<>endobj +1390 0 obj<>endobj +1391 0 obj<>endobj +1392 0 obj<>endobj +1393 0 obj<>endobj +1394 0 obj<>endobj 1395 0 obj<>endobj -1396 0 obj<>endobj -1397 0 obj<>endobj -1398 0 obj<>endobj -1399 0 obj<>endobj -1400 0 obj<>endobj -1401 0 obj<>endobj -1402 0 obj<>endobj -1403 0 obj<>endobj -1404 0 obj<>endobj -1405 0 obj<>endobj -1406 0 obj<>endobj -1407 0 obj<>endobj -1408 0 obj<>endobj -1409 0 obj<>endobj -1410 0 obj<>endobj -1411 0 obj<>endobj -1412 0 obj<>endobj -1413 0 obj<>endobj -1414 0 obj<>endobj -1415 0 obj<>endobj -1416 0 obj<>endobj -1417 0 obj<>endobj -1418 0 obj<>endobj -1419 0 obj<>endobj -1420 0 obj<>endobj -1421 0 obj<>endobj -1422 0 obj<>endobj -1423 0 obj<>endobj -1424 0 obj<>endobj -1425 0 obj<>endobj -1426 0 obj<>endobj -1427 0 obj<>endobj -1428 0 obj<>endobj -1429 0 obj<>endobj -1430 0 obj<>endobj -1431 0 obj<>endobj -1432 0 obj<>endobj -1433 0 obj<>endobj -1434 0 obj<>endobj -1435 0 obj<>endobj -1436 0 obj<>endobj -1437 0 obj<>endobj -1438 0 obj<>endobj -1439 0 obj<>endobj -1440 0 obj<>endobj -1441 0 obj<>endobj -1442 0 obj<>endobj -1443 0 obj<>endobj -1444 0 obj<>endobj -1445 0 obj<>endobj -1446 0 obj<>endobj -1447 0 obj<>endobj -1448 0 obj<>endobj -1449 0 obj<>endobj -1450 0 obj<>endobj -1451 0 obj<>endobj -1452 0 obj<>endobj -1453 0 obj<>endobj -1454 0 obj<>endobj -1455 0 obj<>endobj -1456 0 obj<>endobj -1457 0 obj<>endobj -1458 0 obj<>endobj -1459 0 obj<>endobj -1460 0 obj<>endobj -1461 0 obj<>endobj -1462 0 obj<>endobj -1463 0 obj<>endobj -1464 0 obj<>endobj -1465 0 obj<>endobj -1466 0 obj<>endobj -1467 0 obj<>endobj -1468 0 obj<>endobj -1469 0 obj<>endobj -1470 0 obj<>endobj -1471 0 obj<>endobj +1397 0 obj<>endobj +1398 0 obj<>endobj +1399 0 obj<>endobj +1400 0 obj<>endobj +1401 0 obj<>endobj +1402 0 obj<>endobj +1403 0 obj<>endobj +1404 0 obj<>endobj +1405 0 obj<>endobj +1406 0 obj<>endobj +1407 0 obj<>endobj +1408 0 obj<>endobj +1409 0 obj<>endobj +1410 0 obj<>endobj +1411 0 obj<>endobj +1412 0 obj<>endobj +1413 0 obj<>endobj +1414 0 obj<>endobj +1415 0 obj<>endobj +1416 0 obj<>endobj +1417 0 obj<>endobj +1418 0 obj<>endobj +1419 0 obj<>endobj +1420 0 obj<>endobj +1421 0 obj<>endobj +1422 0 obj<>endobj +1423 0 obj<>endobj +1424 0 obj<>endobj +1425 0 obj<>endobj +1426 0 obj<>endobj +1427 0 obj<>endobj +1428 0 obj<>endobj +1429 0 obj<>endobj +1430 0 obj<>endobj +1431 0 obj<>endobj +1432 0 obj<>endobj +1433 0 obj<>endobj +1434 0 obj<>endobj +1435 0 obj<>endobj +1436 0 obj<>endobj +1437 0 obj<>endobj +1438 0 obj<>endobj +1439 0 obj<>endobj +1440 0 obj<>endobj +1441 0 obj<>endobj +1442 0 obj<>endobj +1443 0 obj<>endobj +1444 0 obj<>endobj +1445 0 obj<>endobj +1446 0 obj<>endobj +1447 0 obj<>endobj +1448 0 obj<>endobj +1449 0 obj<>endobj +1450 0 obj<>endobj +1451 0 obj<>endobj +1452 0 obj<>endobj +1453 0 obj<>endobj +1454 0 obj<>endobj +1455 0 obj<>endobj +1456 0 obj<>endobj +1457 0 obj<>endobj +1458 0 obj<>endobj +1459 0 obj<>endobj +1460 0 obj<>endobj +1461 0 obj<>endobj +1462 0 obj<>endobj +1463 0 obj<>endobj +1464 0 obj<>endobj +1465 0 obj<>endobj +1466 0 obj<>endobj +1467 0 obj<>endobj +1468 0 obj<>endobj +1469 0 obj<>endobj -1472 0 obj<>/XObject<<>>>>>>endobj -1473 0 obj<>stream +1470 0 obj<>/XObject<<>>>>>>endobj +1471 0 obj<>stream x+2T0BCs#c3\..}7K#4K=3cS`g`NvurT(JM.QpO.M+I, r endstream endobj -1474 0 obj<>/XObject<<>>>>/Annots 59 0 R>>endobj -1475 0 obj<>stream -x[rG}WLe==WiKl|'EYI_~n4Co[Ttx4@c&}ΒJG //闤*F2GڃE2~d2g2qv`E`Ir3aVH2W0๚ DT9es줴9EC-`D9 3|#tH\II$嘔O+@ sL$)#pEr^Nh>[Fe$4@ -@` vTX~)Z 6A' vVP,Pf`+:nqf>y9' 8a0-?I ,JvyA蹚2m[6r~Tb#="k.J{0g+} DU<'+g`PE9Qŏ+iYQ%1E`r`qdʊ4s ͔30((9G%wTD%g\5DF)D@8F5,|3`(|Jk0XԏV`awX܎ܯ$ՙ-*Je1/JX"wZD}j!Y@2"8b=rRDΪ`>"G#r OB $iF- +U32y'YV$VzI g 4I5YNZ vDr:3Z@ -h+b=,P"tXY'pqb cEAIUȊ~l(ʼn-B0ߜZ}$J"q RR(xIFJ"K -%1B=K"DX98> y!j0NdNw:2shD!I*m -:PP]r'd7.8?dܡd 8sZcKI"-<0@d ;Z'"-2&Ueý"GBO`(ˢ"`8,k13[ ²Qk0tv#˦@&h!ʰ5f$:>l׍\K&|_%#k,r:`Y𯗳l,goM2_mbnßSb&jn/vp\yjb&=j5p$D8<:n#L-+>d{f~l 8+ǽE 3ި8B=6|ڢ[4njMOɇ٦]촻u?Z!%ܿ8JĉM%!qŏ^v]`TͶ9o;E RvI}Uߵ~uQ/MU~U~nF_h=;5>Jk;t> -_ѹEÌה^//>C(p5 ^x ߏ_?swZ>_M߮9.u 98 eO~Y\(5*.r̗u|iSQܫჅv"eiPC3dKY\*ozzsWzƻZMa;ʧvrzI_tT9G6|_t BHxrwI{H^P-ٔC-^rgD?z]Qyg҆_BY+A)DdPj0s{0>*`;]lxeN"j'=-07yɡoc Ëg6Ywُ8C3^ԃcfr3i쩰om}ePCgH8kgm)>,uûYN yB^]ԸfzH=~i ƔVЍOÞ^2/l:oACݮ;3(`*G\x-ﲂ0CIϿ6k~Vis 9>Ș|Rޱzv& N5_w{~$dE,U/~v>3Kzhu:ɣnendstream -endobj -1476 0 obj<>/XObject<<>>>>/Annots 102 0 R>>endobj -1477 0 obj<>stream -x[]s[ } ~KGVV-e܇t(C!8= Dz-9mg^ `ثߟYY̪6ϟ?o7Y[<"Yvyy֯{7yVTUlН8U!v(XJ62,{`#W^JzLiX)m+s${h8mJft`⊼1us`}XY az l`бAA%N$0u"W54/gpTKX!R11lUc0tZ>6%9Ty6 -D1غ lZsFY0r 1`#FzC+%>Mǿ9ЧCr3WA̙7l#z ')T[K0HΩ㘑)8IA al*` : et:a$D福B,'99gs(1ZUV3##CrbҪKz -aYa{d3sP%Yk:kTF⊢/IzLY.0XHc]BS788[ĝsP;Lqz :L벤IU݈K@:d7cӧ^3 Hˆ̜z vkfJ?f,2*U+i3)972E^"rzbApt׎3{]8ԟKs:HEdt"UC) @og3kAp83Hpq-T>SH HgCC) 83%prN 8$3(gb~A_ - 8CAprqA!'4N,YuN1%fzėj6=~J+Q9=tv1]\EoDNlPp0AVoy6 Ӓlg.i1u/Vwǣj9EY+֫JMZ>jyD\TeA1qf'ѻRP(4Rr+T֌$=h%+q{qJ^sq)/ۦY~y'<R:H)zRd1/{1~mnrm܊ɖI&{Ujg8xBwE~'| -F){uҼYAKs[5%W.c|OVz,J9LH(//y +qhjyTSF pEY4{6gP0Mk:{]jDJ.,UJ 5AWy{lPZN4c}hޜ9&74;tO>ͦӣ6h͒Zj},N~ﺯ -g|y)j͙v4\Y0ghu:R{/0׭px펕:tݳwo0ه?RIlMl?gp*v]^':(ah_wY$/DŏչG<6Ǵ/e'%Oйî}j\OыN>⻤(n kz3[G `!Jwukz*m2*{6N1T>ash?eh2(\v E>΢l49JoqjK sv06 (mqU0Рׯv4)m*t}>av7wדoS~V䇣qMdr1}𺆞*>U/]T|{v۲Yz}siq-uw< pJ͖ -?5:ԩLރˆnX,=§zv`jc;V޿>ϓ<$_CI>؛|ZMnpl^3//syfiVEϰx&WAvξ?t5:&&%;w]ts- mW?%ۃO`g/7%?lFw%fCb~7؆ǷKF&BWzxO"endstream -endobj -1478 0 obj<>/XObject<<>>>>/Annots 145 0 R>>endobj -1479 0 obj<>stream -x\v+f,aޘENQv,:Aaϭ; ˒ %>֝骮WGy6?yYdh'!OeVv<#ˬ8lR -GpuhBe{1r<l#k+ױYǖƄY@F(QIAYn)r@& μjF * -יd Kޫ#6h7uA2J^j$cVb E4౤U>6, aABNX_RdbqT%,K鬾@0 ^3$cL \mC -|ȖǙ1-aZشoVO۝$B2VOEQǜYA2ROE1P_sN2f0XMwi,a1Ie S0K,;KF%0 2ff 3ZBxq,q1a)`a(퉜&_qe{rظ"P`JYPb^e tX`c $Yb#0){/cx1% (%Gt6;q$H\D.xd,[ X`Qcmb`!e$KX6H*6gGLȚCQp栊\(pUD.U`IF2Ƃ ;KX,aXT!X`aFKXnY`̄U61v,llPZWJ\C21u0X,Y`'М% aBl"2ak -sD / QI)FzБdX9Pq!d%$M$(H -б2,iCDgEk![9AP}P(5 -D25IKէe .'f,cmK,aQZ"PEM% Ec%8V49ީ@CԱ2# %@Qp`ѓHiRo%  *~g Cle >, I]"L8X1D51X/JT - 08Rg,Y MuO -Agի#s$B,L>2!e0(@`k"( ccsT^$9X$ -d|8@b!8\C0~$NG2k? E0 -Ʃ9L;qARIZC\Z9h4"G_ /g7ZqV^uru& 2g|-D&.zꏐ|WGSm]t#oɓe6=J'e/B*ܼ4xtյ, 8v)h!@)BvwRBQLBmWYCqRӉ:6} f,_=og߮jƅݾIBI|6x@Pt6wQ:5{{c,tKZ1.&ET Fַo]7u$?m>4`Q6Qִ){UŇv2$[ԇd^!Jb{+=)p 7%LLljH }/RN%41OA4Z 7|EhLɎ-Ґ fjXh|/c/$ )b_Ȗ6> zi/AD8ZZOq͝OVrDU qLd9q[>+7n ")TJ"wme~$E%.!F w/ ->ж9CobС_m3/qHv/\iȷ:žbFWӷhpN>mĻ'Jv@3OC|w8jFL -wڒ ٘Q ElMBĞ+' t bos~84?cB2"ieW1{*UXl#X(}5mXrkt|UrS2Ϯ%uC>^ߧЎĬq(з}~v9@5؍{u41O3X^h k>XL76軬>f4hL:Kr ;T6a2M '|tqi| ?NC$Y -q7'IEv}A.Q:[y7^{i\ڬ~?8mݸ7 -B *KTk[)48bg 0ro:~m\>KkQ)ڡz9hdvwLq'[қ#G[R]/a~+Uf <|PɫO~[5N[,_>ףmǚendstream -endobj -1480 0 obj<>/XObject<<>>>>/Annots 190 0 R>>endobj -1481 0 obj<>stream -x[s ~_q}Hg*{謹qNQ-yҙN(JJ xM%L.XB6ƿ!k򬨳x4/_eVtmveVUq.QHEo`c^f9f"y (zz iU7Rc,Qr'UQT S h^Y75AnT8cs,]Z-4!{baWY:-6rmI)Jz[jli7)KX90qq9W: [ Yyl`=up1Xmo` -: {Ry a|1Xv=ǒsVug)@4q!NG4Ű tVJf*ЊYds{֌*7AW$dBN&4eHÈaӰ 1LS"|)h5/Fz 0O4}26r!4PI1mUТ:LvűO -) X&Hv``G.HX$&uh~7a uԡ3cp$/Nԉ\K%=H8Ұm}aRoC`D3{ jHcPqÔSrxb&L``\5Pɨ`i΍uLAg%J<$G}$AL`)XRBp9:Uaz%=ƴp,j`X^(£袉dbǤK]0ؖ::LAG"RKg0.a %=Ƣ0؆~+68Ң lEPc -c&;`,;YwR'@%$ G8w0i#Jr'#EMܶ C0aJ6TYY4Ha/2E#'\(1-XI$r{:Lla( +PcL[X6T;alu,LX5yeuNwVG\dFz -gc&e;cecEFJ(HƊHi,\`VEXݝcEH cC#=ƴ,,ѳ(u9[4rK5]zuqrmLl3i#eWc҅ eZ;g@b9.s٪YXlN1X,ge.дb WFA*;C8$=ō`ᖥg"fU,K00U"uz9%Qvx"1آDo@#fSGN 6Pc%k$%?7aI](ˁB p8@$~m0EiulK硱b#Ul;E&qbR8uHI dl`E=ۅR nc=9{`0+mX%rK(( S  euԡ:XI9a"3:83Gu*1拢 ,R=\:  2TKLlB -,"(++ 8ǥ tq^lAp8D_9 1ApǛd1VO .RhSlFnE֓ "DB(ՉϺPdpw1p /RC2ARџ8j!D9 rշoq+ xjM]̸ӏ\L.o*{^m/~(YQ'qINþy}37 9%$o~C2J`nX]n|=7koWk3ovm3zit+(eZs -7_2ٗZfUʻdt]W4 AWVk-RX)S` L(y;,/'4iү+Pn zZhzu=dU7{{;mږӡW''oS2>|Mޙܤ D#_]r4EКhmc;* 4);~юXTY5mt__qD{lvq;'Q3Sz/g$ޢJl7syʼnN.QQG,phPC;GG&.c -j7,2_ht$)?sV"1|ϭE<%s3Jɯ`6ݭ7Řc"s0;"Gz&HS_'WmNL4z+^(z㴐g#hwpR;mϩx[|Z8o>Bf0pHUPo5)? ʄCG -duz:yH?Y=?󯧲%r@bтv -5Z`[^bfk -P.t!UI}>9bbozfiO0&2UHE&vZ =,bA^4Agv%f(jӳy}8a_*hE50OVg8gE!u6d8\p^!|wtd쪲EhXh5w^DvY:|5;GfCx Mx3aQFXZ~(04%9" {l {ʁ>z -X%mzQ3C)oMZC8u&)@a~78HA|y7cZo8Lm}Fv|?&H5GE3/\ixCTt,Nx_a7(jsě:h[Y˒$Zm.% EN.|ʹ0+Q#aIK\#fL丙<9zW&şh():}w!c:JmI4|i3ɦbN܂x'hXc}ɪ]mԹ[ v}Ik| qp7loWJ.)uZFeKQ"iKd%jlj\8F;U3 tn7_3yxWDŸ{vax)XNkU!]:lf@-ߧ?aMZV/'Q 7n';i\'sR_X cEU6RWU(rf7=BmPq -5QPDiЗ_:nR}ֵ$Q}W:owMl5!7'a.&޴q冿ᢅU3vE/HbHcdS aJpM݌G;bDrR[lTv*Ays|aGj{zO(af^ G'O}QEqk{7۹~1ԍ>f?кY -oФzǿHW'q W|Z-RN[)Z?o)fthxi봟>7*@TkCzW.K|;޳'h}{\ҍhfoe<!4zHendstream -endobj -1482 0 obj<>/XObject<<>>>>/Annots 235 0 R>>endobj -1483 0 obj<>stream -x[[w8~ϯC\SKz˶}UlԶ2$3@tIΜ'Iv1wI&$.Oƣ1I2kLzUf?`R5f?'=`1i4aAs^%-&R4c1 $RevI8QDbaXbm[ؠxi -qPϹHZnkE,VԼePqP9L`JZA ϰ-J45,,ybY!p:+Du s0ẼH9vKdLɛM1p΍I~H©4ը`0KVta7\NήPRl\^$() ǙYn{LIixG`%ؖ6Ǽd<hP9,J$aI%gzN"IY?P;>gQ 0IixD,|䉬`ٱDVȾ #\+i1ut`ΞʠinAsEQbt,k0 Jn ]Y { .7(j:*s D9/iWȕnNŤ'ٌa  V, -ހUРḂu\ `+|`xUuXBbψ"k0 pdeuf {v0HQ2b|`Xr SVND6(D> Tq"k0r`bXI\ k0g^{er -:2 23PQ+[ze"+VLdEߖr(TDemnE,qϻn!"| -؉J}܈sUF+:wnwNjd=z#Sgr$ -t[RqJ.e-ع੺u355Au~:tߓz6[x8sR#"Z X xT. j)M{i(Y1o;xes&NƁRW:¯6uTd!r"b|Ŏ yO&wX/|˻0{;/H{dP%`Jo%y`y:|/"zQDg˻uw/!=IVb5"t9)<كi7 M+zEyKH2=%6vYQ/=r-VC!$K£V2>>y").BdM6n-3J"D|KGz"@nF_Od"^bn7b1SG:Dу} ^z7W$MXͪ -TB`P6=$TǗ2T]ԋb+것f=DK}2rz ^63XA$ynό M) .+ ;cMQ|5㼄BXuhAHxYˋH*|QҚUOǃt)n߸I7/ޓLT 5Y|u_'m0V 1l;qv6We۳{s/5|q݅O4}⹋.Bo&XF8]<2AeW|C;+ /LNqM_'L]endstream -endobj -1484 0 obj<>/XObject<<>>>>/Annots 278 0 R>>endobj -1485 0 obj<>stream -x[rG}WV]~yR䵣ʃ_HbBr!e;@wCk%7r̙F7h4=I?4hzOc< {IO2o*ʚi2xb**ii8WQOk"=PHlVYyZjzE^$@QC eBQ8!4!Ehܠ@:N@ZN $ -rBhMH 53R)͸dlxJ٤Hʱ}6N3edkCV11`|$X&(T00Na -ԐɼX8'&Clr-;~לfuj B*i1a`EBKUZ q t [%4ؘ 2PKHn#" ='3~eU@b9NxΉ7bզTrh!/P@,MZ*0!Ee@p\p@JC,rq5yrb4qM -Be1v"e%1d3B 4h R̚]@s܇rZ9r "PR:VC!2'=@aC׎Ieis44;1 8V@$&Sb4.,0/̼$2$@(+D LH6dqG И%-p^ F-^E)$cC2L tCԃo@nWWbД6 x@=BEY)['e@Xʱ@HI>-2 -A{ϱI;t1eWc 0"45B@:(KL>2v# `x#Vb0MKe5Wi]:p%B*~9Jr&c8貶`a̰8I)6{ksq|;D,SCZ }E`VŤIinyi9Oe+xorC,: (sLXDZ53BgmȦN%2 !6n:ϏX"a`(U5"!;`‰db%[ ִ5R$[ hGe1<͆`1[ LnLlXWQSf`1*/ɲU۲a0} =+V`zeZYL:S++X -)b ^`L2XǰEY A |ְ~ Sdzەeӣ}8 `x$Xze%®HS)$1BpHl;doС?47)$kfv -!7:MhFL N!8̦m<` 8E?p0sB<0r,@HF9br6LO+)$62:8@)br -5r -1)pv@p$3&:ƉGa4;FN2SD)IIc!)ZsLb @)RGh),#eGsXBՅCŁ -cFm)N!8t2bU 8I:/ຘ[;;(9h@$%)Dg@pX,ȣ$Gpqty͊*.\㲋_ovBNՄ &)5{zvmޡ̟)=Ce?hW[~E?~XYGʻiZ;scsݣT5A!]JSjXlYBrT~!<~LNÚ`)WUU=bٳ)MY:Ζ o">u}( +U!+zx-ͽٶ'q?_o~~?.55QvTh;3ICH҃ZҨHtsRqt -@ vA{\ՇvY(6fhl.p*[9/ሩ:A=mDA1 !d^/s\%Q>^E|o4ְ4<{'S{ܶ$)޼[8q |F}Qfh>x 2<~~ w -C.dz1 !æ ʤusl f*Y]xWSn*ypR;NjfFUe(:2ɗD Q(Q9)$%;KpNJdxrRݧHuQB;6{ÑRS}qTtwwz":V)MXL}}?[_\p} {}Y_H -.ٔl73v՗W Ǿ~sKjl༊nU&6:Fq|sXskR[ϼZÆRauGwM-dvMCFX yѬ__/nG OA\lU; -\]SoٮQޠp:ryG/+LX[Nj*]:^nFق80~Vvf><]rB -鷳҇gש/VA7%t0B2Lct{y5$rɀP3_, |R5=L?>vPUo;ofS7lP)05q !+*ǯo>OY #dkvUįDw=}Xw(x9Pb -+t>,0W$?'s%u>ï3BoF6ߪːml -4ށvչoWP/ä#߼^ 8 u^qx7|h-[gJ8BU1˳'|[EͶFkzWo,M<wN>B拂gNCjnDqy`>n `>|n6moPZ|t> ӬO*0 -c1> 火+6Ԛ/u%'v;yύC/|&K48}iF~A=g+͉\de[TqC}Z|'~endstream -endobj -1486 0 obj<>/XObject<<>>>>/Annots 317 0 R>>endobj -1487 0 obj<>stream -x[KsW΁}?rIT*d3&lA}Е(ʪRog1=.$ß bȉX#=آX: )l: kcSKnz%h]a8h9,9SZʜԁm) f` \a9Ƒܳӂh`auI~_ɸXSuqf`'{HڊP%ij%c++[,,<^.:pyFNO0&ބuDzX,)b]GdcWd|e=(~1a5%:: c"+y;I20SB9L^ӂ (ˑTi@Sr|DRU16$ֱ}[Ʊ -ұ(mǨe cقU` -P FۭIs,HHT0ؚٱ!d>kq%)1V3l`{uceR?pc6iਜI6cM6cD$ʔu.Gt,Rrh* %(rZ- 2ek#HW ,G[j*Yg_N:0r94"݊ϒ 6y j#EhKArKbsB *PFPMFg`B']]Ǵ֚L -5""P8aX~XYpE3hEjzV(0I!$㐌\` Yf EmCEL}30-'j$,sQ2ڭ``%c 0 -4A( &yd 20 bX*+bP=G Ll%=VʊBUњ \*VY``b(鱊UVĢ -1Jzbe6hb#'b85VĶ`ms&6pAXeE,R6QgM%pAXeEl%LGq3TlQ;ƊXs2.Qc,ozK u"cQ"q&PSI2bXz뻋w$.m?M>/p |Wa4u]4Ǜnw!\ 1' _ŧ8vE;D"6<_m.raKG"k-3,>1*N~3Y$: -"b ឞ}^W'a3c!,0YWi)>R(QO>~")Rj#MXd񫰦q3dM{8u7vz6| W?[8r_Cԇ.NQe+i1&ǖ}pEzAOܮ3[ diRNBB}O|ˡw:K1+ ۫__]d-8-#U:_l\\~;%.ZM Fzfn1iIn;=A\GnӢh|Ƶϥ-UtHyjӲ[ʾӨdތu 4O.!P[0cm)kIbW"'Srm+t8e5Zw i@ݙl&*W)ky= -~wtfT\>ESݮ>K㋰O:H܉G|{sp젣aŞ=b=m%4Ö:T8a_-qYO(LP7bNG؂KFsQsuu9j6Qv>M6nb`۰=u?i˅ktv>^.:kDžk~:j4^w>oeOBb44?$jmIG=8sgURD3V{Ġ%a9/% -(*2i Q =yçK|"NcG]vCpFDW{7:RuC2ԯrV8kTO!lV-m5\G"b34tuwk`oŖk".yPkuwTXq`n#9zQMڬuaaοoM4wqLP bu &xSK/;TB' -B!^ 9!.S -Rm|r켨_ } -_-b(m=$lOfo:A~5oD6;cp麑>bɧ[:,)+|'ۿ=w -e?$ybi30ݯc\+>/XObject<<>>>>>>endobj -1489 0 obj<>stream +1472 0 obj<>/XObject<<>>>>/Annots 59 0 R>>endobj +1473 0 obj<>stream +x[rG}WLe=>mɖUUb'&,$Gˋ/@7!-9l%U.9FG}%)ϒ&O:.Ow?ӓ.wA"=sp4uspdU6|Ú:-ANj@:i>:Iʔ(Ԏ-XFsШQ`H5b dIŀ(%B4K .Km2ik8!f61,%[dO:L-h Urbp N9\ex!`_: vc0M7"(p+1A$e/ÔgiѻA4 +44cf۱m +бgiE&R,GJʺdd PEHX~;5i 1XeYbMڱǢgY19 τl^u,/Nc<%3D9q%M6l0XUud[e +lp)8^9U%2eV4:{2/:L)1[c~c?״gVkc+Xis2K ( lP7ADu9(;ɉ,6`c1? ī(#axƀ׹A4L[ZJzL"Q7cR1l!IVv,w+(9vKxQu9A,RYKk0/uh`!tr`[J1rm=[ryUk' 9a-I4,+vy5 5W9(H1XdWz ɱ}cYk1زI1Xh;$8aX=cֵ͍#p1z Ag ++EALlzP"d+lC~9Á!-YcO,Tۂ8]9*ʉ*]]IUcEQlP%mHz qs(TY₁)8L9ʉ]es|mAr1AHsCz 㷮`jzm4m pKcr +,bc`>4Z["Rn!4g`$dDZiFz aX0sܰ7i|Ĭi;/#$ie`8zCR1:3@U7YVn5 r +SAHY6쐊rȑAJ?/[5a{̜ڊHfJr )pAFNȊ:A3 +aֱǴXxj[vu~4*8 S4cm-ʐ8qeːCuDXc􉕥Gˬv}vHuS)~ A3rfoL +HY.'Ui.4TRb"IC0pG\$cȃ 0!>Ȫ<&!WЦ#6uPOs(v<@)9H*n:pL/g|k 6''+⁡9*rؑS$i vI ӧ z *H`24J9K];ljq!k ‡ +[ raI`nT"ǃAPu& $2ApHqV BE9awX\i8 +:?aXHQHX.L$x#T`Æ>sRG݋篑UaV{ F±OryaW)7 {Ti!OƇL[?8]̑(zcJH?!wozIXP 2.?Yc*X&pq}!|EtjY1<[-~;zS,m0.K2LMnm9 eWf'j`qK.& Q[#ob6pѭ?4@ +})'TbW㌦-n3|Qs$J/CL- +S,]>545d*qO?kRuhwsb6yXw6@8 'ϩ_T`ԹwK~nu"ɝ=ͯW!rk1=Hfb:o&uߢ ֖41qJؑBbPkv[)ݠ̱l&vՃnWEi "lH(5O f:mw;UEڨڰ"u]j.cߏH**zK' ?-$RX}ULNW֟ )Vz'Lp"s<lKM+ +jfA`ʋDo`ba?`S4u o=`гi|<9HuΤ|oގY\* +T<'n-ۿ"J֗?cO&65]wn-@e;U$U;{H"hJ{lN>B{Q ^xd15~uq?N}eUY\u(5z5Nmf[_ILQAo Q +OPd)Yx|{Tj`y-!ę]8v@]=ϼ|YQs)cⓖjyL֑fon!ҥ_NIrS +j 墽I9V98|5Wpr=瞨Ri_BYjbwK[]'Kp`6;a|U}K\pCy@Slz3[r*frV߽~a3HKumOS94;P0 }3$M0z唣1ppVo8i>DlO_0&g3S$Nk$g1M)ǍyIdd"CW1v;7ӛߨJ@{0mѧpCjfs;' "n]8J8-{yo>. cxϓmWwZ5V>_+y;רZ8כzws.H</Gb273[r[ +XIҤClN?N-Uendstream +endobj +1474 0 obj<>/XObject<<>>>>/Annots 102 0 R>>endobj +1475 0 obj<>stream +x[rG}WLSA܇/[YoEY'RJĄt7!)˒7yL_@h'E"ʬjI>D;>ںǟGE쉃GcUVTՀl7t[Nՠ ,GM/Fj+QvvbRVy?k;SC;aJَJʠMχq蠉cUfdh8D["W#F;c>o: c^e%Vq`lߏzq^`D(j\^.c8TcƔ1``Jwv<oӴbbPW٘mn!H/l1غ +*V| vodhXX7OIn&\iT—tr2WA7FrD)Bt]R8q] H1ulXb먱t:7٫HA,eʆ! `CFG]f`&dMÐ0 dK 0rr1TRS H\Q#=\!0XƵuU]!s +c:8;W:a;h 9șr\#=L,yCL,ALf9.kGzRiSkAu#'@&]EK샀Hznagm&`F[6TcZsJ: aW6 )H*\Q WJzAԚsPFcà2aP6hPct[90ؠSeeвwW:h +i$1%e?'qt5v;$1& OTxaE8[[9aIz 9πuq$h9RE1a cH;aȞ #=; qubc=RW\^hnιFҋL 4g,Ie0!xPu!tXDP`fE9):UcW`ŧEl}&<`f/V7rѕ"n*1k0!*l Gq5NAZƔbz m=q`ږ) oZ01e$m$}QWK)x &TeW`f_:1ApXV{LGrPN:l9R,T~k Ri4(2%19 v٠6r鰈bq&9H tAp.y@AA Oe5 c>jAp( Ghgsi;)8]qQAX_$N5k)Y~Y0_ 8BL Rp#K!9B6 rQ{~+%DgR7wy^lֻzw_ +.`^4;)W݀@'ojGh,nWb}ٮ&f͗1K fzG +bh^n~.˴#/' l?w:$Q~r}f;gCӵQo}QGt^a&@ebR7{|ݏ1{K[S\s w]JX҆[o'ff_pFu앶ɇLTf%}ԲȖbh_Ƭ;8ٱ͒o;Ƕdr!KcXQ@E^AK^る1n\Z: +J1Uh'ehń^ﶛqj_HԪ)Ip[†&q?lVpV4*3$=o!o&⪲J 72g0Rb76&`jol+R&Ɲ0T4NJ>ol6=f:8jnȨ#f\|VyYi㈝RfA~%H}ۤf+ZU/6sk.Zz.JK|Wo{#5?(@HE#Ԍw|m6$;ϧJj$m<xz\hiՐZo_ P|܊#~bZq~2_v.!ffXU|yލ;қq>:>m\yBK|VlP+i$SrE +_{H&*G{ogQaE8CX A>&ePK=[},oGb[?BLRu]~yKqmJǸ:~_?Yفz KmÃy EÖeOns ~f$^#ɧ$!MH;.aBjp!z!zzLo^HYz>g">tmO_'_Ȳgj|=;})/.{Vt[!`Ut/'?>P6endstream +endobj +1476 0 obj<>/XObject<<>>>>/Annots 144 0 R>>endobj +1477 0 obj<>stream +x[]w }c CO?=u^)JRQ{/0`IQPiiurf bЖq3-#|{~4U]ݰHzp,I=,Cz #/e ǡ> یUl04وVpڎi\# Qhvl?$ T64l12FL#6TـiDـaQ*bd؅#G41Xl7i1L\t=VM\L,MO\0"1.@p s!_Ȉi3nM#; SC l`!+Ԩ%qKpTr֌, ll`KqRge/u6`m7`8TXۈuO*QʬS6s]8 ¢j1X8Yـ'0w1ؚ>؀[ tDgcbj*16sT 0X$v]KQe $1x91mE؀^ۀUVp]RT@$Jfn \ɈM&eҘEű +T1He@S 22 Z&+lU`bD Am\흌lUqHk1Icu -FK@$(DClOȈ9X3ie-LV z5.@+̸1 6i#+T 180pL`{'#搌-?t%L|8HQ!X6$RdNBsHDNBsBNF 쨿Fq"l`,,mfa&g#rRZv̈-+-IKy 291Xq S q㈩ꄆp6`l`˖`mUU\IT +Źi5d24b6`]IE "%l`nƞ&"G1:\ZU Tpo(}DiاPJX)Y +L6.@Į2 EavRfy<.E)ei];':+JNFLRP9ۖ)0?gփ2@4rFFAy l`! 넻j#x̗E(q<鎿MƠ"+.0QMi9'R ؀ ù:(g:*M\Ȉ9(]t6`0fꠍ&:4q2FF.J +,ol\<8" +:INJ6v;_7L$:n MMSIb:tw+q(WtqVi?SZGCDZlW:ڰ+_]׈Ci*-%N%+|^i_Cn1Sٱ5Jv49[* +1'ta!BÕHuM3oe ^DZs{~8vyPg>'h/};&gߌ)V+K7Ve0:ຯ*VQKV ~vӖl N5r}??SD>tѽ_?mU<^{;c?E%cw*0OWʍ^;>,qSs#޾ӽ ^l{]>g'9$\IIvX|6o4Y›[ؚx{KJ޿$n&QMnCλ_x+Qb~3Z3?#-ct_Dߚun,UH;x\LWëj6Ɋ8]&L|¿#nn72jjXe2_ǀS;tXכ.Y7z}o ^xQsmsVs|at:rf{im*8_O}ڦ`ym(N7ӵTQw.gv͊}4Et#wH1='9d%7Y-E)]A?.lݮkf%;mUI Iju<O+>/XObject<<>>>>/Annots 189 0 R>>endobj +1479 0 obj<>stream +x[MsW!*w{O)Zl,RR9HM`|ο^,$Q%]eۙYKR:K*^O@OhUSmrURp3p<6lei ς4 T3}F`FT`U:-,k*3 Z V4U`uCV` ,QL36UҦڿHPMrCZ 6/ayȲ R@2pΥVI™ZnݏE/hk +̚rS3`y +ŘSYr<z堜dS>dy14ɸaBhC9Q ]&19 5+JZLfu%wD@nhsݖ9 4(ELs Z ֶ,p%A\DIJ$e:d  G7M#YDfGu:sxI! *k0Xk0SM[!`e-[֤NbuIfT`G0"ˇesIB`eYV ik0⹲Z8'D2p@EH/g ::`R0dl*Vɬ + + Gbt w VYCsLHZLԤEV`ZyadE$`"yΥ"lI1hq mDyK_@4p2*mX(N7:,p4Hbw^S 2Pi= +2ɽrC;g ='鄒CZLaB"Ӗɑ.gzNYI1hQcv k0DnoX-l[Q(n@ly$-F#5lMa %Ӷ)4+k1آ"omE'G?UsqV)+`RѶΰ"RJ(s^HZERVD +mRe F[ݰadY [I@)p.%?TbtY`Fʠ dP:ȗ*l&[UaJ閁v9/{$-&](e%sfW4NPrkvMMNX/|PIb)G,1n DCĕΤm蹆2 3pfDDIɊM- ͕5>%ʊ*9Td Tq^i8$6l^ N`(9L2'xDT@tV`P/bkXI +~5rG}% ErШn g "b t*k0؆CeFF <ҁ6` :S@Z Iر`[7`@J``PF!dz4.s6X"0P>`PVYIԡa UubϢ4'|Z;ϝ98A#i1惢a PWӶE&SY`RmK"~9r"P9I +LJZ 9*2d\\Yibho3`oacǤ*k05++`Kvؖžw\Ȟ"M"m3iE!F߱gP*QccKB5PCr*i8&b)s ߾C!.׈2vȱ8:Qv4"HAstA7;CˮPa9CI +C;)mŷˤĚE.WxvW~[wۿ^VMG&$f߼z'C'o`)=CXO~;~94Vn}MqF_)2.hdq]C]azakAkvviU٢6~\: *}瘫Y}5[Ϯ&,xݠQ7~M|uI +1I"GnQ9(bF%atfH4K#'n%Å!^<S΋.yDtWHMwr$LH#4Lu=cJ@$*L?r`F9B~6]9?F 74dڱ9'xrrćW|v.q=zÁ09pcPgr4"P7,GNJ"Bx~S'%Lgz¯W?QִƧ% iӸMRJ3M`>j5bQ'Ԥlѓ(GL^bq3_rG 3kS;zƇtY a++$Zih*) `ӳ<(LgY(qGwwR,_7]֦/(l-\hnFySi5GɁ_yowMw.Ƣ,tA"/7orz1ԭv羐;bp,/Ģ9*9d;Rrv0VK1DqD4廳sRhE>OsiIbSwyf.exNc6nvjUEC6W?!2,'RN]h"ٗQe trqz"JoTޭ먨OkO_{ؤ_. pq([_p%ֲ# X/YZGty1>&pOO2^7_k2I +&b˘'3ǑADA0Oݪ 5c$,M렪%PЊIbk>[HH(cn^< X=p)nO ңG(f7)|W~K7 .meǽ+siN2LI~r].|V }~4DlPdmneѣNڞI'IM%Ljn]uQ.~{B\.w/%fi+#'#w?!>a5t?]p>R>#&ǟe &y.P4=ϓP +MQ[*ς^\X_29mn7bs{^ +z*۸:xAWbn+jĵO)/iMF9{9#[}QZ_jnǐnz7BQZ|\;N7l#qloVO/QDn(ͤWW>ت1_un;7ߝ.䴟WŻ.)NHbzwOŋ?kQendstream +endobj +1480 0 obj<>/XObject<<>>>>/Annots 234 0 R>>endobj +1481 0 obj<>stream +x[v[7}W΃4+I5ʲt\]č3V}H  5yVdd8KV#sA*;}GXK2r,[h+s.jąaIDzLʒ'9aMga}"6Cu͂(cP#Wc&(/5V'% lȅ3ct0[8V̫ d&5%=FXnE4{)XHD9Y^Q %!B`#I}j1HcԵ: 5kk8IfhTѐ]HcI2h#ɪ\\e[:LᇎulKX NcYDUAtZҴ)"MGd`F.ꥤǤ'X"#ea +]hP-$c4`:aب: :P1Xgֶba(∅#7 +XrB\3(`Xb!ul3( Lȉ|9*ō-RdhZ:Liެð=7eE!`2 Lȉ9(-2Ɗ2uX1Vmeϕeeg&QLF )1XEx*<0XʳE(þa`DNWAt*(12';0XY`c#a[SC0 qDĐ"ȱ@m+qY' lVe,ehO5D@kDSDݏ?vb` +1ul[4V L2{ r,CGɱDpr2T&3MxKR ' + +o,f*L/v <|>]N9́&lq}qhj +xEIExno]m>~EKSl1׳=\,_qb!]~VP֧J'T\꘯'/×RB˳ΌsI5"q@Y%~\ڣpx)u +WIuPu*`Vb_]ϡ&Af,"l_>ny!S +ԘU ;yX/reMḛ{i@v-n?}=O;%0t• Q[#`7MWS;" a'^N*?_!5Uugk~V­ +Av)C߷^V +yI\Kr7SBk:(|?)%]R?HJ/$ˣ7$3-+v<ݽT igiZx:ksx"JV2EQؼDH%͝-(Aua.o7KI5f#bu@a+ɔa)|h*#q֟Nד;Gtw)nC;2`#&[רFm$Ar8qKUrsn;%{I3v/bJDZ9 +*bo-~gѕOp{lr4^9ُ$HLGMqԸi +C'T;!.v2³OJz8Zy x׊i> y.|c[ݬqoޜ|9(Nﴲ~q Q nN*o5ُIq_d}mw/yBDWۮɜ=^.{n!CQ., ɣY,f3Jq7f-GUί (-Η(FBMFi4M ~ʭ ~Ͽ&"WN$ U_ǽU\iLuYz`sp'U}ݞ)CK[Jǝ^u&5Vf:iY{BDӪVmL4xPrvDp{=jiHF$z$zFߜ1UW UHڜ#Xtjp[$څ7Yx[xak:bvI"V@Nۤ{p^'_Ob7dCud/uxNO"Qk׍s砺wCB5ŅWϯ5“aVVkͥ'ZZ_? sdzkI2í";*;1ɄvP4/YFWr3 M/Zw6bەS% [,*ݯ`rd'Ы?{a|Onwx]4*d q3N1}|1DR( *(ILcˊu'2ffBJ\ ߼ǻihVtQ'$nX<½3G<`n9AmX7\xWa}TݺSL~EA1xu gf+{M6@\ehf87b_ȋu?Oi|endstream +endobj +1482 0 obj<>/XObject<<>>>>/Annots 277 0 R>>endobj +1483 0 obj<>stream +x[KGϯ bGtOaY& .02z,i/3*52wkG>}Gee=%)wI%yV'$7oh*ۉ`LO \%e9 g*qi1 i1جԖ5lՎ44PrЀ DC7K"Kne2Іs+1m'M,T!*$%ݨŤd5xd.%SҤl+k";%CGڰ<4d =\F]D,+6{]3r]:BgH6yYQd9 <Ulm蹦?$@&mh4K"-Be1faEGM<'#5$4i)+]9sG \%m9YF@#m +{P@ߡrah2 +@%-p +ra &QV[Z\ZÂJZLZK>M H*~(3$pp$S^9 N@9*Q@ 4MIby5`z$b%HݣdlFc e"NHmJZ B) oPG!qܬ,3 %;K9vV0&Q@eh%-QcD v hJJâPhCϱ3h)URfМ +( PuREpP"# Eh*eB=W7ve o/~#t?F+>cm%~lia؛>=K>ngݚͼՏ`; +4 mP`'\R|n6{ԝizѷ8NC:8Vck[3Db 7vW9"u=]wI'恫a#+ЕQHB3kbkӆz3=)5D='AQGMRaeXV7ﺙ6zY[eE.AOQ=s$W\3 yS\~2TqX?_8N +[eW^8mn×~;U J^85 w6՞7<$O'o[t ⵱W IKfx^̆yfKՋC=n~uEF{$.F-67c罾$C`®̌8P[ss7bhPUOZ#|Mp*cUm(Hi3Rd ֊>= +?Eoຳ~=_|)Ե98p匃;MLYBTCgcr%tج,Tetވa] ^ܫk1_(8v}r9٫sc-9 +^Bl=\ #i욽jOn Zy^y?3hb}#ޱ/ 6Ӌ 'M8Ϯsc\q^ts;ѓL ?\Oo7XZw;%ٕv/#q蕲)Mo& *zp1pYƉVXf/T(8 [;+oe3g tܫQ􊫼CF[3;q8^O +؅pbZP?]P6ukIJl'S_ciԅ[IylX[8JCX?>kuGxƵ}w1g$B =(c$ue_LQ8F_dyzKV <wc>3z`=ɂݛ{/yW2]ޅWx[6,9lkɥ_u@61WrG9 +$~iyxBYY6xJht ܞ8L[}eĚ#̞43,?-<$!8=B"o45MFw ߸,*n+x{y+ޥZ?o߭l^*Z@\@xńxk2,`+653|^rB'}> aCiС;Ѫ4nY=jV9qmӳg?%/6ïHavBMՅ96:m}˓AD8endstream +endobj +1484 0 obj<>/XObject<<>>>>/Annots 320 0 R>>endobj +1485 0 obj<>stream +x[MsGW-ك˖,>ig"-$G;$ʿ*%rR͛Fh4s%)͒&O:I'~'I]v:)I*:spTդvK'\'YMrGz siJH`nR9EM +Cn:i>›<`IJfdUI9Nڒ84A$*1"(7a{$;Nn`댌ձbNMJ5 bVc2H06'MP8)Ieٜ% #@͉\VdkǤp ;aLX;c=[0XQ-6Q%R಴*%=JزPX:aQ+*oڊ8Y#=Ƥ]XɇP{ H%cye5wzUQ$.9FzL +RcElYp&6pAClN_0ؚ;aCCXv]e 'k!wǹ;kSRzD^h;V@6 +bhnk܅RAE ,!däc+5a/~)Q4 `ݑ 5R6 o u#=%c&?P̱Öl,/LYa+ Ѕ\Ry5cL +Y XTJm[D0)\*cʳ(ѹEi23o"p;~1PHIl(-$ X@RtUcw#c&66: / a8ubJƊyF20 !A*Fz XV 09Ic:mvJe9[0aǺn:b\>Eݮ?ˁa/ +M|s'b 8[c-Ɵ<-7d!nW,fԡi bSfJWRnmqEG%G!~'Rw۸u3\Fĵat_ W<چ5 mN[.=>Zvs8}xw2>^ج>YRvh|?ƟUw/|Z-hYp2Esʃ&ExGny/ $>%"%aA@QeC?Yq/7H. ȐN})p)ݍ6U;' +wɠ~~dg^{]+A9Nģ_A|7|Bǟ4NģchN7?Ar*| #{]CNG ⫡ G +e\m9ݓăMMGOWQ[PU|spiۑ=ܫr%?an?]?u=QX7 -pY+bqǍt +%YϛKg>/XObject<<>>>>>>endobj +1487 0 obj<>stream xA0 g;Gz3Ѹ?@H$"oN^LӤ{k_AR s"MpA[XlDŽf i+A/GBhrPC8$yײm'R?Us跡F.]Ƃ jq?xyƜ;endstream endobj -1490 0 obj<>/XObject<<>>>>/Annots 360 0 R>>endobj -1491 0 obj<>stream -x}YrH+2|9‚rˌdf,RX,"=*rO$ M(+O|'_?AM(O|4Ŗ itvYN2 l &Gj 6w?`gSoX'8" IAXaVŎU|sHª5k"E< VaH(LY+H_HA"0hw`u`g1_XO(YY{XUK0FYq7BI{9wG6d* Pa/$ -ŵfQ@1*i&#^܎6C eZ0 k0sVvwd5fgx* ⍬%E uMBNx`g؊U؏3j 6 -0Oۺk$H¬0BFlcL8UyS*aNQ%3ii 6)~jGRc* kR -jWcU3+±x:Gv;4gR’QokW$ )*̊yf+VaȇUކ<1XEGYk2߶(H܌^>XrdC~b):XYQCiqEV"iVaVqNœw愜* 뜬`FVB -mtyX$1BK 蒩f+SZŨ'F655``c;g)NJEB9e7=9rL2:'* Ocx 8u8m(9=u(r^!մHUJ:KSu=4=z5iztM]ʇMv^7M=hw֥ҴL)f ?kEiZi#ʣ%/kߘ - &{:wp`(Y}&Xu?_^^=f{[ŢwWwKƣ¤@C/?LӼkTI5|2Ei @#$5#ZHl7l*Ӥ="&G`7ߏ =@w]$Pʫ9/y$oɌaurRxY#aT,*nȼH]uF?>$8矰ftUc]uIN,xUۡ8%¬[Yp)_S"K:[\^^K2rx ޘ)ɷ}EpT!n Wؠ3*oW/ʊ1;/94uAqu@-ϫ/q_tyJ[&=xޠaSKWubϳgmK~U.e}Z۬oyX _y =d;}5e*̋hR̬h2Q1U4 -?^-R;X]zXWv4@1yt.8?k2C8 =WE/St9ʀupMiM :x2^PrW7]}ضt -!Ud-\Ҷ}YwM)9>hD8NGsuydpsupԣŗ#b[`zE]os[G 8F1n;)7n`v nD-EZs|ݚ. -ތa(»nMpUxh=3{;7(FF߂'ƑM%)?!">[ƼQ3=4ybk4>osW1.C(.L->/XObject<<>>>>/Annots 414 0 R>>endobj -1493 0 obj<>stream -x[v+)pD~ #Q`ɊgCfxDϷv]g {׾WU~{5JC8Misx5 |\fiF`zAt1b4;kv賆i<&v5 e du]cb0uòxPaV9R}3g cPG"XP5k+ˀEUlT,wdT&$PXLy\1H Ea .'򧰆a9,b -:1\{aI(@ s*a9YN1,`0,W3*a9dk3ueaְݎu ;akɃEְzSXǰLe1, -4;cSKc$@rXQ)`1PAΪ5 xgVtN-c@bc 2gqfǰ )10q$ıu K6}]ǰ=r/Ӭ +ӞUQcUܠGsyCmcg,cGc 2 f&P:tְ3iv Yu89NqIJ ]Xð֞a9Ku LuɼsugHB'++ѻfǰd`Y*8P|{iMV aX޶QE0Xǰ"V&XIЅhv sƤ-9\u$͕pU7S.ѸYq S|eV\ kbKV8ǂvl6jty^L - +Ѻ5 wY6.u,Vl Q:v,}rAF6N_&key;25Yǰ7r0,U: u mflvwyy d^^a w6{ױ;w ݽr^N(Ɔyu ָ4ZR`t=q ơnVeI5 7fc .ݺUa%Vv9D3_-teQ'_2C fafŜ19@l -RE# Zu%* 0lfYfFu9\%I^8,-# =c 8L'{z`X,aXZZ,aX~VFŠCzU6 -HD8^8S=b!. 9E-Į@RAQqR%Ⱃ}1. z=\pLB0p/;MdcÇ B__G{{͏I"m0m2Hjz;V9tc{J6W;w]:U>w۫:rE PӧW処==o:O~UiD?ujLhcJ1OU//316>}q[=o>ҁB?y:wϕK]ס%cRUn6mZZz|9?=SǕӹ߲jk rTw][_T= ~hnjKP;ϑ?*ǪZ7_$TD(}g$8amkzDoҜW|QPF'nUoIfp?kYrr37Uy󥹟Z{_qԇsK%s=Od*3>Uyh>'յ_wc¥MtK4Ǻ͝ڣDXP?MSn?.3t͌<*)Y'џPT~K;&#W>Tmͮ\4L޿?H??'opnnu(cxzlњ}]o_dg8xPxAxg;Nwiwsu6{)z0eRCB}g-eE iÑYٔ>\6<[x Nʋ*N 9_1jnUK:}mTn{ڦ55u&yL*SC*秧iPO !#MzB{ʻ’.'"zxztW{1*i3~?͏Ԭp9͇7:ဴ9(p_/+=sO(7\Nݫ~x\endstream -endobj -1494 0 obj<>/XObject<<>>>>/Annots 466 0 R>>endobj -1495 0 obj<>stream -x}Y]WH}W>˲H!!dc2̫hb[^IJR0s\GW"O䖱K2ޝAL}tVA<;- ֭r 4H\&$q<`I5 :AdYw.3[. 3g%(H$ 6Me 5ˆg]6͐jLlJqg °ONsRVE% e0Exoe&G 15X>5l3OcLű ql0g,g fyxxVGlP:^Zc%$QIA$Sd) GԐsbfj1Bı`S)g &[m \`bcyVEzQU5ʙz`8g (\Z vɍY=+yS%OH4dÊV$QgUhc0Fγ*ASCT Z {" LɼzbrY%gŰ 1%s`Jf`,۩,fb<i=ƲKp, -k0X3\Vj0rфi""i.<72͓XY@- !N1D3`b:pc8J=Fwx8,;J>_0!A]w}[OBXU>pwOe?Gsy#߸peziT6v[JFX~O"I8ÛۗS3do>\_\}l-@nД,8+z+zmW?Ẇ{^+cE~Y]\ f}ܡbӉq[3?_g^Oy $[ޞB#Wendstream -endobj -1496 0 obj<>/XObject<<>>>>/Annots 503 0 R>>endobj -1497 0 obj<>stream -xmXnF}WCyYޞ -iMFJW-&}ܑ̊d0r|>CǿҐ|f"7OI玂0QC˅`* 6NXk8  O5Xa8N* 63Ѭ; -umPq%$A) 6MT&G&I $"̏U(B CTA6YY50{M؍cs0r/P JNG aH8VaY!;6b?>G$A1-`R8l}h.S( p2HbAnd+120}]Ay,H* 8x0if0* bö2Hs -§/̤Ɯ OaX9^b5$PUq3+&2E0XNXcSd*PC6X, t5֐ exb>ffZUAJubU)JXy`՘XҞ4" -4NfD@PsshVu=7|#AR1,F05aC0#Ub@Pٲ`q"d* #+ֆk]E,H*!'\`* ӌ07ֱmYclYcxkO,+Gb֕t<>9w"I7r+N -s8dZrxj"Aְ`e0XWuf|C)]W@7޶k IAf&_䘏E)9n"H) î8UA}AH*̪8֪Ӿ 4yE` ?nxQAVa*tFtUΖ%S$%M"Jʮ )bEj Vuj}&eB -"_Y8˂#qeP#qkƯ:o_4؄b -,]-&x iKwӪ|;xy'*E - Dio4lMb٫Sذe["ߙ e`kƁdnYyq)"Kt?ҟfM!Gշ0Q}׿ s;E:\9mr}(r{,I;3Vs3 R~oadgb/䯃7n幈Gj'TSU7 mg -snAxba3 -1|tC}ʑtaY̽ U,ƾ(%5/ fpo^ǜ쟫?)]endstream -endobj -1498 0 obj<>/XObject<<>>>>>>endobj -1499 0 obj<>stream +1488 0 obj<>/XObject<<>>>>/Annots 363 0 R>>endobj +1489 0 obj<>stream +x}]SJSٜ ,ɟfM[HSEnd[KJr~59w폑Nb7_&KnU }ti4v8%$eM>+d @4J{. NWvX.ŲRpf8*7Ee`f(PX@]H3ӅH,HaYZ,pck0t <#7L' T #8f"X` &aj=m!&'U KB gi#@IEjj0l:k0(mk0t(`Γh{ba, bؙqSLkTQ8nώ&lX9F'5m5ذqT\CF/iGT k mk3ְKc9nZ,!Ox ˀxakpxJvŰDk1T۰n8H,æ [/$KTf*I% ;5XdNe GroK)h=I%A +$&q;mOZ h0ul,s,"TŰc5X2/WD`-MeG +9LHE'ķu,?SE>ycʜE KC,9Xa lrqr` '^{(V:`QJG Kr5.`Z, }THDHƲԅ FR"́$5X+a C`k0:&rbX֒V&%^Qg5D|ٰro!`r Ű!`XN01?^E`ll۳1͡;SJjjYr4dau`ؙ]uVt<`X}Î}r"Eetck0,fD~C`k4^fZY``X:k0p`k@^E@XqLXVd'GE178[>ޔ[ cENԣ@'^Dg,(\ڕd>EDԲNVN.<&{ ~  3P_冖S7 ibE΄Xay <RϪ:i"Sk}1%c7!z;uI#DK偛s\R8sXT:G (x^VoN#PcjFA!fKvIQ[j?ݣ +ֻfH)IMA2X*y}{mu8ǜC4t>r/'Rr˹>UGh_t!˨׫ڎT3ߨƑ~R\F9u6?z,nREj掉$aE)NOmȾ,fki :gVl+LjĆ}NWcUW7n[m +4{}S ;wwE5?#ϒw.VQ/GN=-LLun~]`V_vmew}S?rbԻmvZk;uQ]+X2_6U::xηQER}B @ao~z+|˺yU1V̝&cR1/"in\M.]^Ϗbjw}p;+k?L6fl?d`~KU SzEj!D]s5oNDyEF}ݔ~reK&,~^V]Swd_n˸(Ѷu˚ hs rrӚ-K2XIn7~_Py1eY/ݿ?_fP/Bd-ZHo57/>亦:BZfF;G;}Kԋs^.B#]dl7P>m/oncJkvˤd,M3gSkB ĮC)䇻m2c2̳uM[Eamt:䑎K*8r_!endstream +endobj +1490 0 obj<>/XObject<<>>>>/Annots 417 0 R>>endobj +1491 0 obj<>stream +xZrF|Wc4$pu%qNWgGg1{HHBL +ڧb!\q133 ȿ]dal6d?>tQyX4CV'3څ `9gɺ2gS9_ih;`l++j6Y)+xY>ɄU &3a=b1)l/ YP.3JX j9fcb:Yb Eϊc[0)hU g`KJU @ȺTvReyC.U”je+R͹lb#|ɽ/DlV8 ٲ"[_b]Xa$V0r[d-d+!OKYy6>C`5.W܂d+J#V1yA1mQ@9Z\ `I rH`(aS)6fBV0XD8 db+Q̱6FB6 7H<: sC4uʦb2V)\X`ϐ" +5U  +``A$`Șf颋lO9i,]T'] 8N,kMju#nUtل +*Eq]ŬYŔjld=F[>4ʐMH73 + mX` .u``HV175>kl?.}(W ( DH*;y.`bd{3sC7 tV4 ~dq?}XБ8XXs<9Rlya fKH!` !d+jC5,bV![V0ͱ +&[ lQZ1e9g0L1g +Xw<7~A[ 8ayV XW78PL\ބkYX`ql3&ςYj<,H7*;YKW< #(. +KV0ӝB 1G5*`Md7fq⬵f+.blʣg P 9a1g1Sm9i+X$L`8k`$:Al}Y\+PQplȖ ǘh)Kfcaho|T -Mz) 6\bY1X{ +I*f /՜rf<Յ 6̄8 bxAq],bOmXzV b$[P7x.›-ؐI%b%V0(Ub]p\ +RV1XBMUX`qӨTѳcY4*QxDn"v[(+uKmm uGLYyb#L,YŮ\X +!2S;f`n.[Й f +ƲvM +>fPz`qcj䲉 &V09Q,҃V1XTggUU vXOE°wx1zX1Ȟ=۞K?8gVU.ΙPU "&e@M6(VV H*w 6^y .)A +k +kw[aCc9BRJ1X{[,V%֊ƿ"(̄RX`QKp!!s,س-uSL^=kc +se#VlcYm9r-ep YJ!=^D*3DK'2` fvDfW5t;1d" )o +9j#g#NV&t2`L”H\@w /-%.Ap%(rA>`3p]t7 \ q H\Xď-#+pSŀ-g  +W>h\fKpX.gDBAA5Ԁ-M8C, #A9r00# 7 hn%=vf}w%ޢ\~7 9OuWwouTWp6s$6_tؾ`g=5ơM»v_5}vu´iWW=>TPuw:rb1TmG]Sg}k:}5 +w΀]w/?v]_İUZޅz6!\ۋgi öv ߘFaP3Ѕ }O2z;s;{Sp;۩5wM f[}y>Bg({ ɏp9ǃ{-l[~A@(E+F~Vkzu6~=>.Py5~8o'Tx))߼ ;^vx׺hU asz䣣'! d|k6,/?}mJUZD.WvŹ>-|| ߌ*| + =Xo0MWy{`Ů갩qa2n}٠xSѧpukS[)8]F~xp]wxDdMsi@O`0'?c2*qI t'%p:l]8Jnj?͇sIVyCϕ+k +Lo;>4VX +=vato )\6wOLE_PZՆ Bu=tyl5Kxj_Dz Y`e]s63Qc_ 'Dϟ??){}N-,68 j{CuΨN7ƌu=ʪߗ+#w V R`\tΎ%@]\`v=0>Ӛ]=F2<*?#;u0R9s+/75nd/֐Ut="FTkEC'aovopz:w]Yסws煊1 7Éjh+0vI2{i;īN7q؜Ÿ7񉏿ZNW|>deYߠ'?/u?õendstream +endobj +1492 0 obj<>/XObject<<>>>>/Annots 469 0 R>>endobj +1493 0 obj<>stream +x}YMsW!`xJS%++HBb@IɯO L*UN3󱳻B7"n9g$4Oƅ${v3Y0Ei03` `llkdĪ, +rJNTH6l0 e' E `㐩 (yNf1)DS&J5Ixb0b +F-Afl-f89<[ 6MGZ vm F}1I` %a̚ O"AҌT Ӕ_`lVW2 ql05eg ) +Sq`:ιk{k*hD ҉)Kt)I m5m5)<[  +k1Xrj>d! +1`󘒽`gc QaBk1XT %`gӑf (b'aY @ S̀ X5@2[C5,3 5;>Gj!lVĎ4 +`" !v - ?b"cltphI )Nɳ8F $yMQL)#סauYP 06a*H=i6HI pǏZIL{@8Ō'̙(3ҌY`q,3Mm CcJE%CC&V,4K^:$K:(X]3/r?ѯޗ4Ű#TܪVOLX86y{VLY--`31`g'5HdWTj$m)_ +2FB2$<>N%Q1&|=`yBx[ b`%24}-XC8ͳУE 2,ȓg Fb1z)ǂ^\ۺeS:wTۮ>Ǧ޸{gwDEpEN3C@5R1rAOT-Jݼ, f2xSlJwWz/+nߔۇ/vj-0o^(eXtR8qlv(, :=/eRlǍ}:k]t#6`.7·t08-Mݶ/4ż:2pu=es`>֐<|绯nhǫڌ60f.fDK]Wc3tNɛn,O&8MݕX*VKwj'^][<S~]W,EعBwK "7m\הè:pdntb/ܼ+ r6//?~d-eD& +c[7|5+⥨֢\sٔR=qxJav˾|Fݢ.ǖSC~?T_?Ǧ M1z}.0V>/XObject<<>>>>/Annots 501 0 R>>endobj +1495 0 obj<>stream +xmWrF+vJIrdʎsAHM +ui*W> [_HYDqJn_?- +kJw hK˅`- +PE2*X*H +MT`KIaR.$+vS+ȓq a!rz ֆ&Sq$ SAndIAbWaH;"1ͬxMإƦ ذ!ێrπsƜLv*sUlu+B' +Y'Mx@ $H +뤖 dqHD0$bÞUx< 2iΐ exbSdf4ҜCLtbӐzVaD\d(b恑Z-xbfM ?8&1M9Ixf6&!Ifaj\pFUb@l){H'u!g֍F!  +s) +X"m$ +ss؃g5 ?ڲ`lYc8,+ ֥sCΝ$cNbIȳ\1O { V+VauZ-PU,!Z6Nd )WQǤ bg!`Od1r>%eAP"UT' VNJ"qdž!*R>/XObject<<>>>>>>endobj +1497 0 obj<>stream x+2T0BCs#c3\..}7K#4BHP$YSO=5/(1G!3$1''$3?O3$ BMr = !)f \CT&lendstream endobj -1500 0 obj<>/XObject<<>>>>/Annots 548 0 R>>endobj -1501 0 obj<>stream -xYr}WtKU+ Re;dJy$m}g/ӷi@ebIg/&?GLh"q4V֒Ql8k3;%3E 38΢Z vG Nh*yvAN jՓQfY.#l`4,xPEj1lB="D0"5szX.& S`Qs2ɏdY'$NJh'E_ dB=i1X`` $)Y&#,;xYwؘi8VA8IL=i12h: FQN5N.41sBQ@w L+Y=,jf~=TmxEg/$ӯVU/d6CQ5\_Q_;CH>=0 UgOM?9:*bI 'նR]_\J#Yu/^Eui/ew>s*`)QpG5<_)mMBn>-'OJI!?Q嗦 -?> -ym6}};}9ihJ8ц޵oФAćmgP_ھ)=z=-?u~}tYg47UkE^+kYC)WMu[,Q)|i%,fo?.O!Jpn_ʟ?]r|X2DHbsBH>$sG>uw*vttuOnx( 2_] E3GĶv&/^N"Pz c,?\fݽK4msY:r,۸"qMOm02$)sGib3!)G2tOp>_WӦIvrퟫwopNrٵ}jF@RoSgab̿gZd>gt7cZ]- CW=Yq--<84-p,w(7ő4O:~xY~;O3>>/XObject<<>>>>/Annots 550 0 R>>endobj -1503 0 obj<>stream -x=n0 ysc aPUk+Jy &˖>[>>/XObject<<>>>>/Annots 553 0 R>>endobj -1505 0 obj<>stream +1498 0 obj<>/XObject<<>>>>/Annots 546 0 R>>endobj +1499 0 obj<>stream +xYnH}We3@ˆ%JO ;N4> -67"%$=.IY a]n]" %Kd:Mu1&(rMi-Յ(6d)ĝXr 38N,%Lf>B풜U .'-;Fe L;e4xAѪ` ,hÊT`.q` 0LF$;uff+Yw)*d* g 'zIƪ6D` Lo` $'Z 6Yye1ؙ˺LxX'1<ΔFa0r +`1Xyőfdҡ 8q̰C9,O H"eblZ2:ǽbl YzbBoX+q /sƕ2W>f\[({e1a6e.큵.s/7t QJkFAzuҢRQ)HV +\V=8(MZb woMEQq +Z fx >Yc3!ӟB< 8Do% RŸ pAn{H70 9\1ރNy};q%5 8ic -6rWH~Ol!2ټ6}Կo1Kc+HS>o{4uu'E]N `绝tyuK^oG-*TW'ss%ĪD^ۻ[{(|}{z+mo"2ѻۓ.;%.@ɿ7t{]t.?\]R){Т|gQ8P~rtbD?4Gm#N] P\yujɺ}]eOy[t˝ N-|+]~/3SuK?I:OJLlv&6riRgY/>ɷi:y)E(ejMS̓(N5җ0`eF6;k-mmMD3/rM޴Mp_\͏x==-?aCtYg4e9tkhxs: <jJ,ѶgAIozЋ{$?#`˺n`WEVX~))d\oNe1: +yn㧵\kLB|ۦo6͎Ê%E&7Bs{,8|-fw|O֝[\DZemλ,߆"9Mu/N.I9e|ZwHSkJ֛y?#0s,Q7I[d~4!P7\-FSUN?߆; .ޢÞ)iq:mn\y**w}-vb}$}ӕ?/74I[rp>/XObject<<>>>>/Annots 549 0 R>>endobj +1501 0 obj<>stream +x=n0~966!ks jPmDDT +5@1QuJ<)F>/XObject<<>>>>/Annots 552 0 R>>endobj +1503 0 obj<>stream xV]OF}ϯڗ 8 Iԇ6jZT;w&;*+$sϹg^HC i67 fKlt8 TP8< f{q:lgoNN& FR5d6 &Q0:<8_Wg42E?ٜkji( GZӢseBKik|}h|I? zB̜E$°͂)R-U"^LZҩw fUM"A"/4*~VeBC^(Q6*jjˀ+ Gvdu!9N±vJ< (iMJWpPK6b(tV7TJź\]w] WcbyLJkPTѕQFezc?qLa0 B~gQ<Rlk6e<40o+ cU@8moAo}F=h:y#WGqzxcQTאLÂFb2ODѥdK^0U2#BLַсLW$LFF'nl؉TĀx#v`(f B xNơ' CݸD+\px;K8[I#1F_<XO8D22[F6vL6R+Y-x҆ia3&VJZ8 a2f_W*Ø ;h3֓=o73n]%fQ^cwn"bKA 5WkN:x:]C+6覢/(zg~#lk+ya%ޙ%cFM}yՎ#$F $іW±q%xBXi9nw4 :([id4kS%H;〞7eʮ:Owꤊ%*w/nKݍj&N"qCe.)?:$ ! ȟusc,aġ}$st^vW CPNI}͕Qմ̾wET7lk+TeKd*=B4pkۃNJߑ aWWA@D.$"~qYBaECvrb R vm)dyȉ_^<-̙W=. vFS7)Ӣ eҦX$Gd]"W-_C.XbTnWT*“ciJ{OW}i! ʵGSro 3.Zc9i-DW">g'w ctϩHd`jtPo>&s/9Cܯ3kpendstream endobj -1506 0 obj<>/XObject<<>>>>>>endobj -1507 0 obj<>stream +1504 0 obj<>/XObject<<>>>>>>endobj +1505 0 obj<>stream xVko6_qWl IJe~Àl]}m >mH\Rrl'%Hk}{ιz)F4RV] !MgdD G6`X3qL;Hd~~bp34٧-sBᐖY܉#hZ؊V(MBjڛB譤/CIf&^Nb~vd_^>3)Gvr_ 'sRK$_O,kBnmZTmIOkIARK(x#e:HZ^=To.ix~PKjMs)Qf%x*6RfZJo/yQBr8%16TLc36 ]*E"@H_0"K`B@윴jIyBW`PLqj1L]LƱnt/t3>o|Тo00&\:tȃb3Al(tFH {伉ӻ<-3UEi^vaۛJd *4jjTpnglNN9*ᢣ*K&[fi<GNȈ IFZ=y^|頂ơvz"LLI`  T\c}g} @@ -2704,8 +2739,8 @@ x *x"qltInK>KD%Q Ϩ2)W!/7juOwOn%d$ϤVrg秪U:*h`:{|L".?_gkEdM(P\c{?.xgNfd6}_]ᾰ`endstream endobj -1508 0 obj<>/XObject<<>>>>>>endobj -1509 0 obj<>stream +1506 0 obj<>/XObject<<>>>>>>endobj +1507 0 obj<>stream xW]o6}ϯKS Vbdzݐ4 `]ƛ1(@ITZ"UsIqn%ޏs9z0S|Bg3ʪfdJ9>O#dg''7>E$9-rBSZdGo^V?o/_8}>N.~řE~J*k7~E+geM6ZTkcJBe2Bd'ՍҎ UJNBNcUBRpLCV*Iզq4F l'k趠ZKFp4qn2Ofb-5mMKzX;95rqGZN6tă6VY_p>>/0UTY6sMΎ3L9+JH;ղikZlH$z{y-x%eBJT"mLZ[eADYʜ$ukZnd:Ӕyrm UbSI%I'Y+5T7&-e6)?@ 3mnrД mQ w,w7Ճ.z-Y9į".>q{9HKv)1$:%ː @@ -2716,12 +2751,12 @@ R z?1"ǻ0Nr^A 6vq-[>@ٷ79a&ۏW+3@kp Z$ Z![s~PОyD U{so?5y,rLɳԯXQVƯ[fҒj Q;Y 6zJl°O|;ȶG?2¤j*q*g /NNc17r.U&TShWw/b޻_6Z+q?kGR_LAB?\YwP>걵{]W Ķc2{rs/~ll_KzF7t>Mr<0oMްendstream endobj -1510 0 obj<>/XObject<<>>>>>>endobj -1511 0 obj<>stream +1508 0 obj<>/XObject<<>>>>>>endobj +1509 0 obj<>stream x]R]o0}WePH,D%[ire16".T|;#[cBvAFH(\#3^M}8F0$3T5x_zS8 ϧD^JcgL'U}0 q{l1ʼ8i$Yfi?4>U= .Vendstream endobj -1512 0 obj<>/XObject<<>>>>>>endobj -1513 0 obj<>stream +1510 0 obj<>/XObject<<>>>>>>endobj +1511 0 obj<>stream xWMo8W zi 4Nqvovئڋ\z%bCZoHJ/ @"͛ѿgsϜV >]ǫZެN.ϖ緛hqIL]nhS\IS% зVYin t+%/ɺ罳m3۷|nIyry-¦RJ[4|e[]V"~Q2TX5EPAj+LI8 !)TH[@ ]S9UFKYltD1KOle;<.m-aMHo%{Vκ_'mLAk2kDYJl>|_d#+I+B6G:)<vY>CPeMOʔ1>0Z0 alTdCeWBWb6g{d/T[ͮ9;|$ RsqH8 [Tz-g[m)OJ>=Iٱ췱: @@ -2733,38 +2768,46 @@ $  ;N5u*%d!#x2HV<V?w<*Pn+NaZ j>('Y)Kfch1F1T}=w431#;Kaxe6DG+&1c ʀ rDtrR}t#'b* JHH lfGahM)Lq Ad x7EgVfJ]#1c=ո~1EK!o>cPP&B_hи,Be [`~*q3ML $+Cm_"(-2yK/ TBw0@ }̤.,`9J`Mh1͢񝐚UXEo.kR#Pڿ%_H#Xs-f #?NC;1j),Nk`nH5Nj%xvTbEKbEaB"e0_Ʋ5F8VC\T=t$4i_((_!Qd✿~E%3 )XX3vDl th^ i׋>T>j9[]<~9v(endstream endobj -1514 0 obj<>/XObject<<>>>>>>endobj -1515 0 obj<>stream -xWOH_1Y$$)}]{BWפB6&b僚6iY+E -xAL~bi48DDHi<N*F'|qpSZ`k2iD-á -7UaKEg$ m*;Z|1Űé|~Mb)kVHCKEW)V%zH_!2%<\zN=YCCx$بrk=.5Y PB AߙR~gJڟFMv ᓚ;IEJ*kGBo?/u)&:NIi{Ii0ƅR}<Ï69]Jй[]|"Ny>tVG5zUcrkuw`Jn(L"޶[ɶ -Ó -h`I!=i(3Rh#A7{uxc%Z ^SrЁ2ehYsLj^¡^VQjzAnC -݊>xPנK=q9G-AvSjk$k_;[mꢃ -~D+ي!h%e|[9*di,b(XrkYS`-^ pHCj c󊡠PÑZbS6"5r5NLYMW3BM:n*/QLlFB0H!o|.~:h~+!syA!OJl:"ZrgtX -PjUO{5v1nG:t?Ϣ) 46I xnIAGZм.2A^g( (w -gҫmlrQf_`]id0wz$ûrQ -aya ?p:a>39k >e"BIUFCV$8A޾h, *cX`.M!\#a%4|pa䅼LBDm6}f{Âzuaoch=pi[gi ###8NB7>ɤ\uK!n t;D= Vw?^<%N%')ƪkqfvB"xKߦ0Fw|2} e$1y *z{MWi#ڀұ {a;f#L"1cř]'gM1a|s^L#~Ob:c6~q3#Wendstream -endobj -1516 0 obj<>/XObject<<>>>>>>endobj -1517 0 obj<>stream -xXSF_/!U X~! sT{k$vHｖBl0f_~vfr?39?3)PO/98G -Vd^ŹKC=HaZ|ZheKLl46|MplɕmSdmڄ^j\֦Ͽ8;]:5QO(hU>Wbz@ɾl/Ru2'qm)>Ƒ@^4`:|fZИ9Sn ɕ(g_}ńLܢC],}LTFlhӁ]dL3C5y 3ؐGa5 ]XyT đ5>M[,o]7b&(S6QX.2vi^˗741|yVK[HC-(h6wQ`%)\43CAD pjR[}[er ]Bo%7w?MxW TK +A~qm n.X7$LM{HZq!A,N8DlU^TY -}LL4%lEU6nzQ˭E>=p~¨:5EwnFҠK^߁j)rz> -f `P -j{_c6rUxak1P)J@ =xŻAH^Q׋VVYB([I6+Zփ0+a'yB,@2+MAUTqZsFy0Mn_eJHڵQbZXwM TEs|F"mc?8+w5 Oo:xDІ񾫥#/E7sR9p'+0JtK(N0u+B$%ѸS՞ дMBZvĴH>Ka-~|ҏ4i Tη>o}ȣJv|7-0/ym -nj~|^C{ J5yBڨi}P0io>=--<NeCL:ik1`9ɾ1UkSiKgEp0~ _`X MZi,C%+(4g&v.mhǁ[{R:"x]oq ;QiM ArF*]THD즋` {.;^awKpإwBH5V_$ VJ -&~J6I4:/GcP7:D.CؖԔ=,: F:r^jr߼dF`OKZ6 &4ͼq$^x'X6Fr!x{(h/ ~%m7tFBPGۺQyM~eյ:lEǪ|w!Jިd}sJkɾ9#q!"FL◛¶hw}sx8v'{r= GITAF$S_6p27{z#q黺d4~߉_RL|]Ю:ļO,F 8$^@U4Y7XpO]{ ӕZ_dK <O]ndj<@-ϹK$`xâ0;ű0n>oEǝ^WM^?wGRu99?.0asvJW;/.endstream -endobj -1518 0 obj<>/XObject<<>>>>>>endobj -1519 0 obj<>stream -xUmO0_qSh!)HhH@4MBBn4~wN eMZۤi{^AF)M/ BH4!ge8T~!> υӼ7dLփ^}3"1k4k-0ųAgN`w8^1+*dCtRvPE o$qU(#6,Eɉ߃3&^(pr7;xe$8>֭[%Uoa)0U3= o{ms)Յw}׻wRbt)5Ŏw<bUxzn ?DV~V'+xC$b~qNSǺيrpxn͚U%Y:~3MUy`neReAf+P+]ՆxG$Yp?=:=r3]$bg2BIY:F)!彯߉/9endstream -endobj -1520 0 obj<>/XObject<>>>>>endobj +1512 0 obj<>/XObject<<>>>>>>endobj +1513 0 obj<>stream +xWn8}W |II Ciˮ]a((HKJq{dE1P`[*3s3ß's.t>%r,_TܬO>Y^i^h.EB̎RkvN e#s*1meV^8b\S<:ZJԩ෧/h2Yw׎ldN"5rBWMP-RiPFFZjJ,}iQJdu_'TKGL*췒&Vph6n'qeS=J@:$oV)\Usp$D4Yn\)Y*z}ZQx8)J&~y^QeCt@t!3Uˈ=B6Y.wڗ '94K^":I<Ÿ(FKQ Ih-Q{ӧ^s7+\jL|:tV aiP8vZPkA ̑myT9 X/ZinDj?V2c)DY)4r(-T3 "e^ׄ _VX޿o31qNx;waսS HԻbD"{Lhƚܪ)[>C|BHch!S +=|,y&A%#V7{/gAc@q`݂;9fgF7T+"Fˇj9( T~[!| {?N)+7CpXX-D dJx~\O4^U{2i +]o+( ªUO> ,bE"&·FHr[)+oMhȉQ\09pEr*W V!jK)%$nUcE pR+<P'DbTNl<ʨx#SD|\5˖ɗ X:'J,7]ģPHUŤ&0*pHXіQbz|5PM ~Ok/ZLxScξB-<_ +o,ϫf!G?l:N<Ǔ녕Xطt c^g8oz72vlgk 7ihS*Q&7zp$17M8ʟ-ePWedQbR Û-3X(<]08㾛{p 00E)$fG! Ҵ0,Xf y3O1 |9 Gg!C +ך06с(;eh'F~ce7p-,>!ϹbjFt + +KfhThy")W3J>u>¡OǍ߷NXΧ%ׅE3[xv~ErѬ>yrQ|~4Ȃ:Irf0a!wAVۨA6fǎeX8 8вgoKmBMH0INȤH6I/%I ߍ"\>Η_rynϫ7ЭD_u]ΐc/|"\^r@ n}nendstream +endobj +1514 0 obj<>/XObject<<>>>>>>endobj +1515 0 obj<>stream +xWn8}W q>$eͥ[EAKF"]Rd;JP`u$q.gΜ8Pt61A?i skˍy2޸[aj|/LO?^ҤuM5A*%i}ӗ_̓E.GI~ Eo8u~oo&#ݘnjO !$&6 >] +QKAtTy;]&eFϥ~ua2'do}.2iZS4 *< GB]*v#* QOڟsx` :E+`JiRYKX^i) +8J5"W-E[Hh#YgFus5%XLլ@\u8795enhZRدh|-zr8 &1Se9k[[bz,蠂{G TK{XUʗL1+(nX3!C#PR8h +u+lp[xdt9T  ㊚wP Q[b3]?Ş&dᗨ*;i!-G.hڧeR3} +6e>9;g! 雭|!kepU W?k{g Uy0U.Er`BW@w0q}30ܝȃ)RV:2H0 ([+RqB(v M I|;(8=]rgtXDwbՑzMl xy 3&XLot3{c3Бn4E:#7RN,[z"Unk =Rr[YjZƴg \tk(?`3J58!xD~) + G\- 9\iU!Ƴ0ebjxKUM<M^G$K$jIwaoch=pi3lmw֑@;84RyPFm B`"W6ɠuk r\؍|ó,{yÿn,ka0{p +2n}%d!~L +>u͹E$K,~{S޻oRXoQr6>+4N!endstream +endobj +1516 0 obj<>/XObject<<>>>>>>endobj +1517 0 obj<>stream +xWnF}WLRi,`'Na ܈i4E$䮺%)[o2ɝ9sf5FJˣ~ԧ x6!~<Ѭ{*>:{7&)NOqz"FR{ڮU!ɯ%\ZGބ+p^ZJ>RbI*4+bt88;MNnKڪ0hL} gHt/!onhc7)yZ8J 'WʌqV(I 홋RZ~-|rmF,(][x3"KA%+0ek _)v4i%=fK"1h zTtDnpw-$qd[,c~F$@r"8V(lZZkElHKQ&C* tUڑ6c=B;ueqAPeǪ0(ܟP_(4DZE)GY3$^uno}Ǽ]|`#m|J=A^T,dڍ^U!,KrJPn?fՄ.lJ$F*Dh:LB/B;nYut4eaM"zkB|BaHz2!-Kti@+bFKLYN 4C$,jUJ?!5 ƀv!AvkW7eyq1NB,'܊j0$9%/YPAU[+Aq5e`f(!x@U&uAG 5Hqg[y +L +bJ#GZHNk>\JƎAe-vXr]ff"nqnVjy#=0OKƙ`0 YDѡ>< +MՌ>(-5SհѶ4L0}iyq$Ǥ]Fj f^CNAz_<g7[jܓZȷ6JQ/%Vix<@%Ƈ {7B;=QM'ʼa؄GNWd6YX= 5JVW9OP/Έ}=o2Vf9ZIvOkwD|qX{gԉu6 fp=Ɓ9'x(UQrkSgJcVZ=z0BS`*}Auh=ܗĉ KRr,X24( +8W6pܬdnxX<%C{L.'wzqz\1:K(P,7 9vu, +;yJ״_ta/,h:O#A:STa[```1Ah{_d<##64Y@LSb1Y]\{eڡM FP_NP0ޢFðySx4a*1E̬Yhr>G|hyy{uIw|x"V.^vr:=m6iN;'h:a]]Gʘendstream +endobj +1518 0 obj<>/XObject<<>>>>>>endobj +1519 0 obj<>stream +xTMo0 W9@p;C\Pd9Vk$7Ϳ%7];,C"G%7)26I6=FBٻ{ $ %$l2AM4 /r}]sPN ຀BÕv IYN !4 ;J WwSp %a~yC\t\7R;P]rьe$A_NM{#e@[PҢn i}fCİBN: )\<6K<#QV]ZK%)^Isw`#n\;51(ԈO톈f 3V{(q JBb)Æ!}ⵑA%  _=[ov c8#Ō&l_`u+&>? x@]<2j"S'q=,y[;by-+7$gޫOX46 Waaؑv^;d㥤M-˵$V;߃eUeE)w@?`]w6K6iʏuEpZ[UNT>/XObject<>>>>>endobj 1521 0 obj<>stream xWn8}W pjE/liBKŵD*$WgHɱU/(93gΌ.&4ƿ -4[PZ]1ͧdA%~OJ/hL8$7xGpdA }}G1s^,oh$XKK;U:7^Mb#|'ؘ,,$Y{k&+&tqhtfRI93K4yS-92ψWLATAД2'oZJm[{& NV$&5U-,劼 rX!'5D}ٜ.9{=!X{ǥ3W(K<"t,8՚ػt?ޜ;B$K R1YZ'? WeIFm\X92e0>$3F9FJY*mK @@ -2777,9 +2820,9 @@ u/ 0*R»8Yж,K"Mڳ'`cE2r_hH>pv1m /DCr>{LYHk㜂D$\A A;DC*3cgs -(#e&U{*1S4ۂقx0NxdfVUVYlXCͱ,?*uͰa *\4T$#ѡqΆ0OT0ˮoċc@U5~9S6a3G wE fWG;سJg~Y?^jx,Jd=TŬh̐ҝJq&(F5S"8YMHYid2On}0FB=rG8ajjД7hT0C7Ԕ-X(aEV~Vh^=畖u(ҟX=Zݯuu5&$#;|U7f;UpT - @am䯕>E2^贃3+ב[|o«,Yt5_|Of t' aqiX_|% endstream + @am䯕>E2^贃3+ב[|o«,Yt5_|Of t' aqirv/% !endstream endobj -1522 0 obj<>/XObject<<>>>>>>endobj +1522 0 obj<>/XObject<<>>>>>>endobj 1523 0 obj<>stream xW]S6}Wܷ/7BLXN-'Zd˕d v:0Ėt?9W`H i6` h<G#g<Ÿdp<Gi'p|L˔i0e<::ӟNq`@4LynJ-fFY4_nRUE mš6keW/wd]`[[`|?zq/5מGUCіHl$ 8vH@)om@w(PXKZ5h5 MjvWq ;BIR:3yT_.em`$NJb_[:n1=2o[Y[OzFR;["NW \stц쾰K `M4~#0 |K6g{JM"5* -?,|p{lR +WV}0672-}m}ny;o?;|LI4ӫO|$UI.-lp&l:Ǘbyendstream +?,|p{lR +WV}0672-}m}ny;o?;|LI4ӫO|$UI.-lp&l:Ǘ?endstream endobj -1524 0 obj<>/XObject<<>>>>>>endobj +1524 0 obj<>/XObject<<>>>>>>endobj 1525 0 obj<>stream -xV]oF|X-ZdEn6 -ȓy1uwv%I`Hُ/'9M✦s*6'lBg =ǯ״Y6C>f^/O\Pr -KBɄ(lV[®|*(V -U+SRtTTk@'cK tF2niC]-08F^itA!8(\zQkQҟFZ{2kj]C -cIY6" ^f]9Aԥ#Xr':Q55}n*[M%bPq%\e  Cӱ%}xz,.H Uh4rTa[XGxǝvCQnNݲ0P"0dG>ؽVH? 0ϳOd?H{xVh;JH*iՖ y]t -XL.+1 Jb4{zv\Sťk1]u*G, IDJյ @ԙv4v>J (}hwL gF,:DfN)lua-w {c6`fӋO:xgn\\ RXOrnl **]<N{EJ: d(QAr:<#.TY CvP#wޢ؈3AB6 -rtrl3~}3Н?|GP1)fX7o@M2l& {k(lVvAUSmEƚhPԶWcjOgiOYF5xwĜ~_ Fkh To#J#6#ZCtk\V -zj)8sp6233As] Z}gg зPuyʋ$Oi&(&NyhF/8%<hsjh y04mRe +]KUw|z҇n/06D$.JW?be?I%jq$N<3zwN 4WP( -]!CH -KX<9` 4yKqp VȏX^YkntqX@9{kjG+B)Z{+6bp|*l$vbt%êad%k_TYR9uǢᔶn?`k\iXyy治 9n)4>z.\QpJ8u4`\qh,[/__˓N.!,endstream -endobj -1526 0 obj<>/XObject<<>>>>/Annots 568 0 R>>endobj +xV]oF|X-JdEn6 +ȓt1uwv%I`Hُ/g9|L۳Q6dӫ95x:f}gśKsZdv5EI0ѢrBؗ/p>FMکLl(:*6ʮ5e g铱]PQ@1jhCF[aF4'8^uA!8(\yUUҟFJ{2+j\M +cפ,۴okxz/6x~uז *oUElMkNoepy5}/}t(/zUI޽a:wy>ͮ[ GU՚6yژa[XGx񇭣vCQn^ݱ0P"0d'>؝NH? 0˳KdH;Vh[JH[Mt=-c3ĸwԇT+ 9г/.MUU.OU >`Y6hPo,H'T^ʷΔ.aAmGLDDTCf087.g!ʯ-;ӅY5܁AB4脟N|{Pndt"ȴ`hzBԗsvlUŃhuP>ԛSߙA."-Óa>b:v1Xh={Ǣ+u0kb#6H_+ ! b*۷ IrA@wAN(Ƥp-PSݼ[4 rT2# &i^PdIJA `Zo :TTj/J2D*nYWp2M}M3xmD5ƻs}U/,Iܣ]0Pя(XTh ښsZ*T+kh2++lTn .t,.w5"?3Цi6]s>/XObject<<>>>>/Annots 567 0 R>>endobj 1527 0 obj<>stream xXn+ ތ H M<1$psڴȦct7T7)r2@ S9zbZi2E#|r"|9FT8DSNW,8ZbuO:EsOQ4nxXPAx6q|أY4ix/MX.{#)͒lΗ.cO3.bj3V#9 >MFK?N _\ R&̗ ڤ.#$O,VkxQ!T#Sڝ~_DizJ{?nP{d AM~_=?u!JT[̊2/pA,xNs,ptF92S:8XZPvP{K1!u; 38{=}y!=f6FO}CgW\ײL̩rT k$5G6xzl e*}-I]$Hnєg(pEj` |Dj8U\ @@ -2813,9 +2854,9 @@ e 79ۑRd G@|Ko]]ӏUE屉> u8x~c3I]~\,eS&Tioӵ~TR<^;2@2]&6c׫0046o4]1 枥%Tr%v_]F¤żkݖ^í+*;5.&SW ul̋Ĩ䡍[d4Cz9Fzx~`Xu5Us3YeVy\QgȓyۮD_?SS+062鹀waV+l},F4]L|.^ oNendstream +dw 8?>aV+l},F4]L|.|yOendstream endobj -1528 0 obj<>/XObject<<>>>>/Annots 575 0 R>>endobj +1528 0 obj<>/XObject<<>>>>/Annots 574 0 R>>endobj 1529 0 obj<>stream xWr6}WL3cyƦudI-y$! 1IhE߳)SƑlJٳπCM(ɏQ?hJ$SNSFs^O()/ WW#|6b/#iu4i8Ēlew+i%H=>-(DUYjdJf_i.͓4d 4g)6Y1%: F#ZDR&4KIfI˾*59R{p @)8N2% G0Jڈ @@ -2825,34 +2866,32 @@ P PnOºtLuP(7/8ɯZ2zTɣ?ڍ(n6XseY${T2;7dmkfpVibT8 pc4s(<8跁UAXX `tUAs".OBsgټJ:Kw_ng1P5h"!öJ6LEƵ ɀ َ*Δt/3Έ²{uх=Az(47:dl[ŹrFSRڮ`APGwj[C``adr"E,*`($OmQܢe2G`|!{8s`7|taٝB;³òuBko@m6ڈP7@lCuxfZ@]8Jn.S =b,mbDN O- ˞ z~HL)ӕqWp`#rQj]4 H4χB|yݰO9Mplpx0k fX^2Z:~ױc\~v~ =)wA;M="pYf?t<9%"N6WYzRf (+|w 2Pӳmxv_&Bիvs8V](v>3S+W'٧39ZdB@`'4JS%程ntRpB@~reSҏ`8`>/XObject<<>>>>/Annots 590 0 R>>endobj +1530 0 obj<>/XObject<<>>>>/Annots 589 0 R>>endobj 1531 0 obj<>stream xVMo8W IJ%;|H`7&z$aK(GIf8ސ#f) h$ͼ" 9_ig ͗\zKrBhh[ޢ٢f x͢km%2U<{[vc:[4G~gk:?-\y>\5slo~T27ՌV١R۫mMyLUsb%+R/Q|m4I#MjvgvBrMqJkQ#|jYmH'N9 ~Ni䜧S%il$ΫW"oJ T*w%y%=sA-7=p␳l;~A@EwXp+6fš/awLD#9u!547$S Q&ŠJsl[uRгmżvo۶$o)ZM?]+LN[vν̣b_ۢ6Üa3S d0ԕ`BXZ],DЀ2Ř&\ cL#Sk;SN:U &SKZ7qQ'W  !=jߩA^hon' {#$<74$ gRdV'7%`{1G0sUQ1 -*x>p<#:pꂘ&A2{63ns"J3Ǯ^:v}w{nN9Kԣ9-ð׿_R>6 V e >i&<͘y477 Q 0_}ڌ HJjendstream -endobj -1532 0 obj<>/XObject<<>>>>/Annots 593 0 R>>endobj -1533 0 obj<>stream -xWn8}W Rb@K.BKT"U3|m&)Μs8vң.~z4`DiqM4N 'c㿕 $Y@[><:bcAdLuNӓza2/tntI%Ɯh]-(D <2RXQH/;=t,>ɥҒZ;*'iJgJ3^͔7Ox. h)XUC6BEL> d|DbyBu!QF ΍i9ZMX댏󁎧 -1K|%~\Phx2ӧ$Jn8Bz%E,Ǯ@% -h88cr ڋ\tEb!VhTW4e./0vuZkt\)S|gn왣q^64oʽcI/0rZ,"7~"Szet$Ac;z9?r ?@0DQ25[::'yỸu$ > ʐۺ`"7t:TP`ҹjTߙr˰Ҋ<)`Acj3yyRZ2G$͡H45CK a=6A2O::T"H:QfH=lamǼڱ?ZlyAk[5 =TyFX}s}[A0VXɃ3)r(V-*/AgZ.;D -VǦq#;p`6Q#@|@@@7wr)-NJIf6- Rڡ DLEv2J?`;󖇝cxKxB|}U -@'ƺu*K#}auqb7{Q4=nvɲ$]Nd<w=;/ V?#XQi4ЌB - :k>/XObject<<>>>>/Annots 596 0 R>>endobj -1535 0 obj<>stream -xX[oF~8pV)$ZIŎU$@#r(1!gؙ )ɔݦ"kօswnh@}h<Q?Y43RGO|AY4&!׳3 hBh2Yo,L+̓4]eJmm%9MJn_0n]MH~sR%2!]J#\eʟ/sKҩ?wэz1rԧ̒ P,FW$uFe$XB6G Z<+dnC<~YQ9]@s.6w/ڄ(:cncCTts!p^AEdT[J\=3}Ib6`,o0a!P-,gD#[Fo8ōӳ_6Zm+0v2t4x>O[<Y~4[V0 h]K)yޖIFx79tg4WEaxoǃ}$o4 3fv(^endstream -endobj -1536 0 obj<>/XObject<<>>>>>>endobj -1537 0 obj<>stream +*x>p<#:pꂘ&A2{63ns"J3Ǯ^:v}w{nN9Kԣ9-ð׿_R>6 V e >i&<͘y477 Q`n1HTjendstream +endobj +1532 0 obj<>/XObject<<>>>>/Annots 592 0 R>>endobj +1533 0 obj<>stream +xWn8}W Rbv@K.BKT"U3|m&)Μs8vԧ~4ňh؛$#Nx=+) $X@><:bcIdLuAӣݻa2-f9Ɯh=D<2JXQJ/;=;,<\iI~%yC^IM 3fLNڧ]~wfxέ(7{'4rF g o0bH?@ȰN?$ʨ&x~#bm:NVj?m*9ᣄ|é8bED>w-(W܏yX9Y'3}LO̭#+ҝrl VEAZ Z3&EWtꫩ(nKiL}UIS,K/ cMVU2Us8˧McOyu,L*xi~C'Vb Fvǽ+#@ ߡܯx 7߉'sO@`*Éd4utOz# 0H&}!]L.o낉ҵ¦P}YHFnsiQvVJ2y6*ʿk&19cB(hn2v[- 5(CZNoA,ߟ`?j/ssVWi'oi5Mf,다׉G.geɪbg+\JAMR|mWvZ'5tB7pYm J.zu_B Pea1:Ѫ*_3ECKƑ,qBSVP}ApaԐA~mHԫ񞳲L(灘UFUvlqL)f8 Fw,;8SЊa3ZqVBPԩ}xܿi;N&<+Ѹ6 b߸A`Y蒐P_K6L宆h.V4*{ja  E0|s@ Xјr>K[S{ʤUO Z=6V-uR")1˨t)I/t{~7k? lbxݛ=>L4nSF}efYsey#Ǖs.P-ח% `<;5<ĉڦ՝i3ǚP-f0n3]zL\ז+Y1פ{F bz}yޚ)!twv7Ɛ1h7rwJendstream +endobj +1534 0 obj<>/XObject<<>>>>/Annots 595 0 R>>endobj +1535 0 obj<>stream +xX[SF~Wu: &3<8fB;L݇H +ٕl#C|\> t<8?F]:D}: ?#iptݯ1ϩ=?dtwbrptuBM? i4[,Js/MRGB[2INSi񲔛;'ח[_TLHjELĒܟZ=|M$\,BGsh:KU.RyZPT)dgҭTgT6 TM$&X?Q}/CL-_C,):"S"\P|a,͍i)@% +aJ% ع$NuDo,Jb,Ou_x+ufH"ЌYO$XݢDcimfԚ8k6IfV^t)fsƞgmz[mcu~'1y!uv#RQ,i7 ΨswQ:( +k "Nrx@6fc^şshy#=|'QA(\F 6A CY/nCoތo :594LCc ,YFU .Nsq |]:hԣvMaƇQb +>L{k'~ڱaJ^ ۋG?UN.KsPTΆ]Z-Q8oM>]8;mdK)ZIt⇄vWX |]6Wlc4 s =$?ܒKsѼֱ-%3w7t_3}֦ +'|Jr]a" /2V5c6gz#uE{8 T< Fd S:fB],Z8lMiֺԹ48[p?cAUG ‚Qso+k}퇰 q8]̏,\T8Y:Em=ZdBE8({3:{r^΃D cQ1Ԟt '֗&oaܭ/톕v eJ8:.N59tM5?am+t\2ےUW'Ki?,Uۡg z|yn~bji WpxSðX(Ǎ`{w}4m&;YYÄEqMJ +-XLψ #[F?zgō36Zm*0v2t4xI`,ස(_endstream +endobj +1536 0 obj<>/XObject<<>>>>>>endobj +1537 0 obj<>stream xVo6_qUiO*! ! H϶R^2mӺ&16vJٴ}6)mھi {l7$N ٺ{>tȋ!J|'),Y= `%q,0˚ Qb@l^jr(-$a "9d(ʵ[ؑ{R\VN,4Om!ZĚiGJ$7aVB l^X }!VXe @@ -2860,10 +2899,10 @@ S/ /+DITT'kr4Qg.քc*-6v$&ъ'*?S"fj6P'6̱(O6T"ى< k.g=8[zOkI|ѐ M.g Kmlnaѿ ȼ T$]@) g*[4]jr&i> wT8 %Aۜ!ȃŚrV;|4UƳTL==T.+淘~V`ZmO}Û>,тux ϔU`VXx*v}/5(9R,C؏GA؋dE t;QR[日#{IQ8z1O5S)AP {~wd}|^dzE99Qr%%+ W}|^dzE99Qr%%+ W>/XObject<>>>>>endobj -1539 0 obj<>stream +1538 0 obj<>/XObject<>>>>>endobj +1539 0 obj<>stream xWn6}WLqHl}^.v.b((DG6 )9A\ϜOblD)eIF4)%Gk$ncґ$xqO,ys'MY #E9(E6'ãnKQLwWlv$ﯯd|vvU0up҇͗ϿmƂq@;87*sU/\Bqɍ1,4,Av%i]KUS^|҉wRUyw1ehک(350m29<U#3 邌RA2QikCG8i"(9ez]jJ >F҃mH7m^T;U%.+ !e?aRMg4ΰ5 ](6ױw1 m#Ts2saE*܏#r ~J2Q5{ߐ~@EZJDYLPE% MD}dЍtV0Gޞ!TjB&CZBw|[F(u) #`üAP sRqd7L#[xr:.d2)hzڣ5x:\ic @@ -2873,321 +2912,279 @@ vAm5 n g' M;"F"vm"g%j)]vpaUQ75͞,Jk~0!yj4 gn|]:7d ;u'.A6~{rORO%;b#Lŵg%9fc>Po͘3Kۚg_xM_NUǴ>"͌Mc7غ-15(I&c7(۝ﳾs.]Q`ztك3x u| FSXJ׸H|Y+a|{  ~,(nh~ UzU' z洹f~C?w nNp͚* t z% \۳it^Fe)-r_`  -\k4ܩe%ЕWk`rV^{ZC‡c*^!tu*4v0Lp գ*zBpQ;ޏ L/w﹵nN}])ޫc$a40~>5;x/J;/_^rYΦs`k?,2endstream +\k4ܩe%ЕWk`rV^{ZC‡c*^!tu*4v0Lp գ*zBpQ;ޏ L/w﹵nN}])ޫc$a40~>5;x/J;/_^rYΦs`k^/N>,2endstream endobj -1540 0 obj<>/XObject<<>>>>>>endobj +1540 0 obj<>/XObject<<>>>>>>endobj 1541 0 obj<>stream xWmO8_1R6ZtwRIKgm3Ni5%gfyVzۇc߃t`4Ⱦ 'ҟlzp Uz "*1i8&P+SU{pq:.<,Ζ?Z={VQ,roH3a+0)o@R$2iƦ."-BH/Vm+ou֬)kHͱ'/n 6P>4Fv®EwͪS%-(ՏƥlFfA` :8ze>/ BfXT/0#d8l*@i4!{-<9$M#Mq:偈ta,>@ qAv7^ ްwa |Lйga6v;0HɭjHSS Bޜ.?*qB>_>>/XObject<<>>>>>>endobj +1542 0 obj<>/XObject<<>>>>>>endobj 1543 0 obj<>stream -xS]o0}WG* F&m^*Mjw5P!$K{>qdqT9V%1XYohD5x MX8Aiw<'xW1ESjƠq Z=N ,Ȑ% TqC0[X?mND)]Pl6Zbb+H"/8(x6v*}vs@'azk;u/|g(V9Yw{$d `NR)TR;$GR+i٦m:ylz=IoƸ*,{! 9¦ޝR$}Mp~-=~ԁƇ5]tZ5;``r];d*!_=֌~6J)irMxIϣ^kV}5tt~$i3Aɹ!ub`UYz^/M#}endstream +xS]o0}WG*!F&m^*M6;:5P!$K{>qdqT9e,C׬ƪohD5 +MG-eM g6.X8^q<|gxW0{ESjBwC89J0#C,P t5q3}Zb NbAAy} Nbx۪MIeIgazk{u/|tg(V9Y$d hNR)TR;$'RCPIdS6İyl:ݫQ oƸ*,{! 9¦)>J&8ޖ>@Ú.Zo]B \w0H9`:kQ^N?\z&Q!w߶wn]+|6HpڌAPrnHl８UbUYzm_G~endstream endobj -1544 0 obj<>/XObject<<>>>>>>endobj +1544 0 obj<>/XObject<<>>>>>>endobj 1545 0 obj<>stream -x+2T0BCs#c3\..}7K#4BHP$YSO! U!?M!3$1''$3?O3$ BOzs=s3 -!)F #\C&endstream -endobj -1546 0 obj<>/XObject<<>>>>/Annots 641 0 R>>endobj -1547 0 obj<>stream -x[o+xDs8 _k[e`D,$GտwEAGGg]3rR1)byXmOƣ1I|I5r>mXrp~6TqnCQG#=NG3&dTqd5֑t‘KX'ѨvmX%i@jDDz ;/hb|4Mj dW229ٴH9iHM,ʬ0)&(1|Pƈj H[~8'AN,8Ia'&QacYaBeƗ>Gz KTh8Py*踁'm/TCsҬ9BMǰDUY?Pf˱Qb=VMFg.)̚PaKt"h$N" x*"cF.=0,8;Ƭ95Z/US:AԖ3Ia?~31줔;Xcvd.&'65{ ;)tǰCK05,?*VsYJF%cCCͱ+FK24!3aD jb=-*"(cftcV#hDuɴ8b3&sð 39: [əuX)׉AN;(3q2;B$1,&--B:AsHa̢ò9xP1k*rSС"HMLҀʢ$Huv88aXnͥc\i}) XjD( X&iˢҿGT B(#LD)y@vÈr{caX9췻'c;16q:,t39abYaY稨cXRK$6{CòsS3u1*{ʬð +:TJ,+0,ueҊƀuT {X$A{Kdg+9Hl vsD/Nceda820,/ *a:4;LtfaYhtn,C+ mW`خY,CڮD#)èg6B%@F&=eM=0,+ܳ+YJceh/cXðt葬ʭJF55U@ X3d.9ȇ9m9`-@X c-HaL+Cbc×أ\X8da󙁊ɬð|"uXFʬê XY+\O@H!sa%1Ö6f20,WeYa Uf09Pʠ4}ʉ@ؗgn2 +9Hk4eA, X1K_іfGXdX_2Ypr )lHQ-k1ܠ6[uEwHOV;qxHLz *IcJm`WdFS e=%!* Q/ؙY"ǑRkǰڳ1Jh+ X2D7NXSkЪ-~6dT˒ն,"mbd1Ek5*S -ḉːu3o*~6oR -(XSpM=edžY8b$pUZ VwYȁEB6F`"k@9[sPi<'EAsPW( ߾-A]O_<}<hŕm߬]{u,Ϟ2'<^aUB{tu߄.|u{o]kQYmazumk/^ֻOaod8kwfG<:.M#h|?ё]4:>4 t{^>ڻ#pqH C-p0*{[ndjabv#/6kN۠SV{[͠^5}c)g)!,el駾9Ϻ꺶?~7pn֫uFzrb>}h 7ś(TUm?}qr=qf8wq -_OK ??oz𡭷 k.qgow:/ɕw%);E~S@35}p :[ZtZ`}me)2Up-X}1J W*+|Ǥ^SaM3^őJa!I~ivkGG|Use?S-bL"lIcT}n7>z|8?u9t]5c/o Zo6ۺ |v n:<{y~eE}{O_aܫZ?Ӣòjwn8[metkmMeGi% |.Fvw+.']<_ՠ'v>£ .G7PO_M`7u|U 4.cAG̏ZtT]Rk \K]pRWl'W=endstream -endobj -1548 0 obj<>/XObject<<>>>>>>endobj -1549 0 obj<>stream -xWn8}W IH]Ih[]!)_^Mju֧~4꬗ht=̮ht5ZIp0Y=.`r|Eӂ`oX{iiуKkX4 Ht|'̌ߏf.W:7EVxc?urkYxozּ!p0J/񷕒 -Ԟ<|_ .x ))Y"gW\4\ .tw8c跦Jӽ,f7[SҶCvG>~? Mz>w"^o7gb81wӿuP &Dە!h!*U*ai$#_*oZZ87d,ո9\FYr?zV0 }f +LWRH>8qa8e~cASfD r"<!hLtC)Ė%٨BRirQ*^<gOc3Db#T)%ƚwMK#BN3\w0%# -\8x4"QnK:| !;DRЃL$@AlLvJɇ/ ۟ym0y Zry -zKa H]+{ȋ g˂PX殭D1R7֝P^}r+<"@ثl D5!1tDh@В= w` A1'#\0;a\ V75b0oeȑ$73jMQASm/G[)\Tq: 3F/;MW UA=:e\ݜu)Xԯ4(GB DY+XnkyQo' aؕmԻk߂V_qDݻf8O|:fGzxDEPwt(N@ٲPilOu5O^5]ƣl|y}N쏳endstream -endobj -1550 0 obj<>/XObject<<>>>>>>endobj -1551 0 obj<>stream -xV]O8}ﯸ iG-VEZiafծi$NkHN%h(-=ss4 ~|Ai9DZWъgbMbގ.ocNi#bmFH06=W:7^ ;a3w7GR+$(3PJ?e"-9ixGGYĪhB2ZbnEwR闀^pN8?nQUqUY#ј݆Q:3GG9exϝ7/SJjO>`)⃸ -#B92k[VҔ / ~8T Y7,1A9o\ZzMeBF+I?5"j4A=^E+{hްb]B֎=*,*hٛ+VO 2Nro!=odZ[βNh<Z{pѶ"YPI2:+XA͕I/(£gp+C(, -\G鴨wFntD:XxZn_zD\^SgZ\= 8%,ὡ# Mw>Χ,?`覥tv}TD ,+GĜOgUTj !LP5%\^9_7]nfCmo{ίwW *eO҃'o&Z:B$pPԕ(XC YhwمA&K'w%wD0#n - R CPOS"hː/"xuCv-ي]Pxv{*2>뀾=,B1\` LfCiӐUV] Q9D5dlǷ[ -*H=k>/XObject<<>>>>>>endobj -1553 0 obj<>stream -xXMo7W t ز-;[/.%1%7$׊} K{(;o޼5]k_/OhY -oUszRJ --/>Tj -ڿl.0q3U7qO~|b0_+dU(n56mhŇ١H&o5v3V9w\oILʬ &g-Imk-5ID^ڼ@jEL~5[TtZMΜtHiX;m=mg3Me"z`^8p2! DFӪֈIFi4ީVʇ=< WX -vIѻ>s?z.gsP ̉I(^ԪBexoRWQUvw^wsawXPx4~$rMd1 A# \ # yW'c[8Ud10FF 2S -a|)00[ RQ&w ^,N ^^"⟰ ᯆmudJLԅ9Z-JR{8I+Qs -0 dxinLԽ㟓 C.GI <Nj^7>ɞI -R3HJ_Cҏ8MHJl8g@v-$!a|Gq,P>YQ'\[ܡ ^^"IO):!luFr<g3KEU4ĝeU>N*4hnKzf'.^ْۛ6(ˠ@1/'3J:78@B{ROvXjt0w1g3P}e;Vo~$*g1K-i*6N&0N -|9G$ɐi|`IaiB<ښyj=713dDALL8;Q I3{&k4"v; !Hn U:[ך\u^kUٹXKBܦ AOb=NY$/d V42E|El|#ȫlg-.y&Idn:q @p9OoiI -D  ;/[]睋] ZWcO(󳱋u})vaz653ys42jwhRyûev6_Ue ӡa{:G WQen6hi<{0m2 MxI8H=\1dC螲ǷoLz43ZE˔L{Ë7'.'$\/z5xܢG!i?KnmYmxْG1d\9r6(tmZ$IRa5΋(ȳ.Q}ؓK@=Zp9~.!W8,<^RGg^93߷5x1IUn4y\n* iSVoIY!7PEph~)MPD:upB@IxzКq{cLMn7b@QkZu jsX\ rmyE@_5]pw2s]2]#]ng{>̑-J&q]/%£naMN@̔{2*\5~:L. I/(}zVωAܪW1R9{0:rs=dO1Bv~n:77_'!,endstream -endobj -1554 0 obj<>/XObject<<>>>>>>endobj -1555 0 obj<>stream -xTn0+>%@HkzH*zɅ(D*|w(-b(ܙ$C/C>bIwy\ϹD=+&KdOVE)BWFCjmeoBPKვW`"cT'\pVx m{ܾBZ 6w$,[$s_8?M񉱕Kك#)oT)vz"Ю5V*i,qfj}c®a .g:fb';=\p'!ޠ4){V2er.|,S'`pC틴Stő؈n+ UpUV6hD@g*96x҇Q(0>[ʵУ|6QW41XYAUAl婷g, - 4VH*6C6\E; ZBSI/3B0ij_߯38yd7wj͓,=>2DWGӃYGsg4h<^|nM3VeL̗IZGċe>/XObject<<>>>>/Annots 644 0 R>>endobj -1557 0 obj<>stream -xVr6+樭h%G6J묕J@ (aM\VުxS.% zz[g@} h6єd'}<ٿ|3$CLɜ -LF_d|!~,|0E Ȑy:" Dvoע4'Q, GŘu9|G aw_;} н3%ݚ[h0z#.ߜ&!UjWETxbLAsb8K|Fewڙ$Vc8Cڑu_P+Eq̯gHS \V5OKln5j3+GNٍ\L`Iim 2D'"-tcX ƦX])9@5Z9D[,s,wxKE!% m+yN?e%V*O:6M .+׀׫QȞy =&BbHPzi-/0fSrwOP - A1L_NTr {Z?,|CRX -D+?k(OO -Yyڶ?]*kdq᝶JzcwoW#w1`i[[ Z)J(k>/XObject<<>>>>/Annots 689 0 R>>endobj -1559 0 obj<>stream -xWYoF~QQ<$Jn>$X@QyX+)e~3K ͵z!E1%ʼnxI8 љRAazӆO}p $7 &q f7n*IM}x6 Pt :ҳx3x(c!:^cvltDNj9ND8#.!/A''Ď.Gt?p$!,'hBtBxA<9鈎1039hBtZ`^;Xpq!u1?]Q0R>͓AE]V2{ܘ|$tPYLk< tMk*m0235A(1ZYVh[SzwuIYMMj2keT-^Q]?<U+~(EMaJzaYbVc?85;ح6v1`q`3VKZWYiec#tV-{=5YmqI'sKu56k#Vey$\)uV7meǿno-r?N]> =],xl#s@,>2_a;]Z:OӇ> -vk]ϬL)3& MXѫKrj\$ɪMM7݂.xssU}%|bn3a4d {h1kD-rR1_tg/̳!_YDé{R؛3\!Ŭ䏓0endstream -endobj -1560 0 obj<>/XObject<<>>>>>>endobj -1561 0 obj<>stream -xXr7}Wt"7FV%);Q%03 {F{ Yr۲l$/On՘F33*WlD,OJZ]]^ i>Ƙx6on6Y09Ww(sS Uw¹%_+ -,2AQw[kNW~!>ɝޚ⌖MR@+M#;+#FfPU*Llj?+kz~jHkbJTIr]%B4zfg:Nc5ڰu}kڽ}!}v6$Y( i3ZBQԗHO 8-DrU|G. Iy` qxxfiѦØ`HNEû;rX#ѐQd&L~k=d=43!VR0LFjG@"RxPdqAq{9וWfɊ YU]o~vV6Gx"M Q]+B!2jT~d `:&Bi Rz#.w.#aAybQy&=`D(rXDB/o1hĹYpY20v8@8RM2jYŰR1AvU!E|`ES<6ΕlN!_M<(t-ANgץ܁ A#{Uf22pxR9=8CdVI?4r?UB4FV`V2]g(R6@aK -OJ'MyT_(B.(WZ(湀B2TaЛ$ Eu -Sm'XrOE=qoAB?5,^< nqOn 0HIcR.y.H(\?t7*k)j' fk-?u&;6WHN(6 $Ia1Q -y&FeÓ}Ո -a&-i<2+Tuer毼qIf/,5͋]*b[-4}xx@3ޜ'md<_^d#FH[31w@iN`#,Mns@jM+EBŜ49]bRRq%>t.qv13T'Pւ|.d&F f;ݨO׭=ta=Xz+,覰^@ۭ^fs]rE㱇fՁާpң-DJׇtJ츼%B6qq^g=fbw;y +SЦCQr`tR}NVV=:G[%z~g7fs~y0endstream -endobj -1562 0 obj<>/XObject<>>>/Annots 692 0 R>>endobj -1563 0 obj<>stream -xWko6_q[D8oI vm\ Dl$ҡ8ޯ߹$nuCx_QD}D4it: -G4}8;:!e4b OJ7GÁ_pB(Q轋Fte7vںE4[_ɘfާY}/t)R2:KSXI\ ZN^Iı)uA9Y|K+_Ͼf\ ᄡ%hLm{D ?E=n4kDRZRa+'TN,Lb۶GUĦX+TMJ"f=¸ T*@r۽6rVQ2eX$}M fbKpRnv0= &atN@#8F!U[e<3녇50ukRqJ8"L:*O>q&ٺj͑ۓE[<$.wC$yf98쏝 -A7Q RG$ Ĥ2~66skf́˾0H^04ij6\QpGS~nJ4sQuP;mUV NA}[<//}Z-ܭۡ[Jd[.R͇G P't6W5ٺ,&QmQc)]1M -q 7Z2 wo} y8PAiŪl(" OV4@{nXy88U `6pDkTΥ} Lnaӱb}I:Ylt -?ݠh;m6Z -^%f&kLf+y6wmwr%:_'?[(>9 Q̛hZjSk[7lK ٭w -NU?? oSkk2Ѿn9ia&sr_v* A?`Ľ7N]& -^CTzf -=C|F[o/ՃHy,Zzj+9h4 ~U:1`=?6P7nV,=Fׯ!tp} hY٬T/3m_9`KzA8u֔&_2ϱ!!&f`d p[-`:[LgktR9 u*NO66I -;U)qb;mRaridq ?ߴ+DcOSFX\~bk\Zݶ d2`'7/50qK5D#ܞ'3hѧendstream -endobj -1564 0 obj<>/XObject<<>>>>/Annots 695 0 R>>endobj -1565 0 obj<>stream -xWkoGίr[HޅCC>b|a$;dfטs VUE3yιh2Ofp4M4U85NSIx:{+etnh4;WFҒl4ÃNzg4_"o -nywAJ'Iu=+#EtMzIoDRimCyۺ/auDY& v+IV.+jd]mĖM|}OU8"&eɪj]n$Roѭ̓4OI_sF%HXOڬd.祒uækSi6ZJ: ۻUu.I"hc$(o\!?kH!3%;(ZF.]0@hsft8kT)=w"\cf% bR2pr'GF;ܸ}V,tIĵ+Z#F5KJRK?T0[G 1(d{k)F8F~ -F:-r1mfK12)>rȼ.!Ugh |% H'n -ngP/r p,x.,,~KWFF&d N><[6X[PXP 8`#?ˍ Yx2-4 Sĭn(E0.QzE0[M#$%bf3=8NSFQnAA&>nvMcR54ʶ`0~}Tq1RkYtݽ6۵_ E([S6R^޾:h߽5:jONd\קM\ ݴ[^c84U6DfCo ,o./ 1[hE!tHɤ-ͯ:h2J')~p_;t{Bendstream -endobj -1566 0 obj<>/XObject<<>>>>>>endobj -1567 0 obj<>stream -xXmOHίC=%wPPA*tR$.׷&ͿgvpV*gyfF4MttBIq7:шK~t2-,zH)K1m PHcJFtʫ{oQh~%*i;ֲ$ >i+\n-brx$ht b|2!;p80mPl%`;ʥ6Y.{7JaB#IN౬shg EKN^=K' c 5J -vbvOsJOh21~+sI`SZXVpiIj -Д/3tGTxis40GL1"7wz.=YEQ?4i-_f|B@SH2k!chPv17u,GפKvJ -nh I}c#?>_REQ}% ,Sf,?8GakRZ:])RMrMd Hi,bbjR:+ܐ ka3~qsUQ&qϊC 8ay<)>}&`nqMa2wh8ݏwhU~ _TH)F737v -E:鿎hD~ VJ fA6C -*謲\#=k0ޘJ,yU+QsNW䀴?KlNA:]N-# ,% b`tۜwNyESxǣ_3:pt?ǃgɳ *ac /$bNڍpƒ fU*ī‡- FOE+f8at/ Hpߍ0ÁgXmT -}V/)V aE0Tպ`t|Iy^a3Ncr -z)Vp}F_gg73twwsb,?<9a[M}{t7..URc#gӇI4dxMeڿ)Uݧ mKf5< 6u<9&'Sf|Ͻ:\endstream -endobj -1568 0 obj<>/XObject<<>>>>/Annots 698 0 R>>endobj -1569 0 obj<>stream -xX]s۶}ؗ;6mJ>ri[O4;X߳)Ctim# -ٳKy ~SZLh:Invz,i\/+l=?]$(NiwUE||5*<{&6Z:`5ViZ%i]W4Moyz}qnFiJ/=$7w ʺv-Pk މmw{IVdiu蠚?`39&Wmk!+I–#ic+QGʍꆮ)LJt4-eVFyNx+vNɌwk26c=H"44X:bp!+l9HM4 5-s(^/鰇MORgJ/R5W5P)~p=8uGƷD!VfO;X% eO2D}~4 p?pbB|:m5E]+4[= ǢrJBB9щhU@K5|Ai|aoB>gP NlQ|bQ!/٫{l ðzƃ,`4G4*j5Єh'\(4<69t)82G{R*HTY.UDq)r3IMSڌ0{M>|)8O Fm`KN pK '{I=?k_whf x­>J=\x`1 'Ɛ0VAM .x{'ffY1ad ڝ.`dY(WU-PAogwZPֻA4Y1+YVO5">}]+<߀@нB|YEk{{#gi1^a9{9<7K@3Ez3;ӥŬ nta/XewVl(\3s7cQ -O*|W\|b''t T9K`ǜ;Q{9\>v̨9%F%7Cp|^◝"S|_Uw_|1Yˏ!9*7+7)]-nlփl1K%q,߮/~ fmendstream -endobj -1570 0 obj<>/XObject<<>>>>/Annots 707 0 R>>endobj -1571 0 obj<>stream -xWr6}W웜P7v;i#ig Ti= 3Ǵybٳ_{gB) J8tGSьJ-VѸ+hݛWъ1x;~ C4'VK\tɌ/hNx-–3MotdbM&该}o_mcNe^ܩg2Orުm#AXd2;$yc -G( -OXRy<>|ҩ98{v^.-c;nv1'='EJ_/淣s8qdt>}C'wB 8}eJG=Agi8E Jh'Aoˆ'az*@f45*ۼE)Gk$PzOknM ߡ'S:'Bb[f6ՙ5%G@?e͇hF7432aYMENx2bjzGJaD(~Kə&^i}OC^"JTz܀>޼|TjC8F%N[qF6F)7&%/P\u\ji (W0dG"S}[á*G7ВV:@d@*k<5] -@Vy; EEX#qĮSAp@ʿHOOl4ұJ4ް'rN KG:E/:*dߙ;lo -+iȤPn/=Ӂs֯/,POg%JS"I:Xv,mLZYP.e j2 Zs(, ) -b>wp`l_vT`YUP)D- ^YjFWL;ݠ]P$4맭_PV*QETg TS[U-93-1 ȘfBG28w* !a}| M6[vbx9 2`QVlm1 -8so5E5O\2([l!f/kG0p_`:\[SoN['uUnl6(jȼ29Cmʠ{Mp r/o ʚw~vmgy TAG\*SqŬ̀;Vn6@3SFH|{f<ԥ68L25rVYd(f}s5(L{:X^XQz"PkxKoZ2`h_M^i#}1$*LS*aj:(@'Qp)4ڽH@ U칪?iA**Ol,͡(xb;V$5Uq  :in{BwF+`0h -Yߧ{#"'ZZ8I4?jKY_3;eByNYAR^>Ppxw,5sh*8XUTEG05 JF#Y6 wTJSTpvR-sf"b4n0ރH+.& /S?8sc4iE>>|rށgz8<ŃUwP,;GX)e9!4p>O#b`_{`n}*( TO{3wahwtbL ˘ݛ 4Yऽi_rX0[΢bU.gS6s4endstream -endobj -1572 0 obj<>/XObject<<>>>>/Annots 724 0 R>>endobj -1573 0 obj<>stream -xXMsFWRRR"HI%ZȺR  D鲿}_ Do{-Xf|9i>4Qt?ޞ3߻|-(dSJxdDSD^>QM^Ggf_9+U>pm|XM@{(MiLEtb t@O^ǞCr{􋩏u" -! 嵁/&tDc9rdpoL#wy{gS#hvk)ҽfd$0&Ejr{QdC"@bb}(A KKZŸ7&IcϭRT>j/ o& #rm6]ͬT"+[a\1ޝVq>LšvfYSуYq.xq:5QJA(=X -Z$mXou Ii zlޠ|:qeգÆA>b9wߛ=l,E 30_si6}9V2w\JJ?V*;R`ԡu_m^ L`ˣR[uC?1 :o D*dv|$"Z54"ڐ,un 'oGnkX8S(ced@z1a|-Sj"!vҁ(.2F&hzQ=,s k?A 6ࡽP&Cf&:M$DIJFX0#-%*-uJ?z7}a}ް}Z !d0ۄwJ- L賢$DCtYb; /YhUj vKrE5oL` -xgL)cT&UGw9i :MBצcgZ \VvV -D5"c-ݫ!r7o@7^C"Ӱ6ȶKl~W4Kw7ܹHf}3 cD8|fj 朖90,*!"]m<Sk/]5N %a>@RuQzswg| a*ai2Zsm ^=\߆Lt84)Pk -Uoh+ǯ7E n*+7>\H0;[Ͻ Gi=\W'eΗ:J(ffww~0J/߆]!g >/XObject<>>>/Annots 729 0 R>>endobj -1575 0 obj<>stream -xXr}WtM^i%T0$gpg_=L1.l$0ӧOw{oL#3 MTԽQ6“?_>쒦E6󷊖tMi:f٨oqMcvy״}va%9^Ä;v;8Vk6qqyARѪ_W{u8u=ŭOr;)\F~}E)Sezj˿Y}h8fVe(x/EG;ʦФGS4*6WxM3OT5g6o]Ƕ/8X l4҄&%L*[Zh=C7qk -\#4/f#d#"? -uM&Z<:kU^9x]'IAlL`pPY֦*:EVc_ -WT zc; -n|XRei9ğhQ!%-'?-lTQPm -:Ulu3L$׼fwG_ zNjZ=wM(7z=!Df@gK1ݖ@Rӓz L+\uת?!!XWmJ^jxHʂphqC9Y 70Pf0M֬njv8*aA V bwlc;G h'6xajL~G"<5 ݤ*ܭu5S+>=Ơqlۙ·7A )Xw0Uǝj26MmXŨ -EW4\RZfA%P ;Ur@ܕ6J=5/d6 -rBf!m?CS`]05 g5R#^XhPQ*":kohNf₞;=̢N|T{I? su$k-ROP@4h!bEvsIoƹ?Mj -ໍqsQL9e2$_:H{m$Ò!ٻU Z,SwEakإ4CZnC -ɩbpQ{?)uڤJՉDgan$@Yѿ5@ެ4^0*Gت#t1nN[i1e dAY%=8/1]MNTK_af8W5@"y/C,i]8$8 -s ,+xvUm-Jc[oy1VU]!܀uO5 m' IQԹ.Gֈ78=F -Q2NI{LtاNCjwF䖗^oº]  kIPƻf'N?dXtKF={D', }_uVM1s 'FHW@TxU8pH?B (w(JBG0LUp;PD~ ijȈ+mixhFGdy*1G6Á I',#3Cnվ )hˢv~ 'Jgxv$.Ohm۷n0 X#\oq,? 9ο} 9vI;|3/ GXq|EN(D<*qLd --k;W5Mo|y 4#Ouɿӎ\Qax"YC5~_e s9|sV׷o޻o<ʽoq^Ҷ2],{YvF5aVzendstream -endobj -1576 0 obj<>/XObject<>>>>>endobj -1577 0 obj<>stream -xXnF}WCEK,iQNV@/+rimLrҎgfD;HA$^vfΜ3}=G4ɔ` i|zi2gk4_i4Kq0#b47>X_Nh4e-3©!-Åsv8P^g-&gB -{g+=6)όK[qtꍭQJk6QfKe__4ev(ǺKS{\VUF ՍMr }2UfW讱mg,y\tM(h%"~4ßֺpbt8ϭ% Oƪ,Uٯ9@tIh s1[su;9+_* -!_ n9!mwp::]ʸR^QYip7Ýr=r^ZxBbkYnW'!dpianA[I!T+4UYOn d?jE@ 0NM9Am87:^).b\p=5 Nwӏ<ӥEo#U8CkkjfO;7$F%-,n`zFudKzdع -Tr60-`X5i"#n aȞvR5i^nWʃ(pc;uL{okQxpj^hP^S*]D;rskAao~pvȳ_Co+gߠS/Z70]W|t z ~F!o@zG*ːX#P`n -*PNTF2=&;7TRӛWw q"1|.Ԧ+tmPB{5{րdS PG=/w& 6W@)"5\p )tb/peprLx`*,ңVEkGl(WHCfYRoӨ7h#q/_ - -51al.#ʧ{0#xp}cP}»r9{ -['?vkKaMpKlЧVMjm/qASD=ώzug7]?xb!< >Ϻ.jƦn0y}1w ]*BI -1s&[79=I-<.a1|*H {Q/$A:<{|k[`bb.# U/)|)ήNBǗg4\`2 u~{}_Py# Fj2j"yyy~ZT;s~xWbປu6X!L]3B4.VY2 ߎ3iOӭ1 oJ2 FxfBhZl*MQ}% 9z0ġ`{)ې*Xbq=ym4<'!,c l7*JJ@(@!^EdxzݱGǒ&sŠ/XR KM ȏ){,T8{ (YK+UL,&lX`j0{ {:JFV[o,V=P/_bӗ#p[vh+{QN|EeaWac)b03uُy( YTu6L=w%}S2$B+熾A5&,yV`*oE&o4iz?Bśsn4=L&9WMcUl̦)vyoendstream -endobj -1578 0 obj<>/XObject<>>>>>endobj -1579 0 obj<>stream -xWioF_1uaT$ZeIP>@VQȥ1UK+}KJ2Eѱ;Ǜ7o_B_HN`HYpJ#V҃/Na0Q4 BurZw?LFpGfDaH(!gxJpHwZO6S1_|CVɄI\+I$>HWTjKX*jci!Q]UR!)%ESVZWJ+6[^JXU.I  -}rfa8+Ȗ6F-5ue*O{KX4uѼ'RT>x2.ZS "-\&*Me%KKiO͏c0Z')8B[d2] Rb@l&X%|o$]9\н hq=t׊PmPņޫ2(B8)1ג:;'ry/ke2`mO-3vw *8UIat٢ -lhLV|3a)a4FL{[6zt[uW%$B' -8K:42+e7+MqMi@ekgfw԰ Y#^W ;$r0쇍QRKc 0UېR3) QMqJׅ \h~w}҄t8?ǒK_hfcg^kU!Qat* > -es+P[nEVZ1xMrk+YN۶ظ>юLUX:^3mPq{pX%l of""_G]ɶQFSmE'zBXJfZ N`zzL(FY!̈4i\CjQ0$+BB܌A4 F˟8m-#JW$9KioA.}hq 3Ш[ny:FJwNT!!HQ*p2]eZq6R*Xߥ-S -FKFqҒ{- -6v/(V@资D`V`Z镉'IECa#`T>/XObject<>>>>>endobj -1581 0 obj<>stream -xWaoH_17q$ECW 8Rq'^'Klo]7Dߛ];n]N:݁*Jݙyޛɷ1wLΦ'hDi4|cI7Ϣ8ο9M^ĩWsޟGycZde:"%hCɋ^( -6%Abc&Dn2Wߝ<{]J"B0dU2#G?E@bO qğ__va<僀L B+Y:K{VNeU)[j^@ނl:"sc~?aH8DՎSo){PwmzmD&be`ꦑ +!(qţ1 Y49Eq'5Lhўjfl% W`c&Y4Љoh`_}ôQp\09 X&[)l9r֖΁OLX}px#˪7tw%]o@=丆'^ht+AB$,:8.]I+I4kYk̨\c:Q8 NX6^g%,+\.3%w~f -UBhLTh93 "Dyt{,%bȰpG;V@a7@\x9e&À*py'x{\6 /*~e)"iȇJ*=X߮[--뇝FV+6B^J|Ǜ3^4ͣm jyl 0Ȣ ^•S O{Bau,#Q L5\5nt'D(cpZ>/XObject<<>>>>>>endobj -1583 0 obj<>stream -xW]oI|ϯh%Aqx9%swg;ff6UNޟ'4Ÿ<1h8'xFRyjzpNNhZxrIӂhD,H746DSKKݒ* rxZ+͡4ɥ>J7_Lhp:#;<~VMז.(l庖C\^HtzBUH*ܡI>Z5\7X%QO΀ #m6dW2WB1z(E[zkE=0*7NpuȬקG'{ٴ^{FԶo=HкQBK q&eCbBZ4/>VU"_J碪6)c߇jW_G撸O80gJʎb?9Q-}psD1 ̸|\rPgS -X*[3]h os|(f:2Th|iЧ4G1ݗe8%4^K}U\K:x4PitMMg~ ߆f}5AA -zLґ4F@>2#ثF><0POG,)G9Y04-"Z;+a]?iW[4+4= -D6Z@|Ԩ'J7'.cTjEF<ѱ{NTS_Mچd@[nD.@v -j)P*kJSLÀ*Oot#\UoB1J mH@9' =A}>2`SpNUc&rh@ٯHhZOjQmI\}OG'CvAϴ[F]'%VŠTK21~~on,ZFݴ^/@,{NYwM73^33>ل x{D`+RnZJh"f?åYe4YƁQE.;}va~ps#1'! #r#ͷ)WtOC_ߌ.co~g  P/pa$9 s -9 hdGnwfMOU,AN-`@.A)I몉IMxzP[`f"_bAWt!^XFJcN/6ɲ,yȏArQ/TQ-=ً@e<ݶZb߀Upō&n3E/n:/.>:N^^lV -M"r]F^}v -DLܳwq <$T6v8$dyrX) @sf`G/l;8 wwmWkW]0YRȠ']9qhpzA []x;)䬝P%dPD̻(1@/%xD٣m&^*zgZ7;wUviw9P|i"dO/]WLP1'qIbgc켸]T} -#m]P:shw= -a~9c=+A~I1'g4>5V:oN8xnrtF2Nݔj źaڜٗx5tJ';{/χIX)'_Ӄ?)endstream -endobj -1584 0 obj<>/XObject<>>>>>endobj -1585 0 obj<>stream -xWOH_1tVJ$@VT8ZrREILl&ofm'*]+xǛ7ofh#pBq~FhQtBat_Ӆ/v8DO_F0~4dcXMb2|<шf 19,!=,~5N"XkZ$fzF_];|j -:g0qԚ'~)H󔙥 oe}+M54ƧbID+}H6fC`*^Sa6JT'0mM\A*x#ɡFCU-O4eN{3,qfwT~Qۻɵ*JR|8KAPiEWz pb*-<~б0Jn@*Wh^?832\{7,8hk*ZG͉s^ @ԖC2x^0aLj@ϸ {pia,M:7cj*$6}=fκ)sY- bKXӡ0(CUʈνЛ5WBP$dIv+IYďkD'EΑ$C[Jg%1)I0x)P>Igδ%E7y]8X n}&e%S^7zyCZ㾎W:^q0 %Ei8wy.u)!Xd -$ҋ: ])6XRY*Ƃ٦@'eb>8jWOU㞫赃,, q@1"肩 - J#07}J*\ :gێ{KaDOIBHX3k+jqh=_){[>>3<Մ߂N1.}B,ʫȮCm"ur]hwʘ?ze=] -vzP%fEzC#}7DQq"#`8{Xp-Y1`U}E㧑oolv@ZLF7Й۔[pgixL6h"O6tӢEw umUDPK]Ml~KB]5PQ21^&!bqTꀒz߮ίWR!C+ahߪǦH t-&_M?]TC'9sy=sV" -[򂀅B=Z$]B> 2 _V -E`x$UZ^h*Wm{]x9KފZ B1w?_s-G-6)@yA6'CӱȒ2_YaQjQ`gԁǖ;7˽- S&9:psro5D#m7l'99 PozS[DێOkKMnE9/m3PAˈ:cV r5d:,ٌJ+`laŶWqL,{w [O-/a0bq{:Dv ջ1D2d jbu܆&!W( }&`C|ޞ_;{ϱ c팻 '󶒫&3 C_^^(NNp{ͣS~av?.bendstream -endobj -1586 0 obj<>/XObject<>>>>>endobj -1587 0 obj<>stream -x}WkSί* [%T{7!<.CK#<iF;38>G0*9}ALCihBiyi48d<ÓxBsC(qfNgS|NJ?}4|]zFqL9MfSZdSCZGh%4J?ѭ5*)5=I茮h+4~YI%ØY4K8ѭR{%bK2#cIX+SO%xrSfOl,Kk_GSiejwLZHS& qhytRԕ*]h6JZ\ԅk,qJhNz+j+Q$bPƧ~Ub/o8I '>Za8(j!C*)32хp$|ZU#p:w Jy–HpԲrHF~-F7qaSK )ЈP7ԻOy:6ye'nmkЧze2RcBT|]Qk8J\Q1Jq򈫑?j8Hυ,a$\a,zF/]^ UUV sͥL^zQ-xe`Szea-J+p<0 ޠ<nNxlKh KŘzW?687iwSc{a0K`s[ў!Ss =9kE a?^XNOd0r{)d(endstream -endobj -1588 0 obj<>/XObject<<>>>>>>endobj -1589 0 obj<>stream -xWMo8We)8q>44rMTt$*f#*Iտ7d %Q7=N~Ζt%]r=;]W<ïT Z.))HnF/7“+-:,z͎K+rO;7X/y2e:^K~Nl@$zQێJUIG)T\x05Go.:!-rd$)4FkQXNu pēq&M=I @Q,R~2,MsSBdUZ֞*U]pjPɼ@ǹN3㍼+{C_;֎vZUJMpGU,nh+?y{y8:SsCK[|7#LF(ʭ}db]MeCϷ&1G>=&œy^U`a{f4eDT V]GH~1KN%EI9ܷ -`#m -Y!Y vT'VnHѢ-WdL& FZc,K+pHEZ&Mah -Zy "Y*pBO# `K܊]PjãA0abۿ$}}vNfeebMې:6qs߽zӰ۰"f5-tL޾W#GjrMߡX4S,zysX?-,ACs17@ލm۰A|vWHΎL,! -x3$lQƐ!HT%\>}; HLMņW8E6AS -x™B!xJ࿣Ow_/^A -@*eRH5,QKMcH>/XObject<<>>>>/Annots 732 0 R>>endobj -1591 0 obj<>stream -xW]oJ}WԗTRInAʕ<,{c{:8UUkfΜ93tǟMt28>Vv38F#:L>e4FҌx i4C-%-lۘHżs|}F>͗i<\ʒ&}cK ?W]LNzn]ܖ:MqO8yW2Ld Aͤq]L 3h])KR)R$*_ pqB.5`bJw=ke(uH02,Cl -|:[V,RIeRIp'S%#Hj!oR{}FÀnh9XWa޳E_{DVys$ȟIJ祒Z:.V̵ܸ¼Wy7npDkW'2Yvq~r8#NIϮF?φ -%^+ݓl?t' -a l$§9#ÕݱFE,Β^"F#sXZ]ٝ.a/anHEfO ^*P qqGU >^Mg)`36 c*|vy BU$8Ea7AM+vq)}sD}{jˣfe} 8 Jz<>\\P%P -`e°źز߼Ԉ|Ok2 WTuHi`C4sW -E4}4Q8 ïؒ*4)`[jX@=瘥38 -*T2ѕIFUм!\ +1LýIƒu l&Рeu.ի~ɉ]pMQP4D_K+آYZ޵>$Y3Dj4a@"|k4v/qFu CMf{L6NɄDn 8jb INt4Jj_WB$|zgL -5 !ikr2D7^|<3a{/ v HGEuAʘj) -1vG`+6;\ N,u¿@ lh\t&5(-{F*&ad; -H4BJt)_Ô ̂9h.-€Cť6zi[֯)9L~0q3njG(`(耵?;;/A[X'? FQ4Oq:d;wBendstream -endobj -1592 0 obj<>/XObject<<>>>>>>endobj -1593 0 obj<>stream +x+2T0BCs#c3\..}7K#4BHP$YSO! U!?M!3$1''$3?O3$ BOzs=s3 -!) #\C&endstream +endobj +1546 0 obj<>/XObject<<>>>>/Annots 642 0 R>>endobj +1547 0 obj<>stream +xIss 6_Zm9$Yҡ36EXj4ѿ,93\*3++S+¢ }XTjpq>,qCQ'#=̱RpYN\NeҀL:t9Y8c$W$ HVSyHa6بv6Ivj5YY&lpVW8)HChQfއ(Qb-cA#5 8Xl(3E-c$Y[tNDiY+Չ{Qa3dWV뢴 :,:,s9XS\S.vQH^DQqưsð96*^,b5am(*XkvXXlT<bYՆL]Ĉc|ʬÔTG1QljI/6k;zdaX7uZX`kRPp +d,9/S A21lU*uva Ϭ +vgֺJ͉:C:z%6E$BjȈFӐXn:ق8aXlQ96:EOSXiϕ jȤǰ֙_Sd㘝Y5bX;qN}5{ [ +T1,vTbU!˞ð UfTfV0r*+밂l y>!saD 2K"z,tD0,fYltPrıXs9:˙uX5{ DlQlLa̒wbXYTaXYa]×q41b&CuX۵CYaJvrXpÇ8V '>GکDz K9: KL): ;NeaF 91lz1!ɬðNYa'+ٳQ=zTÀQ]b不sV3YAXWR&=V40,#܉ +dŋ±VąUF8c4Xaj: ʉfaҘyYUٮʺ qY* +C!1KTcff0,4s: P|"0,ٮl:rfu Acݺh;߹Q Dr/r+} T> zh"l<4V\v%#"8ST&  R˖ I4fTk Am"#'ب ]L4 [Dz tF30괏UJŀl:S4s2~Y-YYLFZdA8;LR-( !ĜSeA) ]34>j1ĜWJEd4>hzeLF%cFCsH)De%qr\ox9-'X݇Y?nR (p,2c9M#͂t%gO_ 7<pymof͡Mm7k9E\{O.uجku߄!|]w.=vpy=uׇM{Ñ7m_B~tmC4u۵}s菓g3ɔU]ڛZWґƕz޷h}g2MH2Ϸ$\uxkMyɭ3 /= “uUZ'Wvk:i;5Z/.w -kR!W3 :6uq&fC6a|mvݑ(V [\nwZH_$C REx$ds2jeC9|u}0.]V7]~{r&~o03N󧮽?\?b F҉o2x$J`^t nR6GAK^:oDeEn}_:7bp׻J跜?v7ץ)c^u]vʼ7 o}hЅfwg=MyE*á(Us~;O߽z̅doloǾ >vœRhUTH~T/]1Gre.Ir 1Bylo S$@YOuk*>cniRױnR|ݏ!p䇗/0\7׶>xs!W Uo f=j8ݱu޸cDn&xvn.fo uۅo6}C +˱n`~zXL4=wALv> Yʜ3MyJ:Z ˦b;{쵕чxjh1?I;SsIC[q'iwWk\viekZ|4Kqh8:$`^أ+h4fOK%&\odcL +I<endstream +endobj +1548 0 obj<>/XObject<<>>>>/Annots 644 0 R>>endobj +1549 0 obj<>stream +xUQMO!+ޱ{0`s4ݍ5wАyyo/&!HJLpA/57Vs>bak\{HQ]VBZbb¸ĶPBQ%&2,hV[Cqƀ-[:v!%6J[+iGGH)DOKGPCr{'[a+(EyK'܍~Ð֩,KMQ܈6? )'Դ-mJeͽcDpqendstream +endobj +1550 0 obj<>/XObject<<>>>>>>endobj +1551 0 obj<>stream +xWn8}W |hi4[_hH/I )) I93O=i2⬗ht=Lht5U8'Ϻ4|[3I;6b륥QB:ͅ/aѬh&'V_03~?\%LBi:~N8z +ּ!pJJIZLjO؊ /df^茦Ѳ/FV]\4\] :;^1SNK>siۡ?XU{mA:׽Vq{>fL^d2Pe;k\WBɤ*6~cH9ZBJX+a8I`lሩ[V`" K%nDGУ6{Xt!AQIȑkO^"9GI?_1w&ɘk3LqE@rH!ިMtCUU,ikNerDW TLt8V(xV+)-.F' +vBbCm)H>iZK-- : p(a XʄKdx0V2hD +:BvTtI> *< ӯ0Y1*[fS` kNP rzQ3NPtwPyc9Oe\V JKpQ ++ +bThНPГٷL{΁[rkhrK_`qN|JZ=>Mnl7jZ<=BS-'^4ๆ]g[yո|t;Wc0냤ކ^lm&;faeɠS+3.ֺ8~&,릉Z+ 9U`ϟG )^1*v1J` E+@ +~U+OXF9QdsW`ERk+#+h7 ik_ޡ5x戺v$Q_xnMi.6Z5yE# Q~^$3A\= 'qs(p&?< թ7endstream +endobj +1552 0 obj<>/XObject<<>>>>>>endobj +1553 0 obj<>stream +xV]o6|ϯX+vNߜK-p{ PPe":8E>Y8_c_dFiy6Fts;_JʛE4Ս8߸Ϯ>h<8GbNqFH0QM7׈JK~#<)G*c(J(F*4%/y[Sc%5~$ciUBhq%h8a &^Y6CK>,kONa eЩWF4;\L՚ I8dU)ޔBid(Fr@.=JF)Bx+fJicv;RxY`RBZ,j , +F8")dS6㐻 AU2=-:ѵ.}/k|K-!p2mFn͡OtQU'J6s ڱw܀"/^dh/T'8Oy`G꺓UcJ醔FVGّ!}%V(렚hӿ7d;nQsW&4^qf7H_G(d~~맆]y +Č7a0ld8/d^tB1Tɖ"0?ҙ9z'a$iZG;t\Ԟm5Kud>IV +009)=e‹>K<T Y7,1A9o]"@5ZO xֈY<N>@up$jW$P~wk%Y %; +ۘ-߉re+8/L_+֖,[*XK :xZ;|ѴrQ:++}A-?s;,TCOPuN:;4",":XwZϿmA[]OC5oĖ;u9voS">ɻ8t~" nZ9@gWa{0;E;<'7endstream +endobj +1554 0 obj<>/XObject<<>>>>>>endobj +1555 0 obj<>stream +xWMo8W |N8v("^ -Q6TI*JPI+7oތ\fnzGx\?^S!/ҋ W/W I6c==LIUE*ST6|(ﰲ,Y:w&PY4}cPMH߅dkƛx81:7fi:f6tqRn-]8x1/)R;GýC0]CЉ6'Ƈl KKOr(yACf8SXC]Jz0]0ʠmUU{sij02]GrB+-t,YG&J*<x*fc*%?sw6;F)eZ:q=fdLDoCh2<Fǣ +b =ʈ),͓QWC7Qqi: J*װBW&p8c(z` Mqkԕ^SbsBm;pf(A &ѶZS~0/NeU>N24 !-.yjgsno @@ b8YV4GHh(dkBsS:<H7c?},byuɃJB0w%i%ݾ{EI+zyT$FgP+IkVbH7vpr _L:Z~ >4< +ԑ;yZ#V輻L8eiƞBnuTiDڡPi  qu '`4hɁʂ` Fh}dx$qG<شG^ǥCA5Z ۮ4 F O#P%$0H"NXsص!jXAwBX{N26> +q~:v7+u">qHlRR"-x *M>X~^1;,W?0Zpw< Jvwè)[&<)8r+:;&l7-S–fF@ESZ ircŅ$Lj3ƢC!i?K{vYmyQܸ6q0Z`4*$^-v_~~<}\="_It|L'߫|endstream +endobj +1556 0 obj<>/XObject<<>>>>>>endobj +1557 0 obj<>stream +xXn8}W b;,Ї,tw}%f#*I~!)ٖ[m"r̙Q~\icOfFyu1F4-Ms|JZ_[^\k\- h_f&'i_"K7Vwܝx'sܽ(= \Tt+?5~ £ $'h[Yy奒ߑG2&pf3ZnwWj*t$8@h|SH8*˭Zɂf哠xuʁhQZ83rRɹc]^Vu̬4Rt#DZ.ސ| H$ 1T|32c4pY] (Ctr(7Zo@ @HJx5h]Co9C,K&|imMS]3 ̚·]$HeYF;fbK[ f/Tg#ץ8Dx0t{< C-l,S\gN4b WH-daml/àUʶUwpyHVp-e*kdJ{ 'kaU_ȴyu~|@  ު,L Р([%1*L=ǩObVVF/[#< svBCB>/S k֞s]Ju7lQg`2lh] kYs`$Xe1D/0 O]k9R}PQ.5*J4Zn5JY͚~J +TكۥȞ3Ǘ7$Di4-1WtT TOmJ8Ω i\m,zCR&7<$K=_͈鄬>+N]hdU#̡&_ccgxM<:](d $/aTߢT+n8aՑډ:9l'뽦S6e/|ׇ\XY;1HB9g c1¿MfsbƷc@U|<(GJq8Q ,6xkjKƨYNZf5l9_J)-XA.!P"ՇOP}P: 4U[i|t2?fLl>[ęs3c?./-endstream +endobj +1558 0 obj<>/XObject<<>>>>/Annots 649 0 R>>endobj +1559 0 obj<>stream +xW]o6}ϯԊf;,V`MA7 @AKtF"]rsIJvT&%~{νWΆ4!F4R^ t2&T|~)iogf?iܚو&JZg qyͻׯg7iFEq@˼)Km:ʅɂ'cIXSk|3ʹZYg RIn-yaӝ/ ?#en?kU{~N*vvv0FD^JagO1U.2:c_79G0z,N|Go(xOi/-l4 5q?=r-BT+AO, ܺIe6=HJυb%\Kir2<sѻd.nպD1Fܓk^QtA12ךG1X;"+C-e!PK<>-y‹}J<zHIm~Jt_xFlDN"î ƃG3cE*kbzF(NbWγR ޙK-V%* +Y*M؎;3z83ဧc:;Pu'44zjBqNT*SN'rg-O0ðhK{Ra\CƓߘڙrh-궒')ӄeQ2N֪)?)#߇Q&Rsɼ1Ѣ;皒5}Cnzq'W'`XbZ !oUX RE۱ fs; [[ЅP(UNg9ZF@b.( Vԭ5;.](Ni!O'T,8 fp(KNZsSS*#0^j1=2 N-X +Z:*lU!b{P++q_ðBH?x~R!!hJn(Mib9B N5nB8GK{$S"hjK@T/?J[qz6g]wqk +5Yu[xW ;b +rx lwZ=7U(:Ӏ3RZ:]{!)XZ4R0ɤY\c67h}Cdtm*^~絗arwʤɅ +Q:>pX:N؋,$R?F jb ++f|,A q,򃫇A41 k6;b8NakkA_Fc'ҪdPjJ%x?=a ķsq3Ocv8K|L3'kB_6y]AVy?६`bx$M`2gl쏳cnendstream +endobj +1560 0 obj<>/XObject<<>>>>/Annots 654 0 R>>endobj +1561 0 obj<>stream +x}U]sF}W! Y@g@Bh=LZKg::.ѮݕpsϽ6(oDӘ&) B<]mL $q(Aޕ gknnG>MaSs;I2 f` +iNLHY~GyS s_Py( +1+nvU=Ԫ9p(YI1kubZó 3ZW E6S';rjjunH>4a/Ґ.,)gGjǬUrf8ʕ4*K]ص:H$+A50 x p+i/BQw@Yk=kJC;~dg:h)$@UWUasZf]+eJr^8H +m7Ah7_ O:W[@=6AQsh!oP+ +Z qby4W{X4^ FoDQےtJU'Iy쟄l^H_bsoߑvNAjbFϴܬg| R(ǧNM +c֠mhRk~k'  Ø>/XObject<>>>/Annots 657 0 R>>endobj +1563 0 obj<>stream +xVMs"7+ +3|:7ĉ+ekJgF4{+\Fݭ믝Ii`L>>ٿ<ڙIF0RIh]AO8F#fNp.DR HIz鈮 }\:s4[dJ<'j%j,z\p$* XKW =X] +4S7"ٵ)TޚPD$&<9N!U_iQ\WxbHiڜ&ɘO\wfMuVr8CWڑuDuSTEnc~%|8+Fگ8B/i.ͭAv ) + ,9̖!UK]i¹9vW{m*pMhR B;C!%(4Z7F5#(cm%j +f:3qz7vFeI:BL09ˬ[āendstream +endobj +1564 0 obj<>/XObject<<>>>>/Annots 702 0 R>>endobj +1565 0 obj<>stream +xW[sV~WK'ݐLlj$ݘN'΃DQC L)ݳoo#\yD#q)>kEkf@t#gJyDTNR9ݍtA9ހ;cg6hp S0;%Ī ]LGTP¢%z^NϝqBs +¹` ΄B_=ϛX6xAEޞ'DCOS10V= %vbϛ$} "‚3YUiFD+rbP W*R״R&mmVUu95QU:Ҍ(:CN}Ssj-Ri:->\|qT*YJFSBwIL5,ZP(*OZ_Yһmv2Ui62P9qs8Za[(o^"JfZ繪 +% Yguc TCi|Cx[$%*B<ڃȚb 5DZQ+*gԙMbT#4S0%`tAXl,{RT" fY3Z`ߺ6~^&.4= z4(<LJa K8{0R4= ۛ7t9CV^_|~qpxlW$mй^9+[D\IQ#5-kT-PE;_qVZhUuJHKlבq6*E}>آe$/*CD:c|ʴ~˫i +mVBSkxgf[U6]ru"ܳ~w' O}l:;,~mh $PKaCei -z[2O:ow܃ʳ~LVv9zPV]̖<+ A,8J7w%Jn͏%#.9/[Tm`ޏ S?6DuZrG:~VK]E9١YcsrM$+~еc^X$J.h^x%}ǮjeH}IiCGDX# (F\Ho +.B؎QqJ#y֧]#r@mcnߜt2WёLZ9tZcDS︦W\^ 𤋴Y~kgc.LjG-ޏvZ/vw3.֟1MR[[{tgc;_8th7џendstream +endobj +1566 0 obj<>/XObject<<>>>>>>endobj +1567 0 obj<>stream +xXے6}\%Q<+ٲDT&I09i\(%WmyݧOn)MgJ7dB-yIۛ[Ni嵋Ւ69adBlK tk{ylSU;%,F +.dE˜c+{x3F&0-/4%+^(SAsZo6Lu!O>-nk*E]s)b ~dR/=vK b4Rő~o9=R3"Cw4`h~F Ԇ$$m reߴxɽ˲lOܽsGl,5g@xy\f/~Zhq~ո`qϵx|]HrLS2@RUuzBS8|u4\U gka-xWd *0zW9 3q[[t,?u]$RpTs-G#\TmqtcE)~OT/[=?Rp A)Xv`!sɔ伌}ID4L^=^.Q{G | ݹw/4O8[H J7 }+L(egr8 vI,S2He&5)VwZ[˸|ÞeFCL{ f'*sݓm?yEkGc}=&54$ +k"j `r+sHXH IȞF!c)w p F*ۢQf*ʋk^;8QȖ)Q4rHxu6S +:rQXȒ!0kPnUz%=ujH;'GGU/dh%? -B7jM+MKAZ@/ο* +<dD=qv; +$dZ31d%Bp_PEOFv*p<2T\GCy)D;_AB7:y\xsgIQB]1xɓs>gFXŝ d Zrƈ\.5*Pڙ+t6 +hWu|L3W3P /KT! d;|$$qG{)Y$J<}8nitXc{dm1d]So<9 KXX4gE.e>hl'?2x27ħ{k@C +0:)[S-FGS!k,] ʏĘ.N FޮPs1L +d>_-+Q ctijѐ+ǭta QMn\KnHB1;/Bf9>DgI\:K +F=GFF;^+4̸<$\4TʵwEț5nJֺY(xdtd|j%! F/|hH‚u{ WZi?q[wȟdXCS~s-Pqendstream +endobj +1568 0 obj<>/XObject<>>>/Annots 705 0 R>>endobj +1569 0 obj<>stream +xWkoH_q7[ ZoI]um UR`0=Ca;36IJI=uvQ?t:8;}:N>'8=:e4?GJG(D'8ш }< )h`ɘfҧYR&Ts)JI/g_qݞ,Z&qojM]̕,›&`0 +Pޝ$C-Z2ƫ*Jql*]SVNJ-etH\Qt- Mbmt>ku_]H ͷE؂q8ߛh#/tH-ѠH$dTHӭz(9$vOReTeV2'~@$77&BU dpL.ceR'd2 2Eƞ0[ ˌ l\ha{NO&atN@ft0 +g5C,qefrXg + :Z*J&}gςf0Mcm'1SbVaxMP-%s.Ra͇F P't6W6ٺ*e'QmQc)]1/L +q wd6^o?\;F;CyQ: djg b`-)L_jK3 {Ł{5ÃlM+K} Lm/ro1n08s[Llt +?ݠh[m6S +ff&ksLf+E6w;qnDŊ='ic;j9OZ85Zٰ]'YSd<`bnz{CsƶV +ZJ[Jٷ0[&rw*% A?`ĽVf=K +;jEu&a 'հ^B![`zkJ݉ib7 q+'6*҉uj/b)ctB J2Gg{G{[=RT80$wUٟc=ly +3JVF-`S@C-Z8Ch)%rhds5I[~gJ2l^*%\R8o݇oZ"**0Z|m#r\~a74۫n4~8X^_it\iv >9`ܷ,?xGwاfGjendstream +endobj +1570 0 obj<>/XObject<<>>>>/Annots 708 0 R>>endobj +1571 0 obj<>stream +xWkoGίr[HfaaCC>b|a$;dfטs VUE0;yιKi2ј3H4Β7|Gw/o쌲)ϧZ8O%v?&{+,rdLA(Ow3J3/xnvMcR54ʶ`0~}Tq1RkYt{mkA=+P;3G%kR'tm}uJ{ktNNd\קM\ ݴ[^c44U:Bf#g^n/\^pc+PCD:/z4"$K&)~L6b?:UHendstream +endobj +1572 0 obj<>/XObject<<>>>>>>endobj +1573 0 obj<>stream +xXn8}W]]$%ia4Q46. Dl$Q%=CR&m֡乜9sf{CgHRV]7'4lG1r$fYoT$eIWņTE./(2'?3CI򐔣6ji2s&{MIogt4?Loogg>Ӝ~i "7h6d` :(e(\p͜ j'_f>ǔchTr)#?dV,eBW+Q-*0HX]Jr-IVDZZb9}HFZ_. SK,9VYhL4:SxGݤ-XKh2]Aó[n`L=B6 I2h +hg +E NA\4c %EXytvg\!}*ɞcYA٦pvJ"M +LY{AIeA_:C*-8WR8<\8r U湔.-5ԈTW;AfS>|R3X׉!п@(D鼇L$`֭\ x7ٙHZJGT_L%WY517ܦN%J%C˴֮tšY8U(}ݎ~vV +ėbnMdI +b%RL$4‚zW>Lz|?69SgZ 0mF'%;/ouK/9ƜycY +b5 += x фaoan,VcFg8@:5 _\T+_|ccݩG^wc<EK'8?:ٶhPȰl)mE<a +GOx UY-sjQK% +g-n {%@G* ]їѿ7[Q tB@Kk_*eA\`_E2yxxa& /8QFo7N|[ĆNh7qىs[pMx~UxGa؃ƙ{16p0W;?>ۛC0"-DrvKTrʲJ;*˚a=U@Q͒1JFɀ9RMo ~6]K.yа\gM( @ܤCp RVK󪊛U `?'p%Js|QFl~{?}/~Yg=x|>/XObject<<>>>>/Annots 713 0 R>>endobj +1575 0 obj<>stream +xW]o}/ )D}Zp IkAňR3ܙisgHIw6Iޏs=׫VJy2unK/?_-dMUV[IWerMVެq*~W{ܼ}Ξ7-`Nt|)Wy:H5|'HShUn &1ph*>C<{O`H9ml%2儏M4]%G4Z)$Q\n$N~dl&-EYS[+R Fe N\ b{5%(`*^FCAϤOglDuC;QnҴ SZǔׅ.(+wg-m|k'ڀH Ll ~o͐TU T{3W#G\@RTCmvx8Q/g*IobNކ FcYKqnQ2''i϶ACXJ$S|#ZrFdףd`Q5'*ӛ-WTy% ol*U:x r|Υy Z"3iS!px8B` -,Gjdgա ޹'O +c2u)tb-\@x>jӮIh׃E3 JHVP& )QhԅMzcJ@P3CWBܙ /M@1"yb)rAVSNqeH)s8]4(D 2tDed'ַ>np@l +f?p2U \QLO~h +xs7:1kQ0tF|u& %,L-t $ nC1pXU B5-=ESwbN&G,z.0ȭ>7XޔTI# 1r`UU82a1S8AV)MivaUe 0Ҳbp TןU3mhD%T8F[BE:'iH|mg<ۗ}.Pghw@A +-SjB?[z[NE駙,edFԺ>,'g Bs9nRͥ +prJv&qyqcϳ~E 543X{:f䈧 +Z}=+>=n9n;Nө)]J.ݬh]n?T4.].ݡR w+nxczN]T5oL&endstream +endobj +1576 0 obj<>/XObject<<>>>>/Annots 730 0 R>>endobj +1577 0 obj<>stream +xXMsFWRRR"HH%Z̺R  en|R7=],3u4?fce'#o7ϧ'~{4ޜ2OoRZވ)~8`'Y\Q ^^^ orDVdD..LS(W.39MET_*]*K!E*REfK֩zJmM=K K~*Iw_z2?}07<}r3kнJcgfoٜ*UI8v6sfE{XmiQHYK61UFՙNR6.5|0t~1ՑNSPA D6Dnw,G m}i.N#ol*Lx:B7،I@کܝr.ॶ2h5tahT8\[ycrW>J*MF*Y6j +qh2Rz|1z-fJU?v=R=v*oD "Dߨ\NHEOTN(p*7@f+V-F["{ Nԓ64 +}eӇ38!\P^2gw=N&D(S lXe]w<#=,iݩyf*um5E=(Gq炗ZQs5Jɔ1KA\MN"DZH``xoPEeգÆA>b9wߛ=l,P_gT`Pls"-V2Ӗ;.ړҏʎ(uDvJqqsUQQwuСe7?D*dv|$"Z54"ڐ,un 'oGnkX8S(ced@z1a|-Sj"!ǥQ\e2BM0zY8Eֲzu4CfB A4!>PIl)QiRӻz./  ۧ0@ M(yĹphgʝG%!rR3O0gxQ G RSdt/g_Tjk,LCA)eޤ*S9'-"{ޞApIX6Pn.@N +dj'ixn;|KXqUYYJQy\׋ψFc{>xkm4fxo*uw ;W ̠o&ahXg>.nicAB]~4@d]um0<*@ iaj'В0b )F$`.b~[;,L&_~SMDً6CsozXcug5BE m(Dø 9:_e`2f3\է| 3ocd=?;ڡ}1¹g@R^e8ؑ[b1[Lwf>/XObject<<>>>>/Annots 735 0 R>>endobj +1579 0 obj<>stream +xXr}Wt$HFFX٤< 9`;3=0m֦l`.ݧOgSϔ3/l&o?bR|(l~Ui>3|]/I_qͱfɿ_T_]~V5߽YҪ{'*/^"6Y@i~h~C$^m]x烼t>N[]لS6uU]lZi|Ֆ6d֪@V%d]Н;F89_h:mP.x姲`<f 3{]O(/aVłt5%"UVt`FuJ*b [U:OVk{p/.٘@Yw5CiʻN8 +o5Ǐ(鷃wHUvnDFl'N +I|1>z*ilةSV_pI۷)3Ay +8ب/:#&n@6u0*aیQlI0iRj= Z`iNδ7;^*}mj,iW +7 %/:$K A,-NQH61?j"J0 Fə:{zk*9"Bʞ+H(Y*'X1 7Q{V a#W?#^^>|abbSnDaPNNHf1k"Nv; UӘ,&c*8%I[gJe zPÝ)h vb Xf=A+Ͷ25sQe9 k'p'-Nڝ}V@P#*t/;:%pH0N@UȩFЯg?/ yl+m[iӢ+^)_9#0X-E8d^DjZpGEM +zd}F)1(aQ V bw=|26w2"jP}e>*w9^E&╌XANhn gsN; ff!F*svrU +8JV&RUqXұS,Mu+Kד0Ku,>hJ <BѨY hEs~ [w˸5%$_:H{c$ò!UZ<)IoO Vh} S57SkPmrEO\3P0w2[@ _j(M Z#Pl]t}@YEZL%?AF._EփA,nt;;uP-~KS15sSLo1jD"bY_Z4o@|o\n^>|>i5 l*Te|^ELɖG N'wArjWmu@ӆCA`Utf >l"08k.حbFHdbG%P.`*hQ0R6]C[(:Xodx<ׄ}t,܅z0>ru}V +\pC}5q$^ggV !H7ͪ2 X4w ?5<:CA ƏPt2I7<*d^%D%^覫fNUֳwg>v툄w _W˫bIaՒfu׳endstream +endobj +1580 0 obj<>/XObject<>>>>>endobj +1581 0 obj<>stream +xXko_1@%ٖ䶸:qci}Y+scpVY,.R4@cg̙33z0>h<A?It2!ך_i0Nq0H&48;mu<S hãɘf~f\W*z0dp2[*|XkGRamEӢ*Kpkw5^ O8]?:Y'Mlqٗ>'puzUlQm'Y&S6 nsk[g8S=:NNsUW\(RYipÝ\ES9Bg M$ΙEi~h< 9߬L6,r AT 4UYO.WhZc<$:36I/:Y XfEÈ>y#(SRaIngܮI58 xkcjfOXֶ$F%-,n`zFeK(䔓) +TapcJR=iRA7$s̈́H| +i±̮$n-j-Qɴ{v%ρ/ת5TgKj+S+!\i͟ 4#qOGM gy9[_qtqV>?Pt{EIKk:[X +k[>SnOֺ ~Bhy .bt+M5UȘs=>O T*TH|1'[7Kƻ3i1[`y萺!r +F +x# Ҵ'Ra;|*/BltPM mrax#Ψ9 0,OϨwzt~^oPe;uNr +SLGcv ](Z L.,/}80,V4ٿ~6# X?1 لrܵJ].:yg-caSM?7 s˃2mFi.),VkFVm'8=? +I&!~&h 'Z6JBP~7 }Oǧx4 t~??$endstream +endobj +1582 0 obj<>/XObject<<>>>>>>endobj +1583 0 obj<>stream +xmTak0_q)83iW}Ŗc5Zri #,Gݽ!G̐U@ơ NS+e:yH Dd*i RִЎPf AwUqN[dzP.{Zq*}f"n'{Zf[.\`36$P+洏J4:5G|PgWvMÉii]K̖Tv6jR ]t.j0Q2!cC\%$ +ylKdVjC+Ӻ`?zՈ=s;J@N˵mK\=́U ,_^RLhTH䶒$vI}vU&з`Ȣ6mCe-+Ѫi#_N)0W69k}J{VѡY)JT厂QR`ZoJ}u#RTNymcL>=GF981xPޅ9D68h6rwGwtq(Hg !x"I"ө'x}\⹶\۬ɷ31 LE(pםv#~M.(<sS2G?HO.}[endstream +endobj +1584 0 obj<>/XObject<<>>>>/Annots 738 0 R>>endobj +1585 0 obj<>stream +xWn8}W Зql@Qi6>ms#H%Y`4$r.gΜWi<w6B8r29` +^p{DJ6@8GfAchM/$ o\HgRY e[S8|n%zN􂁆~/M&f0> +gsO˯ܲch + !pn +5XFei2LwO lrD+BT[S +EPALapfREYb4@øABS!!.ꡝӼnQ5:9c3g&U'VkGlbAȘW8_E>{(xm!b *P +^:7KY(#[˄gh0z7VlO `eU[㾏5jSMvrO'"A<0- +]y_a^нEvD5Ptl0#VX24QDЇmEQV1ٸ>& U,xK n93)gՊ+E*t Z\>#o-/y@,Zg\+/ ѝtW_(TB_}7H|en+À%QA]0d2sbNkBrXkf1A +n ʆ1m_IlրHcP%&D H;ޅw!YTإe\02֬\M";),&~sF/:bmy}jxeNob@i\h2J&)΀>/XObject<<>>>>>>endobj +1587 0 obj<>stream xWnH+C$ >eD$Y~V͐2Mۻ"0"in:H2h"iyOr:'CϦ<_eg/g2| '>dd jwYD[;|n,sIJI- ]}0 c p f. <׺1p{9~P^v¦ӕx+ -jSu&k{7!ax}K%ksb/YnŨR˯)Z_Uvov:s` $Tol@=L^mfu Fdv6$am sدR`ɣeL9Io?k8de菣endstream +Z1 gh8-nW8oTbp("PX̠r Vͮ2dmML²@D9,2m3HA E]'J{y;> $Tol@=L^mfu Fdv6$am sدR`ɣeL9Io?k8de菣endstream endobj -1594 0 obj<>/XObject<<>>>>>>endobj -1595 0 obj<>stream +1588 0 obj<>/XObject<<>>>>>>endobj +1589 0 obj<>stream xV]o6|Xb8p(hӴ6PMQPeN"7KIN( N3{-GTj^.knAJRe%$꩕&| 2pU[~eV7s!ޠӸ<:~2^.9 U[(8VAIWϠοB睫CpC # =ʆ`K-(8rll z} ``Ψ"`C)\]Ka!8.:!i<5Fo8c7/`v=IoGA|(zU)7szFN=Yvz={+kQNV=&Y&O9-7E,رLXo@o7$]wB{;~xYꦒPNyhɉ\4{ۆ p*wpq>NZ7 - D5Yްb=l/ 4U`TKr(jmrUfp*^g;!tB,e,k-]OQOY4 }H>dG5P(|0?5OlϦ|j+Mendstream -endobj -1596 0 obj<>/XObject<<>>>>>>endobj -1597 0 obj<>stream -xVn7|WJu*$[[Aa}v)-]rCr -Esȕe]"%X\ CmvhإI;iE]YXw.Gš ?LNn&3hMںE奥QB -]3t]u_Rgd>g%-=Lm)>ilrF(455rNTHf(̒葩>i} ٦5ME񉢤}i|a|܏>Mmzi'<ʯ8 [:S%[9dG5P(|0?5Olf5mKendstream +endobj +1590 0 obj<>/XObject<<>>>>>>endobj +1591 0 obj<>stream +xVn7|WJu$(PV + +KikU(C,-2gf'jC.'M%!޻xYI\^%Cz?LNn&3 G4y&m](QN Gn(3PJYN}30}tbwQE$W'ȚzӼV$oIS]5{e|N i`OsJWF#ҙY.:/3lIIV4\9MRg?9k'Ix*TE3Sf T\Դ>l"DQx>40{HW6BRZ[Wx-KU-[INh棦T +}H w`%kQʳ9.hq;{A{͑N/rd #nqǘl&ML/ ƿ%-e2!{/:#Sd@ -ʢ)#gtjDQgش' +OKèW [tVF.%&mZ.H#ɿ+2AK^S*keQ뚡4zhj R\ztY" -dؘzcWH SZΥOv:8 )V%zga2;g~g k=-!Ł>x#ڒ)ѿ? D/b;4]a,,A t`ڜk3L8XR/5eUGLM=}jnW|b[Gsp'$TEMoUV=s?jWTƃ֍ncL9>/XObject<<>>>>>>endobj -1599 0 obj<>stream -xuT]o@|WRZW!OQZiS):k|s#4{gٝٽߣ&Na>ю&lEz/+lr5 VU/PUL`% V4F~@ҴG%9'[qN6XT'=&0`fē`]shuFjPhUɍ7l#R\x*cn-5zwp5ȵ k%z&X7)D-VYNx?ioyZ9iOoD~JUꝅiPY4gzlh -xէ3=Z "6zN{ wJ -XJavڝ6%/'-T\66xutHRIE7LiⶔeP6іAsXj ՜'SQ s|tOUryOguЬw(PCX;AU= Ϳ(oCq^ze2U%=oNaAlAwNHCZn>/XObject<<>>>>/Annots 743 0 R>>endobj -1601 0 obj<>stream -xWo6a3$eˑ=`2V{+ehJKRqIŊb0$HBw|we_1cSV F< ьYPE|~Ub0OxoN$xn#ww8R2Gc6OyX9;NS@Ɍbw6ruEcw?vmzDYʼSol ؜_^ p!{E+}nvj0Mxap֐0+m-VAPY mŞSAZ -Rx? -Є?i,5Q438Y\{,6^>ڠ4nCMK=R3R@2n<>/XObject<>>>/Annots 754 0 R>>endobj -1603 0 obj<>stream +dؘzcWH SZΥOvzq\o4R*JdvFό0@Vz/ZC}9$gGȵ%S@_ vh YXNׇ՗/N!J99fpy40l]|5g2 1 Zd`o w]UҲ?V™hRoGсΈӀ>f2+#3`i'Yvixc ZʱJB(9~pnp8N!=L§8VAM{2{zC`FMBjY5C9AM8Db)0-C ~ӪyчN;l%$a|3ݯQ􈬃)E6h\8Vڡ#.F:mP >Cˑb<P9oEɜ]pǀinͥ.9^^$ҰS\1cvK]HԔU35}Q\Ums"K𒠾R9F7UYY6~Ԫ] WRZ7v91p&Db1F/ #q1qJendstream +endobj +1592 0 obj<>/XObject<<>>>>>>endobj +1593 0 obj<>stream +xuT@_1񋜱+pq&~8=scBB픮unBaͼyofR;D; 5[@>,eY:f9+.nW7!aUQbA%PVb`KXE#Q9p؃fDcP[WWk"x`k2.jk gR(R8 {D)H>/XObject<<>>>>/Annots 749 0 R>>endobj +1595 0 obj<>stream +xWao6_q0ղi tòDl%%{GRX ݽ{|4WJ1M.(dO~ydN<ɨt1*i9XdLɈ7'dW]c7ؑ?˻4R6]$c6OE\y:8κS@ɜbwHҸuEcm8wӌmQ"c[5YiUd|z'NZ$Z$v6AOTJ`D JVki#΂IEZ[5ѕwBvI2 +2J`fD # C+>@I%DO(KY_{s~Fwy7'9HAZ䟚}vF=>)ݔgzlJ"!%R]+c]y<ŪH:pzwJIN%(7vZMyc;VEq7 PJUKR5^o>\>6 +k(~ ^Ԝ..[Q>6F "8'\n@fS͹iq@Z_?Ȟ:4AB~:7ǽk9jz'|#04jrysjUP#&?{"Nh45qD[q|=9z<(pNVɢ$rp/ +.*. FgT#D! +Z*Qkл=w/u ƞ4X;Nge ©{ɼP^),EɆ du`W6|P;[Í\VZ󵤯+SF+u P,F*D 8$㸒,iVH8BKPI<Нk|ºDC"8M !afW/==XyuY(Nۊ=.yǂ / + ԉ(n5JY KQ?~0v+y.-k(ift|P,#d}Kvz6!HHuu8=8Z2~VQxxLj!nXm4W /^Vz ^^j_,Kf@Kf5mH>endstream +endobj +1596 0 obj<>/XObject<>>>/Annots 760 0 R>>endobj +1597 0 obj<>stream xWr6}Wl֙Nlj;qJ"! (hYH>t2 ={o>O '^ÛohLi2'*?V9yM;wVҪ3 oAQ⊯5׼;o؝Γa.}zɈqłk쎦ɸ:˻߀xOf3{ӥOx8c6Q`  sw@<W@4Vc {v^!8}Zy2" "=(-3L!?n7/1n_B;'쟐7 :Ň"zt>͋*-9.{)o$iOgob @a@Lzr5D.6֚T:G_` O *voLi#^^ >j.D+yijJ }f",YJJM 2Zx)כ VS+ vfB̅%ޤ&?ӚvV ]S x|ӂC>.RPa%!&y' @@ -3195,171 +3192,159 @@ x +W%{ `#y<&gG?t1mb 3! ~h]Jjk FKD_#)zv*k9IHy2HaGgfAm/~});]i-0nUe2CxZY>SN@sW-Vx8p!C zP O!E(_fҡ>>aJgiBM2LKU)Zv[2޴p*cSsXͪK-U;ns)38/6*"VdglFL]֚>JȅoZpj2ՊഭbǑf -(6c{rn@3z£YKmKqajD'8ctQ x_dOB{Tr~GBPAhEQCs0xϴP7̹Pgj"'3Cʿ<Bl\ `A'FmH`JdrY "bִle@)HF00ĩNʙx Rp{xqJnǍJYp+X<&%нW!)4Gt96h~0[L5(ŠQHǢBBVne2!*}pbdZ./ }8F8-LOr chY521 --؇A|9utUN#DEZ;Z@loGFqi mxla-gct%fL h<^0J/@U= n'f /һEPh⸲! y yGC幄9,q[-%\Sqe+t9j>l>1nXQ4 Lϕyhf2`mv|}K8t-oJb2[;b<F&}լ(4Lp RR"P@Yy$ |ڛ1gd: 3~=/endstream -endobj -1604 0 obj<>/XObject<<>>>>>>endobj -1605 0 obj<>stream -x+2T0BCs#c3\..}7K#4BHP$YSO$3?/1G!9?/-3( jP04hՅ%DhWH%@.0})endstream -endobj -1606 0 obj<>/XObject<<>>>>/Annots 799 0 R>>endobj -1607 0 obj<>stream -xZKsW!`x$~J*DB"b`в}0 *ZEn$s|6o*Jf+Xg;xwWnR\gfZ`Re\O.VTSdz2pra2fK3*X0a vb0`l-bh` BшPϦ "l4G ClH(,2ňYy"i4@ΧGR1,q -L,A`3،iY`3-KxjwN,qYgs4 -+^1)\Z"oǐeL+vWkYX9K}Lj4 "ρ5FSCޫ U`llKv,:riq^Arb]1 vEׄ9U򱩄 vOY`Aѐg``W1X5cW~v܀bf_(~\.X,@1ZH* 0X`1(_`#QXbY1$bFY`;AX,YH#va)DˍWHL" H+` w˔< -f#X`1bbXI(h]q0^p!o`3>.EV0(Qa)6 vcWd  -v#gyd5CR +$.D)/9!ˤ` `Xgrd]93.,JIӎHC2[rsN[A/E)#5dJ#RTX`sX -F0#Y1Xt w(thg) `G \µI`q{TQ`W+f8 -K7U vpT30[R1jV*cgdD.[Ab@$J7rDabp=1*XLq`I `$Gz]'O1=ጤbD~Gjj=WHPwz(FyVBY;/%e9#9`^abۮ0= sT vl)"`Nl -܍ -SXWwN`'Ɔ,4^X`WX`>f8Y,JhԬ7~d}h&;=|x$܁Vn`}/pG2FJ#RpyV0ť}2w?X,HN B{h ?U w+ Y u=+;^`C##5Zܽe"k>TX/?y-?2@I!S&),`$iѥQ12BM\+ШAIHHtAT1X.zifňSvZl&+,WIL-y0DQs"k9QB8<r156̃y!$iL"7m)o rvFa}h0Y6IN.@$ @p{$ș/:o#={5|nt -A _ 9_[88 >p'~}8p񽾗## 8J1pbž/(7BƗ 8\?G]>՛\Ȗ+w?7WMW_g15 xm~.o][|/|;5E]޹sOyչQUjwjnˏ]Ѵ ]7+mjhsN$خµbS>{Oy~_?54E:_<6yWV˭ZVuU=ͷ=YT^A:Eu~(ܯE[OL-)sU7~{A5.[3=j3_)͛]qH_D٦)E<- tնfwA보¾Cߡ{VeP Y -w]t>rG|Zz %!_nnC>\r}o%Kiy7hG6é m]^m&j[k;y #0LSgd-6]}dNqG_($swYEq omc(NsZn0hpV|~h8P#Q@ȶ>QFIHϡ2Ӱ#<"OwS4C]lB޻e?kS, 4hH`& N -I"|_? h|Cu}H\zy180~w|leSlyv‹Q(H!u={^6-m?,TG\I4bmMpsџSg9λ)Ox/{iݼ8[4:(pLN3G8L~ <;>8: 5-bZ9n`F ,w_MSCUnۮ8)ЗvH| @V tuFVhܞǺ^dͺ2hZN2pA=uտo WEk6GxR5儆-#x7_/yq.Ӳ#^&d)wo$l.lN;?]s -;endstream -endobj -1608 0 obj<>/XObject<<>>>>/Annots 851 0 R>>endobj -1609 0 obj<>stream -xYr|Wc*)%Kde+]+DBvI R}9rvϹ_fH~"W.zw!gEB/rsE#غ w. 1`8H-TUzx1#*lf9+` tV5g 4 " Y 2;GaPbYv,vqBsiD=`ˈyY՜$ѬYiX*g$MXLxe0t5{%U4`ϑ]9K,j$H31}`Yq,k0#Z+YvdNЌgq@ vB{2fgԮԜ0^*YړfDFʆ8Yz1rH/ G@IwK05P]deSXՋ> AԪ$' '.@0-H,h1XCdD-qC^`+TݕI!ԢRHIZ H=k0|gVWHEc:CmƕjXg^V5Dz4Y)Q" ` f$l}̞`-2<@B-:3iTxNFs v:^`D~Z 6I4[ YM\02re4 (?L7cLd ;s2.5OZLw#E5?5,#Y.YNgD\:>e'<+iI dI2F2 %H"* ,Dw)gB_!]̤T^5c@T$. Y\le fXt/k1 Wg5q1oՎ cwb C3^ͬ`%h7_h.x%H4x=kX٠j&Y7FD`xyY5WaGVh6^\5,.Ȳ3"5^*x dQ} -LzLRAbVFSȳe>TȊS,!Ia1R"3CS4D̀B$Ұp92ce)b%\)H#\A '3&8ܕS0,z̲Q I]A S15|P*']HQ7 OƁrwOUn ܗʗܩة/}Atrqۺjq._6Cnkh: c\!}>mݙ`$l6u[u.g4{IaޕFlN4_]Ӻ0cأЕKeΟ/P]7rlFˎ\;Ҫ͔ܺPėY{ڵ]Knz~qӟ*MaWCL~wk'nQrFe9M9- Jk)e4ikwM~&Hah/om%ے~}y9~oK6{j&CJ2] O1% |xbǮ?vv"㫌qy[9SUٽTޟ eG>~owky@ڡmȡ5֗6 >0 /wVauzhbUtssJ"ү定θzXvm -vZ-bk]XSG}퍻n[=g P퀈ׯ^8轵mC'N;6|~? {;Dy_2b+׻o=("aΨ¨7qy׶oƦחC|Lo? i"s#=÷Ő?vwu2?3y2So_xuySn4wee.h:]Hm@/ayD[_]uendstream -endobj -1610 0 obj<>/XObject<<>>>>/Annots 895 0 R>>endobj -1611 0 obj<>stream -x}XrF+搪$AؗSʖ#UsHBL j$T6=YǿdRSm緋$|)nLzfPpc02Ej 6*fj 6 @* 6ͽH -oLG6,r{IH26lRvvl*Ko&"< d314bf=4NQ )`キsl( rϜ }~&m_!)$F kX0VO3^pBPWALs&?qRDk:!["asfA_'fR U"$䚱SAw`SNbf bm:($H,I2!$,;`k,)TzKT]lv}w{Hwhަ{hC{͓L -|X{RpH*}OV, YjJN_*wXQ@5SKҚr}6!`f/f|~>/룬g1n۪+H գBKeUMf#1p"v *Uҗx6K71_ (yU .ϼ/E?m>/XObject<<>>>>>>endobj -1613 0 obj<>stream -xVr6+DHє&4nڨ/ hH%@Hi;m<Iaݷ*bZ%(тmt[I{!YǗ~^RXjMۂ-ŋ>h'pJgta-iMҳrW %)P?z'  e%qDE(8%(E[Cک\)<ҾӹSFjB+[[2š:CR]%=@!k@1B/C\’S88BsӂΦyŒ9ģMeh`"<_$*/VZgh6K87RQ4]Jw/4 vpF_CVAD+ؔG0ɵiA8b;%N89vE9Byvvmݸ!q8D otueB;d`ԇ1NpT ' j{A#t-=^o0rUs; =@ذ;B*<^#Fo| /-.(9ZE1+*A9*qw8 $DCNxw q'w&;  -8ϓݷ"TwR`0곱S?4Ejq:8)`IoB<樼R5pRbɎ@Էߊl#kߐz_-0wbJU=[2W^}e}endstream -endobj -1614 0 obj<>/XObject<<>>>>>>endobj -1615 0 obj<>stream -xWn8}W ڇuXİSlnu/y%b#.IRen/h*s;gΌ~^h3ZfIiu5M͓9-+<_+)/Eb6_|~s5ٌ69,+d)mґYa {$c)S.+ҤL֓/$Uy -R*,I%i>Rj*|ߑѾ){q5m$J/4NvU?IlH$tF; O\=ˌr$"qn/Wi] -9I ӕԞL ڡT$t+Nk{i^^=dA}F˾Yta|B|Sު9Ei(7pN\p -kۯx/me`)FʵCp\U87)Lt @ LZT.-R!oRSe(Y`0*_{Т8W0 )9 Dq:5[S8=r\m>OPTծ1UJaw'ѶF 9܈3Npb9LC~I:t,CIиBL,q@:ʸ? UP>ZЄDfh=tK_:Dyo#бAZ nY* -X%}aH}wܝbgEE75sZS>EoiP}܅ 6f~-҈[8&Ba{p]gw -uЍumʺзmD -fHP% \ -}LJ8K] (KCn+;_M@kр]ɟJ!pDbuUWQ˚isA-9`AP(V5b0рC̣F{cK]0ҜPؖq^M>W,jl`IxǵtQxʈiy,,S`siNJhx3W:, -C Kw Wɚ*D0_$(ni=YqW@_/HG萰i 8Elg-J+ ͱ@P rp繴k/yYɐW :z~a} K̴ǐ{ʆL"/FHR -bcDžZލx-@ 仹L>]z u#Y;"1mQDgMT=GT ]OcݓYBj1sU#eer a}eg弭S1C[2mZ{Mͯ2-[;N5+H˶\ʉUN-˩c]3R -V演FMl_^[7*]<eh iq -_NRu@y_p\`W1ݷ?(@U$nב/Bh3^G֍Ζ\rln?*xgҚ70h渽0^M1 ]-Qj ~>endstream -endobj -1616 0 obj<>/XObject<<>>>>>>endobj -1617 0 obj<>stream -xWS7_|(L 6ɤ4$Lc3LGmtt}+lsۦ0 [AѰOʖvN{v·ǟ4;t&3CNX$;݈*ق2gj^Y4SlMtah~K*~(%IfR0clN PY$|ss‘V\Rztdž[ܬ#5U]<&/ YFXv{мK[# ҙ -Gn9r~ idž}+c6A1uDM$i7;(x{0PZMfecz[f;}?suF^l~ة$9IK--2RH ϯIJxT<׹y0)mS!*rJ<:4 - NS%,XB aC{].->qQۨ¢^[VMquD:S(!WJ.ִB;M( y-hA(~͉TB8tD*Kc} 浠Cwܒ -mFL!cE0 -;( -fIL ɦ wbVn X@Etm9[ Jg屦qVK+@z䑚ݚvmR6 #%_+E:M\D3xݛnW%\N f8,Ot4(5|ʆK-hT2ÜLp9p? -=B;2\NI~wozS[l/~iqؐ>/XObject<<>>>>>>endobj -1619 0 obj<>stream -xX]sۺ}ӉdvemgĹ_I$߳ P陴7e `wϞ=ϣ1Lgt>: Gtv~׋+~=ïӴχ7/#K4›phDz=>ǯOA?tAUvVtN-JW <%v~8`<^/,3VٲNAҮlM3xw6S%+vn?u356:Пe # G9 ۖ@FSm - ->ΨRYajw8b6즦zRxǤv4/'ip:·gl5c𘂥̨`liS [5`+-H啩Ru1h6j6Ɏꐝd%fkD)V(dcBA TytED0l ;jS++3KIP}?|
p&9xLIF#ڧyW;.u/+g5K1ǰ !P)Dz|4^+@-("fUK -rHU af3-AX">&ԕ=eC@vt 6ƙJ-|x~:Yg늳)~BFk7vQ!ٷ0^;)j fZdz›]EcV=s߂݇Oi* ڲvx @?QzyQEy|Kow'~ !Ti,⾉7 -55Ma܍/]Жl#"O6G,:}{yTڷ\?[87.<+>n+ 췚<@E lloy$WT|;]wԋ ޫh¯zwP w3`O{n9^ 1J07&96j{3FyLwӺi=d6`Fu`:So1[l}WwvW̝_NX87P QPm$[ {,؍ۯSzkLW&LoK~ϵ$dhpr71(Ɠ^0ݾfW8e?*P ?<N~HD@L Aӟf3 &2J8 [8%hU6Bd -v?KF [+͘_ͤslؔ}\ &iL`0ΎȢ,J|?1"%fp>"q.>a8*x;_y.|-zVƢ,zPg2W4梉ujZIS nKyǐvI:? % Um!cڟ*BФyVcCǸQg;txX-^ H-,`XG BŞU7Oy@z.s#ybg…EEdX_AҖe \RT])v:=M,7ٓ f3L=֥"yfC -}? $KC2 ұYkGkA,>=|ɉ rLt@!LV92P(2.A4/2s8rPiB mI|1`ϧVU(qX3U-#kU2?j;Nr N:"~q1'g%m+H p!t#NrrɄOJUendstream -endobj -1620 0 obj<>/XObject<<>>>>>>endobj -1621 0 obj<>stream -xXko_18HGpQ@Vo (VRkrw%-&M;"8sPic8/U+QR%h8(Ɏƣ鐒}[$ *T)?%3s'x(Y+~ed9)M tn6 Gd,/ 6yt5M$M-×4}cHir>#:K#:#f'3J;j&yns|_DVZ*dkDZ e]HCP]3$TK[[!5\Ͼ-5]kWAI !hPUhY~탺? sH7ZZ7e'_]]҃ʬqhpֽ3=܇:H '3r˭v vtSr~C&HK#vȞ =byGyG+S 333U621\[>՟MA)BvKnmHzuCFw`Y^TeZFGYPS[Tei6oe }u':46w:Y 6J)\YXOek`?j-ׁʔKmXx(LZ9n +\J~#ػ~(F-!j{rAhOé5񰘶Y6Pc|mvo>J6''n=|%7_~rt6vJp,=p=l}2}OE2gt5ڍ6J7=ȵuml~eNw^`lMm's̍ ľӎ (Kzm;m?29-4Plcb!cZ ǰܹƨdHnTQ~t^$uy}p>} V)E,f-mFfP~ó JGkŒ,fEex) aR!e[Q͙oo0$cR \- @?D>3?e4#܈Rl0Vk -D탛hM 񒭿()癲۲O:a!ܞnޖ- $.ig|. )KEXl<E@Zý(F_7'K:c7&#Q3&(տP7)jPnɼ.oF1'쒈ir}6}B`#r1{+Deq@-hh`^_Ny\YhR`!<]shu,U6՝װqN -7 Ѽ7,ނ}9I2:Yh^X)‹ǻz6cypz[V/j8M;i궮Uf-;kMd[]JRJP4h.M5\G6tH[R.08Џ߃Y$ձF3LPð&xU[Vo7( : /ů%=v/.n\heM[CIYIuHwܮ>RVy\! Ͳ owJ{L}q(4' æЫjE 68ЅÍʺ5@7c!(|wٽ//_G[7ϝO.Fx%_M??M~o)endstream -endobj -1622 0 obj<>/XObject<<>>>>>>endobj -1623 0 obj<>stream -xWn8}W M:N}5Xݢ-1TIN~Pov lΜ9sfKvG!EQաA`t=YI {9h O\G`;#| ; -S~N( ;/Z6ȕєr- DRc]}Ys(Z -+\ևQλl7SdIblH4K$$)\nE.$!|)Ć\jܧ&MZ-@tyჶKM?<<'- =YSd9yq\6EiJvǛv>xEBLNڕ﹡gɊDse { 6`IL$gW;<>;!eSMtr=c2.?Nqaaf\ԡT -4 .UfinD)$ۇ6[>6]K'@1bCFɥq)PUbjOxR x H@3'**/5yŜ)g3lmQΧ!o -2xnj/厠3y̜,WKQzzVJ? N@{[RS[YWĉ]4rjd,', -t!;:{70!=hK.G)/N -8V>)4k /VN{Vd-o=a x`6D:u0PmUs0b-O<3oիG.XZN};3;iA[=qVe;}~Jw7aaxW4~*jv|QUwQÏe˜]__у5^'nMTpGˁ/:&0 .†-G zrendstream -endobj -1624 0 obj<>/XObject<<>>>>>>endobj -1625 0 obj<>stream -xX]OH}W\@`}U /c{OgRMȿsc (|ܯsνӟ's{Nt:%3Z.ɂW?,\'oNgtMkܴ9ٌS_;c=vuuCɌ -Ftkl{yyI?|fqAy0vv䳻B:vGOxj -MHy'OYp5/z'v;o֭9Xjz[=F9=X6V[*UoL$QIYOTV=1Ann￮Ȫ -&r%sݷQaIKb/ צwj.S%(ZL% η = ێ>!D[›y.жv&? -RA<%6D]=*ͅLZGCgL cc3gڕī"Za  lU?5+)nkWuLV'n̐5lR @@>e.+ /=*]mK0@²EwP> (bE &ALgVRo# 11 1njZv%=3TXF ~0Y[MAvۘ -a`4j\JB#HCb%G5&2E<4rڲ2IH+KҖYepG=+SԔ zh]CF6exNlC׈tsćٴa@RV܀)ړM 6 -es5/\ӷH$OAGi6]'!WF7R_! @`mV8kN8{Tu-\_ g֦ԑsEhFp]7g|zĤ7.,ABFƽ„!mICq: ЧE)M'XfG& T2 ~Z$wߜ_ԧ2GgϚ@`:LyHr?7`- #`'`DB̰Y-` -<&BHWw~Evf]VИ'^[6/OΧׇy sVs}2 bVw}~Lx+!Ozsx$M?^EKί.h^ވϷ7v<ҝ -]pκg3~7-r]\.O5endstream -endobj -1626 0 obj<>/XObject<<>>>>/Annots 902 0 R>>endobj -1627 0 obj<>stream -xXQs6~ׯ2cђ,K!IN3~HBM,ZvAB -v:& .EhfՒj4ͦx~tMzʖTlnFzƪ͗ײs=K"[WXe ZW7vnAmvz^Ѧ`<6xԑZIۼ9AT+)<)&ۑ|R[/kgIa+&W8K+tnhJU6XeϙT鬾R~ Cc쓧^{SեNVyD~Ʀk˂W.^:'JT7.ܕ?,>g/E#",: ϤT)"Ȕ ڶ [ƼWhuYmHWd<%xc`DVˮ,)#nf98:'?,؞!߿|?lE2a;X or˻cd1f+&gp5N,^qjUkZ1.-}h=Z!dߨ -d$KՇbORO&^TjI2 h{¥O+3ۣFr'u6Zھpc;ci  O_nhA.EZ90A6qZ r5޽C>kԧ/&g4`U^:+ ZeI$/57eyrgH wCCSlTxATϴ">"; Ei/{I#xh\]3wziN$\TVm6ؖinpQ#TD} uS4PcƷ$B#ږ#y3k磡|oCYCy%ߛqSx`Y>,؀z8S# A=TZmAS9ɊER$SCu݆QP' uxUH#FCL̈́Mڡģ6rmQ N -(62:ds/gS -ho <EOd -@LI !9Gm'!96"V.㚰PY`TjoE/IsqLl!}(ȅ*j@Q~p-%*2+]rXgCӷ/t|G -v(C%hc*.0݉fۘMcMPwnу* s)MGUN)R:ia?]gDj([8b[+x'Xo^xu.ޡYMqi@9yy9g 2z'q 4Yh02$Ovqb!: ]ye줸*CP ;Y&JJ' X'}3:YLU2VTmETEj7>BLαmcX EN(w4\݅VܹǏ$K/c>:QALw5soPnw U V'My_Kz/Ƅ!%j\]?tvӹ"&Lnє0u1 /w7wjڀ2[ je~g=vO.hh \\MF E=ʾ2SĻs7[kANW?~ OoݺlX_Si> l⋣&)E1/2жZ+#~yuu鎸ˀ` .NƲZjx[M蟣lendstream -endobj -1628 0 obj<>/XObject<<>>>>/Annots 907 0 R>>endobj -1629 0 obj<>stream -xWMoFW |r%YR -`IkJFP".%RiE8xYL}i2ᘒituh4?ZRpߟ1Ń14 qVA4gC>fqv=#Zdk<Ň9"UGh$k^jgaAHv-+'"#V0`unvRʫ*HӜREBjEHmp=32JTQOO# _*cvJ>_>Isǡc&okS8~ lT!'=}xA?vh'.Z -|r)h7t2JRjF0{.jY*+Jg"/B>Ku: -B[y>i$z}+@29Br7!w*FFE2Dj+BU].YuowVY-M]X?xĦatp{RӎTZ~s&P.]Fx cHUWLv̌oXag!)XhEG!3e'OV:qgs=''7' c mkISUqߊBȨoPA鷕VϩS7n5m:{ Q\wU]rUQsD@^aXg2( D%5P 8 -~Cu -/\a(C,{Æ*)1Y8;n"ZpCiDE91nFb52<{kpjrQTGTb|RVuۭځ4?$I4)A=OM|?#=2{"`]* l -")4a?=\3Wxzi?_ 3Ȫf_%M)(R9j;D؅֬r^J;\X[Pɐ5FZ܂tbtYKpz_pRҗԟiV &}ۣqcߏwx`cL=g‡Da`ǰ24'.warGZlxӸb$v83c؈cW`wT<]ɘx -_l px6v_;_thǵDQc --y'Am -MΚm -x;Msm/ M yZL1æC 9-_\w7jAI!acdMS$fg&endstream -endobj -1630 0 obj<>/XObject<<>>>>>>endobj -1631 0 obj<>stream -xV[SF~W>ЙH%Ǘ $}6-d:YKkDu+~{ %0ivҧ4)RV &I8x1~N '0~h$z7~#JsB^<-JE5ׅ̩+Y". ]YUr]{Zm(>S<̤XТ/Hףăp|gg8S-xe[u)QV%SRףCc.6g(gąlZ5++up}%俸ȚR/ֲ?amų)/7Gbf(Rs RW2NA d]sH*8߉*0{?}tN"%k.XãRDHm g9IQ)lܨv 6;qD̓ | XVh3!湍YVؙ hͫ5͓@׷\+Ql^R=:+ݴn;om<4wfxX  GoYrк{–mJL -*s ̜rd˴l6 -VNӇ~(Eam Hz,3fdMfTvF``;ʟV`(`Ȝ"CtjP}} eU{DWk\v~ -q64h!q8 5ZN7 ra!3#opSkB[p%0F)kU(`U$Z+/?x 0h/Ieq2+H..ÐJU–z@7c:3Eyű>#0bu:Z*)8+2$Y 1q.)!;cx; sNn?B 4[\[ϴ+Qf\]={݀Uv}.I}y~0o5/vf_f-_vN1TZ9dQ=[3o>}J&ǻx8WGσ\&C4ejj^ϡ+ǬdG3uC&V_aҘNgӔܗvr/i~d' ~^\F~ҠKZXC n_[2BYf89A-ޢ&`4G1*=os%6endstream -endobj -1632 0 obj<>/XObject<<>>>>>>endobj -1633 0 obj<>stream -xWR9}+T1bvJlp.32͌4x{xTmQPƣG?NhZ`6r:>5r7h%-s&ׅdJ_OW&,3M esfloh~#,!еw%}0 |,3p_(VBGG֝@_7xMgƛfGQ{L7_L/_3ed´fƓUy i6$˴rR Kz'Qml}TӘ8i[kؽjǠ+Sr.)כ3Gjҭ%SнV \5g%ИVze)F֦ԗJbt*Uye,UU=)]GWb` -$Bn;@ώ@O(i -IƛǢqW+fw$! x! cTnS%_VM1ovCѦ> Z1 }EnauB%0 h+ gSZ2dV^0%SDZOo0NfzE f-{':zgBW\ pOj -Ss=-"$L1F4c{GMWӟv8ȯ(0186i!R ^յVLTxh!K}&+p|`\̗% a'yN*VށRG`fyPxt6uK`dޘ=Zol`[2ހGp#T^-wLwVT!8AF\ʽRvn\ *A[ހiȔE}Ät}3o~;efe GnkcAMV)ƪJEieĠ|zA0<Eɧ-qn޽x/ -COT[p^%Jí(n 7*IW?hzO{92!¡a*&w3L(7\E6#jy!V=ا] ޅ2H8c]>U<: `S7/i&>b56Yy\C,F?aVC>4&; 77Y=dݲ] -jiKױKE(52=M}C8.0mH9܄Tv0,ԗ*4༎aʥt -*V v"bDf;6rm $u{ Ё-5zRT+N1^0yAt2TMt"­K RuY8N5-8ʩڊ#$G#7 DPf3 %1$M woE9k!H>r.W -oWa-oa:^Df}Kendstream -endobj -1634 0 obj<>/XObject<<>>>>>>endobj -1635 0 obj<>stream +-؇A|9utUN#DEZ;Z@loGFqi mxla-gct%fL h<^0J/@U= n'f /һEPh⸲! y yGC幄9,q[-%\Sqe+t9j>l>1nXQ4 Lϕyhf2`mv|}K8t-oJb2[;b<F&}լ(4Lp RR"P@Yy$ |ڛ1gd: ~=-endstream +endobj +1598 0 obj<>/XObject<<>>>>>>endobj +1599 0 obj<>stream +x+2T0BCs#c3\..}7K#4BHP$YSO1,1/95E9?/-3($3?O3$ BUs=s3 ]!) S\Co)endstream +endobj +1600 0 obj<>/XObject<<>>>>/Annots 805 0 R>>endobj +1601 0 obj<>stream +xXMsW!4IR^{ثU @?RJvUr=*aU緟t +XD%3*_$+YJ =q +DΖ\RHƇgE,aZQ"NV,[#R̈́.s>$KbMsY투LFT1aJ"V]R8.."s1"SI!9kHQN׬4Ol]g kBbrE0|3)4\Bf7JjnQDk8Kvע#wI[9vudr35!04,c\As\Ro"-J,aZDEf6Y#WYg 9l.X`9>4]۝e #1WT>[Q&j,aPɜ\*u"<:uVgd8t"Iֲ9p(ĤjQ$Y`ꐳe>,a۞53[$,a~]Yk't@!(Cf1\;Y`1=ag %LF3.3-,Ma͌f2.c8v&M MT{DH#(IH`Mꢌj"%,)Ne% ^F 2cy]%b%"V:&U0wA$chKnf.c̦VQL2ZYbt-F%ly@Y3>$ nĩ04/UUd1<)R7 n$sYKA"SXns0X\YF,a8qpgYs +ǤHnr"sʱŬ"vdY`WkqYR!e v\0;X악) ,\EZxud-Ϭ]ck6% hdϲ\3c +D-mZT!s>}v % v<;KX|ֈf1Xpx,a0u0X ^TY{ŋg>Շ5/ȳxwV7uUk@: ] A]mCXJ X '_RPHe C 4;KX‘ @jWHݍ +TCpՅs(Y:י̓!z8؆aO9sCa7X(܈Ó!2`1~W8D#eJP15EXQꡣW9D@ q +z8 +;|t,FC3tXΉm+ e[ՕpWé0 >nU}ŋ(ۦ +wv20OfOLMyB{޶P5Co+^4]!\z[WcgX/e˼)|hZl5ֿ퐛?w;{B(Y X{7-{ +of>F⻫OLY(e/_S]e;Dvfbt>|Qˡ0Y_(X5.ߡ{"}r>1VcU5fJCT/]_pCk_"hUa߻_uGO*f^-ZֽgKG%N)vSs/@Mg=6<`!}=uvuo!;Ce)#e* tT}ljWxBvOB+~ЭD|!|^wNϼ=߁wO"4)f(Xtv+ݘL* P |GQ^շ'U{>/XObject<<>>>>/Annots 857 0 R>>endobj +1603 0 obj<>stream +xYnF}WcXӼKzZx;cϬhD*9$( EAO׽&0> ,4Qj6񟗟o?BS7GFci* vR* V,X;"фA^B؃lP Ul"*Lg°'5Lil:ڵ>'솾0 IsUl2*̈ivԋ]AZ;UQ1XY#vkF:aL +v:VaVaF͎AxRAYafcƞtS9a~dr^B""3~(#مd"`2':sDIKB52ʭh,)H(1Xl@j 9YYrXn͌^'讂P&,/"E5.&ؗ p9 `咑jb:YD9QdI0qX,9Va>ǯcmRP/>@ş!8EpHcUgultj 6'5V5`ϑ,*̀6c.# eӱeI(1XAct=-9e,CT4G@UlXC*̀3tvOz@ĄL )"pH`D`<(p=`F3U,`SVm)%x,'g9 r$ƒaηX@2KSRcf)A8Q{C#2I Q8Y\Ec⒃t:Rc QԺdt<=-,D +p,՘-ű]4RAθ"* hTx5MC]]}V +EA%lAYaxyYmb>S Ѭ0YI* MYH* p +ή7﷨>dL:LalI1+HD-c˼@YM"kKh*. rl@ʙ`f)v_#ӡ af@>Xʣ±nڋd{}IDŖD{\)ZEx!Lsa= ` t !TR,:X՘ Q +'pEf"\byC⒃Pɑ8ã`\ +pNVa8AGVcnˇ<;g[$icOe(زZgbFis"FlSIc. R*4nXR`7(Va"l;*|fױv,I$"3/!U>̆UIY ʨpݓ/VXaWb7:ᣋ [#keZr { Ðer.7ku^T`0hJ9!h 8s35(ۼn̶2fכ[ܢv!3˼mrgd'[ LCs3XQ7ee=uU3^ڴuVr\3/ه^5rS!57枹߾g&ߚ \[<;mv~-2>՘ew:UĄ/zaDzmi<75/VYS/"Vօ/3YQ^d?A.X$)C^lr9sl|v ,{'Y}{Z ;!XSӡ5J2(+ JR52ouu4OKZJhnC$Ӷԧ9UsQokƬ#y^I~1ˏϻ6`>,dRa쌮#RK~>:s8TV%KtoÖ?0>MX8>W[j˕*/%CqI7V1 z$"(]Q7F=*1 t`koq]ċGd_\d:tR49Z@w_p짻9,1mDK^ʻAZyMi45ih8>/XObject<<>>>>/Annots 888 0 R>>endobj +1605 0 obj<>stream +x}XrHWa  kplX,gY#3#V7ZV< z:*")bIri07(X2BKgA9WMˠ`t8̃Z 6Z rk02^f%R * + 0!8(I-5YFb"b`"50UQ/i&I3i1fh5lz`UY_Y̾Np,X,DFA"#dPREʲikP4q^gcuҰtU&:$9:RLP̲-Og) +ePC F"_.,> 8]ECr2xA{e +|ЉsQf@9LZ V3KvܳN:Ԙ/@30:%X<ta#p@U!bRCZ#y#yWieI8bN~ԧ9J<̤Ŕ-,%na,oE}[덾Cn~AA6];Hw ЎrwE^ o3FcwȺGI-/߭ehmOpa/_=Fo>ԭN}@.2vrxʾU\n_C\hwJ}^Ax7vК-O\wۮZnf\Tvֶ-[ݎr~{sۍ\lc eV/} ^zlmwPe'a>N6en5澾^em;giP{zԇ4vܵ}(v;sļb}z,$CSkgu6Ǟlp>pI7"o=:?G~_nNc +p1k7j=7o_zz t6ݦ}vΊ_>@!zܿendstream +endobj +1606 0 obj<>/XObject<<>>>>/Annots 893 0 R>>endobj +1607 0 obj<>stream +xW]6|_1o\RT^9'W|HH- ZH..]V03& ƴlIiq3&x*ZboAlڧ73VU MhX-(ou³3V7(Wf"Z,|͗hㆦr]›t$ZVO"^l- hr*iWl/lqD ҫ3z)cS 7́$U!je4iJkEuڐ*\RW FJE+sP9V&A[Qн3S,*|ZQHQܿbJr{Ph~V:3gKv4`D4yF-_|*E@;>jO5_aJ|*\ҡ2Wie9Qlꏲ­^)UeT}w3!C. =l~wRoEeďt}PǨ4]_ؚ`p߭pV};p$b_|C@RN&U} +[65olg[;n|D;1 cà + cA0Q)@s0~u@ee`cSD^ǓCf1, qXc;YC Xz.<*[%j^MeM{^FuTDh$s˾)BMЮR99%^m==G:QjHdCgp򬴮7'{pԊ V|1olzxI$$PaX!6JvW!t 5R 3,7YYىI' Yd)”=,;I;r΢\u)r3J(gQ2bQd.T7.W|7qD/u%R}A{)Ds #޶mzn˥uQ R8`! 3Ɛ0VZ*`ǶbZ$#"@$ftð\bJcVVL:#wurqDU TPy:};t< +z87'_2]ϲI +Z#Z?mDSgLV +:w8#[&1Lߥw3|r;V);N^2`lũM' ,DΛ'kYA $ImLnYI$\|m׮}2Ӏ!XNyj k{Ac +2KaFg%롽~ _H B>Oq +qvqADȑG7/Ndr= +̱ӱ3b])uIn4g.'ݺ([[?,P#?v͓%l a#1gN0ڜ:fԮ򣒽ua\zp2IH*W~^y;Cy]>7 KvdoKxcX5p,j2Cen1i밃]t5mjEɳt O|\ +5錯<:Q +aboMӻïï;0_xZkuof+yZ}.1{t_endstream +endobj +1608 0 obj<>/XObject<>>>/Annots 896 0 R>>endobj +1609 0 obj<>stream +xW]oH}ϯPJ@*CFMHnWeU =3Nʿsgl8ĝA?N )tYrK hG*A!So~m %{Gr)c6OkWy,PB'!2ߞ,E"P m*)%eҶqYP+cYçt;V +iҊ8SyoS Ӭ̶D c̄9ޝdׅ %"R;G,)B3eɊUP9媂mX#0HGKbd2RX#]2aQ ]+3mŝ6 +2Ia hLNdIlmk 6-$`GFë&95[.z6)2 qF{h(Dt߅FDz$t vOaUH^Yjy؛|*ۦuq$,4iS[lX#h&-KiDm~M]<֘/\&7Щ>A?2[@0[#XC/6,^a+V/ eh6:yYdR,͗=||ލa>Dpk*^VylU!#PD͵^e>XF@gD΃Y>2f{ L Go[P ǫzt T득*%~a= j-|p]z%RL@;r&[᜖b_T?2Z# +&[OǕVV@ak+%~j>2O||yercnD +'z37X;\dgo5pE[7{6F5mq~a]l`||1 ]iw,MckL&X Sz~kĽ\m*: z/'^o{.Ù*RHsS1o VJNV>JTq_NW=}@ {5`}ҁ&st;Vt+T]UI@fH5+X9*{jV F`: 7 S(ɻm9`4Xw0ƛtHIo^+d4!r8t endstream +endobj +1610 0 obj<>/XObject<>>>>>endobj +1611 0 obj<>stream +xWmo6_q30lŲ)IŚE\t<Dl$%)Ebkaĉ{yNbL!&gh@e4lC|?Oh~i4 v s  Qܾ=?;yIL&3H'OAk}Pe.Ԫ2)]>1qNq\6mĥ$WtG;]QQYG֒:^ֺ# +餉^KAka[ZJYRȔ=SJԏGnyėD84m*^bctr8W96]T8mvQ+V(#v!MDɈF*[|seߵ?V^O b%(-PP]6e~N 5>*K*b{eiIhvFi* +bF׵WG !tel +u)A(P,AV$ i EUӨoYph#/vP#aԉn,j ՄZ#NpJcsɭ,NU΍No:= fxu[kv$Q~b`ѥz)f +5ԥf]@zhb Cs 1,DS$Q&?Ό.Hdzf)ㅕkp : gNZɮy2a@͟)\~r^g * Jl9hG.]%/,~4mK0u' >P6 ΖQDbHo=ʢnd J$0 +[ʴ2d۞uDWwa `?w0o&0_ a7CMlZG+,ފR?tIQ1}՝be?m% p +E<* 0Z<`kvК 5(9ȥ',_qDsF@E/V%F[9[ʞG8 Az>/XObject<<>>>>>>endobj +1613 0 obj<>stream +xXnF}W bd&y)[vFmZA"F$W%-{fvI( $rݙ9sa<:~.攖GG/9EFl6Ezmhg*TkUM&uۼ]x+S>QjZnL[=Ɣ_|!|YkkG3]Lϑؗ)-[Cګr?jwTRSrbjO9 QKzL˦VjCKMUmRUԊc(L>[gsSh]UXْ <@.V*vk]q,y1&ID +nAƋK*ՂZ+Z5nnT{7EGU ˓QyRkSPrJڃ:][aP +I}^+rnxxH r:N#} }҅Nk:kN y%oR#ʹv;~m"Cv3%`ϬA2㐑u{[ܠQhVWq,Vml4ѧZuՌƃή*Hnaf#mii0JSCku3HhTPT1#bƱjBځRt2@9f-kP'b:KBVVq٫IbJE&$R,T)oL8IԞ)>@O-[Nƴc̀LӁ:AZmL*Ӑo<BJh4P[!LaڋN!,92U?(Jפ  ՠV pa8'͟ԤZ[ @",⋝.m[ Zy(h'Ț b f5[8V< ծ4 !ْ35Ox`t -TWp1$,fx- +Рݒ=? E +S*P*0. 0p" "#V駚;U}d5I9»Wg#wqlp# azLϾ{G +$g~(F=i'Asd'gSvnpMpSOpU1(Ua}lwqÛۻ?o|]DH7ԿI| } apM,̌zced`u0$xGDVХC= DR?-@$SN4Ix @%c_ g +kC˜=ac+Tsc5</q]ͮs۟><|6^HY p~9ɉZ@o ׋L<~쓵Ɣ,2 +KDSKP +e25q#%\| +}^`BR0PVYI4$>n5L)j{TOl*0G` ke3юRB'/D\ooR C;Ev!("ɋO|<7t'o{A+ZzVĢN?~ >\;9C{V#G nMV#5/ax~F6Y^0^c{D,P34uf }y` I|u7ҧAOr{桢M.n,`o͓.xU-2lV@TG<K˅,)B})D /fM`[i+opݮ/7LLɋ /xXwȹ&{:&Y~XOE +d" 66r mY8OŅ?o>*>Plt. ϯπsVOoYtiU \nĿgsPn+UnV]^_N//w;endstream +endobj +1614 0 obj<>/XObject<<>>>>>>endobj +1615 0 obj<>stream +xW]o6}ϯ\?Ne, dDl(Q#);;dGHסhZ8<.4)-gt$Z,Ɍ%~ᯕW UtJ%m2BɄ60Sy.,SH A$OBғų oE*wMywy5Mk6NY1GUf~Cƾ8/2%͓I ɓ SΊ1eP)cnTO|jqSdJp.B;Q!h@8 AV/Q6 +k(DrQ{E(V8!2v3 ^F{6I*c1`챂Kf'H/ZD6TaA_w2Hfa!l6Az>ڐ1y,"h?6دRS`2^;H==o]Y20.SceCiwn{Iar' q7(aU8 /fDȊT80*yy%k9^\J G)3Y٩ #c1ʪ+{hֆqmxVde|Oֲ]ۇL_p ++f؝>c~Ǫ|3wҸcA+9m!4j:-뛻7>/XObject<>>>>>endobj +1617 0 obj<>stream +xWn8}W Kvloi.۠ͥA-T]$[&EFȹsf 4h8$?A$Oa8 t:=OBA04h:s#i_ 0"_x?;8zKfKD4aA<,9 +ALzRB-hf( ;h;GRWlsL.EZ]DGH=)˦`fDP4"[D-Uq1}TVZw|Uܞ+heQQ]PfyY9iz>Ƃd|N)s =Zi!ڄ^Lڞ*iGCjOxBϫo~] +(AkQ MZDEwEA4QI䰥U496&)9n +((em]bF+r/JޑwS.d}˻t)t\T凑>&$SCVs}qY2zIAag*L8 ʥ;_7rI0kj3Qq)ι3ݣy.{XWͶ_sIoXrMp1ջ|Oѣ];qz.i0Q/uu g">*{{@n"dg`r*3 ]gF(A(s6:2f%pv/"dS˦9=֔f|ط!~`Ѯg{v~*G=Oҟ B7dLS|^> 9#=endstream +endobj +1618 0 obj<>/XObject<>>>>>endobj +1619 0 obj<>stream +xW]oH}ϯD +6H^V4Q&M+eƞzP; m7 +왹_{iPo@Qz4y}ꏆ?4;TGo荨?<7ti|, ^ ˂i&'gi2`fKzwџJfi)Go'߯6v!eJJK[L~yABRJinRH$뇅ؤB3ݾɟm! +W² ]=$ g&I9?F;9[3'ޝv{1Tie\&:j1a0v/qg!VtaҬ,dަd㘬LdTP!7RmŖ/Vs9ͶM­Pۥ B†U#V8Ӳ(V41{d馪FA* +s-;%X=m`ڷ<-((I*ҒH1-R'JBBܥJf4 Nrgɣ-5r"oSI"jHrxA3۹e╚92+A =SyE3E n.Ə?078LX r甮߻5A ;}/\)5YމT<˭# KfFS!tEB 0 +@`UM[uFUO#>r _b;|((m@(/5&{= #N?5>P\+A%i_(<49<_!1F'W +#n +fwuJc1ݩ(7 +2@ 4Κt"ˤgr}؊QEQ4\ziG=Nm+ĂN?Wnꉷ#Wۀ~=nu93Z, ņQ}78 pKӁ>wyiGaǽ_\Zþ7K`ۯ&dZendstream +endobj +1620 0 obj<>/XObject<<>>>>>>endobj +1621 0 obj<>stream +xSAn0 b(Zޜ:EXE[\EL$+5,;"Qjg;@A`V)$+)W%#B\MYuyQAmI Nf06AqM@?8w#܎ڞK##{Z*6VF%VOڇb̈́{L?V?}ɊQݡ~FE;}g@-Q >_zôg4uද]aΠ:8#aQy~ +E;0uof:9,-%BbHӖgcB׸|KEϬE ͥ4 Q3&y(Yu aX(~jvzjsȮn@8"s|b\DL +%~XghAyyOA:endstream +endobj +1622 0 obj<>/XObject<<>>>>>>endobj +1623 0 obj<>stream +xWR9}+xrs; +v"\xgdFi"q{xTmQPƣG?ic9el:tN<ǯ״'g'w۷4b[ vf&\n)}{>i_4雱[Y7)LL@6ޕ&w|"XjG>?Z)l*>4[ʍ*cw1SVmJ,Lk6lSP wܑz4RJ]< FmLSH2< U\7 \7%  i]ur(L^rwMj)}+k]dž`ЊI'DNw(rc(A;]Ql8.8҂!u-QvН &jr}}ۄg(-p4o,j85.h8;ZgmZkB7VPzt֯n!)e14ޣL=j\A~5@ǴeNbd>p@p^ۦ0Y#b,1^{njm4PG vQ iH N ieLkF,&w@w0ͣ˒$=tS&h?UX9_1Ai3|zA0<Eɧ-qn޽x/ +COT[p^%Jí(n +7*IW?hzO;92!¡a*&w3L(7\E2#jy!V=إ] ޅ2H8c]>U<: `]7/i&>b56Yy\C,F?aVC>4&; ft2n.Ȅ~u%r +"re>`\r!A+z6H avEnB]*PWX +KpDxp^0CBez\ +:~ +P; 1" +@g;bC@UUyV=)S%tnM/s ƉO +:UM:m|CmVQH%n):mIT[qm} lZϛ@(H\ԙQW|ْ끘}fO&Hn˜ID$y9k;psy Ԃ˰`x/"fxZ]-灲X!QISp-:l 0loc $5 4fWP\FkV,?qojU0WMkHzt{KYk5v>8^_+[ffPendstream +endobj +1624 0 obj<>/XObject<<>>>>>>endobj +1625 0 obj<>stream xWMsHWtqTa-۱\M BEf@GϨ?^~dBcLh19EۓhLw.<ůkt4;,hbV`2FYReOQ$m(VFFNlJg+h2 N DKi]83Re^P`66ugf`"'Dh_p&D]Rl4bAtICzs8pceTdLBuou:[||p8S#LlN΍$Tp=\P-}~-ש,v-nI3 q8߱#kC%2PU2d`Z9e,mdT7IqI2sjόs_E{"VE~ىldRȅ-cZX`T=T. l#d<ƽp1؈VeYU]YX45@3ڏ+}YOTx3a`&\|ﶀk9^nlbـ1 ֻCI;$Oȓ+[ T!hR :ou>He3ֲ3HɈnAcv -`ƞo. HFUF6Y)ސzQN"PV9dб*1RLty'*hMH8Kږ7l;0A|!Y34=z-RC]vl?T!sA~m9@eCm|lX03(2ZKdhFUxTGa0d`xB|osN0J{n^2]zQ:; (#y|! md:D|Qdڳ``^%L c14YnZ?"?i[' GAH'Tjê_#ŋ2ʑ(T¯5_|dMG~~?tw1o9/Yhevg2ȼ z5:7|g!ܜ76_+0b}F}2]tqӗNۥ2ܵ1fY^ye/,/ƃ!FZj]Yo kh6XHLѼԆU 9_)* v%{ǐjXyRX*̫b"x>QfN(7)#]aT\,] S&v5 ;&ą DcW}Q9/=oۃ凫Kz0+zw<  ibnKl1-؉.flfu'8endstream +`ƞo. HFUF6Y)ސzQN"PV9dб*1RLty'*hMH8Kږ7l;0A|!Y34=z-RC]vl?T!sA~m9@eCm|lX03(2ZKdhFUxTGa0d`xB|osN0J{n^2]zQ:; (#y|! md:D|Qdڳ``^%L c14YnZ?"?i[' GAH'Tjê_#ŋ2ʑ(T¯5_|dMG~~?tw1o9/Yhevg2ȼ z5:7|g!ܜ76_+0b}F}2]tqӗNۥ2ܵ1fY^ye/,/ƃ!FZj]Yo kh6XHLѼԆU 9_)* v%{ǐjXyRX*̫b"x>QfN(7)#]aT\,] S&v5 ;&ą DcW}Q9/=oۃ凫Kz0+zw<  ibnKl1-؉.lfua'4endstream endobj -1636 0 obj<>/XObject<<>>>>/Annots 912 0 R>>endobj -1637 0 obj<>stream +1626 0 obj<>/XObject<<>>>>/Annots 901 0 R>>endobj +1627 0 obj<>stream xWMs6WeƖ-[ޜi3p|HPBL @ֿ[(ҝi'#ݷo?NtsZ]ՒbvA+|/nV ,z̮zvI-ON̂t*/ޯO?N^izNzF_L[T.XJIeJi 2ڽ]a]fK n#ȩ1xJvBoj'ŕ˴&)_lic^N_!8OKrdR[U :&mHNj%cwb+ALY;OCT]Y4Ms\@V l#kLǜ I~*ުg0G|[Y0ҚD5-Y!VrǷ3Zj!EK뽩aFZu.p$BȖ {v.c"efT`B {N0G`y>8#](E>*%fϯQ͝ptG*byJ ̾w;~+5lO[?z,RWS_x0KQCibgkNY;kD~H&T*g*YƯ#"fndG RXFKu=iR-TQ*]% -I4{Kɓet"@"Q NtHLQ ut;9I3e7yFUx iDngd`Nzj*j&w2,z8Sµ+fP[m,xd B+V>W7c /!mw%I @@ -3367,89 +3352,82 @@ j3ԗTf Ih^Dl,/,=J@0GYcr}Iwy03j:|? JvA:>ZA c;qq)y\^ݔs;3S[:` *kr& ֶzPv(CjHaI<"kkCvϺp-_飬'ց,.dCLUWG΀9C@p 5y4(n }(\,vH*C -zi6cM-oߠ_|7 ~W77xA+B s4V؁na抖+p-nw63I]ik=k7.}K]wT^]_'Cendstream +zi6cM-oߠ_|7 ~W77xA+B s4V؁na抖+p-nw63I]ik=k7.}K]wT^/?N?endstream endobj -1638 0 obj<>/XObject<<>>>>/Annots 921 0 R>>endobj -1639 0 obj<>stream +1628 0 obj<>/XObject<<>>>>/Annots 910 0 R>>endobj +1629 0 obj<>stream xWnF+XldI.ЃąMZzeE.MH]FVovIuQ@.wv͛7_Gh1|!޴?2,`F9M 2zu:&y8w<4GgΖ%뽺,9[ 'g^MyfAYE4`2ZnP&/%݌V)/J!{cdaȲ%KMke F>c7ȸ*S.XwZ-2!aH`%z0J%)[ㅶ}J`j^ 2?7x$t!mxFmO քY[)h|f*V6Ä2ȥuv 7U#*v hwarf6RW۫.̕1J0L2€A>[zZq8OuY'$Tax>o0KF'5trv#,$s*X4[#0YYt]93ùglBhM2q:/ȢGr}U<$,ۉ tq֏ OpCvpҽhM~zi 3Tu>(rP/R.-t+"mB `.YsuRVxw 5+3Jx#4q֬kDS9[ br6TnJ|3ZHN~ͩ{z l?b?lVhGbRQe{[\/QCݸ=@)&9}/=/F9{U$.Y8DN"5\ !PP SZ5 2Frk F8][arm%ѬR -ATmQXSVp$օ-urCN lC秚G9%鵞P!s/0v~J11[T.Yc@tw7~vQM={_50l#C[@ y?_Ng~F`}QT\cdED E'\Wz39rp%U;iw&}Ǧ7lC秚G9%鵞P!s/0v~J11[T.Yc@tw7~vQM={_50l#C[@ y?_Ng~F`}QT\cdED E'\Wz39rp%U;iw&}Ǧ7>/XObject<<>>>>>>endobj -1641 0 obj<>stream +1630 0 obj<>/XObject<<>>>>>>endobj +1631 0 obj<>stream xSMo0 W=Ijv[aj`^hYR& G:vv=taY)齧_Q =)KXe (i\ox\$m-kHS(jڒmr(*$B̔-(hlhe|Ym56M>/XObject<<>>>>>>endobj -1643 0 obj<>stream -xW]o6}ϯ@6Z#iCڵO+![hDKJ[IC~s量isZ.l-fVͲ +c)v^Z/2hFmUzK_oX*Vg3zI.T -!/rѼcϗ)l6VkAB,ٻXfWtlOܾ۠T*w5 G{YUF -irߕOI=*]"% -ۭXWnNSJrp| -sv@`pMF/1&f<Ί6$vc -MC5] U=|Iy1=6&h߄9e/W b7'>cG5ny1mȪqN>?Nx,lnQb=z1 /H~z7"^a+fJ䱉 */@ _s?P:B!!Z) -| -tv=VC[oY-ܴVZvSe#Yђ,0xwՅ?c {pۍ<&9+5ƛ{DK#^ -l \-3j4e'-kآߒ,^4b.1m6K坅+q ?j%ށ"cVQDT_tFXQІkq.߈})%7hu!OBl˸Sew/nk15nFꛧ\wsi8bT>S9CŞactBaоT:Ct̯?"%_lyuoV 5:6:]endstream -endobj -1644 0 obj<>/XObject<<>>>>/Annots 924 0 R>>endobj -1645 0 obj<>stream -xXnF}W PQX}pPihWR܄2K.)Q) - rv.g wB)]P\\#:f4)I)?x1&t=Á&*ś h{Lx`ɂ*aFRXI->U_G\FQDo:2z'?|G2rB'u./prM̠Xo=;TQmD0XN2xTVf$l+']홰-2evu5UD efX#N*Q('3k|a_m7ŔJ*W}{PEB"NX 6[G?~7N{*ZV R(Z {L)>ȩ蝣XRy`+tˑF!9-i8d ;;蓮8V ɒL]lɻʆmu jU澽5UA".],q/-*K4ed oI{LPxeQ˚>߅!40й|q8|4n xZT5B<9*_!(1r,*T9b".*!HeVFi޺ ;f2FiW+z3P" ޷/^-oE_q룐15"R>tNp|hk0k[΃],k \z4'"O6_ՎHwP-V-jV -^dm#x-ݍqŭa WC)X{EyEU 7k6Gډ^2f -o*ܯ J$kX&:cbfNC6^ qe{?b+o1֠dpLgY4/Eendstream -endobj -1646 0 obj<>/XObject<<>>>>/Annots 929 0 R>>endobj -1647 0 obj<>stream -xTMs0W[&@iڞIkfrEa -ɕD\'}}+~" -(iR 4K<_é6eP'Hi)Bz:$gsKqx,'4 4 2J Geg83W'Qt>NΈfIgoׄzyFEիRQ<|u~ j!f^ՕNhE81)"ֹ+'J8ZEk!Tj2}֪ %t_ jc]7)I+~k:#z6 S{ImtK OZ-P.wH1x('jn*>8zfpoqrbmi x@èppbYNj=+eX7X- aH6:T,K)5+Z)-6J0=Q׬6aB3P Q;;e,%Sh%=,*ViPO@ߵ sgȃLl/'q >/XObject<<>>>>/Annots 936 0 R>>endobj -1649 0 obj<>stream -xVM6W Cs v!(uuD[L$%);}CJdQh$97fLiSZh~KY5$/ -*Z̓EQ곢t,gI2j+ɬgm2wp:cOOqqf}O mvvM l/-M 5+'AUf3;OoV9U)_l>&4-etv^V䭔d4=*lpS%BiI!ÆXJP07ZTE9k0BK}!EZJzz8NCoY?ʆ #ʌީ}tR`7kېc>W.zqHOЯ:֪# :](GT6R 9:%9Hh#u4x9J)ѳB%u%*V - -*Mu%0t|[457jl]o"H_#p<-Q>v8N%ߙͯjيH(K?3wv`JM2jhEbϢ:5W{仒~uOˆ6d2tUC@&2HKt: 3#Z(l+p1$ -BgΨW-n_`BXAsj:ڣzj9ӜM&~Y6G"ՇUPLc2_7 ݷeepEnlOÿ"ALz# 2+zzx˸ݠ{.A@^ XKf3.ĹYFptvL'TG#Dm֣Uqb\(ogC<6eZbA[/vܶx8QzL{V&rZj;BVXBћM%(uCM#.AX[VR*kS>a%,`-/:ƌ3ظ.㠛Qyͬa֞\A"T)!m`@3uE0ِ+~%ӤeqLRU*E#,GKh֞B׆cR)*K{ X˥Q ys&jb,Vdu{)wϛohendstream -endobj -1650 0 obj<>/XObject<<>>>>>>endobj -1651 0 obj<>stream -xuAo0 -j7v=r۰)vEZm,y~OӭA ae7"d=[ ZtEsc: `e[cL"d0RƿTXb2A_?=endstream -endobj -1652 0 obj<>/XObject<>>>/Annots 943 0 R>>endobj -1653 0 obj<>stream -xWMsH+UF A8wm rXrD`}=(۔Fc'~BD4SRtWv~L`Bi0A ݷfp4Q< ";waiLݷݽ8OO*IY ٸ0)DxpL4}aݽxӿ3Ob6#\I+eE(J*h֬׺O}7_ҢXnf3*E!SZ\rrtch#+L Ť'nDy+](>&p1j@HWbDNYSZD'Zn U&yJ =oٕ2]@*s-RFz(Sz?w~4\?CZBMR&AMdxBGy/ Wir~Q?D\_uap:'#-% -V2HpU7>HT1MH R(u^<>W tD^$4.5KDN7ʀd ꦗdRc z `돍l$j-CChi[nTb U2K~oz}֋Sy+@%]p &eְ&Xꦦ -̠P! -%&_xlTe9` -KvmjxJ,a?m{̓}VbNT( $5~6G@(h+ EՖS(H¦V,o 3(vFZ%9"-WlyV2_I7s*~yyۗW+.H =54q ZY ;9 .ƳC}BN]]_]1?8.f)6o&p_gꡩlOg]r `YiӲ+mL@Y|}yE=SVɕAyn7;(bcs}!\|GYg~on86*TR``y%:Aimb8p)r0۠L=]) #4H{v!<-˜-XC [|k]@\t-'<9-c'@*h2 -&݇![z?| ZuqHendstream -endobj -1654 0 obj<>/XObject<>>>/Annots 954 0 R>>endobj -1655 0 obj<>stream -xWkoF_q[D%QF:5qKE[ԋňLH3CZsgHQ` px_Ч|bB9E| 'sD/P5DYLU TYL"U:smdNHRf.>O7Hp0\֢BGLȌ_~DiciP)5h˘[YdӍTa3iyZv+ʑR츯i4K/-5Gߖ\ms3-@yT\"ŸuD^R,KY@t͋qkǬa aϮFFO+զ[B6aT lE^K g?ƐYzKu]%Jc53cea/B$Ө CTZ3SУ_azb,^R -K}" (Dj=4^ng[>0l*u5KQyhBy8[Q<^rcm1[?ؑkK|';m?̉_c'r |;I[^fGйs4z8=qG?:V%P.h8 ENVt߶+1kk'zǦ4Ks>/XObject<<>>>>/Annots 957 0 R>>endobj -1657 0 obj<>stream ++~D%6>endstream +endobj +1632 0 obj<>/XObject<<>>>>>>endobj +1633 0 obj<>stream +xWnF}WL"hI-/Em4iAȕ6ew="\7a"wvf9s'sgN_R^2|Ͳ-V_#i{--fruEp|'])Z' dtR-V5;ӗ=̗4 +.r%}F9|--&${])ݐ$ĦKIyglҕqdu 9Mq^f'N6b';b85EH"1&[o,;NqElɉrp[e#U8/" DٞᝠoM8W +!c(t-5hކ'`6P@Yx 3fc+x/,[p;uxRWȨ],qT&yN06_Zɺn [U -h9*TьY8( ^ʪ6J>k퐋B*X8Џ/_'_)|~?ij$l}UۋALp#DMdkR8id)fQ;XᴱpUF +^75QUr\ZQr\%?-X|S@ ¢9ppW 5 ʨE^aJ#/P7ISwe7|RF#ķE|!Sx 64 czn-Q7I.riQOCz t/FAL G2HM/(<ǓQǿ3xtF}YP[ɗx=15A{.Jv=~RcKw$0uS@4{^ TK~Н!ŰJ}9A.CǬndyT!>/XObject<>>>>>endobj +1635 0 obj<>stream +xWn7}W UxW7[N>f @$fv)5THe{ܕVk(r̙33gg@!~` *3ȮiY~az߼asl\Ӵ~c}\U>Z3W)o:*N Kӿt1H&8*a;DXT̾b4NAF dgifp]djvND~レ<ֆnNoHxZK/h.*e7d꠴)ygEtX~/"jZKvwa`i*%" fS?#/֮8\Xpj5yU!}FߜB`RmYL/30N,%l= @Z ="t81G+ں R18|Kɀb2z EO3MXZZHe! 쀩aX \;&nb`3ceFN[¿K^ uۛMG.[5i>& +2zkc%0W"T!ad]Xsgyڔ 5 :U; 'u(qlX5 +%x:TK]i^jنdeJBK[4 QCFlmMQ,/H +UQڊ2i5sm""t0륜ZKTV&K=[d}Ps ;+}A)C*jQ?r[g1t^@jeጓV҆1oh!F슛[W}z6qR75wWLxieGlY.~0m^G0u +VkJB)OZ=2?V[姖JhC@fv؃  Ckm +[U,Zϵ:6>}: +"As%$qX6ZćlNbLd{qZ3莓!1 c!D!lUd뀰 +,FYڔ;qsVr19-_Qǽ 9 cwj[.Aqpk)S';^UJ(Qh aӄ }c#Fcjv6Hkz$Xx*i / 7y.WUyy^T6q** IHnB= P*ȧ~\7)t]u|Lƒί# dBF ^6UB)NLgG l!0v.ZĶ=h\AjukM`v}R>>Zxi3Vҁ4F>zok^֞P:=,m뢋^[~syuK^F;5ޥ`jJendstream +endobj +1636 0 obj<>/XObject<>>>>>endobj +1637 0 obj<>stream +xXo6~_q04jr8{Cڮ@hQ@GVUR~ߑ,;qa0y@S,RZ⒲dN!M(ɂK_C^Φog rܽƒY2hSf+׉3\ Gg]'W_f4IgнT}oR4*#Ҭx۪u#\< ض"Z/iB2^}][زH뜲Cͭu96]PLU(7eiސUSfkjXQUM)2OLh@ŋ>g}fSedBgA`۹VUpq0VX ht~hlu=tB퓮n隣Vw98ra!p^OE{7Cp2SB!7:ƙ7 RufwM#V0^ԑKhUhgאRGii2QN5ml+/NF&92ePDVLR5 ZS0EB3+P,8XؒdzcaE}jw}2o;f̓.Sл2QZQfFAkT{༌E cp22-܈}Na_Pj]]$g.܍: Mg{}{i.iz + CsB<Jض9&!sBu,^j2`|;w‹$k^w$O|16(?f&3wbH>ܵ:}H <a[e<{m*,3]w~aC=ݲ3&EdIVg]),oR+QƷZ;('߿7pr0-zTY|EVw _#(Wb}>QU:>^,#H>Q^z%_pr<]RT LnJHtHCxynqȑȧ>Ƨ!A0t{SB;.P-$Jt !32@'jI[-:W@c1@/<+DA\?y U }V[~"pq_y]§2C(en6&"^36U] R1,?kc@x]̯g#31u=k P㫱Vwmei3[RbUݿq@tH'לYoAX`x #'BkDD#ֺĴv#m~nb_̿L:RC(>,@87ak 4"v/"! ndc():OYHd >ХcJukx +},>ndM=‰C5,d@%]wG!Bs%:Q~:J|!i6m/@ gc~26,Jwq1s_"" +5 6xszLfW4Y{B`EjD\rӁaĖ;W 5JEG%(X^ogyendstream +endobj +1638 0 obj<>/XObject<<>>>>/Annots 915 0 R>>endobj +1639 0 obj<>stream +xUMo6W̭+Pd{KSlk{ P$D$F0,"͛7ߓ[zIj2lQLf%Nѱ_Q0y"YargE $d8h9Fpdm|x-LѦ p\jrVfc.ׯgcqUV[ZpIrFcNlՈNMP9P(tA[ssa B-y pκ,Q.?B{<8(UM NH]Ը 0WiG޾>ňeu&'sI8$)yJ)g_o7Yt̹R಴疱R.™)ÛÊ Ul1nrwl]N9RrJ/iDSu@i|{!>3^;{r\.ú.:ycsR-oT ءMk$)_$>X&g6𒬟t欷@,h=j22WEg +w{0׆( ۭȳa +P++D>uIghX⮢V9S +Ĭ(n&xedL\4I˽UmN[RYB58h0??..h@sKK7um]:RѸf3) _ 0}m)RA=8ْ΅Bӵ{g ۔4p0l#FByԠk|ykW.WGnÒrBXQX0+7xmk`c d,J_zBOD]:ry|+EMfV&s:@֮=Dk[!lޔ~lDkm8}| ܈IqW#(=@z2GFÙyucWݦ@?7HpIoVkc{z'gG5ul=Sklp@X/endstream +endobj +1640 0 obj<>/XObject<>>>/Annots 922 0 R>>endobj +1641 0 obj<>stream +xWMSHW5UXrn]vة9Dd/z4ccFc/!~"t: !l?>G·`D%$8u +%AwG r.PZR{h k6.' + >^x蝦6L+8,8Yf3•Ft_QMJ}6wNq8 +jjit=(rG12ѷAUݨfIR".B +#Oh*ʅ ӹ4D%EUʇVt)*eJC\U#3v?AİZ >_ҼXnSD)3Zsrtkh-kL Ť'nDu+m({>SQ&pj@fHWdbDAy[YD'kZn UEI oٕr]@ +-2Fzf5)Wz<$, vZ(g]2Y*)W+`$HfqW+ |EM;EȲs! 庸2?&dŇKk3i)Sy9F˦Y Cb:AlP.yƼ!92GQ2,g% CF;sH>U[fޟl TJNבt;}wڦ-sY +J R] h +y#x~݋!x|s2nz,(7\[C^|icoc5z7 ?RU[th4ZFrmuA3шTX, +I\.b< FOh-% +YRVdt` TWy˚Dbۆ6K2*C+t,KhT~qUUHNg]N(F,صiWKm`5ymg;Q 肣0=r5WYGza5\KH&zbK&@7֟07|w4e*xw#̘zRIi- &{v^=|yD&= Zsq;A3l`i+ +m!٠1';v6hmIĽ|Xo3 +]mŖ{ 0}r`ZPhJ*'o}$*[PBI]T)s>+.Tp:2L0ۃIJ@89Gvt'Z2G3c%=|&<_v}}Ċ`b>',V4zߒʌlrC/XY1q= Eyߢ|q݁8vSV%{:Q->ZqLendstream +endobj +1642 0 obj<>/XObject<>>>/Annots 933 0 R>>endobj +1643 0 obj<>stream +xWkoF_q[D(PDZ6bhzc afH+{̐bT%X%H4׹>74xFQ O &C<&`{cNe-`N,X@n8ҝX{l̺3n#xp]ؗ!

X>$-LD@nVɉ]Q/`N:| VտXbp"ZtA~\[_T"ӂvZe0\Lغ94DRW4gRҼ(2@*Hu/Џwۿ:Lɀ6zHd#x!; gAuH},&U ̯)B6Xj nJ̹ +)3@]1{ ~P" IdkL%sBԘT6s| |pGEG{ek\988 +hB}Kǖg:Q$?#|u`  o^ai5LMb .KKɶ>0\֢BGLȌ_~DiciP)5h˘[Y F< h-]kHP)v4%#oC9ڙӖ Oue.xpO[`Y"G@/),b ThpŸ5^8`0F0gWa'j1!Ɔ53̘3V 9쵴!xֆC epɿDi Uy4Ci4\ֲ2تpD=3 \QbIE\AFȸ\L6ݨ jx:nA&]!2 C0I_V͉UTsR3S;[Yv"D20< в阂%hG7djUX A!P/Av*j{ JS\lh[yTjk#Chy8[Q^rcm1[?ؑkK|';m?̉_c'p |3I[^fY@йsxh=TΞ ikรe+Q\a|z"IE4LvJtbrq^alێ[! `AEo25:m1^ch[S/e/ kߖ>5Iiά>(;!~_\B}uIt\|Ct<׭tG:+W~ntC$ oJV7GKǚnbLln6<|G}Kw5d,#fxbW7״_^QͽNng \?IDɛp@ +[4b.g b̚/7Mendstream +endobj +1644 0 obj<>/XObject<<>>>>/Annots 936 0 R>>endobj +1645 0 obj<>stream xW]oF|ׯX-ɲ$;n(>ȓt1SxwvHSSA`1;;4ل3kl:i2>x8f*y}) `Mi<~ M+vCItq|j9}7+`Hyt>"{sE *-UQLzGIaV4WRƺlɮE'46wUiBeQ_/tG4[l48U^R4sg'z;T g"NamY͞N!4qI~4?,`LK(0G%NUשqeRul/͢. q`4mĕ&MikĹ+j`]LL 0qlx:תПOEIʍB5ۨ6񋜖Ҿ*Bt{JJUO/%(̙ckbm18B_ţ*GÇ3NQv#C*guͲ-|S{W`w'vvAhp:z85h>nuN[F*bfYk.:7{ ]PƮ$,`GLm`S=9rG3uCv<]E]xH!⸍N3drhJIء1B\̎L񆙆2raŕ% Y.h9a5 T..D~ !ՙZr+iɏ}66 +S R @@ -3461,10 +3439,10 @@ j OYDGzִ| %r(S;#`#:h5)&ݓ'Z'GR9f.KZ֪PG"VuUTf[T,7Zbg61}箊7G)@>.|'G-WKYĎmE<mA;ف e W "rp/_Z߅F^~XfdAbX(SѕF28f6/Tre[5cSbQX6Fy ^" -=-#,+g#&O|gIY32[dÇ+״\5#1Ԅ l_Q!]5 \KXnOwo”x~u潱AKN;B\5ѪaU+tfDoYQyx~(dU~ &(Bfu3F4RkS7a*v"9zv.t0rZJmO|bh2F9oF˛K~a 1KW?tMm*;;g.:uendstream +=-#,+g#&O|gIY32[dÇ+״\5#1Ԅ l_Q!]5 \KXnOwo”x~u潱AKN;B\5ѪaU+tfDoYQyx~(dU~ &(Bfu3F4RkS7a*v"9zv.t0rZJmO|bh2F9oF˛K~a 1KW?tMm*;0o:endstream endobj -1658 0 obj<>/XObject<<>>>>/Annots 968 0 R>>endobj -1659 0 obj<>stream +1646 0 obj<>/XObject<<>>>>/Annots 947 0 R>>endobj +1647 0 obj<>stream xXmOHί;5 zG{C^!p&K Ԃ@lvwg^" @@ -3472,64 +3450,69 @@ z it`EJ E}+\7&F $<+!sYJʴ^Ij$L˒ncI Y6TdQDVT)eJ"bIR.s%R sh^0|}}N맬]MS_}b-Zr0ZVx0L7/PtS*%[lɀVEZѠ=`Y*DCu$yU˦+QE!1Jdk/ UF{u, WR7"qh ,T5(`֐S+@R'[H.ԭj~2оDYz0YYjv18ɫه2LYf ®7ϭd<ߏn۩K6˅ jO\'4{{E5"dDt5q!F\ Iv=ar?җY\Yx?a~td'r>_V]éIUMʓ={N?]3zsyMӷ>]<)Si}2s..|'%~ie2g['}4?^DjX.ڠAMσ -@t{(:i5B$Mw0KmTo+e!VysXYJ\(ךf%bV`Z7Ac%>ka `Ki*k`ϵB)E0etMUg]-JSg1}V-ܬ @9\U 3`7*̅JpèYAi7]󜼗ɪAu/鲒eky(M$-fբAe^AeN|R%O8N7q;_ǻ`9n<ܰ"!pW w`0yF3fu֍15o)?PPL07˖kpo"=K=mZֽځ =9&x)VǮ;لW HUZT+Oi8"A7h=lS}(LDbDvc\F#0|w-#/Pbvc*/[2M)D-Uc"ߎk(Le&]!{#C-+QsXҭLs繪!;CEJ^vZ2C8k P&\ d]wǦЩ,3}uh ْЅ20Y?WTe}K5Zi 5adlw`%C0<*.e>8~Me.agSVAfZ4H\<!a]HY:dg/4+?FY.}G kW凈0OB$ʴu1hK^]d1ŇQЂܴh<_a&h :deƳ aK;e|۶gp0WGx6s_$!+endstream +@t{(:i5B$Mw0KmTo+e!VysXYJ\(ךf%bV`Z7Ac%>ka `Ki*k`ϵB)E0etMUg]-JSg1}V-ܬ @9\U 3`7*̅JpèYAi7]󜼗ɪAu/鲒eky(M$-fբAe^AeN|R%O8N7q;_ǻ`9n<ܰ"!pW w`0yF3fu֍15o)?PPL07˖kpo"=K=mZֽځ =9&x)VǮ;لW HUZT+Oi8"A7h=lS}(LDbDvc\F#0|w-#/Pbvc*/[2M)D-Uc"ߎk(Le&]!{#C-+QsXҭLs繪!;CEJ^vZ2C8k P&\ d]wǦЩ,3}uh ْЅ20Y?WTe}K5Zi 5adlw`%C0<*.e>8~Me.agSVAfZ4H\<!a]HY:dg/4+?FY.}G kW凈0OB$ʴu1hK^]d1ŇQЂܴh<_a&h :deƳ aK;e|۶gp0WGK>/XObject<<>>>>>>endobj -1661 0 obj<>stream +1648 0 obj<>/XObject<<>>>>>>endobj +1649 0 obj<>stream xVkO8_q#V&MHe Z`i5~7vg;c;{$c-6>{BOcHVp:)q Άe<@L}}fY˔Ad´#a#7+ztEC/@AzQ:$p2@@ sa&z-wK T&$¾?u@gEuЌAH2w {&]皜݁TpEq 1@C.PgG].EU ̱r*J]pqpŪLq$#03_3bO*6e+@]\_YLXɓy|:Ba[s'^Ssyyc&_dz6QSlim2v9X՜?%0݃9Ok`{y0fZB ut ㅇூj: t.e`6/z񘷀fa?~N[@|ZM%q]ϕ8|L 0H~ ,/P{DGFձYf(WS3Ia5,\{ Yj0wy=|]JNv^p +6S6N|l'R{g, noBL޲w$-p/ @25(@ƈNA@xnkKv}%8;e.jpc ¢ nZ=< r*"+}Uv0QIhp;H97ܬ;!S>kTH4}cG83;/qxح8#{?.q/N ̳BBJbN[X4,JPD!]{BGRH ׇ>+R RWmV׉ 2sOFn\qW?hò(( lsW)(ylvA Hv%e(mtuAʶYq2mzJ[$Lm[ɔp&,am٬ 3Vב֚ -TV'WeA$$%"1-"<Ui%1exf~y<_YbD&MS6ڡ7S'C27 sl ̆Qendstream +TV'WeA$$%"1-"<Ui%1exf~y<_YbD&MS6ڡ7S'C279[Lendstream endobj -1662 0 obj<>/XObject<<>>>>/Annots 973 0 R>>endobj -1663 0 obj<>stream +1650 0 obj<>/XObject<<>>>>/Annots 952 0 R>>endobj +1651 0 obj<>stream xWMs6WQF%w=m7a&=%L3i `}>&lIY9'c>Z4Xѯmџ*@g~ݫ8V[Ti5,@șH(۝1iIWժr ߈/'̈&JHm[%G:6>8x=,@O Na(8sE,;K83`w1+hM|"dO i ` zy(nHojk?|t?ؑendstream +T],/րK# HDMBqVɚ׸.WXcU/K/oe yQnH"_Eu(IJBqx8P%>Z4Xѯmџ*@g~ݫ8V[Ti5,@șH(۝1iIWժr ߈/'̈&JHm[%G:6>8x=,@O Na(8sE,;K83`w1+hM|"dO i ` zy(nHojk?g|t?_endstream endobj -1664 0 obj<>/XObject<<>>>>>>endobj -1665 0 obj<>stream +1652 0 obj<>/XObject<<>>>>>>endobj +1653 0 obj<>stream xWko6_qO)ˏS`ҴY5kzhPBRVa}Rbs4!MFtvNi~4Hx7I4N~V= -aq>śpz0Yzрz,g aBd4J"=$Q֔V /*eC~ؗ)v##t5簙U<ƹJ:]fٝUCp1?wW?4GQp7D+!Hdȸؕ(RH2Yh;Ej*kYK<@cT Go! Z"H%BZʢM,qa,@¦kJе$'pJTo3REAoő3:,q Yts?ivLp-ӑ~@rm~tx܄'coZ;X^ Vb#i%*mDWh*ZZiݩ(*Sz0|Q9\k̚Jtb 5Đ_jUxdrQb5 ,.(׵"g kl<^}+Q|4Wi` ZB #rOx,d X'v#RŖV_Oə@Z&b`I c -C<pXv [{bkpSH<ōAYY w&欹8άW_ U(I>IT*^Ob 9\㥠RV|Z@N4;N_JFYw4CzmN;9: pL 4Oo] /crrnOJ!>ƢYa:#i}^B3y +߱65sk6 jxiN0Е؂0Xv詒X4q\6Z ,=dgeC*}]f}ǷLDlWªM^MT(y`DXkTЦXo)PSoJT$MX>"ϴ1gEJ_޾[#}0i_mز&!rr@Ǔq29B|zfgG *!endstream -endobj -1666 0 obj<>/XObject<<>>>>>>endobj -1667 0 obj<>stream -xWmOFί){  %QS --WUaml]s9U}f6mr/ط;o<31'4=E#Fфfs\O1;o;#:H G#Z$ղFںeJ4 q$2tҐ6Wx&P(\`2fJ;k'4ƪ敡{YV3xnK]'KH-)Icyƶ}QaI0o -d LyJV:$\X]8ʥsgiLTVLU"]F׆:YT5ŵ#-sB{#J~p*YL(sp2q/irk)n@owJ6EagD,<ߴ5l%T2JIXCHc*Ćlŏt/ZڨQ:9l=  1GE,sع -*m jCzc8bk^olj^Ãщ̲(*X.E t0M芥A">+lg{ F -Œk|O -=B2GKGst7˥%.Hgk I@GfR w U"@ˉ+"fj93y: /l+si`pNs`觻HWt"61Ek2Ue4L 'њo7^3qϲfl 3>{Ѓ3=! 9B g]=,02k9_g*ɸh4(℁fhh0c*Dɸ^;5_~<3s>x .֔e -rjbtMe3ʶQU[;`m<=YaPŒMrø"":#x 1$rxd)T+E Vd7~v۠ Zl {f>mV) *:WDޫ'1S~:Pۓ`xRVSmOW"Uȣhk=SDwy9~e@Y^$B4, кh׬?aP)e)&g -DefKЌH:Ȃ C,ӟ_G24eIbZ+ U)E -ԧOL[7׳HS<:-Tuf'ºv 'Ϩ~ NB'g_R} i0N.C8_1]]VB>_n8\>dj0j^ l@_>s7?>g'8͎xi꿛Vos"D½-}I){p':jU4je" Ϫ96<N<:\΍S;6,&`>.,b*A~U-#3endstream -endobj -1668 0 obj<>/XObject<<>>>>>>endobj -1669 0 obj<>stream -xWkoF_ 6*y&yiYE~|gHaM$۝]}=ǴtNIq6G49ͮie|Q<9}ay6xL {̯L G#Z&ˍ(QDLMjި4m}iL E˚V;y$7xR25Z\-و)r\نU]y⸪L6uėȡjE?q vLִw7y|~m믍Iև=dF*W5vq$[q=~k]kV#J -oJh׵q'Eu %REh퀗7֣r6>H_-gq|Vu̝CN8`/ae1Փ0RȥC# eNmXTn?8mF_(U^XEkAoQ해zmKHjʦ$Is>0o!A#H6J<Dwomú+p?1eG >|BzERy/8*ؕ~ۤ -0nhavQp;9=qMɽ[:v#/lƢaQ} 8/˜1h]9磔[g$0$b{rcGDHɋ?w'vch{ Q@\5F+$;iLeJpb Rk0C9JE9p.(2pV vI,tQApcNK.@aܤE -xa1A 8B -"X'̱0[kDf^7(# iJtAb~2lgg -<Tߏ\d~!jd2y(ah~c>/XObject<<>>>>>>endobj -1671 0 obj<>stream -xWkOJίRbH-EUK@[ ]ickvפ̬M\Cry9sf3V;d7ɂGx>)y{qB渲m7_$MBy] Ֆl6 BSe}ܵ>8L}OrlN35HmR*ԓr]MI; -kZ+Ouk2M8M;:PېSM)gۚ-hJmU)~'M'j<`/ "r[U Wvva"i6[O_?cr3EXc[Ї6@DF1EooɺQN|cmDn:L!ĺ-~륦,iű*p1ߍ6JOŌNz28Q٤4 x!s|ҮuL Ԭ5Ѵ[6[kL.9qf XK~x`Gnfm@~ZZ[i)T19kwgg̥pk {Nޣ\ *QR4&TGƃTVш#?+/n RIߜB <=wcDqT\mˌF1edWYJ(d]rd\lh٥60ud:hxAV34%J3Rn_ilDbQf2nbXxG҃~UTu~OY~6ͫM3?˭4 H~{GDoHB`YFt|GPLNF<)W}C(zmIäxG͖DP1{0;*Hգi<Σ Zs4>s_0e$ОGzmHGׁ*@lkr3n[PUO[+{41SZFa{TbU؍;L|P?X3Gt%T5d`eT{xQcer5<?C 6lO"`=}N{OV;s^wcG6|/eiRQwykwJIpHaB'(&K\V8,"8C5$d0gU,FIYkS۪8x8^jaIֵGtn\Xyl^h:ݦ:OKɛ - uƾ,n@~$阔ae-F[Cj0EDHeL82]Ў0ޤ4A|K>/XObject<<>>>>>>endobj -1673 0 obj<>stream +C<pXv [{bkpSH<ōAYY w&欹8άW_ U(I>IT*^Ob 9\㥠RV|Z@N4;N_JFYw4CzmN;9: pL 4Oo] /crrnOJ!>ƢYa:#i}^B3y +߱65sk6 jxiN0Е؂0Xv詒X4q\6Z ,=dgeC*}]f}ǷLDlWªM^MT(y`DXkTЦXo)PSoJT$MX>"ϴ1gEJ_޾[#}0i_mز&!rr@Ǔq29B|:fߏ*|!endstream +endobj +1654 0 obj<>/XObject<<>>>>>>endobj +1655 0 obj<>stream +xWmOFί){# %QS +-WUaml]s9U}f6mr/ط;33뻝1|BCJQ4hMhv4#iv307XB)ahDdZH[]Ld0UFN&\jq3EA&h-WڡаfrWxUgY͈Qt-Ww,#;F7iS 8/FA-.bٰ?}Y<έVĮF <6>~[1ڃժ9/ڲװ D&l4J +AKQ"Fn8M芥A">+ كVCB%ewCKrB2GKCst7˥%.]"Nk I@>%̤prWE,.HaՊct>t7^VZ;ͥ$Ow mw!ʯPsDl2cdk2Ue4 hdٸgYE^ձy_{}Ѓ1!X zC8 -uYad s +E|$ +h*P K+a#`:7T&qZqwj_~<3s>x .֔e +rjbt'Ce3ʶQU[;`m|{AfAYb_f6hYd! &K08]Q -Zo@ݞqg2Oml/h-Cw5I_O5Ov[4tVy`=tp@B'Xɧ/[>lEG{¦Ή rL/'49=Kzю  +wZ&B']rA04%*W햙-eC3" ֻ:4w"geM=I)SM3բ4T ;q+PC?3m0_z""MKHR NtQ'Ϩ~8So.*O..g.o|M`J\>q4 Ùc: |¿pq +-| +`s7?>[foxi꿛?e"sbޖzn ) |ΟZZ>);Y5'ݣb|G)ZGߞѹ7|{߆{r + #~2ϢDX/;UT#7endstream +endobj +1656 0 obj<>/XObject<<>>>>>>endobj +1657 0 obj<>stream +xWkoF_ 6*y&yiEE~|gHaM$۝]=ictNIq6G49Wiex(><h4&^آeMU~`<)Z +sRSɖxlD9.lC*ɮvOZq\UdjjKPEnI ⟸rf&zK^kv;훼F>Ncc|aO2Q9ulMmV\Z1HҶu*dnIC]'C*mZ;-=;c޼,`:qg,'.Z~  00zpuJqk +F4䡃GkG*4CStbץG̎/XSoP +v!::mƹuu%ϋB^X 'co̺B2g Vh:.=yn\o99dک$~_zd 8E`Mm2+VGL£YL_t]smM/ rs{RjGFNqS:= pyq} G$ނ~y>~s |QINZSYnE½2L.wΡRD 8CÀf" ATk9}XӒK9P7i*^7gLm| A-s,6 mRA|@.J`3-ɵs"34%vX Y1~5lgg +<Tߏ\d~!jd2y(ah~c>/XObject<<>>>>>>endobj +1659 0 obj<>stream +xW]OJ}WL!R^ TЕ6ofwMĵ~H;gΜ:Q`(/UA4"OFKȴp7POsUavr#lm2#iLUVJ$Frxv Lp!^@hCPMҌ;~:('-ѫe ۼ;&'y5qSMjS@Gr+M%;:X053O +衩ADUg*^d[0!Q%TL^! +RCZe8fQGd-\߃F/2_Fohρdr#OmW@?cIu7-*ӎqւ ZAԽL)T]0=**U}`>dhF#:pAM0W*ѽA(^n1ŲQԡE'b0O}Aw{>Baw;#G_ʗ۲k( ;jż;$I80!F%._dqY+sI muǡQrL T2A #^CpƵ)mUFf̥h|OHU44X9U#?A)RCBp['~5g\t?wt*|w-Ҥw P[q Yy,{beϿ!IJk/ dZ]]p4WBxMߠyl'!z(G i5=`sL t{ΖhK)/\p&G)n`P6Mk>/XObject<<>>>>>>endobj +1661 0 obj<>stream xTn@|W*UIM0~tFC}<`m喤;wrV%ݏYD!>LhfaRt :X yp&/%N5E1e['I08 V}UOtk] ]w=Ebپ:ܐ앸7U]TrI@\ɞ;,lkL] {th`EuBfd4M>R7VqXB۪ 2 >;UBvitrB|4(獵F }! @@ -3538,137 +3521,129 @@ N {.Vvp^K ݹ& #Ў[rv=\`]`I c>0J#0G .tId:~wOWLz] kh U~^1 -wP쯗C62 ?ឳendstream -endobj -1674 0 obj<>/XObject<<>>>>>>endobj -1675 0 obj<>stream -xWMoFWLuh,Y-5IXiuKr)mJrݥ%e-(|yfdJ3.U'9/.K_.{NSqj}2~AsZX^:'?ǓV5A;>O-7t6u.<)nLycxtNiwtL|tVcmFtAWtw~VyJuf+MM[*wFi(XT'xRD &S%2a4^*Pq֙vA!= (ss{YOCwڷZdjG`Mu[ߍE`0 xU -Ok)v[xx{KL۝ˡRnVhgvX\}s/{*L&Bj@Kn@3tYo>c.#I#ơ'u8Nܘ{XT|TR0:p5,}H\6}z_LA{ےs:f*ٶnƵBp^Z;N%"SldB/;q-w]DerZ#iua6-J@gR:Pg=4Ҁ^t.bĺ{,wY5c!Ŋ;:likv? Av, CCgQ4&j( -i%rD8 6lSК D[TN9$Oqp+ƻk>/XObject<<>>>>>>endobj +1663 0 obj<>stream +xWMoFWLuh,ّ-5IXiuKr)mJrݥ%e-(|yfdJ3Ō.U'9]^\$K\.{NSqj}2~AsZ2_,iIvzM'VmƺtY L2)nLycxlz鵭*[|>v=VScT6PTzO& +LJei<)U\-3B{@Q.t%yU紵;/oK뵮6J-` J7%?,v=?(\S !>:;O C;4Z9`΄y*ˍu'4iS?Mw'g2Dt) d8 dF]:'h@(ة,[lD>7(cLJzMj4x 9gznV+ܴfDP7B#2t9D9*Z٠=Pw:nԒ3Dr|A2@6&k#OP#ʒ+03Wp̓Fw0%Ժ +/Ͱe޾\+ ,fF'yf"ŸвSn^;G[scaMzS}2SJ@L!q %O}"32mK +鈫{wbg2U +zh8 Lm CĽVu%mkqօٴx*KBe?Jz-7lJA6g]׌+p茳m_tٕ 6 +F6Ә\/(Pcko{)|(fu. .6MAk3+Z“oMPi; bƒ\f?]ZAIlgޯ!BRq7qŲח3рFs ]fD=x è +qRd%xK,#y;M +}}@@@0*y)@Fg0\C3$=ϣ/d/1@JS7jtlt&RG}Zc^Jlj2 17AJ: P5eX&u Rrw_p0 =)Fʛ\oefwց8 > m5[Ďjy薱uk66XlFuvSr#󚸧*]Zk6"EڜFb0s -*X;\~UF?b|gǏG QY\x!~?5p<V?A`y˯ڱ}i5>y{u>!`3x#ReǍyw0q9`LuwM#ވw=ܓO"+$$;n?cq'eh/lo'Bendstream -endobj -1676 0 obj<>/XObject<>>>>>endobj -1677 0 obj<>stream -xX]s8|eUIԧ]{[xT6V/0 I)H+_=%Ӵo YF4 'oS:M+IMd>c.FqzzDiJ%̦(h Zk) -iI*tT%-U))6jGUl6Vt/Q% 8&acxAP+RomF&я؜Ï_MM'R/ EVl;EXdtQfN ls8aQV="qk6tsKRijsED;:MhV*r5t̒UHQ -HVz#v̀x{#InjYl8k,wZZQ˂_}sʜ!?[ ǁ]R9(ly>3ث /k8A T(韸UZ|jgy{zIiO]6?AܸVUu <532G%׫_ɜz78\jqo>޼ ~K ua48i2Ѱ`.z0T= 7aLSg& lOCE'-lɊ{^&xjSf%;ޮ%Pg<+F{Z͹)d|4-os7q GGvGz͟WwVh֣q̈c0(@u}Eut&!zTt(S@PJC% {Ě`F ɢj6:V&2#(?Z5PT5@z^ &zyr?[=$(s&GbKo`l?!;/Fו\ԅʘKC26h![i>3"z%ђfCa՚JE[H3H(f$@h)A;҆)K/,Q>䙭:] ;J`Y2 t{L?*BmV_>Fly}iάkl˪8;;%p us?UUu]/t,ey둿$<{ۦaOJ@@+8.DlphE E K }b0e.D(MOs|â"f*<\liDt¹_{ A0OXEQ2e4^޼5p _'|<4̆V_E6y(66UetL'p8FGg&endstream -endobj -1678 0 obj<>/XObject<<>>>>>>endobj -1679 0 obj<>stream +*X;\~UF?b|gǏG QY\x!~?5p<V?A`y˯ڱ}i5>y{u>!`3x#ReǍyw0q9`LuwM#ވw=ܓO"+$$zy7TxLehlo'ºFendstream +endobj +1664 0 obj<>/XObject<>>>>>endobj +1665 0 obj<>stream +xXr8|W̲*uˤDJdV98x{ LBb +`ҊdU$ 0=4фwJI~/i2(~5ǫ˲09e,G=nq4Sb')- +&ZBZJ8'kIKUJ#" Qe47MU.je4݋A"yveI6L)Φl?/_,TGIn#6c$~hSӉKcsyB(N]xHq:8DٺhF۹Zn|8$cVԲ`W,2gHn~=}=$BqkTj["EU-qț¾LO%ҙ[U:Pʧ6cNJ{"ɔ.[@^l;.P̖=*^JcU{x^]N ku5y!MhwٰC@]ѐyS>et: }͒yhd- Yqkۄ\m߬$w۵g%Vh\"?Y˴OU)ryOijȒ*K b|(ph(s44@{+#8 N`>կWI {6F?Mh*^ =PS߆"eK׹itr~_렲mkazRdEo~x7џ!pFŵZڞ}>|qPEljJaQXYƦYZ.Q\TR?{PgiE;5O̸GtتOsn +=2faKMfٿ#nJR=rwJ^˫;+PtQ8fDd> C:: F *:)zhrc(ޡb*6Dcm5~k#8bMWK3Z7o³w_B_=bM#؆dQ5y+ ^ZwR n(* = r KsShs9xo0r`㟐N.xwe%\!TWSJ4T4{]gThT!0jMKXƢ-[$}a3m 4ou G|iVy( mk.c%0,H}wX? Q &Q6f+PQ/#4Zg5eU\ ndn*,/x=[㰜d'wo42Sރk +;_U}BqaxlVY֪ +7xhtsakYhL6ɸy%0c_\%U ^η>У +b--xp!w+c0p/ !_SP*w~hDMLiF^K/:Bzjx*Z"&,wlwuwd،ޛ<(PtBOh>+Ń*`Sgy}_z{[tCLdwYЌ_\P'6( +^ +OҴzt{?7,+b{Z*L>_%;FD'נ Uı g(,tOM%ͭ{ o:Np6_"j-*YȜkmSUz Ot2 w!o~qg!endstream +endobj +1666 0 obj<>/XObject<<>>>>>>endobj +1667 0 obj<>stream xWn7}W 9Ю.%@j؍[- ]xܐ\)=CUΥ j#"vΜ;ClBYu2H4O3_L5YIlL! `H|rApo0y֝RiIt{VBW0Jv^e=2:<9rMI犦,˜?%8=P2*,Q8l@/m@z4Nnj4"X|9<!Jv5c󇖿lCgp6hP[.'\(SY=е cl#CL|EKh4HD˫m\3 |$= 8& G軔 ښ6a%._trpȹĘn͖~S(d՚[I<~ŏjB =G\,x*^[2lBl#o3 ǭŒghjyݫ7U&2!N| R'A $C ;p eE,jaږfZe9Y͜BedIaAG,&E#jR%ۃleE aE|L5Y$*1W%1352Y( 飔uJBϔx!|GNLV{bړSSF%4뛕NgrdaN'p˖}y]Fe - FD IЅ#0k5ŐqD+agU-0,bvjl*TÊE'2Das&1cv͛p s;}Κ0m>g"nl׷W)>m&P0|tt {e](O!gߙ.h2'_pJ?a K2G$ݼO߹e+ﾘɯ' -fIendstream -endobj -1680 0 obj<>/XObject<<>>>>>>endobj -1681 0 obj<>stream -xV_o0S%Ֆ4) h>4H-d/nb$lSs[a VeNd%gߝw怍3h!jWvڷ]l ? y`:?_E۹rUK[ז=c%TL N da9>CǬ`8 -g@% .B큤B(B*:QU D^q b%! pONp&ϝx{!ƻE -gŵ>"ېLZ/!KgP4 T]bs,0z?ޝzfxݏCFO -PBrX>/XObject<<>>>>>>endobj -1683 0 obj<>stream -xWQS8~W/"pqgX(t/ 4׶&rI - -Ut:m|9ΗZ`_ :gо }j́ _[.ބ`[mO@_Oc~N5̖mu̮Lė4(CʄdgBU ,beҬ~FƄ$8_cv;M;q ? cJݱK1 # W OfY@ !/sa ǣNIo90 S\;þs?^]X2Fa. x?-˚W $#* -tOGy[~Di=nrE_̪z]A֌? V^:LLw}81saS3aU-JaM1ykOW0Gw^TP!Rzp'ᨷa$i^~& mrGN/QQxM3@HIB򓢿 C9[-VrΘq#dMC ( ,D,m}f˃|)KnYd8`y 6- -I G5!$#`Ps<wJLB#Xh*#$f‚!T!bY I&,bTr:_)UZ! RdeX&%[~m[/-̈ H\זRzT7fD̊d Oas.&*%kBCsh$FފϙNJ\Z"ҙ{WKVw)Di"᛹=kCٹ>K~a"fE@@TE6J:pn/ W1A57['s0u]+ϫӻK} %ْ3dYѓ>%]K8#kijoEDzmjYgJݷJ=YR֤ʏ`vlMVon-6rC~cQ;V碋qkW59^ڿAD1endstream -endobj -1684 0 obj<>/XObject<<>>>>>>endobj -1685 0 obj<>stream -xVs0~ر/tn@=郵1*'O B#g&Eh6: ɗotOոtgN_5]#mv5tP ]w5dܚQ:e{%Ç7 KEi\fJg~rN4#lΏ+V^jfs*vh O -+(YÏS`R|b`  $# Ӓ|!8t&7+sf Lձ́5_I7(aR:W螀T=?SBE^}tlJw苍p|rhESGܓSzTd+1%xѧUֵ9Lo_<_"pEl>M )SJBQhNlgusMj#^5Rkb&gk3i2\wt}wQ(k.Wq(!kx(BP *i9b}2ӌ1=Xy`yQv̦rAH/i<\)ͽ$ \^kVPN'$Bkjzer7}[zG|W_HQ>h"hP]]Skk8$\azQ"iTvzX)3aߍ|endstream -endobj -1686 0 obj<>/XObject<<>>>>>>endobj -1687 0 obj<>stream -xW_S0їzNZ=gDZі+> 釿@RH N.dw??`ٹOk3RF#o7#ːEq ȯ\@>9е!W"6{{B ,hҽrTP'7S70HƲ)'JM[G76r&ctiFk[ȱTt [L.G+‡gOpOaJK tR}clpg۳*Xu )`/S8Lj۟Gt\?h?~B+zG -~E8_W@ڞ K ϫ'–g.+'Wq_2࿈!=SCYMըWא޳XPߒ%9h:1qM^h+hW QmFҬecؙNܩ=k_n_K-UTIj7VYT—RrL[TnJUKoz],pue"4jFjqN+Т]J>&ocx -iJC_5ܲ:藜պ%MY&('m`LDMuB,Om:zˠ[%eʖ5= 0[18a W|ϼ0yBÀ% V0a>IK7t緍q5Q(8)j` Nzz3zb_Zendstream -endobj -1688 0 obj<>/XObject<<>>>>>>endobj -1689 0 obj<>stream -xW[S8~ϯ8c6-8P v&L )qyE,p,Wa2Ï#NO-]g&;ӹ?Zׁ#8>p> 'N؈|߇ ly^?-܎uq~ݛ$|iTևM !g*$)t<+sSȤHEdTJP.򂫘K%C2{uRJ#JTHbF բ@Zșs?!qc&aDԃa -$]@H$=hu$RK 8aI"BUOe4`$IXdxZ`DQ0enx?؞9\sg)56#")/,I- -(4syZK906tE+X -/J= oܚ< k 8 ے)|e,4q< M'bT 27H$\S>\},6@j] h~VK3łjzhaTF*oSA~rs]Ѣصkps{ 6[[W!(ߣBo<:ÛfL.nHW3tEXTW|=6:;ZM4.%@l|keO N[܎@e l婹b'+U\r&D+;+5q mjTXmܷWuNX;׵ko-/XfSUu7[®ARoz]LcӬo6Axn{ c65 .t:Kszc^xGr2]-?P%sc:/_ΉwAWk:1a)N~~Gַֿ`uendstream -endobj -1690 0 obj<>/XObject<<>>>>/Annots 980 0 R>>endobj -1691 0 obj<>stream -xWnF}W +IEZhbRR0ȕĘ䲻K+*=|Q\ʰ-r93gΜY}R ?! S¾ߧpmjIK# ?\G۰nSFqPuҬZk 5iZ9voSukqiD!nͣ3rwտoAvR[ŋXT;6ʤ]']NOjF:q __p#p_]_M\xw7&=QQ' ]<_5N" -oܒcₓkco*z$7 &ג^(gUNDgo3r4{zi6A.1++ck=>Q0F?:]rW Vȝ;2I"i*.amap10IVJ(T^M7aUZBR>JDNInHSBF"a`jcNxkCcZ8^A); mu0P!4$M(䈼A(qT !'_zW9blxY ҍHkiu"oˠ7kRGy,t ex[iA#Mav nNC(&ܒi_6fO3(ZhDeaL2}ZӧS\XHW=-ʑ-SQiieLRi,(]V  ޴Cc# -uªzOR&u܀>#3YVkQ^za9DžF'&ƨps3-ɝUj悭t>^yEzՇU0L00 -!¢Rլ<7]C5'NFD+HB􁘯d.$A\۱j9z;hYD@yzج -GsEVѣ[[-r s ܕ -Ik<&%#rh{]eh&G'XbĔZ!ʼnHՊ.N,&aDL֍!vޠE|.~׮1aFendstream -endobj -1692 0 obj<>/XObject<>>>/Annots 989 0 R>>endobj -1693 0 obj<>stream + FD IЅ#0k5ŐqD+agU-0,bvjl*TÊE'2Das&1cv͛p s;}Κ0m>g"nl׷W)>m&P0|tt {e](O!gߙ.h2'_pJ?a K2G$ݼO߹e+ɯ' +4Iendstream +endobj +1668 0 obj<>/XObject<<>>>>>>endobj +1669 0 obj<>stream +xV_o0S%Ֆ4h>4H-d/nb$lSs[@ eNd%gߝw怍&e+R;pd .~`[mw{ OQHBw>/XObject<<>>>>>>endobj +1671 0 obj<>stream +xW]s6}Wq^Hi`3ΰI7O[`ml˕IJJ4uf-KGW+]kC =q[kZ%M-jO@_Oٿc~NC ܗ#3SbOR )qOH}׾8I K)R4@&|7U/$hB*Ǿr/DD ,iD`Qx<)g>x_qnAߵ'ieaۃBjLxuaʚZ4R(,k~_BǓXP,&2ꐎ26zܪ=Uח$l@]uMw{|cf2gp`3aU-JaM1kOsWG^TP!R߇L1A~[0f4PM/ /6j`z3q [@P֫U3&^$Ѐl= Kh' _ʒ[-f^ǹ8Y2^$!BClkBƻ,hhBdBhv4q@9eXfv4*~Uy?T@$rf2B"., + j@RT7Id%Z +Qobx'%,2,. dk7b|eaFAdRf:1CV(Xx +S'nhR.J=tx`:HKB`} !x*H̥%!3to##ze6J\.(1M$x3'tm);;gO='" }4,hBQ~*TҁssYz?jx95eo|NȾ&ӻ[Uw5z.%ْ3diѓ>%}K:U4G=hշUkzj[gJ̳ݷ>J=V֤ʏ`v[ꛬXnd2wϭE?׎j?kAD,endstream +endobj +1672 0 obj<>/XObject<<>>>>>>endobj +1673 0 obj<>stream +xVs0~ر/tnP=郵1*'O B# Eh6: ɗoC :Noݸpn_|Јixdm~64Pu;,s:i'dDzUkj;pfZ CJOä`C3a\p/LiR|6ʇw/5y6cVqsS;Fn'5AG)B uZ)7a=,)$f>2Mi%)te?ikeN17j[ïcpzw40:.sn$@^=RPI,#{q ^JvAHHö m,sJgǜr>)R=tp Уi}pB$W^lIMd߆"x'[> /d>Ů:2tv=ID-ʯgnHR"ڏ +Fsb<ȯ6h6KY sMⱘt .8BTV n:2AH5f(i%71DT +TJZX$exyn<_(;fS幠K\É2}x^ \ynB*j"U$BAew{D뷱ɉT){p}1@epɼ͚Œid?I\saq;uX)ӎ0{endstream +endobj +1674 0 obj<>/XObject<<>>>>>>endobj +1675 0 obj<>stream +xW_S0їzNoVfJO Eᴄ 釿@RH N.dw? ׇ`ٹĝgF' 5]} )#o7#ːEq(ȯ\@>9е!W"6{{B ,hҽrTP'7S70HƲ)'JM[G6v&cteFk[ȱTt [L.G+‡gOpOaJK tR}cmpg۳*Xu )a/S8Lj۟Gzt\?h?~B+zO +~E8W@ڞ K ϫG'–g.+'W"? tjmu &<#eYC,;Bk}d ƟEQ!'gK%K4rntvk⚼VdѮHیY+]t23S{q4?'WZݩ"U)n.'/(60e թ ,ݔ* +fY+DEVi;PVE}LҔj~+Xeuj/9uKT]L;PNR"`*YtAAJu˔-k{4a?a 8y{iօ +W$X-Ä,&I.@o]TiPi5qRԤ6364>/XObject<<>>>>>>endobj +1677 0 obj<>stream +xW[s8~Wq6I +;@LlpċEX$'L~Iv~|:7g 5}-~߀qF hԏ<Zf7WHD<Ñ%g*$ 4=} 8CR +^XZ(8("fQh$ٵrN%bAdWV^-=pkP0p,5iXKxɃS!r04TP7_ `Kqp1[uIoX}ϭ 9 J¥ +P^@* $^T&(ȤdѺ҂XR]4G b"%Z5O║ƼW*7~y9@bb]I{RĆΧz0iqWe}=w jP[xJB]->FSsL_B[B]-.HM iUWg3o객".k_v :_/XȦST0[n+AQoz]LlovAxwx[v5 4Kj{9~/63}9tovi1W}_'&t"S +/^OR\1z~?uendstream +endobj +1678 0 obj<>/XObject<<>>>>/Annots 959 0 R>>endobj +1679 0 obj<>stream +xWnF}W +I.EZhbRR0ȕĘ䲻K+*=|Q\ʰ-r93gΜY}Т&~Z4hSOQv k>u|oWKZΠtYY=چu2jUW)ͪ^3jxڭz=g cxA8n1͗?ėڤyxF?=8hjCxhaVb8Վ 2iInׁ4l/ɫ6X'7R{Wϟ7OXz79l2Ouѵ]ӛ.:-<&.8)::Bۭ?NRpà~ir-i^r&^ŘDtv:s.G)ZQ+?i$}C2ڳc?iA* +sGf=7I$MeڥV6m0vuR$vM+{YJ[Z*M0R*-m!R%E"$7V)Nu#00NS1'5ToZ1-Ds:odz&L rD~v`PY8S=LoW9b#t5FZZ2vQf-}BxP&Jo@ 4r(Htzn8aB69b!-8ac4ЬaT&T,Ӈ5:>ȅt#ڢRi8^XV$f }BuhUr01!M;;;⡀,~UQиԮI7L8M7b vFQrS`SGX#H&yq-Pzfi, oXҢJ 2:T-Y؉v\[[f > !mާAJjwDTFɕ͵a&5'j9D6Bs܁+če9*4|5(;+&jGhQABEŜ]wV04'Ps-tiW9E\w_4Ecz˒. z_΀erk5?{\R`>0 f5FcCitOLRmU3ly{WwZ}h\]3`",QK+и/Uzip58TyMnNT:l-JJR NdE$yx=U]* \KdIJ{($9M&dG*?tjJ^T܃ /}ń4ɂg\. =;:bo|5y<@8BHz m~{ +Yh*wje[?#w³]a->޼t7_NqvTXUT"&[;o>u`V~?<jendstream +endobj +1680 0 obj<>/XObject<>>>/Annots 968 0 R>>endobj +1681 0 obj<>stream xWnH+ -:cnZ 'Ad5|iMmt7%k~^5e!6 Kիҏb'4xFiu1>whz;gEMW%gid> ]Qg$xk<D)iMf0aMw7?JpgpB?{>N(IhfNG2. YeIU;i\.q0\02e#J4T -+ͣtl-j-Y2& dWDv5QJiw?Ȩdk{O4٠L0qHh'pCdQJ8ŝPntE_U>{^ڬ TK T'81eIƨҶAVc'hKNJRp^WaZjm1H$Cu*IjSf$e:*eH "t!)&,Q Wn#Y:ë*!$(v$PijMMHjm=ia茨-h Aə0up}Sh]hljT|X -#3avo{'ʌBJ}RQS!6d+~"wOZ8zৗp dۦцc]8s9,)Ñ)){_fI'TixXcT(Z P}OZ"'~Wg<:u -*m -b,Q L.߷WOx*R-puYі ZiCK OI[HsFAv Ay[5Fo$Xt:hr+vֽTޯwMG520.G,a漱3]n$ḄQ8<{\r񾈪i$oO^玓<@|JWpԚrFfb30t}T OAe ' Vy@E4=EVxåO)IN@Wr&ref5^= sKV#yFl= oqg2qP𗚄'J4,\UQIu0Tu1v<r2ɥKEQe&: d_A!G/sIJ.}|ˀg˅!x'llnE6;Z_x=^>/XObject<>>>/Annots 992 0 R>>endobj -1695 0 obj<>stream -xWo8b/u#(ikvX h$"ea{Cʉ콽AmK"9of޼8Q=ň.?zјA4䇝ioHךu.6|||6b?QFA*9/`h0>VggzXO#4i8]ZĭmKUXzUƾmS" '*_n$%ʲDmunTEKK+]Xnȭe@-al.垂9_<] -{~Mxnzxpn,$rMLPci^WKt4JmmT 0nt6*=X /`D'P<_VZgª8hV*u#2'%t&HpAMճKʼg;7]z9 1&շf _gW z8\6ص.Hz铙A 5k9W#-Tp{}0] `Isro0fI"LJg2Qb'yQy6x<y_Y,zJ凐Bڡ!l K;e7a6'PW2l" dqUOsDo>ojp,R_"ENFkײ -e*(UnI,geŵ0&쉩`Jd>{c -Y&X47k6f&Wv'Jj ,QDb>),`*$ǵ2\*D3MqM@zg_ުby B`* ")/;v}Ɯ NgȆH!fN RhLumXbU?]Z |㹗Z֕(@r>C࣑PUXZ+S&mF1v1uJ Qwdɶ1agl GNQx('N Bғ^0s$$pМPQ&`^:2o@_qEѐu - g^|oQ2/~Trwcgcrk|?uϝͨL\ e -qmwg`8?Lcp9@Shg;K*Y'h--XiHN -&|^*_id#^k,Xr[W#iתH"LR+6$3ۈs3>" 4˞WI?a2Y\a4( ?{q~Kx<Fh4C>;Ng_ 8 -k=endstream -endobj -1696 0 obj<>/XObject<<>>>>>>endobj -1697 0 obj<>stream +:cn68 $e9 Klml)YI-#gA\W^~\$?وnVqO|&S|V*?Opg8Qw~P2 G}୛v&LNwob4 6tW{$olt{g1% -s8g|1-Ა5:Q +IQc1.!oP6"TMACPJFpEh[媔vgm!]PJ6M )v G8DLSiXFWUu +XM L(i_{Bc@S uA6Ȋ} B$GNZGi5Naxtah4@-kDv ԲPmiZIJu.>ZkR-)=dH\%2I[mʌL['V ݞY>.#Є%:j -w$Tgxu_%D_Uvd?d\*-[II6-\? -a~"(9ƿn.WoJx mMj@a{& -}DQ>\?/`[*j*FlOIXo2l4psp!%7Y}`8?3_2e4_3*K~ +E+׾iL t>@dR ۞G:>VAVО5@\AL򗚥#*ZCWI_]Uʽ^N>+ !4Y+ Ctza3 |I2iZt sx"hծ!(][@wd@8:C'W-QnҺ +W5µFH\r2:ܜ7v& Ѝ$Vԓy4 +GqK.Q5tB t0Iq'/S<6ZS.HpLlyC^ʽrI95$JpP 1ȢȜgh +ϔ)? J^Cμ֬Zߋg!a0qɪ$P҈!uޔr>L[&JRD 23~? ɵN5ŽB[W>5Ty)#?Z;QDgL+(a`tDPfP7伜 +KE>J$'cn1  ^|zGS7tÐ聾SF>kk~ mU xO1/ w׌lQXwS eI) vaj־t-X0ښ)n/gx:iEÅ4%f 7ן0帹\ă/6űWP!~S#/: (uH 7];%f(3 h,RA{Xvإ{Lz0D} ~ +L' MHXdw޿яu 3%x~C, I8-x;` !;Q\LsJ9~/;.,endstream +endobj +1682 0 obj<>/XObject<>>>/Annots 971 0 R>>endobj +1683 0 obj<>stream +xW]o}%r*Rd9@pr*4HnP@"W$..eS-Drw̙3ßg=G}QewG/Ӱ73 Fӷn׏_CeRr QK)iuiqֹPGl .4Iј3ХEƚTYe6%y5FRR,;NdڦXVLU% eܪXFrZ)XYإwI+OQ0hH+!56uE L7}NtަFCLkcIYȱكuFtJLXmߊT%nD2Y&$U҄i.zpI|KW#OCIaz]̯o'qq:Yav8Phn&~|OOl]DoGǡ>,.Z3s/y7U_W|&^4'' cyl4:,r||h{6p'%f(~|oo7ł_!T~ )ߏy +k+ȶSvCgs5~#f*L[Wd{:wOt:m2-e?P$)hRZ[RL%-邃e𬬸Ä=1"U3g D!d+F}ƬdDX@-v3!%7? 6^^$ +rx"K\XV TĐk9i9ɼ2{VAh=NRHk[@l a4cALR0A$ezǮOS]{v9r99IuAY}͓.+PK O|:RѺ@pq[q(|4 +_Vp~ɤM2߈<.潱jnK)qCynu~@%_"͆V*MAa'2r,wݮKY+͕l||\Q~MKn~j#mZuIIj؆*^kF[DQXt|xe'k,K]'jAv2D+YK1Gj&ێӒhM(*C/3yQ-F2U/M0(Z _ (1mU'rax ͤS,b*`>J Fi/zEYOJ%Or޲Lr2X'wn0wzSz#2-]+ř"8q.w%jء8o]顔i-Z2cFWBE)#x#8afB́5{u0Gd==M"xN V\WBsJ~SvK'`~o;wnLJWzF^ts57gLx;+%gO0o / [8ٷkendstream +endobj +1684 0 obj<>/XObject<<>>>>>>endobj +1685 0 obj<>stream xWmOFίKa A"RA[EEm%h޻`{:򡿽5!UC${vggݛ?:b|7dBNi8ǴHO~kMѫOWt-Si67嚮 V*[{Gz墄>?(U%-5-gkw7xrL~߮]:5[?Mߊ*fiTBxReɁrK*]6Ԫ'</wrM)6ZOmLI!SJ\S8B,l 2 pts~;ӳ~Θ\+S;s@$pɕ<NԖ=\m}.A!$bJmڤuPF[^j8vKrV.BtPn= rP5E71egf_)PpXb$,1 :eXAVmbPThU#xU{bepS7IJsj7C&UT|C9p*ksfUVfV a)S\km9B!?0iwk[S2gf`G9-c#Ѩmi6xMluWΡI64\#D-ē?sgⵕ7s t2`/1q)3:h 6MBOYrtgmF$wDžZʙL%\cq\wN]!!_74ƮƠctv ]]]D-~h`e2jk;Qi !TvTCPV̰.c, >ٶ:"?znc/-[UD_H:q/Fw?ڋha in*5#iS93+('c N{¤!EzN>@1ч} Jfdv:]̪"e:$5 P MɤG2 *vO ֖zJNI0ﻊ &:ľ%Ga KZBXjvTHsQDg 1TbɴjQtF} ,l6%"y|}`k2yEv7,O!|Sd[aV>qr &l7I͓o1\ #$y%:)jV5WSoO1O~Ke@¦M -m,Z$Ob?9INzk}h>#A :@oRAϒ_up9׋{uendstream +m,Z$Ob?9INzk}h>#A :@oRAϒ_up^}Suendstream endobj -1698 0 obj<>/XObject<<>>>>/Annots 995 0 R>>endobj -1699 0 obj<>stream +1686 0 obj<>/XObject<<>>>>/Annots 974 0 R>>endobj +1687 0 obj<>stream xW]o6}ϯf,Ɏ2keXq Pm1H⺿~R&6`h'Ls%?e;㜦s*4Id͏{,(;'sjh:͒|xWe-V4?9E (Vr$4ɏފ“YQ^\V'Zk%yC;*I+ca$+%qgO ϒ"اKx~1t,?|N4ϲYvrN4KӿPF^,MNY~5˳fY?|q>N.* s#ltYRk}[ZGX+h3vƍJ{aZ%%-fY(> Gw$*~U#cU4#S`,Ms4c4k 4 yΏxU D3:h)sə] /Et@ZĆG{sfRhX F "P:/*wuyB l3Xiluj":ĎՃw`=A7/wgIUqq~x+gf3Sbڧ7\N8IO4?`Mn5Pyza'he%>Nq+(_T|w@y9Llf6?IG9.l"󳗋s䇰endstream +寸QJ ZVx,>7/wgIUqq~x+gf3Sbڧ7\N8IO4?`Mn5Pyza'he%>Nq+(_T|w@y9Llf6?IG9.l"o{sendstream endobj -1700 0 obj<>/XObject<>>>>>endobj -1701 0 obj<>stream +1688 0 obj<>/XObject<>>>>>endobj +1689 0 obj<>stream xXko_1.I˯qR^dIh7IaߛM?PE3$f[X$"53̌ϣ>ӧ ǔy:O~:pqT/_66 ao t0bQG4_ K{c"-̋I; AOyz6|~};|w{IE-iO+I{?##K)u,`9ķIUup[[ӵKad0Eݏ 0UY'EAz +S)5my&at]^Sz]d$N2uUsPV,IeO+VH92Q ܨjeئQOKGR 38K8;Ԗ˻@ >Fs0I'۝#G&^[7 A ymT%̶r{;Z)dumr o~Q,x+  2 6|IRXʤ/k(-e2^_Tn GSO ~Uh|zFW3S igǁUQ2P&xҕ.zM„D*', uV(ԄKo= NƔQKi9 5 lEaWY,̉NƷ~1򷩮>@sۯ]9(û+OYpP`!"di&CЏw;K&5h)_; GX~b(aд>'3!d% -~q~ Xaho{:?{3yڛ i|>N ̮|bz^avW:=>QJ?sJUʠAkzX6s6/GrH7endstream -endobj -1702 0 obj<>/XObject<<>>>>>>endobj -1703 0 obj<>stream -xXn}WT,@ ]!,%29$ۚOψb>{-mEX&rԩj~?jL)%ɰ?d?/fWsKM듛/4bg+Z!-uUgvR!u+Mw_?8]|$]gxvoeo4fWY>FW/7wg3JKKZL{Z.sGM0iMumj -(Jc+o HĨJ8)u-uE?V)nˡtH -p!)MQQwTDHնr&_c*V;y zhQ~BZ|?:>-S?~?PtT]j_0 *Q;qN03d]~ j(lrar )gl+lITvN"D -s]RoThK;B:(2Xan -K:₇kAQ,%uO6L.Oi5Yלʼ{ q68I\m+%Ь]* ɀ D8gT -| &CHZ^ +玲bB: /|lA噥6uUSt,o?GФPcWp]~^lRwJ̇e73h']-U)ݝ_*7j -SpAQxu`JLf=dY*ń#qV Z[BgQDz 8~P<Pbdilvї^,;eUyHX=$t+Pvg@/Q4m`Niʖ=pYy5!Em5^ -ShQb_tUgM*M sACu#Gb0~:❓!&Pɦ=WBBߣ%lPP{ -mΌWY#U(GvK6s*eic1#:}/S+aŇ -<>[P.}?YxẲys侸]sZV. [Q~`k -Za>k{Uƛ=^P #rs.d jO֙$ - 'ge?w[aP]ي -`ɨl;—cĐ 8 J+ }@Qb27v/Pa. RF/˸sGD?eO%߿r-'kv#ଧ^ -\I,|HV.%8w}m>JP"ahk܃`oqٹS}r(@C~ۣ‘6<Q~Z٘_$W]iR0sc7%k G`Vq⑅"foe;y%~QBo ֩ ROwX9T9!0Ex r<,ɜOkݰ|vO7Pv8-po a)~MӤ5a?|y~뒚y|sFjxLqj4?N 1endstream -endobj -1704 0 obj<>/XObject<>>>>>endobj -1705 0 obj<>stream -xWkoF_` ,eKu$-#-~8GёwL6)"p Q؝]h3Zi*arqfތNWNV<ǟ6 fplE|:MrtQڋʑT$KJM$T+E* -iLT!+gsEQV-3Hcq/"+]S?ۼMi<[ MzYrE6WW;Qn4O!>IPTkCJɟu PQY'U|:|-|os:hΉ$O~oX9PL6U1]5WRzZMDEۦJek9O+s ERB1Z]2>XJo/NVg*KaB*Przڐ e?,.%k=(sVR-,i5E>M٘^4ڲ8Rh}  P5`ψjH@6M,[U%,9 !XR`1J%Xwj@{;8ycu{Wʶr+c z njWڔ` RItLkq|+?M}Haput Jnvȳ SD!ƠzACxat=c +ZXϨ^DRkg-z/V -Z@m:yyZ"ʝ/&+],3f>][~-׬JOCr/vsKA||l>-F`DExyR!K]&0W:FclE&}+q䀖K]Cf67WD`Vwp.//`Zz : 䓘d6_FCϗI]]xP/Ph/[٢,0>_T#U:΄QA3(koyl(Aq L@S(q$HJ'ү g8RntnE}%Nt:zw@;ja84#?ŝDG%k0H^1_b 7(0  Ԏ>N4dpػxW00ifj4V{zЙ1C@ȆaJxm]0^ǰwh9JB;z)9d5oXB.6{3 -`.ʢhҴ'̆3:85WU[^%F`\@U,ipxX0>/XObject<>>>>>endobj -1707 0 obj<>stream +~q~ Xaho{:?{3yڛ i|>N ̮|bz^avW:=>QJ?sJUʠAkzX6s6 藣rH2endstream +endobj +1690 0 obj<>/XObject<<>>>>>>endobj +1691 0 obj<>stream +xXob*Jdvc5ΩKIwrײ͐+%DΏ7o hDgoDcL)-g4L%Jf~49F4_%33}h5mMzC斚~pZ/7w'*+Z\{ZUsGM0itmf +(+ckn HԨZg{81U-MMf?Vnˡ%gOp!LYSwTDHr&_c*V?y zd4_#WWXjR{X_#-f)LjI(Sz]+KRU8Fy@'I')YW +[U#{]{|+RG*ZkR VkUe'" ʤt*VR)-k#{+KiS͒)m7&>Pw!.klͰu+;|R0w!;_gC8]ҚX??d(6ɚdAVLQᅏ54I]uS鞔^RYi뀢P*Ԡ \PMWCuH1 +\UMñPU,Ϥ0x4RsAht,+jPo#8'/ JԬ\^C?S|"2rwk0֍5t s'C]KgunwdEF턈&l=ǙWRNS9M-?MY+AGP0{V0!(aTG8ṙ3 ~,)b^h ls,/=Zfie-0x:;_Iьrdds2&3'ZIb;* w:PwAק5Zg*Bޅzi6cǤ2PW +.ƃԵ^W06*`tRgQ=(aCZ굱` &:2 K` +U/$:VĨ\x (]ҁ+Ps&ah_"#<3&@;rpXQg  57X0[ț)fZ|wcm@SVV-B+f<Ѷ5s4V,wsTXbB+rgNtYڍ5XQ2)9 Cdi<~R6E4̡ ьwdn7";'x1>ǽ6x~YLt~1U#DfԢ F2?M/ 3$Bh8~X[g=JPJGd @r.aǹ8ml(O@p Hu# UۍGy3#mx jp+1^[IһҤ`U Mo*xí a# EbCE+>/9YJv_"@Л>>u&HwTSh-qUs1 j^K2Y|q7lơv{%>@90:-Ml>/XObject<>>>>>endobj +1693 0 obj<>stream +xWkoF_` ,i6Pv\#.DeE'h2:򘻣ޑ&ER$3 oB)4Y?LSZ?~Lt`i~4?]FR6\FsLh)axL&nh'*GNS)\.)5œ4R(1QEIS[DTX>Pf"ѮPtMln0d4_Wm7\ \]DkcHd"=gy +v1pLZUJĨM:pb`: tx G!GKpN$Ln Obz%ŸեqB6=zOo"*4{X1iexuH +[}LVyx[1nE*`t%p\7&E`O|Clqm!i/ φV&{v ="}r&8]XHJT _+\ +u%V HT> \2DOR& +[><鹮񡬪e %dA%Fڈ^Օޥԍr*B|)ţщVgb2tbHKX3pۋ ʯdEFZPzIc d V̰/FQ+6$ Gk)A('mYnN1J*] gIr^I +P@U2Prť`e{nJe2 ÁӰ k&_,y$>@9gDb F`l F0EڻP5\~}߻8ycuG[ʶ=Vt 0)H٦G1 yI4!W#-D*[#6L%rF9{⑇%ق|F%Ul%=_8ka\?{pxA0Rږ:l7ZN[Q\}>)]|10qJ +m7fV}3^S^ gm1"{ :p ŋ̣ +Yꪣ0ŮЇa5 +{`m-2#{\23֥ .":ʼsyy,rkY%%l~;<_D$]QzA@^nadP|QAV06Gm˻﫫^3(koyl(Aq L@S(q$HJ~RWϿ8+pAQ_ɰ-Ǟ~ǝ1b*Ňl`1MAdmq+z  Rv̗ +L&Z{=#7ٺ1E2.L9LZ۾U]#䎧tfP1 w?d:gsq$L1,?iiZΧPGhp -peMP h4njB}8(4- ?̣40Nhu|půxUֵsQoHyg0.l48<s~s&iF4YmtFdnj<1xJhݖr^}X3_Ƌ~}9zflendstream +endobj +1694 0 obj<>/XObject<>>>>>endobj +1695 0 obj<>stream xuU]F}W\]eW6`Q6ٮm6ZP E{=R\a[!q?ι^?Ih8}Htg xgxNmkO)ei4洔8eq-QT]Kmu%UK%Il6SPhkVOd M{jZcALaEq6EQa͚횂Ѧ[L]jNYBt#Y0]Di֫! pDYRj 1Q`t Oq;3v@LM-drmu]ݐ@uFɋ8ڶ;UV(s] >t6T/۶1baFiY4vÚNOޒ̚8:5R?x]KVys'[ut|_@Fv%XgT RQ\ YՀʚBIWtP0"QJvT@iM?m ? l:ހ7(S@ODޤ5 GR9DKFK!HWr%ѤX\]@FDqiJ'-xMU-[^r5仜En_%G*y*7b?XT~أ>/XObject<<>>>>>>endobj -1709 0 obj<>stream -xWMoFW zrИd[vzK08n =".%ŨM-6l͛דk!KXIZ'rJ./hË2Y_]zZaku}#L`Ow[b'kr3mmfr~\Ζ0ql&n -dpHƷJxRحmQqV\6λ#mѸn[ndR(FSa2 )%? !E  nvŪZ4Vڶ^rP5N䳖/cF!SxuvW`[hyPF"i5QĻa!օOM+4BLU܎<,K/VmMpYWj`qĝnv&޴i a͜fRq6>k1Zy4>S05XKp\2l4CkKYc;YUv/%;p)|ͶbÛ5^ ~O"vAht2~_<:5vB범GzP?4DvZ24άxtg g=ev_S!F]g7|?QB-9C8Mx}6ӔGAkP@Th0ue6hs%Rm,F跅8~8ɩƁ6?T,E-N#BZćw#ĥ*L;-tκ%'p#ȍFX4G=̰٨>(wdMUɮ"'PFnv 'è|J,FW@gv KW۰& -(]Y΀tNagb$b1i+;v,;hh[@| dcb\3-x\ !"㐫:Kר8?0}! {,tW+ ɤU`X K -d'kr1b|2&yLJ:` E G}L|4&y@|É81Pn*; v+ ZhcdթBp8lq~cht)_NwF¶,al]\YVFNJiTw G Ȱ;9b+Y15j ƄЛ7OOW ?Osi Фruq"- >y}_5endstream -endobj -1710 0 obj<>/XObject<<>>>>>>endobj -1711 0 obj<>stream -xWrH+8ı1GCZ Yb -4D3ޯ3(Țn>ft3t2~^-os?N&|pNo}0_\O`|}f byCx:uz+j -EBE)Z~-9bQl[Jyb/wٶ› 7z[_'S:]"uvr}ZF[M>R%;يuDuPispbr96vj;#%\|H -MxYi ٜQ]hTGoQ!  2J5NT 鉋gA^nYct7QSvG;MaIHBbfAij[Ӡz1Nq6:2d3(X:+YS(΄?1S[`pDW4X@мS-XN_5,d#McC71(!LUh#,tSg4=o "Zd/H:+8C P -ӎ,GɀQ2W{\MOA?$7 >d1 #)B:1ȘZԀ"1 - -:0 C])L2VJ-A-eBGcW3,cX7b\pw s Z$DL*WFLCgᥣ"edb2pKL}g4p(@3!(JU86=SjcJ.AcCC+7(AĢ>!:, -.4ڨv?#/a"nF+'eVG58JP\REX"'oLĻo3ʢ^lNöVCA`b)RK6eņЮ3 v\1Bmm{R8/p7*T@}`-$eeX'^NWUƥ~q+xmZv* -:C,*3Ѝ)6 EWUx0Q8pݺbҎ> C);5()VAl00mU@j9!'/ֳD }E&Dž fork(hZxqgBw7YtvB! C[1C7ޡT\=/xxb5e;=_閗MWwWd~-š *χoXzLޙ듿N)Ǫendstream -endobj -1712 0 obj<>/XObject<<>>>>>>endobj -1713 0 obj<>stream +$0{pwi46cٱQЮɶleS~!NOy_k-endstream +endobj +1696 0 obj<>/XObject<<>>>>>>endobj +1697 0 obj<>stream +xWMoFW rrP[d[vzK08n =".%(M-6l͛ד\$)O泹\-frysdr/ޮO^-˹3Z]:ؙIr.WUkYfɚT~u[gltim峱ܭ_<&NMzcJrcQunT +%>I3Q ڡ~]VpڄȪ4{1 ߁;H1Gx/Sf-t~b@,iA,g/GN;]h]NKj J"=O/&ƓblMXeG&֡ @f;h dЈJ5cX&iu8&rlz*tNb)I`Z;*ACD^[GI'Z{C%I\fkb#09b C^Z1%AcNUAU=G1$;08{Lu@d+=i:5HOSnD-ې6XR9&uJraCKFJyHqok5܀v$Jn6r[='yO<d8C鐐!԰C5rsEZ/!֟ f򑁛WwCaLZ_Oqq~=,W^k,Ĩě:J+%g-^1M5C8 +T5z2{ĥsmZ\ T !M0GU1.prq͡'{KQ.B ∐Fy(>HF"?rӅt ]un`IlA r;8QG36(God+DHTv]`07}?*v4ˆU?Й]R6,* uv]?j}D +Y[K]n"SY%3h4b;F;FyԷ- >2jX{0Z1.H܉іr +sbOLrȕ-%RkTq>Ĉyr]=wSlNd*g0,%Gݓ]59X 1I@x>{ +})JA"tV0LD!esDVG?K +s0v/;Bwa[ae|0.,+#x'Ԫy;#dXi1G٬X_aڦ͛㧧˫?Os=i zߤru3[]-DZW|䷓9endstream +endobj +1698 0 obj<>/XObject<<>>>>>>endobj +1699 0 obj<>stream +xWMsHWtq2Uc1GCZ Yb +4D3_g$Q5ݯ{}2~.V'錮/y q6lz[,|\_,ohfN'߽rPO8-Qrxh#6ζ5'rpGm,p],5}u2%[gv6M&nu (IVC&#UJY#FK5SyCv>0{1]T&[m[O8STPCʸ/3ҞM.8ĭgXWzr?8<Oi] ~v;@7ei;dQfLʴSiL 4Ζ%  MTktږ} iAk߲©rʤ*2- >٭΄ZL`[H@ZlRšQw6kmO{;$] [(@AfG8MH>E3 +r͉.u- c+daY}g]&lj:, GT|c[8>MzjПhڋWt媡Px+g+#)4edsFuR=E)7R60NX30l{*mZ:S 1D['.}y;pgA2 X(GQO]]nN7EX$e FmM2Ŝ; +TȐQPΠd`dQN8L%n2_)X`CNŶtbE;~հ=(7Q{ VBĜb z +Q$c 2CVpҝNv1P4BkU#=w+ RT. C)^O;PE$G\%s5?1fI$H60d~ \ cjRHg<Ƭn(dJ+3B uO P S*{„2VJ-A-eBGcW3,cX7b\pw s Z$DL*WFLCgᥣ"edb2pKL}g4p(@3!(JU86=SjcJ.AcCC+7(AĢ>!:, +.4ڨv?%/a"nF+'eVG58JP\REX"'oLĻo3ʢ^lNöVCA`b)RK6eņЮS v\1Bmm{R8/p7*T@}`-$eeX'^NWUƥ~q+xmZv* +:C,*3Ѝ)6 EWUx0Q8pݺbҎ> C);5()VAl00mU@j9!'/ֳD)}E&Dž fork(hZxqgJw7YtvB! C[1C7ޡӽT\=/xxb5e;=_閗WwWd~-š *φnfX뙼3O:)Ǯendstream +endobj +1700 0 obj<>/XObject<<>>>>>>endobj +1701 0 obj<>stream xX]o6}ϯK3 QlqҾ [lv Dl(Q%xޯ߹$rv($x?=~=t3(l4f4XIex1]g˓ˏoi\_`jJq4u1sIZxIh|N QmP,o$RV䞶ozTuau^Gt1& 5x %pȥ3LzH.iW9T*Yٶ}q"dV)5mFۉJVpB'ʵ57.6qDq>Q -R_(PU\8Sgn/&0*9ǘL T%|Kdd,sRe)o'jIcaQ_dveɓ ?*D|QETPNƂpi{+vqF?5 @@ -3747,26 +3716,21 @@ oR le.Z=vՃqX]_);phV>cbL/;ܢ>,X@ Z'B3sӢ:aQ"mje$>GՇ;8R7(&R `ղFܽOB9zoLpKhM\ eQ_UcU6&V)$]~ Rv.cV($<2 >c+b6}m%қA[mSۄ^@]Ia&7 r]CC@C18$k$xP%&wni#Bqzh"ƀ OcB Ud>ap†]#1\ p SKÁ`YPբ[<b!{rBwކ(~E$~ݱ]A2s^UyҬ@EݴF"Ÿ YiDz:F:Ga;҄%E)bDh̑1yXW0Pg:#8=-~8ojp9?#~cc 2vzz04a?lrO?K*ast7^pk) VA tj`i!i;$D~t=cPd4q 1H!k 7Fc,JS`Eyהּӌu^e!B}.cSm@Cyӎ4+~˃8<(ƪe6k(  vҩqNqnFr]V@1D6p_}հ -9 xϜ\>h *#J5-^6´ZXj ּF/ae*rؼM }v'/Q3p1{vҠZO+ b8m/{I['lphAp8|xͮowqݛ7tc݁e/m6"8b?/O~?jendstream -endobj -1714 0 obj<>/XObject<<>>>>/Annots 998 0 R>>endobj -1715 0 obj<>stream -xXQS7~W[ CJIi&Їtl $G՝208N~|1~Ft6)qqL'#|N9o0''K/ƣi1~/F Zu*"FI1z;;z7шf x;=?iVZ7NSMfeHt-UcZ945²q>@5&,TieTc^ptfmiqB䅞}x7mlL]le#6`yf*Wq7M1RY 6j^ VaKW; L`OL4rp*z*W-ذC;R [Խ!X!m{ѝ:PƑ- iuV[>-lt2L8<;z -LSU]>-| `/ BdE<s -L5H6/ZsHUz̌Vv8ou ~6eجTC-#4RZVxof}20 -ykf _#àT(rf(`Qq{7pg,cRv9E:٤.O/Қ_[Hd٣h6f\dO @ -2 -±#Kڵ2e)5bk_CIy#VHAA.Q5,{Pe) h8-+칾 hNQ1k~R62HD)ؤsY~!W +9 xϜ\>h *#J5-^6´ZXj ּF/ae*rؼM }v'/Q3p1{vҠZO+ b8m/{I['lphAp8|xͮowqݛ7tc݁e/m6"8e?/O~?j"endstream +endobj +1702 0 obj<>/XObject<<>>>>/Annots 977 0 R>>endobj +1703 0 obj<>stream +xXQS7~W[ CJIi&Їtl $G՝208N~|?c:zoTxϓ3|N -qqҋxZL^xËQxrZ49>/ݷ;f x;=?G4+o[&R2Z|ƖQZOHaZŸA\| 4x 1gw{#:#f[o"}y'E_?^MqS4[Hx X^%ncʕupsh&TEDBWnUҕ.k*MiʕrKD26ЀNg/C0uo,lHۀ-a^tN C(XHv4:[svB:&yɇe G)֪.Qzd>r`KjH"9݂G&{$JU9A*=^wA\fF+;Hz?SDвfvlV떁)-+7 \^5 +H AOԯaPAK*9c`x{0è=`83Bk``U1P)s"lRMѧOiMү-$Q4el} . d SؑG%ZCIJTyуU@_1/[֡KLڇޑpeX C8-+칾 hNQ k~R62HD)ؤsY~!W @"f]Xl뤁8+Vvb*X>ʢVW 9PE 6ih%5ڤq.{,ZJK٫Hw~ E`vCI,~Z󊍲VE"3۝<@ 0Aa(1}.R\s/b.s*r}ÆMmELfr,l56 3O4<6)f|-gHj1 MFY.ih&d6y)0c,+,P 5Wh+SiyMS'ec\Dj@(a=lm?DdZg .eY2Q \JxXgxB q-rskרJ``Tb̅K):C\ /NIB-30i2uCf&x I(Y'i9ntsu)u ң6+ @6>uDc$ ]ZM,V~Æ`q$u˺J$18@`F6Пֵ4(p93z7w+ \N'tZ8@ 8-WP7$1[h nݕ0 E+7V^\@ܽ L`&{/w tK53F*e[ -H=\bHBՃ`n"m *oL wqp~By&;8^ `pxv LOǘyh‡:k_|endstream +CMmdצѤ1Ce747\Ш?p&C8_91Ktj̓ 8@+4G3^}}H"qmûTX;G /M?6%4HBuHbqdim?kiQr+ig2nDPW(OAsq[l9 '- oIbT&3n+a:VnTkāO{FMv>V_;jf6!ōU0˶Rr{Đuݬ1bE4Uޘ7u8.e)T iMw|qalN0>_{|endstream endobj -1716 0 obj<>/XObject<<>>>>/Annots 1001 0 R>>endobj -1717 0 obj<>stream +1704 0 obj<>/XObject<<>>>>/Annots 980 0 R>>endobj +1705 0 obj<>stream xXMs8WTIԗ-ٵ-'Rr$!cAT*eׯ_7ŒJEe-~^i Mzbݴr~1˫h;\|f]WzփUpן=mt9KzKTBY.2ʔXkKMi +Hѻo:]UD۪4;:uR=%jR@HYWex8;}bA ( h.5c5;aM*޳7 ԸG|nVd'> +lŧ-R\}0ȒKCgJ4+S"Zyރ}>0tLR?Μ¥]C`>B #12T'뎰x{QhTXW,{Ո>F|cO\S l$L{T}'9p lu-oh&,7U6)%3iS$lT%͡\ ! 8>.Kd!Q9O/yG}əX(Ąb Fָ-50 a˭8/ A2ʌgwf.ĥ* *uݡ[FtAxc>rWD3E 0pq8plm/gUXk.\3VWzbit~׹EwHg_tܾT\o8![Ju-p` C45 nr9ar~hXEm}>R]!qcpb={ȅy:U+V[bҢ/qb@Y ~]uG۾#6==\=c[>P>0@|x5Z&3 F̝K50㳣xxwQԦLlԚ$Ec.qʠ|儰pmUؾ^X0UI,]K(6f^rw tn79S('ۄPRnon &g]UGͤdB i'ݛL<]b~2RP2cyh(A'k)N\xaLgrL8y AcV A<+o,1A-;(G@Wr,#Na>b">6w|ea>/XObject<<>>>>/Annots 1008 0 R>>endobj -1719 0 obj<>stream +1706 0 obj<>/XObject<<>>>>/Annots 987 0 R>>endobj +1707 0 obj<>stream xW]o6}@1eɎۀt]<@I͆=R`?~Öx] -u.()ple3)\:ϯ5?#v i>l^~?fs64X dR6܎2kia4KYrir+Xw²g/_pO24@䊕\°ģSͻ8v\)IM)!قB\K [Ppn?Oixq[(]rX˜Э4{J}#ڎwR kx=$a !-o;y] ,k`p9PRUVl WQ/Vda2Ur,;.%C ~vǜӰyZ]f@cg &BM\~BT`.\⍡`vk"IHpH04?:4{wx̞a~g[p'ESfGg^@1 ٵ6NDWxQBT(z  @@ -3785,20 +3749,20 @@ aa D؇y5vF+Nw' gPs,#٣{D#J=PZp~GUU~XV|7aZuTJvWՅZb&]lA݉/8U:'ڻ?%N,ο${VFlY; nFȔWa;GsܜŨv ʵP8% 3x6)ĸpnx#0X8< Q\ugry-ĚKmP{=:r{@Я &eDGGa8b%lidjt8E+}\T r8 ѕÍ@+Sۏըa!|.(鎰cو:鱅gK0$ذh:TŌbUukx>\|| 0 QZ3% :zF6*It:̽,)"9ĈɐC(ykT:\ W %_5 /ǎl/^x`r5oO -KaI§|ei _FP)aendstream +KaI§|ein,GO\endstream endobj -1720 0 obj<>/XObject<<>>>>/Annots 1019 0 R>>endobj -1721 0 obj<>stream +1708 0 obj<>/XObject<<>>>>/Annots 998 0 R>>endobj +1709 0 obj<>stream xVko6_qעŲ؎`&)2M( -ѶRTI)KR$.8`H1~t b~ 9bD 4DP]X ֆ{&i8ESxM[Lͺ0K>x$>hʡ%7na`p)Hv2ŗ,JZ晥?TkJܗ6R䊖F7}=Gp7z\s^oDߝW( &RQZ^Pk K~% =o?ݙTxAvԢ EA{ZRRf2|AJnh%p54~~݅eUZJ2Mـ@@ՃWWya/9̅]) \jR3D"N;wqNA.4p&[K aWؼ\\-)euR|A]ӝ#Zޏ~zty{[gS`@qэO ^ۖk<+sDus ڳL%QHowP!/RZ0p|D7ta=uү9kNE1`߹?w2s10VZCy:ٕn^0@^.ۓyuvkjyL=oT. eBP G>ik_|mizn 9# -vYx.rNMM^!u2s;t}i@lY*ڏѼЙ敶6d}/\ SEnlLxO{enRt}w&虇ۂl5>2J"[@Vi7a:-u& 9\!'LwYiyQ[ke p1HW07Uuȁ '_STSe[KG'`и{L"4)RsNqnH+Iߺ8gL.4,('+,1nKpa-6hayR+rp2A hLB!(A,1lȪmp>/XObject<<>>>>>>endobj -1723 0 obj<>stream +1710 0 obj<>/XObject<<>>>>>>endobj +1711 0 obj<>stream xVmoFίHp:1BN:UIwQ/nJeװá@JU<@?\u7(u}o⿤nÚ?5  G (@5'uZA}"z+B5F!vw`4LL*ݴ'!@,284x7R(iš9EWD-4)hoxw݁7F9DK -RH TB|'BfD3!"ΝmژX_ @@ -3808,40 +3772,40 @@ I 1g !q!sΑHv$BFLA5Q/-8q21K2gJrSmj_ҍgjN#Uiv8: | mNs Ÿ4Z494c]0sFW@m!q\rB3(+)Vn z9 {Ts,C [&CSڎ9waD\&tӍƮ)rߪLMe|k~{(~yx}=^.Tus  -">EUsSfPG4|>/XObject<<>>>>>>endobj -1725 0 obj<>stream -xVn8}WF,])`,vc!DWl$AReX˙~08BR|G &C>%êw2y>0_F4?)H1OFh^,cχdn.0||K8pv!ʸYyǏederj%nnXt#DY!Q2]E#<{AF&e9de%bE U#Y! -:i V[ͧN([jJ٨Sq=rᵞ:}u/#t:{+9u:0C=zJ$S2X!F"˒).MUVirSW #yAR5θĸ[Ҁ٭gNPU 6-D )/yK3/ 8+[NbOVYYKZ9] :jɹa rc7rC2K{8퍀, RӐD]|EI\kҨl8N<.vӚ\`RWkkLRD5/oa@9M bI2KBnjd$5'g1I`wo\w88hb!$R蘬S -3CxcvV6aڙW#8),dxcHCxw`U Ӭf]>scswpV3]7f&KP Sj1bjcU\t[+鐵:h`"Hd}Oyy^>/XObject<<>>>>>>endobj -1727 0 obj<>stream -xV]o6}HlJmdn=dÀ-6cTIFlζt8"׹ܫϝb$4pLiщYLGӉdFNt[/j<ŗ&iv?tb6AUTtIѩVX\K#2ZjC NV0').K.H9~}yl#O2YQpK&[٣ QJjEݒWkۣ6u٣FZRZ$ "jk\<|B3[?30bV~ $~~yM"$UrU -d4m{6>Wks޿? 9Ay#ܑ\Ǯ9r | u+"QTbY 3_yF[婻݌(ITȫGryYlSUF(yN :=y*FKZLBqM,+ C`RMɘ]!C -*82K1\lRˎCM靖`w+ϪJGw-q7RKU|n!YۇDM8%TB a衶@!8qE5ZL|7N$W5,[mTtu AygFKnBw(9rr Jd5Nw\y,E1kتJa7$V6B-yAn;c(־7/xrWsaEendstream -endobj -1728 0 obj<>/XObject<<>>>>>>endobj -1729 0 obj<>stream -xXn8}W /ȗN@Rt E?(hPKRu{lYQAvΙٔ&͌攗glBUvM׷7_'iufq6~wM)-V82EAx|2E>Z9[RXK:_|e2Q̃uuF6UfLy?RZ_Jۍ6AYCvE5\EXMLrz˼r*TڢgPY_]Mi+PvcN?N0hpʳ=Ip 5{UHR_qf)$=N$ O_P!HK 56oUChkzs2g&f2;'Ƿ~#sR9}J=U.BuX1; 9)Ó#(dl #-#kad}| -W!AG - mvi]ډ* /'V`n&`>7˻DK֙yn+N`+M@V/R  ^?0ŀC*n#'+/Y2%8hij$դD[D6֕Bi5  -id -ҕJ?CR H"LAid0 -X҈%2m {*E 68@ݲ Q IO sHoEFӽ#γ@^rKOUybR}4q*q/8a6joK@?M5L(rxl'|0Flu*߁Mۖ=ٍt*Ih-T͵PTQmfV`a)l)@s}ԄvR5PpCv&tkp-aw{"xFN`- a'\,182A -EoCRbU):mqi/?I% td?vrQ4"(Yk]чxCӟcMbKj>nrеAȫRa U_S*nCP<;ikIg;X8/gV>@L21xyWHÝK˻X=1ŤswB-d-f:VI94aG7n1kovnX͈?M ⟏f|!cX+@si1->=-)[}H7X01 qOʨ~A5y#89alqR{IBޛ8]j\BW^{Ogt4Q{ ^6f3m@Cg,us|Aa,%?ewkhZ_]'biy ص-6~6[7`=/JqoJQo)M6^x|>:}zkd]./o&X Qs{7=}fW3|Φo?HZ;lendstream -endobj -1730 0 obj<>/XObject<<>>>>>>endobj -1731 0 obj<>stream +">EUsSfPG4|>/XObject<<>>>>>>endobj +1713 0 obj<>stream +xVmo6_6g$Kv1$h]m1qUHU9^E1~y/灏)}ԝ"gűO!ϱJI#\П$=bOоXէ?u$suV}&N-Z+) uTy>/XObject<<>>>>>>endobj +1715 0 obj<>stream +xV]oG}W\9B*eI*>Ikj`ffd9:w~{ν?)M4PVvl@dztNr=4_d/9`@30et_mMZWT kEύ4"6dyd +sdq+::zmwotf>!5kWT^k =1Vt׭x=iYT=Zk[gu(U\^ADIcMR/9YHrSNm`!X2o~/OBIߐĖjV.^R(u޶ϕCtuJxȢpd$WkοC.ߟ0i~fJDY"Y"/L"rvѾ=ay%cJ +bť\:MCTa( /(RVDpSZI˞I NUM|v^qL߶S*N9 >BO hZv<i vxJ}RnwLZTuϷή}} Jdt1NYH.A*E kWԀOяIr6JO7`l#k<G5 +]r(C9iʍj7tkaX {1تZfa7$V6BTxIn,`jq`^5 Ε}O݀q!6MeI{6"'#WRAQrHEfeDi0'׀ i8 MP b 4jNqx3zͼ75e" +qUX DY)"y0@t1ʽZ{Ih] +Eoc%@Hfu;x,FxIn/n./NW:kJsY[t^Q34xqNjec{3|+w5=w.>;tEendstream +endobj +1716 0 obj<>/XObject<<>>>>>>endobj +1717 0 obj<>stream +xX]o9}ϯҾP) IIRZuU+Uf7ڞRkaL~@(:{׳)M3KQYM .kugogw4|#W'5/x6ャ{۸RU2X-hZԟ7, +ogJK+JV`cږ"(k.i dc^{e8T۪Pd>6CٍZ~ ajg{P6Aѽ$)ӯg~GFI_'vֆ_ҧ/3>T1BH^%>Lg⪸)L}I_R-UI_ff:\X*EfTVz26̑0*螾4>ː#@W\]Zשv +ɯ [:I,|i/M.-ufᤸEYƄJPE@=S 8&r%ӪPa&VRmJ Ldc]-tN-Oho!O#HPVFh=T!A T 6 1WI +F,` n?S-`ԙ1(H2.&wxJdCz3kgN|zQ~Ej{* ek8yS +$I h"T^p\l:2敃o @?M? 9jB;)-PpKv&tkpa,;н^k@b A@L21xyWIÝK˻X=1ŤswA-d-I;7KXŤNKհ#ѕڷ^7vD&Gw;1k\IqNhY { DL|?)+C yDcw^q~׿ t;qNAԞG&N=: cԮƯML[dxYα7ye2빯CF o7 oф.;(_׉XX^wvmMħM<-=|yRܛR"}l'r:÷W~ ^9^>:}zk˦d].7,ը=\|>4\nK|Ngo?H;pendstream +endobj +1718 0 obj<>/XObject<<>>>>>>endobj +1719 0 obj<>stream xWێF}+JKioaQ&  iԴ۸Wv/;|}mf2 SN]\B!LG0 x̦xbޯ{CX'%Ma.XӁ/Hli V+m Ljd\0 a L6VŖa.3v̀1b۬ `2JѐHȋTs"oV7`%3Qp T"KqJ "NP'6`,ր hJĎ,=Grqjf}A+AlO N`~(aSWWdq++bc+~X#~P TZLԷ~J7f|j] .C0dX;yT1ע9omth:\mF.M"uÊեƣRYpo51n1;7=qrMr +E!3e8_՛h^ 2wS9۬9#Y} #<@xTgĨٞZӞ"͆4H{5D3/zY-ֽܳ?{ -Kendstream +ڗJml >qjf}A+AlO N`~(aSWWdq++bc+~X#~P TZLԷ~J7f|j] .C0dX;yT1ע9omth:\mF.M"uÊեƣRYpo51n1;7=qrMr +E!3e8_՛h^ 2wS9۬9#Y} #<@xTgĨٞZӞ"͆4H{5D3/zY- oޟ1Kendstream endobj -1732 0 obj<>/XObject<<>>>>>>endobj -1733 0 obj<>stream +1720 0 obj<>/XObject<<>>>>>>endobj +1721 0 obj<>stream xV]o6}@lَ-M@da@@KV"Us))NT؀&Iޏs9ALc|ǴtNI9Gc̣ ͖ Jt|-O-LƳO| FcM%^1mn>4I>JLѢ QPۑIm?~YF(ELLY*\?r="B]"kOSkG'r9p`'5Q7Ni*S3T(-Id@iVmV\z e$6sJM-$U֔w>ܐkE;{lԖ֢ DN2J2﬩]KTUÂgysڢ/ˇ"4d^RhΚOuKl2ܶuK!Cph)OIec xkʣZԙe9ȴ5wWا \7tL/q 6Z5_yx|U`k h4fFe"50slm84-0ndy+,:NQ|IYkEDF'ExjXpsY K iL 5UKS5d,xV 0%1y/kjJ6VpM&y Gb0eV!RXU&2lTop - .g^񬼜2ܾ뫻W`g\tcna}Cr6_F yd' |~Jendstream -endobj -1734 0 obj<>/XObject<<>>>>>>endobj -1735 0 obj<>stream -xWMOH+J\` FBLXa)EZqono=yUm3*" իWL -t35eUrE< >5m2_OO.~B]R\JvTM=Moz6:w`욌:O(ӛb@4?cӄo%W쟍,h:${:SpJ@jʚPjGd%eѶ )K*t*ZNU4bNH^t1wB]R 1Xl !R*Q됰O4)_:ƶv {R{ ִKe:o)w`]R+-eLJڑZPNYϐHvP4RA.p{Sg j3D8`qWFW\陵É| 9]ըc@;N,o^OL<@_ y1?҄ -lT^K$n?t)t4dȎf[\lhj[rCU[1r9QшPh4Aoyve8vS{Bw]#Xjs)#95pv";?ݻi'`$#:dfHMe QXxʊbUCG e<6 -[ -R"y4C-'a ƭkEz -BrBj:8>#u8EiQ`G;MRu-9tڟ[8ѭ_7-^pV.޾J|u[ 6[0'|endstream -endobj -1736 0 obj<>/XObject<<>>>>>>endobj -1737 0 obj<>stream -xWr6|Wx:S{F-ɖN!M$XTidd vft3Zi::Oiq9Otq9 -o6GgiMW3miV"֦e獭O7ͰWOl[ʭv}"5l,_W*6 -Sjڛ.zVeO`_& HhӾ\ݖ1R?lAs--sw -zmmu)mq:)Fޑ9@x޸_T1 {%I\5_& p)9b̨~¸jlW줚 oɿ4\&gR*|?3 Rb}Pr\T?5b1/W=+S - Spĸ5F@PA"2Ձg xA쏝zlKa*lWc,tV{|֕R-*{p euƦőu:O1 aOΝ~9QE˪`:4F㚾 X\xUC(7~GkU2U^mCP{*Z94NQ`O~CwwcT_GuӀ1>4HBZY<6.-{kAVTqoQEȥl$Pѻi"4/Ԩ͊s$d+|ÚKL >y–@ ri5H~!B4 -F׀LF@kp{B9j uDa*)|<,FfHP ѹH't? @Fsh&5ĕaik=8Vjs1)A-0>gFp0XB,pT={طx豊Lޱ-X^ TT~>/XObject<<>>>>>>endobj -1739 0 obj<>stream -xXn6}W[Xv @m}1Pms#(^dYRȴHr04_L#O(ٜ̞NoP|AOKL0Hi CzJzetwji()1dE.KZzgT.糧vAq Fֻ~w2$(ћmQʔR'Wy)TR7UVm&i_V[Ika2;eɇij,DFRXi}˵Tb JZafP&E!O"OQl22k7*'7D!tp iX@ar:ĥZUf4D޵΍Je'ֿT[Ke<<>/n7g޻ς芏=w9u/0)Û 渱:e ۧSށ:^׃QVէ?NubAW%~foitND_־oWbwu/yAlJQYiz?' - Srԍss -uWxf"AAI" d^.l@zXx(Nkﲴ-ԘC RpϹ\3i[ r;*͡ȩɩ! !}hV֩P6HXx [wwߛIzZLBEX 52xmȴxsf[$8B_'ՋM2>ҳZgc.ҀH<㰷Z=c09̻xj!eHnuR5 %269/hm%A$h]~owa*:WJcYdʵ.T)JD`'2zQhm^a. -; -m.m]payG[Tap>@FWlԢ/ @UpkOGXFKwsí @5rpiϠ侴ɔ+*^+C/pmqTs# w)gʖ>_2yap3+T*KY)xQ^j/j^b5.qKVD&W١k֣k}=P~E 5-N1{i\w0+ f}ا^[y>/XObject<<>>>>>>endobj -1741 0 obj<>stream -xW[OF~ϯ8P%ء!V a[nKV !_%3;gظ -R6 {|s?w!F4S͖7o-`<"a0i]I\D"/Ǚ8?^~ i*)fbt7o e$RF"etRKy7DB;En;¿[喞t^jƥ"+6[ )6S}*4mt*UPm^L5'lBHoxNQ@SbO+, [hx )C;sp_?Z׆bMKpD4"]]x-"ֹu* GVև#yO2y \,€#j~{,WqaV9bPnvqyME 'o.W?Zr&0)a=ՎNt`\xwةuFVhBe*Q9SU_ĽkYC$q ت"N -`Z]B}GzE -kI@ E;%5!9גD[WY^5YYU\b07/ΧCBQ'tIYx֮}TJUT_ttrW㎦bBa8+fQے\`/^ZO:i3ohnE=*rxtق3:Dj`=_kQqW=^Olfih((g@n.>u7\3}s{,>kgr.JK-gUԾ֖f7w?o꫈Mo+UƀXb)>TFj .JܡJ -v f+V;!0NGUJ,X$8@ No[~5AsʨkˡQ%]|xNA"wAymʬauѭj 8dE4- d )eh nMa"}UXaf"򠘂U}ferXc[ǜapR(22"^is޼x1klcVU_GPW fN06=pJYW'o9Ʒ+4eԅ 0E}JJdv4eR}`8g7}7ҕU0%Ͼ2ztȟGipؗOq O,d< Fh);_~8endstream -endobj -1742 0 obj<>/XObject<<>>>>>>endobj -1743 0 obj<>stream + .g^񬼜2ܾ뫻W`g\tcna}Cr6_F yG䓿o ~Nendstream +endobj +1722 0 obj<>/XObject<>>>>>endobj +1723 0 obj<>stream +xWoH~_1D + poihtHr=xYbvM;]+T|ӰG+Jg)FhD=<4 p_7F]ǣhL=|?~i~ֹSKh̻xn6bKATrmEgMԼ:25ѫ7Ϻ pKk&Ko:!9|;(GN&2R)p=qFf/b+)7GV: +>Vt0idI]S~yxSbJ +Spx|#5PD&'e>*re="p}jCJM]ڬ~Vh#O= {YUiYEbucg +> .RK<BjZ%";_Q[Ѣuww8Q֤*rG*7j"+JŲ>>%A}#|$W$!Af2ҨͧI)KrC_nD8eꔊ`|ŮrmJ1aIIk ,;B! Ɖ q cQҪH^B=R:z|9!={8lx,Ϗka^%ET9S‰=:(D!Z}FXB2%2ZJ)R8D>qbh.H}瞧c!lfGȣF-E,`{ZEWK y[ЇNioӇCh1CD+2; ~Snj4>g~z9,'3fh q'CSX(SqM@k#DYl(cHz4"? X8*!2o{*,I&Ʀ͞ŹG--inv+i|-#zKc;XOq8⪔YlUXhi+q%o@}a&ikN VM ;Se)ED^@;2I?,m +~YvF^2u0b"uj %mklBd@^@w{W!̓unҦR 2eѻRq;,G)?΁BPE|(`+.ZMNxX:(͑a2⮃C@cƕX,9D4g!SRy9wq/fyR-UP$mexOJL *cG{*O0sHJ1.T]lVnKt>4^j ʱ<:KVQ{, +nhډEda4(#yE1=޲. $K5,f|-ɽLq: pTR_`M!kAIa-Ƃ]*$I?F:/lS9gL?xendstream +endobj +1724 0 obj<>/XObject<<>>>>>>endobj +1725 0 obj<>stream +xWn8}W )P˖:)(m} -Q6tI*gH%6MD&vΜi9]i2e#ٜ+>ƏT8dvJyN +>f+Z-KK[UJ'x2k*eQnFpɭ/$47ʔ3y_<_/^h0eSr=ݔ%:uJy`KjY~gTki#D/k>A,FtH,b2](ힴ3@ +up,%%NJĤ2q*hE:{ZI2?kcp]2(2\R|1jب-lc8ވ;6@4Ωneb (2r(MZJ$9 j *NTGYRiVd!Thok\^|Tf]i4"yĜO!?) +qD^@W,251%f@:Ƹ?U%PS%ЄD1DGذIІ((bµ9]Y#BDcUB%DLJ; ̹‹ %9[ -)F>Dڠ6urz7HS(7r@:渚PX $K\ь;ivhS5>mU-ο`J[Q<KN +}J'1)eu%,ٻEvZ|Ρ@kсC?JO!pEgm6K `rskWTڞv*`8;9sYofNfK dpQbwȐOGD 3:-`sBbrj?&y+r㬃7D›TF`1m/:΢~>ZYp 612餄>/XObject<<>>>>>>endobj +1727 0 obj<>stream +xWMo6W Ch"[N-iݏz Pmq#*IomĶҲYdf vyO/&ڹEF ytt5R֪#oMWD;Q g+ eMX*D].n%& OZÀW;QL*f}mnJzl79fw/L3'v +f8t6 e֧<kX.Hi?k/F$ •RpclI'HXy-Ӹh#$ilk]vJ.r(XӵۗRݑ1WKU ۣs?y?FG@ **\<Ρ}bgCb3B~xS sC3-8˿wñ<*;u(*2k'E%S |#|TyV :{ \n- &eS}CQ>BV*%$iew )O<@PCX^ơFФ dk:}gwDP-$ Aē2C;#L(4$ճ-"HceN4+tgr]^g/5ۂvHZ( +m9$'cup^ +;kfI0ڬPx O ?|D=8ɃœDݰ7N 屧EHVKY/@z )#5⨦0;M7)7(1zo9Zo\zh8KWM&J\a ԐL> 1a|S)3 O'<o103PBjDYrǍEF2P 18=a싣5ΩT -Wh fE?Z$`mx1 V +<+pCRФA/D뫰$ V8 :;peptΥrCM@%-/fpX ȼ[Y X.i }n>>It;I}3%)rȾ[ + 3QC^!`zR&ϋO'eE%ƴh; u`_B i @WEvоqRѡ^0y8DiV ; Аh V7 S$fX';C)x13p:P rI_EW'1c.T+<PAh Hܓ[Qw>:*sKt0䝄>N"b..12CO@q)b\D'b0q|MBt.aA5][|+,AqŋAAKqEe,=}&z~3EO;~/So57lvEbY.~_^y/pkQendstream +endobj +1728 0 obj<>/XObject<<>>>>>>endobj +1729 0 obj<>stream +xX]S}Wtl-6ar +u] \l*yFf鞑m&U{|8}t dDYyѠwJgx=iyp9?8ԧič9^>ͳCjaßd4UXĉ0k:p*Dߟo> GW*Uһ <1>C}aw:+R %mo> D[;fn65?n3g.SE"ScÆ{\O44? +ԓHah.VQ@J<*z-8' U&&pϺG5h,= ސ 1hxCDeT4ڬQ-™UWԱ$Ƣ^EicP\#mrXxBDǛ* +.v|\f1qM TyuD@S匍LP,M&IuqUd3,DMYwA7zry4q^gruʻg|8sZ1BK&*tF_ыh r]ixQ kb%]z6iG*+ď{%VH-⠍`v!(q4Ǥ}@%i|@vr8J-md(Vj (R w*m]jo,=z۾Cn k sJǧטM!t +cX:LŇȌ5!O b;zaC 8is@uδA3S$#ǤٕޙnӊEz5~"x,о$B"`VVZOe'C6 @05 ܄rrp١[wVޔʿ"}QPxgKą Q+QtGcB*P +jE'iu>/XObject<<>>>>>>endobj +1731 0 obj<>stream +xXko6_q|Iص,bH,V 0sHx~璲xP5(J}s7!~Ft:ʪ`H'1cd1F8rrvJIN|8$;}xe)Vn@j hiQIR&l)ΔWFSiSSӋ*KrMIV`J!koH`(FJohm^G*IL*A ʖŠKW"8&3u5>$p 9}Q:7/v +G'QLJi8EBo}g8 sw^.i.IP~mԳ("uZDz!ڏ74BLSh n~g?k +d#`,cY xmBVA+Wt6Kt<aa} $tfJ@.|=FT]zeSzht~~Fw*ƙ㵭Fs9yy,+ȉۊ"i7xGW%PZd:=gi)8GPw +󳮓]ćwbhw\oH(nP, i{b _&6d4% $kT\=*$!--cu)XMtz[6TJ64t=VvQk}넿h5Z#W<ԀVJ Z:詷{뤝G utr- Zڲ5'K~tn": ]cо([Ep{1;#= +Zbfe'P ήnЏ6\N~M&{Lf4jvV07+B]]u= B2ocƙ܋I&N|0mХC *l\ +є0S,mםɸs ;˝hQ)_ vlk**/m68CcxH LE8N"ZkQh32S h^7wwk7NEpqZlhTޚ+ܭxY RseQ)yq`/IY*q)SAZ9?*VhyeWެ)9juξ\pbl$,nݒNANTpcuUՓ\1[NiںOSr^Vi5XUךIWmJRJTVI{]6 ۽H[,+@~?Y$Ǜ7:/ +Ύ+'|_]^н5A tm;j3[w㓳c\e${endstream +endobj +1732 0 obj<>/XObject<<>>>>>>endobj +1733 0 obj<>stream +xWmOHί߀HrĽ$Kސ-ٵΛ-%ٙgyfzХ~tѣEAա~k@ |JtWطw&8hu节9\CLPSSCN6,$݌O1&irEތ$1oIGƓQ]\RrC3IY i[tW~9WDtn^$tl4"Q8I0S+ 6ӝnuB*'Š(2t&(M2r4[5ڝ+re&;˔H%[z- RF~`Hc0k w˃>LFj"A NK`~ ݓ"e -RBfΞ#5=qXhZnBq\](mj*ӈ_>k/KI? o?`װC'np}և#Ki?rCmd&+a̕1,8Sa]Mb"8ܲH- +k 84oaaf,QV҅qq8#_MW4X{,Þ.49RDѹPVZ̷lEC/5X[x'jYxCڎ RtsgFkPҸukkGTݲdB*4W, ^hN}rh]RD419- (=q +ֳVD&-$EĘ";ivҠJ|o^nm 0 JViP*,(u +5MJlr9ci'/c4М }k A{quCܾnNϺ<t/ZY2 ~'l\ԡT +4 _+4\aqƏ,ܵzb{ +f?d䩁!\gyPZ_{n g[C9qR8?bx CY6(\Vػ,Ke_A543/w#HqՍ'k +Ƹ> IVuJ/~Yı]@{pjd,', +t瓛tN LHZ9huJpKFӰ~GN +:)jy߻7J׵r+γZ/&YoIF+/Fe/N뇛kz}h%k;uZo?[qCo.[*|t}Djendstream +endobj +1734 0 obj<>/XObject<<>>>>>>endobj +1735 0 obj<>stream +xRMO@+,P@ڨq KKSʂwJRGl6 ͼ73oK#*e.&aBqDon#QXԺ 9҂(a!ApE٩B\wNDhV/e-w٠P.۩CYdKZ\!O>-55=gxjVf-nTUnE[0D. 0y<3?&iҷ0fģ 4obbl}*endstream +endobj +1736 0 obj<>/XObject<<>>>>>>endobj +1737 0 obj<>stream +xWMOH+J\`$7 i3aicǽLU=*" իWL +t; eUrEyrGw<ÏT7wl|!=fWus{GiNs+ٗR54Kn[뜖m+29;hoyC},e +ʴ^/~ũATzː +z'6w +ΉFzFٽ zkg__ϓ~/)ŗ|vZ+`"PKhsHၤʭ1OLȼiPuRke*VX#Sh(k@2腬@<#D0ը T`b-anxaq}ޣ%-#N%gc]|%~ˡ' %*nG=fx'9 +\f'趗 qϏi+Cv[qEJ"τ8uB`aF@c(`{NFI^)W|oJ 'uNjY;`ᛏ Z +JsĘLv2{7)/Dr:?r^רnχKqrr;+"#e +p4s^rx؄kU{/wt?J/dWG{-SM4-CPQ^{ dDXՎҲ<9#QR#V#/ +6,|rjV;Kq%$TE"v63s~OHFu͂XkKQ\1F/Ţ%(Ax7m+Ehni5[*O[׊Cgtq8J}Fp,=ϣځkw6[ +s? qN[7-^pV._n?i] 6a2HO: ‚endstream +endobj +1738 0 obj<>/XObject<<>>>>>>endobj +1739 0 obj<>stream +xWr6|Wx:S{F-ɖN!M$XTidd vft3Zi::Oiq9Otq99M|p74[ѦV˫mr6NfW"gRW۲kO7ͰWOm۝[_[[DN״.|_ۤR*Lioʒvlv:=a}-+ {!EN-cɳɥ~%قd-s -ڶ۪V:tR-uSr[ONdEF am+UUer0gL#GOW-<TZj_.AY;U==WVV[j|T_U +TQ,geJw +h(` +`}}N Cؓs'F(Pu"eՈۈU0}X#qM_,Fsn.fkMRxJYm`/̶c~w=Ke7: hڣb~ND"%ZI!Ԥmѻi"Mk-h_Q͊$d+|ÚKL >l-ZgB" 8h +@^3i1 sl[r>{t2:^~ +o;nȣP[# +G;IɛEFB Þ%*ϡ`pWAXuD8Ja2%}Ό`;Xਔ9s@ wx豊Lޱ-X^ TT~s+1a5.pFy6xh2+{B݈KlbDM!(p`^5<m:&{BuexUVc /g+A'Ϣ"1^i@``a(6]<^';|9EPZ5.QkrH4"=0ty9\/' Zj's<{T+-Sc¡71oq_O<]_J& +?aWFI6!dx>Tļ5:we?F"WF9[kՂuk[~ͺ +w/gL5s˫dy9Ƿ9^8_7G \endstream +endobj +1740 0 obj<>/XObject<<>>>>>>endobj +1741 0 obj<>stream +xX]oF}ϯo!Zp0d ۗ +RmH}A{ؠH=w>1!U ;s䯳z@%yQߧ(TKCI!SsYҼ;%tB?_<+c'7ͻ[!A^o2R<]KrRm2IkQ&o%RȜk%ާ^<|[Y^(V+ @$*̮LB&eDғXebih.W +oTNF%B +(:51zqQ+ jY0ڟF^`q:7:7*O[XPm/tx_ϟY~:1{!s^`4 S1_?Foa%5qcoNk Z}:X{]zR>yU࿣@?o8U~ⴇ_־oWbNG:`?su H+Fe=8XrÀOd +}^a +T<}KGz+_\ +fS2q :q].rhJ`*,x#V=Ǵi$r] ~&0?Z=3E5l9)k뉡DDc*B ᜙ <˜nCAMEKfrF@*6o`0`GTP٠."w6%>mn k%g%#v +'`rT?2hҋZgc.ҀH<㰷Z=c09̻xj.eHtR5 %269/hN=h5FKH6ǩ:o*hn?=l\a4*g*WP(s˨v7#hhЖۼ]32",w\NIl9c]!{,(]媲t^#ssвZ(,%FWE"Q<mcM.i}0՜vug>m)W9;/U}:W^ ڂ:F64"i-|eZ4o7gUWUR\ +^.r5Jk\v/4M*-DdzCew׬'{-< + +kF[hߝbǝӸ 4`V~OPpKO{)>/XObject<<>>>>>>endobj +1743 0 obj<>stream +xWnF}Ẉ]HHR-$i4+X:K,)Ҭ +He\^vsS/!B:h4tӛ-{ 5-o`<"a0i\I\D".ǙO8?\~ i*)fbt3o e$RF"etRKy7DB;En;¿[t^jƥ"+6[ !6S}*4mt*UPm^D5GlBoIoxNQ@SbO+, [hx )C[sp_[ՆbMKpD4٧"]]x-"ֹu*3GVև#yO2Oyq'\-.yP `3.:z,3bNs."iN^Zr&0)a=ՎNt`\xsةuFVhBy*Q9SUŽkYC$q ت"N +`Z]B}{zEkI@ E;%O5!9ӢD[WY^5YYU\b05/ΧCBQ'tIYx֮]TJU( JeMM.GGpVƣ%_4譴F-u@!g'݊FW?iA :1g>u@'b{ :>:{\ECAPPπ\}Hkoܻfd>P },O\hR}-rgo~SޤWR|ZA\6C ?*J+صϘx[!t[mqV6+3Bwx `yL1:mѯ+"m'Frtft}9Ey%)eFG!c,Vii5L ;udB'J< q6IjU-~}5`Fj $wxB:a/&ok4ޏ꺮ܖESkb"7T))ѨBIudDc7lJFT< !r(/2'4&?!_Yxʻ|t:8endstream +endobj +1744 0 obj<>/XObject<<>>>>>>endobj +1745 0 obj<>stream xWnF}W he@4J -0VRژU./ 4uj4o;s̙_f"r4f4q<[^௒֣3cZXX^:#>:*-0!TTT dEɌ8]M#=DKH1~:49]+ sY5Sӭ 7#`Mח>^Ǜ /9R|y?8:7=MQC0XNhSxY -:G y~1>"i/n~p_xG¼{+fI/-$L^?WYc+ ܥGYɥo{mTng*mPP-J:i BVe-m{R}I/HvJP4C&MjBgvBL]d83\xPddmN#CBPsSe+u 3bN䔚rϖpIB?ɪLF4M)Ķ67>ԖgmE4b_lA jZZncjg e1O1ڙG^p9Ydx-Sǧn@=-̗OL@qvz)9bf^;y4gUٔooWwHmI.r838y'Si!&:b?PeSeMazR 2ZIw 0jn`@9֪R]hw;Ѡ_%..ma)Ʀ%Gihh|Gt'lK(za܄t'ʍh ->Xt=ְVy-@쉷GwAh%LMe E4}krSdMFA(|+ d.|h^l +RouW]Wk+MG:H_J + 'W -"8z!;Ble2u[#B;0;@ .z [t[}bmm%l鄀& -y[{Xz+N 6*4݂]5ϙwrgyb=jѤ[<n[w7!KgVGjYay.2]Z_w}CM` ЬСͳV:֡*>/XObject<<>>>>>>endobj -1745 0 obj<>stream -xWnF}W "ɶl;(<4}XK RQ=q`8wr̜?1oL:RZF]\H{IՇs)qezuIIF8>Q6+H+I$+ZT(.d Q*!X/RYtԬ$1.T4V/o g F7:ե% kcpR-LSE-,:tH_8}hJw1we9=¹[ˎGd9=l,y8D^ZK2t}AOɐMD"GYR:pZi[q\YT|eRKRC}'K +-߾p"&OF)G_ՕD#5 H;79m,|mAch P0wzГWL'zIy vGևȝ]ń>n!5C6{VE։xÝd2qeCs|?}m*0;!H +! : pNOAqր0(/aL0^ۇd?D <'l'9'm3t>ɄڱșA/^+«4z8_Cﱻ 36?t{LpSȳԳ8D~ptd;dz.-0JBjl>' sy,^XV0'~=EڭM-XON6_J4l ˕KFѮם8tRl!ipt8G=Ypl@9b*y0m]QS20eK\-9Hf`|{i>͈q)pe!N1-%!&.B5 9lOk%xs,@6z930T~ͯӨJ`Y pD@V-<> `azܽ[)qiN.I&@gWD⮩8jMwA7Ƕ >(ϯAe#8TaqM`|ZXEi!HxƀOn`5S)Fimd@xnG>[/20'aS9LvEW<Ƀ v0 g%.18R%D96؍҄,euadmx:Û+o - U𯜻A0W$|z5^L|qriOz}Mendstream -endobj -1746 0 obj<>/XObject<<>>>>>>endobj -1747 0 obj<>stream -xWKoFW | X%ْ\n²H%\KZѿ7KFm.4A`ٙ1Ch<(ƠlGWJJz7>ᐂG&)1aS.꘶&Vu,tZT$E&?tiIPp{#Q*HdXו,),Fgʣsϧp썐!߻QTGŖn)-bE06~0q̥Ja؊bS}̡7i}s kz8Y6kd]+YlR)W(JvLZQZPJZ)SKkz8(PHv/E -B-Q7%QY6i"T -O *S=/ CI(IQ9ڧ3;ᚓmlzt5lw^/i+JȲƿYi&6o &2veؖx5WOTuZHlD_4JR܅:E3M 2a܇;({i}I" }.W ];|W eLLYt%ʪ~"绛5SBсjZHx틸[HZ<#n錮qVi6&ՠMs'N5A'O T9-UU^uo ͽ g h`菍h ԣ4gMZ1fax -;]T1%>VK+MmZWVx q:4R,QgerD+`/h3*@ih(mE,4₇9Uc&ݧrFN7wK2>4pdbV7qk|,릀-,p!e. _݆K|FtTwu2kWu['8cbVK@Һ1vvjd7#)]aYўᦲxF6%@W،Y8;gf(3n=bY/m3 3;5 ͤup}Z^/(U'`^,>/XObject<<>>>>>>endobj -1749 0 obj<>stream +:G y~1>"i/n~p_xG¼{+fI/-$L^?WYc+ ܥGYɥo{mTng*mPP-J:i BVe-m{R}I/HvJP4C&MjBgvBL]d83\xPddmN#CBPsSe+u 3bN䔚rϖpIB?ɪLF4M)Ķ67>ԖgmE4b_lA jZZncjg e1O1ڙG^p9Ydx-Sǧn@=-̗OL@qvz)9bf^;y4gUٔooWwHmI.r838y'Si!&:b?PeSeMazR 2ZIw 0jn`@9֪R]hw;Ѡ_%..ma)Ʀ%Gihh#mz[G=0GnBF{nW:ÞVk{f+<{ [#g`€s M~"|5{fc&Bi RAGZÏji?وں+ЮnصTr#/|IY+RsQ{QX2 +\ } Sdx {MXUu`Uu-ۭ>1P6_{tBZ_@b@=,i~nAݚ̏Rr>/XObject<<>>>>>>endobj +1747 0 obj<>stream +xW]oH}ϯSAIH6mWcU.1aه=N dH +!gǹss0 LrFgsd<9_]3$h9M2(!L(OPZJ55%eź(s/fX_YU!U=CY\i~X >@FI%hz6iYZ:7 +R*\wTh3c)3TjcUNQ G^5Wkp.=,R +c,fJ&CdQ"B;6gg;bI UaukdKVj)kΦ?c6F$l3ePUMoh'I/9oR~ڑlJJ4[v1\ys4ρ5Bf~ⱷ=-ƐNl +D~%!ǐ Q9W@A{ϟ>yBT;bir{!ZՕ;6h-Gha Lzm8ƯJid=Dc4µ1P -s )5\DܗSS\N@Vp"&GFZ(:D]= ՍD#]Kf6T>ڴvi1HP4YF)|(V9=I+zO=$4וķM{!ncNOHbB[x͐-bt"r'"˙/Fwl܄6?L_K%LJQ EՐU:L +%5HNOAaր0(/~L0^Ct^N"Uǜ퓶wGzIdB} :/ՇkBYGgnO1-zPO?ӗG6FSȳVY"? @2}-B=U%!5L6st/ +~;EڭM-OV6ߺjiXCr}l[ a蔹A6|{aq̯{%`ـ/r.a7#-tA_fhW.q- ;uur s;4#$ +zXx:醴$۰ǎD!5JgY]ro` _/Qb>҃ʛ? k/).5op]f9AvYYU9*ު U u^x]ѭρb;v[LڏIAᯧgQF}< +2?3As$#b~UgAI>/XObject<<>>>>>>endobj +1749 0 obj<>stream +xW[OF~ϯ8 I UDhQEH[al/d76vR!D\Ιsɗސ| i:¬{>3oB')>[H{Uop}B!b̦}VB~-i*U\W8XnDIRR1 PHrM2,'DXT"ź.eAAcU>|Y[U< U=ytvI< ZF?n4I"H[Q`96I悳x.aM"-ߦq#k-K-Pe +P1֎I+J4D)PAk"J")`ŗUG}DKPg*iduUmI=B,NU ҿpO MCsbG=?:Nо7xPxCw紓ᩐ, +.mkT>˔irjsh‘.)ÖëVRG cnig[>Y,Mf%j)έ:zţ +7Г(D&ނ]@»$6n (@P7< *Qhj$Ӻ9ReDwו3$ j[H݋[HF<#m芮qVi66Ѡ޻Ms%J4󽓧H\ UtyW)K }/:Cdtzn8|Nsp}FC<}lH?yS@˜5k˻ۋ=)2.q\ Lh~,`fIR@PSO,D;S{7s9,+#H2^5,@AHf0L7vʾ=^W})lsK|i2=eap_Ϙ aI|{ᩙ ѯ>_ߴNG0X>5mWｿdRendstream +endobj +1750 0 obj<>/XObject<<>>>>>>endobj +1751 0 obj<>stream xWnF}WL6uCl46J  -eEč]KZ,)Kk( ;!9s̅^ M4PZ^>Mfͦ<N<.>~ؚLɌROz0Mf }vUj얼*׊jGkMuTՇ7X XN \r>R{9 i]ULBih} eI:\Ƴk|BTϱ>Fɐ}TkJ٦\܆vR% lZSijz^?|"\j2vzoa9( qiwץ4J^&Ra^CEyu7T |dpV2^-uqE1s -A?#kۑ5X;`Req16;X`m jSbV`P aWDDwvi^9kЭOqۭF;!|d-当4X?HmP&:l1'3^}fҥh3A및\t}#̶شhcK̶E5VOE:Yi$vǧ Ye5n6T6×r  Éo=)O,Fiy׭8endstream +eEč]KZ,)Kk( ;!9s̅^ M4PZ^>Mfͦ<N<.>~ؚLɌROz0Kf }vUj얼*׊jGkMuTՇ7X XN \r>R{9 i]ULBih} eI:\Ƴk|BTϱ>Fɐ}TkJ٦\܆vR% lZSijz^?|"\j2vzoa9( qiwץ4J^&Ra^CEyu7T |dpV2^-uqE1s +A?#kۑ5X;`Req16;X`m jSbV`P aWDDwvi^9kЭOqۭF;!|d-当4X?HmP&:l1'3^}fҥh3A및\t}#̶شhcK̶E5VOE:Yi$vǧ Ye5n6T6×r  Éo=)O,F#iy=endstream endobj -1750 0 obj<>/XObject<<>>>>>>endobj -1751 0 obj<>stream +1752 0 obj<>/XObject<<>>>>>>endobj +1753 0 obj<>stream xVMo8W ri -X>A@MwaBKF""U5~P(EaMrͼ7wSWL5e" -#Z]V IEz!M6vp_|8}$9!A>Ԣ6ۂLPV*%lFOZth3aqX)Hێ|%:lԩ$emEK4(B\pf8ujq(%+IPn*l%\ GKcFipNp'^䬶=hB98$ IԵԖA)s2c :ˡ*u@硷s]Y&-֑3$`EGF) Ɵ尯K䊂:\sSn%0tlt0DVTqDAw;BIfF;9O$J=yDCe#BEYFf8Pjj+- bjd&D!j/D -oL¨F:Ɔ,?UUߩ^?"&Skq#[gaPLfPzF'bFScBcrM18C Ǜ0B3=; Jju^:4 ɺ. ,y1=\!ST5, JC7L|թ9l=(gC`0D%q{@86Yhʊ]ƶum) ,9ESzzgfg/c ;zt;=ږN5?Nfwށ,:ÝT1H:2({egjbRG.Ne:x!T&T!q -2KtBvhv5nmJ&꛵ݘdmXp^FMt[B^*?pBdzendstream -endobj -1752 0 obj<>/XObject<<>>>>>>endobj -1753 0 obj<>stream -xV]o6}ϯ)q}趺lPD\JC "^ޏs=rUAd{%ɚ+<jWIyz,ݼ"m _5m+ o{RNfNE77Ԛjl{W\&\Fu7XADW4]oG+MBg1VA2hQ=eUHɐPlD?*Y2tH8^+AZ{n_{aQOwVXXdJ>$8:B#jQGE!C)рp[;4o4>\:mkhD Ռ$ ӭnetv1 -9$zaE,tsxN5J}SnfD V;hxՃjwF9=hF]z^`s'00G&t&i!c&D􉇏@}Ѯ@j0}.L |1LLyzkĻ,Axҝ5wb煗&y?'g@&<ԵV)7ȑbvnA`Rt 2^7fC_=޳|u|@,{y,,˲YNU6e؛C}@w

{TsrNV7o~?8Dendstream -endobj -1754 0 obj<>/XObject<<>>>>/Annots 1024 0 R>>endobj -1755 0 obj<>stream -xVMo8W ziK?m6E{(PeH쨇[e ̛ u ? -S7~œK]K.K^*.l5xOJ{t7؎!"C-ہ~J^V)CmAta#sʄǐ{42kzm{ +Xd9[nrɅ(DjEj>(EaMrͼ7wSWL%JEF5w[<%Bd w×51r$t !dBI, d3x*}cmD +3bMCҝt7,ɝ&<`V4m-XmP! +Jĕ5hSGIBr\eJ/IXRŐq08iDA+i̋6G-][4g?ʑk EUImI::"#U+BYtzH8' +iҢa)=^td 뙒`YUW\ 7ܔ| !%;Qxܯ$ѩAݞP?Ĭ6N2i=l挧ZPYˬ}QvֶF ŽZvKjJ{ ʋe"(e ,I?QAs3jSUuꄨ#b2W?5J2f7jG~IOG!LJx ]5p o"$D8 +8gpԓ*=u~d:?ZS?2<&"hC0zMM(+X:n=SsN{Q]X®apKpMSDє%mԎS@X01ES:zgfg/c [zd9=N58?Nfށi,:ŝT!@w7>oxYZ 2SC@-!^k?թeH{rXR&P۴x}Pf?}D滄9~6iS>Á`]כ]Z?YsGijendstream +endobj +1754 0 obj<>/XObject<<>>>>/Annots 1005 0 R>>endobj +1755 0 obj<>stream +xVM6W CZ\Hݤnrv]E%ItIʎ}ߐ(Y dg 罙1M7ՔfKJ$_h%4E棠gIqGjhJI<6_|t ֟/5ki|Ϟ~ttfM m\6K:|uDou:*5꽣7:Ɍ6/O2|X'KrFJ=2lU81R#Bѻ +)]`:G +aW jCovFT&-.,=YyFx^ +}P(䙏*L:myS< \84$D_YJ2ڤrJ6ۑ( +}G:4l㊓PHTeD Y$)#0"DF(D{IFRIBgF"5poGHmgN^_:i]QcF/͕ւS)\Y8]/Ri*I!ÆXL P0הTE9k 0|K}&Yq|yFj5Y_}mDoCd\l!#?mDVVa7F9(S|)6r]G +D=OW q[BkP+Ϟ-Q[R }Ƿl;O]xpMРk(YR%HW]mZ @w͖ܻ =,Ց 0Q[h՟o:ʛYNtV "@} 8؎۶oGUP/^hX-}!+y&¿c~HKBڦas]Y -GiJey) Kꏵ)WhtTWc)fl\*㠛QYMaמL/^T)J{gb `0!WFIA/*U؋ FXK8aᕗI+譹xP? R& +SW yKVWfL] nY/b(Kendstream +endobj +1756 0 obj<>/XObject<<>>>>>>endobj +1757 0 obj<>stream +xuAs01GҔ[;N/\JJ2>&mi +Ì-?g -MhRgxAyKZ+tRՑ7}xǚ}g+JXvԛ:- ]zzA7ق4]9:2.IkH +MttsD**,Qvo_OKSendstream +endobj +1758 0 obj<>/XObject<<>>>>>>endobj +1759 0 obj<>stream +xV]o6}ϯ)K>t[]ax]u(hHJRqw.I%KD/ǹ {Abͩ6ܬ\*bw5sZohWF^tWz!žQa{KFW/beV%n,2鼅t$j}7Xo%-rV|VwR^PͯңXMStA[?ݞWWcH>/XObject<<>>>>/Annots 1010 0 R>>endobj +1761 0 obj<>stream +xVMo8W ziK?m6E{(PeH쨇[e ̛ u ? -S7~œK]K.K^*.l5xOJ{t7؎!"C-ہ~J^V)CmAta#sʄǐ{42kzm{ NE)|l?])L0cgbt3V#"  !EvNYhըi#muC1Dd| M?0Kik .N1"`-8zĴS?BnD"zqܨ+7TLAދ ںNnCO)ԣhv r/{ztNoG.Yys4tt^łAa֨AtnZ(e1}4ބ.r@!O5 ᖒGf`r=S*tYvgdx^^Z(XiG3x^n'ƍq>ԁN*`bxj4?gT / m5OչW;0$jq=w{X6p LCCC [l2Ȧ?Wj 3}״ykb۪bs su8OvיKERVt8xXܰ y!S+C^) %57ʶXKh -e(Az2{(A|)Xc @v݊COd7UFd.w;vW6︞hsFxbx/xe 5|5F4J$endstream -endobj -1756 0 obj<>/XObject<<>>>>/Annots 1027 0 R>>endobj -1757 0 obj<>stream -xeQMs0+љ e[2mzI&M;="ˢ(1J4+t: zψ#c! (e)edUY=x{;b(79+Pk3V(߀hZRj - qFxr1UBq&M̨1x}vrI(LgS^ %hicZ R9LG5NSSv$h5ݛB,M{!/\=c: c'3>/XObject<<>>>>>>endobj -1759 0 obj<>stream -xWnF}WL"he/EK[4uZDEP/+r%Mrݥe}%7Maذȝs\ɒYUN+*EEk$mO~\M[i]/𤘾D礡~2]\y~ r ^>f#>EU jvGWnpJ,GjeFJR#[Gt.nZY?‚ศDwxP[`Yw\oK*D]2qӘm6@8͢|]pVH5 'v tx'of1 -}4HHo0O( m>/XObject<<>>>>>>endobj -1761 0 obj<>stream -xV]O8}W\Haf݁٥J#I<$qv=-%B@{Li)]lNEw0&t>ds:~JLGqNͳsf6V`TLv:4Mk5)[uڍ+녞OZxP>bzm$$exڀ;VS(D'R8ڂT`ȥ/G~(Rt`'ch-9_֔cntp M_Fۓ7t.XNFKˌnAjk76GLU<$Tne7qե^dE0n\Ѓ -`DFXktgWcF N0ub*5UNdsLObSMk>Ieܴߟ" -'~IW"fM[<@v ƿ] -/F0ayI42VH?"Uj2_;8'8A""4LY -Y,} 2_<+l_IV9C_0L#_8RcѺ<Ĕ$FYC[IϦ׀S" A$g&)IZ8l89X^?YD#DIUj̓RSGsαX%I&8imz$u -_Nۗ7bH_̏TF;QrTY6͜^Zb,}dT7ぼOHigH!GV">L25^RZ()xz|P#[ΌE𕸧Xһ=<2/8lC)>L ZKE3Q.+t0p5@K -<{:;wZSMK9ji.{K^ 0jxwiK|ϥfܡvƹAA\׸0 C H8֍$DLTvjd^d~pc2E9dbKv׫6F۸=|E[/>/XObject<<>>>>>>endobj -1763 0 obj<>stream -xVMo6W |iC v@Q J,n$R+Rq_7udoz($@ 3o޼yW3gF9-bJi4x6ܬܿXo&K'V۫46xmF@46ʒyM)ZMd)Ѿ\!Rf,L':#-I"M$PU*E3B7ZTmZЮD@a!2t,֟ŋrLIg ^j٨Jj'28PԘqN:rRxکJ!xyPICE 8{UqP W 㬶NVNw{Etݠxv6JAk/$SZ7-eiRF rZKnhTy4b,4ZFIK|N53+}:ѸU^V6Z˝q UEUmE" +e(Az2{(A|)Xc @v݊COd7UFd.w;vW6︞hsFxbx/xeÆ$[כ_J endstream +endobj +1762 0 obj<>/XObject<<>>>>/Annots 1013 0 R>>endobj +1763 0 obj<>stream +xeQr0qnɴ%6EQji+v: z#c#PH4}2^wX3,G.9}/'#mJՆbAiCd[uK +稛Y7j_\ 8>Ѕ0e<̎zPC0g&ϬO^.0 +Mi5vhtY}bLa#t_x^B !A7h +#mœ%iendstream +endobj +1764 0 obj<>/XObject<<>>>>>>endobj +1765 0 obj<>stream +xWMo7WMI!I@Ӥz( ;2%$ײ} w%YH°.g{o&\Li)]h'l<5^6z9^l:^~uq & V%!/>TM]nKwY:?j@>K]w肦課OL;ɤdKJR9 joP]&H6Q]26ɸDQL{1*z5I䊊irF.&Sz1mq0G/gc+ +NH6u?7}*6IKS%~lQ.E[2}EåIrv>܏JޘNgh:w +˩R.iW٢FHs3=p!yVœAɗD*m@z/ GGP)5ǖ 顫!뚵%/%AZ`#ژx +^ɑd~յߍPR9|RۏȷšY Xn5"xI +wڴVZf6wH=m~񯙌z3k! m[_)te4yL7jaov(d䨧5 4-:)kTR܈P$Nٴ:vAJ@gh>C{C13}XtpIxf Rހ3 wL (+Ŏ xH Fc½ZB#6&vbFuq>wnX. 1(;Rab jObH܊vj>;ƋgϨa8UPĶG`8[sø0)z۪;IdgS.$!~8B#śɥ^)kNi +o1j|E{ŁKnULPN{d0K\{\f :M;4 ǏPg)ut{qVŨmHrl[L=CO1T˚dQπc+t.jagq}٩*_3BD *j )z7tv='{v8GX&utg񠖽;LG-yx!Q KFIUêmMiUa'+Jng,\PxMvR^9l2֗%=[(>|:ֈMv5i \U.>/XObject<<>>>>>>endobj +1767 0 obj<>stream +xVn8+@S -]b0]MgASF"5$sI~ƈDqιoV͖$4b|~]|P,ljhqNyN,+ڔ)mͧlGٽ +A=u- izQ*ebQ`؞J<<0%}Hucs)Ϣي7o)YVM+Ld9UrRb!|" @ٖǔl}[6M#eK4Q=!&s [ʝ]ˏ0 U$zH[gP!g8EY&n`IhF*tpP,!|G9R<[d3>=>"_q+2師, p9ϊ*[#w:mn9&Gڮ.!oIj,ˮURﴌ0]zD@0!Tj/э^p* C飘!Tہ!Q\CߺNҧ#˝ Z:\C*C$ꍥҢwۗHt+_{le=3UwE/Y/p|_e&S<2uG5NSD$5Fɠ9 !b>"J؂ +vjEj&Yz5c-EP&zAbl^yjT}3A8xh*^a "E/.FCʚCc;ش>mGPϪLؐ mx|RkpU=f+{ xZqgLROi;yDCP*>|FAЂVk,U@W1 {1~W]Gm%\T>Zc[g{6ru>{U;Q*kLg. ðM fgj6SMFSޣ jM$Dޚu%;Q/lpWzwpXоL<_uIBז"@u|]=3RaV%XO+~SzF,q |Uz_s]RDň>wQNlunO=^Ur~YhQ,;?ӣ߰Gʎl7>/XObject<<>>>>/Annots 1016 0 R>>endobj +1769 0 obj<>stream +xV]o6|X)#WEQk/.~%V#:?$] Cܙ]~Lh -.(-xß*lE*i:Ǔ_A'ͮූ] Fo(j2w3Vf/*+kJPy39Zm5ҟ#li/, I~*_?<$NjP˒ +)WrYd͐Haڼ(h#Bg2nki*\wǴKF0ԃ.P22aLSdm e*3_7]Bc-RZ x#{1JbrFJE€dl8t;xsp5 lA;Q"#l@2vOd]VSl"*$n䣎:Ȧ x4nbJHw}srgk9O&[ '"V6Vda}# +;@MUڒ|ҥlkpT]\G>n__p~u5H3`PK7( 2? 7}O|vs4#tdvA+ #aib)@j[c pMasV:T=O"w `Sҋ{tChrƗѝ};AlQ"/\ap mM]Los&{P@CK +Y7`gwtp#Ӏmky +jE t T0֘gJ<Ґ;ܾ+7QTiژ~- _k30p;msaY>84)m1冪Z[ ,^>/XObject<<>>>>/Annots 1064 0 R>>endobj +1771 0 obj<>stream +x}Y]sF|ׯطUL|+Y9'/>K/ J8|g̀T]*fggk_[-#gnX 2a\A.ɂd;w{aޅtFZ 6Nfl +."2I +]O. ʃea/%ElCè"THg#UBb +B/\ \³\KPh !ݙH/LUqH' aJNr4 1KaDNBf3 G ϤH] +Y;yL(4+"DJ%B%أ7 by'S>6KCzoIIxw2Nr=HVgb8 @J%@,OX +Cdt<`]215x2FŒhqr#)g 8N@bI)+AW,HbJYz2#T.l~V7^fO2"dQeĈJ`s Z6(Z 6a k0ՒQ,[ 642{K)k1XZL6bˈq,̲DfbgZUr `z`XFQIk1، +eX&8#A>nb5,jHYnė7bq! L],>+k0ge ƺ`#JE8gإm< Ʋ(+H%x% +2ґA)k0,Q`FE5,ޗ!J,)W@L73q%Pz` Ăs(x'pA01$ ,pD?[=b2l1XȲ#xH-+uȎ:Dw 7aO?vGpj2#f(d]e 9(k0le}(#Cy||)d($i1ؘ*IPE۰" dCQ!8\S(:\'L6!Bf3cx!TN!8md80mWa⻦"'^*M(Eu񭋀"p2ar#(E;f(IQϊm\|/77p(MRvo1cB%Dx]+]uMݗu?<Ob|bPCnv_U]w<0?m5X]֚w͡^} ~.@ŋ{W9m|N.wV}^eWp{<]5FkV><.Į?UH.g>5m_qMBf͡68o֍YS)_7 ~lWڟHrp Fon>:k#]^]7q[^7} +w*nm654A=/Oi_/ iėQii~vƱʩGkXOsIyO/)ikY-΀6-mphYH!.p8$ei+0iw}6Տendstream +endobj +1772 0 obj<>/XObject<<>>>>/Annots 1084 0 R>>endobj +1773 0 obj<>stream +xmMs0=+!NdtrL0Lj\xlGjYɿ#_Ui(J?ȝ'q( )@1fh4:Q)8V 5RcqU@MeBhN,FgTWJsh7)~9\SBEXEIB>ϴY$D{L]0)`EQo?V+Ԏ- .U05(@c*Yx}N^Vw]ulG +3JśZ٭xYޙwⵚ1*T+obxg*ޕǑfb*T+6aXޙw쵞ޜW]({3H/JFjc슬e*^GxYޙwGpnc߽XygF$.93>nǿ2Qḧ13#6GPendstream +endobj +1774 0 obj<>/XObject<<>>>>>>endobj +1775 0 obj<>stream +xV]o7|X)Y}CƁIkiwTHwvI)9a[ٙY~9?3Œd:b>,iquszM<-OiUc*>S|S>n:jO ݫP־vWdBtx,{./.9vyE ]~ 747痀7W78o:EGQu/6NhLM;7Bm&HmuɛuCW1)]$^Q)06.k@Uz͏+] 4.DP*=FNփ+ ^Pk?:?˕qMXÉ^8(Tݿ{☝Ic,VY5 F:Mg4)[Mލ+BրVmQeTrqv^?Y;lkԫ])m[ej0aҧga([Rt,`>='ch-9ߨTcjp Ə(Rz l #ՄnAjo72GLU$twsFX۴;J9tBu8حa0rR|8 ݹ [+V^ QDXrh:ЛSŒi6dsN)ـg3푫aVj%Tޠ}Y1I| +0xE%N^NΚG T.2:]L#AD=N?JɭAb 0O7hLq,c: +#RV {'$g1J@p^P!k`C!y>ƆO }1)%+1S_2LqPzRк<Ĕ$F@[I׀S"[T-)I4mWp!0,qA"͡y^`Y0$QRps%H>n_fSF܈iC!}Q3?;GL25Z/)- ΔWt<@!I + g"JSqe?\RЩo`Z¥ pRqe=AR;Xⓩ|Hc>/XObject<<>>>>>>endobj +1777 0 obj<>stream +xVMo6W |iC v@Q J,n$R+Rq_7udoz($@ 3o޼yW3gF9-bJi4x6ܬܿXo&K'V۫46xmF@46ʒyM)ZMd)Ѿ\!Rf,L':#-I"M$PU*E3B7ZTmZЮD@a!2t,֟ŋrLIg ^j٨Jj'28PԘqN:rRxکJ!xyPICE 8{UqP W 㬶NVNw{Etݠxv6JAk/$SZ7-eiRF rZKnhTy4b,"ZFIK|N53+}:ѸU^V6Z˝q UEUmE" [!+P>?k)TRShr@![ Dgֲ(#ҏ4-$UFjPP[tgi1_[! Ej 0+sqѻ@PK5joe3h1C`"aiϰlAh6\ ;2FIK'<ބRpZ|YT$tf27McW 1f1%{A/%Z9thx=pMrs:9:T7*{Vʠ%̥ﺟlvUDHWr1c plzf .5dF7Taj-wߘ\=B@Ws^`tBE}Cl{ay.\Wn*$*)2ja|U0=4H=MHqQ2؎Xaڌ{D~-Z`ziY< 1tVG~OF]`ɢƁ7źF6W'(GnWB`4v`+֩`G'lТ5]˿ôMho{e P -yeΛ~ػ7 aytG5 Rɤq/xÁzz˫mXz𱟷W_iq۞endstream -endobj -1764 0 obj<>/XObject<<>>>>>>endobj -1765 0 obj<>stream -xV]sF}KXA1LLZfM<"`cIܕMޯsϹw9 .4S>_1&<6/a0:~!:y ROB~t&2]4Spm# -q-%wR -6N&‘Ωb/8dӱiϖ7+2 .vqu;I bx0p<[JxW9dijtNae96h-c9 -ֱkr*K dl[%SO\{"hEu%oeWςU&̫Y76k ZF+GH=slMzHA"(6vwPhjbXQ6[G"2+ݷt8˖7+?Crm9F-Jrg< 6#T.z]`iiDzegɝzG*:B X'.Oj動Xgl=|Rl.}U,ēLU&JZe -^Gd|ނ |jd4^jEȯ^%TEk9(ڇUe 1Bktɂœ\qS&UJJ:t$:n& YR߁[V -4T9l!CV?>nZ=yQ2y^=5wTkBJC`"BxէU4[91mށ}17j'kʓG7 -Lz{5cq ]?%nKߧ>tWk78Q`A44' ;Tl^rċ5GǦ)BW" -̰7Q\@:$FGn<-j^~x$9O@8P"KY$`zylA&J=ϵ mخ=XR2U<7u T[#/M@6Du|<C;J)TgĺʂՎCsl <2{\F[Lxa; -Jl>ᬎN3ʔSXVbHզh\/Ay4A۪%'1N8q -endstream -endobj -1766 0 obj<>/XObject<<>>>>>>endobj -1767 0 obj<>stream +yeΛ~ػ7 aytG5 Rɤq/xÁzz˫mXz۫߯۬endstream +endobj +1778 0 obj<>/XObject<<>>>>>>endobj +1779 0 obj<>stream +xV]oH}ϯ⥩Ը!%t68}==wl Ͷʇu9ד iԣt|4 4?#i]Ň +Gk8)J~]^?LuETٷX (A8.JNosI4Va mLm#+S_phc4.d^>G$(1"N~x2 {s6h,{Cֱs*K xhV-U ĩL{"Eu&oe7ςT*̫Y6+ ZFT;C"O=3;HAF\om n(=Tǰ_١LmDj5meZxpԐ 5? ,(sD`/+Z& ,d"2YύJRA q0NԂ9 5%x߲`R` æؓ;%#rsO?ӛ?botS&^KuGx@i;[z1Zw5-/?)j:BzyMfFLwF_]LIJmZZ͘HW9z1cIҏ6h#eemNT)ضPD +M>xpT6t _xZ(3JaQ@V6=8 qH+肑F>@ AW_j@>/zvF0BI35^^[,{dvBrx(~O+s Ckk|5TTOM]k4 K$5Q&AL/b~{!f>7cS@obiiAR[jˡze=nLV\UUAb-F< 6NyvpVON)yj@fSLզh\-@ƌrF乍[, QϿ~o ״j0$ɟ'dendstream +endobj +1780 0 obj<>/XObject<<>>>>>>endobj +1781 0 obj<>stream xmUMSHWBjc1lr[]92F@QfF8}=X։)(i=u}WLҜn!"AYG6k*7}FqL 5KB/.mJzid۾~׊:GҾ1MI2sS5uT$lJY Ei!hQ 'ʓ%.'?X~sQXkJe}L  G$55zA u/28[8L`p=F)89,&4zp,Ftj}s^k4%4eZ>\ "8@:(ј_ aP}r!~D9ѿyf?'rL~||I} lcF}ܒp`j&  0M'хxSܛ - 8c€š4V|)Oˊǐi7%s\MJz:|7״ D6/kQ^$}e&W Q%{endstream -endobj -1768 0 obj<>/XObject<>>>>>endobj -1769 0 obj<>stream -xW]s6|)YyKe;$NjPH0}Ғf&mc,BE4FƋId>sRQz>ua< E ĶmxIW>a0%>,(QlNqB7'܊U%Ea@R -MdZFgz gs>6b믺H̾ɯP6+Y0啿 -[6shkJ*eWI95)Tϳ͝ўϸ\Hִny,{͋u.# OK&sy=\k-x'[֕E_mvcG_-㺄tLޣhӓ[<;ݢD+7@%t̓pqt7b7Dvf?[O;m;E _'y0:p2_endstream -endobj -1770 0 obj<>/XObject<>>>>>endobj -1771 0 obj<>stream -xW]oJ}ϯTo4IoQBVT-f7K=kmnu[EM;gΙŏOÀzץAw ?9RҾ8ϟz^g/J g~  NޝߧpÃ] -h,$EI7H:[}}w qHU.H͍Hr2kI%mUa*+t,r$ fAF%ڣ{)Ld8Vq:Cb4\tz*b-(V$+Ti&=E@"U|eҐ1eҬբq\6b_JM(2I4&5 Jη>rMEF[z\}L6b\ g\Ja,V -$DRUE㑒 Z`K[JU̎`7Gd]CTU ̂$%+__o~Oϣ 3._##\YRD"C &ƒsznWR۔21[إ,Uv-%'$r8J̴YW:_m\Y(\FYxvKߣ@aHHAιI[:2}ͨ'g<$# i&KP}Ub<)swjƑYK*3aP:+*<1KȱH.?}=_On.hv.|iĥji)(:J0 )u9^sm.3GCC$89>ն` |ıL͜i -V  -r@/baDǡ6gϟyAueu sp剆[tK_屌^g+cPֹ*՝,7!W4W%;EY2kю_& -C)HH$qG+ɣgze۬FdVh<l]"{vK1gCȥyƳL ֿ£/+:?g ν}>JL+)VVU.PmkZ5.9y1VGI5Ǣȗ\$%>/XObject<>>>>>endobj -1773 0 obj<>stream -xVNH}W ;Wen+4 C2])/݉{=6j"d"+@ vwΩ:R?!M");?(QƣA痧7. }}XF/q/<N'ᯔ/:C -CZl<"!i]-T͆R$IPQ$T8I2QɄ*o$Y?%gL/w(!I0DyM'ϋ裿_YIfEЉq>Y2'͡9]S(Nx}TDGgg7Do񨾤,WqU*8#iAbBKȔ|mw_YY>XR!p3\t ;5%M$'%t] -aL[RfSR2@ACc4C{ar(+J,ɕVy 'r9Z'bt<>w` {)MU0] P.!6 6)G65U0t\fTn7sٟ`YϷ^|B̬+;9a2iڂ@7v?ե@a⸲"[|\B@GfwE C)t/gx#/CpVY,3ay98-J }8 -#75ߦʲq6|4ADbr;oǞq3_zhe4{x@@/Mk~=رu8r)aI86v}iѯ6s'J=}=Wgn-$y|6/02[ƚ[tZ<loNDx$9hkQFsU\.Mu;?ښ托rxp7u`H?ͫ-6_,0oOo'a%Iz@ )ˬ_F/ZmZo7{z>8E4l2ݞx԰W/YlyOԛ|Q4W`4xDZp8gW?4xdendstream -endobj -1774 0 obj<>/XObject<<>>>>>>endobj -1775 0 obj<>stream -xWMo7WMIڕ";rH04) -BRZ\rKr-pW- ;~pf޼fEA3t]|IU{1rZKM1^N?Qtq~*g V5! W%,t>;ծwyo/Ϫ~G)ݺ|Wx]PQ i"T蚒TgZƓLʻ ʑi;r1SZ5U1Uёɸ0b:jUTEƩ1iT<Zg1fHơOHE(|5}Ek'~JTm:C#׹3֒* .o^J]cZ0jpD -8^Ӄ=$B68H i~$xʐ8֤c+顷ܐ_.Arpa e6&&^ń¿vO䄳 J+v Y304)ޜ˗̶hcwHZDEۀ8ISQPn+HfSzH?*Zm/k&ތZdH6CoiẠX@ZX ) s5QOU=h:ZhIuRcE!JY.nB^~lR r@gh>/XObject<<>>>>>>endobj -1777 0 obj<>stream -xVn8+@S -]b0]MgASF"5$sI~ƈDqιoV͖$4b|~]|P,ljhqNyN,+ڔ)mͧlGٽ -A=u- izQ*ebQ`؞J<<0%}Hucs)Ϣي7o)YVM+Ld9UrRb!|" @ٖǔl}[6M#eK4Q=!&s [ʝ]ˏ0 U$zH[gP!g8EY&n`IhF*tpP,!|G9R"[d3>=>"_q+2師, p9ϊ*[#w:mn9&Gڮ.!oIj,ˮURﴌ0]zD@0!Tj/э^p* C飘!Tہ!Q\CߺNҧ#˝ Z:\C*C$ꍥҢwۗHt+_{le=3UwE/Y/p|_e&S<2uG5NSD$5Fɠ9 !b>"J؂ +vjEj&Yz5c-EP&zAbl^yjT}3A8xh*^a "E/.FCʚCc;ش>mGPϪLؐ mx|RkpU=f+{ xZqgLROi;yDCP*>|FAЂVk,U@W1 {1~W]Gm%\T>Zc[g{6ru>{U;Q*kLg. ðM fgj6SMFSޣ jM$Dޚu%;Q/lpWzwpXоL<_uIBז"@u|]=3RaV%XO+~SzF,q |Uz_s]RDň>wQNlunO=^Ur~YhQ,;?ӣ߰Gʎl7>/XObject<<>>>>/Annots 1030 0 R>>endobj -1779 0 obj<>stream -xV[o6~8Kn4[l@5mkHU؏wH5݀!H$.~h-4SR+?e<Td6G῜x?N.%M |㷒]woh<!%Rw3Vv/J++ObCeNk\rgG z28a(O{aI HP))Fx.! %(x2E.6X^Id֩6l%q&%I*ԎriqwL t= )ﰜv{0&۩U *5np7"Z$ZG% F1t -() XVlrda{߲ŋ3{!XbɈGyaTPɪ@ZuEBIGt&+xԈ|`=b2 g@}Y+vd=%j23`n1ϐry}R;ܾK7QTdIژ~ _kgBalv%wf2}8qDФ\:h)6TVDle <ƫ5'J' >T{24}g} -_ik eqD9N&|y>\# p-0Ōig Ŗ-La?|澎x:Zj`a(nGfv_IIҶXh<̷i\q;d[^i#.Nb"]{k,[~K.S2ttٶZ\;6|>/XObject<<>>>>/Annots 1078 0 R>>endobj -1781 0 obj<>stream -x}rFs*ArodejFrHPš߯{LTm_a4__Ks_̢"Ny˳(9/˓$V(>V2.W {tQ`nFeK̄S (ũĐ.D|{\,+L5$U k%5DvL7@H%@~px;Aa BJeJ(,Rl~+HH(jWQjcpgF>NEj`o' ;Me ]i$&I9Ű-. 2{&a_a)-+k~-]$+af.#6 &ub|oh|z;O<װQViXw5wdsƁa F3 Y`C(Z 6i1#kd0 k0,O-k09c*6Z,'-fhȔ)GJo4vXa K-d!^MZ T v- J/`U2l0qNeYaxbbX75V`4 3 kw9`9t%kdP{!K,K`WVbQ,;e-&Yw)bX⼐>et𰡙" 7.7OQ*5,c`() -6[ K)Ld &펲æ{` $hi.kJl0,Ck0,C`X̉fC{'}:!H}6X`4dx5rU2 /ɂa 殮T`&+kXǫ6+u䑷0,= >&5F ŰȲF) -صmdI1PhfGbTQX%ǹa PhfF[ " İ -= 5sҚ"#ʄ5X$#Z,vvhXaic:ڵKɍ>:%Jaxl cSP|bg7 @"T2f$ #$ -zY 0`c@#9*aG \;S{ RH5A`X/,k0J%A;E#:V>(SRbˡ D2rT1hƝyЖlʻ!H2(U7F RJVC'y -rV+P!ᴇ|z~BAnT.p*LJ?Ā 7p*8߳{K9#p<拥{.Y3rWe~%jֿ/vk+R;4mھxvUC4|i8r~0 Dw ;%VU}?E/onٯrG#˿l*v)6_ a5SٺwnLź{;&W~KܵD s׼uQnmxhK%s>Krݻ5\ѹhm`q'}yS7`۟)gSO'vl s^I YuݡSY{_luU];z}cDzw-'UBw I~iگUjiZO2ןNFmgk֧t/_߾u]_mj6]Ʀ⨣]ٗ.z~ٹm#0V\t~oJbDc}|~2lvUDat`M7y% {q?:vޟN}iZͶMj4ꢭ,?/5!{' K2:LqwE +a(e_edzK!AQu!NM[z_NBNq[\{x>/XObject<<>>>>/Annots 1087 0 R>>endobj -1783 0 obj<>stream -xmN@g t.]b\4-)3cH| ?<F3= 2$H%:5)q{ܑWⰯO4= H+%v=S4#e;];W΄4LYZʥT$⦜c[/dJS]J||=W#˂WWbΎ?7 FX*PTm' fM#SDhN<| -r)g;< sFaM_|~4W6N]f% ^cy=TmcG̰?SXNU+ɴZ y(+}endstream -endobj -1784 0 obj<>/XObject<<>>>>>>endobj -1785 0 obj<>stream + 8c€š4V|)Oˊǐi7%s\MJz:|7״ D6/kQ^$iNЗq[o|Zlõſendstream +endobj +1782 0 obj<>/XObject<<>>>>>>endobj +1783 0 obj<>stream x}Vo6} 8vO].C,<D\$R%D"%w޽{ד! H'd@E2|#YIy0]FI2~}urFZH2i &]D奥$^lT_lpzwhOIBo%BѦwF\DQ755O]9c^pWB&ae NBiU2UJ1`# ((LoIjǿJ/i8k*O W F ,'cLyԑ*B`B>}eI> g{JG*,nhߛ)!&媐z.}zpq0[ș ;NQR)~qu5lp5ƈu*|,d[ab` }4SEd%e3> J4%d ^vLUؗc-_(ǐu2lkXvA~DVD! ^'فp0)u-*<)v4HE ;DX>tG`䥑NοIN}bhy^ֽKtcYPZ[ ˛C30iQgl?Ov54xdSB qMT,r$ujjlZ!G hf߶Vs.(Ng@1,JfЁ7G8O?c0'юg-k6jm|j`qnxVUXӜhӁlZ='Kp]7Vxbo;Px26j( Z*.Ej }nqNuH. ]c.ѝ%X]*v SB 5CE?őٛc˪w\۫H\I ;gm #KC _epCAZIbf`a" Nm pY*Q0fh/f c{E-6{p;zJve{l[K/Ma\!T^'Lflb2`p0苟la_\ d:O#ܺ|8V'EFendstream endobj -1786 0 obj<>/XObject<<>>>>>>endobj -1787 0 obj<>stream +1784 0 obj<>/XObject<<>>>>>>endobj +1785 0 obj<>stream xV]o6}H"َC[?l@ E$U~:y6KK}ebJx=J^/`6K凔i])_ )Om~p9:vۯo/Xv4Ji;޲m0<0pAf੎ąƞeoޝtz\~SNy}xt$5~Q,(f;E#c9*d:G <*Ad:塴Pxgiz pJ/!z%Ϭy#lFM41DpWS`ܪX9- i%GUsd+UQm)v! д뽐to Ol_F!i-DA+S L=)EwV"adh {,B$i, ~LC_Ra&e39S P9.`KĂ74QeQb! Z!F2v^ doWw5u:-LkRs%UE7f#/ (u7n~Z`!nHY|x Օy@fHhoKeeDz(ev>/XObject<<>>>>>>endobj -1789 0 obj<>stream +1786 0 obj<>/XObject<<>>>>>>endobj +1787 0 obj<>stream xm?O0wS2icĀ8USoϋBeIݻ+t$J\!)ޣf;LM%L…q49G` -`df|; *$>I)Z`MhO0 ǩHzBl>/XObject<<>>>>/Annots 1098 0 R>>endobj -1791 0 obj<>stream +1788 0 obj<>/XObject<<>>>>/Annots 1095 0 R>>endobj +1789 0 obj<>stream xWn7}W bV]Kav+44R. %1撛%׊^=C$[ !A%93gΜ=9:4RoHY~rӰ7wc~'X7wYwÁ^ʩ?&iw }}39͗`8|Jvv%u D fA֯v5Q4޽=}t=8⦳Z9[2kP T2SK2K[+kxՄ:^?UЭȔ֭w@_%4_WKdY_M3Y>#Lh-kj=VwrK^:OʓXq>)GAsn0r-E *su (W$M2fmӋw6‘/Nr@󜼍kT %LxJT#\<вV,d`|FGv=g!\2PPKGV^oI0\4C8zժTpDLW x| m->76:BT $qEO(; |'x^~\dk#]8@na 9e)\`?$]TZ?[[1eeu2EQ p.o'$N(l9_+U2&dl6( @@ -4115,8 +4135,8 @@ x %]1쀈tKW47zS0EAD oƇ}8}g&|e8F ' ;endstream endobj -1792 0 obj<>/XObject<<>>>>/Annots 1107 0 R>>endobj -1793 0 obj<>stream +1790 0 obj<>/XObject<<>>>>/Annots 1104 0 R>>endobj +1791 0 obj<>stream xWo6~_qR,GɚIk0,@KV"5QbE=iU[$^LtpBi@hWϽ4,g^FQr̛~7sZE JMƚECoFjT5IRzSJ7ήöM/\4(S2htc#oF0}s~+>NH^W;bk+')tS(ծBRjjʂy- 5JFhc6(H|"Z$6vO*OD^(z|O0^4{~F:L!p{-slJMgenȵ}:tec$X'YմP_Uy󻷓Uf iSu{_c44W T*Xdt)3&09H6S^&rVOP\`.A3q{;5Z ߝvDD:m+ OP9" @@ -4124,8 +4144,8 @@ x TiYT6ϨMFjZ.E˚{RB)>7 ~> 5-ꝳ83օ&07c@r׶SZ+VH€OtEvݙ[WDao3eX{1/ǫ &d*t4@B6SKV@2ײxnq/AlBUm0F1 ^y:u/=ǵ'$)Vwa&[>UB !y}B#L3]w\ݬpgpd+K޳'vϱe{DHıH u0E6L;rx8yu 2^x7hX>HT{a^޿+fCVIAuEs!CYUFƌ~S&ofٝj/@m&mwWîdڴA֏;OT}qWJ _a_,iUg{ fSm^V-?˸޵>ˠhmlsw E -l21^{4 n[ܵuefh83,Ɂ/T]t}$/?/5 ~ Tʽ"eV=I(xN4ᛇޚ-1/a8\|/GIx>/XObject<<>>>>/Annots 1110 0 R>>endobj -1795 0 obj<>stream +1792 0 obj<>/XObject<<>>>>/Annots 1107 0 R>>endobj +1793 0 obj<>stream xW]OH}W\ҬD*$B%nӕVc{L=gLȿsvUUsϽuң.O1I ?p? 'n@׭~p7ݾwQZ9 {Oqs?\#?9S%?l[IRɁs$cEdh+"J5c tgu\[4>ȈDF* s̊&$nk%~JY2(W27%ZJsoAs,"Uc#$a ^Z:=!dF:;9^eޛήvlS>Aߓ/ق*P s]y}6IH0W4v{{>y{wpY,Vӯҟ.71?;4zĕtPƭY-D5~R۹2ize#Ah"nTʜv˜# "۸DZXk"0+= @@ -4135,22 +4155,22 @@ RIvT >om LXe8Yꆍ<8a*4OүB _CckG% xes+bt1yzVtD9yW.Ft?C߹뺍3  G)37+HG7-4G{@ qcy莎ur HrH]Q䫞zAlfY߄ʲ QUG/gsnؾ׉t-r$d52!,T Z;7Ϧf7qw·q*L& rSng`؎Z=xKzL˛ŗ.a*Q17d@s7.. ]''c R(8>^ca1WN,wu/ !endstream endobj -1796 0 obj<>/XObject<<>>>>/Annots 1113 0 R>>endobj -1797 0 obj<>stream +1794 0 obj<>/XObject<<>>>>/Annots 1110 0 R>>endobj +1795 0 obj<>stream xVr6}WDI.NfXv$V,LM$d{e[Zօ$vYݛ -b:SRјfgw-)Xz7'ќ8RI": Wtǎmz)M&8lAԹ&߮.sF!|^-/O6¢_r89E \F׫׫N5eҘvy=뙷3s䍸5RV;yo=TZU]!1mDQPKybPFɱ{hoWItǏf))cfغ$6R2JʤK^mJ ['mHd՝VJnVRmu9I"KUw ZY?5MoԆS_x)KZ{#ZboQDcs . "kQ kmB#=&?#ђLZ$'=ǃ&h-ʝ8JS5Ö`).d@8}*PR7(ԔB-:9\rX6;Юm56HD*ԽDN&I@ssM5:a\Wb۾+ܓɄc@Z^lO-c٢x(<x&l[Un->-q!dsÙ`ŔTQ2ͻ"꡸F0κʓ/qbʪ$vX]SpBx]Ii)(2waRKmѨ %RD)U7ί?F>d@oME$BAeP [l۟}RTjLe#T\ T2`,+>AW81xE)pA҇DqT(u- ) JZ5(eG sy`T\P^E"Q#g1Ft{}WRF+w~`-[tSi6ڼR<8^$L.~N>afcɮuzy%I5{I*ޑ<@Z+I0}{xz9!9Ib~rj*A x?;nQXZ`&2 ,Ą嘘^|Oz"1_Mҫ SWGa1,P6e!6n8ee?g04۠G-J`2ںJ p|je_,P6O6^qPn%$/s ɰ:^h%x2@0M=:5@ލ87T/;[xnS 拏&sNi6sI(}bNv-.PQY4>/XObject<<>>>>/Annots 1122 0 R>>endobj -1799 0 obj<>stream +1796 0 obj<>/XObject<<>>>>/Annots 1119 0 R>>endobj +1797 0 obj<>stream xW]o6}KS V,q<-֮@[lb@_hXKFRw.)يbC$2u9^IL3vN%dǧxfZ54W]TdӛE7\o#)ocy6)-ױČwh>Z :Zczw:Z,8<٫ h6$sQ;iVniJtYBÇW/7a87_DTN\.Ɋr+$@rm+V9F&RyKY9:HcsME*H / 5VU;2X%QH.`"]G$Zz&TA 9lbh{s8xW9&qH94^ɔ#UˊduPFW\rDQ9}|110K4B"eWlEa5+`E,U%۞7 tF[#*8׭$B@gTT:a`%*L4PˁHYs^TTe#Hg^KOgRrk/H]:9(wexyk ,ES<$Txl ;E1FH$f}: ZjN+`Mʢ^Ca)}Wͼmv\bF |\04؊e$Ctv9=+ b>Vvu;7`k>hgGώSP&A_~-X$EG?-S+JG*U6 ܗ7|ZY^ᕃDYC{Ὕu쾗y?NUs J (=ntĘǩ&™~DSӭ)N`LM4ClJ_T4| )~s3zbӔVp#h-rsa1CCua:Ͻ{mfsbwm&NHendstream endobj -1800 0 obj<>/XObject<<>>>>/Annots 1127 0 R>>endobj -1801 0 obj<>stream +1798 0 obj<>/XObject<<>>>>/Annots 1124 0 R>>endobj +1799 0 obj<>stream xVM6:@%[vOm6ihQ @@KD"oH:IIX|yo2_F9+*ګY:jɿ5~o%U׿u*P\5tofoVu {ni1q*5v٣]0Ǎew۫em+NfYӶ !h[L&IX -;IO`%L_F3J֦?L=;M|nydhx0qYP?CT=`nNrx3v!߹wt OMN Q+LNze;<)z~&N zvq,VtGBg5|{տPHendstream endobj -1802 0 obj<>/XObject<<>>>>>>endobj -1803 0 obj<>stream +1800 0 obj<>/XObject<<>>>>>>endobj +1801 0 obj<>stream xV[o6~ϯ8kbɗ8 ]0 @Z"]J[b}QFCdthJE}4L4g?ǯSTl"NjK/ϗG'(ѲD씖Px8e1p/ʺNZlixQU01n%10ɧ阃^O{ے(nfMu$hԭmC5%]z%‰Z7*ػoJ^d4F8UE+UQ+~گRxEWk,(\=k+[ZD!AR73Q3(4K魭wu7aayvSvi?Ȗ37IxEȧe[\ ЌŠ(ґO-HਹGo:\&o%m[)gXTew2Lx @G]v*R *@jbnSZɍҵO:PXOwmSi:N?~p&y6e;Lv(ɲkHH$UA [+ ɄP”zqdl$a[M~_\^ꜗ P˵A r҃_ )VX;D;2  r='=X#k_K+z?ݿ\O(AGqrѷXHk~EC [a8$CX[k>/XObject<<>>>>>>endobj -1805 0 obj<>stream +1802 0 obj<>/XObject<<>>>>>>endobj +1803 0 obj<>stream xWOH_1R81>Q!JN{M^wwMov$DZQ؝y͛σ) 'h@ :??#) QO4CyLӔf0i;D0Nl1KI)G?9=&k*j(km%9MNR!!a)Х%m(3MRk>7Gά8~iBЕ9 I%ƅ,#goD.e|s2/DKJePVoCVy4|M|t} \L9%}DNDީ\ҭяP(>:${;G?i/ 07}MΣ|p!_p"endstream endobj -1806 0 obj<>/XObject<<>>>>>>endobj -1807 0 obj<>stream +1804 0 obj<>/XObject<<>>>>>>endobj +1805 0 obj<>stream xTM0WL UganTGL6Nm&~ǘt= $f޼Sg0-I%Q y9UxyiՆ EI/5$YQ%oXm+ 0 %TOT+4lNJyޣ>GQ`w5p"4\; F Ե[%P7lgD|sBd J\Z0}FB\qoƥakNRIV:GcQx\;U)fK <0fpP]v;%/>r) uo >/XObject<<>>>>/Annots 1136 0 R>>endobj -1809 0 obj<>stream +1806 0 obj<>/XObject<<>>>>/Annots 1133 0 R>>endobj +1807 0 obj<>stream x}W]6|X(z. hI M BK+9JTI|%%O Cɜf7-7דY6Ó6fTrɖO*[ffx9ndhlM*bfX+D]mop-!S9ϗ QVs}inXˈѴ--f+fK"'կj;Zd[n;q&|P Cg.6i~(ldbZiC({OuHIJ>a<2<{ҞYwѓ9ʴ:O3z"B_tl @@ -4202,8 +4222,8 @@ X l `+GB\ ֱqg G]˅ ѢfG(;# ZqAe*yJ혖QtpĴg" A4J=%>9m`lıMPV;T02[M߯E6oҫlWnMqG+lhxF/ɵR ).0=Ғ_;4md׆Q[y"Fԏ(=Cq!q()p5kg  GeuxRM%Ӏ'Y0=Uicq'|ѿ}!6%}(_\h= ؎pM+xsa}h]Ldx]Gw;8%XեJ*ByivǴU8֢,aZwN=5\]>/XObject<<>>>>>>endobj -1811 0 obj<>stream +1808 0 obj<>/XObject<<>>>>>>endobj +1809 0 obj<>stream xWn7+TbYe)Ѓڀ&M@_#.\ݵܵ}( ̼yoɌ39],)O)]^_Liq}7h*b6Ya6>N4ѪD BVV8=9]8|bZk;+GDZ&we8&R8^"wү&R<8o"MZSB7)tTܓ*ZEʴvD]qmD1ɜw|IT)RqO T@7{H*X|Jcu"vNFsA+b-R}(HQ43ɕK[P@Tq(Fܡb {ՁO4@\߹6ZT]LVy(#,gRj|.`_Lg86 @@ -4217,30 +4237,30 @@ S >Qf$믝tm$(ۄ] VFFUtslo ~wapZqAk^RE-oQ ]Wi|{u$Xe|%OG]C0(MrM(tQ=| ab1lN# PAqGsfz€hk[Gzu9;WzW`⯙_q8#qIGnC2yluqm`F ,j-pa&&7Ъtq#ȏ"rCC"fu2Ff+Iw@ay6|mԑeOҳWAn~E\Ԉ+xWK#Wf6Ypޣ;sU񮣑eVH#Ym~,|~+4t=GQBbEt4O?s/j7f&ljQtִ K;mn͖#} `d-_ M3'-ZaSCr# H0Zykm|ӋQYs-H1$8\!֛﮻7%~]_r_axX~醾KQgWӏgby=Y^ŮrΧoW' Pendstream endobj -1812 0 obj<>/XObject<<>>>>>>endobj -1813 0 obj<>stream +1810 0 obj<>/XObject<<>>>>>>endobj +1811 0 obj<>stream xVn6}W Rhac]REeM*Iy3ڪ [̙3hBcLlJSʫq2ErN3=ůT8u0;ON?dG )+윲/N4^Z'$9Qm;?iٟ,^7#tV~Ъm&tzl`픣RiIP#ALI^:`ZEMyCBBxgҐYZ$3u Ok$sӻ,& 5[-+BR$ ^D} SV0w^6M#0Қ4捿kv_Vl>qBjtߦɜδ6T_'rݠ|4hMPLdF۩Jia%84r*P:zjע g; Pw6 +MtڛAǾjډ( F]!p¤Dք /fL$QPYL#ԩG?XaA -w0JC|O$~ZinIBڬiov>-)]}XPy-J7-i@'u͗5]ih*hzz%R@L ? #+o*xixܬ̥zAY7_A=krBmVɭD)u = `;E,ŬE)PJgtXdqIOm|;@ IҸ0 \xMW: ߰>hGeKQuxospXE\x0*zQN>&N~cÔݖs `Y>fkoRwH(0qCMgH`+DWRS!J 48ָw ԽB?mEZ^!o$`[/x$j'ZR)ckEXxRðk%t?ܨ5֑691ˠ$,Hth\9}Ӿuv(i7yw//ƟZ19evOendstream endobj -1814 0 obj<>/XObject<<>>>>>>endobj -1815 0 obj<>stream +1812 0 obj<>/XObject<<>>>>>>endobj +1813 0 obj<>stream xW[OH~WeAh>+$eKR%^Lg~sƆ`AngsgJ|MdFGsI:)~ ^Ss9Ǵ(1e~_ Ʉ4=Jg)-thh4ZjrW}.}-һZF^ˀ˛֚ enUIkpt;O`Te V͋[iqq{xuKZDȺg^MՑQU_t6OBצj]P3|CZU­Qz@ՏA%X!MAu TtY 9OԦR~/7w/EaġnC4Pnpm dԟ8:SY!IS^+aZdv_'fEk+y &" cVPLyX1e*Ȉ^< mkz2J7rUmMŰGa_6Ykŗ ^J] -W L(TXvr2?} =68#w:DQF9W8xaɰuG"8 TAP/byJv$fK ͇P-RgʓV3 늷Dz@JK?^6H삕u"nktr^y`G) gJ@Ah;1Mol5['K+4Y1$E:L^|&þp70 '2So__g*[ʙo?j1^r}8Yf\8!ظ__-.oK4b0M*O'4Hc|Ekx~PQzID:LZ["mQAA+yRs%Vh&/NUE$g6.:QZT7/˶+H 'L3ꈙ{ҦBؐIG'#g'˵qֈnF3:CS9HOHoc2ol[g{ziTI-JH@ZtS9rT c U n Lj-0 i.bwO }wDZP/^78(3]_OS@&لq&>:CMBDȼ=69w{ʐHX?Ԫ58pj hYrPmjʆ݌Xʹw4RZA1@pl(S!EIR493⑺ž/# Gf{&_OY94uzDgt}q9.>!>&L`pta{x=_;Eendstream endobj -1816 0 obj<>/XObject<<>>>>>>endobj -1817 0 obj<>stream +1814 0 obj<>/XObject<<>>>>>>endobj +1815 0 obj<>stream xV]OH}W"&_oRfZi%$4ۓΌܙIH]ZTAbߏs9~;Ft>Ɍ` ?s9#_Ld(,?LN?Mi4D҂x84?^UPFJ%C61XR*YHWo6R/d`lW$,݋&үC&(-lwzitCF~@%Փj,-6<ل*?ыL-Td3/\d@ɾT+Hr@%Z;ƥ4uF8b E[Ћt$"kmjAEZ*;dG> dx S#tgF"qHk{X:A别\#sв=.Χ@| :iJKY"F]CU_PկRľp~! #-*ȉ*.h@(`;'dP*4sxpIi w5[q4R&SbBc"76YQe\a{9k,EWㅭ&(]vLeJj D+mNn[ΆiuVUXd^Z$VBA@O\lC搀X/CjJW0XQ w-VBU h'QA;Qw&|T|9stWU1d V"3 .w[^{3n0Rv͞N^)73`p6θ@]h+DMlT]S+ycD}c!Ow J~yV rdxU 8}EamlS v띵ţNP_,}rzz:4?႟Oh6:9 Z}y[<ƙlC_f~+]dFendstream endobj -1818 0 obj<>/XObject<<>>>>>>endobj -1819 0 obj<>stream +1816 0 obj<>/XObject<<>>>>>>endobj +1817 0 obj<>stream x}Wo6 ` v$[tmd -QTIɎ#)Yv%XxɌN;9-(NN'tv>,|ysYI+]+%>d㧧trBw5t;NlN8=jj I*p"Vinh:>|}9477Ӓ+L[flOJRmMU72XT f,?l20IMwLijZK^îҍ[ieibB׹?'~BBgw}" ozhQ7dFLw#]Sr[*7xȴJ_;c2a!$l M!$B Eb*J|;(Ò5a_~qգQqz vC/`Ux c^ _-jǍsĻ(ɂP4v;}O?.{l-.ݾtn^&m+X<><}W'/dq1l`wN:endstream endobj -1820 0 obj<>/XObject<<>>>>/Annots 1141 0 R>>endobj -1821 0 obj<>stream +1818 0 obj<>/XObject<<>>>>/Annots 1138 0 R>>endobj +1819 0 obj<>stream xWnF}WLiQ%9:mk3 VRbB\Ҋgf^DY;3gF4ߐCM(.&I0l*MNk/FpL^`~<\ !OYP8Q8 D8bW N&o?DG'Wc CR2M)JDvs4hm<Ӧ>fnttOoF_ .xǣ01g(8 (Ү3mgxȦz)ELo vq'psxSt{!M\SY٢u"A(*s+[%lpPU2pt¡,*_eYkX;6yQZnR2*gr6W @@ -4267,299 +4287,301 @@ h3M-- `9jے4sW>ofvEVzZ@M˺.ߟl6 x>gm24k~*1_ lDW+/mxbtpτdLN,vz7Q;endstream endobj -1822 0 obj<>endobj -1823 0 obj<>endobj -1824 0 obj<>endobj -1825 0 obj<>endobj -1826 0 obj<>endobj -1827 0 obj<>endobj -1828 0 obj<>endobj -1829 0 obj<>endobj -1830 0 obj<>endobj -1831 0 obj<>endobj -1832 0 obj<>endobj -1833 0 obj<>endobj -1834 0 obj<>endobj -1835 0 obj<>endobj -1836 0 obj<>endobj -1837 0 obj<>endobj -1838 0 obj<>endobj -1839 0 obj<>endobj -1840 0 obj<>endobj -1841 0 obj<>endobj -1842 0 obj<>endobj -1843 0 obj<>endobj -1844 0 obj<>endobj -1845 0 obj<>endobj -1846 0 obj<>endobj -1847 0 obj<>endobj -1848 0 obj<>endobj -1849 0 obj<>endobj -1850 0 obj<>endobj -1851 0 obj<>endobj -1852 0 obj<>endobj -1853 0 obj<>endobj -1854 0 obj<>endobj -1855 0 obj<>endobj -1856 0 obj<>endobj -1857 0 obj<>endobj -1858 0 obj<>endobj -1859 0 obj<>endobj -1860 0 obj<>endobj -1861 0 obj<>endobj -1862 0 obj<>endobj -1863 0 obj<>endobj -1864 0 obj<>endobj -1865 0 obj<>endobj -1866 0 obj<>endobj -1867 0 obj<>endobj -1868 0 obj<>endobj -1869 0 obj<>endobj -1870 0 obj<>endobj -1871 0 obj<>endobj -1872 0 obj<>endobj -1873 0 obj<>endobj -1874 0 obj<>endobj -1875 0 obj<>endobj -1876 0 obj<>endobj -1877 0 obj<>endobj -1878 0 obj<>endobj -1879 0 obj<>endobj -1880 0 obj<>endobj -1881 0 obj<>endobj -1882 0 obj<>endobj -1883 0 obj<>endobj -1884 0 obj<>endobj -1885 0 obj<>endobj -1886 0 obj<>endobj -1887 0 obj<>endobj -1888 0 obj<>endobj -1889 0 obj<>endobj -1890 0 obj<>endobj -1891 0 obj<>endobj -1892 0 obj<>endobj -1893 0 obj<>endobj -1894 0 obj<>endobj -1895 0 obj<>endobj -1896 0 obj<>endobj -1897 0 obj<>endobj -1898 0 obj<>endobj -1899 0 obj<>endobj -1900 0 obj<>endobj -1901 0 obj<>endobj -1902 0 obj<>endobj -1903 0 obj<>endobj -1904 0 obj<>endobj -1905 0 obj<>endobj -1906 0 obj<>endobj -1907 0 obj<>endobj -1908 0 obj<>endobj -1909 0 obj<>endobj -1910 0 obj<>endobj -1911 0 obj<>endobj -1912 0 obj<>endobj -1913 0 obj<>endobj -1914 0 obj<>endobj -1915 0 obj<>endobj -1916 0 obj<>endobj -1917 0 obj<>endobj -1918 0 obj<>endobj -1919 0 obj<>endobj -1920 0 obj<>endobj -1921 0 obj<>endobj -1922 0 obj<>endobj -1923 0 obj<>endobj -1924 0 obj<>endobj -1925 0 obj<>endobj -1926 0 obj<>endobj -1927 0 obj<>endobj -1928 0 obj<>endobj -1929 0 obj<>endobj -1930 0 obj<>endobj -1931 0 obj<>endobj -1932 0 obj<>endobj -1933 0 obj<>endobj -1934 0 obj<>endobj -1935 0 obj<>endobj -1936 0 obj<>endobj -1937 0 obj<>endobj -1938 0 obj<>endobj -1939 0 obj<>endobj -1940 0 obj<>endobj -1941 0 obj<>endobj -1942 0 obj<>endobj -1943 0 obj<>endobj -1944 0 obj<>endobj -1945 0 obj<>endobj -1946 0 obj<>endobj -1947 0 obj<>endobj -1948 0 obj<>endobj -1949 0 obj<>endobj -1950 0 obj<>endobj -1951 0 obj<>endobj -1952 0 obj<>endobj -1953 0 obj<>endobj -1954 0 obj<>endobj -1955 0 obj<>endobj -1956 0 obj<>endobj -1957 0 obj<>endobj -1958 0 obj<>endobj -1959 0 obj<>endobj -1960 0 obj<>endobj -1961 0 obj<>endobj -1962 0 obj<>endobj -1963 0 obj<>endobj -1964 0 obj<>endobj -1965 0 obj<>endobj -1966 0 obj<>endobj -1967 0 obj<>endobj -1968 0 obj<>endobj -1969 0 obj<>endobj -1970 0 obj<>endobj -1971 0 obj<>endobj -1972 0 obj<>endobj -1973 0 obj<>endobj -1974 0 obj<>endobj -1975 0 obj<>endobj -1976 0 obj<>endobj -1977 0 obj<>endobj -1978 0 obj<>endobj -1979 0 obj<>endobj -1980 0 obj<>endobj -1981 0 obj<>endobj -1982 0 obj<>endobj -1983 0 obj<>endobj -1984 0 obj<>endobj -1985 0 obj<>endobj -1986 0 obj<>endobj -1987 0 obj<>endobj -1988 0 obj<>endobj -1989 0 obj<>endobj -1990 0 obj<>endobj -1991 0 obj<>endobj -1992 0 obj<>endobj -1993 0 obj<>endobj -1994 0 obj<>endobj -1995 0 obj<>endobj -1996 0 obj<>endobj -1997 0 obj<>endobj -1998 0 obj<>endobj -1999 0 obj<>endobj -2000 0 obj<>endobj -2001 0 obj<>endobj -2002 0 obj<>endobj -2003 0 obj<>endobj -2004 0 obj<>endobj -2005 0 obj<>endobj -2006 0 obj<>endobj -2007 0 obj<>endobj -2008 0 obj<>endobj -2009 0 obj<>endobj -2010 0 obj<>endobj -2011 0 obj<>endobj -2012 0 obj<>endobj -2013 0 obj<>endobj -2014 0 obj<>endobj -2015 0 obj<>endobj -2016 0 obj<>endobj -2017 0 obj<>endobj -2018 0 obj<>endobj -2019 0 obj<>endobj -2020 0 obj<>endobj -2021 0 obj<>endobj -2022 0 obj<>endobj -2023 0 obj<>endobj -2024 0 obj<>endobj -2025 0 obj<>endobj -2026 0 obj<>endobj -2027 0 obj<>endobj -2028 0 obj<>endobj -2029 0 obj<>endobj -2030 0 obj<>endobj -2031 0 obj<>endobj -2032 0 obj<>endobj -2033 0 obj<>endobj -2034 0 obj<>endobj -2035 0 obj<>endobj -2036 0 obj<>endobj -2037 0 obj<>endobj -2038 0 obj<>endobj -2039 0 obj<>endobj -2040 0 obj<>endobj -2041 0 obj<>endobj -2042 0 obj<>endobj -2043 0 obj<>endobj -2044 0 obj<>endobj -2045 0 obj<>endobj -2046 0 obj<>endobj -2047 0 obj<>endobj -2048 0 obj<>endobj -2049 0 obj<>endobj -2050 0 obj<>endobj -2051 0 obj<>endobj -2052 0 obj<>endobj -2053 0 obj<>endobj -2054 0 obj<>endobj -2055 0 obj<>endobj -2056 0 obj<>endobj -2057 0 obj<>endobj -2058 0 obj<>endobj -2059 0 obj<>endobj -2060 0 obj<>endobj -2061 0 obj<>endobj -2062 0 obj<>endobj -2063 0 obj<>endobj -2064 0 obj<>endobj -2065 0 obj<>endobj -2066 0 obj<>endobj -2067 0 obj<>endobj -2068 0 obj<>endobj -2069 0 obj<>endobj -2070 0 obj<>endobj -2071 0 obj<>endobj -2072 0 obj<>endobj -2073 0 obj<>endobj -2074 0 obj<>endobj -2075 0 obj<>endobj -2076 0 obj<>endobj -2077 0 obj<>endobj -2078 0 obj<>endobj -2079 0 obj<>endobj -2080 0 obj<>endobj -2081 0 obj<>endobj -2082 0 obj<>endobj -2083 0 obj<>endobj -2084 0 obj<>endobj -2085 0 obj<>endobj -2086 0 obj<>endobj -2087 0 obj<>endobj -2088 0 obj<>endobj -2089 0 obj<>endobj -2090 0 obj<>endobj -2091 0 obj<>endobj -2092 0 obj<>endobj -2093 0 obj<>endobj -2094 0 obj<>endobj -2095 0 obj<>endobj -2096 0 obj<>endobj -2097 0 obj<>endobj -2098 0 obj<>endobj -2099 0 obj<>endobj -2100 0 obj<>endobj -2101 0 obj<>endobj -2102 0 obj<>endobj -2103 0 obj<>endobj -2104 0 obj<>endobj -2105 0 obj<>endobj -2106 0 obj<>endobj -2107 0 obj<>endobj -2108 0 obj<>endobj -2109 0 obj<>endobj -2110 0 obj<>endobj -2111 0 obj<>endobj -2112 0 obj<>endobj -2113 0 obj<>endobj -2114 0 obj<>1<>8<>9<>13<>14<>16<>20<>24<>36<>37<>38<>40<>42<>59<>62<>64<>66<>67<>70<>80<>85<>88<>90<>101<>118<>131<>140<>143<>144<>148<>151<>153<>154<>156<>159<>163<>168<>170<>]>>>>endobj +1820 0 obj<>endobj +1821 0 obj<>endobj +1822 0 obj<>endobj +1823 0 obj<>endobj +1824 0 obj<>endobj +1825 0 obj<>endobj +1826 0 obj<>endobj +1827 0 obj<>endobj +1828 0 obj<>endobj +1829 0 obj<>endobj +1830 0 obj<>endobj +1831 0 obj<>endobj +1832 0 obj<>endobj +1833 0 obj<>endobj +1834 0 obj<>endobj +1835 0 obj<>endobj +1836 0 obj<>endobj +1837 0 obj<>endobj +1838 0 obj<>endobj +1839 0 obj<>endobj +1840 0 obj<>endobj +1841 0 obj<>endobj +1842 0 obj<>endobj +1843 0 obj<>endobj +1844 0 obj<>endobj +1845 0 obj<>endobj +1846 0 obj<>endobj +1847 0 obj<>endobj +1848 0 obj<>endobj +1849 0 obj<>endobj +1850 0 obj<>endobj +1851 0 obj<>endobj +1852 0 obj<>endobj +1853 0 obj<>endobj +1854 0 obj<>endobj +1855 0 obj<>endobj +1856 0 obj<>endobj +1857 0 obj<>endobj +1858 0 obj<>endobj +1859 0 obj<>endobj +1860 0 obj<>endobj +1861 0 obj<>endobj +1862 0 obj<>endobj +1863 0 obj<>endobj +1864 0 obj<>endobj +1865 0 obj<>endobj +1866 0 obj<>endobj +1867 0 obj<>endobj +1868 0 obj<>endobj +1869 0 obj<>endobj +1870 0 obj<>endobj +1871 0 obj<>endobj +1872 0 obj<>endobj +1873 0 obj<>endobj +1874 0 obj<>endobj +1875 0 obj<>endobj +1876 0 obj<>endobj +1877 0 obj<>endobj +1878 0 obj<>endobj +1879 0 obj<>endobj +1880 0 obj<>endobj +1881 0 obj<>endobj +1882 0 obj<>endobj +1883 0 obj<>endobj +1884 0 obj<>endobj +1885 0 obj<>endobj +1886 0 obj<>endobj +1887 0 obj<>endobj +1888 0 obj<>endobj +1889 0 obj<>endobj +1890 0 obj<>endobj +1891 0 obj<>endobj +1892 0 obj<>endobj +1893 0 obj<>endobj +1894 0 obj<>endobj +1895 0 obj<>endobj +1896 0 obj<>endobj +1897 0 obj<>endobj +1898 0 obj<>endobj +1899 0 obj<>endobj +1900 0 obj<>endobj +1901 0 obj<>endobj +1902 0 obj<>endobj +1903 0 obj<>endobj +1904 0 obj<>endobj +1905 0 obj<>endobj +1906 0 obj<>endobj +1907 0 obj<>endobj +1908 0 obj<>endobj +1909 0 obj<>endobj +1910 0 obj<>endobj +1911 0 obj<>endobj +1912 0 obj<>endobj +1913 0 obj<>endobj +1914 0 obj<>endobj +1915 0 obj<>endobj +1916 0 obj<>endobj +1917 0 obj<>endobj +1918 0 obj<>endobj +1919 0 obj<>endobj +1920 0 obj<>endobj +1921 0 obj<>endobj +1922 0 obj<>endobj +1923 0 obj<>endobj +1924 0 obj<>endobj +1925 0 obj<>endobj +1926 0 obj<>endobj +1927 0 obj<>endobj +1928 0 obj<>endobj +1929 0 obj<>endobj +1930 0 obj<>endobj +1931 0 obj<>endobj +1932 0 obj<>endobj +1933 0 obj<>endobj +1934 0 obj<>endobj +1935 0 obj<>endobj +1936 0 obj<>endobj +1937 0 obj<>endobj +1938 0 obj<>endobj +1939 0 obj<>endobj +1940 0 obj<>endobj +1941 0 obj<>endobj +1942 0 obj<>endobj +1943 0 obj<>endobj +1944 0 obj<>endobj +1945 0 obj<>endobj +1946 0 obj<>endobj +1947 0 obj<>endobj +1948 0 obj<>endobj +1949 0 obj<>endobj +1950 0 obj<>endobj +1951 0 obj<>endobj +1952 0 obj<>endobj +1953 0 obj<>endobj +1954 0 obj<>endobj +1955 0 obj<>endobj +1956 0 obj<>endobj +1957 0 obj<>endobj +1958 0 obj<>endobj +1959 0 obj<>endobj +1960 0 obj<>endobj +1961 0 obj<>endobj +1962 0 obj<>endobj +1963 0 obj<>endobj +1964 0 obj<>endobj +1965 0 obj<>endobj +1966 0 obj<>endobj +1967 0 obj<>endobj +1968 0 obj<>endobj +1969 0 obj<>endobj +1970 0 obj<>endobj +1971 0 obj<>endobj +1972 0 obj<>endobj +1973 0 obj<>endobj +1974 0 obj<>endobj +1975 0 obj<>endobj +1976 0 obj<>endobj +1977 0 obj<>endobj +1978 0 obj<>endobj +1979 0 obj<>endobj +1980 0 obj<>endobj +1981 0 obj<>endobj +1982 0 obj<>endobj +1983 0 obj<>endobj +1984 0 obj<>endobj +1985 0 obj<>endobj +1986 0 obj<>endobj +1987 0 obj<>endobj +1988 0 obj<>endobj +1989 0 obj<>endobj +1990 0 obj<>endobj +1991 0 obj<>endobj +1992 0 obj<>endobj +1993 0 obj<>endobj +1994 0 obj<>endobj +1995 0 obj<>endobj +1996 0 obj<>endobj +1997 0 obj<>endobj +1998 0 obj<>endobj +1999 0 obj<>endobj +2000 0 obj<>endobj +2001 0 obj<>endobj +2002 0 obj<>endobj +2003 0 obj<>endobj +2004 0 obj<>endobj +2005 0 obj<>endobj +2006 0 obj<>endobj +2007 0 obj<>endobj +2008 0 obj<>endobj +2009 0 obj<>endobj +2010 0 obj<>endobj +2011 0 obj<>endobj +2012 0 obj<>endobj +2013 0 obj<>endobj +2014 0 obj<>endobj +2015 0 obj<>endobj +2016 0 obj<>endobj +2017 0 obj<>endobj +2018 0 obj<>endobj +2019 0 obj<>endobj +2020 0 obj<>endobj +2021 0 obj<>endobj +2022 0 obj<>endobj +2023 0 obj<>endobj +2024 0 obj<>endobj +2025 0 obj<>endobj +2026 0 obj<>endobj +2027 0 obj<>endobj +2028 0 obj<>endobj +2029 0 obj<>endobj +2030 0 obj<>endobj +2031 0 obj<>endobj +2032 0 obj<>endobj +2033 0 obj<>endobj +2034 0 obj<>endobj +2035 0 obj<>endobj +2036 0 obj<>endobj +2037 0 obj<>endobj +2038 0 obj<>endobj +2039 0 obj<>endobj +2040 0 obj<>endobj +2041 0 obj<>endobj +2042 0 obj<>endobj +2043 0 obj<>endobj +2044 0 obj<>endobj +2045 0 obj<>endobj +2046 0 obj<>endobj +2047 0 obj<>endobj +2048 0 obj<>endobj +2049 0 obj<>endobj +2050 0 obj<>endobj +2051 0 obj<>endobj +2052 0 obj<>endobj +2053 0 obj<>endobj +2054 0 obj<>endobj +2055 0 obj<>endobj +2056 0 obj<>endobj +2057 0 obj<>endobj +2058 0 obj<>endobj +2059 0 obj<>endobj +2060 0 obj<>endobj +2061 0 obj<>endobj +2062 0 obj<>endobj +2063 0 obj<>endobj +2064 0 obj<>endobj +2065 0 obj<>endobj +2066 0 obj<>endobj +2067 0 obj<>endobj +2068 0 obj<>endobj +2069 0 obj<>endobj +2070 0 obj<>endobj +2071 0 obj<>endobj +2072 0 obj<>endobj +2073 0 obj<>endobj +2074 0 obj<>endobj +2075 0 obj<>endobj +2076 0 obj<>endobj +2077 0 obj<>endobj +2078 0 obj<>endobj +2079 0 obj<>endobj +2080 0 obj<>endobj +2081 0 obj<>endobj +2082 0 obj<>endobj +2083 0 obj<>endobj +2084 0 obj<>endobj +2085 0 obj<>endobj +2086 0 obj<>endobj +2087 0 obj<>endobj +2088 0 obj<>endobj +2089 0 obj<>endobj +2090 0 obj<>endobj +2091 0 obj<>endobj +2092 0 obj<>endobj +2093 0 obj<>endobj +2094 0 obj<>endobj +2095 0 obj<>endobj +2096 0 obj<>endobj +2097 0 obj<>endobj +2098 0 obj<>endobj +2099 0 obj<>endobj +2100 0 obj<>endobj +2101 0 obj<>endobj +2102 0 obj<>endobj +2103 0 obj<>endobj +2104 0 obj<>endobj +2105 0 obj<>endobj +2106 0 obj<>endobj +2107 0 obj<>endobj +2108 0 obj<>endobj +2109 0 obj<>endobj +2110 0 obj<>endobj +2111 0 obj<>endobj +2112 0 obj<>endobj +2113 0 obj<>endobj +2114 0 obj<>1<>8<>9<>13<>14<>16<>20<>25<>37<>38<>40<>42<>46<>57<>60<>62<>64<>65<>68<>76<>81<>82<>85<>96<>113<>126<>133<>142<>144<>147<>149<>150<>152<>156<>159<>163<>168<>170<>]>>>>endobj xref 0 2115 0000000000 65535 f @@ -4603,7 +4625,7 @@ xref 0000006079 00000 n 0000006182 00000 n 0000006285 00000 n -0000006387 00000 n +0000006388 00000 n 0000006490 00000 n 0000006593 00000 n 0000006696 00000 n @@ -4632,21 +4654,21 @@ xref 0000009266 00000 n 0000009369 00000 n 0000009472 00000 n -0000009574 00000 n -0000009676 00000 n -0000009778 00000 n +0000009575 00000 n +0000009677 00000 n +0000009779 00000 n 0000009881 00000 n 0000009984 00000 n 0000010087 00000 n 0000010190 00000 n -0000010292 00000 n -0000010394 00000 n -0000010497 00000 n -0000010600 00000 n -0000010703 00000 n -0000010806 00000 n -0000010909 00000 n -0000011012 00000 n +0000010293 00000 n +0000010395 00000 n +0000010498 00000 n +0000010601 00000 n +0000010704 00000 n +0000010807 00000 n +0000010910 00000 n +0000011013 00000 n 0000011115 00000 n 0000011218 00000 n 0000011321 00000 n @@ -4655,10 +4677,10 @@ xref 0000011630 00000 n 0000011733 00000 n 0000011836 00000 n -0000011938 00000 n -0000012041 00000 n -0000012144 00000 n -0000012247 00000 n +0000011939 00000 n +0000012042 00000 n +0000012145 00000 n +0000012248 00000 n 0000012350 00000 n 0000012453 00000 n 0000012556 00000 n @@ -4671,2014 +4693,2014 @@ xref 0000013486 00000 n 0000013590 00000 n 0000013694 00000 n -0000013798 00000 n -0000013902 00000 n -0000014006 00000 n +0000013797 00000 n +0000013901 00000 n +0000014005 00000 n 0000014109 00000 n 0000014213 00000 n 0000014317 00000 n -0000014420 00000 n -0000014523 00000 n -0000014626 00000 n -0000014730 00000 n -0000014834 00000 n -0000014938 00000 n +0000014421 00000 n +0000014525 00000 n +0000014628 00000 n +0000014732 00000 n +0000014836 00000 n +0000014939 00000 n 0000015042 00000 n -0000015146 00000 n -0000015250 00000 n -0000015354 00000 n -0000015458 00000 n -0000015562 00000 n -0000015666 00000 n -0000015770 00000 n -0000015874 00000 n -0000015978 00000 n -0000016082 00000 n -0000016186 00000 n -0000016290 00000 n -0000016394 00000 n -0000016498 00000 n -0000016601 00000 n -0000016705 00000 n -0000016809 00000 n -0000016913 00000 n -0000017017 00000 n -0000017121 00000 n -0000017225 00000 n -0000017329 00000 n -0000017432 00000 n -0000017534 00000 n -0000017887 00000 n -0000017990 00000 n -0000018094 00000 n -0000018198 00000 n -0000018302 00000 n -0000018405 00000 n -0000018509 00000 n -0000018613 00000 n -0000018716 00000 n -0000018820 00000 n -0000018924 00000 n -0000019028 00000 n -0000019132 00000 n -0000019236 00000 n -0000019340 00000 n -0000019444 00000 n -0000019548 00000 n -0000019652 00000 n -0000019756 00000 n -0000019860 00000 n -0000019964 00000 n -0000020068 00000 n -0000020172 00000 n -0000020276 00000 n -0000020380 00000 n -0000020484 00000 n -0000020588 00000 n -0000020692 00000 n -0000020796 00000 n -0000020900 00000 n -0000021004 00000 n -0000021107 00000 n -0000021211 00000 n -0000021315 00000 n -0000021419 00000 n -0000021523 00000 n -0000021627 00000 n -0000021731 00000 n -0000021835 00000 n -0000021939 00000 n -0000022042 00000 n -0000022146 00000 n -0000022249 00000 n -0000022351 00000 n -0000022453 00000 n -0000022822 00000 n -0000022925 00000 n -0000023029 00000 n -0000023133 00000 n -0000023237 00000 n -0000023341 00000 n -0000023445 00000 n -0000023549 00000 n -0000023653 00000 n -0000023757 00000 n -0000023861 00000 n -0000023965 00000 n -0000024069 00000 n -0000024173 00000 n -0000024277 00000 n -0000024380 00000 n -0000024484 00000 n -0000024588 00000 n -0000024692 00000 n -0000024796 00000 n -0000024900 00000 n -0000025004 00000 n -0000025108 00000 n -0000025212 00000 n -0000025316 00000 n -0000025420 00000 n -0000025524 00000 n -0000025628 00000 n -0000025731 00000 n -0000025835 00000 n -0000025939 00000 n -0000026043 00000 n -0000026147 00000 n -0000026251 00000 n -0000026355 00000 n -0000026459 00000 n -0000026563 00000 n -0000026666 00000 n -0000026769 00000 n -0000026873 00000 n -0000026977 00000 n -0000027081 00000 n -0000027184 00000 n -0000027286 00000 n -0000027388 00000 n -0000027757 00000 n -0000027860 00000 n -0000027964 00000 n -0000028068 00000 n -0000028172 00000 n -0000028276 00000 n -0000028379 00000 n -0000028483 00000 n -0000028587 00000 n -0000028691 00000 n -0000028795 00000 n -0000028899 00000 n -0000029003 00000 n -0000029107 00000 n -0000029210 00000 n -0000029314 00000 n -0000029418 00000 n -0000029522 00000 n -0000029626 00000 n -0000029730 00000 n -0000029834 00000 n -0000029937 00000 n -0000030041 00000 n -0000030145 00000 n -0000030248 00000 n -0000030351 00000 n -0000030455 00000 n -0000030559 00000 n -0000030663 00000 n -0000030767 00000 n -0000030871 00000 n -0000030975 00000 n -0000031078 00000 n -0000031182 00000 n -0000031286 00000 n -0000031390 00000 n -0000031494 00000 n -0000031598 00000 n -0000031702 00000 n -0000031806 00000 n -0000031909 00000 n -0000032011 00000 n -0000032113 00000 n -0000032466 00000 n -0000032569 00000 n -0000032673 00000 n -0000032777 00000 n -0000032881 00000 n -0000032985 00000 n -0000033088 00000 n -0000033192 00000 n -0000033296 00000 n -0000033400 00000 n -0000033504 00000 n -0000033608 00000 n -0000033712 00000 n -0000033816 00000 n -0000033920 00000 n -0000034024 00000 n -0000034127 00000 n -0000034231 00000 n -0000034335 00000 n -0000034439 00000 n -0000034543 00000 n -0000034647 00000 n -0000034751 00000 n -0000034854 00000 n -0000034958 00000 n -0000035062 00000 n -0000035166 00000 n -0000035270 00000 n -0000035374 00000 n -0000035478 00000 n -0000035582 00000 n -0000035686 00000 n -0000035790 00000 n -0000035894 00000 n -0000035998 00000 n -0000036102 00000 n -0000036206 00000 n -0000036310 00000 n -0000036414 00000 n -0000036735 00000 n -0000036788 00000 n -0000036875 00000 n -0000036929 00000 n -0000037015 00000 n +0000015145 00000 n +0000015249 00000 n +0000015353 00000 n +0000015457 00000 n +0000015561 00000 n +0000015665 00000 n +0000015769 00000 n +0000015873 00000 n +0000015977 00000 n +0000016081 00000 n +0000016185 00000 n +0000016289 00000 n +0000016393 00000 n +0000016496 00000 n +0000016600 00000 n +0000016704 00000 n +0000016808 00000 n +0000016912 00000 n +0000017016 00000 n +0000017120 00000 n +0000017224 00000 n +0000017327 00000 n +0000017429 00000 n +0000017774 00000 n +0000017877 00000 n +0000017980 00000 n +0000018084 00000 n +0000018188 00000 n +0000018292 00000 n +0000018395 00000 n +0000018499 00000 n +0000018603 00000 n +0000018707 00000 n +0000018811 00000 n +0000018915 00000 n +0000019019 00000 n +0000019123 00000 n +0000019227 00000 n +0000019331 00000 n +0000019435 00000 n +0000019539 00000 n +0000019643 00000 n +0000019747 00000 n +0000019851 00000 n +0000019955 00000 n +0000020059 00000 n +0000020163 00000 n +0000020267 00000 n +0000020371 00000 n +0000020475 00000 n +0000020579 00000 n +0000020683 00000 n +0000020786 00000 n +0000020890 00000 n +0000020994 00000 n +0000021098 00000 n +0000021202 00000 n +0000021306 00000 n +0000021410 00000 n +0000021514 00000 n +0000021618 00000 n +0000021721 00000 n +0000021825 00000 n +0000021929 00000 n +0000022033 00000 n +0000022136 00000 n +0000022238 00000 n +0000022340 00000 n +0000022709 00000 n +0000022812 00000 n +0000022916 00000 n +0000023020 00000 n +0000023124 00000 n +0000023228 00000 n +0000023332 00000 n +0000023436 00000 n +0000023540 00000 n +0000023644 00000 n +0000023748 00000 n +0000023852 00000 n +0000023956 00000 n +0000024059 00000 n +0000024163 00000 n +0000024267 00000 n +0000024371 00000 n +0000024475 00000 n +0000024579 00000 n +0000024683 00000 n +0000024787 00000 n +0000024891 00000 n +0000024995 00000 n +0000025099 00000 n +0000025203 00000 n +0000025306 00000 n +0000025410 00000 n +0000025514 00000 n +0000025618 00000 n +0000025722 00000 n +0000025826 00000 n +0000025930 00000 n +0000026034 00000 n +0000026138 00000 n +0000026242 00000 n +0000026346 00000 n +0000026450 00000 n +0000026554 00000 n +0000026657 00000 n +0000026761 00000 n +0000026865 00000 n +0000026968 00000 n +0000027071 00000 n +0000027173 00000 n +0000027275 00000 n +0000027644 00000 n +0000027747 00000 n +0000027851 00000 n +0000027955 00000 n +0000028059 00000 n +0000028163 00000 n +0000028267 00000 n +0000028370 00000 n +0000028474 00000 n +0000028578 00000 n +0000028682 00000 n +0000028786 00000 n +0000028890 00000 n +0000028994 00000 n +0000029097 00000 n +0000029201 00000 n +0000029305 00000 n +0000029408 00000 n +0000029511 00000 n +0000029615 00000 n +0000029719 00000 n +0000029823 00000 n +0000029927 00000 n +0000030031 00000 n +0000030135 00000 n +0000030239 00000 n +0000030343 00000 n +0000030447 00000 n +0000030551 00000 n +0000030654 00000 n +0000030758 00000 n +0000030862 00000 n +0000030966 00000 n +0000031070 00000 n +0000031174 00000 n +0000031278 00000 n +0000031381 00000 n +0000031485 00000 n +0000031589 00000 n +0000031693 00000 n +0000031796 00000 n +0000031898 00000 n +0000032000 00000 n +0000032353 00000 n +0000032456 00000 n +0000032560 00000 n +0000032664 00000 n +0000032768 00000 n +0000032872 00000 n +0000032976 00000 n +0000033080 00000 n +0000033184 00000 n +0000033288 00000 n +0000033391 00000 n +0000033495 00000 n +0000033599 00000 n +0000033703 00000 n +0000033807 00000 n +0000033911 00000 n +0000034015 00000 n +0000034119 00000 n +0000034223 00000 n +0000034327 00000 n +0000034430 00000 n +0000034534 00000 n +0000034638 00000 n +0000034742 00000 n +0000034846 00000 n +0000034950 00000 n +0000035054 00000 n +0000035157 00000 n +0000035261 00000 n +0000035365 00000 n +0000035469 00000 n +0000035573 00000 n +0000035677 00000 n +0000035781 00000 n +0000035885 00000 n +0000035989 00000 n +0000036093 00000 n +0000036197 00000 n +0000036301 00000 n +0000036405 00000 n +0000036509 00000 n +0000036613 00000 n +0000036717 00000 n 0000037070 00000 n -0000037157 00000 n -0000037224 00000 n -0000037310 00000 n -0000037413 00000 n -0000037517 00000 n -0000037621 00000 n -0000037725 00000 n -0000037829 00000 n -0000037933 00000 n -0000038037 00000 n -0000038141 00000 n -0000038245 00000 n -0000038349 00000 n -0000038453 00000 n -0000038557 00000 n -0000038661 00000 n -0000038765 00000 n -0000038869 00000 n -0000038973 00000 n -0000039077 00000 n -0000039181 00000 n -0000039285 00000 n -0000039389 00000 n -0000039493 00000 n -0000039597 00000 n -0000039701 00000 n -0000039805 00000 n -0000039908 00000 n -0000040012 00000 n -0000040116 00000 n -0000040220 00000 n -0000040324 00000 n -0000040428 00000 n -0000040532 00000 n -0000040635 00000 n -0000040737 00000 n -0000040839 00000 n -0000041160 00000 n -0000041264 00000 n -0000041368 00000 n -0000041472 00000 n -0000041576 00000 n -0000041680 00000 n -0000041784 00000 n -0000041888 00000 n -0000041992 00000 n -0000042096 00000 n -0000042200 00000 n -0000042304 00000 n -0000042408 00000 n -0000042512 00000 n -0000042616 00000 n -0000042720 00000 n -0000042824 00000 n -0000042928 00000 n -0000043032 00000 n -0000043136 00000 n -0000043240 00000 n -0000043344 00000 n -0000043448 00000 n -0000043552 00000 n -0000043656 00000 n -0000043758 00000 n -0000043862 00000 n -0000043966 00000 n -0000044070 00000 n -0000044174 00000 n -0000044278 00000 n -0000044382 00000 n -0000044486 00000 n -0000044590 00000 n -0000044694 00000 n -0000044798 00000 n -0000044902 00000 n -0000045006 00000 n -0000045110 00000 n -0000045214 00000 n -0000045318 00000 n -0000045422 00000 n -0000045526 00000 n -0000045630 00000 n -0000045734 00000 n -0000045838 00000 n -0000045942 00000 n -0000046046 00000 n -0000046150 00000 n -0000046254 00000 n -0000046358 00000 n -0000046461 00000 n -0000046563 00000 n -0000046665 00000 n -0000047106 00000 n -0000047210 00000 n -0000047314 00000 n -0000047418 00000 n -0000047522 00000 n -0000047626 00000 n -0000047730 00000 n -0000047834 00000 n -0000047938 00000 n -0000048042 00000 n -0000048146 00000 n -0000048250 00000 n -0000048354 00000 n -0000048458 00000 n -0000048562 00000 n -0000048666 00000 n -0000048770 00000 n -0000048874 00000 n -0000048978 00000 n -0000049082 00000 n -0000049186 00000 n -0000049290 00000 n -0000049394 00000 n -0000049498 00000 n -0000049602 00000 n -0000049706 00000 n -0000049810 00000 n -0000049914 00000 n -0000050018 00000 n -0000050122 00000 n -0000050226 00000 n -0000050330 00000 n -0000050434 00000 n -0000050538 00000 n -0000050642 00000 n -0000050746 00000 n -0000050850 00000 n -0000050954 00000 n -0000051058 00000 n -0000051162 00000 n -0000051266 00000 n -0000051370 00000 n -0000051474 00000 n -0000051578 00000 n -0000051682 00000 n -0000051786 00000 n -0000051890 00000 n -0000051994 00000 n -0000052098 00000 n -0000052201 00000 n -0000052303 00000 n -0000052405 00000 n -0000052830 00000 n -0000052934 00000 n -0000053038 00000 n -0000053142 00000 n -0000053246 00000 n -0000053350 00000 n -0000053454 00000 n -0000053557 00000 n -0000053661 00000 n -0000053765 00000 n -0000053869 00000 n -0000053973 00000 n -0000054077 00000 n -0000054181 00000 n -0000054285 00000 n -0000054389 00000 n -0000054493 00000 n -0000054597 00000 n -0000054701 00000 n -0000054805 00000 n -0000054909 00000 n -0000055013 00000 n -0000055117 00000 n -0000055221 00000 n -0000055325 00000 n -0000055429 00000 n -0000055533 00000 n -0000055637 00000 n -0000055741 00000 n -0000055845 00000 n -0000055949 00000 n -0000056053 00000 n -0000056157 00000 n -0000056261 00000 n -0000056365 00000 n -0000056469 00000 n -0000056573 00000 n -0000056878 00000 n -0000056981 00000 n -0000057085 00000 n -0000057189 00000 n -0000057293 00000 n -0000057397 00000 n -0000057501 00000 n -0000057605 00000 n -0000057709 00000 n -0000057813 00000 n -0000057917 00000 n -0000058021 00000 n -0000058124 00000 n -0000058228 00000 n -0000058332 00000 n -0000058436 00000 n -0000058540 00000 n -0000058644 00000 n -0000058748 00000 n -0000058851 00000 n -0000058955 00000 n -0000059059 00000 n -0000059163 00000 n -0000059267 00000 n -0000059371 00000 n -0000059475 00000 n -0000059579 00000 n -0000059683 00000 n -0000059787 00000 n -0000059891 00000 n -0000059995 00000 n -0000060099 00000 n -0000060203 00000 n -0000060307 00000 n -0000060411 00000 n -0000060515 00000 n -0000060619 00000 n -0000060723 00000 n -0000060827 00000 n -0000060931 00000 n -0000061035 00000 n -0000061139 00000 n -0000061242 00000 n -0000061344 00000 n -0000061446 00000 n -0000061815 00000 n -0000061919 00000 n -0000061944 00000 n -0000061993 00000 n -0000062080 00000 n -0000062105 00000 n -0000062161 00000 n -0000062248 00000 n -0000062317 00000 n -0000062404 00000 n -0000062455 00000 n -0000062542 00000 n -0000062627 00000 n -0000062714 00000 n -0000062770 00000 n -0000062857 00000 n -0000062907 00000 n -0000062994 00000 n -0000063046 00000 n -0000063132 00000 n -0000063205 00000 n -0000063261 00000 n -0000063348 00000 n -0000063396 00000 n -0000063482 00000 n -0000063530 00000 n -0000063617 00000 n -0000063658 00000 n -0000063699 00000 n -0000063786 00000 n -0000063830 00000 n -0000063917 00000 n -0000063962 00000 n -0000064049 00000 n -0000064093 00000 n -0000064180 00000 n -0000064224 00000 n -0000064311 00000 n -0000064353 00000 n -0000064440 00000 n -0000064488 00000 n -0000064575 00000 n -0000064648 00000 n -0000064696 00000 n -0000064781 00000 n -0000064806 00000 n -0000064859 00000 n -0000064943 00000 n -0000064968 00000 n -0000065071 00000 n -0000065175 00000 n -0000065279 00000 n -0000065383 00000 n -0000065487 00000 n -0000065590 00000 n -0000065693 00000 n -0000065797 00000 n -0000065901 00000 n -0000066005 00000 n -0000066109 00000 n -0000066213 00000 n -0000066317 00000 n -0000066421 00000 n -0000066525 00000 n -0000066629 00000 n -0000066733 00000 n -0000066837 00000 n -0000066941 00000 n -0000067045 00000 n -0000067149 00000 n -0000067252 00000 n -0000067356 00000 n -0000067460 00000 n -0000067564 00000 n -0000067668 00000 n -0000067772 00000 n -0000067876 00000 n -0000067980 00000 n -0000068084 00000 n -0000068188 00000 n -0000068291 00000 n -0000068395 00000 n -0000068499 00000 n -0000068603 00000 n -0000068707 00000 n -0000068811 00000 n -0000068915 00000 n -0000069019 00000 n -0000069123 00000 n -0000069227 00000 n -0000069330 00000 n -0000069434 00000 n -0000069537 00000 n -0000069906 00000 n -0000069954 00000 n -0000070041 00000 n -0000070066 00000 n -0000070114 00000 n -0000070201 00000 n -0000070246 00000 n -0000070332 00000 n -0000070375 00000 n -0000070461 00000 n -0000070502 00000 n -0000070588 00000 n -0000070637 00000 n -0000070723 00000 n -0000070769 00000 n -0000070855 00000 n -0000070900 00000 n -0000070986 00000 n -0000071038 00000 n -0000071124 00000 n -0000071174 00000 n -0000071260 00000 n -0000071306 00000 n -0000071392 00000 n -0000071435 00000 n -0000071521 00000 n -0000071565 00000 n -0000071651 00000 n -0000071694 00000 n -0000071780 00000 n -0000071825 00000 n -0000071911 00000 n -0000071949 00000 n -0000072035 00000 n -0000072077 00000 n -0000072163 00000 n -0000072206 00000 n -0000072292 00000 n -0000072330 00000 n -0000072416 00000 n -0000072458 00000 n -0000072544 00000 n -0000072588 00000 n -0000072674 00000 n -0000072721 00000 n -0000072807 00000 n -0000072855 00000 n -0000072942 00000 n -0000073135 00000 n -0000073184 00000 n -0000073270 00000 n -0000073295 00000 n -0000073342 00000 n -0000073429 00000 n -0000073454 00000 n -0000073569 00000 n -0000073656 00000 n -0000073681 00000 n -0000073763 00000 n -0000073850 00000 n -0000073935 00000 n -0000074022 00000 n -0000074077 00000 n -0000074164 00000 n -0000074220 00000 n -0000074307 00000 n -0000074356 00000 n -0000074404 00000 n -0000074491 00000 n -0000074565 00000 n -0000074652 00000 n -0000074720 00000 n -0000074807 00000 n -0000074861 00000 n -0000074948 00000 n -0000075016 00000 n -0000075103 00000 n -0000075177 00000 n -0000075264 00000 n -0000075312 00000 n -0000075399 00000 n -0000075456 00000 n -0000075543 00000 n -0000075624 00000 n -0000075679 00000 n -0000075766 00000 n -0000075847 00000 n -0000075934 00000 n -0000075967 00000 n -0000076020 00000 n -0000076107 00000 n -0000076132 00000 n -0000076180 00000 n -0000076267 00000 n -0000076309 00000 n -0000076396 00000 n -0000076439 00000 n -0000076526 00000 n -0000076576 00000 n -0000076663 00000 n -0000076711 00000 n -0000076798 00000 n -0000076855 00000 n -0000076898 00000 n -0000076985 00000 n -0000077039 00000 n -0000077126 00000 n -0000077171 00000 n -0000077258 00000 n -0000077315 00000 n -0000077401 00000 n -0000077497 00000 n -0000077582 00000 n -0000077639 00000 n +0000037123 00000 n +0000037210 00000 n +0000037264 00000 n +0000037350 00000 n +0000037405 00000 n +0000037492 00000 n +0000037559 00000 n +0000037645 00000 n +0000037748 00000 n +0000037852 00000 n +0000037956 00000 n +0000038060 00000 n +0000038164 00000 n +0000038268 00000 n +0000038372 00000 n +0000038476 00000 n +0000038580 00000 n +0000038684 00000 n +0000038788 00000 n +0000038892 00000 n +0000038996 00000 n +0000039100 00000 n +0000039204 00000 n +0000039308 00000 n +0000039412 00000 n +0000039516 00000 n +0000039620 00000 n +0000039724 00000 n +0000039828 00000 n +0000039932 00000 n +0000040036 00000 n +0000040140 00000 n +0000040244 00000 n +0000040348 00000 n +0000040451 00000 n +0000040555 00000 n +0000040659 00000 n +0000040763 00000 n +0000040867 00000 n +0000040970 00000 n +0000041072 00000 n +0000041174 00000 n +0000041495 00000 n +0000041599 00000 n +0000041703 00000 n +0000041807 00000 n +0000041911 00000 n +0000042015 00000 n +0000042119 00000 n +0000042223 00000 n +0000042327 00000 n +0000042431 00000 n +0000042535 00000 n +0000042639 00000 n +0000042743 00000 n +0000042847 00000 n +0000042951 00000 n +0000043055 00000 n +0000043159 00000 n +0000043263 00000 n +0000043367 00000 n +0000043471 00000 n +0000043575 00000 n +0000043679 00000 n +0000043783 00000 n +0000043887 00000 n +0000043991 00000 n +0000044095 00000 n +0000044197 00000 n +0000044301 00000 n +0000044405 00000 n +0000044509 00000 n +0000044613 00000 n +0000044717 00000 n +0000044821 00000 n +0000044925 00000 n +0000045029 00000 n +0000045133 00000 n +0000045237 00000 n +0000045341 00000 n +0000045445 00000 n +0000045549 00000 n +0000045653 00000 n +0000045757 00000 n +0000045861 00000 n +0000045965 00000 n +0000046069 00000 n +0000046173 00000 n +0000046277 00000 n +0000046381 00000 n +0000046485 00000 n +0000046589 00000 n +0000046693 00000 n +0000046796 00000 n +0000046898 00000 n +0000047000 00000 n +0000047441 00000 n +0000047545 00000 n +0000047649 00000 n +0000047753 00000 n +0000047857 00000 n +0000047961 00000 n +0000048065 00000 n +0000048169 00000 n +0000048273 00000 n +0000048377 00000 n +0000048481 00000 n +0000048585 00000 n +0000048689 00000 n +0000048793 00000 n +0000048897 00000 n +0000049001 00000 n +0000049105 00000 n +0000049209 00000 n +0000049313 00000 n +0000049417 00000 n +0000049521 00000 n +0000049625 00000 n +0000049729 00000 n +0000049833 00000 n +0000049937 00000 n +0000050041 00000 n +0000050145 00000 n +0000050249 00000 n +0000050353 00000 n +0000050457 00000 n +0000050561 00000 n +0000050665 00000 n +0000050769 00000 n +0000050873 00000 n +0000050977 00000 n +0000051081 00000 n +0000051185 00000 n +0000051289 00000 n +0000051393 00000 n +0000051497 00000 n +0000051601 00000 n +0000051705 00000 n +0000051808 00000 n +0000051912 00000 n +0000052016 00000 n +0000052120 00000 n +0000052224 00000 n +0000052328 00000 n +0000052432 00000 n +0000052535 00000 n +0000052637 00000 n +0000052739 00000 n +0000053164 00000 n +0000053268 00000 n +0000053372 00000 n +0000053476 00000 n +0000053580 00000 n +0000053684 00000 n +0000053788 00000 n +0000053892 00000 n +0000053996 00000 n +0000054100 00000 n +0000054204 00000 n +0000054308 00000 n +0000054412 00000 n +0000054516 00000 n +0000054620 00000 n +0000054724 00000 n +0000054828 00000 n +0000054932 00000 n +0000055036 00000 n +0000055140 00000 n +0000055244 00000 n +0000055348 00000 n +0000055452 00000 n +0000055556 00000 n +0000055660 00000 n +0000055764 00000 n +0000055868 00000 n +0000055972 00000 n +0000056076 00000 n +0000056180 00000 n +0000056284 00000 n +0000056388 00000 n +0000056653 00000 n +0000056756 00000 n +0000056860 00000 n +0000056964 00000 n +0000057068 00000 n +0000057172 00000 n +0000057276 00000 n +0000057380 00000 n +0000057484 00000 n +0000057588 00000 n +0000057692 00000 n +0000057796 00000 n +0000057899 00000 n +0000058003 00000 n +0000058107 00000 n +0000058211 00000 n +0000058315 00000 n +0000058419 00000 n +0000058523 00000 n +0000058627 00000 n +0000058730 00000 n +0000058834 00000 n +0000058938 00000 n +0000059042 00000 n +0000059146 00000 n +0000059250 00000 n +0000059354 00000 n +0000059458 00000 n +0000059562 00000 n +0000059666 00000 n +0000059770 00000 n +0000059874 00000 n +0000059978 00000 n +0000060082 00000 n +0000060186 00000 n +0000060290 00000 n +0000060394 00000 n +0000060498 00000 n +0000060602 00000 n +0000060706 00000 n +0000060810 00000 n +0000060914 00000 n +0000061017 00000 n +0000061119 00000 n +0000061221 00000 n +0000061590 00000 n +0000061694 00000 n +0000061798 00000 n +0000061831 00000 n +0000061880 00000 n +0000061967 00000 n +0000061992 00000 n +0000062048 00000 n +0000062135 00000 n +0000062204 00000 n +0000062291 00000 n +0000062342 00000 n +0000062429 00000 n +0000062514 00000 n +0000062601 00000 n +0000062657 00000 n +0000062744 00000 n +0000062794 00000 n +0000062881 00000 n +0000062933 00000 n +0000063019 00000 n +0000063092 00000 n +0000063148 00000 n +0000063235 00000 n +0000063283 00000 n +0000063369 00000 n +0000063417 00000 n +0000063504 00000 n +0000063545 00000 n +0000063586 00000 n +0000063673 00000 n +0000063717 00000 n +0000063804 00000 n +0000063849 00000 n +0000063936 00000 n +0000063980 00000 n +0000064067 00000 n +0000064111 00000 n +0000064198 00000 n +0000064240 00000 n +0000064327 00000 n +0000064375 00000 n +0000064462 00000 n +0000064535 00000 n +0000064583 00000 n +0000064668 00000 n +0000064693 00000 n +0000064746 00000 n +0000064830 00000 n +0000064855 00000 n +0000064958 00000 n +0000065062 00000 n +0000065166 00000 n +0000065270 00000 n +0000065374 00000 n +0000065477 00000 n +0000065581 00000 n +0000065685 00000 n +0000065789 00000 n +0000065893 00000 n +0000065997 00000 n +0000066101 00000 n +0000066204 00000 n +0000066308 00000 n +0000066412 00000 n +0000066516 00000 n +0000066620 00000 n +0000066724 00000 n +0000066828 00000 n +0000066932 00000 n +0000067036 00000 n +0000067140 00000 n +0000067244 00000 n +0000067348 00000 n +0000067451 00000 n +0000067555 00000 n +0000067659 00000 n +0000067763 00000 n +0000067867 00000 n +0000067971 00000 n +0000068075 00000 n +0000068179 00000 n +0000068283 00000 n +0000068387 00000 n +0000068490 00000 n +0000068594 00000 n +0000068698 00000 n +0000068802 00000 n +0000068906 00000 n +0000069010 00000 n +0000069114 00000 n +0000069218 00000 n +0000069322 00000 n +0000069425 00000 n +0000069526 00000 n +0000069628 00000 n +0000070013 00000 n +0000070117 00000 n +0000070142 00000 n +0000070189 00000 n +0000070275 00000 n +0000070322 00000 n +0000070408 00000 n +0000070441 00000 n +0000070486 00000 n +0000070573 00000 n +0000070618 00000 n +0000070704 00000 n +0000070737 00000 n +0000070785 00000 n +0000070872 00000 n +0000070897 00000 n +0000070945 00000 n +0000071032 00000 n +0000071077 00000 n +0000071163 00000 n +0000071206 00000 n +0000071292 00000 n +0000071333 00000 n +0000071419 00000 n +0000071468 00000 n +0000071554 00000 n +0000071600 00000 n +0000071686 00000 n +0000071731 00000 n +0000071817 00000 n +0000071869 00000 n +0000071955 00000 n +0000072005 00000 n +0000072091 00000 n +0000072137 00000 n +0000072223 00000 n +0000072266 00000 n +0000072352 00000 n +0000072396 00000 n +0000072482 00000 n +0000072525 00000 n +0000072611 00000 n +0000072656 00000 n +0000072742 00000 n +0000072780 00000 n +0000072866 00000 n +0000072908 00000 n +0000072994 00000 n +0000073037 00000 n +0000073123 00000 n +0000073161 00000 n +0000073247 00000 n +0000073289 00000 n +0000073375 00000 n +0000073419 00000 n +0000073505 00000 n +0000073552 00000 n +0000073638 00000 n +0000073686 00000 n +0000073771 00000 n +0000073964 00000 n +0000074013 00000 n +0000074099 00000 n +0000074124 00000 n +0000074171 00000 n +0000074258 00000 n +0000074283 00000 n +0000074338 00000 n +0000074425 00000 n +0000074481 00000 n +0000074568 00000 n +0000074601 00000 n +0000074649 00000 n +0000074736 00000 n +0000074810 00000 n +0000074897 00000 n +0000074965 00000 n +0000075052 00000 n +0000075106 00000 n +0000075193 00000 n +0000075261 00000 n +0000075348 00000 n +0000075422 00000 n +0000075509 00000 n +0000075557 00000 n +0000075644 00000 n +0000075701 00000 n +0000075788 00000 n +0000075869 00000 n +0000075924 00000 n +0000076011 00000 n +0000076092 00000 n +0000076179 00000 n +0000076212 00000 n +0000076265 00000 n +0000076352 00000 n +0000076377 00000 n +0000076425 00000 n +0000076512 00000 n +0000076554 00000 n +0000076641 00000 n +0000076684 00000 n +0000076771 00000 n +0000076821 00000 n +0000076908 00000 n +0000076956 00000 n +0000077043 00000 n +0000077100 00000 n +0000077143 00000 n +0000077230 00000 n +0000077284 00000 n +0000077371 00000 n +0000077416 00000 n +0000077503 00000 n +0000077560 00000 n +0000077646 00000 n 0000077742 00000 n -0000077846 00000 n -0000077950 00000 n -0000078054 00000 n -0000078158 00000 n -0000078262 00000 n -0000078366 00000 n -0000078470 00000 n -0000078574 00000 n -0000078678 00000 n -0000078782 00000 n -0000078886 00000 n -0000078990 00000 n -0000079094 00000 n -0000079198 00000 n -0000079302 00000 n -0000079406 00000 n -0000079510 00000 n -0000079614 00000 n -0000079717 00000 n -0000079821 00000 n -0000079925 00000 n -0000080029 00000 n -0000080133 00000 n -0000080237 00000 n -0000080341 00000 n -0000080445 00000 n -0000080549 00000 n -0000080653 00000 n -0000080756 00000 n -0000080860 00000 n -0000080964 00000 n -0000081068 00000 n -0000081171 00000 n -0000081275 00000 n -0000081379 00000 n -0000081482 00000 n -0000081586 00000 n -0000081690 00000 n -0000081794 00000 n -0000081898 00000 n -0000082001 00000 n -0000082103 00000 n -0000082205 00000 n -0000082574 00000 n -0000082678 00000 n -0000082782 00000 n -0000082886 00000 n -0000082990 00000 n -0000083094 00000 n -0000083198 00000 n -0000083302 00000 n -0000083406 00000 n -0000083510 00000 n -0000083614 00000 n -0000083718 00000 n -0000083822 00000 n -0000083926 00000 n -0000084030 00000 n -0000084134 00000 n -0000084237 00000 n -0000084341 00000 n -0000084445 00000 n -0000084549 00000 n -0000084653 00000 n -0000084757 00000 n -0000084861 00000 n -0000084965 00000 n -0000085069 00000 n -0000085172 00000 n -0000085276 00000 n -0000085380 00000 n -0000085484 00000 n -0000085588 00000 n -0000085692 00000 n -0000085796 00000 n -0000085900 00000 n -0000086004 00000 n -0000086108 00000 n -0000086212 00000 n -0000086316 00000 n -0000086420 00000 n -0000086524 00000 n -0000086628 00000 n -0000086732 00000 n -0000086836 00000 n -0000086940 00000 n -0000087043 00000 n -0000087147 00000 n -0000087251 00000 n -0000087355 00000 n -0000087459 00000 n -0000087563 00000 n -0000087666 00000 n -0000087768 00000 n -0000087870 00000 n -0000088295 00000 n -0000088399 00000 n -0000088503 00000 n -0000088607 00000 n -0000088711 00000 n -0000088814 00000 n -0000088918 00000 n -0000089022 00000 n -0000089126 00000 n -0000089230 00000 n -0000089334 00000 n -0000089438 00000 n -0000089542 00000 n -0000089646 00000 n -0000089749 00000 n -0000089852 00000 n -0000089956 00000 n -0000090060 00000 n -0000090164 00000 n -0000090268 00000 n -0000090372 00000 n -0000090476 00000 n -0000090580 00000 n -0000090684 00000 n -0000090788 00000 n -0000090892 00000 n -0000090995 00000 n -0000091099 00000 n -0000091203 00000 n -0000091307 00000 n -0000091411 00000 n -0000091515 00000 n -0000091619 00000 n -0000091723 00000 n -0000091826 00000 n -0000091930 00000 n -0000092034 00000 n -0000092138 00000 n -0000092242 00000 n -0000092346 00000 n -0000092450 00000 n -0000092553 00000 n -0000092657 00000 n -0000092761 00000 n -0000093122 00000 n -0000093170 00000 n -0000093257 00000 n -0000093304 00000 n -0000093390 00000 n -0000093437 00000 n -0000093523 00000 n -0000093564 00000 n -0000093609 00000 n -0000093696 00000 n -0000093741 00000 n -0000093827 00000 n -0000093860 00000 n -0000093906 00000 n -0000093992 00000 n -0000094038 00000 n -0000094121 00000 n -0000094154 00000 n -0000094198 00000 n -0000094285 00000 n -0000094336 00000 n -0000094423 00000 n -0000094472 00000 n -0000094559 00000 n -0000094607 00000 n -0000094693 00000 n +0000077827 00000 n +0000077884 00000 n +0000077987 00000 n +0000078091 00000 n +0000078195 00000 n +0000078299 00000 n +0000078403 00000 n +0000078507 00000 n +0000078611 00000 n +0000078715 00000 n +0000078819 00000 n +0000078923 00000 n +0000079027 00000 n +0000079131 00000 n +0000079235 00000 n +0000079338 00000 n +0000079442 00000 n +0000079546 00000 n +0000079650 00000 n +0000079754 00000 n +0000079858 00000 n +0000079962 00000 n +0000080066 00000 n +0000080170 00000 n +0000080274 00000 n +0000080377 00000 n +0000080480 00000 n +0000080584 00000 n +0000080688 00000 n +0000080792 00000 n +0000080895 00000 n +0000080999 00000 n +0000081103 00000 n +0000081207 00000 n +0000081311 00000 n +0000081415 00000 n +0000081519 00000 n +0000081623 00000 n +0000081727 00000 n +0000081831 00000 n +0000081935 00000 n +0000082039 00000 n +0000082143 00000 n +0000082246 00000 n +0000082348 00000 n +0000082450 00000 n +0000082819 00000 n +0000082923 00000 n +0000083027 00000 n +0000083131 00000 n +0000083235 00000 n +0000083339 00000 n +0000083443 00000 n +0000083547 00000 n +0000083650 00000 n +0000083754 00000 n +0000083858 00000 n +0000083962 00000 n +0000084066 00000 n +0000084170 00000 n +0000084274 00000 n +0000084378 00000 n +0000084482 00000 n +0000084585 00000 n +0000084689 00000 n +0000084793 00000 n +0000084897 00000 n +0000085001 00000 n +0000085105 00000 n +0000085209 00000 n +0000085313 00000 n +0000085417 00000 n +0000085521 00000 n +0000085625 00000 n +0000085729 00000 n +0000085833 00000 n +0000085937 00000 n +0000086041 00000 n +0000086145 00000 n +0000086249 00000 n +0000086353 00000 n +0000086456 00000 n +0000086560 00000 n +0000086664 00000 n +0000086768 00000 n +0000086872 00000 n +0000086976 00000 n +0000087080 00000 n +0000087184 00000 n +0000087288 00000 n +0000087392 00000 n +0000087496 00000 n +0000087600 00000 n +0000087703 00000 n +0000087807 00000 n +0000087910 00000 n +0000088012 00000 n +0000088114 00000 n +0000088539 00000 n +0000088643 00000 n +0000088747 00000 n +0000088851 00000 n +0000088955 00000 n +0000089059 00000 n +0000089163 00000 n +0000089267 00000 n +0000089371 00000 n +0000089474 00000 n +0000089578 00000 n +0000089682 00000 n +0000089785 00000 n +0000089889 00000 n +0000089993 00000 n +0000090097 00000 n +0000090201 00000 n +0000090305 00000 n +0000090409 00000 n +0000090513 00000 n +0000090617 00000 n +0000090720 00000 n +0000090824 00000 n +0000090928 00000 n +0000091032 00000 n +0000091136 00000 n +0000091240 00000 n +0000091344 00000 n +0000091447 00000 n +0000091551 00000 n +0000091655 00000 n +0000091912 00000 n +0000092027 00000 n +0000092114 00000 n +0000092196 00000 n +0000092281 00000 n +0000092314 00000 n +0000092399 00000 n +0000092486 00000 n +0000092511 00000 n +0000092557 00000 n +0000092643 00000 n +0000092689 00000 n +0000092772 00000 n +0000092805 00000 n +0000092849 00000 n +0000092936 00000 n +0000092987 00000 n +0000093074 00000 n +0000093123 00000 n +0000093210 00000 n +0000093258 00000 n +0000093344 00000 n +0000093393 00000 n +0000093446 00000 n +0000093533 00000 n +0000093583 00000 n +0000093670 00000 n +0000093703 00000 n +0000093766 00000 n +0000093853 00000 n +0000093911 00000 n +0000093998 00000 n +0000094092 00000 n +0000094178 00000 n +0000094219 00000 n +0000094262 00000 n +0000094348 00000 n +0000094396 00000 n +0000094483 00000 n +0000094524 00000 n +0000094611 00000 n +0000094655 00000 n 0000094742 00000 n -0000094797 00000 n -0000094883 00000 n -0000094908 00000 n -0000094961 00000 n -0000095048 00000 n -0000095098 00000 n -0000095185 00000 n -0000095218 00000 n -0000095337 00000 n -0000095423 00000 n -0000095466 00000 n -0000095553 00000 n -0000095596 00000 n -0000095683 00000 n -0000095724 00000 n -0000095787 00000 n -0000095874 00000 n -0000095932 00000 n -0000096019 00000 n -0000096113 00000 n -0000096199 00000 n -0000096240 00000 n -0000096283 00000 n -0000096369 00000 n -0000096417 00000 n -0000096504 00000 n -0000096545 00000 n -0000096632 00000 n -0000096676 00000 n -0000096763 00000 n -0000096807 00000 n -0000096893 00000 n -0000096950 00000 n -0000096996 00000 n -0000097083 00000 n -0000097108 00000 n -0000097157 00000 n -0000097244 00000 n -0000097298 00000 n -0000097385 00000 n -0000097436 00000 n -0000097523 00000 n -0000097577 00000 n -0000097664 00000 n -0000097714 00000 n -0000097799 00000 n -0000097856 00000 n -0000097906 00000 n -0000097993 00000 n -0000098057 00000 n -0000098144 00000 n -0000098177 00000 n -0000098254 00000 n -0000098340 00000 n -0000098430 00000 n -0000098516 00000 n +0000094786 00000 n +0000094872 00000 n +0000094929 00000 n +0000094975 00000 n +0000095062 00000 n +0000095087 00000 n +0000095136 00000 n +0000095223 00000 n +0000095277 00000 n +0000095364 00000 n +0000095415 00000 n +0000095502 00000 n +0000095556 00000 n +0000095643 00000 n +0000095693 00000 n +0000095778 00000 n +0000095835 00000 n +0000095885 00000 n +0000095972 00000 n +0000096036 00000 n +0000096123 00000 n +0000096156 00000 n +0000096233 00000 n +0000096319 00000 n +0000096409 00000 n +0000096495 00000 n +0000096584 00000 n +0000096670 00000 n +0000096711 00000 n +0000096782 00000 n +0000096868 00000 n +0000097000 00000 n +0000097086 00000 n +0000097160 00000 n +0000097246 00000 n +0000097343 00000 n +0000097429 00000 n +0000097478 00000 n +0000097543 00000 n +0000097630 00000 n +0000097655 00000 n +0000097720 00000 n +0000097807 00000 n +0000097832 00000 n +0000097894 00000 n +0000097981 00000 n +0000098006 00000 n +0000098055 00000 n +0000098142 00000 n +0000098167 00000 n +0000098215 00000 n +0000098302 00000 n +0000098352 00000 n +0000098436 00000 n +0000098480 00000 n +0000098564 00000 n 0000098605 00000 n -0000098691 00000 n -0000098732 00000 n -0000098803 00000 n -0000098889 00000 n -0000099021 00000 n -0000099107 00000 n -0000099181 00000 n -0000099267 00000 n -0000099364 00000 n -0000099450 00000 n -0000099499 00000 n -0000099564 00000 n -0000099651 00000 n -0000099676 00000 n -0000099741 00000 n -0000099828 00000 n -0000099853 00000 n -0000099915 00000 n -0000100002 00000 n +0000098649 00000 n +0000098735 00000 n +0000098785 00000 n +0000098871 00000 n +0000098921 00000 n +0000099007 00000 n +0000099056 00000 n +0000099142 00000 n +0000099189 00000 n +0000099275 00000 n +0000099332 00000 n +0000099451 00000 n +0000099538 00000 n +0000099582 00000 n +0000099671 00000 n +0000099715 00000 n +0000099804 00000 n +0000099849 00000 n +0000099939 00000 n 0000100027 00000 n -0000100076 00000 n -0000100164 00000 n -0000100191 00000 n -0000100240 00000 n -0000100329 00000 n -0000100380 00000 n -0000100466 00000 n -0000100511 00000 n -0000100597 00000 n -0000100642 00000 n -0000100687 00000 n -0000100775 00000 n -0000100826 00000 n -0000100914 00000 n -0000100965 00000 n -0000101053 00000 n -0000101103 00000 n -0000101191 00000 n -0000101239 00000 n -0000101327 00000 n -0000101390 00000 n -0000101480 00000 n -0000101568 00000 n -0000101632 00000 n -0000101720 00000 n -0000101756 00000 n -0000101818 00000 n -0000101906 00000 n -0000101933 00000 n -0000101989 00000 n -0000102078 00000 n -0000102105 00000 n -0000102209 00000 n -0000102314 00000 n -0000102419 00000 n -0000102524 00000 n -0000102629 00000 n -0000102734 00000 n -0000102839 00000 n -0000102943 00000 n -0000103048 00000 n -0000103153 00000 n -0000103258 00000 n -0000103363 00000 n -0000103468 00000 n -0000103573 00000 n -0000103678 00000 n -0000103783 00000 n -0000103888 00000 n -0000103993 00000 n -0000104098 00000 n -0000104203 00000 n -0000104308 00000 n -0000104413 00000 n -0000104517 00000 n -0000104622 00000 n -0000104727 00000 n -0000104832 00000 n -0000104937 00000 n -0000105042 00000 n -0000105147 00000 n -0000105252 00000 n -0000105357 00000 n -0000105462 00000 n -0000105566 00000 n -0000105671 00000 n -0000105776 00000 n -0000105881 00000 n -0000105986 00000 n -0000106091 00000 n -0000106196 00000 n -0000106300 00000 n -0000106405 00000 n -0000106510 00000 n -0000106615 00000 n -0000106720 00000 n -0000106824 00000 n -0000106927 00000 n -0000107030 00000 n -0000107471 00000 n -0000107576 00000 n -0000107681 00000 n -0000107786 00000 n -0000107891 00000 n -0000107996 00000 n -0000108101 00000 n -0000108206 00000 n -0000108311 00000 n -0000108401 00000 n -0000108457 00000 n -0000108545 00000 n -0000108614 00000 n -0000108702 00000 n -0000108778 00000 n -0000108867 00000 n -0000108938 00000 n -0000109026 00000 n -0000109106 00000 n -0000109195 00000 n -0000109258 00000 n -0000109341 00000 n -0000109429 00000 n -0000109505 00000 n -0000109594 00000 n -0000109668 00000 n -0000109757 00000 n -0000109836 00000 n -0000109925 00000 n -0000109979 00000 n -0000110028 00000 n -0000110117 00000 n -0000110144 00000 n -0000110193 00000 n -0000110282 00000 n -0000110309 00000 n -0000110359 00000 n -0000110448 00000 n -0000110512 00000 n -0000110601 00000 n -0000110665 00000 n -0000110754 00000 n -0000110809 00000 n -0000110898 00000 n -0000110952 00000 n -0000111021 00000 n -0000111109 00000 n -0000111165 00000 n -0000111254 00000 n -0000111290 00000 n -0000111339 00000 n -0000111428 00000 n -0000111493 00000 n -0000111582 00000 n -0000111638 00000 n -0000111727 00000 n -0000111775 00000 n -0000111864 00000 n +0000100091 00000 n +0000100179 00000 n +0000100215 00000 n +0000100277 00000 n +0000100365 00000 n +0000100392 00000 n +0000100448 00000 n +0000100537 00000 n +0000100564 00000 n +0000100668 00000 n +0000100773 00000 n +0000100878 00000 n +0000100983 00000 n +0000101088 00000 n +0000101193 00000 n +0000101298 00000 n +0000101403 00000 n +0000101508 00000 n +0000101613 00000 n +0000101718 00000 n +0000101822 00000 n +0000101927 00000 n +0000102032 00000 n +0000102137 00000 n +0000102242 00000 n +0000102347 00000 n +0000102452 00000 n +0000102556 00000 n +0000102661 00000 n +0000102766 00000 n +0000102871 00000 n +0000102976 00000 n +0000103081 00000 n +0000103186 00000 n +0000103291 00000 n +0000103396 00000 n +0000103501 00000 n +0000103606 00000 n +0000103711 00000 n +0000103816 00000 n +0000103921 00000 n +0000104026 00000 n +0000104130 00000 n +0000104235 00000 n +0000104340 00000 n +0000104445 00000 n +0000104550 00000 n +0000104655 00000 n +0000104760 00000 n +0000104865 00000 n +0000104970 00000 n +0000105075 00000 n +0000105179 00000 n +0000105283 00000 n +0000105386 00000 n +0000105489 00000 n +0000105930 00000 n +0000106035 00000 n +0000106140 00000 n +0000106245 00000 n +0000106349 00000 n +0000106454 00000 n +0000106559 00000 n +0000106664 00000 n +0000106769 00000 n +0000106874 00000 n +0000106979 00000 n +0000107084 00000 n +0000107189 00000 n +0000107294 00000 n +0000107399 00000 n +0000107504 00000 n +0000107609 00000 n +0000107714 00000 n +0000107819 00000 n +0000107924 00000 n +0000108113 00000 n +0000108169 00000 n +0000108257 00000 n +0000108326 00000 n +0000108414 00000 n +0000108490 00000 n +0000108579 00000 n +0000108650 00000 n +0000108738 00000 n +0000108818 00000 n +0000108907 00000 n +0000108970 00000 n +0000109053 00000 n +0000109141 00000 n +0000109217 00000 n +0000109306 00000 n +0000109380 00000 n +0000109469 00000 n +0000109548 00000 n +0000109637 00000 n +0000109691 00000 n +0000109740 00000 n +0000109829 00000 n +0000109856 00000 n +0000109905 00000 n +0000109994 00000 n +0000110021 00000 n +0000110071 00000 n +0000110160 00000 n +0000110224 00000 n +0000110313 00000 n +0000110377 00000 n +0000110466 00000 n +0000110521 00000 n +0000110610 00000 n +0000110664 00000 n +0000110733 00000 n +0000110821 00000 n +0000110877 00000 n +0000110966 00000 n +0000111002 00000 n +0000111051 00000 n +0000111140 00000 n +0000111205 00000 n +0000111294 00000 n +0000111350 00000 n +0000111439 00000 n +0000111487 00000 n +0000111576 00000 n +0000111630 00000 n +0000111685 00000 n +0000111774 00000 n +0000111829 00000 n 0000111918 00000 n -0000111973 00000 n -0000112062 00000 n -0000112117 00000 n -0000112206 00000 n -0000112242 00000 n -0000112278 00000 n -0000112314 00000 n -0000117919 00000 n -0000117964 00000 n -0000118009 00000 n -0000118054 00000 n -0000118099 00000 n -0000118144 00000 n -0000118189 00000 n -0000118234 00000 n -0000118279 00000 n -0000118324 00000 n -0000118369 00000 n -0000118414 00000 n -0000118459 00000 n -0000118504 00000 n -0000118549 00000 n -0000118594 00000 n -0000118639 00000 n -0000118684 00000 n -0000118729 00000 n -0000118774 00000 n -0000118819 00000 n -0000118864 00000 n -0000118909 00000 n -0000118954 00000 n -0000118999 00000 n -0000119044 00000 n -0000119089 00000 n -0000119134 00000 n -0000119179 00000 n -0000119224 00000 n -0000119269 00000 n -0000119314 00000 n -0000119359 00000 n -0000119404 00000 n -0000119449 00000 n -0000119494 00000 n -0000119539 00000 n -0000119584 00000 n -0000119629 00000 n -0000119674 00000 n -0000119719 00000 n -0000119764 00000 n -0000119809 00000 n -0000119854 00000 n -0000119899 00000 n -0000119944 00000 n -0000119989 00000 n -0000120034 00000 n -0000120079 00000 n -0000120124 00000 n -0000120169 00000 n -0000120214 00000 n -0000120259 00000 n -0000120304 00000 n -0000120349 00000 n -0000120394 00000 n -0000120439 00000 n -0000120484 00000 n -0000120529 00000 n -0000120574 00000 n -0000120619 00000 n -0000120664 00000 n -0000120709 00000 n -0000120754 00000 n -0000120799 00000 n -0000120844 00000 n -0000120889 00000 n -0000120934 00000 n -0000120979 00000 n -0000121024 00000 n -0000121069 00000 n -0000121114 00000 n -0000121159 00000 n -0000121204 00000 n -0000121249 00000 n -0000121294 00000 n -0000121339 00000 n -0000121384 00000 n -0000121429 00000 n -0000121474 00000 n -0000121519 00000 n -0000121564 00000 n -0000121609 00000 n -0000121654 00000 n -0000121699 00000 n -0000121744 00000 n -0000121789 00000 n -0000121834 00000 n -0000121879 00000 n -0000121924 00000 n -0000121969 00000 n -0000122014 00000 n -0000122059 00000 n -0000122104 00000 n -0000122149 00000 n -0000122194 00000 n -0000122239 00000 n -0000122284 00000 n -0000122329 00000 n -0000122374 00000 n -0000122419 00000 n -0000122464 00000 n -0000122509 00000 n -0000122554 00000 n -0000122599 00000 n -0000122644 00000 n -0000122689 00000 n -0000122734 00000 n -0000122779 00000 n -0000122824 00000 n -0000122869 00000 n -0000122914 00000 n -0000122959 00000 n -0000123004 00000 n -0000123049 00000 n -0000123094 00000 n -0000123139 00000 n -0000123184 00000 n -0000123229 00000 n -0000123274 00000 n -0000123319 00000 n -0000123364 00000 n -0000123409 00000 n -0000123454 00000 n -0000123499 00000 n -0000123544 00000 n -0000123589 00000 n -0000123634 00000 n -0000123679 00000 n -0000123724 00000 n -0000123769 00000 n -0000123814 00000 n -0000123859 00000 n -0000123904 00000 n -0000123949 00000 n -0000123994 00000 n -0000124039 00000 n -0000124084 00000 n -0000124129 00000 n -0000124174 00000 n -0000124219 00000 n -0000124264 00000 n -0000124309 00000 n -0000124354 00000 n -0000124399 00000 n -0000124444 00000 n -0000124489 00000 n -0000124534 00000 n -0000124579 00000 n -0000124624 00000 n -0000124669 00000 n -0000124714 00000 n -0000124759 00000 n -0000124804 00000 n -0000124849 00000 n -0000124894 00000 n -0000124939 00000 n -0000124984 00000 n -0000125029 00000 n -0000125074 00000 n -0000125119 00000 n -0000125164 00000 n -0000125209 00000 n -0000125254 00000 n -0000125299 00000 n -0000125344 00000 n -0000125389 00000 n -0000125434 00000 n -0000125479 00000 n -0000125524 00000 n -0000125569 00000 n -0000125614 00000 n -0000125659 00000 n -0000125704 00000 n -0000125749 00000 n -0000125794 00000 n -0000125839 00000 n -0000125884 00000 n -0000125929 00000 n -0000125974 00000 n -0000126019 00000 n -0000126064 00000 n -0000126109 00000 n -0000126154 00000 n -0000126199 00000 n -0000126244 00000 n -0000126289 00000 n -0000126334 00000 n -0000126379 00000 n -0000126424 00000 n -0000126469 00000 n -0000126514 00000 n -0000126559 00000 n -0000126604 00000 n -0000126649 00000 n -0000126694 00000 n -0000126739 00000 n -0000126784 00000 n -0000126829 00000 n -0000126874 00000 n -0000126919 00000 n -0000126964 00000 n -0000127009 00000 n -0000127054 00000 n -0000127099 00000 n -0000127144 00000 n -0000127189 00000 n -0000127234 00000 n -0000127279 00000 n -0000127324 00000 n -0000127369 00000 n -0000127414 00000 n -0000127459 00000 n -0000127504 00000 n -0000127549 00000 n -0000127594 00000 n -0000127639 00000 n -0000127684 00000 n -0000127729 00000 n -0000127774 00000 n -0000127819 00000 n -0000127864 00000 n -0000127909 00000 n -0000127954 00000 n -0000127999 00000 n -0000128044 00000 n -0000128089 00000 n -0000128134 00000 n -0000128179 00000 n -0000128224 00000 n -0000128269 00000 n -0000128314 00000 n -0000128359 00000 n -0000128404 00000 n -0000128449 00000 n -0000128494 00000 n -0000128539 00000 n -0000128584 00000 n -0000128629 00000 n -0000128674 00000 n -0000128719 00000 n -0000128764 00000 n -0000128809 00000 n -0000128854 00000 n -0000128899 00000 n -0000128944 00000 n -0000128989 00000 n -0000129034 00000 n -0000129079 00000 n -0000129124 00000 n -0000129169 00000 n -0000129214 00000 n -0000129259 00000 n -0000129304 00000 n -0000129349 00000 n -0000129394 00000 n -0000129439 00000 n -0000129484 00000 n -0000129529 00000 n -0000129574 00000 n -0000129619 00000 n -0000129664 00000 n -0000129709 00000 n -0000129754 00000 n -0000129799 00000 n -0000129844 00000 n -0000129889 00000 n -0000129934 00000 n -0000129979 00000 n -0000130024 00000 n -0000130069 00000 n -0000130114 00000 n -0000130159 00000 n -0000130204 00000 n -0000130249 00000 n -0000130294 00000 n -0000130339 00000 n -0000130384 00000 n -0000130429 00000 n -0000130474 00000 n -0000130519 00000 n -0000130564 00000 n -0000130609 00000 n -0000130654 00000 n -0000130699 00000 n -0000130744 00000 n -0000130789 00000 n -0000130834 00000 n -0000130879 00000 n -0000130924 00000 n -0000130969 00000 n -0000131014 00000 n -0000131059 00000 n -0000131104 00000 n -0000131149 00000 n -0000131194 00000 n -0000131239 00000 n -0000131284 00000 n -0000131329 00000 n -0000131374 00000 n -0000131419 00000 n -0000131464 00000 n -0000131509 00000 n -0000131554 00000 n -0000131599 00000 n -0000131644 00000 n -0000131689 00000 n -0000131734 00000 n -0000131778 00000 n -0000131823 00000 n -0000131868 00000 n -0000131913 00000 n -0000131958 00000 n -0000132003 00000 n -0000132048 00000 n -0000132093 00000 n -0000132138 00000 n -0000132183 00000 n -0000132228 00000 n -0000132273 00000 n -0000132318 00000 n -0000132363 00000 n -0000132408 00000 n -0000132453 00000 n -0000132498 00000 n -0000132543 00000 n -0000132588 00000 n -0000134212 00000 n -0000134373 00000 n -0000134542 00000 n -0000134735 00000 n -0000138632 00000 n -0000138826 00000 n -0000143256 00000 n -0000143450 00000 n -0000147800 00000 n -0000147994 00000 n -0000151993 00000 n -0000152187 00000 n -0000155810 00000 n -0000156004 00000 n -0000159812 00000 n -0000160006 00000 n -0000162906 00000 n -0000163067 00000 n -0000163301 00000 n -0000163504 00000 n -0000166084 00000 n -0000166268 00000 n -0000169848 00000 n -0000170023 00000 n -0000172517 00000 n -0000172692 00000 n -0000174374 00000 n -0000174535 00000 n -0000174723 00000 n -0000174926 00000 n -0000177557 00000 n -0000177732 00000 n -0000177997 00000 n -0000178200 00000 n -0000179634 00000 n -0000179851 00000 n -0000181305 00000 n -0000181502 00000 n -0000183354 00000 n -0000183514 00000 n -0000184009 00000 n -0000184179 00000 n -0000185919 00000 n -0000186107 00000 n -0000187596 00000 n -0000187775 00000 n -0000189751 00000 n -0000189930 00000 n -0000190872 00000 n -0000191101 00000 n -0000192970 00000 n -0000193167 00000 n -0000194706 00000 n -0000194903 00000 n -0000196399 00000 n -0000196622 00000 n -0000198791 00000 n -0000198994 00000 n -0000200887 00000 n -0000201101 00000 n -0000202402 00000 n -0000202634 00000 n -0000204307 00000 n -0000204520 00000 n -0000206424 00000 n -0000206632 00000 n -0000207910 00000 n -0000208149 00000 n -0000209668 00000 n -0000209856 00000 n -0000211168 00000 n -0000211356 00000 n -0000211903 00000 n -0000212064 00000 n -0000212254 00000 n -0000212466 00000 n -0000215515 00000 n -0000215704 00000 n -0000217327 00000 n -0000217515 00000 n -0000218887 00000 n -0000219057 00000 n -0000221012 00000 n -0000221172 00000 n -0000221853 00000 n -0000222066 00000 n -0000223488 00000 n -0000223702 00000 n -0000225271 00000 n -0000225469 00000 n -0000227391 00000 n -0000227656 00000 n -0000229367 00000 n -0000229580 00000 n -0000231148 00000 n -0000231355 00000 n -0000233384 00000 n -0000233616 00000 n -0000235644 00000 n -0000235857 00000 n -0000237825 00000 n -0000238037 00000 n -0000240018 00000 n -0000240272 00000 n -0000242535 00000 n -0000242765 00000 n -0000244810 00000 n -0000245041 00000 n -0000246950 00000 n -0000247161 00000 n -0000249037 00000 n -0000249206 00000 n -0000251045 00000 n -0000251267 00000 n -0000253265 00000 n -0000253516 00000 n -0000255480 00000 n -0000255649 00000 n -0000257180 00000 n -0000257374 00000 n -0000258953 00000 n -0000259133 00000 n -0000260874 00000 n -0000261063 00000 n -0000262264 00000 n -0000262461 00000 n -0000263778 00000 n -0000263966 00000 n -0000264835 00000 n -0000265067 00000 n -0000266490 00000 n -0000266725 00000 n -0000268641 00000 n -0000268802 00000 n -0000268993 00000 n -0000269205 00000 n -0000272152 00000 n -0000272327 00000 n -0000274947 00000 n -0000275122 00000 n -0000276953 00000 n -0000277151 00000 n -0000278513 00000 n -0000278711 00000 n -0000280400 00000 n -0000280588 00000 n -0000282270 00000 n -0000282449 00000 n -0000284550 00000 n -0000284729 00000 n -0000286502 00000 n -0000286681 00000 n -0000288362 00000 n -0000288551 00000 n -0000290399 00000 n -0000290612 00000 n -0000292643 00000 n -0000292856 00000 n -0000294408 00000 n -0000294597 00000 n -0000295870 00000 n -0000296077 00000 n -0000297826 00000 n -0000298024 00000 n -0000299752 00000 n -0000299965 00000 n -0000301652 00000 n -0000301865 00000 n -0000303414 00000 n -0000303583 00000 n -0000304163 00000 n -0000304351 00000 n -0000305877 00000 n -0000306080 00000 n -0000307788 00000 n -0000307991 00000 n -0000308808 00000 n -0000309021 00000 n -0000310507 00000 n -0000310687 00000 n -0000311450 00000 n -0000311714 00000 n -0000313438 00000 n -0000313684 00000 n -0000315575 00000 n -0000315798 00000 n -0000317588 00000 n -0000317811 00000 n -0000319686 00000 n -0000319865 00000 n -0000321089 00000 n -0000321321 00000 n -0000322990 00000 n -0000323169 00000 n -0000324749 00000 n -0000324928 00000 n -0000326473 00000 n -0000326652 00000 n -0000328156 00000 n -0000328335 00000 n -0000330001 00000 n -0000330171 00000 n -0000330917 00000 n -0000331115 00000 n -0000332933 00000 n -0000333166 00000 n -0000335221 00000 n -0000335410 00000 n -0000337066 00000 n -0000337236 00000 n -0000337998 00000 n -0000338168 00000 n -0000339273 00000 n -0000339443 00000 n -0000340263 00000 n -0000340433 00000 n -0000341250 00000 n -0000341420 00000 n -0000342582 00000 n -0000342805 00000 n -0000344459 00000 n -0000344685 00000 n -0000346367 00000 n -0000346612 00000 n -0000348503 00000 n -0000348672 00000 n -0000350418 00000 n -0000350602 00000 n -0000352352 00000 n -0000352608 00000 n -0000354585 00000 n -0000354784 00000 n -0000357007 00000 n -0000357218 00000 n -0000358986 00000 n -0000359187 00000 n -0000360205 00000 n -0000360394 00000 n -0000362087 00000 n -0000362266 00000 n -0000364011 00000 n -0000364199 00000 n -0000366035 00000 n -0000366229 00000 n -0000368141 00000 n -0000368373 00000 n -0000370477 00000 n -0000370690 00000 n -0000372127 00000 n -0000372341 00000 n -0000373790 00000 n -0000373997 00000 n -0000375234 00000 n -0000375413 00000 n -0000376400 00000 n -0000376588 00000 n -0000377720 00000 n -0000377908 00000 n -0000379409 00000 n -0000379597 00000 n -0000380680 00000 n -0000380869 00000 n -0000382202 00000 n -0000382372 00000 n -0000384046 00000 n -0000384225 00000 n -0000386009 00000 n -0000386188 00000 n -0000387833 00000 n -0000388002 00000 n -0000389317 00000 n -0000389505 00000 n -0000391071 00000 n -0000391259 00000 n -0000392878 00000 n -0000393066 00000 n -0000394465 00000 n -0000394635 00000 n -0000396269 00000 n -0000396439 00000 n -0000397452 00000 n -0000397649 00000 n -0000398860 00000 n -0000399064 00000 n -0000400410 00000 n -0000400596 00000 n -0000401072 00000 n -0000401260 00000 n -0000402750 00000 n -0000402920 00000 n -0000404427 00000 n -0000404597 00000 n -0000405996 00000 n -0000406166 00000 n -0000407716 00000 n -0000407885 00000 n -0000408848 00000 n -0000409069 00000 n -0000410603 00000 n -0000410824 00000 n -0000412430 00000 n -0000412652 00000 n -0000413901 00000 n -0000414080 00000 n -0000415625 00000 n -0000415804 00000 n -0000417041 00000 n -0000417245 00000 n -0000418655 00000 n -0000418850 00000 n -0000421553 00000 n -0000421729 00000 n -0000422199 00000 n -0000422378 00000 n -0000423906 00000 n -0000424094 00000 n -0000425062 00000 n -0000425232 00000 n -0000425563 00000 n -0000425759 00000 n -0000427488 00000 n -0000427702 00000 n -0000429386 00000 n -0000429581 00000 n -0000431288 00000 n -0000431501 00000 n -0000432989 00000 n -0000433184 00000 n -0000434766 00000 n -0000434989 00000 n -0000436353 00000 n -0000436541 00000 n -0000437709 00000 n -0000437906 00000 n -0000439456 00000 n -0000439644 00000 n -0000440288 00000 n -0000440492 00000 n -0000442228 00000 n -0000442416 00000 n -0000444159 00000 n -0000444338 00000 n -0000445736 00000 n -0000445915 00000 n -0000447613 00000 n -0000447792 00000 n -0000449273 00000 n -0000449452 00000 n -0000451238 00000 n -0000451442 00000 n -0000453091 00000 n -0000453150 00000 n -0000453253 00000 n -0000453418 00000 n -0000453500 00000 n -0000453608 00000 n -0000453731 00000 n -0000453843 00000 n -0000454021 00000 n -0000454142 00000 n -0000454302 00000 n -0000454420 00000 n -0000454517 00000 n -0000454669 00000 n -0000454809 00000 n -0000454987 00000 n -0000455142 00000 n -0000455244 00000 n -0000455344 00000 n -0000455553 00000 n -0000455654 00000 n -0000455797 00000 n -0000455943 00000 n -0000456059 00000 n -0000456226 00000 n -0000456338 00000 n -0000456512 00000 n -0000456615 00000 n -0000456788 00000 n -0000456909 00000 n -0000457039 00000 n -0000457165 00000 n -0000457280 00000 n -0000457388 00000 n -0000457535 00000 n -0000457640 00000 n -0000457759 00000 n -0000457888 00000 n -0000458047 00000 n -0000458181 00000 n -0000458318 00000 n -0000458450 00000 n -0000458599 00000 n -0000458731 00000 n -0000458879 00000 n -0000458980 00000 n -0000459108 00000 n -0000459226 00000 n -0000459380 00000 n -0000459511 00000 n -0000459657 00000 n -0000459758 00000 n -0000459856 00000 n -0000459980 00000 n -0000460092 00000 n -0000460269 00000 n -0000460378 00000 n -0000460503 00000 n -0000460649 00000 n -0000460751 00000 n -0000460923 00000 n -0000461122 00000 n -0000461233 00000 n -0000461348 00000 n -0000461492 00000 n -0000461700 00000 n -0000461834 00000 n -0000461988 00000 n -0000462113 00000 n -0000462244 00000 n -0000462377 00000 n -0000462508 00000 n -0000462683 00000 n -0000462818 00000 n -0000462971 00000 n -0000463116 00000 n -0000463341 00000 n -0000463452 00000 n -0000463567 00000 n -0000463760 00000 n -0000463903 00000 n -0000464019 00000 n -0000464177 00000 n -0000464334 00000 n -0000464465 00000 n -0000464586 00000 n -0000464763 00000 n -0000464873 00000 n -0000465003 00000 n -0000465173 00000 n -0000465267 00000 n -0000465394 00000 n -0000465521 00000 n -0000465617 00000 n -0000465803 00000 n -0000465929 00000 n -0000466062 00000 n -0000466189 00000 n -0000466301 00000 n -0000466493 00000 n -0000466591 00000 n -0000466777 00000 n -0000466881 00000 n -0000467005 00000 n -0000467127 00000 n -0000467239 00000 n -0000467435 00000 n -0000467551 00000 n -0000467675 00000 n -0000467793 00000 n -0000467911 00000 n -0000468016 00000 n -0000468205 00000 n -0000468428 00000 n -0000468567 00000 n -0000468730 00000 n -0000468867 00000 n -0000468970 00000 n -0000469176 00000 n -0000469335 00000 n -0000469483 00000 n -0000469611 00000 n -0000469792 00000 n -0000469902 00000 n -0000470017 00000 n -0000470162 00000 n -0000470326 00000 n -0000470476 00000 n -0000470694 00000 n -0000470799 00000 n -0000470931 00000 n -0000471052 00000 n -0000471259 00000 n -0000471387 00000 n -0000471472 00000 n -0000471638 00000 n -0000471742 00000 n -0000471899 00000 n -0000472010 00000 n -0000472155 00000 n -0000472297 00000 n -0000472447 00000 n -0000472564 00000 n -0000472728 00000 n -0000472839 00000 n -0000472979 00000 n -0000473106 00000 n -0000473223 00000 n -0000473362 00000 n -0000473468 00000 n -0000473602 00000 n -0000473734 00000 n -0000473879 00000 n -0000474006 00000 n -0000474138 00000 n -0000474268 00000 n -0000474393 00000 n -0000474501 00000 n -0000474672 00000 n -0000474776 00000 n -0000474911 00000 n -0000475039 00000 n -0000475213 00000 n -0000475315 00000 n +0000111954 00000 n +0000111990 00000 n +0000112026 00000 n +0000117652 00000 n +0000117697 00000 n +0000117742 00000 n +0000117787 00000 n +0000117832 00000 n +0000117877 00000 n +0000117922 00000 n +0000117967 00000 n +0000118012 00000 n +0000118057 00000 n +0000118102 00000 n +0000118147 00000 n +0000118192 00000 n +0000118237 00000 n +0000118282 00000 n +0000118327 00000 n +0000118372 00000 n +0000118417 00000 n +0000118462 00000 n +0000118507 00000 n +0000118552 00000 n +0000118597 00000 n +0000118642 00000 n +0000118687 00000 n +0000118732 00000 n +0000118777 00000 n +0000118822 00000 n +0000118867 00000 n +0000118912 00000 n +0000118957 00000 n +0000119002 00000 n +0000119047 00000 n +0000119092 00000 n +0000119137 00000 n +0000119182 00000 n +0000119227 00000 n +0000119272 00000 n +0000119317 00000 n +0000119362 00000 n +0000119407 00000 n +0000119452 00000 n +0000119497 00000 n +0000119542 00000 n +0000119587 00000 n +0000119632 00000 n +0000119677 00000 n +0000119722 00000 n +0000119767 00000 n +0000119812 00000 n +0000119857 00000 n +0000119902 00000 n +0000119947 00000 n +0000119992 00000 n +0000120037 00000 n +0000120082 00000 n +0000120127 00000 n +0000120172 00000 n +0000120217 00000 n +0000120262 00000 n +0000120307 00000 n +0000120352 00000 n +0000120397 00000 n +0000120442 00000 n +0000120487 00000 n +0000120532 00000 n +0000120577 00000 n +0000120622 00000 n +0000120667 00000 n +0000120712 00000 n +0000120757 00000 n +0000120802 00000 n +0000120847 00000 n +0000120892 00000 n +0000120937 00000 n +0000120982 00000 n +0000121027 00000 n +0000121072 00000 n +0000121117 00000 n +0000121162 00000 n +0000121207 00000 n +0000121252 00000 n +0000121297 00000 n +0000121342 00000 n +0000121387 00000 n +0000121432 00000 n +0000121477 00000 n +0000121522 00000 n +0000121567 00000 n +0000121612 00000 n +0000121657 00000 n +0000121702 00000 n +0000121747 00000 n +0000121792 00000 n +0000121837 00000 n +0000121882 00000 n +0000121927 00000 n +0000121972 00000 n +0000122017 00000 n +0000122062 00000 n +0000122107 00000 n +0000122152 00000 n +0000122197 00000 n +0000122242 00000 n +0000122287 00000 n +0000122332 00000 n +0000122377 00000 n +0000122422 00000 n +0000122467 00000 n +0000122512 00000 n +0000122557 00000 n +0000122602 00000 n +0000122647 00000 n +0000122692 00000 n +0000122737 00000 n +0000122782 00000 n +0000122827 00000 n +0000122872 00000 n +0000122917 00000 n +0000122962 00000 n +0000123007 00000 n +0000123052 00000 n +0000123097 00000 n +0000123142 00000 n +0000123187 00000 n +0000123232 00000 n +0000123277 00000 n +0000123322 00000 n +0000123367 00000 n +0000123412 00000 n +0000123457 00000 n +0000123502 00000 n +0000123547 00000 n +0000123592 00000 n +0000123637 00000 n +0000123682 00000 n +0000123727 00000 n +0000123772 00000 n +0000123817 00000 n +0000123862 00000 n +0000123907 00000 n +0000123952 00000 n +0000123997 00000 n +0000124042 00000 n +0000124087 00000 n +0000124132 00000 n +0000124177 00000 n +0000124222 00000 n +0000124267 00000 n +0000124312 00000 n +0000124357 00000 n +0000124402 00000 n +0000124447 00000 n +0000124492 00000 n +0000124537 00000 n +0000124582 00000 n +0000124627 00000 n +0000124672 00000 n +0000124717 00000 n +0000124762 00000 n +0000124807 00000 n +0000124852 00000 n +0000124897 00000 n +0000124942 00000 n +0000124987 00000 n +0000125032 00000 n +0000125077 00000 n +0000125122 00000 n +0000125167 00000 n +0000125212 00000 n +0000125257 00000 n +0000125302 00000 n +0000125347 00000 n +0000125392 00000 n +0000125437 00000 n +0000125482 00000 n +0000125527 00000 n +0000125572 00000 n +0000125617 00000 n +0000125662 00000 n +0000125707 00000 n +0000125752 00000 n +0000125797 00000 n +0000125842 00000 n +0000125887 00000 n +0000125932 00000 n +0000125977 00000 n +0000126022 00000 n +0000126067 00000 n +0000126112 00000 n +0000126157 00000 n +0000126202 00000 n +0000126247 00000 n +0000126292 00000 n +0000126337 00000 n +0000126382 00000 n +0000126427 00000 n +0000126472 00000 n +0000126517 00000 n +0000126562 00000 n +0000126607 00000 n +0000126652 00000 n +0000126697 00000 n +0000126742 00000 n +0000126787 00000 n +0000126832 00000 n +0000126877 00000 n +0000126922 00000 n +0000126967 00000 n +0000127012 00000 n +0000127057 00000 n +0000127102 00000 n +0000127147 00000 n +0000127192 00000 n +0000127237 00000 n +0000127282 00000 n +0000127327 00000 n +0000127372 00000 n +0000127417 00000 n +0000127462 00000 n +0000127507 00000 n +0000127552 00000 n +0000127597 00000 n +0000127642 00000 n +0000127687 00000 n +0000127732 00000 n +0000127777 00000 n +0000127822 00000 n +0000127867 00000 n +0000127912 00000 n +0000127957 00000 n +0000128002 00000 n +0000128047 00000 n +0000128092 00000 n +0000128137 00000 n +0000128182 00000 n +0000128227 00000 n +0000128272 00000 n +0000128317 00000 n +0000128362 00000 n +0000128407 00000 n +0000128452 00000 n +0000128497 00000 n +0000128542 00000 n +0000128587 00000 n +0000128632 00000 n +0000128677 00000 n +0000128722 00000 n +0000128767 00000 n +0000128812 00000 n +0000128857 00000 n +0000128902 00000 n +0000128947 00000 n +0000128992 00000 n +0000129037 00000 n +0000129082 00000 n +0000129127 00000 n +0000129172 00000 n +0000129217 00000 n +0000129262 00000 n +0000129307 00000 n +0000129352 00000 n +0000129397 00000 n +0000129442 00000 n +0000129487 00000 n +0000129532 00000 n +0000129577 00000 n +0000129622 00000 n +0000129667 00000 n +0000129712 00000 n +0000129757 00000 n +0000129802 00000 n +0000129847 00000 n +0000129892 00000 n +0000129937 00000 n +0000129982 00000 n +0000130027 00000 n +0000130072 00000 n +0000130117 00000 n +0000130162 00000 n +0000130207 00000 n +0000130252 00000 n +0000130297 00000 n +0000130342 00000 n +0000130387 00000 n +0000130432 00000 n +0000130477 00000 n +0000130522 00000 n +0000130567 00000 n +0000130612 00000 n +0000130657 00000 n +0000130702 00000 n +0000130747 00000 n +0000130792 00000 n +0000130837 00000 n +0000130882 00000 n +0000130927 00000 n +0000130972 00000 n +0000131017 00000 n +0000131062 00000 n +0000131107 00000 n +0000131152 00000 n +0000131197 00000 n +0000131242 00000 n +0000131287 00000 n +0000131332 00000 n +0000131377 00000 n +0000131422 00000 n +0000131467 00000 n +0000131512 00000 n +0000131556 00000 n +0000131601 00000 n +0000131646 00000 n +0000131691 00000 n +0000131736 00000 n +0000131781 00000 n +0000131826 00000 n +0000131871 00000 n +0000131916 00000 n +0000131961 00000 n +0000132006 00000 n +0000132051 00000 n +0000132096 00000 n +0000132141 00000 n +0000132186 00000 n +0000132231 00000 n +0000132276 00000 n +0000132321 00000 n +0000132366 00000 n +0000133990 00000 n +0000134151 00000 n +0000134320 00000 n +0000134513 00000 n +0000138558 00000 n +0000138752 00000 n +0000142590 00000 n +0000142784 00000 n +0000147010 00000 n +0000147204 00000 n +0000151186 00000 n +0000151380 00000 n +0000155280 00000 n +0000155474 00000 n +0000159023 00000 n +0000159217 00000 n +0000162507 00000 n +0000162668 00000 n +0000162902 00000 n +0000163105 00000 n +0000165725 00000 n +0000165909 00000 n +0000169136 00000 n +0000169311 00000 n +0000171915 00000 n +0000172090 00000 n +0000173540 00000 n +0000173701 00000 n +0000173889 00000 n +0000174092 00000 n +0000176851 00000 n +0000177026 00000 n +0000177322 00000 n +0000177525 00000 n +0000178959 00000 n +0000179176 00000 n +0000180630 00000 n +0000180827 00000 n +0000182679 00000 n +0000182839 00000 n +0000183334 00000 n +0000183504 00000 n +0000185244 00000 n +0000185423 00000 n +0000187298 00000 n +0000187486 00000 n +0000189329 00000 n +0000189517 00000 n +0000191227 00000 n +0000191396 00000 n +0000192199 00000 n +0000192428 00000 n +0000194297 00000 n +0000194494 00000 n +0000196033 00000 n +0000196230 00000 n +0000197726 00000 n +0000197949 00000 n +0000200118 00000 n +0000200321 00000 n +0000202214 00000 n +0000202428 00000 n +0000203729 00000 n +0000203961 00000 n +0000205635 00000 n +0000205848 00000 n +0000207750 00000 n +0000207958 00000 n +0000209235 00000 n +0000209474 00000 n +0000210994 00000 n +0000211182 00000 n +0000212494 00000 n +0000212682 00000 n +0000213229 00000 n +0000213390 00000 n +0000213580 00000 n +0000213792 00000 n +0000216648 00000 n +0000216823 00000 n +0000217171 00000 n +0000217360 00000 n +0000219001 00000 n +0000219189 00000 n +0000220682 00000 n +0000220861 00000 n +0000222591 00000 n +0000222771 00000 n +0000224735 00000 n +0000224948 00000 n +0000226722 00000 n +0000226944 00000 n +0000227993 00000 n +0000228238 00000 n +0000229658 00000 n +0000229872 00000 n +0000231409 00000 n +0000231607 00000 n +0000233638 00000 n +0000233903 00000 n +0000235659 00000 n +0000235872 00000 n +0000237449 00000 n +0000237656 00000 n +0000239651 00000 n +0000239883 00000 n +0000241912 00000 n +0000242124 00000 n +0000244105 00000 n +0000244318 00000 n +0000246522 00000 n +0000246752 00000 n +0000248939 00000 n +0000249099 00000 n +0000249836 00000 n +0000250030 00000 n +0000251586 00000 n +0000251766 00000 n +0000253507 00000 n +0000253696 00000 n +0000254897 00000 n +0000255094 00000 n +0000256412 00000 n +0000256600 00000 n +0000257468 00000 n +0000257700 00000 n +0000259123 00000 n +0000259358 00000 n +0000261274 00000 n +0000261435 00000 n +0000261628 00000 n +0000261831 00000 n +0000264448 00000 n +0000264632 00000 n +0000267263 00000 n +0000267438 00000 n +0000269039 00000 n +0000269261 00000 n +0000271148 00000 n +0000271394 00000 n +0000273228 00000 n +0000273439 00000 n +0000275172 00000 n +0000275341 00000 n +0000277331 00000 n +0000277510 00000 n +0000279155 00000 n +0000279376 00000 n +0000280992 00000 n +0000281235 00000 n +0000282833 00000 n +0000283003 00000 n +0000283512 00000 n +0000283719 00000 n +0000285467 00000 n +0000285665 00000 n +0000287393 00000 n +0000287606 00000 n +0000289293 00000 n +0000289506 00000 n +0000291055 00000 n +0000291224 00000 n +0000291805 00000 n +0000291993 00000 n +0000293488 00000 n +0000293708 00000 n +0000295314 00000 n +0000295524 00000 n +0000297191 00000 n +0000297394 00000 n +0000298487 00000 n +0000298751 00000 n +0000300475 00000 n +0000300721 00000 n +0000302611 00000 n +0000302834 00000 n +0000304624 00000 n +0000304847 00000 n +0000306722 00000 n +0000306901 00000 n +0000308125 00000 n +0000308357 00000 n +0000310026 00000 n +0000310205 00000 n +0000311785 00000 n +0000311964 00000 n +0000313511 00000 n +0000313690 00000 n +0000315194 00000 n +0000315373 00000 n +0000317039 00000 n +0000317209 00000 n +0000317955 00000 n +0000318153 00000 n +0000319971 00000 n +0000320204 00000 n +0000322260 00000 n +0000322449 00000 n +0000324105 00000 n +0000324275 00000 n +0000325037 00000 n +0000325207 00000 n +0000326313 00000 n +0000326483 00000 n +0000327303 00000 n +0000327473 00000 n +0000328291 00000 n +0000328461 00000 n +0000329623 00000 n +0000329846 00000 n +0000331499 00000 n +0000331725 00000 n +0000333408 00000 n +0000333653 00000 n +0000335544 00000 n +0000335713 00000 n +0000337458 00000 n +0000337642 00000 n +0000339392 00000 n +0000339648 00000 n +0000341625 00000 n +0000341824 00000 n +0000344048 00000 n +0000344259 00000 n +0000346026 00000 n +0000346227 00000 n +0000347245 00000 n +0000347434 00000 n +0000349128 00000 n +0000349307 00000 n +0000351052 00000 n +0000351240 00000 n +0000353076 00000 n +0000353270 00000 n +0000355183 00000 n +0000355414 00000 n +0000357518 00000 n +0000357730 00000 n +0000359167 00000 n +0000359380 00000 n +0000360829 00000 n +0000361036 00000 n +0000362273 00000 n +0000362452 00000 n +0000363440 00000 n +0000363628 00000 n +0000364760 00000 n +0000364948 00000 n +0000366449 00000 n +0000366637 00000 n +0000367720 00000 n +0000367909 00000 n +0000369242 00000 n +0000369483 00000 n +0000371089 00000 n +0000371287 00000 n +0000373136 00000 n +0000373333 00000 n +0000374955 00000 n +0000375134 00000 n +0000377187 00000 n +0000377366 00000 n +0000379204 00000 n +0000379383 00000 n +0000381094 00000 n +0000381273 00000 n +0000381707 00000 n +0000381877 00000 n +0000383551 00000 n +0000383730 00000 n +0000385514 00000 n +0000385693 00000 n +0000387338 00000 n +0000387507 00000 n +0000388822 00000 n +0000389010 00000 n +0000390576 00000 n +0000390764 00000 n +0000392378 00000 n +0000392566 00000 n +0000393954 00000 n +0000394124 00000 n +0000395758 00000 n +0000395928 00000 n +0000396941 00000 n +0000397155 00000 n +0000398641 00000 n +0000398821 00000 n +0000399584 00000 n +0000399781 00000 n +0000400992 00000 n +0000401196 00000 n +0000402543 00000 n +0000402729 00000 n +0000403206 00000 n +0000403385 00000 n +0000404928 00000 n +0000405107 00000 n +0000406344 00000 n +0000406548 00000 n +0000407960 00000 n +0000408155 00000 n +0000410849 00000 n +0000411025 00000 n +0000411800 00000 n +0000411970 00000 n +0000413478 00000 n +0000413648 00000 n +0000415047 00000 n +0000415217 00000 n +0000416767 00000 n +0000416936 00000 n +0000417899 00000 n +0000418078 00000 n +0000419606 00000 n +0000419794 00000 n +0000420762 00000 n +0000420932 00000 n +0000421263 00000 n +0000421459 00000 n +0000423188 00000 n +0000423402 00000 n +0000425086 00000 n +0000425281 00000 n +0000426988 00000 n +0000427201 00000 n +0000428689 00000 n +0000428884 00000 n +0000430466 00000 n +0000430689 00000 n +0000432053 00000 n +0000432241 00000 n +0000433409 00000 n +0000433606 00000 n +0000435156 00000 n +0000435344 00000 n +0000435988 00000 n +0000436192 00000 n +0000437928 00000 n +0000438116 00000 n +0000439859 00000 n +0000440038 00000 n +0000441436 00000 n +0000441615 00000 n +0000443313 00000 n +0000443492 00000 n +0000444973 00000 n +0000445152 00000 n +0000446938 00000 n +0000447142 00000 n +0000448791 00000 n +0000448850 00000 n +0000448953 00000 n +0000449118 00000 n +0000449200 00000 n +0000449308 00000 n +0000449431 00000 n +0000449543 00000 n +0000449721 00000 n +0000449842 00000 n +0000450002 00000 n +0000450120 00000 n +0000450217 00000 n +0000450369 00000 n +0000450509 00000 n +0000450687 00000 n +0000450842 00000 n +0000450944 00000 n +0000451044 00000 n +0000451253 00000 n +0000451354 00000 n +0000451542 00000 n +0000451685 00000 n +0000451831 00000 n +0000451947 00000 n +0000452114 00000 n +0000452226 00000 n +0000452400 00000 n +0000452503 00000 n +0000452676 00000 n +0000452797 00000 n +0000452927 00000 n +0000453053 00000 n +0000453168 00000 n +0000453276 00000 n +0000453423 00000 n +0000453528 00000 n +0000453647 00000 n +0000453776 00000 n +0000453935 00000 n +0000454069 00000 n +0000454206 00000 n +0000454338 00000 n +0000454487 00000 n +0000454619 00000 n +0000454767 00000 n +0000454868 00000 n +0000454996 00000 n +0000455114 00000 n +0000455268 00000 n +0000455399 00000 n +0000455545 00000 n +0000455646 00000 n +0000455744 00000 n +0000455868 00000 n +0000455980 00000 n +0000456157 00000 n +0000456266 00000 n +0000456391 00000 n +0000456537 00000 n +0000456639 00000 n +0000456815 00000 n +0000456959 00000 n +0000457071 00000 n +0000457198 00000 n +0000457326 00000 n +0000457454 00000 n +0000457565 00000 n +0000457764 00000 n +0000457875 00000 n +0000457990 00000 n +0000458134 00000 n +0000458342 00000 n +0000458476 00000 n +0000458630 00000 n +0000458755 00000 n +0000458886 00000 n +0000459017 00000 n +0000459178 00000 n +0000459299 00000 n +0000459502 00000 n +0000459613 00000 n +0000459728 00000 n +0000459921 00000 n +0000460064 00000 n +0000460180 00000 n +0000460338 00000 n +0000460495 00000 n +0000460626 00000 n +0000460747 00000 n +0000460924 00000 n +0000461034 00000 n +0000461164 00000 n +0000461334 00000 n +0000461428 00000 n +0000461555 00000 n +0000461682 00000 n +0000461778 00000 n +0000461964 00000 n +0000462090 00000 n +0000462223 00000 n +0000462350 00000 n +0000462462 00000 n +0000462627 00000 n +0000462781 00000 n +0000462889 00000 n +0000463035 00000 n +0000463153 00000 n +0000463285 00000 n +0000463422 00000 n +0000463554 00000 n +0000463688 00000 n +0000463818 00000 n +0000463986 00000 n +0000464106 00000 n +0000464215 00000 n +0000464421 00000 n +0000464580 00000 n +0000464728 00000 n +0000464856 00000 n +0000465037 00000 n +0000465147 00000 n +0000465262 00000 n +0000465407 00000 n +0000465571 00000 n +0000465721 00000 n +0000465852 00000 n +0000466070 00000 n +0000466175 00000 n +0000466307 00000 n +0000466428 00000 n +0000466594 00000 n +0000466698 00000 n +0000466855 00000 n +0000466966 00000 n +0000467111 00000 n +0000467253 00000 n +0000467403 00000 n +0000467520 00000 n +0000467684 00000 n +0000467795 00000 n +0000467935 00000 n +0000468062 00000 n +0000468179 00000 n +0000468318 00000 n +0000468424 00000 n +0000468558 00000 n +0000468690 00000 n +0000468835 00000 n +0000468962 00000 n +0000469094 00000 n +0000469224 00000 n +0000469349 00000 n +0000469457 00000 n +0000469628 00000 n +0000469732 00000 n +0000469867 00000 n +0000469995 00000 n +0000470169 00000 n +0000470271 00000 n +0000470421 00000 n +0000470571 00000 n +0000470696 00000 n +0000470902 00000 n +0000471002 00000 n +0000471120 00000 n +0000471285 00000 n +0000471376 00000 n +0000471537 00000 n +0000471663 00000 n +0000471806 00000 n +0000471933 00000 n +0000472073 00000 n +0000472209 00000 n +0000472317 00000 n +0000472491 00000 n +0000472597 00000 n +0000472717 00000 n +0000472829 00000 n +0000472946 00000 n +0000473048 00000 n +0000473240 00000 n +0000473412 00000 n +0000473516 00000 n +0000473640 00000 n +0000473762 00000 n +0000473874 00000 n +0000474056 00000 n +0000474172 00000 n +0000474296 00000 n +0000474414 00000 n +0000474532 00000 n +0000474637 00000 n +0000474814 00000 n +0000474926 00000 n +0000475057 00000 n +0000475181 00000 n +0000475348 00000 n 0000475465 00000 n -0000475615 00000 n -0000475740 00000 n -0000475946 00000 n -0000476046 00000 n -0000476164 00000 n -0000476329 00000 n -0000476420 00000 n -0000476581 00000 n -0000476707 00000 n -0000476850 00000 n -0000476977 00000 n -0000477117 00000 n -0000477253 00000 n -0000477361 00000 n -0000477535 00000 n -0000477641 00000 n -0000477761 00000 n -0000477873 00000 n -0000477990 00000 n -0000478092 00000 n -0000478269 00000 n -0000478381 00000 n -0000478512 00000 n -0000478636 00000 n -0000478803 00000 n -0000478920 00000 n -0000479050 00000 n -0000479190 00000 n -0000479327 00000 n -0000479463 00000 n -0000479599 00000 n -0000479736 00000 n -0000479848 00000 n -0000480019 00000 n -0000480141 00000 n -0000480301 00000 n -0000480400 00000 n -0000480515 00000 n -0000480617 00000 n -0000480778 00000 n -0000480882 00000 n -0000480981 00000 n -0000481112 00000 n -0000481287 00000 n -0000481390 00000 n -0000481510 00000 n -0000481625 00000 n -0000481739 00000 n -0000481854 00000 n -0000481968 00000 n -0000482083 00000 n -0000482201 00000 n -0000482318 00000 n -0000482424 00000 n -0000482602 00000 n -0000482705 00000 n -0000482861 00000 n -0000482969 00000 n -0000483095 00000 n -0000483215 00000 n -0000483316 00000 n -0000483423 00000 n -0000483587 00000 n -0000483691 00000 n -0000483824 00000 n -0000483956 00000 n -0000484078 00000 n -0000484207 00000 n -0000484314 00000 n -0000484480 00000 n -0000484602 00000 n -0000484712 00000 n -0000484826 00000 n -0000484987 00000 n -0000485083 00000 n -0000485197 00000 n -0000485307 00000 n -0000485438 00000 n -0000485571 00000 n -0000485672 00000 n -0000485850 00000 n -0000485960 00000 n -0000486114 00000 n -0000486283 00000 n -0000486471 00000 n -0000486652 00000 n -0000486808 00000 n -0000486974 00000 n -0000487106 00000 n -0000487253 00000 n -0000487392 00000 n -0000487526 00000 n -0000487650 00000 n -0000487771 00000 n -0000487890 00000 n -0000488060 00000 n -0000488222 00000 n -0000488328 00000 n -0000488445 00000 n -0000488596 00000 n -0000488761 00000 n -0000488886 00000 n -0000489042 00000 n -0000489160 00000 n -0000489290 00000 n -0000489454 00000 n -0000489558 00000 n -0000489676 00000 n -0000489794 00000 n -0000489915 00000 n -0000490051 00000 n -0000490150 00000 n -0000490305 00000 n -0000490409 00000 n -0000490526 00000 n -0000490676 00000 n -0000490776 00000 n -0000490890 00000 n -0000491004 00000 n -0000491118 00000 n -0000491232 00000 n -0000491346 00000 n -0000491460 00000 n -0000491574 00000 n -0000491688 00000 n -0000491804 00000 n -0000491906 00000 n -0000492020 00000 n +0000475595 00000 n +0000475735 00000 n +0000475872 00000 n +0000476008 00000 n +0000476144 00000 n +0000476281 00000 n +0000476393 00000 n +0000476600 00000 n +0000476728 00000 n +0000476813 00000 n +0000476984 00000 n +0000477106 00000 n +0000477266 00000 n +0000477365 00000 n +0000477480 00000 n +0000477582 00000 n +0000477743 00000 n +0000477847 00000 n +0000477946 00000 n +0000478110 00000 n +0000478214 00000 n +0000478347 00000 n +0000478479 00000 n +0000478601 00000 n +0000478730 00000 n +0000478837 00000 n +0000479003 00000 n +0000479125 00000 n +0000479235 00000 n +0000479349 00000 n +0000479524 00000 n +0000479627 00000 n +0000479747 00000 n +0000479862 00000 n +0000479976 00000 n +0000480091 00000 n +0000480205 00000 n +0000480320 00000 n +0000480438 00000 n +0000480555 00000 n +0000480661 00000 n +0000480822 00000 n +0000480918 00000 n +0000481032 00000 n +0000481142 00000 n +0000481273 00000 n +0000481406 00000 n +0000481507 00000 n +0000481685 00000 n +0000481795 00000 n +0000481949 00000 n +0000482118 00000 n +0000482306 00000 n +0000482487 00000 n +0000482643 00000 n +0000482809 00000 n +0000482941 00000 n +0000483088 00000 n +0000483227 00000 n +0000483361 00000 n +0000483485 00000 n +0000483606 00000 n +0000483725 00000 n +0000483895 00000 n +0000484057 00000 n +0000484163 00000 n +0000484280 00000 n +0000484431 00000 n +0000484596 00000 n +0000484721 00000 n +0000484877 00000 n +0000484995 00000 n +0000485125 00000 n +0000485289 00000 n +0000485393 00000 n +0000485511 00000 n +0000485629 00000 n +0000485750 00000 n +0000485886 00000 n +0000485985 00000 n +0000486140 00000 n +0000486244 00000 n +0000486361 00000 n +0000486511 00000 n +0000486611 00000 n +0000486725 00000 n +0000486839 00000 n +0000486953 00000 n +0000487067 00000 n +0000487181 00000 n +0000487295 00000 n +0000487409 00000 n +0000487523 00000 n +0000487639 00000 n +0000487741 00000 n +0000487855 00000 n trailer -<<1e4bf6963641260076121f20f04b0c49>]>> +<<59edfc9c992c6dc16325ed514a78f3f7>]>> startxref -492974 +488808 %%EOF -- cgit From 66806b53dcf8957b1bc1b6477abbeda2a072a197 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 2 Apr 2003 08:28:32 +0000 Subject: Fix a crash bug if LDAP doesn't fill in ld_error. Andrew Bartlett C VS: ---------------------------------------------------------------------- (This used to be commit d84a3fc522a588bdcd36cb86df304572947a456a) --- source3/passdb/pdb_ldap.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index 8a74cc1f67..264de8d0f0 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -406,14 +406,14 @@ static int ldapsam_connect_system(struct ldapsam_privates *ldap_state, LDAP * ld rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret); if (rc != LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("failed to bind to server with dn= %s Error: %s\n\t%s\n", - ldap_dn, ldap_err2string(rc), + ldap_dn ? ld_error : "(unknown)", ldap_err2string(rc), ld_error)); - free(ld_error); + SAFE_FREE(ld_error); return rc; } @@ -649,11 +649,11 @@ static int ldapsam_search_one_user (struct ldapsam_privates *ldap_state, const c rc = ldapsam_search(ldap_state, lp_ldap_suffix (), scope, filter, attr, 0, result); if (rc != LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0,("ldapsam_search_one_user: Problem during the LDAP search: %s (%s)\n", - ld_error, ldap_err2string (rc))); + ld_error?ld_error:"(unknown)", ldap_err2string (rc))); DEBUG(3,("ldapsam_search_one_user: Query was: %s, %s\n", lp_ldap_suffix(), filter)); SAFE_FREE(ld_error); @@ -918,12 +918,12 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, ldap_mods_free(mods, 1); if (rc != LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("could not delete attributes for %s, error: %s (%s)\n", - dn, ldap_err2string(rc), ld_error)); + dn, ldap_err2string(rc), ld_error?ld_error:"unknown")); SAFE_FREE(ld_error); ldap_memfree(dn); return NT_STATUS_UNSUCCESSFUL; @@ -1876,15 +1876,15 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } if (rc!=LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(1, ("failed to %s user dn= %s with: %s\n\t%s\n", ldap_op == LDAP_MOD_ADD ? "add" : "modify", dn, ldap_err2string(rc), - ld_error)); - free(ld_error); + ld_error?ld_error:"unknown")); + SAFE_FREE(ld_error); return NT_STATUS_UNSUCCESSFUL; } } @@ -2026,11 +2026,11 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_A ldap_mods_free(mods,1); if (!NT_STATUS_IS_OK(ret)) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0,("failed to modify user with uid = %s, error: %s (%s)\n", - pdb_get_username(newpwd), ld_error, ldap_err2string(rc))); + pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc))); SAFE_FREE(ld_error); return ret; } @@ -2189,12 +2189,12 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state, filter, group_attr, 0, result); if (rc != LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("ldapsam_search_one_group: " "Problem during the LDAP search: LDAP error: %s (%s)", - ld_error, ldap_err2string(rc))); + ld_error?ld_error:"(unknown)", ldap_err2string(rc))); DEBUG(3, ("ldapsam_search_one_group: Query was: %s, %s\n", lp_ldap_suffix(), filter)); SAFE_FREE(ld_error); @@ -2451,11 +2451,11 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, ldap_mods_free(mods, 1); if (rc != LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("failed to add group %i error: %s (%s)\n", map->gid, - ld_error, ldap_err2string(rc))); + ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); SAFE_FREE(ld_error); return NT_STATUS_UNSUCCESSFUL; } @@ -2509,11 +2509,11 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, ldap_mods_free(mods, 1); if (rc != LDAP_SUCCESS) { - char *ld_error; + char *ld_error = NULL; ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("failed to modify group %i error: %s (%s)\n", map->gid, - ld_error, ldap_err2string(rc))); + ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); SAFE_FREE(ld_error); } -- cgit From a557af96e9f232e2fa012850e0725fde353521bd Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 2 Apr 2003 10:36:02 +0000 Subject: THE Idmap patch :-) includes a --with-idmap=no switch to disable idmap usage if you find problems. cosmetic fixes and param aliases to separate winbind from idamp roles. A temporarily remote idmap winbind compatibility backend. As I have time I will further change code to not call directly winbind (partly done but not tested) and a specilized module will be built in place for the current glue hack. The patch has been tested locally in my limited time, the patch is simple and clear and should not reserve problems, if any just disable it. As usual, comments and fisex are welcome :-) Simo. (This used to be commit 02781320476ed1b7ee5d943fa36f9a66ab67f208) --- source3/Makefile.in | 23 ++++--- source3/configure.in | 21 ++++++ source3/include/idmap.h | 2 +- source3/include/includes.h | 2 + source3/lib/username.c | 2 +- source3/nsswitch/winbindd.h | 2 +- source3/nsswitch/winbindd_idmap.c | 55 ++++++++------- source3/nsswitch/winbindd_idmap_tdb.c | 4 +- source3/nsswitch/winbindd_util.c | 4 +- source3/param/loadparm.c | 70 ++++++++++--------- source3/rpc_server/srv_samr_nt.c | 2 +- source3/rpc_server/srv_util.c | 2 +- source3/sam/idmap.c | 93 ++++++++++---------------- source3/sam/idmap_tdb.c | 54 +++++++-------- source3/sam/idmap_winbind.c | 108 ++++++++++++++++++++++++++++++ source3/smbd/server.c | 3 + source3/smbd/uid.c | 122 +++++++++++++++++++++++++++++++++- 17 files changed, 405 insertions(+), 164 deletions(-) create mode 100644 source3/sam/idmap_winbind.c diff --git a/source3/Makefile.in b/source3/Makefile.in index b05e7692cd..8a7abe6bf7 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -279,6 +279,8 @@ DEVEL_HELP_OBJ = modules/developer.o SAM_STATIC_MODULES = sam/sam_plugin.o sam/sam_skel.o sam/sam_ads.o +IDMAP_OBJ = sam/idmap.o sam/idmap_tdb.o sam/idmap_winbind.o + SAM_OBJ = sam/account.o sam/get_set_account.o sam/get_set_group.o \ sam/get_set_domain.o sam/interface.o $(SAM_STATIC_MODULES) @@ -336,7 +338,8 @@ SMBD_OBJ_BASE = $(PARAM_OBJ) $(SMBD_OBJ_SRV) $(MSDFS_OBJ) $(LIBSMB_OBJ) \ $(NOTIFY_OBJ) $(GROUPDB_OBJ) $(AUTH_OBJ) \ $(LIBMSRPC_OBJ) $(LIBMSRPC_SERVER_OBJ) \ $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(LIBADS_SERVER_OBJ) \ - $(LIB_SMBD_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) + $(LIB_SMBD_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) \ + $(IDMAP_OBJ) PRINTING_OBJ = printing/pcap.o printing/print_svid.o \ @@ -401,14 +404,15 @@ TESTPRNS_OBJ = utils/testprns.o $(PARAM_OBJ) $(PRINTING_OBJ) $(UBIQX_OBJ) \ SMBPASSWD_OBJ = utils/smbpasswd.o $(PARAM_OBJ) $(SECRETS_OBJ) \ $(LIBSMB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ)\ - $(UBIQX_OBJ) $(LIB_OBJ) $(KRBCLIENT_OBJ) + $(UBIQX_OBJ) $(LIB_OBJ) $(KRBCLIENT_OBJ) \ + $(IDMAP_OBJ) PDBEDIT_OBJ = utils/pdbedit.o $(PARAM_OBJ) $(PASSDB_OBJ) $(LIBSAMBA_OBJ) \ $(UBIQX_OBJ) $(LIB_OBJ) $(GROUPDB_OBJ) $(SECRETS_OBJ) \ - $(POPT_LIB_OBJ) + $(POPT_LIB_OBJ) $(IDMAP_OBJ) SMBGROUPEDIT_OBJ = utils/smbgroupedit.o $(GROUPDB_OBJ) $(PARAM_OBJ) \ - $(LIBSAMBA_OBJ) $(PASSDB_OBJ) $(SECRETS_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) + $(LIBSAMBA_OBJ) $(PASSDB_OBJ) $(SECRETS_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) $(IDMAP_OBJ) RPCCLIENT_OBJ1 = rpcclient/rpcclient.o rpcclient/cmd_lsarpc.o \ rpcclient/cmd_samr.o rpcclient/cmd_spoolss.o \ @@ -420,7 +424,8 @@ RPCCLIENT_OBJ = $(RPCCLIENT_OBJ1) \ $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(LIBMSRPC_OBJ) \ $(READLINE_OBJ) $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) \ - $(LIBADS_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) + $(LIBADS_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) \ + $(IDMAP_OBJ) PAM_WINBIND_OBJ = nsswitch/pam_winbind.po nsswitch/wb_common.po lib/snprintf.po @@ -467,7 +472,8 @@ NET_OBJ = $(NET_OBJ1) $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \ $(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(LIBMSRPC_OBJ) $(LIBMSRPC_SERVER_OBJ) \ - $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) + $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) \ + $(IDMAP_OBJ) CUPS_OBJ = client/smbspool.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \ $(LIB_OBJ) $(KRBCLIENT_OBJ) @@ -544,7 +550,8 @@ PROTO_OBJ = $(SMBD_OBJ_MAIN) \ $(READLINE_OBJ) $(PROFILE_OBJ) $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) \ $(LIB_SMBD_OBJ) $(SAM_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) \ $(RPC_LSA_OBJ) $(RPC_NETLOG_OBJ) $(RPC_SAMR_OBJ) $(RPC_REG_OBJ) \ - $(RPC_SVC_OBJ) $(RPC_WKS_OBJ) $(RPC_DFS_OBJ) $(RPC_SPOOLSS_OBJ) + $(RPC_SVC_OBJ) $(RPC_WKS_OBJ) $(RPC_DFS_OBJ) $(RPC_SPOOLSS_OBJ) \ + $(IDMAP_OBJ) NSS_OBJ_0 = nsswitch/wins.o $(PARAM_OBJ) $(UBIQX_OBJ) $(LIBSMB_OBJ) \ $(LIB_OBJ) $(NSSWINS_OBJ) @@ -936,7 +943,7 @@ nsswitch/libnss_wins.@SHLIBEXT@: $(NSS_OBJ) bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(LINK) -o $@ $(WINBINDD_OBJ) $(IDMAP_OBJ) $(DYNEXP) $(LIBS) @BUILD_POPT@ nsswitch/libns_winbind.@SHLIBEXT@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" diff --git a/source3/configure.in b/source3/configure.in index 38716aee18..3a6641d44a 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -2442,6 +2442,27 @@ AC_ARG_WITH(ldapsam, AC_MSG_RESULT(no) ) +################################################# +# check for IDMAP + +AC_DEFINE(WITH_IDMAP,1, [Include IDMAP support]) + +AC_MSG_CHECKING(whether to use IDMAP only for [ug]id mapping) +AC_ARG_WITH(idmap, +[ --with-idmap Include experimental IDMAP support (default=yes)], +[ case "$withval" in + yes) + AC_MSG_RESULT(yes) + AC_DEFINE(WITH_IDMAP,1,[Whether to include experimental IDMAP support]) + ;; + no) + AC_MSG_RESULT(no) + AC_DEFINE(WITH_IDMAP,0,[Whether to include experimental IDMAP support]) + ;; + esac ], + AC_MSG_RESULT(yes) +) + ######################################################################################## ## ## END OF TESTS FOR SAM BACKENDS. diff --git a/source3/include/idmap.h b/source3/include/idmap.h index fd7646a324..2cc31e9ed2 100644 --- a/source3/include/idmap.h +++ b/source3/include/idmap.h @@ -44,7 +44,7 @@ struct idmap_methods { NTSTATUS (*init)(const char *init_str); NTSTATUS (*get_sid_from_id)(DOM_SID *sid, unid_t id, int id_type); - NTSTATUS (*get_id_from_sid)(unid_t *id, int *id_type, DOM_SID *sid); + NTSTATUS (*get_id_from_sid)(unid_t *id, int *id_type, const DOM_SID *sid); NTSTATUS (*set_mapping)(DOM_SID *sid, unid_t id, int id_type); /* Called when backend is unloaded */ diff --git a/source3/include/includes.h b/source3/include/includes.h index 3656a8454e..de87f82709 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -798,6 +798,8 @@ extern int errno; #include "gums.h" +#include "idmap.h" + #include "session.h" #include "asn_1.h" diff --git a/source3/lib/username.c b/source3/lib/username.c index b8f33494ee..d8f4ff80ed 100644 --- a/source3/lib/username.c +++ b/source3/lib/username.c @@ -339,7 +339,7 @@ static BOOL user_in_winbind_group_list(const char *user, const char *gname, BOOL goto err; } - if (!lp_winbind_gid(&gid_low, &gid_high)) { + if (!lp_idmap_gid(&gid_low, &gid_high)) { DEBUG(4, ("winbind gid range not configured, therefore %s cannot be a winbind group\n", gname)); goto err; } diff --git a/source3/nsswitch/winbindd.h b/source3/nsswitch/winbindd.h index d98ac28ab1..192b058871 100644 --- a/source3/nsswitch/winbindd.h +++ b/source3/nsswitch/winbindd.h @@ -203,7 +203,7 @@ typedef struct { } CLI_POLICY_HND; /* Filled out by IDMAP backends */ -struct idmap_methods { +struct winbindd_idmap_methods { /* Called when backend is first loaded */ BOOL (*init)(void); diff --git a/source3/nsswitch/winbindd_idmap.c b/source3/nsswitch/winbindd_idmap.c index de547cde41..4b4d9eb8d2 100644 --- a/source3/nsswitch/winbindd_idmap.c +++ b/source3/nsswitch/winbindd_idmap.c @@ -24,33 +24,33 @@ static struct { const char *name; /* Function to create a member of the idmap_methods list */ - BOOL (*reg_meth)(struct idmap_methods **methods); - struct idmap_methods *methods; -} builtin_idmap_functions[] = { + BOOL (*reg_meth)(struct winbindd_idmap_methods **methods); + struct winbindd_idmap_methods *methods; +} builtin_winbindd_idmap_functions[] = { { "tdb", winbind_idmap_reg_tdb, NULL }, /* { "ldap", winbind_idmap_reg_ldap, NULL },*/ { NULL, NULL, NULL } }; /* singleton pattern: uberlazy evaluation */ -static struct idmap_methods *impl; +static struct winbindd_idmap_methods *impl; -static struct idmap_methods *get_impl(const char *name) +static struct winbindd_idmap_methods *get_impl(const char *name) { int i = 0; - struct idmap_methods *ret = NULL; + struct winbindd_idmap_methods *ret = NULL; - while (builtin_idmap_functions[i].name && - strcmp(builtin_idmap_functions[i].name, name)) { + while (builtin_winbindd_idmap_functions[i].name && + strcmp(builtin_winbindd_idmap_functions[i].name, name)) { i++; } - if (builtin_idmap_functions[i].name) { - if (!builtin_idmap_functions[i].methods) { - builtin_idmap_functions[i].reg_meth(&builtin_idmap_functions[i].methods); + if (builtin_winbindd_idmap_functions[i].name) { + if (!builtin_winbindd_idmap_functions[i].methods) { + builtin_winbindd_idmap_functions[i].reg_meth(&builtin_winbindd_idmap_functions[i].methods); } - ret = builtin_idmap_functions[i].methods; + ret = builtin_winbindd_idmap_functions[i].methods; } return ret; @@ -62,13 +62,13 @@ BOOL winbindd_idmap_init(void) BOOL ret = False; DEBUG(3, ("winbindd_idmap_init: using '%s' as backend\n", - lp_idmap_backend())); + lp_winbind_backend())); if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); if (!impl) { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } } @@ -87,10 +87,10 @@ BOOL winbindd_idmap_get_uid_from_sid(DOM_SID *sid, uid_t *uid) BOOL ret = False; if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); if (!impl) { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } } @@ -107,10 +107,10 @@ BOOL winbindd_idmap_get_gid_from_sid(DOM_SID *sid, gid_t *gid) BOOL ret = False; if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); if (!impl) { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } } @@ -127,10 +127,10 @@ BOOL winbindd_idmap_get_sid_from_uid(uid_t uid, DOM_SID *sid) BOOL ret = False; if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); if (!impl) { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } } @@ -147,14 +147,14 @@ BOOL winbindd_idmap_get_sid_from_gid(gid_t gid, DOM_SID *sid) BOOL ret = False; if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); } if (impl) { ret = impl->get_sid_from_gid(gid, sid); } else { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } return ret; @@ -166,14 +166,14 @@ BOOL winbindd_idmap_close(void) BOOL ret = False; if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); } if (impl) { ret = impl->close(); } else { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } return ret; @@ -183,14 +183,13 @@ BOOL winbindd_idmap_close(void) void winbindd_idmap_status(void) { if (!impl) { - impl = get_impl(lp_idmap_backend()); + impl = get_impl(lp_winbind_backend()); } if (impl) { impl->status(); } else { DEBUG(0, ("winbindd_idmap_init: could not load backend '%s'\n", - lp_idmap_backend())); + lp_winbind_backend())); } } - diff --git a/source3/nsswitch/winbindd_idmap_tdb.c b/source3/nsswitch/winbindd_idmap_tdb.c index 911b3b41d2..b47b7ed07d 100644 --- a/source3/nsswitch/winbindd_idmap_tdb.c +++ b/source3/nsswitch/winbindd_idmap_tdb.c @@ -419,7 +419,7 @@ static void tdb_idmap_status(void) /* Display complete mapping of users and groups to rids */ } -struct idmap_methods tdb_idmap_methods = { +struct winbindd_idmap_methods tdb_idmap_methods = { tdb_idmap_init, tdb_get_sid_from_uid, @@ -433,7 +433,7 @@ struct idmap_methods tdb_idmap_methods = { tdb_idmap_status }; -BOOL winbind_idmap_reg_tdb(struct idmap_methods **meth) +BOOL winbind_idmap_reg_tdb(struct winbindd_idmap_methods **meth) { *meth = &tdb_idmap_methods; diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c index b033380206..ac0b317b42 100644 --- a/source3/nsswitch/winbindd_util.c +++ b/source3/nsswitch/winbindd_util.c @@ -380,12 +380,12 @@ BOOL winbindd_param_init(void) { /* Parse winbind uid and winbind_gid parameters */ - if (!lp_winbind_uid(&server_state.uid_low, &server_state.uid_high)) { + if (!lp_idmap_uid(&server_state.uid_low, &server_state.uid_high)) { DEBUG(0, ("winbind uid range missing or invalid\n")); return False; } - if (!lp_winbind_gid(&server_state.gid_low, &server_state.gid_high)) { + if (!lp_idmap_gid(&server_state.gid_low, &server_state.gid_high)) { DEBUG(0, ("winbind gid range missing or invalid\n")); return False; } diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 9d5d279b31..4e2536cf89 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -162,8 +162,8 @@ typedef struct BOOL bUtmp; #endif char *szSourceEnv; - char *szWinbindUID; - char *szWinbindGID; + char *szIdmapUID; + char *szIdmapGID; char *szNonUnixAccountRange; int AlgorithmicRidBase; char *szTemplateHomedir; @@ -172,7 +172,8 @@ typedef struct BOOL bWinbindEnumUsers; BOOL bWinbindEnumGroups; BOOL bWinbindUseDefaultDomain; - char *szIDMapBackend; + char *szWinbindBackend; + char *szIdmapBackend; char *szAddShareCommand; char *szChangeShareCommand; char *szDeleteShareCommand; @@ -551,8 +552,8 @@ static BOOL handle_include(const char *pszParmValue, char **ptr); static BOOL handle_copy(const char *pszParmValue, char **ptr); static BOOL handle_source_env(const char *pszParmValue, char **ptr); static BOOL handle_netbios_name(const char *pszParmValue, char **ptr); -static BOOL handle_winbind_uid(const char *pszParmValue, char **ptr); -static BOOL handle_winbind_gid(const char *pszParmValue, char **ptr); +static BOOL handle_idmap_uid(const char *pszParmValue, char **ptr); +static BOOL handle_idmap_gid(const char *pszParmValue, char **ptr); static BOOL handle_non_unix_account_range(const char *pszParmValue, char **ptr); static BOOL handle_debug_list( const char *pszParmValue, char **ptr ); static BOOL handle_workgroup( const char *pszParmValue, char **ptr ); @@ -751,7 +752,7 @@ static struct parm_struct parm_table[] = { {"update encrypted", P_BOOL, P_GLOBAL, &Globals.bUpdateEncrypt, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, {"allow trusted domains", P_BOOL, P_GLOBAL, &Globals.bAllowTrustedDomains, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"hosts equiv", P_STRING, P_GLOBAL, &Globals.szHostsEquiv, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"idmap backend", P_STRING, P_GLOBAL, &Globals.szIDMapBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"idmap backend", P_STRING, P_GLOBAL, &Globals.szIdmapBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"min passwd length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"min password length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"map to guest", P_ENUM, P_GLOBAL, &Globals.map_to_guest, NULL, enum_map_to_guest, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -1116,8 +1117,10 @@ static struct parm_struct parm_table[] = { {"Winbind options", P_SEP, P_SEPARATOR}, - {"winbind uid", P_STRING, P_GLOBAL, &Globals.szWinbindUID, handle_winbind_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind gid", P_STRING, P_GLOBAL, &Globals.szWinbindGID, handle_winbind_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"idmap uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER | FLAG_HIDE}, + {"idmap gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER | FLAG_HIDE}, {"template homedir", P_STRING, P_GLOBAL, &Globals.szTemplateHomedir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"template shell", P_STRING, P_GLOBAL, &Globals.szTemplateShell, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -1125,6 +1128,7 @@ static struct parm_struct parm_table[] = { {"winbind enum users", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumUsers, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind enum groups", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumGroups, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind use default domain", P_BOOL, P_GLOBAL, &Globals.bWinbindUseDefaultDomain, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"winbind backend", P_STRING, P_GLOBAL, &Globals.szWinbindBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {NULL, P_BOOL, P_NONE, NULL, NULL, NULL, 0} }; @@ -1469,7 +1473,7 @@ static void init_globals(void) Globals.bWinbindEnumGroups = True; Globals.bWinbindUseDefaultDomain = False; - string_set(&Globals.szIDMapBackend, "tdb"); + string_set(&Globals.szWinbindBackend, "tdb"); Globals.name_cache_timeout = 660; /* In seconds */ @@ -1646,7 +1650,9 @@ FN_GLOBAL_STRING(lp_acl_compatibility, &Globals.szAclCompat) FN_GLOBAL_BOOL(lp_winbind_enum_users, &Globals.bWinbindEnumUsers) FN_GLOBAL_BOOL(lp_winbind_enum_groups, &Globals.bWinbindEnumGroups) FN_GLOBAL_BOOL(lp_winbind_use_default_domain, &Globals.bWinbindUseDefaultDomain) -FN_GLOBAL_STRING(lp_idmap_backend, &Globals.szIDMapBackend) +FN_GLOBAL_STRING(lp_winbind_backend, &Globals.szWinbindBackend) + +FN_GLOBAL_STRING(lp_idmap_backend, &Globals.szIdmapBackend) #ifdef WITH_LDAP_SAMCONFIG FN_GLOBAL_STRING(lp_ldap_server, &Globals.szLdapServer) @@ -2804,49 +2810,49 @@ static BOOL handle_copy(const char *pszParmValue, char **ptr) } /*************************************************************************** - Handle winbind/non unix account uid and gid allocation parameters. The format of these + Handle idmap/non unix account uid and gid allocation parameters. The format of these parameters is: [global] - winbind uid = 1000-1999 - winbind gid = 700-899 + idmap uid = 1000-1999 + idmap gid = 700-899 We only do simple parsing checks here. The strings are parsed into useful - structures in the winbind daemon code. + structures in the idmap daemon code. ***************************************************************************/ -/* Some lp_ routines to return winbind [ug]id information */ +/* Some lp_ routines to return idmap [ug]id information */ -static uid_t winbind_uid_low, winbind_uid_high; -static gid_t winbind_gid_low, winbind_gid_high; +static uid_t idmap_uid_low, idmap_uid_high; +static gid_t idmap_gid_low, idmap_gid_high; static uint32 non_unix_account_low, non_unix_account_high; -BOOL lp_winbind_uid(uid_t *low, uid_t *high) +BOOL lp_idmap_uid(uid_t *low, uid_t *high) { - if (winbind_uid_low == 0 || winbind_uid_high == 0) + if (idmap_uid_low == 0 || idmap_uid_high == 0) return False; if (low) - *low = winbind_uid_low; + *low = idmap_uid_low; if (high) - *high = winbind_uid_high; + *high = idmap_uid_high; return True; } -BOOL lp_winbind_gid(gid_t *low, gid_t *high) +BOOL lp_idmap_gid(gid_t *low, gid_t *high) { - if (winbind_gid_low == 0 || winbind_gid_high == 0) + if (idmap_gid_low == 0 || idmap_gid_high == 0) return False; if (low) - *low = winbind_gid_low; + *low = idmap_gid_low; if (high) - *high = winbind_gid_high; + *high = idmap_gid_high; return True; } @@ -2865,9 +2871,9 @@ BOOL lp_non_unix_account_range(uint32 *low, uint32 *high) return True; } -/* Do some simple checks on "winbind [ug]id" parameter values */ +/* Do some simple checks on "idmap [ug]id" parameter values */ -static BOOL handle_winbind_uid(const char *pszParmValue, char **ptr) +static BOOL handle_idmap_uid(const char *pszParmValue, char **ptr) { uint32 low, high; @@ -2878,13 +2884,13 @@ static BOOL handle_winbind_uid(const char *pszParmValue, char **ptr) string_set(ptr, pszParmValue); - winbind_uid_low = low; - winbind_uid_high = high; + idmap_uid_low = low; + idmap_uid_high = high; return True; } -static BOOL handle_winbind_gid(const char *pszParmValue, char **ptr) +static BOOL handle_idmap_gid(const char *pszParmValue, char **ptr) { uint32 low, high; @@ -2895,8 +2901,8 @@ static BOOL handle_winbind_gid(const char *pszParmValue, char **ptr) string_set(ptr, pszParmValue); - winbind_gid_low = low; - winbind_gid_high = high; + idmap_gid_low = low; + idmap_gid_high = high; return True; } diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 7448dc6401..6e1b6f2160 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -915,7 +915,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM struct sys_grent *grp; struct passwd *pw; gid_t winbind_gid_low, winbind_gid_high; - BOOL winbind_groups_exist = lp_winbind_gid(&winbind_gid_low, &winbind_gid_high); + BOOL winbind_groups_exist = lp_idmap_gid(&winbind_gid_low, &winbind_gid_high); /* local aliases */ /* we return the UNIX groups here. This seems to be the right */ diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c index 4eba9c7d1f..4656efb6fa 100644 --- a/source3/rpc_server/srv_util.c +++ b/source3/rpc_server/srv_util.c @@ -112,7 +112,7 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui *prids=NULL; *numgroups=0; - winbind_groups_exist = lp_winbind_gid(&winbind_gid_low, &winbind_gid_high); + winbind_groups_exist = lp_idmap_gid(&winbind_gid_low, &winbind_gid_high); DEBUG(10,("get_alias_user_groups: looking if SID %s is a member of groups in the SID domain %s\n", diff --git a/source3/sam/idmap.c b/source3/sam/idmap.c index b18423a13b..0e55ca5141 100644 --- a/source3/sam/idmap.c +++ b/source3/sam/idmap.c @@ -17,8 +17,7 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/ #include "includes.h" @@ -34,14 +33,13 @@ static struct { } remote_idmap_functions[] = { - { "tdb", idmap_reg_tdb, NULL }, - /* { "ldap", idmap_reg_ldap, NULL },*/ + { "winbind", idmap_reg_winbind, NULL }, { NULL, NULL, NULL } }; -static struct idmap_methods *local_cache; -static struct idmap_methods *remote_repo; +static struct idmap_methods *local_map; +static struct idmap_methods *remote_map; static struct idmap_methods *get_methods(const char *name) { @@ -64,48 +62,33 @@ static struct idmap_methods *get_methods(const char *name) return ret; } -/* Load idmap backend functions */ -BOOL load_methods(void) +/* Initialize backend */ +BOOL idmap_init(const char *remote_backend) { - if (!local_cache) { - idmap_reg_tdb(&local_cache); + if (!local_map) { + idmap_reg_tdb(&local_map); + local_map->init("idmap.tdb"); } - if (!remote_repo && lp_idmap_backend()) { - DEBUG(3, ("load_methods: using '%s' as remote backend\n", lp_idmap_backend())); + if (!remote_map && remote_backend && *remote_backend != 0) { + DEBUG(3, ("load_methods: using '%s' as remote backend\n", remote_backend)); - remote_repo = get_methods(lp_idmap_backend()); - if (!remote_repo) { - DEBUG(0, ("load_methods: could not load remote backend '%s'\n", lp_idmap_backend())); + remote_map = get_methods(remote_backend); + if (!remote_map) { + DEBUG(0, ("load_methods: could not load remote backend '%s'\n", remote_backend)); return False; } + remote_map->init(""); } - idmap_init(); - return True; } -/* Initialize backend */ -NTSTATUS idmap_init(void) +NTSTATUS idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) { NTSTATUS ret; - ret = remote_repo->init("idmap.tdb"); - if (NT_STATUS_IS_ERR(ret)) { - DEBUG(3, ("idmap_init: init failed!\n")); - } - - return ret; -} - -static NTSTATUS idmap_set_mapping(DOM_SID *sid, unid_t id, int id_type) -{ - NTSTATUS ret; - - if (!load_methods()) return NT_STATUS_UNSUCCESSFUL; - - ret = local_cache->set_mapping(sid, id, id_type); + ret = local_map->set_mapping(sid, id, id_type); if (NT_STATUS_IS_ERR(ret)) { DEBUG (0, ("idmap_set_mapping: Error, unable to modify local cache!\n")); return ret; @@ -113,8 +96,8 @@ static NTSTATUS idmap_set_mapping(DOM_SID *sid, unid_t id, int id_type) /* Being able to update the remote cache is seldomly right. Generally this is a forbidden operation. */ - if (!(id_type & ID_CACHE) && (remote_repo != NULL)) { - remote_repo->set_mapping(sid, id, id_type); + if (!(id_type & ID_CACHE) && (remote_map != NULL)) { + remote_map->set_mapping(sid, id, id_type); if (NT_STATUS_IS_ERR(ret)) { DEBUG (0, ("idmap_set_mapping: Error, unable to modify remote cache!\n")); } @@ -124,23 +107,22 @@ static NTSTATUS idmap_set_mapping(DOM_SID *sid, unid_t id, int id_type) } /* Get ID from SID */ -NTSTATUS idmap_get_id_from_sid(unid_t *id, int *id_type, DOM_SID *sid) +NTSTATUS idmap_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) { NTSTATUS ret; int loc_type; - if (!load_methods()) return NT_STATUS_UNSUCCESSFUL; - loc_type = *id_type; - if (remote_repo) { /* We have a central remote idmap */ + if (remote_map) { /* We have a central remote idmap */ loc_type |= ID_NOMAP; } - ret = local_cache->get_id_from_sid(id, &loc_type, sid); + ret = local_map->get_id_from_sid(id, &loc_type, sid); if (NT_STATUS_IS_ERR(ret)) { - if (remote_repo) { - ret = remote_repo->get_id_from_sid(id, id_type, sid); + if (remote_map) { + ret = remote_map->get_id_from_sid(id, id_type, sid); if (NT_STATUS_IS_ERR(ret)) { DEBUG(3, ("idmap_get_id_from_sid: error fetching id!\n")); + return ret; } else { loc_type |= ID_CACHE; idmap_set_mapping(sid, *id, loc_type); @@ -159,18 +141,17 @@ NTSTATUS idmap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) NTSTATUS ret; int loc_type; - if (!load_methods()) return NT_STATUS_UNSUCCESSFUL; - loc_type = id_type; - if (remote_repo) { + if (remote_map) { loc_type = id_type | ID_NOMAP; } - ret = local_cache->get_sid_from_id(sid, id, loc_type); + ret = local_map->get_sid_from_id(sid, id, loc_type); if (NT_STATUS_IS_ERR(ret)) { - if (remote_repo) { - ret = remote_repo->get_sid_from_id(sid, id, id_type); + if (remote_map) { + ret = remote_map->get_sid_from_id(sid, id, id_type); if (NT_STATUS_IS_ERR(ret)) { DEBUG(3, ("idmap_get_sid_from_id: unable to fetch sid!\n")); + return ret; } else { loc_type |= ID_CACHE; idmap_set_mapping(sid, id, loc_type); @@ -186,15 +167,13 @@ NTSTATUS idmap_close(void) { NTSTATUS ret; - if (!load_methods()) return NT_STATUS_UNSUCCESSFUL; - - ret = local_cache->close(); + ret = local_map->close(); if (NT_STATUS_IS_ERR(ret)) { DEBUG(3, ("idmap_close: failed to close local cache!\n")); } - if (remote_repo) { - ret = remote_repo->close(); + if (remote_map) { + ret = remote_map->close(); if (NT_STATUS_IS_ERR(ret)) { DEBUG(3, ("idmap_close: failed to close remote idmap repository!\n")); } @@ -206,9 +185,7 @@ NTSTATUS idmap_close(void) /* Dump backend status */ void idmap_status(void) { - if (load_methods()) { - local_cache->status(); - remote_repo->status(); - } + local_map->status(); + if (remote_map) remote_map->status(); } diff --git a/source3/sam/idmap_tdb.c b/source3/sam/idmap_tdb.c index 4af46ac8d3..72c602664c 100644 --- a/source3/sam/idmap_tdb.c +++ b/source3/sam/idmap_tdb.c @@ -37,7 +37,7 @@ /* Globals */ static TDB_CONTEXT *idmap_tdb; -struct idmap_state { +static struct idmap_state { /* User and group id pool */ @@ -183,7 +183,7 @@ static BOOL tdb_idmap_convert(const char *idmap_name) #endif /* Allocate either a user or group id from the pool */ -static NTSTATUS tdb_allocate_id(unid_t *id, int id_type) +static NTSTATUS db_allocate_id(unid_t *id, int id_type) { int hwm; @@ -229,7 +229,7 @@ static NTSTATUS tdb_allocate_id(unid_t *id, int id_type) } /* Get a sid from an id */ -static NTSTATUS tdb_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) +static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) { TDB_DATA key, data; fstring keystr; @@ -239,13 +239,13 @@ static NTSTATUS tdb_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) switch (id_type & ID_TYPEMASK) { case ID_USERID: - slprintf(keystr, sizeof(keystr), "UID %d", id.uid); - break; + slprintf(keystr, sizeof(keystr), "UID %d", id.uid); + break; case ID_GROUPID: - slprintf(keystr, sizeof(keystr), "GID %d", id.gid); - break; + slprintf(keystr, sizeof(keystr), "GID %d", id.gid); + break; default: - return NT_STATUS_UNSUCCESSFUL; + return NT_STATUS_UNSUCCESSFUL; } key.dptr = keystr; @@ -264,7 +264,7 @@ static NTSTATUS tdb_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) } /* Get an id from a sid */ -static NTSTATUS tdb_get_id_from_sid(unid_t *id, int *id_type, DOM_SID *sid) +static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, DOM_SID *sid) { TDB_DATA data, key; fstring keystr; @@ -288,7 +288,7 @@ static NTSTATUS tdb_get_id_from_sid(unid_t *id, int *id_type, DOM_SID *sid) /* Parse and return existing uid */ fstrcpy(scanstr, "UID %d"); - if (sscanf(data.dptr, scanstr, (*id).uid) == 1) { + if (sscanf(data.dptr, scanstr, &((*id).uid)) == 1) { /* uid ok? */ if (type == ID_EMPTY) { *id_type = ID_USERID; @@ -302,7 +302,7 @@ static NTSTATUS tdb_get_id_from_sid(unid_t *id, int *id_type, DOM_SID *sid) /* Parse and return existing gid */ fstrcpy(scanstr, "GID %d"); - if (sscanf(data.dptr, scanstr, (*id).gid) == 1) { + if (sscanf(data.dptr, scanstr, &((*id).gid)) == 1) { /* gid ok? */ if (type == ID_EMPTY) { *id_type = ID_GROUPID; @@ -318,7 +318,7 @@ idok: || (*id_type & ID_TYPEMASK) == ID_GROUPID)) { /* Allocate a new id for this sid */ - ret = tdb_allocate_id(id, *id_type); + ret = db_allocate_id(id, *id_type); if (NT_STATUS_IS_OK(ret)) { fstring keystr2; @@ -332,11 +332,11 @@ idok: data.dptr = keystr2; data.dsize = strlen(keystr2) + 1; - if (tdb_store(idmap_tdb, key, data, TDB_INSERT) == -1) { + if (tdb_store(idmap_tdb, key, data, TDB_REPLACE) == -1) { /* TODO: print tdb error !! */ return NT_STATUS_UNSUCCESSFUL; } - if (tdb_store(idmap_tdb, data, key, TDB_INSERT) == -1) { + if (tdb_store(idmap_tdb, data, key, TDB_REPLACE) == -1) { /* TODO: print tdb error !! */ return NT_STATUS_UNSUCCESSFUL; } @@ -344,11 +344,11 @@ idok: ret = NT_STATUS_OK; } } - + return ret; } -static NTSTATUS tdb_set_mapping(DOM_SID *sid, unid_t id, int id_type) +static NTSTATUS db_set_mapping(DOM_SID *sid, unid_t id, int id_type) { TDB_DATA ksid, kid; fstring ksidstr; @@ -387,7 +387,7 @@ static NTSTATUS tdb_set_mapping(DOM_SID *sid, unid_t id, int id_type) /***************************************************************************** Initialise idmap database. *****************************************************************************/ -static NTSTATUS tdb_idmap_init(const char *db_name) +static NTSTATUS db_idmap_init(const char *db_name) { /* Open tdb cache */ if (!(idmap_tdb = tdb_open_log(lock_path(db_name), 0, @@ -425,7 +425,7 @@ static NTSTATUS tdb_idmap_init(const char *db_name) } /* Close the tdb */ -static NTSTATUS tdb_idmap_close(void) +static NTSTATUS db_idmap_close(void) { if (idmap_tdb) { if (tdb_close(idmap_tdb) == 0) { @@ -449,7 +449,7 @@ static NTSTATUS tdb_idmap_close(void) #define DUMP_INFO 0 -static void tdb_idmap_status(void) +static void db_idmap_status(void) { int user_hwm, group_hwm; @@ -506,20 +506,20 @@ static void tdb_idmap_status(void) /* Display complete mapping of users and groups to rids */ } -struct idmap_methods tdb_idmap_methods = { +struct idmap_methods db_methods = { - tdb_idmap_init, - tdb_get_sid_from_id, - tdb_get_id_from_sid, - tdb_set_mapping, - tdb_idmap_close, - tdb_idmap_status + db_idmap_init, + db_get_sid_from_id, + db_get_id_from_sid, + db_set_mapping, + db_idmap_close, + db_idmap_status }; NTSTATUS idmap_reg_tdb(struct idmap_methods **meth) { - *meth = &tdb_idmap_methods; + *meth = &db_methods; return NT_STATUS_OK; } diff --git a/source3/sam/idmap_winbind.c b/source3/sam/idmap_winbind.c new file mode 100644 index 0000000000..a5ba658674 --- /dev/null +++ b/source3/sam/idmap_winbind.c @@ -0,0 +1,108 @@ +/* + Unix SMB/CIFS implementation. + + idmap Winbind backend + + Copyright (C) Simo Sorce 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_IDMAP + +/* Get a sid from an id */ +static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) { + switch (id_type & ID_TYPEMASK) { + case ID_USERID: + if (winbind_uid_to_sid(sid, id.uid)) { + return NT_STATUS_OK; + } + break; + case ID_GROUPID: + if (winbind_gid_to_sid(sid, id.gid)) { + return NT_STATUS_OK; + } + break; + default: + return NT_STATUS_INVALID_PARAMETER; + } + + return NT_STATUS_UNSUCCESSFUL; +} + +/* Get an id from a sid */ +static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) { + switch (*id_type & ID_TYPEMASK) { + case ID_USERID: + if (winbind_sid_to_uid(&((*id).uid), sid)) { + return NT_STATUS_OK; + } + break; + case ID_GROUPID: + if (winbind_sid_to_gid(&((*id).gid), sid)) { + return NT_STATUS_OK; + } + break; + default: + if (winbind_sid_to_uid(&((*id).uid), sid) || + winbind_sid_to_gid(&((*id).gid), sid)) { + return NT_STATUS_OK; + } + } + + return NT_STATUS_UNSUCCESSFUL; +} + +static NTSTATUS db_set_mapping(DOM_SID *sid, unid_t id, int id_type) { + return NT_STATUS_UNSUCCESSFUL; +} + +/***************************************************************************** + Initialise idmap database. +*****************************************************************************/ +static NTSTATUS db_init(const char *db_name) { + return NT_STATUS_OK; +} + +/* Close the tdb */ +static NTSTATUS db_close(void) { + return NT_STATUS_OK; +} + +static void db_status(void) { + return; +} + +struct idmap_methods winbind_methods = { + + db_init, + db_get_sid_from_id, + db_get_id_from_sid, + db_set_mapping, + db_close, + db_status + +}; + +NTSTATUS idmap_reg_winbind(struct idmap_methods **meth) +{ + *meth = &winbind_methods; + + return NT_STATUS_OK; +} + diff --git a/source3/smbd/server.c b/source3/smbd/server.c index 9d43db20c6..ae587ea251 100644 --- a/source3/smbd/server.c +++ b/source3/smbd/server.c @@ -856,6 +856,9 @@ static BOOL init_structs(void ) if (!init_registry()) exit(1); + if (!idmap_init(lp_idmap_backend())) + exit(1); + if(!initialize_password_db(False)) exit(1); diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c index b9cf0de3bd..0fa65f47ca 100644 --- a/source3/smbd/uid.c +++ b/source3/smbd/uid.c @@ -722,6 +722,33 @@ static void store_gid_sid_cache(const DOM_SID *psid, const enum SID_NAME_USE sid DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid) { +#ifdef WITH_IDMAP + unid_t id; + + DEBUG(10,("uid_to_sid: uid = [%d]\n", uid)); + + id.uid = uid; + if (NT_STATUS_IS_OK(idmap_get_sid_from_id(psid, id, ID_USERID))) { + DEBUG(10, ("uid_to_sid: sid = [%s]\n", sid_string_static(psid))); + return psid; + } + + /* If mapping is not found in idmap try with traditional method, + then stores the result in idmap. + We may add a switch in future to allow smooth migrations to + idmap-only db ---Simo */ + + become_root(); + psid = local_uid_to_sid(psid, uid); + unbecome_root(); + + DEBUG(10,("uid_to_sid: algorithmic %u -> %s\n", (unsigned int)uid, sid_string_static(psid))); + if (psid) + idmap_set_mapping(psid, id, ID_USERID); + + return psid; + +#else uid_t low, high; enum SID_NAME_USE sidtype; fstring sid; @@ -729,7 +756,7 @@ DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid) if (fetch_sid_from_uid_cache(psid, &sidtype, uid)) return psid; - if (lp_winbind_uid(&low, &high) && uid >= low && uid <= high) { + if (lp_idmap_uid(&low, &high) && uid >= low && uid <= high) { if (winbind_uid_to_sid(psid, uid)) { DEBUG(10,("uid_to_sid: winbindd %u -> %s\n", @@ -751,6 +778,7 @@ DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid) store_uid_sid_cache(psid, SID_NAME_USER, uid); return psid; +#endif } /***************************************************************** @@ -761,6 +789,33 @@ DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid) DOM_SID *gid_to_sid(DOM_SID *psid, gid_t gid) { +#ifdef WITH_IDMAP + unid_t id; + + DEBUG(10,("gid_to_sid: gid = [%d]\n", gid)); + + id.gid = gid; + if (NT_STATUS_IS_OK(idmap_get_sid_from_id(psid, id, ID_GROUPID))) { + DEBUG(10, ("gid_to_sid: sid = [%s]\n", sid_string_static(psid))); + return psid; + } + + /* If mapping is not found in idmap try with traditional method, + then stores the result in idmap. + We may add a switch in future to allow smooth migrations to + idmap-only db ---Simo */ + + become_root(); + psid = local_gid_to_sid(psid, gid); + unbecome_root(); + + DEBUG(10,("gid_to_sid: algorithmic %u -> %s\n", (unsigned int)gid, sid_string_static(psid))); + if (psid) + idmap_set_mapping(psid, id, ID_GROUPID); + + return psid; + +#else gid_t low, high; enum SID_NAME_USE sidtype; fstring sid; @@ -768,7 +823,7 @@ DOM_SID *gid_to_sid(DOM_SID *psid, gid_t gid) if (fetch_sid_from_gid_cache(psid, &sidtype, gid)) return psid; - if (lp_winbind_gid(&low, &high) && gid >= low && gid <= high) { + if (lp_idmap_gid(&low, &high) && gid >= low && gid <= high) { if (winbind_gid_to_sid(psid, gid)) { DEBUG(10,("gid_to_sid: winbindd %u -> %s\n", @@ -789,6 +844,7 @@ DOM_SID *gid_to_sid(DOM_SID *psid, gid_t gid) store_gid_sid_cache(psid, SID_NAME_DOM_GRP, gid); return psid; +#endif } /***************************************************************** @@ -800,6 +856,35 @@ DOM_SID *gid_to_sid(DOM_SID *psid, gid_t gid) BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype) { +#ifdef WITH_IDMAP + unid_t id; + int type; + + DEBUG(10,("sid_to_uid: sid = [%s]\n", sid_string_static(psid))); + + *sidtype = SID_NAME_USER; + + type = ID_USERID; + if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&id, &type, psid))) { + DEBUG(10,("sid_to_uid: uid = [%d]\n", id.uid)); + *puid = id.uid; + return True; + } + + if (sid_compare_domain(get_global_sam_sid(), psid) == 0) { + BOOL result; + become_root(); + result = local_sid_to_uid(puid, psid, sidtype); + unbecome_root(); + if (result) { + id.uid = *puid; + DEBUG(10,("sid_to_uid: uid = [%d]\n", id.uid)); + idmap_set_mapping(psid, id, ID_USERID); + return True; + } + } + return False; +#else fstring sid_str; if (fetch_uid_from_cache(puid, psid, *sidtype)) @@ -873,6 +958,7 @@ BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype) store_uid_sid_cache(psid, *sidtype, *puid); return True; +#endif } /***************************************************************** @@ -884,6 +970,37 @@ BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype) BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid, enum SID_NAME_USE *sidtype) { +#ifdef WITH_IDMAP + unid_t id; + int type; + + DEBUG(10,("sid_to_gid: sid = [%s]\n", sid_string_static(psid))); + + *sidtype = SID_NAME_ALIAS; + + type = ID_GROUPID; + if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&id, &type, psid))) { + DEBUG(10,("sid_to_gid: gid = [%d]\n", id.gid)); + *pgid = id.gid; + return True; + } + + if (sid_compare_domain(get_global_sam_sid(), psid) == 0) { + BOOL result; + become_root(); + result = local_sid_to_gid(pgid, psid, sidtype); + unbecome_root(); + if (result) { + id.gid = *pgid; + DEBUG(10,("sid_to_gid: gid = [%d]\n", id.gid)); + idmap_set_mapping(psid, id, ID_GROUPID); + return True; + } + } + + return False; + +#else fstring dom_name, name, sid_str; enum SID_NAME_USE name_type; @@ -944,5 +1061,6 @@ BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid, enum SID_NAME_USE *sidtype) store_gid_sid_cache(psid, *sidtype, *pgid); return True; +#endif } -- cgit From 4392be0a471df0e4f4a8c690dfc0754b1f9d4e05 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 11:06:42 +0000 Subject: Add const (This used to be commit 7dccd144b74d8c752a4b8c80fa5b3e6b2d11eaa2) --- source3/lib/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/lib/module.c b/source3/lib/module.c index 700de56953..763a5c2b2d 100644 --- a/source3/lib/module.c +++ b/source3/lib/module.c @@ -127,7 +127,7 @@ void init_modules(void) /************************************************************************* * This functions /path/to/foobar.so -> foobar ************************************************************************/ -void module_path_get_name(char *path, pstring name) +void module_path_get_name(const char *path, pstring name) { char *s; -- cgit From bf11814a57dff757d5816791593c55c9bd15a9e5 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 12:28:46 +0000 Subject: Renegerate docs after John's changes (This used to be commit 597b23e9fbbd4b5024d9d839151b9083efc02b5c) --- docs/Samba-Developers-Guide.pdf | 4 +- docs/Samba-HOWTO-Collection.pdf | 4 +- docs/htmldocs/Samba-HOWTO-Collection.html | 10208 ++++++++++++++-------------- 3 files changed, 4979 insertions(+), 5237 deletions(-) diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index e87b401c7b..ca67bef976 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -2728,7 +2728,7 @@ xref 0000186776 00000 n 0000186871 00000 n trailer -<<46ba5d3e7036cf10d354f2ef6c5f4150>]>> +<<93af2445d6880037f24b021f8ddba00f>]>> startxref 187413 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 85dcb89cb4..b2fbe18a31 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -6700,7 +6700,7 @@ xref 0000487741 00000 n 0000487855 00000 n trailer -<<59edfc9c992c6dc16325ed514a78f3f7>]>> +<<90de86fcfbc3ee411d8c68aedcf34015>]>> startxref 488808 %%EOF diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index ea080fbd79..c902d63bec 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -145,26 +145,32 @@ HREF="#AEN130" >

2.2. Use of the "Remote Announce" parameterHow browsing functions and how to deploy stable and +dependable browsing using Samba
2.3. Use of the "Remote Browse Sync" parameterUse of the "Remote Announce" parameter
2.4. Use of WINSUse of the "Remote Browse Sync" parameter
2.5. Do NOT use more than one (1) protocol on MS Windows machinesUse of WINS
2.6. Do NOT use more than one (1) protocol on MS Windows machines
2.7. Name Resolution Order
3.1. Introduction
3.2. Important Notes About Security
3.3. The smbpasswd Command
3.4. Plain text
3.5. TDB
3.6. LDAP
3.7. MySQL
3.8. Passdb XML plugin
4.1. Stand Alone Server
4.2. Domain Member Server
4.3. Domain Controller
5. Samba as Stand-Alone server (User and Share security level)Samba as Stand-Alone Server
5.1. User and Share security level
6.
6.1. Prerequisite Reading
6.2. Background
6.3. Configuring the Samba Domain Controller
6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
6.5. Common Problems and Errors
6.6. System Policies and Profiles
6.7. What other help can I get?
6.8. 6.7. Domain Control for Windows 9x/ME
6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
7. How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain Control
7.1. Prerequisite Reading
7.2. Background
7.3. What qualifies a Domain Controller on the network?
7.4. Can Samba be a Backup Domain Controller to an NT PDC?
7.5. How do I set up a Samba BDC?
8.1. Setup your smb.conf
8.2. Setup your /etc/krb5.conf
8.3. Create the computer account
8.4. Test your server setup
8.5. Testing with smbclient
8.6. Notes
9.1. Joining an NT Domain with Samba 3.0
9.2. Why is this better than security = server?
III. Optional configurationAdvanced Configuration
10. Integrating MS Windows networks with SambaSystem Policies
10.1. AgendaBasic System Policy Info
10.2. Name Resolution in a pure Unix/Linux world
10.3. Name resolution as used within MS Windows networking
10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba
10.5. MS Windows security options and how to configure -Samba for seemless integration
10.6. ConclusionsRoaming Profiles
11.1. Viewing and changing UNIX permissions using the NT security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask parameters
11.7. Interaction with the standard Samba file attribute mapping
12. Group mapping HOWTO
13. Configuring PAM for distributed but centrally managed authentication
12.1. 13.1. Samba and PAM
12.2. 13.2. Distributed Authentication
12.3. 13.3. PAM Configuration in smb.conf
13. Hosting a Microsoft Distributed File System tree on Samba
13.1. Instructions
14. Printing Support
14.1. Introduction
14.2. Configuration
14.3. The Imprints Toolset
14.4. Diagnosis
15.1. Introduction
15.2. CUPS - RAW Print Through Mode
15.3. The CUPS Filter Chains
15.4. CUPS Print Drivers and Devices
15.5. Limiting the number of pages users can print
15.6. Advanced Postscript Printing from MS Windows
15.7. Auto-Deletion of CUPS spool files
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.4. How Winbind Works
16.5. Installation and Configuration
16.6. Limitations
16.7. Conclusion
17. Integrating MS Windows networks with Samba
17.1. Name Resolution in a pure Unix/Linux world
17.2. Name resolution as used within MS Windows networking
18. Improved browsing in samba
17.1. 18.1. Overview of browsing
17.2. 18.2. Browsing support in samba
17.3. 18.3. Problem resolution
17.4. 18.4. Browsing across subnets
17.5. 18.5. Setting up a WINS server
17.6. 18.6. Setting up Browsing in a WORKGROUP
17.7. 18.7. Setting up Browsing in a DOMAIN
17.8. 18.8. Forcing samba to be the master
17.9. 18.9. Making samba the domain master
17.10. 18.10. Note about broadcast addresses
17.11. 18.11. Multiple interfaces
18. Stackable VFS modules19. Hosting a Microsoft Distributed File System tree on Samba
18.1. Introduction and configuration
18.2. Included modules
18.3. VFS modules available elsewhere19.1. Instructions
19. Group mapping HOWTO
20. Samba performance issuesStackable VFS modules
20.1. ComparisonsIntroduction and configuration
20.2. Socket optionsIncluded modules
20.3. Read size
20.4. Max xmit
20.5. Log level
20.6. Read raw
20.7. Write raw
20.8. Slow Clients
20.9. Slow Logins
20.10. Client tuningVFS modules available elsewhere
21. Creating Group Prolicy Files
21.1. Windows '9x
21.2. Windows NT 4
21.3. Windows 2000/XP
22. Securing Samba
22.1. 21.1. Introduction
22.2. 21.2. Using host based protection
22.3. 21.3. Using interface protection
22.4. 21.4. Using a firewall
22.5. 21.5. Using a IPC$ share deny
22.6. 21.6. Upgrading Samba
23. 22. Unicode/Charsets
23.1. 22.1. What are charsets and unicode?
23.2. 22.2. Samba and charsets
23. Samba performance issues
23.1. Comparisons
23.2. Socket options
23.3. Read size
23.4. Max xmit
23.5. Log level
23.6. Read raw
23.7. Write raw
23.8. Slow Clients
23.9. Slow Logins
23.10. Client tuning
24. Portability
24.1. HPUX
24.2. SCO Unix
24.3. DNIX
24.4. RedHat Linux Rembrandt-II
24.5. AIX
25.1. Macintosh clients?
25.2. OS2 Client
25.3. Windows for Workgroups
25.4. Windows '95/'98
25.5. Windows 2000 Service Pack 2
26.1. Access Samba source code via CVS
26.2. Accessing the samba sources via rsync and ftp
26.3. Building the Binaries
26.4. Starting the smbd and nmbd
27.1. Introduction
27.2. General info
27.3. Debug levels
27.4. Internal errors
27.5. Attaching to a running process
27.6. Patches
28.1. Introduction
28.2. Assumptions
28.3. Tests
28.4. Still having troubles?
2.2. Use of the "Remote Announce" parameterHow browsing functions and how to deploy stable and +dependable browsing using Samba
2.3. Use of the "Remote Browse Sync" parameterUse of the "Remote Announce" parameter
2.4. Use of WINSUse of the "Remote Browse Sync" parameter
2.5. Do NOT use more than one (1) protocol on MS Windows machinesUse of WINS
2.6. Do NOT use more than one (1) protocol on MS Windows machines
2.7. Name Resolution Order
3.1. Introduction
3.2. Important Notes About Security
3.2.1. Advantages of SMB Encryption
3.2.2. Advantages of non-encrypted passwords
3.3. The smbpasswd Command
3.4. Plain text
3.5. TDB
3.6. LDAP
3.6.1. Introduction
3.6.2. Introduction
3.6.3. Supported LDAP Servers
3.6.4. Schema and Relationship to the RFC 2307 posixAccount
3.6.5. Configuring Samba with LDAP
3.6.6. Accounts and Groups management
3.6.7. Security and sambaAccount
3.6.8. LDAP specials attributes for sambaAccounts
3.6.9. Example LDIF Entries for a sambaAccount
3.7. MySQL
3.7.1. Building
3.7.2. Creating the database
3.7.3. Configuring
3.7.4. Using plaintext passwords or encrypted password
3.7.5. Getting non-column data from the table
3.8. Passdb XML plugin
3.8.1. Building
3.8.2. Usage
2.2. Use of the "Remote Announce" parameter2.2. How browsing functions and how to deploy stable and +dependable browsing using Samba

The "remote announce" parameter of smb.conf can be used to forcibly ensure -that all the NetBIOS names on a network get announced to a remote network. -The syntax of the "remote announce" parameter is: -

	remote announce = a.b.c.d [e.f.g.h] ...
-_or_ -
	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
- -where: -

As stated above, MS Windows machines register their NetBIOS names +(i.e.: the machine name for each service type in operation) on start +up. Also, as stated above, the exact method by which this name registration +takes place is determined by whether or not the MS Windows client/server +has been given a WINS server address, whether or not LMHOSTS lookup +is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

In the case where there is no WINS server all name registrations as +well as name lookups are done by UDP broadcast. This isolates name +resolution to the local subnet, unless LMHOSTS is used to list all +names and IP addresses. In such situations Samba provides a means by +which the samba server name may be forcibly injected into the browse +list of a remote MS Windows network (using the "remote announce" parameter).

Where a WINS server is used, the MS Windows client will use UDP +unicast to register with the WINS server. Such packets can be routed +and thus WINS allows name resolution to function across routed networks.

During the startup process an election will take place to create a +local master browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the domain master browser. This +domain browsing has nothing to do with MS security domain control. +Instead, the domain master browser serves the role of contacting each local +master browser (found by asking WINS or from LMHOSTS) and exchanging browse +list contents. This way every master browser will eventually obtain a complete +list of all machines that are on the network. Every 11-15 minutes an election +is held to determine which machine will be the master browser. By the nature of +the election criteria used, the machine with the highest uptime, or the +most senior protocol version, or other criteria, will win the election +as domain master browser.

Clients wishing to browse the network make use of this list, but also depend +on the availability of correct name resolution to the respective IP +address/addresses.

Any configuration that breaks name resolution and/or browsing intrinsics +will annoy users because they will have to put up with protracted +inability to use the network services.

Samba supports a feature that allows forced synchonisation +of browse lists across routed networks using the "remote +browse sync" parameter in the smb.conf file. This causes Samba +to contact the local master browser on a remote network and +to request browse list synchronisation. This effectively bridges +two networks that are separated by routers. The two remote +networks may use either broadcast based name resolution or WINS +based name resolution, but it should be noted that the "remote +browse sync" parameter provides browse list synchronisation - and +that is distinct from name to address resolution, in other +words, for cross subnet browsing to function correctly it is +essential that a name to address resolution mechanism be provided. +This mechanism could be via DNS, /etc/hosts, +and so on.

2.3. Use of the "Remote Announce" parameter

The "remote announce" parameter of smb.conf can be used to forcibly ensure +that all the NetBIOS names on a network get announced to a remote network. +The syntax of the "remote announce" parameter is: +

	remote announce = a.b.c.d [e.f.g.h] ...
+_or_ +
	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
+ +where: +

a.b.c.d and e.f.g.h

2.3. Use of the "Remote Browse Sync" parameter2.4. Use of the "Remote Browse Sync" parameter

The "remote browse sync" parameter of smb.conf is used to announce to @@ -1921,8 +1972,8 @@ CLASS="SECT1" >

2.4. Use of WINS2.5. Use of WINS

Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly @@ -1984,8 +2035,8 @@ CLASS="SECT1" >

2.5. Do NOT use more than one (1) protocol on MS Windows machines2.6. Do NOT use more than one (1) protocol on MS Windows machines

A very common cause of browsing problems results from installing more than @@ -2027,8 +2078,8 @@ CLASS="SECT1" >

2.6. Name Resolution Order2.7. Name Resolution Order

Resolution of NetBIOS names to IP addresses can take place using a number @@ -2118,7 +2169,7 @@ CLASS="SECT1" >

3.1. Introduction

3.2. Important Notes About Security

3.2.1. Advantages of SMB Encryption

3.2.2. Advantages of non-encrypted passwords

3.3. The smbpasswd Command

3.4. Plain text

3.5. TDB

3.6. LDAP

3.6.1. Introduction

3.6.2. Introduction

3.6.3. Supported LDAP Servers

3.6.4. Schema and Relationship to the RFC 2307 posixAccount

3.6.5. Configuring Samba with LDAP

3.6.5.1. OpenLDAP configuration

3.6.5.2. Configuring Samba

3.6.6. Accounts and Groups management

3.6.7. Security and sambaAccount

3.6.8. LDAP specials attributes for sambaAccounts

3.6.9. Example LDIF Entries for a sambaAccount

3.7. MySQL

3.7.1. Building

3.7.2. Creating the database

3.7.3. Configuring

3.7.4. Using plaintext passwords or encrypted password

3.7.5. Getting non-column data from the table

3.8. Passdb XML plugin

3.8.1. Building

3.8.2. Usage

Introduction

4.1. Stand Alone Server
4.2. Domain Member Server
4.3. Domain Controller
4.3.1. Domain Controller Types
5. Samba as Stand-Alone server (User and Share security level)Samba as Stand-Alone Server
5.1. User and Share security level
5.1.1. User Level Security
5.1.2. Share Level Security
5.1.3. Server Level Security
5.1.4. Domain Level Security
5.1.5. ADS Level Security
6. Samba as an NT4 or Win2k Primary Domain Controller
6.1. Prerequisite Reading
6.2. Background
6.3. Configuring the Samba Domain Controller
6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
6.4.1. Manual Creation of Machine Trust Accounts
6.4.2. "On-the-Fly" Creation of Machine Trust Accounts
6.4.3. Joining the Client to the Domain
6.5. Common Problems and Errors
6.6. System Policies and Profiles
6.7. What other help can I get?
6.8. 6.7. Domain Control for Windows 9x/ME
6.8.1. 6.7.1. Configuration Instructions: Network Logons
6.8.2. Configuration Instructions: Setting up Roaming User Profiles
6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
7. How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain Control
7.1. Prerequisite Reading
7.2. Background
7.3. What qualifies a Domain Controller on the network?
7.3.1. How does a Workstation find its domain controller?
7.3.2. When is the PDC needed?
7.4. Can Samba be a Backup Domain Controller to an NT PDC?
7.5. How do I set up a Samba BDC?
7.5.1. How do I replicate the smbpasswd file?
7.5.2. Can I do this all with LDAP?
8.1. Setup your smb.conf
8.2. Setup your /etc/krb5.conf
8.3. Create the computer account
8.3.1. Possible errors
8.4. Test your server setup
8.5. Testing with smbclient
8.6. Notes
9.1. Joining an NT Domain with Samba 3.0
9.2. Why is this better than security = server?

4.1. Stand Alone Server

No special action is needed other than to create user accounts. Stand-alone +servers do NOT provide network logon services, meaning that machines that +use this server do NOT perform a domain logon but instead make use only of +the MS Windows logon which is local to the MS Windows workstation/server.

Samba tends to blur the distinction a little in respect of what is a stand alone server. This is because the authentication database may be local or on a remote server, even if from the samba protocol perspective @@ -4025,7 +4104,7 @@ CLASS="SECT1" >

4.2. Domain Member Server

4.3. Domain Controller

4.3.1. Domain Controller Types

Chapter 5. Samba as Stand-Alone server (User and Share security level)Chapter 5. Samba as Stand-Alone Server

In this section the function and purpose of Samba's security +modes are described.

5.1. User and Share security level

A SMB server tells the client at startup what "security level" it is running. There are two options "share level" and "user level". Which @@ -4158,6 +4254,14 @@ strange, but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed.

5.1.1. User Level Security

I'll describe user level security first, as its simpler. In user level security the client will send a "session setup" command directly after @@ -4190,6 +4294,15 @@ requests. When the server responds it gives the client a "uid" to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this)

5.1.2. Share Level Security

Ok, now for share level security. In share level security the client authenticates itself separately for each share. It will send a @@ -4212,6 +4325,15 @@ home directories) and any users listed in the "user =" smb.conf line. The password is then checked in turn against these "possible usernames". If a match is found then the client is authenticated as that user.

5.1.3. Server Level Security

Finally "server level" security. In server level security the samba server reports to the client that it is in user level security. The @@ -4240,104 +4362,379 @@ requests to another "user mode" server. This requires an additional parameter "password server =" that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support.

Chapter 6. Samba as an NT4 or Win2k Primary Domain Controller

6.1. Prerequisite Reading

5.1.3.1. Configuring Samba for Seemless Windows Network Integration

Before you continue reading in this chapter, please make sure -that you are comfortable with configuring basic files services -in smb.conf and how to enable and administer password -encryption in Samba. Theses two topics are covered in the -smb.conf(5) -manpage.

6.2. Background

MS Windows clients may use encrypted passwords as part of a challenege/response +authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple +password based authentication. It should be realized that with the SMB protocol +the password is passed over the network either in plain text or encrypted, but +not both in the same authentication requests.

This article outlines the steps necessary for configuring Samba as a PDC. -It is necessary to have a working Samba server prior to implementing the -PDC functionality.

When encrypted passwords are used a password that has been entered by the user +is encrypted in two ways:

  • domain logons for Windows NT 4.0 / 200x / XP Professional clients. -

  • placing Windows 9x / Me clients in user level security -

  • retrieving a list of users and groups from a Samba PDC to - Windows 9x / Me / NT / 200x / XP Professional clients -

  • roaming user profiles +>An MD4 hash of the UNICODE of the password + string. This is known as the NT hash.

  • Windows NT 4.0-style system policies +>The password is converted to upper case, + and then padded or trucated to 14 bytes. This string is + then appended with 5 bytes of NULL characters and split to + form two 56 bit DES keys to encrypt a "magic" 8 byte value. + The resulting 16 bytes for the LanMan hash.

The following functionalities are new to the Samba 3.0 release:

  • MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 +pre-service pack 3 will use either mode of password authentication. All +versions of MS Windows that follow these versions no longer support plain +text passwords by default.

    Windows NT 4 domain trusts -

  • MS Windows clients have a habit of dropping network mappings that have been idle +for 10 minutes or longer. When the user attempts to use the mapped drive +connection that has been dropped, the client re-establishes the connection using +a cached copy of the password.

    Adding users via the User Manager for Domains -

When Microsoft changed the default password mode, support was dropped for caching +of the plain text password. This means that when the registry parameter is changed +to re-enable use of plain text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate it will fail if the remote +authentication server does not support encrypted passwords. This means that it +is definitely not a good idea to re-enable plain text password support in such clients.

The following functionalities are NOT provided by Samba 3.0:

The following parameters can be used to work around the issue of Windows 9x client +upper casing usernames and password before transmitting them to the SMB server +when using clear text authentication.

	passsword level = integer
+	username level = integer

  • SAM replication with Windows NT 4.0 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) +>By default Samba will lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower case character, the username level parameter +is rarely needed.

    However, passwords on UNIX systems often make use of mixed case characters. +This means that in order for a user on a Windows 9x client to connect to a Samba +server using clear text authentication, the password level +must be set to the maximum number of upper case letter which could +appear is a password. Note that is the server OS uses the traditional DES version +of crypt(), then a password level of 8 will result in case +insensitive passwords as seen from Windows users. This will also result in longer +login times as Samba hash to compute the permutations of the password string and +try them one by one until a match is located (or all combinations fail).

    The best option to adopt is to enable support for encrypted passwords +where ever Samba is used. There are three configuration possibilities +for support of encrypted passwords:

5.1.3.2. Use MS Windows NT as an authentication server

This method involves the additions of the following parameters in the smb.conf file:

	encrypt passwords = Yes
+	security = server
+	password server = "NetBIOS_name_of_PDC"

There are two ways of identifying whether or not a username and +password pair was valid or not. One uses the reply information provided +as part of the authentication messaging process, the other uses +just and error code.

The down-side of this mode of configuration is the fact that +for security reasons Samba will send the password server a bogus +username and a bogus password and if the remote server fails to +reject the username and password pair then an alternative mode +of identification of validation is used. Where a site uses password +lock out after a certain number of failed authentication attempts +this will result in user lockouts.

Use of this mode of authentication does require there to be +a standard Unix account for the user, this account can be blocked +to prevent logons by other than MS Windows clients.

5.1.4. Domain Level Security

When samba is operating in security = domain mode this means that +the Samba server has a domain security trust account (a machine account) and will cause +all authentication requests to be passed through to the domain controllers.

5.1.4.1. Samba as a member of an MS Windows NT security domain

This method involves additon of the following paramters in the smb.conf file:

	encrypt passwords = Yes
+	security = domain
+	workgroup = "name of NT domain"
+	password server = *

The use of the "*" argument to "password server" will cause samba to locate the +domain controller in a way analogous to the way this is done within MS Windows NT. +This is the default behaviour.

In order for this method to work the Samba server needs to join the +MS Windows NT security domain. This is done as follows:

  • On the MS Windows NT domain controller using + the Server Manager add a machine account for the Samba server. +

  • Next, on the Linux system execute: + smbpasswd -r PDC_NAME -j DOMAIN_NAME +

Use of this mode of authentication does require there to be a standard Unix account +for the user in order to assign a uid once the account has been authenticated by +the remote Windows DC. This account can be blocked to prevent logons by other than +MS Windows clients by things such as setting an invalid shell in the +/etc/passwd entry.

An alternative to assigning UIDs to Windows users on a Samba member server is +presented in the Winbind Overview chapter +in this HOWTO collection.

5.1.5. ADS Level Security

For information about the configuration option please refer to the entire section entitled +Samba as an ADS Domain Member.

Chapter 6. Samba as an NT4 or Win2k Primary Domain Controller

6.1. Prerequisite Reading

Before you continue reading in this chapter, please make sure +that you are comfortable with configuring basic files services +in smb.conf and how to enable and administer password +encryption in Samba. Theses two topics are covered in the +smb.conf(5) +manpage.

6.2. Background

This article outlines the steps necessary for configuring Samba as a PDC. +It is necessary to have a working Samba server prior to implementing the +PDC functionality.

  • Domain logons for Windows NT 4.0 / 200x / XP Professional clients. +

  • Placing Windows 9x / Me clients in user level security +

  • Retrieving a list of users and groups from a Samba PDC to + Windows 9x / Me / NT / 200x / XP Professional clients +

  • Roaming Profiles +

  • Network/System Policies +

Roaming Profiles and System/Network policies are advanced network administration topics +that are covered separately in this document.

The following functionalities are new to the Samba 3.0 release:

  • Windows NT 4 domain trusts +

  • Adding users via the User Manager for Domains +

The following functionalities are NOT provided by Samba 3.0:

  • SAM replication with Windows NT 4.0 Domain Controllers + (i.e. a Samba PDC and a Windows NT BDC or vice versa)

  • 6.3. Configuring the Samba Domain Controller

    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain

    6.4.1. Manual Creation of Machine Trust Accounts

    6.4.2. "On-the-Fly" Creation of Machine Trust Accounts

    6.4.3. Joining the Client to the Domain

    6.5. Common Problems and Errors

    I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your + can not log you on (C000019B), Please try again or consult your system administrator" when attempting to logon.

    This occurs when the domain SID stored in - private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. +> This occurs when the domain SID stored in the secrets.tdb database + is changed. The most common cause of a change in domain SID is when + the domain name and/or the server name (netbios name) is changed. + The only way to correct the problem is to restore the original domain + SID or remove the domain client from the domain and rejoin. The domain + SID may be reset using either the smbpasswd or rpcclient utilities.

  • 6.6. System Policies and Profiles

    Much of the information necessary to implement System Policies and -Roving User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft.

    Here are some additional details:

    • What about Windows NT Policy Editor? -

      To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. -

      The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. -

    • Can Win95 do Policies? -

      Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... -

      If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. -

    • How do I get 'User Manager' and 'Server Manager' -

      Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? -

      Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes -

      • Server Manager

      • User Manager for Domains

      • Event Viewer

      Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

      The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

6.7. What other help can I get?6.6. What other help can I get?

There are many sources of information available in the form @@ -5857,62 +6070,27 @@ CLASS="SECT1" >

6.8. Domain Control for Windows 9x/ME6.7. Domain Control for Windows 9x/ME

The following section contains much of the original -DOMAIN.txt file previously included with Samba. Much of -the material is based on what went into the book Special -Edition, Using Samba, by Richard Sharpe.

A domain and a workgroup are exactly the same thing in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they -successfully authenticate against a domain logon server (NT server and -other systems based on NT server support this, as does at least Samba TNG now).

The SMB client logging on to a domain has an expectation that every other server in the domain should accept the same authentication information. -Network browsing functionality of domains and workgroups is -identical and is explained in BROWSING.txt. It should be noted, that browsing -is totally orthogonal to logon support.

Issues related to the single-logon network model are discussed in this section. Samba supports domain logons, network logon scripts, and user profiles for MS Windows for workgroups and MS Windows 9X/ME clients -which will be the focus of this section.

When an SMB client in a domain wishes to logon it broadcast requests for a logon server. The first one to reply gets the job, and validates its @@ -5991,8 +6169,8 @@ CLASS="SECT2" >

6.8.1. Configuration Instructions: Network Logons6.7.1. Configuration Instructions: Network Logons

The main difference between a PDC and a Windows 9x logon @@ -6092,1443 +6270,746 @@ for its domain.

6.8.2. Configuration Instructions: Setting up Roaming User Profiles

Chapter 7. Samba Backup Domain Controller to Samba Domain Control

7.1. Prerequisite Reading

NOTE! Roaming profiles support is different -for Win9X and WinNT.

Before you continue reading in this chapter, please make sure +that you are comfortable with configuring a Samba PDC +as described in the Samba-PDC-HOWTO.

Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features.

Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory.

WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT.

6.8.2.1. Windows NT Configuration

7.2. Background

To support WinNT clients, in the [global] section of smb.conf set the -following (for example):

What is a Domain Controller? It is a machine that is able to answer +logon requests from workstations in a Windows NT Domain. Whenever a +user logs into a Windows NT Workstation, the workstation connects to a +Domain Controller and asks him whether the username and password the +user typed in is correct. The Domain Controller replies with a lot of +information about the user, for example the place where the users +profile is stored, the users full name of the user. All this +information is stored in the NT user database, the so-called SAM.

There are two kinds of Domain Controller in a NT 4 compatible Domain: +A Primary Domain Controller (PDC) and one or more Backup Domain +Controllers (BDC). The PDC contains the master copy of the +SAM. Whenever the SAM has to change, for example when a user changes +his password, this change has to be done on the PDC. A Backup Domain +Controller is a machine that maintains a read-only copy of the +SAM. This way it is able to reply to logon requests and authenticate +users in case the PDC is not available. During this time no changes to +the SAM are possible. Whenever changes to the SAM are done on the PDC, +all BDC receive the changes from the PDC.

Since version 2.2 Samba officially supports domain logons for all +current Windows Clients, including Windows 2000 and XP. This text +assumes the domain to be named SAMBA. To be able to act as a PDC, some +parameters in the [global]-section of the smb.conf have to be set:

logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
workgroup = SAMBA +domain master = yes +domain logons = yes

The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable.

Several other things like a [homes] and a [netlogon] share also may be +set along with settings for the profile path, the users home drive and +others. This will not be covered in this document.

7.3. What qualifies a Domain Controller on the network?

Every machine that is a Domain Controller for the domain SAMBA has to +register the NetBIOS group name SAMBA#1c with the WINS server and/or +by broadcast on the local network. The PDC also registers the unique +NetBIOS name SAMBA#1b with the WINS server. The name type #1b is +normally reserved for the domain master browser, a role that has +nothing to do with anything related to authentication, but the +Microsoft Domain implementation requires the domain master browser to +be on the same machine as the PDC.

7.3.1. How does a Workstation find its domain controller?

[lkcl 26aug96 - we have discovered a problem where Windows clients can -maintain a connection to the [homes] share in between logins. The -[homes] share must NOT therefore be used in a profile path.]

A NT workstation in the domain SAMBA that wants a local user to be +authenticated has to find the domain controller for SAMBA. It does +this by doing a NetBIOS name query for the group name SAMBA#1c. It +assumes that each of the machines it gets back from the queries is a +domain controller and can answer logon requests. To not open security +holes both the workstation and the selected (TODO: How is the DC +chosen) domain controller authenticate each other. After that the +workstation sends the user's credentials (his name and password) to +the domain controller, asking for approval.

6.8.2.2. Windows 9X Configuration

To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use/home" now works as well, and it, too, relies -on the "logon home" parameter.

By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file:

logon home = \\%L\%U\.profiles

then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden).

7.3.2. When is the PDC needed?

Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home".

Whenever a user wants to change his password, this has to be done on +the PDC. To find the PDC, the workstation does a NetBIOS name query +for SAMBA#1b, assuming this machine maintains the master copy of the +SAM. The workstation contacts the PDC, both mutually authenticate and +the password change is done.

6.8.2.3. Win9X and WinNT Configuration

You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example:

7.4. Can Samba be a Backup Domain Controller to an NT PDC?

logon home = \\%L\%U\.profiles
-logon path = \\%L\profiles\%U

With version 2.2, no. The native NT SAM replication protocols have +not yet been fully implemented. The Samba Team is working on +understanding and implementing the protocols, but this work has not +been finished for version 2.2.

With version 3.0, the work on both the replication protocols and a +suitable storage mechanism has progressed, and some form of NT4 BDC +support is expected soon.

I have not checked what 'net use /home' does on NT when "logon home" is -set as above.

Can I get the benefits of a BDC with Samba? Yes. The main reason for +implementing a BDC is availability. If the PDC is a Samba machine, +a second Samba machine can be set up to +service logon requests whenever the PDC is down.

6.8.2.4. Windows 9X Profile Setup

When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.

7.5. How do I set up a Samba BDC?

The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.

Several things have to be done:

    • On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

      The domain SID has to be the same on the PDC and the BDC. This used to +be stored in the file private/MACHINE.SID. This file is not created +anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is +stored in the file private/secrets.tdb. Simply copying the secrets.tdb +from the PDC to the BDC does not work, as the BDC would +generate a new SID for itself and override the domain SID with this +new BDC SID.

      To retrieve the domain SID from the PDC or an existing BDC and store it in the +secrets.tdb, execute 'net rpc getsid' on the BDC.

    • On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. -

      The Unix user database has to be synchronized from the PDC to the +BDC. This means that both the /etc/passwd and /etc/group have to be +replicated from the PDC to the BDC. This can be done manually +whenever changes are made, or the PDC is set up as a NIS master +server and the BDC as a NIS slave server. To set up the BDC as a +mere NIS client would not be enough, as the BDC would not be able to +access its user database in case of a PDC failure.

Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me.

  • You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.

    The Samba password database in the file private/smbpasswd has to be +replicated from the PDC to the BDC. This is a bit tricky, see the +next section.

  • Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.

    Any netlogon share has to be replicated from the PDC to the +BDC. This can be done manually whenever login scripts are changed, +or it can be done automatically together with the smbpasswd +synchronization.

    • Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.

    Finally, the BDC has to be found by the workstations. This can be done +by setting

    These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.

    workgroup = samba
+domain master = no
+domain logons = yes

    If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.

    in the [global]-section of the smb.conf of the BDC. This makes the BDC +only register the name SAMBA#1c with the WINS server. This is no +problem as the name SAMBA#1c is a NetBIOS group name that is meant to +be registered by more than one machine. The parameter 'domain master = +no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS +name is reserved for the Primary Domain Controller.

    7.5.1. How do I replicate the smbpasswd file?

    If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".

    Replication of the smbpasswd file is sensitive. It has to be done +whenever changes to the SAM are made. Every user's password change is +done in the smbpasswd file and has to be replicated to the BDC. So +replicating the smbpasswd file very often is necessary.

    1. As the smbpasswd file contains plain text password equivalents, it +must not be sent unencrypted over the wire. The best way to set up +smbpasswd replication from the PDC to the BDC is to use the utility +rsync. rsync can use ssh as a transport. ssh itself can be set up to +accept *only* rsync transfer without requiring the user to type a +password.

    7.5.2. Can I do this all with LDAP?

    instead of logging in under the [user, password, domain] dialog, - press escape. -

  • The simple answer is YES. Samba's pdb_ldap code supports +binding to a replica LDAP server, and will also follow referrals and +rebind to the master if it ever needs to make a modification to the +database. (Normally BDCs are read only, so this will not occur +often).

    • Chapter 8. Samba as a ADS domain member

    run the regedit.exe program, and look in: -

    This is a rough guide to setting up Samba 3.0 with kerberos authentication against a +Windows2000 KDC.

    8.1. Setup your smb.conf

    HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

    You must use at least the following 3 options in smb.conf:

    you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - 

      realm = YOUR.KERBEROS.REALM
+  security = ADS
+  encrypt passwords = yes

    [Exit the registry editor]. -

  • In case samba can't figure out your ads server using your realm name, use the +ads server option in smb.conf: +
      ads server = your.kerberos.server

    WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). -

    You do *not* need a smbpasswd file, and older clients will + be authenticated as if "security = domain", although it won't do any harm + and allows you to have local users not in the domain. + I expect that the above required options will change soon when we get better + active directory integration.

    • 8.2. Setup your /etc/krb5.conf

    This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

  • The minimal configuration for krb5.conf is:

    search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. - 

  • [realms]
+    YOUR.KERBEROS.REALM = {
+	kdc = your.kerberos.server
+    }

    log off the windows 95 client. -

  • Test your config by doing a "kinit USERNAME@REALM" and making sure that + your password is accepted by the Win2000 KDC.

    check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

    • NOTE: The realm must be uppercase.

    If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports.

    You also must ensure that you can do a reverse DNS lookup on the IP +address of your KDC. Also, the name that this reverse lookup maps to +must either be the netbios name of the KDC (ie. the hostname with no +domain attached) or it can alternatively be the netbios name +followed by the realm.

    If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace.

    The easiest way to ensure you get this right is to add a /etc/hosts +entry mapping the IP address of your KDC to its netbios name. If you +don't get this right then you will get a "local error" when you try +to join the realm.

    If all you want is kerberos support in smbclient then you can skip +straight to step 5 now. Step 3 is only needed if you want kerberos +support for smbd and winbindd.

    6.8.2.5. Windows NT Workstation 4.0

    8.3. Create the computer account

    When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.

    As a user that has write permission on the Samba private directory +(usually root) run: +net ads join

    8.3.1. Possible errors

    [lkcl 10aug97 - i tried setting the path to -\\samba-server\homes\profile, and discovered that this fails because -a background process maintains the connection to the [homes] share -which does _not_ close down in between user logins. you have to -have \\samba-server\%L\profile, where user is the username created -from the [homes] share].

    There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter.

    The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension) -[lkcl 10aug97 - i found that the creation of the .PDS directory failed, -and had to create these manually for each user, with a shell script. -also, i presume, but have not tested, that the full profile path must -be browseable just as it is for w95, due to the manner in which they -attempt to create the full profile path: test existence of each path -component; create path component].

    In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.

    You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.

    "ADS support not compiled in"

    Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.

    [lkcl 10aug97 - i notice that NT Workstation tells me that it is -downloading a profile from a slow link. whether this is actually the -case, or whether there is some configuration issue, as yet unknown, -that makes NT Workstation _think_ that the link is a slow one is a -matter to be resolved].

    [lkcl 20aug97 - after samba digest correspondence, one user found, and -another confirmed, that profiles cannot be loaded from a samba server -unless "security = user" and "encrypt passwords = yes" (see the file -ENCRYPTION.txt) or "security = server" and "password server = ip.address. -of.yourNTserver" are used. Either of these options will allow the NT -workstation to access the samba server using LAN manager encrypted -passwords, without the user intervention normally required by NT -workstation for clear-text passwords].

    [lkcl 25aug97 - more comments received about NT profiles: the case of -the profile _matters_. the file _must_ be called NTuser.DAT or, for -a mandatory profile, NTuser.MAN].

    6.8.2.6. Windows NT Server

    8.4. Test your server setup

    There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.

    On a Windows 2000 client try net use * \\server\share. You should +be logged in with kerberos without needing to know a password. If +this fails then run klist tickets. Did you get a ticket for the +server? Does it have an encoding type of DES-CBC-MD5 ?

    6.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0

    Potentially outdated or incorrect material follows
     

    I think this is all bogus, but have not deleted it. (Richard Sharpe)

    The default logon path is \\%N\%U. NT Workstation will attempt to create -a directory "\\samba-server\username.PDS" if you specify the logon path -as "\\samba-server\username" with the NT User Manager. Therefore, you -will need to specify (for example) "\\samba-server\username\profile". -NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which -is more likely to succeed.

    If you then want to share the same Start Menu / Desktop with W95, you will -need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97 -this has its drawbacks: i created a shortcut to telnet.exe, which attempts -to run from the c:\winnt\system32 directory. this directory is obviously -unlikely to exist on a Win95-only host].

    If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.

    8.5. Testing with smbclient

    [lkcl 25aug97 - there are some issues to resolve with downloading of -NT profiles, probably to do with time/date stamps. i have found that -NTuser.DAT is never updated on the workstation after the first time that -it is copied to the local workstation profile directory. this is in -contrast to w95, where it _does_ transfer / update profiles correctly].

    On your Samba server try to login to a Win2000 server or your Samba +server using smbclient and kerberos. Use smbclient as usual, but +specify the -k option to choose kerberos authentication.

    6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba8.6. Notes

    Possibly Outdated Material
     

    This appendix was originally authored by John H Terpstra of - the Samba Team and is included here for posterity. -

    NOTE : -The term "Domain Controller" and those related to it refer to one specific -method of authentication that can underly an SMB domain. Domain Controllers -prior to Windows NT Server 3.1 were sold by various companies and based on -private extensions to the LAN Manager 2.1 protocol. Windows NT introduced -Microsoft-specific ways of distributing the user authentication database. -See DOMAIN.txt for examples of how Samba can participate in or create -SMB domains based on shared authentication database schemes other than the -Windows NT SAM.

    Windows NT Server can be installed as either a plain file and print server -(WORKGROUP workstation or server) or as a server that participates in Domain -Control (DOMAIN member, Primary Domain controller or Backup Domain controller). -The same is true for OS/2 Warp Server, Digital Pathworks and other similar -products, all of which can participate in Domain Control along with Windows NT.

    To many people these terms can be confusing, so let's try to clear the air.

    Every Windows NT system (workstation or server) has a registry database. -The registry contains entries that describe the initialization information -for all services (the equivalent of Unix Daemons) that run within the Windows -NT environment. The registry also contains entries that tell application -software where to find dynamically loadable libraries that they depend upon. -In fact, the registry contains entries that describes everything that anything -may need to know to interact with the rest of the system.

    The registry files can be located on any Windows NT machine by opening a -command prompt and typing:

    C:\WINNT\> dir %SystemRoot%\System32\config

    The environment variable %SystemRoot% value can be obtained by typing:

    C:\WINNT>echo %SystemRoot%

    The active parts of the registry that you may want to be familiar with are -the files called: default, system, software, sam and security.

    In a domain environment, Microsoft Windows NT domain controllers participate -in replication of the SAM and SECURITY files so that all controllers within -the domain have an exactly identical copy of each.

    The Microsoft Windows NT system is structured within a security model that -says that all applications and services must authenticate themselves before -they can obtain permission from the security manager to do what they set out -to do.

    The Windows NT User database also resides within the registry. This part of -the registry contains the user's security identifier, home directory, group -memberships, desktop profile, and so on.

    Every Windows NT system (workstation as well as server) will have its own -registry. Windows NT Servers that participate in Domain Security control -have a database that they share in common - thus they do NOT own an -independent full registry database of their own, as do Workstations and -plain Servers.

    The User database is called the SAM (Security Access Manager) database and -is used for all user authentication as well as for authentication of inter- -process authentication (i.e. to ensure that the service action a user has -requested is permitted within the limits of that user's privileges).

    The Samba team have produced a utility that can dump the Windows NT SAM into -smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and -/pub/samba/pwdump on your nearest Samba mirror for the utility. This -facility is useful but cannot be easily used to implement SAM replication -to Samba systems.

    Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers -can participate in a Domain security system that is controlled by Windows NT -servers that have been correctly configured. Almost every domain will have -ONE Primary Domain Controller (PDC). It is desirable that each domain will -have at least one Backup Domain Controller (BDC).

    You must change administrator password at least once after DC +install, to create the right encoding types

    The PDC and BDCs then participate in replication of the SAM database so that -each Domain Controlling participant will have an up to date SAM component -within its registry.

    w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in + their defaults DNS setup. Maybe fixed in service packs?

    Chapter 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain

    Chapter 9. Samba as a NT4 or Win2k domain member

    7.1. Prerequisite Reading

    Before you continue reading in this chapter, please make sure -that you are comfortable with configuring a Samba PDC -as described in the Samba-PDC-HOWTO.

    7.2. Background9.1. Joining an NT Domain with Samba 3.0

    What is a Domain Controller? It is a machine that is able to answer -logon requests from workstations in a Windows NT Domain. Whenever a -user logs into a Windows NT Workstation, the workstation connects to a -Domain Controller and asks him whether the username and password the -user typed in is correct. The Domain Controller replies with a lot of -information about the user, for example the place where the users -profile is stored, the users full name of the user. All this -information is stored in the NT user database, the so-called SAM.

    Assume you have a Samba 3.0 server with a NetBIOS name of + SERV1 and are joining an or Win2k NT domain called + DOM, which has a PDC with a NetBIOS name + of DOMPDC and two backup domain controllers + with NetBIOS names DOMBDC1 and DOMBDC2 + .

    There are two kinds of Domain Controller in a NT 4 compatible Domain: -A Primary Domain Controller (PDC) and one or more Backup Domain -Controllers (BDC). The PDC contains the master copy of the -SAM. Whenever the SAM has to change, for example when a user changes -his password, this change has to be done on the PDC. A Backup Domain -Controller is a machine that maintains a read-only copy of the -SAM. This way it is able to reply to logon requests and authenticate -users in case the PDC is not available. During this time no changes to -the SAM are possible. Whenever changes to the SAM are done on the PDC, -all BDC receive the changes from the PDC.

    Firstly, you must edit your smb.conf(5) + file to tell Samba it should now use domain security.

    Since version 2.2 Samba officially supports domain logons for all -current Windows Clients, including Windows 2000 and XP. This text -assumes the domain to be named SAMBA. To be able to act as a PDC, some -parameters in the [global]-section of the smb.conf have to be set:

    Change (or add) your security = line in the [global] section + of your smb.conf to read:

    workgroup = SAMBA
-domain master = yes
-domain logons = yes
    security = domain

    Several other things like a [homes] and a [netlogon] share also may be -set along with settings for the profile path, the users home drive and -others. This will not be covered in this document.

    7.3. What qualifies a Domain Controller on the network?

    Every machine that is a Domain Controller for the domain SAMBA has to -register the NetBIOS group name SAMBA#1c with the WINS server and/or -by broadcast on the local network. The PDC also registers the unique -NetBIOS name SAMBA#1b with the WINS server. The name type #1b is -normally reserved for the domain master browser, a role that has -nothing to do with anything related to authentication, but the -Microsoft Domain implementation requires the domain master browser to -be on the same machine as the PDC.

    7.3.1. How does a Workstation find its domain controller?

    A NT workstation in the domain SAMBA that wants a local user to be -authenticated has to find the domain controller for SAMBA. It does -this by doing a NetBIOS name query for the group name SAMBA#1c. It -assumes that each of the machines it gets back from the queries is a -domain controller and can answer logon requests. To not open security -holes both the workstation and the selected (TODO: How is the DC -chosen) domain controller authenticate each other. After that the -workstation sends the user's credentials (his name and password) to -the domain controller, asking for approval.

    7.3.2. When is the PDC needed?

    Whenever a user wants to change his password, this has to be done on -the PDC. To find the PDC, the workstation does a NetBIOS name query -for SAMBA#1b, assuming this machine maintains the master copy of the -SAM. The workstation contacts the PDC, both mutually authenticate and -the password change is done.

    7.4. Can Samba be a Backup Domain Controller to an NT PDC?

    Next change the workgroup = line in the [global] section to read:

    With version 2.2, no. The native NT SAM replication protocols have -not yet been fully implemented. The Samba Team is working on -understanding and implementing the protocols, but this work has not -been finished for version 2.2.

    workgroup = DOM

    With version 3.0, the work on both the replication protocols and a -suitable storage mechanism has progressed, and some form of NT4 BDC -support is expected soon.

    as this is the name of the domain we are joining.

    Can I get the benefits of a BDC with Samba? Yes. The main reason for -implementing a BDC is availability. If the PDC is a Samba machine, -a second Samba machine can be set up to -service logon requests whenever the PDC is down.

    7.5. How do I set up a Samba BDC?

    You must also have the parameter encrypt passwords set to yes + in order for your users to authenticate to the NT PDC.

    Several things have to be done:

    Finally, add (or modify) a password server = line in the [global] + section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    • The domain SID has to be the same on the PDC and the BDC. This used to -be stored in the file private/MACHINE.SID. This file is not created -anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is -stored in the file private/secrets.tdb. Simply copying the secrets.tdb -from the PDC to the BDC does not work, as the BDC would -generate a new SID for itself and override the domain SID with this -new BDC SID.

      To retrieve the domain SID from the PDC or an existing BDC and store it in the -secrets.tdb, execute 'net rpc getsid' on the BDC.

    • These are the primary and backup domain controllers Samba + will attempt to contact in order to authenticate users. Samba will + try to contact each of these servers in order, so you may want to + rearrange this list in order to spread out the authentication load + among domain controllers.

      The Unix user database has to be synchronized from the PDC to the -BDC. This means that both the /etc/passwd and /etc/group have to be -replicated from the PDC to the BDC. This can be done manually -whenever changes are made, or the PDC is set up as a NIS master -server and the BDC as a NIS slave server. To set up the BDC as a -mere NIS client would not be enough, as the BDC would not be able to -access its user database in case of a PDC failure.

    • Alternatively, if you want smbd to automatically determine + the list of Domain controllers to use for authentication, you may + set this line to be :

      The Samba password database in the file private/smbpasswd has to be -replicated from the PDC to the BDC. This is a bit tricky, see the -next section.

    • password server = *

      Any netlogon share has to be replicated from the PDC to the -BDC. This can be done manually whenever login scripts are changed, -or it can be done automatically together with the smbpasswd -synchronization.

    This method, allows Samba to use exactly the same + mechanism that NT does. This + method either broadcasts or uses a WINS database in order to + find domain controllers to authenticate against.

    Finally, the BDC has to be found by the workstations. This can be done -by setting

    In order to actually join the domain, you must run this + command:

    workgroup = samba
-domain master = no
-domain logons = yes
    root# net rpc join -S DOMPDC + -UAdministrator%password

    in the [global]-section of the smb.conf of the BDC. This makes the BDC -only register the name SAMBA#1c with the WINS server. This is no -problem as the name SAMBA#1c is a NetBIOS group name that is meant to -be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS -name is reserved for the Primary Domain Controller.

    7.5.1. How do I replicate the smbpasswd file?

    Replication of the smbpasswd file is sensitive. It has to be done -whenever changes to the SAM are made. Every user's password change is -done in the smbpasswd file and has to be replicated to the BDC. So -replicating the smbpasswd file very often is necessary.

    As the smbpasswd file contains plain text password equivalents, it -must not be sent unencrypted over the wire. The best way to set up -smbpasswd replication from the PDC to the BDC is to use the utility -rsync. rsync can use ssh as a transport. ssh itself can be set up to -accept *only* rsync transfer without requiring the user to type a -password.

    7.5.2. Can I do this all with LDAP?

    as we are joining the domain DOM and the PDC for that domain + (the only machine that has write access to the domain SAM database) + is DOMPDC. The Administrator%password is + the login name and password for an account which has the necessary + privilege to add machines to the domain. If this is successful + you will see the message:

    The simple answer is YES. Samba's pdb_ldap code supports -binding to a replica LDAP server, and will also follow referrals and -rebind to the master if it ever needs to make a modification to the -database. (Normally BDCs are read only, so this will not occur -often).

    Chapter 8. Samba as a ADS domain member

    Joined domain DOM. + or Joined 'SERV1' to realm 'MYREALM' +

    This is a rough guide to setting up Samba 3.0 with kerberos authentication against a -Windows2000 KDC.

    8.1. Setup your smb.conf

    in your terminal window. See the net(8) man page for more details.

    You must use at least the following 3 options in smb.conf:

    This process joins the server to thedomain + without having to create the machine trust account on the PDC + beforehand.

      realm = YOUR.KERBEROS.REALM
-  security = ADS
-  encrypt passwords = yes

    This command goes through the machine account password + change protocol, then writes the new (random) machine account + password for this Samba server into a file in the same directory + in which an smbpasswd file would be stored - normally :

    In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: -

      ads server = your.kerberos.server
    /usr/local/samba/private/secrets.tdb

    You do *not* need a smbpasswd file, and older clients will - be authenticated as if "security = domain", although it won't do any harm - and allows you to have local users not in the domain. - I expect that the above required options will change soon when we get better - active directory integration.

    This file is created and owned by root and is not + readable by any other user. It is the key to the domain-level + security for your system, and should be treated as carefully + as a shadow password file.

    Finally, restart your Samba daemons and get ready for + clients to begin using domain security!

    8.2. Setup your /etc/krb5.conf9.2. Why is this better than security = server?

    The minimal configuration for krb5.conf is:

    Currently, domain security in Samba doesn't free you from + having to create local Unix users to represent the users attaching + to your server. This means that if domain user DOM\fred + attaches to your domain security Samba server, there needs + to be a local Unix user fred to represent that user in the Unix + filesystem. This is very similar to the older Samba security mode + security = server, + where Samba would pass through the authentication request to a Windows + NT server in the same way as a Windows 95 or Windows 98 server would. + 

    [realms]
-    YOUR.KERBEROS.REALM = {
-	kdc = your.kerberos.server
-    }

    Please refer to the Winbind + paper for information on a system to automatically + assign UNIX uids and gids to Windows NT Domain users and groups. + This code is available in development branches only at the moment, + but will be moved to release branches soon.

    Test your config by doing a "kinit USERNAME@REALM" and making sure that - your password is accepted by the Win2000 KDC.

    The advantage to domain-level security is that the + authentication in domain-level security is passed down the authenticated + RPC channel in exactly the same way that an NT server would do it. This + means Samba servers now participate in domain trust relationships in + exactly the same way NT servers do (i.e., you can add Samba servers into + a resource domain and have the authentication passed on from a resource + domain PDC to an account domain PDC.

    NOTE: The realm must be uppercase.

    In addition, with security = server every Samba + daemon on a server has to keep a connection open to the + authenticating server for as long as that daemon lasts. This can drain + the connection resources on a Microsoft NT server and cause it to run + out of available connections. With security = domain, + however, the Samba daemons connect to the PDC/BDC only for as long + as is necessary to authenticate the user, and then drop the connection, + thus conserving PDC connection resources.

    You also must ensure that you can do a reverse DNS lookup on the IP -address of your KDC. Also, the name that this reverse lookup maps to -must either be the netbios name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the netbios name -followed by the realm.

    And finally, acting in the same manner as an NT server + authenticating to a PDC means that as part of the authentication + reply, the Samba server gets the user identification information such + as the user SID, the list of NT groups the user belongs to, etc.

    The easiest way to ensure you get this right is to add a /etc/hosts -entry mapping the IP address of your KDC to its netbios name. If you -don't get this right then you will get a "local error" when you try -to join the realm.

    If all you want is kerberos support in smbclient then you can skip -straight to step 5 now. Step 3 is only needed if you want kerberos -support for smbd and winbindd.

    Much of the text of this document + was first published in the Web magazine + LinuxWorld as the article Doing + the NIS/NT Samba.

    8.3. Create the computer account

    As a user that has write permission on the Samba private directory -(usually root) run: -net ads join

    III. Advanced Configuration

    8.3.1. Possible errors

    "ADS support not compiled in"

    Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.

    8.4. Test your server setup

    On a Windows 2000 client try net use * \\server\share. You should -be logged in with kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ?

    8.5. Testing with smbclient

    On your Samba server try to login to a Win2000 server or your Samba -server using smbclient and kerberos. Use smbclient as usual, but -specify the -k option to choose kerberos authentication.

    8.6. Notes

    You must change administrator password at least once after DC -install, to create the right encoding types

    w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in - their defaults DNS setup. Maybe fixed in service packs?

    Chapter 9. Samba as a NT4 or Win2k domain member

    9.1. Joining an NT Domain with Samba 3.0

    Assume you have a Samba 3.0 server with a NetBIOS name of - SERV1 and are joining an or Win2k NT domain called - DOM, which has a PDC with a NetBIOS name - of DOMPDC and two backup domain controllers - with NetBIOS names DOMBDC1 and DOMBDC2 - .

    Firstly, you must edit your smb.conf(5) - file to tell Samba it should now use domain security.

    Change (or add) your security = line in the [global] section - of your smb.conf to read:

    security = domain

    Next change the workgroup = line in the [global] section to read:

    workgroup = DOM

    as this is the name of the domain we are joining.

    You must also have the parameter encrypt passwords set to yes - in order for your users to authenticate to the NT PDC.

    Finally, add (or modify) a password server = line in the [global] - section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    These are the primary and backup domain controllers Samba - will attempt to contact in order to authenticate users. Samba will - try to contact each of these servers in order, so you may want to - rearrange this list in order to spread out the authentication load - among domain controllers.

    Alternatively, if you want smbd to automatically determine - the list of Domain controllers to use for authentication, you may - set this line to be :

    password server = *

    This method, allows Samba to use exactly the same - mechanism that NT does. This - method either broadcasts or uses a WINS database in order to - find domain controllers to authenticate against.

    In order to actually join the domain, you must run this - command:

    root# net rpc join -S DOMPDC - -UAdministrator%password

    as we are joining the domain DOM and the PDC for that domain - (the only machine that has write access to the domain SAM database) - is DOMPDC. The Administrator%password is - the login name and password for an account which has the necessary - privilege to add machines to the domain. If this is successful - you will see the message:

    Joined domain DOM. - or Joined 'SERV1' to realm 'MYREALM' -

    in your terminal window. See the net(8) man page for more details.

    This process joins the server to thedomain - without having to create the machine trust account on the PDC - beforehand.

    This command goes through the machine account password - change protocol, then writes the new (random) machine account - password for this Samba server into a file in the same directory - in which an smbpasswd file would be stored - normally :

    /usr/local/samba/private/secrets.tdb

    This file is created and owned by root and is not - readable by any other user. It is the key to the domain-level - security for your system, and should be treated as carefully - as a shadow password file.

    Finally, restart your Samba daemons and get ready for - clients to begin using domain security!

    9.2. Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from - having to create local Unix users to represent the users attaching - to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs - to be a local Unix user fred to represent that user in the Unix - filesystem. This is very similar to the older Samba security mode - security = server, - where Samba would pass through the authentication request to a Windows - NT server in the same way as a Windows 95 or Windows 98 server would. -

    Please refer to the Winbind - paper for information on a system to automatically - assign UNIX uids and gids to Windows NT Domain users and groups. - This code is available in development branches only at the moment, - but will be moved to release branches soon.

    The advantage to domain-level security is that the - authentication in domain-level security is passed down the authenticated - RPC channel in exactly the same way that an NT server would do it. This - means Samba servers now participate in domain trust relationships in - exactly the same way NT servers do (i.e., you can add Samba servers into - a resource domain and have the authentication passed on from a resource - domain PDC to an account domain PDC.

    In addition, with security = server every Samba - daemon on a server has to keep a connection open to the - authenticating server for as long as that daemon lasts. This can drain - the connection resources on a Microsoft NT server and cause it to run - out of available connections. With security = domain, - however, the Samba daemons connect to the PDC/BDC only for as long - as is necessary to authenticate the user, and then drop the connection, - thus conserving PDC connection resources.

    And finally, acting in the same manner as an NT server - authenticating to a PDC means that as part of the authentication - reply, the Samba server gets the user identification information such - as the user SID, the list of NT groups the user belongs to, etc.

    Much of the text of this document - was first published in the Web magazine - LinuxWorld as the article Doing - the NIS/NT Samba.

    III. Optional configuration

    Introduction

    10. Integrating MS Windows networks with SambaSystem Policies
    10.1. Agenda
    10.2. Name Resolution in a pure Unix/Linux worldBasic System Policy Info
    10.2.1. /etc/hosts
    10.2.2. /etc/resolv.conf
    10.2.3. /etc/host.conf
    10.2.4. /etc/nsswitch.conf10.1.1. Creating Group Prolicy Files
    10.3. Name resolution as used within MS Windows networking10.2. Roaming Profiles
    10.3.1. The NetBIOS Name Cache
    10.3.2. The LMHOSTS file10.2.1. Windows NT Configuration
    10.3.3. HOSTS file10.2.2. Windows 9X Configuration
    10.3.4. DNS Lookup10.2.3. Win9X and WinNT Configuration
    10.3.5. WINS Lookup10.2.4. Windows 9X Profile Setup
    10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba10.2.5. Windows NT Workstation 4.0
    10.5. MS Windows security options and how to configure -Samba for seemless integration10.2.6. Windows NT/200x Server
    10.5.1. Use MS Windows NT as an authentication server10.2.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    10.5.2. Make Samba a member of an MS Windows NT security domain10.2.8. Windows NT 4
    10.5.3. Configure Samba as an authentication server10.2.9. Windows 2000/XP
    10.6. Conclusions
    11.1. Viewing and changing UNIX permissions using the NT security dialogs
    11.2. How to view file security on a Samba share
    11.3. Viewing file ownership
    11.4. Viewing file or directory permissions
    11.4.1. File Permissions
    11.4.2. Directory Permissions
    11.5. Modifying file or directory permissions
    11.6. Interaction with the standard Samba create mask parameters
    11.7. Interaction with the standard Samba file attribute mapping
    12. Group mapping HOWTO
    13. Configuring PAM for distributed but centrally managed authentication
    12.1. 13.1. Samba and PAM
    12.2. 13.2. Distributed Authentication
    12.3. 13.3. PAM Configuration in smb.conf
    13. Hosting a Microsoft Distributed File System tree on Samba
    13.1. Instructions
    13.1.1. Notes
    14. Printing Support
    14.1. Introduction
    14.2. Configuration
    14.2.1. Creating [print$]
    14.2.2. Setting Drivers for Existing Printers
    14.2.3. Support a large number of printers
    14.2.4. Adding New Printers via the Windows NT APW
    14.2.5. Samba and Printer Ports
    14.3. The Imprints Toolset
    14.3.1. What is Imprints?
    14.3.2. Creating Printer Driver Packages
    14.3.3. The Imprints server
    14.3.4. The Installation Client
    14.4. Diagnosis
    14.4.1. Introduction
    14.4.2. Debugging printer problems
    14.4.3. What printers do I have?
    14.4.4. Setting up printcap and print servers
    14.4.5. Job sent, no output
    14.4.6. Job sent, strange output
    14.4.7. Raw PostScript printed
    14.4.8. Advanced Printing
    14.4.9. Real debugging
    15.1. Introduction
    15.2. CUPS - RAW Print Through Mode
    15.3. The CUPS Filter Chains
    15.4. CUPS Print Drivers and Devices
    15.4.1. Further printing steps
    15.5. Limiting the number of pages users can print
    15.6. Advanced Postscript Printing from MS Windows
    15.7. Auto-Deletion of CUPS spool files
    16.1. Abstract
    16.2. Introduction
    16.3. What Winbind Provides
    16.3.1. Target Uses
    16.4. How Winbind Works
    16.4.1. Microsoft Remote Procedure Calls
    16.4.2. Microsoft Active Directory Services
    16.4.3. Name Service Switch
    16.4.4. Pluggable Authentication Modules
    16.4.5. User and Group ID Allocation
    16.4.6. Result Caching
    16.5. Installation and Configuration
    16.5.1. Introduction
    16.5.2. Requirements
    16.5.3. Testing Things Out
    16.6. Limitations
    16.7. Conclusion
    17. Improved browsing in sambaIntegrating MS Windows networks with Samba
    17.1. Overview of browsingName Resolution in a pure Unix/Linux world
    17.2. Browsing support in samba17.1.1. /etc/hosts
    17.3. Problem resolution17.1.2. /etc/resolv.conf
    17.4. Browsing across subnets17.1.3. /etc/host.conf
    17.4.1. How does cross subnet browsing work ?17.1.4. /etc/nsswitch.conf
    17.5. Setting up a WINS server
    17.6. Setting up Browsing in a WORKGROUP17.2. Name resolution as used within MS Windows networking
    17.7. Setting up Browsing in a DOMAIN17.2.1. The NetBIOS Name Cache
    17.8. Forcing samba to be the master17.2.2. The LMHOSTS file
    17.9. Making samba the domain master17.2.3. HOSTS file
    17.10. Note about broadcast addresses17.2.4. DNS Lookup
    17.11. Multiple interfaces17.2.5. WINS Lookup
    18. Stackable VFS modulesImproved browsing in samba
    18.1. Introduction and configurationOverview of browsing
    18.2. Included modules
    18.2.1. audit
    18.2.2. recycleBrowsing support in samba
    18.2.3. netatalk18.3. Problem resolution
    18.3. VFS modules available elsewhere18.4. Browsing across subnets
    18.3.1. DatabaseFS
    18.3.2. vscan18.4.1. How does cross subnet browsing work ?
    19. Group mapping HOWTO
    20. Samba performance issues
    20.1. Comparisons18.5. Setting up a WINS server
    20.2. Socket options18.6. Setting up Browsing in a WORKGROUP
    20.3. Read size18.7. Setting up Browsing in a DOMAIN
    20.4. Max xmit18.8. Forcing samba to be the master
    20.5. Log level18.9. Making samba the domain master
    20.6. Read raw18.10. Note about broadcast addresses
    20.7. Write raw18.11. Multiple interfaces
    20.8. Slow Clients19. Hosting a Microsoft Distributed File System tree on Samba
    20.9. Slow Logins19.1. Instructions
    20.10. Client tuning19.1.1. Notes
    21. Creating Group Prolicy Files20. Stackable VFS modules
    21.1. Windows '9x20.1. Introduction and configuration
    21.2. Windows NT 420.2. Included modules
    21.2.1. Side bar Notes
    21.2.2. Mandatory profiles20.2.1. audit
    21.2.3. moveuser.exe20.2.2. recycle
    21.2.4. Get SID20.2.3. netatalk
    21.3. Windows 2000/XP20.3. VFS modules available elsewhere
    20.3.1. DatabaseFS
    20.3.2. vscan
    22. 21. Securing Samba
    22.1. 21.1. Introduction
    22.2. 21.2. Using host based protection
    22.3. 21.3. Using interface protection
    22.4. 21.4. Using a firewall
    22.5. 21.5. Using a IPC$ share deny
    22.6. 21.6. Upgrading Samba
    23. 22. Unicode/Charsets
    23.1. 22.1. What are charsets and unicode?
    23.2. 22.2. Samba and charsets

    Chapter 10. Integrating MS Windows networks with Samba

    Chapter 10. System Policies

    10.1. Agenda10.1. Basic System Policy Info

    To identify the key functional mechanisms of MS Windows networking -to enable the deployment of Samba as a means of extending and/or -replacing MS Windows NT/2000 technology.

    Much of the information necessary to implement System Policies and +Roaming User Profiles in a Samba domain is the same as that for +implementing these same items in a Windows NT 4.0 domain. +You should read the white paper Implementing +Profiles and Policies in Windows NT 4.0 available from Microsoft.

    We will examine:

    Here are some additional details:

      • Name resolution in a pure Unix/Linux TCP/IP - environment +> What about Windows NT Policy Editor? +

        To create or edit ntconfig.pol you must use + the NT Server Policy Editor, poledit.exe which + is included with NT Server but not NT Workstation. + There is a Policy Editor on a NTws + but it is not suitable for creating Domain Policies. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need poledit.exe, common.adm and winnt.adm. It is convenient + to put the two *.adm files in c:\winnt\inf which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'.

      • Name resolution as used within MS Windows - networking +> The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft.

      • How browsing functions and how to deploy stable - and dependable browsing using Samba +> Can Win95 do Policies? +

        Install the group policy handler for Win9x to pick up group + policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of + times and see if Win98 picks up group policies. Unfortunately this needs + to be done on every Win9x machine that uses group policies.... +

        If group policies don't work one reports suggests getting the updated + (read: working) grouppol.dll for Windows 9x. The group list is grabbed + from /etc/group.

      • MS Windows security options and how to - configure Samba for seemless integration +> How do I get 'User Manager' and 'Server Manager'

      • Configuration of Samba as:

        Since I don't need to buy an NT Server CD now, how do I get + the 'User Manager for Domains', the 'Server Manager'? +

        Microsoft distributes a version of these tools called nexus for + installation on Windows 95 systems. The tools set includes +

          • A stand-alone server

            Server Manager

          • An MS Windows NT 3.x/4.0 security domain member -

            User Manager for Domains

          • An alternative to an MS Windows NT 3.x/4.0 Domain Controller -

            Event Viewer

      Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE +

      The Windows NT 4.0 version of the 'User Manager for + Domains' and 'Server Manager' are available from Microsoft via ftp + from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE +

    10.1.1. Creating Group Prolicy Files

    10.1.1.1. Windows '9x

    You need the Win98 Group Policy Editor to +set Group Profiles up under Windows '9x. It can be found on the Original +full product Win98 installation CD under +tools/reskit/netadmin/poledit. You install this +using the Add/Remove Programs facility and then click on the 'Have Disk' +tab.

    Use the Group Policy Editor to create a policy file that specifies the +location of user profiles and/or the My Documents etc. +stuff. You then save these settings in a file called +Config.POL that needs to be placed in +the root of the [NETLOGON] share. If your Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the +Win9x/Me registry of the machine that is logging on.

    All of this is covered in the Win98 Resource Kit documentation.

    If you do not do it this way, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings.

    10.2. Name Resolution in a pure Unix/Linux world10.2. Roaming Profiles

    The key configuration files covered in this section are:

    NOTE! Roaming profiles support is different for Win9X and WinNT.

    Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features.

    Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory.

    WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT.

    10.2.1. Windows NT Configuration

    • To support WinNT clients, in the [global] section of smb.conf set the +following (for example):

      /etc/hosts

      logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

    • /etc/resolv.conf

    • The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable.

      /etc/host.conf

    • /etc/nsswitch.conf

      MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path.

    10.2.1. /etc/hosts10.2.2. Windows 9X Configuration

    Contains a static list of IP Addresses and names. -eg:

    To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter.

    By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file:

    	127.0.0.1	localhost localhost.localdomain
-	192.168.1.1	bigbox.caldera.com	bigbox	alias4box
    logon home = \\%L\%U\.profiles

    The purpose of /etc/hosts is to provide a -name resolution mechanism so that uses do not need to remember -IP addresses.

    Network packets that are sent over the physical network transport -layer communicate not via IP addresses but rather using the Media -Access Control address, or MAC address. IP Addresses are currently -32 bits in length and are typically presented as four (4) decimal -numbers that are separated by a dot (or period). eg: 168.192.1.1

    then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden).

    MAC Addresses use 48 bits (or 6 bytes) and are typically represented -as two digit hexadecimal numbers separated by colons. eg: -40:8e:0a:12:34:56

    Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home".

    10.2.3. Win9X and WinNT Configuration

    Every network interfrace must have an MAC address. Associated with -a MAC address there may be one or more IP addresses. There is NO -relationship between an IP address and a MAC address, all such assignments -are arbitary or discretionary in nature. At the most basic level all -network communications takes place using MAC addressing. Since MAC -addresses must be globally unique, and generally remains fixed for -any particular interface, the assignment of an IP address makes sense -from a network management perspective. More than one IP address can -be assigned per MAC address. One address must be the primary IP address, -this is the address that will be returned in the ARP reply.

    You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example:

    When a user or a process wants to communicate with another machine -the protocol implementation ensures that the "machine name" or "host -name" is resolved to an IP address in a manner that is controlled -by the TCP/IP configuration control files. The file -/etc/hosts is one such file.

    logon home = \\%L\%U\.profiles
+logon path = \\%L\profiles\%U

    When the IP address of the destination interface has been -determined a protocol called ARP/RARP is used to identify -the MAC address of the target interface. ARP stands for Address -Resolution Protocol, and is a broadcast oriented method that -uses UDP (User Datagram Protocol) to send a request to all -interfaces on the local network segment using the all 1's MAC -address. Network interfaces are programmed to respond to two -MAC addresses only; their own unique address and the address -ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will -contain the MAC address and the primary IP address for each -interface.

    The /etc/hosts file is foundational to all -Unix/Linux TCP/IP installations and as a minumum will contain -the localhost and local network interface IP addresses and the -primary names by which they are known within the local machine. -This file helps to prime the pump so that a basic level of name -resolution can exist before any other method of name resolution -becomes available.

    I have not checked what 'net use /home' does on NT when "logon home" is +set as above.

    10.2.2. /etc/resolv.conf10.2.4. Windows 9X Profile Setup

    This file tells the name resolution libraries:

    When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders.

    The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file.

      1. The name of the domain to which the machine - belongs +> On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot.

      2. The name(s) of any domains that should be - automatically searched when trying to resolve unqualified - host names to their IP address +> On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot.

      The name or IP address of available Domain - Name Servers that may be asked to perform name to address - translation lookups -

    10.2.3. /etc/host.conf

    Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me.

    /etc/host.conf is the primary means by -which the setting in /etc/resolv.conf may be affected. It is a -critical configuration file. This file controls the order by -which name resolution may procede. The typical structure is:

    You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password.

    	order hosts,bind
-	multi on

    Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'.

    then both addresses should be returned. Please refer to the -man page for host.conf for further details.

    10.2.4. /etc/nsswitch.conf

    Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created.

    This file controls the actual name resolution targets. The -file typically has resolver object specifications as follows:

    These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set.

    	# /etc/nsswitch.conf
-	#
-	# Name Service Switch configuration file.
-	#
-
-	passwd:		compat
-	# Alternative entries for password authentication are:
-	# passwd:	compat files nis ldap winbind
-	shadow:		compat
-	group:		compat
-
-	hosts:		files nis dns
-	# Alternative entries for host name resolution are:
-	# hosts:	files dns nis nis+ hesoid db compat ldap wins
-	networks:	nis files dns
-
-	ethers:		nis files
-	protocols:	nis files
-	rpc:		nis files
-	services:	nis files

    If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server.

    Of course, each of these mechanisms requires that the appropriate -facilities and/or services are correctly configured.

    If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time".

    It should be noted that unless a network request/message must be -sent, TCP/IP networks are silent. All TCP/IP communications assumes a -principal of speaking only when necessary.

    1. Starting with version 2.2.0 samba has Linux support for extensions to -the name service switch infrastructure so that linux clients will -be able to obtain resolution of MS Windows NetBIOS names to IP -Addresses. To gain this functionality Samba needs to be compiled -with appropriate arguments to the make command (ie: make -nsswitch/libnss_wins.so). The resulting library should -then be installed in the /lib directory and -the "wins" parameter needs to be added to the "hosts:" line in -the /etc/nsswitch.conf file. At this point it -will be possible to ping any MS Windows machine by it's NetBIOS -machine name, so long as that machine is within the workgroup to -which both the samba machine and the MS Windows machine belong.

    10.3. Name resolution as used within MS Windows networking

    instead of logging in under the [user, password, domain] dialog, + press escape. +

  • MS Windows networking is predicated about the name each machine -is given. This name is known variously (and inconsistently) as -the "computer name", "machine name", "networking name", "netbios name", -"SMB name". All terms mean the same thing with the exception of -"netbios name" which can apply also to the name of the workgroup or the -domain name. The terms "workgroup" and "domain" are really just a -simply name with which the machine is associated. All NetBIOS names -are exactly 16 characters in length. The 16th character is reserved. -It is used to store a one byte value that indicates service level -information for the NetBIOS name that is registered. A NetBIOS machine -name is therefore registered for each service type that is provided by -the client/server.

    run the regedit.exe program, and look in: +

    The following are typical NetBIOS name/service type registrations:

    HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + 

    	Unique NetBIOS Names:
-		MACHINENAME<00>	= Server Service is running on MACHINENAME
-		MACHINENAME<03> = Generic Machine Name (NetBIOS name)
-		MACHINENAME<20> = LanMan Server service is running on MACHINENAME
-		WORKGROUP<1b> = Domain Master Browser
-
-	Group Names:
-		WORKGROUP<03> = Generic Name registered by all members of WORKGROUP
-		WORKGROUP<1c> = Domain Controllers / Netlogon Servers
-		WORKGROUP<1d> = Local Master Browsers
-		WORKGROUP<1e> = Internet Name Resolvers

    you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. +

    It should be noted that all NetBIOS machines register their own -names as per the above. This is in vast contrast to TCP/IP -installations where traditionally the system administrator will -determine in the /etc/hosts or in the DNS database what names -are associated with each IP address.

    [Exit the registry editor]. +

  • One further point of clarification should be noted, the /etc/hosts -file and the DNS records do not provide the NetBIOS name type information -that MS Windows clients depend on to locate the type of service that may -be needed. An example of this is what happens when an MS Windows client -wants to locate a domain logon server. It find this service and the IP -address of a server that provides it by performing a lookup (via a -NetBIOS broadcast) for enumeration of all machines that have -registered the name type *<1c>. A logon request is then sent to each -IP address that is returned in the enumerated list of IP addresses. Which -ever machine first replies then ends up providing the logon services.

    WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). +

    The name "workgroup" or "domain" really can be confusing since these -have the added significance of indicating what is the security -architecture of the MS Windows network. The term "workgroup" indicates -that the primary nature of the network environment is that of a -peer-to-peer design. In a WORKGROUP all machines are responsible for -their own security, and generally such security is limited to use of -just a password (known as SHARE MODE security). In most situations -with peer-to-peer networking the users who control their own machines -will simply opt to have no security at all. It is possible to have -USER MODE security in a WORKGROUP environment, thus requiring use -of a user name and a matching password.

    This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. +

  • MS Windows networking is thus predetermined to use machine names -for all local and remote machine message passing. The protocol used is -called Server Message Block (SMB) and this is implemented using -the NetBIOS protocol (Network Basic Input Output System). NetBIOS can -be encapsulated using LLC (Logical Link Control) protocol - in which case -the resulting protocol is called NetBEUI (Network Basic Extended User -Interface). NetBIOS can also be run over IPX (Internetworking Packet -Exchange) protocol as used by Novell NetWare, and it can be run -over TCP/IP protocols - in which case the resulting protocol is called -NBT or NetBT, the NetBIOS over TCP/IP.

    search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. +

  • MS Windows machines use a complex array of name resolution mechanisms. -Since we are primarily concerned with TCP/IP this demonstration is -limited to this area.

    10.3.1. The NetBIOS Name Cache

    log off the windows 95 client. +

  • All MS Windows machines employ an in memory buffer in which is -stored the NetBIOS names and IP addresses for all external -machines that that machine has communicated with over the -past 10-15 minutes. It is more efficient to obtain an IP address -for a machine from the local cache than it is to go through all the -configured name resolution mechanisms.

    check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. +

    • If a machine whose name is in the local name cache has been shut -down before the name had been expired and flushed from the cache, then -an attempt to exchange a message with that machine will be subject -to time-out delays. i.e.: Its name is in the cache, so a name resolution -lookup will succeed, but the machine can not respond. This can be -frustrating for users - but it is a characteristic of the protocol.

    If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports.

    The MS Windows utility that allows examination of the NetBIOS -name cache is called "nbtstat". The Samba equivalent of this -is called "nmblookup".

    If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace.

    10.3.2. The LMHOSTS file10.2.5. Windows NT Workstation 4.0

    This file is usually located in MS Windows NT 4.0 or -2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains -the IP Address and the machine name in matched pairs. The -LMHOSTS file performs NetBIOS name -to IP address mapping oriented.

    When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter.

    It typically looks like:

    There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter.

    	# Copyright (c) 1998 Microsoft Corp.
-	#
-	# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
-	# over TCP/IP) stack for Windows98
-	#
-	# This file contains the mappings of IP addresses to NT computernames
-	# (NetBIOS) names.  Each entry should be kept on an individual line.
-	# The IP address should be placed in the first column followed by the
-	# corresponding computername. The address and the comptername
-	# should be separated by at least one space or tab. The "#" character
-	# is generally used to denote the start of a comment (see the exceptions
-	# below).
-	#
-	# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
-	# files and offers the following extensions:
-	#
-	#      #PRE
-	#      #DOM:<domain>
-	#      #INCLUDE <filename>
-	#      #BEGIN_ALTERNATE
-	#      #END_ALTERNATE
-	#      \0xnn (non-printing character support)
-	#
-	# Following any entry in the file with the characters "#PRE" will cause
-	# the entry to be preloaded into the name cache. By default, entries are
-	# not preloaded, but are parsed only after dynamic name resolution fails.
-	#
-	# Following an entry with the "#DOM:<domain>" tag will associate the
-	# entry with the domain specified by <domain>. This affects how the
-	# browser and logon services behave in TCP/IP environments. To preload
-	# the host name associated with #DOM entry, it is necessary to also add a
-	# #PRE to the line. The <domain> is always preloaded although it will not
-	# be shown when the name cache is viewed.
-	#
-	# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
-	# software to seek the specified <filename> and parse it as if it were
-	# local. <filename> is generally a UNC-based name, allowing a
-	# centralized lmhosts file to be maintained on a server.
-	# It is ALWAYS necessary to provide a mapping for the IP address of the
-	# server prior to the #INCLUDE. This mapping must use the #PRE directive.
-	# In addtion the share "public" in the example below must be in the
-	# LanManServer list of "NullSessionShares" in order for client machines to
-	# be able to read the lmhosts file successfully. This key is under
-	# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
-	# in the registry. Simply add "public" to the list found there.
-	#
-	# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
-	# statements to be grouped together. Any single successful include
-	# will cause the group to succeed.
-	#
-	# Finally, non-printing characters can be embedded in mappings by
-	# first surrounding the NetBIOS name in quotations, then using the
-	# \0xnn notation to specify a hex value for a non-printing character.
-	#
-	# The following example illustrates all of these extensions:
-	#
-	# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
-	# 102.54.94.102    "appname  \0x14"                    #special app server
-	# 102.54.94.123    popular            #PRE             #source server
-	# 102.54.94.117    localsrv           #PRE             #needed for the include
-	#
-	# #BEGIN_ALTERNATE
-	# #INCLUDE \\localsrv\public\lmhosts
-	# #INCLUDE \\rhino\public\lmhosts
-	# #END_ALTERNATE
-	#
-	# In the above example, the "appname" server contains a special
-	# character in its name, the "popular" and "localsrv" server names are
-	# preloaded, and the "rhino" server name is specified so it can be used
-	# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
-	# system is unavailable.
-	#
-	# Note that the whole file is parsed including comments on each lookup,
-	# so keeping the number of comments to a minimum will improve performance.
-	# Therefore it is not advisable to simply add lmhosts file entries onto the
-	# end of this file.

    The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.)

    In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown.

    You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one.

    The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN.

    10.3.3. HOSTS file10.2.6. Windows NT/200x Server

    This file is usually located in MS Windows NT 4.0 or 2000 in -C:\WINNT\SYSTEM32\DRIVERS\ETC and contains -the IP Address and the IP hostname in matched pairs. It can be -used by the name resolution infrastructure in MS Windows, depending -on how the TCP/IP environment is configured. This file is in -every way the equivalent of the Unix/Linux /etc/hosts file.

    There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords.

    10.3.4. DNS Lookup10.2.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    This capability is configured in the TCP/IP setup area in the network -configuration facility. If enabled an elaborate name resolution sequence -is followed the precise nature of which isdependant on what the NetBIOS -Node Type parameter is configured to. A Node Type of 0 means use -NetBIOS broadcast (over UDP broadcast) is first used if the name -that is the subject of a name lookup is not found in the NetBIOS name -cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to -Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the -WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast -lookup is used.

    Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows.

    If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home.

    If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory.

    10.3.5. WINS Lookup10.2.8. Windows NT 4

    A WINS (Windows Internet Name Server) service is the equivaent of the -rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores -the names and IP addresses that are registered by a Windows client -if the TCP/IP setup has been given at least one WINS Server IP Address.

    Unfortunately, the Resource Kit info is Win NT4 or 200x specific.

    To configure Samba to be a WINS server the following parameter needs -to be added to the smb.conf file:

    Here is a quick guide:

    	wins support = Yes

    • To configure Samba to use a WINS server the following parameters are -needed in the smb.conf file:

      On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'.

    • Select a user profile you want to migrate and click on it.

      	wins support = No
-	wins server = xxx.xxx.xxx.xxx

      where xxx.xxx.xxx.xxx is the IP address -of the WINS server.

      I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC.

    • Click the 'Copy To' button.

    • In the box labelled 'Copy Profile to' add your new path, eg: +c:\temp\foobar

    • Click on the button labelled 'Change' in the "Permitted to use" box.

    • Click on the group 'Everyone' and then click OK. This closes the +'chose user' box.

    • Now click OK.

    Follow the above for every profile you need to migrate.

    10.2.8.1. Side bar Notes

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page.

    With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users.

    10.2.8.2. Mandatory profiles

    The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN.

    10.2.8.3. moveuser.exe

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change.

    10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba

    As stated above, MS Windows machines register their NetBIOS names -(i.e.: the machine name for each service type in operation) on start -up. Also, as stated above, the exact method by which this name registration -takes place is determined by whether or not the MS Windows client/server -has been given a WINS server address, whether or not LMHOSTS lookup -is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

    In the case where there is no WINS server all name registrations as -well as name lookups are done by UDP broadcast. This isolates name -resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse -list of a remote MS Windows network (using the "remote announce" parameter).

    Where a WINS server is used, the MS Windows client will use UDP -unicast to register with the WINS server. Such packets can be routed -and thus WINS allows name resolution to function across routed networks.

    During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local -master browser (found by asking WINS or from LMHOSTS) and exchanging browse -list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By the nature of -the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser.

    10.2.8.4. Get SID

    Clients wishing to browse the network make use of this list, but also depend -on the availability of correct name resolution to the respective IP -address/addresses.

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit.

    Any configuration that breaks name resolution and/or browsing intrinsics -will annoy users because they will have to put up with protracted -inability to use the network services.

    Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Samba supports a feature that allows forced synchonisation -of browse lists across routed networks using the "remote -browse sync" parameter in the smb.conf file. This causes Samba -to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the "remote -browse sync" parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on.

    Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath.

    10.5. MS Windows security options and how to configure -Samba for seemless integration

    MS Windows clients may use encrypted passwords as part of a -challenege/response authentication model (a.k.a. NTLMv1) or -alone, or clear text strings for simple password based -authentication. It should be realized that with the SMB -protocol the password is passed over the network either -in plain text or encrypted, but not both in the same -authentication requets.

    10.2.9. Windows 2000/XP

    When encrypted passwords are used a password that has been -entered by the user is encrypted in two ways:

    You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows:

    • An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. -

      Log on as the LOCAL workstation administrator.

    • The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is - then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. -

      Right click on the 'My Computer' Icon, select 'Properties'

    You should refer to the Password Encryption chapter in this HOWTO collection -for more details on the inner workings

    MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x -and version 4.0 pre-service pack 3 will use either mode of -password authentication. All versions of MS Windows that follow -these versions no longer support plain text passwords by default.

    MS Windows clients have a habit of dropping network mappings that -have been idle for 10 minutes or longer. When the user attempts to -use the mapped drive connection that has been dropped, the client -re-establishes the connection using -a cached copy of the password.

  • When Microsoft changed the default password mode, they dropped support for -caching of the plain text password. This means that when the registry -parameter is changed to re-enable use of plain text passwords it appears to -work, but when a dropped mapping attempts to revalidate it will fail if -the remote authentication server does not support encrypted passwords. -This means that it is definitely not a good idea to re-enable plain text -password support in such clients.

    The following parameters can be used to work around the -issue of Windows 9x client upper casing usernames and -password before transmitting them to the SMB server -when using clear text authentication.

    Click on the 'User Profiles' tab

  • 	passsword level = integer
-	username level = integer

    Select the profile you wish to convert (click on it once)

  • By default Samba will lower case the username before attempting -to lookup the user in the database of local system accounts. -Because UNIX usernames conventionally only contain lower case -character, the username level parameter -is rarely even needed.

    Click on the button 'Copy To'

  • However, password on UNIX systems often make use of mixed case -characters. This means that in order for a user on a Windows 9x -client to connect to a Samba server using clear text authentication, -the password level must be set to the maximum -number of upper case letter which could appear -is a password. Note that is the server OS uses the traditional -DES version of crypt(), then a password level -of 8 will result in case insensitive passwords as seen from Windows -users. This will also result in longer login times as Samba -hash to compute the permutations of the password string and -try them one by one until a match is located (or all combinations fail).

    In the "Permitted to use" box, click on the 'Change' button.

  • The best option to adopt is to enable support for encrypted passwords -where ever Samba is used. There are three configuration possibilities -for support of encrypted passwords:

    Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible.

    10.5.1. Use MS Windows NT as an authentication server

    This method involves the additions of the following parameters -in the smb.conf file:

    	encrypt passwords = Yes
-	security = server
-	password server = "NetBIOS_name_of_PDC"

    There are two ways of identifying whether or not a username and -password pair was valid or not. One uses the reply information provided -as part of the authentication messaging process, the other uses -just and error code.

    You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword.

  • The down-side of this mode of configuration is the fact that -for security reasons Samba will send the password server a bogus -username and a bogus password and if the remote server fails to -reject the username and password pair then an alternative mode -of identification of validation is used. Where a site uses password -lock out after a certain number of failed authentication attempts -this will result in user lockouts.

    To make the profile capable of being used by anyone select 'Everyone'

  • Use of this mode of authentication does require there to be -a standard Unix account for the user, this account can be blocked -to prevent logons by other than MS Windows clients.

    Click OK. The Selection box will close.

  • Now click on the 'Ok' button to create the profile in the path you +nominated.

    • Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool.

    Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable.

    10.5.2. Make Samba a member of an MS Windows NT security domain

    This method involves additon of the following paramters in the smb.conf file:

    	encrypt passwords = Yes
-	security = domain
-	workgroup = "name of NT domain"
-	password server = *

    • The use of the "*" argument to "password server" will cause samba -to locate the domain controller in a way analogous to the way -this is done within MS Windows NT.

      This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is:

      In order for this method to work the Samba server needs to join the -MS Windows NT security domain. This is done as follows:

      "Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders"

        ...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this.

        If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy):

      • On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. -

        On the XP workstation log in with an Administrator account.

      • Next, on the Linux system execute: - smbpasswd -r PDC_NAME -j DOMAIN_NAME -

        Click: "Start", "Run"

    • Use of this mode of authentication does require there to be -a standard Unix account for the user in order to assign -a uid once the account has been authenticated by the remote -Windows DC. This account can be blocked to prevent logons by -other than MS Windows clients by things such as setting an invalid -shell in the /etc/passwd entry.

      Type: "mmc"

    • An alternative to assigning UIDs to Windows users on a -Samba member server is presented in the Winbind Overview chapter in -this HOWTO collection.

    • This mode of authentication demands that there be on the -Unix/Linux system both a Unix style account as well as an -smbpasswd entry for the user. The Unix system account can be -locked if required as only the encrypted password will be -used for SMB client authentication.

      A Microsoft Management Console should appear.

    • This method involves addition of the following parameters to -the smb.conf file:

      Click: File, "Add/Remove Snap-in...", "Add"

    • ## please refer to the Samba PDC HOWTO chapter later in 
-## this collection for more details
-[global]
-	encrypt passwords = Yes
-	security = user
-	domain logons = Yes
-	; an OS level of 33 or more is recommended
-	os level = 33
-
-[NETLOGON]
-	path = /somewhare/in/file/system
-	read only = yes

      Double-Click: "Group Policy"

    • in order for this method to work a Unix system account needs -to be created for each user, as well as for each MS Windows NT/2000 -machine. The following structure is required.

      10.5.3.1. Users

      Click: "Finish", "Close"

    • A user account that may provide a home directory should be -created. The following Linux system commands are typical of -the procedure for creating an account.

      Click: "OK"

    • 	# useradd -s /bin/bash -d /home/"userid" -m "userid"
-	# passwd "userid"
-	  Enter Password: <pw>
-	  
-	# smbpasswd -a "userid"
-	  Enter Password: <pw>

      10.5.3.2. MS Windows NT Machine Accounts

      In the "Console Root" window:

    • These are required only when Samba is used as a domain -controller. Refer to the Samba-PDC-HOWTO for more details.

      Expand: "Local Computer Policy", "Computer Configuration",

    • 	# useradd -s /bin/false -d /dev/null "machine_name"\$
-	# passwd -l "machine_name"\$
-	# smbpasswd -a -m "machine_name"

      10.6. Conclusions

      "Administrative Templates", "System", "User Profiles"

    • Samba provides a flexible means to operate as...

      Double-Click: "Do not check for user ownership of Roaming Profile

      • Folders"

      • A Stand-alone server - No special action is needed - other than to create user accounts. Stand-alone servers do NOT - provide network logon services, meaning that machines that use this - server do NOT perform a domain logon but instead make use only of - the MS Windows logon which is local to the MS Windows - workstation/server. -

        Select: "Enabled"

      • An MS Windows NT 3.x/4.0 security domain member. -

        Click: OK"

      • An alternative to an MS Windows NT 3.x/4.0 - Domain Controller. -

        Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed).

      • Reboot

    11.1. Viewing and changing UNIX permissions using the NT security dialogs

    11.2. How to view file security on a Samba share

    11.3. Viewing file ownership

    11.4. Viewing file or directory permissions

    11.4.1. File Permissions

    11.4.2. Directory Permissions

    11.5. Modifying file or directory permissions

    11.6. Interaction with the standard Samba create mask parameters

    11.7. Interaction with the standard Samba file attribute mapping

    Chapter 12. Group mapping HOWTO

    +Starting with Samba 3.0 alpha 2, a new group mapping function is available. The +current method (likely to change) to manage the groups is a new command called +smbgroupedit.

    The first immediate reason to use the group mapping on a PDC, is that +the domain admin group of smb.conf is +now gone. This parameter was used to give the listed users local admin rights +on their workstations. It was some magic stuff that simply worked but didn't +scale very well for complex setups.

    Let me explain how it works on NT/W2K, to have this magic fade away. +When installing NT/W2K on a computer, the installer program creates some users +and groups. Notably the 'Administrators' group, and gives to that group some +privileges like the ability to change the date and time or to kill any process +(or close too) running on the local machine. The 'Administrator' user is a +member of the 'Administrators' group, and thus 'inherit' the 'Administrators' +group privileges. If a 'joe' user is created and become a member of the +'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

    When a NT/W2K machine is joined to a domain, during that phase, the "Domain +Administrators' group of the PDC is added to the 'Administrators' group of the +workstation. Every members of the 'Domain Administrators' group 'inherit' the +rights of the 'Administrators' group when logging on the workstation.

    You are now wondering how to make some of your samba PDC users members of the +'Domain Administrators' ? That's really easy.

    1. create a unix group (usually in /etc/group), let's call it domadm

    2. add to this group the users that must be Administrators. For example if you want joe,john and mary, your entry in /etc/group will look like:

      domadm:x:502:joe,john,mary

    3. Map this domadm group to the domain admins group by running the command:

      smbgroupedit -c "Domain Admins" -u domadm

    You're set, joe, john and mary are domain administrators !

    Like the Domain Admins group, you can map any arbitrary Unix group to any NT +group. You can also make any Unix group a domain group. For example, on a domain +member machine (an NT/W2K or a samba server running winbind), you would like to +give access to a certain directory to some users who are member of a group on +your samba PDC. Flag that group as a domain group by running:

    smbgroupedit -a unixgroup -td

    You can list the various groups in the mapping database like this

    smbgroupedit -v

    Chapter 12. Configuring PAM for distributed but centrally +>Chapter 13. Configuring PAM for distributed but centrally managed authentication

    12.1. Samba and PAM13.1. Samba and PAM

    A number of Unix systems (eg: Sun Solaris), as well as the @@ -10128,6 +9649,45 @@ or by editing individual files that are located in /etc/pam.d.

    If the PAM authentication module (loadable link library file) is located in the + default location then it is not necessary to specify the path. In the case of + Linux, the default location is /lib/security. If the module + is located other than default then the path may be specified as: + + 

    	eg: "auth       required      /other_path/pam_strange_module.so"
+
    +

    The following is an example 

    #%PAM-1.0
-# The PAM configuration file for the `login' service
-#
-auth 		required	pam_securetty.so
-auth 		required	pam_nologin.so
-# auth 		required	pam_dialup.so
-# auth 		optional	pam_mail.so
-auth		required	pam_pwdb.so shadow md5
-# account    	requisite  	pam_time.so
-account		required	pam_pwdb.so
-session		required	pam_pwdb.so
-# session 	optional	pam_lastlog.so
-# password   	required   	pam_cracklib.so retry=3
-password	required	pam_pwdb.so shadow md5
    #%PAM-1.0 + # The PAM configuration file for the `login' service + # + auth required pam_securetty.so + auth required pam_nologin.so + # auth required pam_dialup.so + # auth optional pam_mail.so + auth required pam_pwdb.so shadow md5 + # account requisite pam_time.so + account required pam_pwdb.so + session required pam_pwdb.so + # session optional pam_lastlog.so + # password required pam_cracklib.so retry=3 + password required pam_pwdb.so shadow md5

    PAM allows use of replacable modules. Those available on a @@ -10164,19 +9724,19 @@ sample system include:

    $ /bin/ls /lib/security
-pam_access.so    pam_ftp.so          pam_limits.so     
-pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
-pam_cracklib.so  pam_group.so        pam_listfile.so   
-pam_nologin.so   pam_rootok.so       pam_tally.so      
-pam_deny.so      pam_issue.so        pam_mail.so       
-pam_permit.so    pam_securetty.so    pam_time.so       
-pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-pam_pwdb.so      pam_shells.so       pam_unix.so       
-pam_env.so       pam_ldap.so         pam_motd.so       
-pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-pam_userdb.so    pam_warn.so         pam_unix_session.so
    $ /bin/ls /lib/security + pam_access.so pam_ftp.so pam_limits.so + pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so + pam_cracklib.so pam_group.so pam_listfile.so + pam_nologin.so pam_rootok.so pam_tally.so + pam_deny.so pam_issue.so pam_mail.so + pam_permit.so pam_securetty.so pam_time.so + pam_dialup.so pam_lastlog.so pam_mkhomedir.so + pam_pwdb.so pam_shells.so pam_unix.so + pam_env.so pam_ldap.so pam_motd.so + pam_radius.so pam_smbpass.so pam_unix_acct.so + pam_wheel.so pam_unix_auth.so pam_unix_passwd.so + pam_userdb.so pam_warn.so pam_unix_session.so

    The following example for the login program replaces the use of @@ -10239,13 +9799,13 @@ source distribution.

    #%PAM-1.0
-# The PAM configuration file for the `login' service
-#
-auth		required	pam_smbpass.so nodelay
-account		required	pam_smbpass.so nodelay
-session		required	pam_smbpass.so nodelay
-password	required	pam_smbpass.so nodelay
    #%PAM-1.0 + # The PAM configuration file for the `login' service + # + auth required pam_smbpass.so nodelay + account required pam_smbpass.so nodelay + session required pam_smbpass.so nodelay + password required pam_smbpass.so nodelay

    The following is the PAM configuration file for a particular @@ -10256,13 +9816,13 @@ CLASS="FILENAME" >

    #%PAM-1.0
-# The PAM configuration file for the `samba' service
-#
-auth       required     /lib/security/pam_pwdb.so nullok nodelay shadow audit
-account    required     /lib/security/pam_pwdb.so audit nodelay
-session    required     /lib/security/pam_pwdb.so nodelay
-password   required     /lib/security/pam_pwdb.so shadow md5
    #%PAM-1.0 + # The PAM configuration file for the `samba' service + # + auth required /lib/security/pam_pwdb.so nullok nodelay shadow audit + account required /lib/security/pam_pwdb.so audit nodelay + session required /lib/security/pam_pwdb.so nodelay + password required /lib/security/pam_pwdb.so shadow md5

    In the following example the decision has been made to use the @@ -10273,278 +9833,122 @@ program.

    #%PAM-1.0
-# The PAM configuration file for the `samba' service
-#
-auth       required     /lib/security/pam_smbpass.so nodelay
-account    required     /lib/security/pam_pwdb.so audit nodelay
-session    required     /lib/security/pam_pwdb.so nodelay
-password   required     /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf

    Note: PAM allows stacking of authentication mechanisms. It is -also possible to pass information obtained within one PAM module through -to the next module in the PAM stack. Please refer to the documentation for -your particular system implementation for details regarding the specific -capabilities of PAM in this environment. Some Linux implmentations also -provide the pam_stack.so module that allows all -authentication to be configured in a single central file. The -pam_stack.so method has some very devoted followers -on the basis that it allows for easier administration. As with all issues in -life though, every decision makes trade-offs, so you may want examine the -PAM documentation for further helpful information.

    12.2. Distributed Authentication

    The astute administrator will realize from this that the -combination of pam_smbpass.so, -winbindd, and rsync (see -http://rsync.samba.org/) -will allow the establishment of a centrally managed, distributed -user/password database that can also be used by all -PAM (eg: Linux) aware programs and applications. This arrangement -can have particularly potent advantages compared with the -use of Microsoft Active Directory Service (ADS) in so far as -reduction of wide area network authentication traffic.

    12.3. PAM Configuration in smb.conf

    There is an option in smb.conf called obey pam restrictions. -The following is from the on-line help for this option in SWAT;

    When Samba 2.2 is configure to enable PAM support (i.e. ---with-pam), this parameter will -control whether or not Samba should obey PAM's account -and session management directives. The default behavior -is to use PAM for clear text authentication only and to -ignore any account or session management. Note that Samba always -ignores PAM for authentication in the case of -encrypt passwords = yes. -The reason is that PAM modules cannot support the challenge/response -authentication mechanism needed in the presence of SMB -password encryption.

    Default: obey pam restrictions = no

    Chapter 13. Hosting a Microsoft Distributed File System tree on Samba

    13.1. Instructions

    The Distributed File System (or Dfs) provides a means of - separating the logical view of files and directories that users - see from the actual physical locations of these resources on the - network. It allows for higher availability, smoother storage expansion, - load balancing etc. For more information about Dfs, refer to Microsoft documentation.

    This document explains how to host a Dfs tree on a Unix - machine (for Dfs-aware clients to browse) using Samba.

    To enable SMB-based DFS for Samba, configure it with the - --with-msdfs option. Once built, a - Samba server can be made a Dfs server by setting the global - boolean host msdfs parameter in the smb.conf - file. You designate a share as a Dfs root using the share - level boolean msdfs root parameter. A Dfs root directory on - Samba hosts Dfs links in the form of symbolic links that point - to other servers. For example, a symbolic link - junction->msdfs:storage1\share1 in - the share directory acts as the Dfs junction. When Dfs-aware - clients attempt to access the junction link, they are redirected - to the storage location (in this case, \\storage1\share1).

    Dfs trees on Samba work with all Dfs-aware clients ranging - from Windows 95 to 2000.

    Here's an example of setting up a Dfs tree on a Samba - server.

    # The smb.conf file:
-[global]
-	netbios name = SAMBA
-	host msdfs   = yes
-
-[dfs]
-	path = /export/dfsroot
-	msdfs root = yes
-

    In the /export/dfsroot directory we set up our dfs links to - other servers on the network.

    root# cd /export/dfsroot

    root# chown root /export/dfsroot

    root# chmod 755 /export/dfsroot

    root# ln -s msdfs:storageA\\shareA linka

    root# ln -s msdfs:serverB\\share,serverC\\share linkb #%PAM-1.0 + # The PAM configuration file for the `samba' service + # + auth required /lib/security/pam_smbpass.so nodelay + account required /lib/security/pam_pwdb.so audit nodelay + session required /lib/security/pam_pwdb.so nodelay + password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf

    You should set up the permissions and ownership of - the directory acting as the Dfs root such that only designated - users can create, delete or modify the msdfs links. Also note - that symlink names should be all lowercase. This limitation exists - to have Samba avoid trying all the case combinations to get at - the link name. Finally set up the symbolic links to point to the - network shares you want, and start Samba.

    Users on Dfs-aware clients can now browse the Dfs tree - on the Samba server at \\samba\dfs. Accessing - links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network.

    PAM allows stacking of authentication mechanisms. It is +also possible to pass information obtained within one PAM module through +to the next module in the PAM stack. Please refer to the documentation for +your particular system implementation for details regarding the specific +capabilities of PAM in this environment. Some Linux implmentations also +provide the pam_stack.so module that allows all +authentication to be configured in a single central file. The +pam_stack.so method has some very devoted followers +on the basis that it allows for easier administration. As with all issues in +life though, every decision makes trade-offs, so you may want examine the +PAM documentation for further helpful information.

    13.1.1. Notes

    13.2. Distributed Authentication

    • The astute administrator will realize from this that the +combination of pam_smbpass.so, +winbindd, and a distributed +passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed +user/password database that can also be used by all +PAM (eg: Linux) aware programs and applications. This arrangement +can have particularly potent advantages compared with the +use of Microsoft Active Directory Service (ADS) in so far as +reduction of wide area network authentication traffic.

    13.3. PAM Configuration in smb.conf

    Windows clients need to be rebooted - if a previously mounted non-dfs share is made a dfs - root or vice versa. A better way is to introduce a - new share and make it the dfs root.

  • There is an option in smb.conf called obey pam restrictions. +The following is from the on-line help for this option in SWAT;

    Currently there's a restriction that msdfs - symlink names should all be lowercase.

  • When Samba is configured to enable PAM support (i.e. +--with-pam), this parameter will +control whether or not Samba should obey PAM's account +and session management directives. The default behavior +is to use PAM for clear text authentication only and to +ignore any account or session management. Note that Samba always +ignores PAM for authentication in the case of +encrypt passwords = yes. +The reason is that PAM modules cannot support the challenge/response +authentication mechanism needed in the presence of SMB +password encryption.

    For security purposes, the directory - acting as the root of the Dfs tree should have ownership - and permissions set so that only designated users can - modify the symbolic links in the directory.

    • Default: obey pam restrictions = no

    14.1. Introduction

    14.2. Configuration

    14.2.1. Creating [print$]

    14.2.2. Setting Drivers for Existing Printers

    14.2.3. Support a large number of printers

    14.2.4. Adding New Printers via the Windows NT APW

    14.2.5. Samba and Printer Ports

    14.3. The Imprints Toolset

    14.3.1. What is Imprints?

    14.3.2. Creating Printer Driver Packages

    14.3.3. The Imprints server

    14.3.4. The Installation Client

    14.4. Diagnosis

    14.4.1. Introduction

    14.4.2. Debugging printer problems

    14.4.3. What printers do I have?

    14.4.4. Setting up printcap and print servers

    14.4.5. Job sent, no output

    14.4.6. Job sent, strange output

    14.4.7. Raw PostScript printed

    14.4.8. Advanced Printing

    14.4.9. Real debugging

    15.1. Introduction

    15.2. CUPS - RAW Print Through Mode

    15.3. The CUPS Filter Chains

    15.4. CUPS Print Drivers and Devices

    15.4.1. Further printing steps

    15.5. Limiting the number of pages users can print

    15.6. Advanced Postscript Printing from MS Windows

    15.7. Auto-Deletion of CUPS spool files

    16.1. Abstract

    16.2. Introduction

    16.3. What Winbind Provides

    16.3.1. Target Uses

    16.4. How Winbind Works

    16.4.1. Microsoft Remote Procedure Calls

    16.4.2. Microsoft Active Directory Services

    16.4.3. Name Service Switch

    16.4.4. Pluggable Authentication Modules

    16.4.5. User and Group ID Allocation

    16.4.6. Result Caching

    16.5. Installation and Configuration

    16.5.1. Introduction

    16.5.2. Requirements

    16.5.3. Testing Things Out

    16.5.3.1. Configure and compile SAMBA

    16.5.3.2. Configure nsswitch.conf

    16.5.3.3. Configure smb.conf

    16.5.3.4. Join the SAMBA server to the PDC domain

    16.5.3.5. Start up the winbindd daemon and test it!

    16.5.3.6. Fix the init.d startup scripts

    16.5.3.6.1. Linux

    16.5.3.6.2. Solaris

    16.5.3.6.3. Restarting

    16.5.3.7. Configure Winbind and PAM

    16.5.3.7.1. Linux/FreeBSD-specific PAM configuration

    16.5.3.7.2. Solaris-specific configuration

    I also added a try_first_pass line after the winbind.so line to get rid of -annoying double prompts for passwords.

    Now restart your Samba and try connecting through your application that you -configured in the pam.conf.

    16.6. Limitations

    Winbind has a number of limitations in its current - released version that we hope to overcome in future - releases:

    • Winbind is currently only available for - the Linux, Solaris and IRIX operating systems, although ports to other operating - systems are certainly possible. For such ports to be feasible, - we require the C library of the target operating system to - support the Name Service Switch and Pluggable Authentication - Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids - is not made algorithmically and depends on the order in which - unmapped users or groups are seen by winbind. It may be difficult - to recover the mappings of rid to UNIX id mapping if the file - containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take - into account possible workstation and logon time restrictions - that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    16.7. Conclusion

    The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Chapter 17. Improved browsing in samba

    17.1. Overview of browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called "browse list". This list -contains machines that are ready to offer file and/or print services -to other machines within the network. Thus it does not include -machines which aren't currently able to do server tasks. The browse -list is heavily used by all SMB clients. Configuration of SMB -browsing has been problematic for some Samba users, hence this -document.

    MS Windows 2000 and later, as with Samba-3 and later, can be -configured to not use NetBIOS over TCP/IP. When configured this way -it is imperative that name resolution (using DNS/LDAP/ADS) be correctly -configured and operative. Browsing will NOT work if name resolution -from SMB machine names to IP addresses does not function correctly.

    Where NetBIOS over TCP/IP is enabled use of a WINS server is highly -recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. -WINS allows remote segment clients to obtain NetBIOS name_type information -that can NOT be provided by any other means of name resolution.

    17.2. Browsing support in samba

    Samba facilitates browsing. The browsing is supported by nmbd -and is also controlled by options in the smb.conf file (see smb.conf(5)). -Samba can act as a local browse master for a workgroup and the ability -for samba to support domain logons and scripts is now available.

    Samba can also act as a domain master browser for a workgroup. This -means that it will collate lists from local browse masters into a -wide area network server list. In order for browse clients to -resolve the names they may find in this list, it is recommended that -both samba and your clients use a WINS server.

    Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain: on each wide area -network, you must only ever have one domain master browser per workgroup, -regardless of whether it is NT, Samba or any other type of domain master -that is providing this service.

    [Note that nmbd can be configured as a WINS server, but it is not -necessary to specifically use samba as your WINS server. MS Windows -NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and samba environment on -a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a samba-only environment, it is -recommended that you use one and only one Samba server as your WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the "workgroup" option in smb.conf to control what workgroup -Samba becomes a part of.

    I also added a try_first_pass line after the winbind.so line to get rid of +annoying double prompts for passwords.

    Samba also has a useful option for a Samba server to offer itself for -browsing on another subnet. It is recommended that this option is only -used for 'unusual' purposes: announcements over the internet, for -example. See "remote announce" in the smb.conf man page.

    Now restart your Samba and try connecting through your application that you +configured in the pam.conf.

    17.3. Problem resolution16.6. Limitations

    If something doesn't work then hopefully the log.nmb file will help -you track down the problem. Try a debug level of 2 or 3 for finding -problems. Also note that the current browse list usually gets stored -in text form in a file called browse.dat.

    Note that if it doesn't work for you, then you should still be able to -type the server name as \\SERVER in filemanager then hit enter and -filemanager should display the list of available shares.

    Some people find browsing fails because they don't have the global -"guest account" set to a valid account. Remember that the IPC$ -connection that lists the shares is done as guest, and thus you must -have a valid guest account.

    Winbind has a number of limitations in its current + released version that we hope to overcome in future + releases:

    MS Windows 2000 and upwards (as with Samba) can be configured to disallow -anonymous (ie: Guest account) access to the IPC$ share. In that case, the -MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the -name of the currently logged in user to query the IPC$ share. MS Windows -9X clients are not able to do this and thus will NOT be able to browse -server resources.

    • Also, a lot of people are getting bitten by the problem of too many -parameters on the command line of nmbd in inetd.conf. This trick is to -not use spaces between the option and the parameter (eg: -d2 instead -of -d 2), and to not use the -B and -N options. New versions of nmbd -are now far more likely to correctly find your broadcast and network -address, so in most cases these aren't needed.

      Winbind is currently only available for + the Linux, Solaris and IRIX operating systems, although ports to other operating + systems are certainly possible. For such ports to be feasible, + we require the C library of the target operating system to + support the Name Service Switch and Pluggable Authentication + Modules systems. This is becoming more common as NSS and + PAM gain support among UNIX vendors.

    • The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option -in smb.conf)

      The mappings of Windows NT RIDs to UNIX ids + is not made algorithmically and depends on the order in which + unmapped users or groups are seen by winbind. It may be difficult + to recover the mappings of rid to UNIX id mapping if the file + containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take + into account possible workstation and logon time restrictions + that may be been set for Windows NT users, this is + instead up to the PDC to enforce.

    17.4. Browsing across subnets16.7. Conclusion

    Since the release of Samba 1.9.17(alpha1) Samba has been -updated to enable it to support the replication of browse lists -across subnet boundaries. New code and options have been added to -achieve this. This section describes how to set this feature up -in different settings.

    To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic) you must set up at least -one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing -NetBIOS name to IP address translation to be done by doing a direct -query of the WINS server. This is done via a directed UDP packet on -port 137 to the WINS server machine. The reason for a WINS server is -that by default, all NetBIOS name to IP address translation is done -by broadcasts from the querying machine. This means that machines -on one subnet will not be able to resolve the names of machines on -another subnet without using a WINS server.

    Remember, for browsing across subnets to work correctly, all machines, -be they Windows 95, Windows NT, or Samba servers must have the IP address -of a WINS server given to them by a DHCP server, or by manual configuration -(for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the smb.conf file.

    The winbind system, through the use of the Name Service + Switch, Pluggable Authentication Modules, and appropriate + Microsoft RPC calls have allowed us to provide seamless + integration of Microsoft Windows NT domain users on a + UNIX system. The result is a great reduction in the administrative + cost of running a mixed UNIX and NT network.

    17.4.1. How does cross subnet browsing work ?

    Cross subnet browsing is a complicated dance, containing multiple -moving parts. It has taken Microsoft several years to get the code -that achieves this correct, and Samba lags behind in some areas. -Samba is capable of cross subnet browsing when configured correctly.

    Consider a network set up as follows :

                                       (DMB)
-             N1_A      N1_B        N1_C       N1_D        N1_E
-              |          |           |          |           |
-          -------------------------------------------------------
-            |          subnet 1                       |
-          +---+                                      +---+
-          |R1 | Router 1                  Router 2   |R2 |
-          +---+                                      +---+
-            |                                          |
-            |  subnet 2              subnet 3          |
-  --------------------------       ------------------------------------
-  |     |     |      |               |        |         |           |
- N2_A  N2_B  N2_C   N2_D           N3_A     N3_B      N3_C        N3_D 
-                    (WINS)

    Consisting of 3 subnets (1, 2, 3) connected by two routers -(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines -on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume -for the moment that all these machines are configured to be in the -same workgroup (for simplicities sake). Machine N1_C on subnet 1 -is configured as Domain Master Browser (ie. it will collate the -browse lists for the workgroup). Machine N2_D is configured as -WINS server and all the other machines are configured to register -their NetBIOS names with it.

    As all these machines are booted up, elections for master browsers -will take place on each of the three subnets. Assume that machine -N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on -subnet 3 - these machines are known as local master browsers for -their particular subnet. N1_C has an advantage in winning as the -local master browser on subnet 1 as it is set up as Domain Master -Browser.

    On each of the three networks, machines that are configured to -offer sharing services will broadcast that they are offering -these services. The local master browser on each subnet will -receive these broadcasts and keep a record of the fact that -the machine is offering a service. This list of records is -the basis of the browse list. For this case, assume that -all the machines are configured to offer services so all machines -will be on the browse list.

    For each network, the local master browser on that network is -considered 'authoritative' for all the names it receives via -local broadcast. This is because a machine seen by the local -master browser via a local broadcast must be on the same -network as the local master browser and thus is a 'trusted' -and 'verifiable' resource. Machines on other networks that -the local master browsers learn about when collating their -browse lists have not been directly seen - these records are -called 'non-authoritative'.

    At this point the browse lists look as follows (these are -the machines you would see in your network neighborhood if -you looked in it on a particular network right now).

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D

    Note that at this point all the subnets are separate, no -machine is seen across any of the subnets.

    Now examine subnet 2. As soon as N2_B has become the local -master browser it looks for a Domain master browser to synchronize -its browse list with. It does this by querying the WINS server -(N2_D) for the IP address associated with the NetBIOS name -WORKGROUP>1B<. This name was registerd by the Domain master -browser (N1_C) with the WINS server as soon as it was booted.

    Once N2_B knows the address of the Domain master browser it -tells it that is the local master browser for subnet 2 by -sending a MasterAnnouncement packet as a UDP port 138 packet. -It then synchronizes with it by doing a NetServerEnum2 call. This -tells the Domain Master Browser to send it all the server -names it knows about. Once the domain master browser receives -the MasterAnnouncement packet it schedules a synchronization -request to the sender of that packet. After both synchronizations -are done the browse lists look like :

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-
-Servers with a (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on -subnets 1 or 2 will see all the servers on both, users on -subnet 3 will still only see the servers on their own subnet.

    The same sequence of events that occured for N2_B now occurs -for the local master browser on subnet 3 (N3_D). When it -synchronizes browse lists with the domain master browser (N1_A) -it gets both the server entries on subnet 1, and those on -subnet 2. After N3_D has synchronized with N1_C and vica-versa -the browse lists look like.

    Chapter 17. Integrating MS Windows networks with Samba

    This section deals with NetBIOS over TCP/IP name to IP address resolution. If you +your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this +section does not apply to your installation. If your installation involves use of +NetBIOS over TCP/IP then this section may help you to resolve networking problems.

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-
-Servers with a (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all sunbets, users on -subnet 2 will still only see the servers on subnets 1 and 2, but not 3.

    NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS + over Logical Link Control (LLC). On modern networks it is highly advised + to NOT run NetBEUI at all. Note also that there is NO such thing as + NetBEUI over TCP/IP - the existence of such a protocol is a complete + and utter mis-apprehension.

    Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will recieve the missing -server entries. Finally - and as a steady state (if no machines -are removed or shut off) the browse lists will look like :

    Since the introduction of MS Windows 2000 it is possible to run MS Windows networking +without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS +name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over +TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be +used and UDP port 137 and TCP port 139 will not.

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-	
-Servers with a (*) after them are non-authoritative names.

    Synchronizations between the domain master browser and local -master browsers will continue to occur, but this should be a -steady state situation.

    When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then +the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet +Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic).

    If either router R1 or R2 fails the following will occur:

    When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that +disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires +Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). +Use of DHCP with ADS is recommended as a further means of maintaining central control +over client workstation network configuration.

    17.1. Name Resolution in a pure Unix/Linux world

    The key configuration files covered in this section are:

      • Names of computers on each side of the inaccessible network fragments - will be maintained for as long as 36 minutes, in the network neighbourhood - lists. -

        /etc/hosts

      • Attempts to connect to these inaccessible computers will fail, but the - names will not be removed from the network neighbourhood lists. -

        /etc/resolv.conf

      • If one of the fragments is cut off from the WINS server, it will only - be able to access servers on its local subnet, by using subnet-isolated - broadcast NetBIOS name resolution. The effects are similar to that of - losing access to a DNS server. -

        /etc/host.conf

  • /etc/nsswitch.conf

    • 17.5. Setting up a WINS server

    17.1.1. /etc/hosts

    Either a Samba machine or a Windows NT Server machine may be set up -as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the smb.conf file on the selected machine : -in the [globals] section add the line

    Contains a static list of IP Addresses and names. +eg:

    wins support = yes

    	127.0.0.1	localhost localhost.localdomain
+	192.168.1.1	bigbox.caldera.com	bigbox	alias4box

    Versions of Samba prior to 1.9.17 had this parameter default to -yes. If you have any older versions of Samba on your network it is -strongly suggested you upgrade to a recent version, or at the very -least set the parameter to 'no' on all these machines.

    Machines with "wins support = yes" will keep a list of -all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    You should set up only ONE wins server. Do NOT set the -"wins support = yes" option on more than one Samba -server.

    The purpose of /etc/hosts is to provide a +name resolution mechanism so that uses do not need to remember +IP addresses.

    To set up a Windows NT Server as a WINS server you need to set up -the WINS service - see your NT documentation for details. Note that -Windows NT WINS Servers can replicate to each other, allowing more -than one to be set up in a complex subnet environment. As Microsoft -refuse to document these replication protocols Samba cannot currently -participate in these replications. It is possible in the future that -a Samba->Samba WINS replication protocol may be defined, in which -case more than one Samba machine could be set up as a WINS server -but currently only one Samba server should have the "wins support = yes" -parameter set.

    Network packets that are sent over the physical network transport +layer communicate not via IP addresses but rather using the Media +Access Control address, or MAC address. IP Addresses are currently +32 bits in length and are typically presented as four (4) decimal +numbers that are separated by a dot (or period). eg: 168.192.1.1

    After the WINS server has been configured you must ensure that all -machines participating on the network are configured with the address -of this WINS server. If your WINS server is a Samba machine, fill in -the Samba machine IP address in the "Primary WINS Server" field of -the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs -in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of -all smb.conf files :

    MAC Addresses use 48 bits (or 6 bytes) and are typically represented +as two digit hexadecimal numbers separated by colons. eg: +40:8e:0a:12:34:56

    wins server = >name or IP address<

    Every network interfrace must have an MAC address. Associated with +a MAC address there may be one or more IP addresses. There is NO +relationship between an IP address and a MAC address, all such assignments +are arbitary or discretionary in nature. At the most basic level all +network communications takes place using MAC addressing. Since MAC +addresses must be globally unique, and generally remains fixed for +any particular interface, the assignment of an IP address makes sense +from a network management perspective. More than one IP address can +be assigned per MAC address. One address must be the primary IP address, +this is the address that will be returned in the ARP reply.

    where >name or IP address< is either the DNS name of the WINS server -machine or its IP address.

    When a user or a process wants to communicate with another machine +the protocol implementation ensures that the "machine name" or "host +name" is resolved to an IP address in a manner that is controlled +by the TCP/IP configuration control files. The file +/etc/hosts is one such file.

    Note that this line MUST NOT BE SET in the smb.conf file of the Samba -server acting as the WINS server itself. If you set both the -"wins support = yes" option and the -"wins server = <name>" option then -nmbd will fail to start.

    When the IP address of the destination interface has been +determined a protocol called ARP/RARP is used to identify +the MAC address of the target interface. ARP stands for Address +Resolution Protocol, and is a broadcast oriented method that +uses UDP (User Datagram Protocol) to send a request to all +interfaces on the local network segment using the all 1's MAC +address. Network interfaces are programmed to respond to two +MAC addresses only; their own unique address and the address +ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will +contain the MAC address and the primary IP address for each +interface.

    There are two possible scenarios for setting up cross subnet browsing. -The first details setting up cross subnet browsing on a network containing -Windows 95, Samba and Windows NT machines that are not configured as -part of a Windows NT Domain. The second details setting up cross subnet -browsing on networks that contain NT Domains.

    The /etc/hosts file is foundational to all +Unix/Linux TCP/IP installations and as a minumum will contain +the localhost and local network interface IP addresses and the +primary names by which they are known within the local machine. +This file helps to prime the pump so that a basic level of name +resolution can exist before any other method of name resolution +becomes available.

    17.6. Setting up Browsing in a WORKGROUP

    To set up cross subnet browsing on a network containing machines -in up to be in a WORKGROUP, not an NT Domain you need to set up one -Samba server to be the Domain Master Browser (note that this is *NOT* -the same as a Primary Domain Controller, although in an NT Domain the -same machine plays both roles). The role of a Domain master browser is -to collate the browse lists from local master browsers on all the -subnets that have a machine participating in the workgroup. Without -one machine configured as a domain master browser each subnet would -be an isolated workgroup, unable to see any machines on any other -subnet. It is the presense of a domain master browser that makes -cross subnet browsing possible for a workgroup.

    17.1.2. /etc/resolv.conf

    In an WORKGROUP environment the domain master browser must be a -Samba server, and there must only be one domain master browser per -workgroup name. To set up a Samba server as a domain master browser, -set the following option in the [global] section of the smb.conf file :

    This file tells the name resolution libraries:

    domain master = yes

    • The domain master browser should also preferrably be the local master -browser for its own subnet. In order to achieve this set the following -options in the [global] section of the smb.conf file :

      The name of the domain to which the machine + belongs + 

    •         domain master = yes
-        local master = yes
-        preferred master = yes
-        os level = 65

      The name(s) of any domains that should be + automatically searched when trying to resolve unqualified + host names to their IP address +

    • The domain master browser may be the same machine as the WINS -server, if you require.

      The name or IP address of available Domain + Name Servers that may be asked to perform name to address + translation lookups +

    17.1.3. /etc/host.conf

    Next, you should ensure that each of the subnets contains a -machine that can act as a local master browser for the -workgroup. Any MS Windows NT/2K/XP/2003 machine should be -able to do this, as will Windows 9x machines (although these -tend to get rebooted more often, so it's not such a good idea -to use these). To make a Samba server a local master browser -set the following options in the [global] section of the -smb.conf file :

    /etc/host.conf is the primary means by +which the setting in /etc/resolv.conf may be affected. It is a +critical configuration file. This file controls the order by +which name resolution may procede. The typical structure is:

            domain master = no
-        local master = yes
-        preferred master = yes
-        os level = 65
    order hosts,bind + multi on

    Do not do this for more than one Samba server on each subnet, -or they will war with each other over which is to be the local -master browser.

    The "local master" parameter allows Samba to act as a local master -browser. The "preferred master" causes nmbd to force a browser -election on startup and the "os level" parameter sets Samba high -enough so that it should win any browser elections.

    If you have an NT machine on the subnet that you wish to -be the local master browser then you can disable Samba from -becoming a local master browser by setting the following -options in the [global] section of the smb.conf file :

            domain master = no
-        local master = no
-        preferred master = no
-        os level = 0

    then both addresses should be returned. Please refer to the +man page for host.conf for further details.

    17.7. Setting up Browsing in a DOMAIN

    If you are adding Samba servers to a Windows NT Domain then -you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a Domain -name is also the Domain master browser for that name, and many -things will break if a Samba server registers the Domain master -browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC.

    17.1.4. /etc/nsswitch.conf

    For subnets other than the one containing the Windows NT PDC -you may set up Samba servers as local master browsers as -described. To make a Samba server a local master browser set -the following options in the [global] section of the smb.conf -file :

    This file controls the actual name resolution targets. The +file typically has resolver object specifications as follows:

            domain master = no
-        local master = yes
-        preferred master = yes
-        os level = 65
    # /etc/nsswitch.conf + # + # Name Service Switch configuration file. + # + + passwd: compat + # Alternative entries for password authentication are: + # passwd: compat files nis ldap winbind + shadow: compat + group: compat + + hosts: files nis dns + # Alternative entries for host name resolution are: + # hosts: files dns nis nis+ hesoid db compat ldap wins + networks: nis files dns + + ethers: nis files + protocols: nis files + rpc: nis files + services: nis files

    If you wish to have a Samba server fight the election with machines -on the same subnet you may set the "os level" parameter to lower -levels. By doing this you can tune the order of machines that -will become local master browsers if they are running. For -more details on this see the section "FORCING SAMBA TO BE THE MASTER" -below.

    Of course, each of these mechanisms requires that the appropriate +facilities and/or services are correctly configured.

    If you have Windows NT machines that are members of the domain -on all subnets, and you are sure they will always be running then -you can disable Samba from taking part in browser elections and -ever becoming a local master browser by setting following options -in the [global] section of the smb.conf file :

    It should be noted that unless a network request/message must be +sent, TCP/IP networks are silent. All TCP/IP communications assumes a +principal of speaking only when necessary.

    Starting with version 2.2.0 samba has Linux support for extensions to +the name service switch infrastructure so that linux clients will +be able to obtain resolution of MS Windows NetBIOS names to IP +Addresses. To gain this functionality Samba needs to be compiled +with appropriate arguments to the make command (ie: domain master = no - local master = no - preferred master = no - os level = 0

    make +nsswitch/libnss_wins.so). The resulting library should +then be installed in the /lib directory and +the "wins" parameter needs to be added to the "hosts:" line in +the /etc/nsswitch.conf file. At this point it +will be possible to ping any MS Windows machine by it's NetBIOS +machine name, so long as that machine is within the workgroup to +which both the samba machine and the MS Windows machine belong.

    17.8. Forcing samba to be the master17.2. Name resolution as used within MS Windows networking

    Who becomes the "master browser" is determined by an election process -using broadcasts. Each election packet contains a number of parameters -which determine what precedence (bias) a host should have in the -election. By default Samba uses a very low precedence and thus loses -elections to just about anyone else.

    MS Windows networking is predicated about the name each machine +is given. This name is known variously (and inconsistently) as +the "computer name", "machine name", "networking name", "netbios name", +"SMB name". All terms mean the same thing with the exception of +"netbios name" which can apply also to the name of the workgroup or the +domain name. The terms "workgroup" and "domain" are really just a +simply name with which the machine is associated. All NetBIOS names +are exactly 16 characters in length. The 16th character is reserved. +It is used to store a one byte value that indicates service level +information for the NetBIOS name that is registered. A NetBIOS machine +name is therefore registered for each service type that is provided by +the client/server.

    If you want Samba to win elections then just set the "os level" global -option in smb.conf to a higher number. It defaults to 0. Using 34 -would make it win all elections over every other system (except other -samba systems!)

    The following are typical NetBIOS name/service type registrations:

    	Unique NetBIOS Names:
+		MACHINENAME<00>	= Server Service is running on MACHINENAME
+		MACHINENAME<03> = Generic Machine Name (NetBIOS name)
+		MACHINENAME<20> = LanMan Server service is running on MACHINENAME
+		WORKGROUP<1b> = Domain Master Browser
+
+	Group Names:
+		WORKGROUP<03> = Generic Name registered by all members of WORKGROUP
+		WORKGROUP<1c> = Domain Controllers / Netlogon Servers
+		WORKGROUP<1d> = Local Master Browsers
+		WORKGROUP<1e> = Internet Name Resolvers

    It should be noted that all NetBIOS machines register their own +names as per the above. This is in vast contrast to TCP/IP +installations where traditionally the system administrator will +determine in the /etc/hosts or in the DNS database what names +are associated with each IP address.

    One further point of clarification should be noted, the /etc/hosts +file and the DNS records do not provide the NetBIOS name type information +that MS Windows clients depend on to locate the type of service that may +be needed. An example of this is what happens when an MS Windows client +wants to locate a domain logon server. It find this service and the IP +address of a server that provides it by performing a lookup (via a +NetBIOS broadcast) for enumeration of all machines that have +registered the name type *<1c>. A logon request is then sent to each +IP address that is returned in the enumerated list of IP addresses. Which +ever machine first replies then ends up providing the logon services.

    The name "workgroup" or "domain" really can be confusing since these +have the added significance of indicating what is the security +architecture of the MS Windows network. The term "workgroup" indicates +that the primary nature of the network environment is that of a +peer-to-peer design. In a WORKGROUP all machines are responsible for +their own security, and generally such security is limited to use of +just a password (known as SHARE MODE security). In most situations +with peer-to-peer networking the users who control their own machines +will simply opt to have no security at all. It is possible to have +USER MODE security in a WORKGROUP environment, thus requiring use +of a user name and a matching password.

    A "os level" of 2 would make it beat WfWg and Win95, but not MS Windows -NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

    MS Windows networking is thus predetermined to use machine names +for all local and remote machine message passing. The protocol used is +called Server Message Block (SMB) and this is implemented using +the NetBIOS protocol (Network Basic Input Output System). NetBIOS can +be encapsulated using LLC (Logical Link Control) protocol - in which case +the resulting protocol is called NetBEUI (Network Basic Extended User +Interface). NetBIOS can also be run over IPX (Internetworking Packet +Exchange) protocol as used by Novell NetWare, and it can be run +over TCP/IP protocols - in which case the resulting protocol is called +NBT or NetBT, the NetBIOS over TCP/IP.

    The maximum os level is 255

    MS Windows machines use a complex array of name resolution mechanisms. +Since we are primarily concerned with TCP/IP this demonstration is +limited to this area.

    17.2.1. The NetBIOS Name Cache

    If you want samba to force an election on startup, then set the -"preferred master" global option in smb.conf to "yes". Samba will -then have a slight advantage over other potential master browsers -that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are windows 95 or NT or -samba) on the same local subnet both set with "preferred master" to -"yes", then periodically and continually they will force an election -in order to become the local master browser.

    All MS Windows machines employ an in memory buffer in which is +stored the NetBIOS names and IP addresses for all external +machines that that machine has communicated with over the +past 10-15 minutes. It is more efficient to obtain an IP address +for a machine from the local cache than it is to go through all the +configured name resolution mechanisms.

    If you want samba to be a "domain master browser", then it is -recommended that you also set "preferred master" to "yes", because -samba will not become a domain master browser for the whole of your -LAN or WAN if it is not also a local master browser on its own -broadcast isolated subnet.

    If a machine whose name is in the local name cache has been shut +down before the name had been expired and flushed from the cache, then +an attempt to exchange a message with that machine will be subject +to time-out delays. i.e.: Its name is in the cache, so a name resolution +lookup will succeed, but the machine can not respond. This can be +frustrating for users - but it is a characteristic of the protocol.

    It is possible to configure two samba servers to attempt to become -the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other samba servers will -attempt to become the domain master browser every 5 minutes. They -will find that another samba server is already the domain master -browser and will fail. This provides automatic redundancy, should -the current domain master browser fail.

    The MS Windows utility that allows examination of the NetBIOS +name cache is called "nbtstat". The Samba equivalent of this +is called "nmblookup".

    17.9. Making samba the domain master

    The domain master is responsible for collating the browse lists of -multiple subnets so that browsing can occur between subnets. You can -make samba act as the domain master by setting "domain master = yes" -in smb.conf. By default it will not be a domain master.

    Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain.

    When samba is the domain master and the master browser it will listen -for master announcements (made roughly every twelve minutes) from local -master browsers on other subnets and then contact them to synchronise -browse lists.

    If you want samba to be the domain master then I suggest you also set -the "os level" high enough to make sure it wins elections, and set -"preferred master" to "yes", to get samba to force an election on -startup.

    Note that all your servers (including samba) and clients should be -using a WINS server to resolve NetBIOS names. If your clients are only -using broadcasting to resolve NetBIOS names, then two things will occur:

    1. your local master browsers will be unable to find a domain master - browser, as it will only be looking on the local subnet. -

    2. 17.2.2. The LMHOSTS file

      if a client happens to get hold of a domain-wide browse list, and - a user attempts to access a host in that list, it will be unable to - resolve the NetBIOS name of that host. -

    This file is usually located in MS Windows NT 4.0 or +2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +the IP Address and the machine name in matched pairs. The +LMHOSTS file performs NetBIOS name +to IP address mapping oriented.

    If, however, both samba and your clients are using a WINS server, then:

    It typically looks like:

    	# Copyright (c) 1998 Microsoft Corp.
+	#
+	# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
+	# over TCP/IP) stack for Windows98
+	#
+	# This file contains the mappings of IP addresses to NT computernames
+	# (NetBIOS) names.  Each entry should be kept on an individual line.
+	# The IP address should be placed in the first column followed by the
+	# corresponding computername. The address and the comptername
+	# should be separated by at least one space or tab. The "#" character
+	# is generally used to denote the start of a comment (see the exceptions
+	# below).
+	#
+	# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
+	# files and offers the following extensions:
+	#
+	#      #PRE
+	#      #DOM:<domain>
+	#      #INCLUDE <filename>
+	#      #BEGIN_ALTERNATE
+	#      #END_ALTERNATE
+	#      \0xnn (non-printing character support)
+	#
+	# Following any entry in the file with the characters "#PRE" will cause
+	# the entry to be preloaded into the name cache. By default, entries are
+	# not preloaded, but are parsed only after dynamic name resolution fails.
+	#
+	# Following an entry with the "#DOM:<domain>" tag will associate the
+	# entry with the domain specified by <domain>. This affects how the
+	# browser and logon services behave in TCP/IP environments. To preload
+	# the host name associated with #DOM entry, it is necessary to also add a
+	# #PRE to the line. The <domain> is always preloaded although it will not
+	# be shown when the name cache is viewed.
+	#
+	# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
+	# software to seek the specified <filename> and parse it as if it were
+	# local. <filename> is generally a UNC-based name, allowing a
+	# centralized lmhosts file to be maintained on a server.
+	# It is ALWAYS necessary to provide a mapping for the IP address of the
+	# server prior to the #INCLUDE. This mapping must use the #PRE directive.
+	# In addtion the share "public" in the example below must be in the
+	# LanManServer list of "NullSessionShares" in order for client machines to
+	# be able to read the lmhosts file successfully. This key is under
+	# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
+	# in the registry. Simply add "public" to the list found there.
+	#
+	# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
+	# statements to be grouped together. Any single successful include
+	# will cause the group to succeed.
+	#
+	# Finally, non-printing characters can be embedded in mappings by
+	# first surrounding the NetBIOS name in quotations, then using the
+	# \0xnn notation to specify a hex value for a non-printing character.
+	#
+	# The following example illustrates all of these extensions:
+	#
+	# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
+	# 102.54.94.102    "appname  \0x14"                    #special app server
+	# 102.54.94.123    popular            #PRE             #source server
+	# 102.54.94.117    localsrv           #PRE             #needed for the include
+	#
+	# #BEGIN_ALTERNATE
+	# #INCLUDE \\localsrv\public\lmhosts
+	# #INCLUDE \\rhino\public\lmhosts
+	# #END_ALTERNATE
+	#
+	# In the above example, the "appname" server contains a special
+	# character in its name, the "popular" and "localsrv" server names are
+	# preloaded, and the "rhino" server name is specified so it can be used
+	# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
+	# system is unavailable.
+	#
+	# Note that the whole file is parsed including comments on each lookup,
+	# so keeping the number of comments to a minimum will improve performance.
+	# Therefore it is not advisable to simply add lmhosts file entries onto the
+	# end of this file.

    1. your local master browsers will contact the WINS server and, as long as - samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive samba's ip address - as its domain master browser. -

    17.2.3. HOSTS file

    when a client receives a domain-wide browse list, and a user attempts - to access a host in that list, it will contact the WINS server to - resolve the NetBIOS name of that host. as long as that host has - registered its NetBIOS name with the same WINS server, the user will - be able to see that host. -

    This file is usually located in MS Windows NT 4.0 or 2000 in +C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +the IP Address and the IP hostname in matched pairs. It can be +used by the name resolution infrastructure in MS Windows, depending +on how the TCP/IP environment is configured. This file is in +every way the equivalent of the Unix/Linux /etc/hosts file.

    17.10. Note about broadcast addresses

    17.2.4. DNS Lookup

    If your network uses a "0" based broadcast address (for example if it -ends in a 0) then you will strike problems. Windows for Workgroups -does not seem to support a 0's broadcast and you will probably find -that browsing and name lookups won't work.

    This capability is configured in the TCP/IP setup area in the network +configuration facility. If enabled an elaborate name resolution sequence +is followed the precise nature of which isdependant on what the NetBIOS +Node Type parameter is configured to. A Node Type of 0 means use +NetBIOS broadcast (over UDP broadcast) is first used if the name +that is the subject of a name lookup is not found in the NetBIOS name +cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to +Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the +WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast +lookup is used.

    17.11. Multiple interfaces

    17.2.5. WINS Lookup

    Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the "interfaces" -option in smb.conf to configure them. See smb.conf(5) for details.

    A WINS (Windows Internet Name Server) service is the equivaent of the +rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores +the names and IP addresses that are registered by a Windows client +if the TCP/IP setup has been given at least one WINS Server IP Address.

    To configure Samba to be a WINS server the following parameter needs +to be added to the smb.conf file:

    	wins support = Yes

    To configure Samba to use a WINS server the following parameters are +needed in the smb.conf file:

    	wins support = No
+	wins server = xxx.xxx.xxx.xxx

    where xxx.xxx.xxx.xxx is the IP address +of the WINS server.

    Chapter 18. Stackable VFS modules

    Chapter 18. Improved browsing in samba

    18.1. Introduction and configuration18.1. Overview of browsing

    Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to -some external modules.

    You may have problems to compile these modules, as shared libraries are -compiled and linked in different ways on different systems. -They currently have been tested against GNU/linux and IRIX.

    To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs object parameter which must point to -the exact pathname of the shared library objects. For example, to log all access -to files and use a recycle bin: - -

           [audit]
-                comment = Audited /data directory
-                path = /data
-                vfs object = /path/to/audit.so /path/to/recycle.so
-                writeable = yes
-                browseable = yes

    SMB networking provides a mechanism by which clients can access a list +of machines in a network, a so-called "browse list". This list +contains machines that are ready to offer file and/or print services +to other machines within the network. Thus it does not include +machines which aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB +browsing has been problematic for some Samba users, hence this +document.

    The modules are used in the order they are specified.

    MS Windows 2000 and later, as with Samba-3 and later, can be +configured to not use NetBIOS over TCP/IP. When configured this way +it is imperative that name resolution (using DNS/LDAP/ADS) be correctly +configured and operative. Browsing will NOT work if name resolution +from SMB machine names to IP addresses does not function correctly.

    Further documentation on writing VFS modules for Samba can be found in -the Samba Developers Guide.

    Where NetBIOS over TCP/IP is enabled use of a WINS server is highly +recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. +WINS allows remote segment clients to obtain NetBIOS name_type information +that can NOT be provided by any other means of name resolution.

    18.2. Included modules18.2. Browsing support in samba

    18.2.1. audit

    A simple module to audit file access to the syslog -facility. The following operations are logged: -

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    18.2.2. recycle

    A recycle-bin like modules. When used any unlink call -will be intercepted and files moved to the recycle -directory instead of beeing deleted.

    Supported options: -

    vfs_recycle_bin:repository

    FIXME

    vfs_recycle_bin:keeptree

    FIXME

    vfs_recycle_bin:versions

    FIXME

    vfs_recycle_bin:touch
    Samba facilitates browsing. The browsing is supported by nmbd +and is also controlled by options in the smb.conf file (see smb.conf(5)). +Samba can act as a local browse master for a workgroup and the ability +for samba to support domain logons and scripts is now available.

    FIXME

    vfs_recycle_bin:maxsize
    Samba can also act as a domain master browser for a workgroup. This +means that it will collate lists from local browse masters into a +wide area network server list. In order for browse clients to +resolve the names they may find in this list, it is recommended that +both samba and your clients use a WINS server.

    FIXME

    vfs_recycle_bin:exclude
    Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain: on each wide area +network, you must only ever have one domain master browser per workgroup, +regardless of whether it is NT, Samba or any other type of domain master +that is providing this service.

    FIXME

    vfs_recycle_bin:exclude_dir
    [Note that nmbd can be configured as a WINS server, but it is not +necessary to specifically use samba as your WINS server. MS Windows +NT4, Server or Advanced Server 2000 or 2003 can be configured as +your WINS server. In a mixed NT/2000/2003 server and samba environment on +a Wide Area Network, it is recommended that you use the Microsoft +WINS server capabilities. In a samba-only environment, it is +recommended that you use one and only one Samba server as your WINS server.

    FIXME

    vfs_recycle_bin:noversions
    To get browsing to work you need to run nmbd as usual, but will need +to use the "workgroup" option in smb.conf to control what workgroup +Samba becomes a part of.

    FIXME

    Samba also has a useful option for a Samba server to offer itself for +browsing on another subnet. It is recommended that this option is only +used for 'unusual' purposes: announcements over the internet, for +example. See "remote announce" in the smb.conf man page.

    18.2.3. netatalk

    18.3. Problem resolution

    A netatalk module, that will ease co-existence of samba and -netatalk file sharing services.

    If something doesn't work then hopefully the log.nmb file will help +you track down the problem. Try a debug level of 2 or 3 for finding +problems. Also note that the current browse list usually gets stored +in text form in a file called browse.dat.

    Advantages compared to the old netatalk module: -

    it doesn't care about creating of .AppleDouble forks, just keeps ones in sync
    if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically
    Note that if it doesn't work for you, then you should still be able to +type the server name as \\SERVER in filemanager then hit enter and +filemanager should display the list of available shares.

    Some people find browsing fails because they don't have the global +"guest account" set to a valid account. Remember that the IPC$ +connection that lists the shares is done as guest, and thus you must +have a valid guest account.

    MS Windows 2000 and upwards (as with Samba) can be configured to disallow +anonymous (ie: Guest account) access to the IPC$ share. In that case, the +MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the +name of the currently logged in user to query the IPC$ share. MS Windows +9X clients are not able to do this and thus will NOT be able to browse +server resources.

    Also, a lot of people are getting bitten by the problem of too many +parameters on the command line of nmbd in inetd.conf. This trick is to +not use spaces between the option and the parameter (eg: -d2 instead +of -d 2), and to not use the -B and -N options. New versions of nmbd +are now far more likely to correctly find your broadcast and network +address, so in most cases these aren't needed.

    The other big problem people have is that their broadcast address, +netmask or IP address is wrong (specified with the "interfaces" option +in smb.conf)

    18.3. VFS modules available elsewhere18.4. Browsing across subnets

    This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason ot another (e.g. it is easy for the maintainer -to have his or her own CVS tree).

    Since the release of Samba 1.9.17(alpha1) Samba has been +updated to enable it to support the replication of browse lists +across subnet boundaries. New code and options have been added to +achieve this. This section describes how to set this feature up +in different settings.

    No statemets about the stability or functionality any module -should be implied due to its presence here.

    To see browse lists that span TCP/IP subnets (ie. networks separated +by routers that don't pass broadcast traffic) you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing +NetBIOS name to IP address translation to be done by doing a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The reason for a WINS server is +that by default, all NetBIOS name to IP address translation is done +by broadcasts from the querying machine. This means that machines +on one subnet will not be able to resolve the names of machines on +another subnet without using a WINS server.

    Remember, for browsing across subnets to work correctly, all machines, +be they Windows 95, Windows NT, or Samba servers must have the IP address +of a WINS server given to them by a DHCP server, or by manual configuration +(for Win95 and WinNT, this is in the TCP/IP Properties, under Network +settings) for Samba this is in the smb.conf file.

    18.3.1. DatabaseFS18.4.1. How does cross subnet browsing work ?

    URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.phpCross subnet browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code +that achieves this correct, and Samba lags behind in some areas. +Samba is capable of cross subnet browsing when configured correctly.

    Consider a network set up as follows :

                                       (DMB)
+             N1_A      N1_B        N1_C       N1_D        N1_E
+              |          |           |          |           |
+          -------------------------------------------------------
+            |          subnet 1                       |
+          +---+                                      +---+
+          |R1 | Router 1                  Router 2   |R2 |
+          +---+                                      +---+
+            |                                          |
+            |  subnet 2              subnet 3          |
+  --------------------------       ------------------------------------
+  |     |     |      |               |        |         |           |
+ N2_A  N2_B  N2_C   N2_D           N3_A     N3_B      N3_C        N3_D 
+                    (WINS)

    By Eric Lorimer.

    Consisting of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines +on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume +for the moment that all these machines are configured to be in the +same workgroup (for simplicities sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (ie. it will collate the +browse lists for the workgroup). Machine N2_D is configured as +WINS server and all the other machines are configured to register +their NetBIOS names with it.

    I have created a VFS module which implements a fairly complete read-only -filesystem. It presents information from a database as a filesystem in -a modular and generic way to allow different databases to be used -(originally designed for organizing MP3s under directories such as -"Artists," "Song Keywords," etc... I have since applied it to a student -roster database very easily). The directory structure is stored in the -database itself and the module makes no assumptions about the database -structure beyond the table it requires to run.

    As all these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine +N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on +subnet 3 - these machines are known as local master browsers for +their particular subnet. N1_C has an advantage in winning as the +local master browser on subnet 1 as it is set up as Domain Master +Browser.

    Any feedback would be appreciated: comments, suggestions, patches, -etc... If nothing else, hopefully it might prove useful for someone -else who wishes to create a virtual filesystem.

    18.3.2. vscan

    On each of the three networks, machines that are configured to +offer sharing services will broadcast that they are offering +these services. The local master browser on each subnet will +receive these broadcasts and keep a record of the fact that +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services so all machines +will be on the browse list.

    URL: http://www.openantivirus.org/For each network, the local master browser on that network is +considered 'authoritative' for all the names it receives via +local broadcast. This is because a machine seen by the local +master browser via a local broadcast must be on the same +network as the local master browser and thus is a 'trusted' +and 'verifiable' resource. Machines on other networks that +the local master browsers learn about when collating their +browse lists have not been directly seen - these records are +called 'non-authoritative'.

    At this point the browse lists look as follows (these are +the machines you would see in your network neighborhood if +you looked in it on a particular network right now).

    Subnet           Browse Master   List
+------           -------------   ----
+Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E
+
+Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
+
+Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D

    samba-vscan is a proof-of-concept module for Samba, which -uses the VFS (virtual file system) features of Samba 2.2.x/3.0 -alphaX. Of couse, Samba has to be compiled with VFS support. -samba-vscan supports various virus scanners and is maintained -by Rainer Link.

    Chapter 19. Group mapping HOWTO

    Note that at this point all the subnets are separate, no +machine is seen across any of the subnets.

    -Starting with Samba 3.0 alpha 2, a new group mapping function is available. The -current method (likely to change) to manage the groups is a new command called -smbgroupedit.

    Now examine subnet 2. As soon as N2_B has become the local +master browser it looks for a Domain master browser to synchronize +its browse list with. It does this by querying the WINS server +(N2_D) for the IP address associated with the NetBIOS name +WORKGROUP>1B<. This name was registerd by the Domain master +browser (N1_C) with the WINS server as soon as it was booted.

    The first immediate reason to use the group mapping on a PDC, is that -the domain admin group of smb.conf is -now gone. This parameter was used to give the listed users local admin rights -on their workstations. It was some magic stuff that simply worked but didn't -scale very well for complex setups.

    Once N2_B knows the address of the Domain master browser it +tells it that is the local master browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This +tells the Domain Master Browser to send it all the server +names it knows about. Once the domain master browser receives +the MasterAnnouncement packet it schedules a synchronization +request to the sender of that packet. After both synchronizations +are done the browse lists look like :

    Subnet           Browse Master   List
+------           -------------   ----
+Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
+                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
+
+Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
+                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
+
+Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
+
+Servers with a (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on +subnets 1 or 2 will see all the servers on both, users on +subnet 3 will still only see the servers on their own subnet.

    The same sequence of events that occured for N2_B now occurs +for the local master browser on subnet 3 (N3_D). When it +synchronizes browse lists with the domain master browser (N1_A) +it gets both the server entries on subnet 1, and those on +subnet 2. After N3_D has synchronized with N1_C and vica-versa +the browse lists look like.

    Subnet           Browse Master   List
+------           -------------   ----
+Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
+                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
+                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
+
+Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
+                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
+
+Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
+                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
+                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
+
+Servers with a (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all sunbets, users on +subnet 2 will still only see the servers on subnets 1 and 2, but not 3.

    Finally, the local master browser for subnet 2 (N2_B) will sync again +with the domain master browser (N1_C) and will recieve the missing +server entries. Finally - and as a steady state (if no machines +are removed or shut off) the browse lists will look like :

    Let me explain how it works on NT/W2K, to have this magic fade away. -When installing NT/W2K on a computer, the installer program creates some users -and groups. Notably the 'Administrators' group, and gives to that group some -privileges like the ability to change the date and time or to kill any process -(or close too) running on the local machine. The 'Administrator' user is a -member of the 'Administrators' group, and thus 'inherit' the 'Administrators' -group privileges. If a 'joe' user is created and become a member of the -'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

    Subnet           Browse Master   List
+------           -------------   ----
+Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
+                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
+                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
+
+Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
+                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
+                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
+
+Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
+                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
+                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
+	
+Servers with a (*) after them are non-authoritative names.

    When a NT/W2K machine is joined to a domain, during that phase, the "Domain -Administrators' group of the PDC is added to the 'Administrators' group of the -workstation. Every members of the 'Domain Administrators' group 'inherit' the -rights of the 'Administrators' group when logging on the workstation.

    Synchronizations between the domain master browser and local +master browsers will continue to occur, but this should be a +steady state situation.

    You are now wondering how to make some of your samba PDC users members of the -'Domain Administrators' ? That's really easy.

    If either router R1 or R2 fails the following will occur:

    1. create a unix group (usually in /etc/group), let's call it domadm

      Names of computers on each side of the inaccessible network fragments + will be maintained for as long as 36 minutes, in the network neighbourhood + lists. +

    2. add to this group the users that must be Administrators. For example if you want joe,john and mary, your entry in /etc/group will look like:

      domadm:x:502:joe,john,mary

      Attempts to connect to these inaccessible computers will fail, but the + names will not be removed from the network neighbourhood lists. +

    3. Map this domadm group to the domain admins group by running the command:

      If one of the fragments is cut off from the WINS server, it will only + be able to access servers on its local subnet, by using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of + losing access to a DNS server. +

    18.5. Setting up a WINS server

    Either a Samba machine or a Windows NT Server machine may be set up +as a WINS server. To set a Samba machine to be a WINS server you must +add the following option to the smb.conf file on the selected machine : +in the [globals] section add the line

    smbgroupedit -c "Domain Admins" -u domadm wins support = yes

    You're set, joe, john and mary are domain administrators !

    Versions of Samba prior to 1.9.17 had this parameter default to +yes. If you have any older versions of Samba on your network it is +strongly suggested you upgrade to a recent version, or at the very +least set the parameter to 'no' on all these machines.

    Like the Domain Admins group, you can map any arbitrary Unix group to any NT -group. You can also make any Unix group a domain group. For example, on a domain -member machine (an NT/W2K or a samba server running winbind), you would like to -give access to a certain directory to some users who are member of a group on -your samba PDC. Flag that group as a domain group by running:

    Machines with "wins support = yes" will keep a list of +all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    You should set up only ONE wins server. Do NOT set the +"smbgroupedit -a unixgroup -td

    wins support = yes" option on more than one Samba +server.

    You can list the various groups in the mapping database like this

    To set up a Windows NT Server as a WINS server you need to set up +the WINS service - see your NT documentation for details. Note that +Windows NT WINS Servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuse to document these replication protocols Samba cannot currently +participate in these replications. It is possible in the future that +a Samba->Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server +but currently only one Samba server should have the "wins support = yes" +parameter set.

    After the WINS server has been configured you must ensure that all +machines participating on the network are configured with the address +of this WINS server. If your WINS server is a Samba machine, fill in +the Samba machine IP address in the "Primary WINS Server" field of +the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs +in Windows 95 or Windows NT. To tell a Samba server the IP address +of the WINS server add the following line to the [global] section of +all smb.conf files :

    smbgroupedit -vwins server = >name or IP address<

    Chapter 20. Samba performance issues

    20.1. Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are -trying to see if it performs well you should really compare it to -programs that use the same protocol. The most readily available -programs for file transfer that use TCP are ftp or another TCP based -SMB server.

    If you want to test against something like a NT or WfWg server then -you will have to disable all but TCP on either the client or -server. Otherwise you may well be using a totally different protocol -(such as Netbeui) and comparisons may not be valid.

    where >name or IP address< is either the DNS name of the WINS server +machine or its IP address.

    Generally you should find that Samba performs similarly to ftp at raw -transfer speed. It should perform quite a bit faster than NFS, -although this very much depends on your system.

    Note that this line MUST NOT BE SET in the smb.conf file of the Samba +server acting as the WINS server itself. If you set both the +"wins support = yes" option and the +"wins server = <name>" option then +nmbd will fail to start.

    Several people have done comparisons between Samba and Novell, NFS or -WinNT. In some cases Samba performed the best, in others the worst. I -suspect the biggest factor is not Samba vs some other system but the -hardware and drivers used on the various systems. Given similar -hardware Samba should certainly be competitive in speed with other -systems.

    There are two possible scenarios for setting up cross subnet browsing. +The first details setting up cross subnet browsing on a network containing +Windows 95, Samba and Windows NT machines that are not configured as +part of a Windows NT Domain. The second details setting up cross subnet +browsing on networks that contain NT Domains.

    20.2. Socket options18.6. Setting up Browsing in a WORKGROUP

    There are a number of socket options that can greatly affect the -performance of a TCP based server like Samba.

    To set up cross subnet browsing on a network containing machines +in up to be in a WORKGROUP, not an NT Domain you need to set up one +Samba server to be the Domain Master Browser (note that this is *NOT* +the same as a Primary Domain Controller, although in an NT Domain the +same machine plays both roles). The role of a Domain master browser is +to collate the browse lists from local master browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a domain master browser each subnet would +be an isolated workgroup, unable to see any machines on any other +subnet. It is the presense of a domain master browser that makes +cross subnet browsing possible for a workgroup.

    The socket options that Samba uses are settable both on the command -line with the -O option, or in the smb.conf file.

    In an WORKGROUP environment the domain master browser must be a +Samba server, and there must only be one domain master browser per +workgroup name. To set up a Samba server as a domain master browser, +set the following option in the [global] section of the smb.conf file :

    The "socket options" section of the smb.conf manual page describes how -to set these and gives recommendations.

    domain master = yes

    Getting the socket options right can make a big difference to your -performance, but getting them wrong can degrade it by just as -much. The correct settings are very dependent on your local network.

    The domain master browser should also preferrably be the local master +browser for its own subnet. In order to achieve this set the following +options in the [global] section of the smb.conf file :

    The socket option TCP_NODELAY is the one that seems to make the -biggest single difference for most networks. Many people report that -adding "socket options = TCP_NODELAY" doubles the read performance of -a Samba drive. The best explanation I have seen for this is that the -Microsoft TCP/IP stack is slow in sending tcp ACKs.

    20.3. Read size

    domain master = yes
+local master = yes
+preferred master = yes
+os level = 65

    The option "read size" affects the overlap of disk reads/writes with -network reads/writes. If the amount of data being transferred in -several of the SMB commands (currently SMBwrite, SMBwriteX and -SMBreadbraw) is larger than this value then the server begins writing -the data before it has received the whole packet from the network, or -in the case of SMBreadbraw, it begins writing to the network before -all the data has been read from disk.

    The domain master browser may be the same machine as the WINS +server, if you require.

    Next, you should ensure that each of the subnets contains a +machine that can act as a local master browser for the +workgroup. Any MS Windows NT/2K/XP/2003 machine should be +able to do this, as will Windows 9x machines (although these +tend to get rebooted more often, so it's not such a good idea +to use these). To make a Samba server a local master browser +set the following options in the [global] section of the +smb.conf file :

    domain master = no
+local master = yes
+preferred master = yes
+os level = 65

    Do not do this for more than one Samba server on each subnet, +or they will war with each other over which is to be the local +master browser.

    The "local master" parameter allows Samba to act as a local master +browser. The "preferred master" causes nmbd to force a browser +election on startup and the "os level" parameter sets Samba high +enough so that it should win any browser elections.

    This overlapping works best when the speeds of disk and network access -are similar, having very little effect when the speed of one is much -greater than the other.

    If you have an NT machine on the subnet that you wish to +be the local master browser then you can disable Samba from +becoming a local master browser by setting the following +options in the [global] section of the smb.conf file :

    The default value is 16384, but very little experimentation has been -done yet to determine the optimal value, and it is likely that the best -value will vary greatly between systems anyway. A value over 65536 is -pointless and will cause you to allocate memory unnecessarily.

    domain master = no
+local master = no
+preferred master = no
+os level = 0

    20.4. Max xmit18.7. Setting up Browsing in a DOMAIN

    At startup the client and server negotiate a "maximum transmit" size, -which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the "max xmit = " option -in smb.conf. Note that this is the maximum size of SMB request that -Samba will accept, but not the maximum size that the *client* will accept. -The client maximum receive size is sent to Samba by the client and Samba -honours this limit.

    It defaults to 65536 bytes (the maximum), but it is possible that some -clients may perform better with a smaller transmit unit. Trying values -of less than 2048 is likely to cause severe problems.

    If you are adding Samba servers to a Windows NT Domain then +you must not set up a Samba server as a domain master browser. +By default, a Windows NT Primary Domain Controller for a Domain +name is also the Domain master browser for that name, and many +things will break if a Samba server registers the Domain master +browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC.

    In most cases the default is the best option.

    20.5. Log level

    For subnets other than the one containing the Windows NT PDC +you may set up Samba servers as local master browsers as +described. To make a Samba server a local master browser set +the following options in the [global] section of the smb.conf +file :

    If you set the log level (also known as "debug level") higher than 2 -then you may suffer a large drop in performance. This is because the -server flushes the log file after each operation, which can be very -expensive.

    20.6. Read raw

    domain master = no
+local master = yes
+preferred master = yes
+os level = 65

    The "read raw" operation is designed to be an optimised, low-latency -file read operation. A server may choose to not support it, -however. and Samba makes support for "read raw" optional, with it -being enabled by default.

    If you wish to have a Samba server fight the election with machines +on the same subnet you may set the "os level" parameter to lower +levels. By doing this you can tune the order of machines that +will become local master browsers if they are running. For +more details on this see the section "FORCING SAMBA TO BE THE MASTER" +below.

    In some cases clients don't handle "read raw" very well and actually -get lower performance using it than they get using the conventional -read operations.

    If you have Windows NT machines that are members of the domain +on all subnets, and you are sure they will always be running then +you can disable Samba from taking part in browser elections and +ever becoming a local master browser by setting following options +in the [global] section of the smb.conf file :

    So you might like to try "read raw = no" and see what happens on your -network. It might lower, raise or not affect your performance. Only -testing can really tell.

    domain master = no + local master = no + preferred master = no + os level = 0

    20.7. Write raw18.8. Forcing samba to be the master

    The "write raw" operation is designed to be an optimised, low-latency -file write operation. A server may choose to not support it, -however. and Samba makes support for "write raw" optional, with it -being enabled by default.

    Who becomes the "master browser" is determined by an election process +using broadcasts. Each election packet contains a number of parameters +which determine what precedence (bias) a host should have in the +election. By default Samba uses a very low precedence and thus loses +elections to just about anyone else.

    Some machines may find "write raw" slower than normal write, in which -case you may wish to change this option.

    20.8. Slow Clients

    If you want Samba to win elections then just set the "os level" global +option in smb.conf to a higher number. It defaults to 0. Using 34 +would make it win all elections over every other system (except other +samba systems!)

    One person has reported that setting the protocol to COREPLUS rather -than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).

    A "os level" of 2 would make it beat WfWg and Win95, but not MS Windows +NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

    I suspect that his PC's (386sx16 based) were asking for more data than -they could chew. I suspect a similar speed could be had by setting -"read raw = no" and "max xmit = 2048", instead of changing the -protocol. Lowering the "read size" might also help.

    20.9. Slow Logins

    The maximum os level is 255

    Slow logins are almost always due to the password checking time. Using -the lowest practical "password level" will improve things a lot. You -could also enable the "UFC crypt" option in the Makefile.

    If you want samba to force an election on startup, then set the +"preferred master" global option in smb.conf to "yes". Samba will +then have a slight advantage over other potential master browsers +that are not preferred master browsers. Use this parameter with +care, as if you have two hosts (whether they are windows 95 or NT or +samba) on the same local subnet both set with "preferred master" to +"yes", then periodically and continually they will force an election +in order to become the local master browser.

    If you want samba to be a "domain master browser", then it is +recommended that you also set "preferred master" to "yes", because +samba will not become a domain master browser for the whole of your +LAN or WAN if it is not also a local master browser on its own +broadcast isolated subnet.

    It is possible to configure two samba servers to attempt to become +the domain master browser for a domain. The first server that comes +up will be the domain master browser. All other samba servers will +attempt to become the domain master browser every 5 minutes. They +will find that another samba server is already the domain master +browser and will fail. This provides automatic redundancy, should +the current domain master browser fail.

    20.10. Client tuning18.9. Making samba the domain master

    Often a speed problem can be traced to the client. The client (for -example Windows for Workgroups) can often be tuned for better TCP -performance.

    See your client docs for details. In particular, I have heard rumours -that the WfWg options TCPWINDOWSIZE and TCPSEGMENTSIZE can have a -large impact on performance.

    Also note that some people have found that setting DefaultRcvWindow in -the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a -big improvement. I don't know why.

    My own experience wth DefaultRcvWindow is that I get much better -performance with a large value (16384 or larger). Other people have -reported that anything over 3072 slows things down enourmously. One -person even reported a speed drop of a factor of 30 when he went from -3072 to 8192. I don't know why.

    The domain master is responsible for collating the browse lists of +multiple subnets so that browsing can occur between subnets. You can +make samba act as the domain master by setting "domain master = yes" +in smb.conf. By default it will not be a domain master.

    It probably depends a lot on your hardware, and the type of unix box -you have at the other end of the link.

    Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain.

    Paul Cochrane has done some testing on client side tuning and come -to the following conclusions:

    When samba is the domain master and the master browser it will listen +for master announcements (made roughly every twelve minutes) from local +master browsers on other subnets and then contact them to synchronise +browse lists.

    Install the W2setup.exe file from www.microsoft.com. This is an -update for the winsock stack and utilities which improve performance.

    If you want samba to be the domain master then I suggest you also set +the "os level" high enough to make sure it wins elections, and set +"preferred master" to "yes", to get samba to force an election on +startup.

    Configure the win95 TCPIP registry settings to give better -perfomance. I use a program called MTUSPEED.exe which I got off the -net. There are various other utilities of this type freely available. -The setting which give the best performance for me are:

    Note that all your servers (including samba) and clients should be +using a WINS server to resolve NetBIOS names. If your clients are only +using broadcasting to resolve NetBIOS names, then two things will occur:

    1. MaxMTU Remove

    2. RWIN Remove

      your local master browsers will be unable to find a domain master + browser, as it will only be looking on the local subnet. +

    3. MTUAutoDiscover Disable

      if a client happens to get hold of a domain-wide browse list, and + a user attempts to access a host in that list, it will be unable to + resolve the NetBIOS name of that host. +

    MTUBlackHoleDetect Disable

  • If, however, both samba and your clients are using a WINS server, then:

    Time To Live Enabled

    1. Time To Live - HOPS 32

      your local master browsers will contact the WINS server and, as long as + samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive samba's ip address + as its domain master browser. +

    2. NDI Cache Size 0

    I tried virtually all of the items mentioned in the document and -the only one which made a difference to me was the socket options. It -turned out I was better off without any!!!!!

    In terms of overall speed of transfer, between various win95 clients -and a DX2-66 20MB server with a crappy NE2000 compatible and old IDE -drive (Kernel 2.0.30). The transfer rate was reasonable for 10 baseT.

    The figures are:          Put              Get 
-P166 client 3Com card:    420-440kB/s      500-520kB/s
-P100 client 3Com card:    390-410kB/s      490-510kB/s
-DX4-75 client NE2000:     370-380kB/s      330-350kB/s

    I based these test on transfer two files a 4.5MB text file and a 15MB -textfile. The results arn't bad considering the hardware Samba is -running on. It's a crap machine!!!!

    The updates mentioned in 1 and 2 brought up the transfer rates from -just over 100kB/s in some clients.

    when a client receives a domain-wide browse list, and a user attempts + to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. as long as that host has + registered its NetBIOS name with the same WINS server, the user will + be able to see that host. +

    18.10. Note about broadcast addresses

    A new client is a P333 connected via a 100MB/s card and hub. The -transfer rates from this were good: 450-500kB/s on put and 600+kB/s -on get.

    If your network uses a "0" based broadcast address (for example if it +ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a 0's broadcast and you will probably find +that browsing and name lookups won't work.

    18.11. Multiple interfaces

    Looking at standard FTP throughput, Samba is a bit slower (100kB/s -upwards). I suppose there is more going on in the samba protocol, but -if it could get up to the rate of FTP the perfomance would be quite -staggering.

    Samba now supports machines with multiple network interfaces. If you +have multiple interfaces then you will need to use the "interfaces" +option in smb.conf to configure them. See smb.conf(5) for details.

    Chapter 21. Creating Group Prolicy Files

    Chapter 19. Hosting a Microsoft Distributed File System tree on Samba

    21.1. Windows '9x19.1. Instructions

    You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -tools/reskit/netadmin/poledit. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab.

    The Distributed File System (or Dfs) provides a means of + separating the logical view of files and directories that users + see from the actual physical locations of these resources on the + network. It allows for higher availability, smoother storage expansion, + load balancing etc. For more information about Dfs, refer to Microsoft documentation.

    Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the This document explains how to host a Dfs tree on a Unix + machine (for Dfs-aware clients to browse) using Samba.

    To enable SMB-based DFS for Samba, configure it with the + --with-msdfs option. Once built, a + Samba server can be made a Dfs server by setting the global + boolean host msdfs parameter in the My Documents etc. -stuff. You then save these settings in a file called -smb.conf + file. You designate a share as a Dfs root using the share + level boolean msdfs root parameter. A Dfs root directory on + Samba hosts Dfs links in the form of symbolic links that point + to other servers. For example, a symbolic link + Config.POL that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on.

    All of this is covered in the Win98 Resource Kit documentation.

    If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings.

    The following all refers to Windows NT/200x profile migration - not to policies. -We need a separate section on policies (NTConfig.Pol) for NT4/200x.

    21.2. Windows NT 4

    junction->msdfs:storage1\share1 in + the share directory acts as the Dfs junction. When Dfs-aware + clients attempt to access the junction link, they are redirected + to the storage location (in this case, \\storage1\share1).

    Unfortunately, the Resource Kit info is Win NT4 or 200x specific.

    Dfs trees on Samba work with all Dfs-aware clients ranging + from Windows 95 to 2000.

    Here is a quick guide:

    Here's an example of setting up a Dfs tree on a Samba + server.

    # The smb.conf file:
+[global]
+	netbios name = SAMBA
+	host msdfs   = yes
+
+[dfs]
+	path = /export/dfsroot
+	msdfs root = yes
+

    • On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'.

    • Select a user profile you want to migrate and click on it.

      In the /export/dfsroot directory we set up our dfs links to + other servers on the network.

      root# cd /export/dfsroot

      I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

    • Click the 'Copy To' button.

    • In the box labelled 'Copy Profile to' add your new path, eg: -c:\temp\foobarroot# chown root /export/dfsroot

    • Click on the button labelled 'Change' in the "Permitted to use" box.

    • Click on the group 'Everyone' and then click OK. This closes the -'chose user' box.

    • Now click OK.

    Follow the above for every profile you need to migrate.

    21.2.1. Side bar Notes

    root# chmod 755 /export/dfsroot

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    root# ln -s msdfs:storageA\\shareA linka

    With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users.

    21.2.2. Mandatory profiles

    root# ln -s msdfs:serverB\\share,serverC\\share linkb

    The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN.

    21.2.3. moveuser.exe

    You should set up the permissions and ownership of + the directory acting as the Dfs root such that only designated + users can create, delete or modify the msdfs links. Also note + that symlink names should be all lowercase. This limitation exists + to have Samba avoid trying all the case combinations to get at + the link name. Finally set up the symbolic links to point to the + network shares you want, and start Samba.

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change.

    Users on Dfs-aware clients can now browse the Dfs tree + on the Samba server at \\samba\dfs. Accessing + links linka or linkb (which appear as directories to the client) + takes users directly to the appropriate shares on the network.

    21.2.4. Get SID19.1.1. Notes

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit.

    Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath.

    21.3. Windows 2000/XP

    You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows:

    • Log on as the LOCAL workstation administrator.

      Windows clients need to be rebooted + if a previously mounted non-dfs share is made a dfs + root or vice versa. A better way is to introduce a + new share and make it the dfs root.

    • Right click on the 'My Computer' Icon, select 'Properties'

      Currently there's a restriction that msdfs + symlink names should all be lowercase.

    • Click on the 'User Profiles' tab

      For security purposes, the directory + acting as the root of the Dfs tree should have ownership + and permissions set so that only designated users can + modify the symbolic links in the directory.

    Chapter 20. Stackable VFS modules

    20.1. Introduction and configuration

    Select the profile you wish to convert (click on it once)

  • Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. +Samba passes each request to access the unix file system thru the loaded VFS modules. +This chapter covers all the modules that come with the samba source and references to +some external modules.

    Click on the button 'Copy To'

  • You may have problems to compile these modules, as shared libraries are +compiled and linked in different ways on different systems. +They currently have been tested against GNU/linux and IRIX.

    In the "Permitted to use" box, click on the 'Change' button.

  • To use the VFS modules, create a share similar to the one below. The +important parameter is the vfs object parameter which must point to +the exact pathname of the shared library objects. For example, to log all access +to files and use a recycle bin: + +
           [audit]
+                comment = Audited /data directory
+                path = /data
+                vfs object = /path/to/audit.so /path/to/recycle.so
+                writeable = yes
+                browseable = yes

    Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible.

    The modules are used in the order they are specified.

    Further documentation on writing VFS modules for Samba can be found in +the Samba Developers Guide.

    • 20.2. Included modules

    20.2.1. audit

    A simple module to audit file access to the syslog +facility. The following operations are logged: +

    shareconnect/disconnect

    You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword.

    directory opens/create/remove
    file open/close/rename/unlink/chmod

  • 20.2.2. recycle

    To make the profile capable of being used by anyone select 'Everyone'

  • A recycle-bin like modules. When used any unlink call +will be intercepted and files moved to the recycle +directory instead of beeing deleted.

    Click OK. The Selection box will close.

  • Supported options: +

    vfs_recycle_bin:repository

    Now click on the 'Ok' button to create the profile in the path you -nominated.

    • FIXME

    vfs_recycle_bin:keeptree

    Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool.

    FIXME

    vfs_recycle_bin:versions

    FIXME

    vfs_recycle_bin:touch

    Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable.

    FIXME

    vfs_recycle_bin:maxsize

    FIXME

    vfs_recycle_bin:exclude

    FIXME

    vfs_recycle_bin:exclude_dir

    FIXME

    vfs_recycle_bin:noversions

    FIXME

    20.2.3. netatalk

    A netatalk module, that will ease co-existence of samba and +netatalk file sharing services.

    Advantages compared to the old netatalk module: +

    it doesn't care about creating of .AppleDouble forks, just keeps ones in sync
    if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    • This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

      "Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"

      ...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this.

      If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy):

    • On the XP workstation log in with an Administrator account.

    • Click: "Start", "Run"

    • Type: "mmc"

    • Click: "OK"

    • A Microsoft Management Console should appear.

    • Click: File, "Add/Remove Snap-in...", "Add"

    • Double-Click: "Group Policy"

    • Click: "Finish", "Close"

    • Click: "OK"

    • In the "Console Root" window:

    20.3. VFS modules available elsewhere

    Expand: "Local Computer Policy", "Computer Configuration",

  • This section contains a listing of various other VFS modules that +have been posted but don't currently reside in the Samba CVS +tree for one reason ot another (e.g. it is easy for the maintainer +to have his or her own CVS tree).

    "Administrative Templates", "System", "User Profiles"

  • No statemets about the stability or functionality any module +should be implied due to its presence here.

    20.3.1. DatabaseFS

    Double-Click: "Do not check for user ownership of Roaming Profile

  • URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php

    Folders"

  • By Eric Lorimer.

    Select: "Enabled"

  • I have created a VFS module which implements a fairly complete read-only +filesystem. It presents information from a database as a filesystem in +a modular and generic way to allow different databases to be used +(originally designed for organizing MP3s under directories such as +"Artists," "Song Keywords," etc... I have since applied it to a student +roster database very easily). The directory structure is stored in the +database itself and the module makes no assumptions about the database +structure beyond the table it requires to run.

    Click: OK"

  • Any feedback would be appreciated: comments, suggestions, patches, +etc... If nothing else, hopefully it might prove useful for someone +else who wishes to create a virtual filesystem.

    • 20.3.2. vscan

    Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed).

  • URL: http://www.openantivirus.org/

    Reboot

    • samba-vscan is a proof-of-concept module for Samba, which +uses the VFS (virtual file system) features of Samba 2.2.x/3.0 +alphaX. Of couse, Samba has to be compiled with VFS support. +samba-vscan supports various virus scanners and is maintained +by Rainer Link.

    Chapter 22. Securing SambaChapter 21. Securing Samba

    22.1. Introduction21.1. Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an @@ -17123,8 +16501,8 @@ CLASS="SECT1" >

    22.2. Using host based protection21.2. Using host based protection

    In many installations of Samba the greatest threat comes for outside @@ -17155,8 +16533,8 @@ CLASS="SECT1" >

    22.3. Using interface protection21.3. Using interface protection

    By default Samba will accept connections on any network interface that @@ -17191,8 +16569,8 @@ CLASS="SECT1" >

    22.4. Using a firewall21.4. Using a firewall

    Many people use a firewall to deny access to services that they don't @@ -17221,8 +16599,8 @@ CLASS="SECT1" >

    22.5. Using a IPC$ share deny21.5. Using a IPC$ share deny

    If the above methods are not suitable, then you could also place a @@ -17260,8 +16638,8 @@ CLASS="SECT1" >

    22.6. Upgrading Samba21.6. Upgrading Samba

    Please check regularly on http://www.samba.org/ for updates and @@ -17276,14 +16654,14 @@ CLASS="CHAPTER" >Chapter 23. Unicode/CharsetsChapter 22. Unicode/Charsets

    23.1. What are charsets and unicode?22.1. What are charsets and unicode?

    Computers communicate in numbers. In texts, each number will be @@ -17332,8 +16710,8 @@ CLASS="SECT1" >

    23.2. Samba and charsets22.2. Samba and charsets

    As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, @@ -17408,6 +16786,65 @@ CLASS="TOC" >Table of Contents

    23. Samba performance issues
    23.1. Comparisons
    23.2. Socket options
    23.3. Read size
    23.4. Max xmit
    23.5. Log level
    23.6. Read raw
    23.7. Write raw
    23.8. Slow Clients
    23.9. Slow Logins
    23.10. Client tuning
    24. Portability
    24.1. HPUX
    24.2. SCO Unix
    24.3. DNIX
    24.4. RedHat Linux Rembrandt-II
    24.5. AIX
    24.5.1. Sequential Read Ahead
    25.1. Macintosh clients?
    25.2. OS2 Client
    25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?
    25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?
    25.2.3. Are there any other issues when OS/2 (any version) is used as a client?
    25.2.4. How do I get printer driver download working for OS/2 clients?
    25.3. Windows for Workgroups
    25.3.1. Use latest TCP/IP stack from Microsoft
    25.3.2. Delete .pwl files after password change
    25.3.3. Configure WfW password handling
    25.3.4. Case handling of passwords
    25.3.5. Use TCP/IP as default protocol
    25.4. Windows '95/'98
    25.5. Windows 2000 Service Pack 2
    26.1. Access Samba source code via CVS
    26.1.1. Introduction
    26.1.2. CVS Access to samba.org
    26.2. Accessing the samba sources via rsync and ftp
    26.3. Building the Binaries
    26.3.1. Compiling samba with Active Directory support
    26.4. Starting the smbd and nmbd
    26.4.1. Starting from inetd.conf
    26.4.2. Alternative: starting it as a daemon
    27.1. Introduction
    27.2. General info
    27.3. Debug levels
    27.4. Internal errors
    27.5. Attaching to a running process
    27.6. Patches
    28.1. Introduction
    28.2. Assumptions
    28.3. Tests
    28.3.1. Test 1
    28.3.2. Test 2
    28.3.3. Test 3
    28.3.4. Test 4
    28.3.5. Test 5
    28.3.6. Test 6
    28.3.7. Test 7
    28.3.8. Test 8
    28.3.9. Test 9
    28.3.10. Test 10
    28.3.11. Test 11
    28.4. Still having troubles?

    Chapter 23. Samba performance issues

    23.1. Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are +trying to see if it performs well you should really compare it to +programs that use the same protocol. The most readily available +programs for file transfer that use TCP are ftp or another TCP based +SMB server.

    If you want to test against something like a NT or WfWg server then +you will have to disable all but TCP on either the client or +server. Otherwise you may well be using a totally different protocol +(such as Netbeui) and comparisons may not be valid.

    Generally you should find that Samba performs similarly to ftp at raw +transfer speed. It should perform quite a bit faster than NFS, +although this very much depends on your system.

    Several people have done comparisons between Samba and Novell, NFS or +WinNT. In some cases Samba performed the best, in others the worst. I +suspect the biggest factor is not Samba vs some other system but the +hardware and drivers used on the various systems. Given similar +hardware Samba should certainly be competitive in speed with other +systems.

    23.2. Socket options

    There are a number of socket options that can greatly affect the +performance of a TCP based server like Samba.

    The socket options that Samba uses are settable both on the command +line with the -O option, or in the smb.conf file.

    The "socket options" section of the smb.conf manual page describes how +to set these and gives recommendations.

    Getting the socket options right can make a big difference to your +performance, but getting them wrong can degrade it by just as +much. The correct settings are very dependent on your local network.

    The socket option TCP_NODELAY is the one that seems to make the +biggest single difference for most networks. Many people report that +adding "socket options = TCP_NODELAY" doubles the read performance of +a Samba drive. The best explanation I have seen for this is that the +Microsoft TCP/IP stack is slow in sending tcp ACKs.

    23.3. Read size

    The option "read size" affects the overlap of disk reads/writes with +network reads/writes. If the amount of data being transferred in +several of the SMB commands (currently SMBwrite, SMBwriteX and +SMBreadbraw) is larger than this value then the server begins writing +the data before it has received the whole packet from the network, or +in the case of SMBreadbraw, it begins writing to the network before +all the data has been read from disk.

    This overlapping works best when the speeds of disk and network access +are similar, having very little effect when the speed of one is much +greater than the other.

    The default value is 16384, but very little experimentation has been +done yet to determine the optimal value, and it is likely that the best +value will vary greatly between systems anyway. A value over 65536 is +pointless and will cause you to allocate memory unnecessarily.

    23.4. Max xmit

    At startup the client and server negotiate a "maximum transmit" size, +which limits the size of nearly all SMB commands. You can set the +maximum size that Samba will negotiate using the "max xmit = " option +in smb.conf. Note that this is the maximum size of SMB request that +Samba will accept, but not the maximum size that the *client* will accept. +The client maximum receive size is sent to Samba by the client and Samba +honours this limit.

    It defaults to 65536 bytes (the maximum), but it is possible that some +clients may perform better with a smaller transmit unit. Trying values +of less than 2048 is likely to cause severe problems.

    In most cases the default is the best option.

    23.5. Log level

    If you set the log level (also known as "debug level") higher than 2 +then you may suffer a large drop in performance. This is because the +server flushes the log file after each operation, which can be very +expensive.

    23.6. Read raw

    The "read raw" operation is designed to be an optimised, low-latency +file read operation. A server may choose to not support it, +however. and Samba makes support for "read raw" optional, with it +being enabled by default.

    In some cases clients don't handle "read raw" very well and actually +get lower performance using it than they get using the conventional +read operations.

    So you might like to try "read raw = no" and see what happens on your +network. It might lower, raise or not affect your performance. Only +testing can really tell.

    23.7. Write raw

    The "write raw" operation is designed to be an optimised, low-latency +file write operation. A server may choose to not support it, +however. and Samba makes support for "write raw" optional, with it +being enabled by default.

    Some machines may find "write raw" slower than normal write, in which +case you may wish to change this option.

    23.8. Slow Clients

    One person has reported that setting the protocol to COREPLUS rather +than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).

    I suspect that his PC's (386sx16 based) were asking for more data than +they could chew. I suspect a similar speed could be had by setting +"read raw = no" and "max xmit = 2048", instead of changing the +protocol. Lowering the "read size" might also help.

    23.9. Slow Logins

    Slow logins are almost always due to the password checking time. Using +the lowest practical "password level" will improve things a lot. You +could also enable the "UFC crypt" option in the Makefile.

    23.10. Client tuning

    Often a speed problem can be traced to the client. The client (for +example Windows for Workgroups) can often be tuned for better TCP +performance.

    See your client docs for details. In particular, I have heard rumours +that the WfWg options TCPWINDOWSIZE and TCPSEGMENTSIZE can have a +large impact on performance.

    Also note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a +big improvement. I don't know why.

    My own experience wth DefaultRcvWindow is that I get much better +performance with a large value (16384 or larger). Other people have +reported that anything over 3072 slows things down enourmously. One +person even reported a speed drop of a factor of 30 when he went from +3072 to 8192. I don't know why.

    It probably depends a lot on your hardware, and the type of unix box +you have at the other end of the link.

    Paul Cochrane has done some testing on client side tuning and come +to the following conclusions:

    Install the W2setup.exe file from www.microsoft.com. This is an +update for the winsock stack and utilities which improve performance.

    Configure the win95 TCPIP registry settings to give better +perfomance. I use a program called MTUSPEED.exe which I got off the +net. There are various other utilities of this type freely available. +The setting which give the best performance for me are:

    1. MaxMTU Remove

    2. RWIN Remove

    3. MTUAutoDiscover Disable

    4. MTUBlackHoleDetect Disable

    5. Time To Live Enabled

    6. Time To Live - HOPS 32

    7. NDI Cache Size 0

    I tried virtually all of the items mentioned in the document and +the only one which made a difference to me was the socket options. It +turned out I was better off without any!!!!!

    In terms of overall speed of transfer, between various win95 clients +and a DX2-66 20MB server with a crappy NE2000 compatible and old IDE +drive (Kernel 2.0.30). The transfer rate was reasonable for 10 baseT.

    The figures are:          Put              Get 
+P166 client 3Com card:    420-440kB/s      500-520kB/s
+P100 client 3Com card:    390-410kB/s      490-510kB/s
+DX4-75 client NE2000:     370-380kB/s      330-350kB/s

    I based these test on transfer two files a 4.5MB text file and a 15MB +textfile. The results arn't bad considering the hardware Samba is +running on. It's a crap machine!!!!

    The updates mentioned in 1 and 2 brought up the transfer rates from +just over 100kB/s in some clients.

    A new client is a P333 connected via a 100MB/s card and hub. The +transfer rates from this were good: 450-500kB/s on put and 600+kB/s +on get.

    Looking at standard FTP throughput, Samba is a bit slower (100kB/s +upwards). I suppose there is more going on in the samba protocol, but +if it could get up to the rate of FTP the perfomance would be quite +staggering.

    Chapter 24. Portability

    24.1. HPUX

    24.2. SCO Unix

    24.3. DNIX

    24.4. RedHat Linux Rembrandt-II

    24.5. AIX

    24.5.1. Sequential Read Ahead

    25.1. Macintosh clients?

    25.2. OS2 Client

    25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?

    25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?

    25.2.3. Are there any other issues when OS/2 (any version) is used as a client?

    25.2.4. How do I get printer driver download working for OS/2 clients?

    25.3. Windows for Workgroups

    25.3.1. Use latest TCP/IP stack from Microsoft

    25.3.2. Delete .pwl files after password change

    25.3.3. Configure WfW password handling

    25.3.4. Case handling of passwords

    25.3.5. Use TCP/IP as default protocol

    25.4. Windows '95/'98

    25.5. Windows 2000 Service Pack 2

    26.1. Access Samba source code via CVS

    26.1.1. Introduction

    26.1.2. CVS Access to samba.org

    26.1.2.1. Access via CVSweb

    26.1.2.2. Access via cvs

    26.2. Accessing the samba sources via rsync and ftp

    26.3. Building the Binaries

    26.3.1. Compiling samba with Active Directory support

    26.3.1.1. Installing the required packages for Debian

    26.3.1.2. Installing the required packages for RedHat

    26.4. Starting the smbd and nmbd

    26.4.1. Starting from inetd.conf

    26.4.2. Alternative: starting it as a daemon

    27.1. Introduction

    27.2. General info

    27.3. Debug levels

    27.4. Internal errors

    27.5. Attaching to a running process

    27.6. Patches

    28.1. Introduction

    28.2. Assumptions

    28.3. Tests

    28.3.1. Test 1

    28.3.2. Test 2

    28.3.3. Test 3

    28.3.4. Test 4

    28.3.5. Test 5

    28.3.6. Test 6

    28.3.7. Test 7

    28.3.8. Test 8

    28.3.9. Test 9

    28.3.10. Test 10

    28.3.11. Test 11

    28.4. Still having troubles?

    Date: Wed, 2 Apr 2003 13:34:53 +0000 Subject: Clean up ntlm_auth a bit, and add a --diagnositics swtich, to check that the returned session key is the one that we expect to get for that each of login. Andrew Bartlett (This used to be commit fa47e44b9caba98e0b85782f3057e6cb8a5763ff) --- source3/utils/ntlm_auth.c | 528 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 417 insertions(+), 111 deletions(-) diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index d924f92cce..243700cedd 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -4,7 +4,7 @@ Winbind status program. Copyright (C) Tim Potter 2000-2002 - Copyright (C) Andrew Bartlett 2003 + Copyright (C) Andrew Bartlett 2003 Copyright (C) Francesco Chemolli 2000 This program is free software; you can redistribute it and/or modify @@ -39,22 +39,17 @@ enum squid_mode { extern int winbindd_fd; static const char *helper_protocol; -static const char *username; -static const char *domain; -static const char *workstation; -static const char *hex_challenge; -static const char *hex_lm_response; -static const char *hex_nt_response; -static unsigned char *challenge; -static size_t challenge_len; -static unsigned char *lm_response; -static size_t lm_response_len; -static unsigned char *nt_response; -static size_t nt_response_len; +static const char *opt_username; +static const char *opt_domain; +static const char *opt_workstation; +static const char *opt_password; +static DATA_BLOB opt_challenge; +static DATA_BLOB opt_lm_response; +static DATA_BLOB opt_nt_response; static int request_lm_key; static int request_nt_key; +static int diagnostics; -static char *password; static char winbind_separator(void) { @@ -178,42 +173,92 @@ static BOOL check_plaintext_auth(const char *user, const char *pass, BOOL stdout return (result == NSS_STATUS_SUCCESS); } -static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state) +/* authenticate a user with an encrypted username/password */ + +static NTSTATUS contact_winbind_auth_crap(const char *username, + const char *domain, + const char *workstation, + const DATA_BLOB *challenge, + const DATA_BLOB *lm_response, + const DATA_BLOB *nt_response, + uint32 flags, + uint8 lm_key[16], + uint8 nt_key[16], + char **error_string) { + NTSTATUS nt_status; + NSS_STATUS result; struct winbindd_request request; struct winbindd_response response; - NSS_STATUS result; - /* Send off request */ + + static uint8 zeros[16]; ZERO_STRUCT(request); ZERO_STRUCT(response); - fstrcpy(request.data.auth_crap.user, ntlmssp_state->user); + request.data.auth_crap.flags = flags; - fstrcpy(request.data.auth_crap.domain, ntlmssp_state->domain); - fstrcpy(request.data.auth_crap.workstation, ntlmssp_state->workstation); - - memcpy(request.data.auth_crap.chal, ntlmssp_state->chal.data, - MIN(ntlmssp_state->chal.length, 8)); - - memcpy(request.data.auth_crap.lm_resp, ntlmssp_state->lm_resp.data, - MIN(ntlmssp_state->lm_resp.length, sizeof(request.data.auth_crap.lm_resp))); - - memcpy(request.data.auth_crap.nt_resp, ntlmssp_state->nt_resp.data, - MIN(ntlmssp_state->nt_resp.length, sizeof(request.data.auth_crap.nt_resp))); - - request.data.auth_crap.lm_resp_len = ntlmssp_state->lm_resp.length; - request.data.auth_crap.nt_resp_len = ntlmssp_state->nt_resp.length; + fstrcpy(request.data.auth_crap.user, username); + + fstrcpy(request.data.auth_crap.domain, domain); + fstrcpy(request.data.auth_crap.workstation, workstation); + + memcpy(request.data.auth_crap.chal, challenge->data, MIN(challenge->length, 8)); + + if (lm_response && lm_response->length) { + memcpy(request.data.auth_crap.lm_resp, lm_response->data, MIN(lm_response->length, sizeof(request.data.auth_crap.lm_resp))); + request.data.auth_crap.lm_resp_len = lm_response->length; + } + if (nt_response && nt_response->length) { + memcpy(request.data.auth_crap.nt_resp, nt_response->data, MIN(nt_response->length, sizeof(request.data.auth_crap.nt_resp))); + request.data.auth_crap.nt_resp_len = nt_response->length; + } + result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response); /* Display response */ if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { - return NT_STATUS_UNSUCCESSFUL; + nt_status = NT_STATUS_UNSUCCESSFUL; + if (error_message) + *error_string = smb_xstrdup("Reading winbind reply failed!"); + return nt_status; + } + + nt_status = (NT_STATUS(response.data.auth.nt_status)); + if (!NT_STATUS_IS_OK(nt_status)) { + if (error_string) + *error_string = smb_xstrdup(response.data.auth.error_string); + return nt_status; } - return NT_STATUS(response.data.auth.nt_status); + if ((flags & WINBIND_PAM_LMKEY) && lm_key + && (memcmp(zeros, response.data.auth.first_8_lm_hash, + sizeof(response.data.auth.first_8_lm_hash)) != 0)) { + memcpy(lm_key, response.data.auth.first_8_lm_hash, + sizeof(response.data.auth.first_8_lm_hash)); + } + if ((flags & WINBIND_PAM_NTKEY) && nt_key + && (memcmp(zeros, response.data.auth.nt_session_key, + sizeof(response.data.auth.nt_session_key)) != 0)) { + memcpy(nt_key, response.data.auth.nt_session_key, + sizeof(response.data.auth.nt_session_key)); + } + return nt_status; +} + +static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state) +{ + return contact_winbind_auth_crap(ntlmssp_state->user, ntlmssp_state->domain, + ntlmssp_state->workstation, + &ntlmssp_state->chal, + &ntlmssp_state->lm_resp, + &ntlmssp_state->nt_resp, + 0, + NULL, + NULL, + NULL); } static void manage_squid_ntlmssp_request(enum squid_mode squid_mode, @@ -356,72 +401,283 @@ static void squid_stream(enum squid_mode squid_mode) { static BOOL check_auth_crap(void) { - struct winbindd_request request; - struct winbindd_response response; - char *lm_key; - char *nt_key; + NTSTATUS nt_status; + uint32 flags = 0; + char lm_key[8]; + char nt_key[16]; + char *hex_lm_key; + char *hex_nt_key; + char *error_string; + static uint8 zeros[16]; - NSS_STATUS result; - /* Send off request */ - - ZERO_STRUCT(request); - ZERO_STRUCT(response); - if (request_lm_key) - request.data.auth_crap.flags |= WINBIND_PAM_LMKEY; + flags |= WINBIND_PAM_LMKEY; if (request_nt_key) - request.data.auth_crap.flags |= WINBIND_PAM_NTKEY; + flags |= WINBIND_PAM_NTKEY; + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &opt_challenge, + &opt_lm_response, + &opt_nt_response, + flags, + lm_key, + nt_key, + &error_string); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } - fstrcpy(request.data.auth_crap.user, username); + if (request_lm_key + && (memcmp(zeros, lm_key, + sizeof(lm_key)) != 0)) { + hex_encode(lm_key, + sizeof(lm_key), + &hex_lm_key); + d_printf("LM_KEY: %s\n", hex_lm_key); + SAFE_FREE(hex_lm_key); + } + if (request_nt_key + && (memcmp(zeros, nt_key, + sizeof(nt_key)) != 0)) { + hex_encode(nt_key, + sizeof(nt_key), + &hex_nt_key); + d_printf("NT_KEY: %s\n", hex_nt_key); + SAFE_FREE(hex_nt_key); + } - fstrcpy(request.data.auth_crap.domain, domain); - fstrcpy(request.data.auth_crap.workstation, workstation); + return True; +} + +/* + Authenticate a user with a challenge/response, checking session key + and valid authentication types +*/ + +static const DATA_BLOB get_challenge(void) +{ + static DATA_BLOB chal; + if (opt_challenge.length) + return opt_challenge; - memcpy(request.data.auth_crap.chal, challenge, MIN(challenge_len, 8)); + chal = data_blob(NULL, 8); - memcpy(request.data.auth_crap.lm_resp, lm_response, MIN(lm_response_len, sizeof(request.data.auth_crap.lm_resp))); - - memcpy(request.data.auth_crap.nt_resp, nt_response, MIN(nt_response_len, sizeof(request.data.auth_crap.nt_resp))); - - request.data.auth_crap.lm_resp_len = lm_response_len; - request.data.auth_crap.nt_resp_len = nt_response_len; + generate_random_buffer(chal.data, chal.length, False); + return chal; +} - result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response); +static BOOL test_lm(void) +{ + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB lm_response = data_blob(NULL, 24); - /* Display response */ + uchar lm_key[8]; + uchar lm_hash[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + flags |= WINBIND_PAM_LMKEY; + + SMBencrypt(opt_password,chall.data,lm_response.data); + E_deshash(opt_password, lm_hash); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation, + &chall, + &lm_response, + NULL, + flags, + lm_key, + NULL, + &error_string); + + data_blob_free(&lm_response); - if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { - d_printf("Reading winbind reply failed! (0x01)\n"); - } - - d_printf("%s (0x%x)\n", - response.data.auth.nt_status_string, - response.data.auth.nt_status); - - if (response.data.auth.nt_status == 0) { - if (request_lm_key - && (memcmp(zeros, response.data.auth.first_8_lm_hash, - sizeof(response.data.auth.first_8_lm_hash)) != 0)) { - hex_encode(response.data.auth.first_8_lm_hash, - sizeof(response.data.auth.first_8_lm_hash), - &lm_key); - d_printf("LM_KEY: %s\n", lm_key); - SAFE_FREE(lm_key); - } - if (request_nt_key - && (memcmp(zeros, response.data.auth.nt_session_key, - sizeof(response.data.auth.nt_session_key)) != 0)) { - hex_encode(response.data.auth.nt_session_key, - sizeof(response.data.auth.nt_session_key), - &nt_key); - d_printf("NT_KEY: %s\n", nt_key); - SAFE_FREE(nt_key); + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + return False; + } + + if (memcmp(lm_hash, lm_key, + sizeof(lm_key)) != 0) { + DEBUG(1, ("LM Key does not match expectations!\n")); + DEBUG(1, ("lm_key:\n")); + dump_data(1, lm_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + } + return True; +} + +static BOOL test_lm_ntlm(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB lm_response = data_blob(NULL, 24); + DATA_BLOB nt_response = data_blob(NULL, 24); + DATA_BLOB session_key = data_blob(NULL, 16); + + uchar lm_key[8]; + uchar nt_key[16]; + uchar lm_hash[16]; + uchar nt_hash[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + flags |= WINBIND_PAM_LMKEY; + flags |= WINBIND_PAM_NTKEY; + + SMBencrypt(opt_password,chall.data,lm_response.data); + E_deshash(opt_password, lm_hash); + + SMBNTencrypt(opt_password,chall.data,nt_response.data); + + E_md4hash(opt_password, nt_hash); + SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &lm_response, + &nt_response, + flags, + lm_key, + nt_key, + &error_string); + + data_blob_free(&lm_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(lm_hash, lm_key, + sizeof(lm_key)) != 0) { + DEBUG(1, ("LM Key does not match expectations!\n")); + DEBUG(1, ("lm_key:\n")); + dump_data(1, lm_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + pass = False; + } + if (memcmp(session_key.data, nt_key, + sizeof(nt_key)) != 0) { + DEBUG(1, ("NT Session Key does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, session_key.data, session_key.length); + pass = False; + } + return pass; +} + +static BOOL test_ntlm(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB nt_response = data_blob(NULL, 24); + DATA_BLOB session_key = data_blob(NULL, 16); + + char nt_key[16]; + char nt_hash[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + flags |= WINBIND_PAM_NTKEY; + + SMBNTencrypt(opt_password,chall.data,nt_response.data); + E_md4hash(opt_password, nt_hash); + SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + NULL, + &nt_response, + flags, + NULL, + nt_key, + &error_string); + + data_blob_free(&nt_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(session_key.data, nt_key, + sizeof(nt_key)) != 0) { + DEBUG(1, ("NT Session Key does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, session_key.data, session_key.length); + pass = False; + } + return pass; +} + +/* + Tests: + + - LM only + - NT and LM + - NT + - NTLMv2 + - NTLMv2 and LMv2 + - LMv2 + + check we get the correct session key in each case + check what values we get for the LM session key + +*/ + +struct ntlm_tests { + BOOL (*fn)(); + const char *name; +} test_table[] = { + {test_lm, "test LM"}, + {test_lm_ntlm, "test LM and NTLM"}, + {test_ntlm, "test NTLM"} +/* {test_lm_ntlmv2, "test NTLMv2"}, */ +/* {test_lm_ntlmv2, "test NTLMv2 and LMv2"}, */ +/* {test_lm_ntlmv2, "test LMv2"} */ +}; + +static BOOL diagnose_ntlm_auth(void) +{ + unsigned int i; + BOOL pass = True; + + for (i=0; test_table[i].fn; i++) { + if (!test_table[i].fn()) { + DEBUG(1, ("Test %s failed!\n", test_table[i].name)); + pass = False; } } - return result == NSS_STATUS_SUCCESS; + return pass; } /* Main program */ @@ -436,26 +692,47 @@ enum { OPT_NT, OPT_PASSWORD, OPT_LM_KEY, - OPT_NT_KEY + OPT_NT_KEY, + OPT_DIAGNOSTICS }; int main(int argc, const char **argv) { int opt; + static const char *hex_challenge; + static const char *hex_lm_response; + static const char *hex_nt_response; + char *challenge; + char *lm_response; + char *nt_response; + size_t challenge_len; + size_t lm_response_len; + size_t nt_response_len; + poptContext pc; + + /* NOTE: DO NOT change this interface without considering the implications! + This is an external interface, which other programs will use to interact + with this helper. + */ + + /* We do not use single-letter command abbreviations, because they harm future + interface stability. */ + struct poptOption long_options[] = { POPT_AUTOHELP { "helper-protocol", 0, POPT_ARG_STRING, &helper_protocol, OPT_DOMAIN, "operate as a stdio-based helper", "helper protocol to use"}, - { "username", 0, POPT_ARG_STRING, &username, OPT_USERNAME, "username"}, - { "domain", 0, POPT_ARG_STRING, &domain, OPT_DOMAIN, "domain name"}, - { "workstation", 0, POPT_ARG_STRING, &domain, OPT_WORKSTATION, "workstation"}, + { "username", 0, POPT_ARG_STRING, &opt_username, OPT_USERNAME, "username"}, + { "domain", 0, POPT_ARG_STRING, &opt_domain, OPT_DOMAIN, "domain name"}, + { "workstation", 0, POPT_ARG_STRING, &opt_workstation, OPT_WORKSTATION, "workstation"}, { "challenge", 0, POPT_ARG_STRING, &hex_challenge, OPT_CHALLENGE, "challenge (HEX encoded)"}, { "lm-response", 0, POPT_ARG_STRING, &hex_lm_response, OPT_LM, "LM Response to the challenge (HEX encoded)"}, { "nt-response", 0, POPT_ARG_STRING, &hex_nt_response, OPT_NT, "NT or NTLMv2 Response to the challenge (HEX encoded)"}, - { "password", 0, POPT_ARG_STRING, &password, OPT_PASSWORD, "User's plaintext password"}, + { "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"}, { "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retreive LM session key"}, { "request-nt-key", 0, POPT_ARG_NONE, &request_nt_key, OPT_NT_KEY, "Retreive NT session key"}, + { "diagnostics", 0, POPT_ARG_NONE, &diagnostics, OPT_DIAGNOSTICS, "Perform diagnostics on the authentictaion chain"}, POPT_COMMON_SAMBA POPT_TABLEEND }; @@ -481,29 +758,40 @@ enum { while((opt = poptGetNextOpt(pc)) != -1) { switch (opt) { case OPT_CHALLENGE: - challenge_len = strlen(hex_challenge); - challenge = smb_xmalloc((challenge_len+1)/2); - if ((challenge_len = strhex_to_str(challenge, challenge_len, hex_challenge)) != 8) { - fprintf(stderr, "hex decode of %s failed (only got %u bytes)!\n", + challenge = smb_xmalloc((strlen(hex_challenge)+1)/2); + if ((challenge_len = strhex_to_str(challenge, + strlen(hex_challenge), + hex_challenge)) != 8) { + x_fprintf(x_stderr, "hex decode of %s failed (only got %u bytes)!\n", hex_challenge, challenge_len); exit(1); } + opt_challenge = data_blob(challenge, challenge_len); + SAFE_FREE(challenge); break; case OPT_LM: - lm_response_len = strlen(hex_lm_response); - lm_response = smb_xmalloc((lm_response_len+1)/2); - if ((lm_response_len = strhex_to_str(lm_response, lm_response_len, hex_lm_response)) != 24) { - fprintf(stderr, "hex decode of %s failed!\n", hex_lm_response); + lm_response = smb_xmalloc((strlen(hex_lm_response)+1)/2); + lm_response_len = strhex_to_str(lm_response, + strlen(hex_lm_response), + hex_lm_response); + if (lm_response_len != 24) { + x_fprintf(x_stderr, "hex decode of %s failed!\n", hex_lm_response); exit(1); } + opt_lm_response = data_blob(lm_response, lm_response_len); + SAFE_FREE(lm_response); break; case OPT_NT: - nt_response_len = strlen(hex_nt_response); - nt_response = smb_xmalloc((nt_response_len+1)/2); - if ((nt_response_len = strhex_to_str(nt_response, nt_response_len, hex_nt_response)) < 24) { - fprintf(stderr, "hex decode of %s failed!\n", hex_nt_response); + nt_response = smb_xmalloc((strlen(hex_nt_response)+1)/2); + nt_response_len = strhex_to_str(nt_response, + strlen(hex_nt_response), + hex_nt_response); + if (nt_response_len < 24) { + x_fprintf(x_stderr, "hex decode of %s failed!\n", hex_nt_response); exit(1); } + opt_nt_response = data_blob(nt_response, nt_response_len); + SAFE_FREE(nt_response); break; } } @@ -516,27 +804,45 @@ enum { } else if (strcmp(helper_protocol, "squid-2.4-basic")== 0) { squid_stream(SQUID_2_4_BASIC); } else { - fprintf(stderr, "unknown helper protocol [%s]\n", helper_protocol); + x_fprintf(x_stderr, "unknown helper protocol [%s]\n", helper_protocol); exit(1); } } - if (domain == NULL) { - domain = get_winbind_domain(); + if (!opt_username) { + x_fprintf(x_stderr, "username must be specified!\n\n"); + poptPrintHelp(pc, stderr, 0); + exit(1); } - if (workstation == NULL) { - workstation = ""; + if (opt_domain == NULL) { + opt_domain = get_winbind_domain(); } - if (challenge) { + if (opt_workstation == NULL) { + opt_workstation = ""; + } + + if (opt_challenge.length) { if (!check_auth_crap()) { exit(1); } - } else if (password) { + exit(0); + } + + if (!opt_password) { + opt_password = getpass("password: "); + } + + if (diagnostics) { + if (!diagnose_ntlm_auth()) { + exit(1); + } + } else { fstring user; - snprintf(user, sizeof(user)-1, "%s%c%s", domain, winbind_separator(), username); - if (!check_plaintext_auth(user, password, True)) { + + snprintf(user, sizeof(user)-1, "%s%c%s", opt_domain, winbind_separator(), opt_username); + if (!check_plaintext_auth(user, opt_password, True)) { exit(1); } } -- cgit From 0d01c00f0740da97bb328e8390c2b8fc6ce3166d Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 2 Apr 2003 13:49:51 +0000 Subject: error_string, not error_message... (This used to be commit ce197eae8d254114a295142b522cc028c375ae88) --- source3/utils/ntlm_auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 243700cedd..82e6127d55 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -221,7 +221,7 @@ static NTSTATUS contact_winbind_auth_crap(const char *username, if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { nt_status = NT_STATUS_UNSUCCESSFUL; - if (error_message) + if (error_string) *error_string = smb_xstrdup("Reading winbind reply failed!"); return nt_status; } -- cgit From f1c4fb5cf5e425e5a07348ed174f7ed4f5b315c9 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 2 Apr 2003 13:54:06 +0000 Subject: Update ntlm_auth and winbind manpages. Andrew Bartlett (This used to be commit 441d6952bdaff94e387a11f5f524359f3bbbeefb) --- docs/docbook/manpages/ntlm_auth.1.sgml | 14 ++------------ docs/docbook/manpages/winbindd.8.sgml | 21 +++++++++++++++------ 2 files changed, 17 insertions(+), 18 deletions(-) diff --git a/docs/docbook/manpages/ntlm_auth.1.sgml b/docs/docbook/manpages/ntlm_auth.1.sgml index 52ab1db9e4..08a7d4aa88 100644 --- a/docs/docbook/manpages/ntlm_auth.1.sgml +++ b/docs/docbook/manpages/ntlm_auth.1.sgml @@ -11,25 +11,15 @@ ntlm_auth - tool for executing client side - MS-RPC functions + tool to allow external access to Winbind's NTLM authentication function ntlm_auth - -A authfile - -c <command string> -d debuglevel - -h -l logfile - -N -s <smb config file> - -U username[%password] - -W workgroup - -N - -I destinationIP - server @@ -75,7 +65,7 @@ --workstation=WORKSTATION - Specify workstation of user to authenticate + Specify the workstation the user authenticated from diff --git a/docs/docbook/manpages/winbindd.8.sgml b/docs/docbook/manpages/winbindd.8.sgml index 0beddf0ea5..e0489c43c4 100644 --- a/docs/docbook/manpages/winbindd.8.sgml +++ b/docs/docbook/manpages/winbindd.8.sgml @@ -316,12 +316,6 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok winbindd to become aware of new trust relationships between servers, it must be sent a SIGHUP signal. - Client processes resolving names through the winbindd - nsswitch module read an environment variable named - $WINBINDD_DOMAIN. If this variable contains a comma separated - list of Windows NT domain names, then winbindd will only resolve users - and groups within those Windows NT domains. - PAM is really easy to misconfigure. Make sure you know what you are doing when modifying PAM configuration files. It is possible to set up PAM such that you can no longer log into your system. @@ -386,6 +380,21 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok root. + + $LOCKDIR/winbindd_privilaged/pipe + The UNIX pipe over which 'privilaged' clients + communicate with the winbindd program. For security + reasons, access to some winbindd functions - like those needed by + the ntlm_auth utility - is restricted. By default, + only users in the 'root' group will get this access, however the administrator + may change the group permissions on $LOCKDIR/winbindd_privilaged to allow + programs like 'squid' to use ntlm_auth. + Note that the winbind client will only attempt to connect to the winbindd daemon + if both the $LOCKDIR/winbindd_privilaged directory + and $LOCKDIR/winbindd_privilaged/pipe file are owned by + root. + + /lib/libnss_winbind.so.X Implementation of name service switch library. -- cgit From 22c6b5be5ac67219694ad90b20aaf2f56dd4ed01 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 14:11:51 +0000 Subject: Fix searching master ip by bcast when old master has gone away (based on patch by Stephan Kulow ) (This used to be commit 5c0e4b4dc630bd304f53c37f2340f954190b7aef) --- source3/utils/smbtree.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/source3/utils/smbtree.c b/source3/utils/smbtree.c index 52de5ab467..d245c324dd 100644 --- a/source3/utils/smbtree.c +++ b/source3/utils/smbtree.c @@ -90,10 +90,12 @@ static struct cli_state *get_ipc_connect(char *server, struct in_addr *server_ip /* Return the IP address and workgroup of a master browser on the network. */ -static BOOL find_master_ip_bcast(pstring workgroup, struct in_addr *server_ip) +static struct cli_state *get_ipc_connect_master_ip_bcast(pstring workgroup, struct user_auth_info *user_info) { struct in_addr *ip_list; + struct cli_state *cli; int i, count; + struct in_addr server_ip; /* Go looking for workgroups by broadcasting on the local network */ @@ -107,7 +109,7 @@ static BOOL find_master_ip_bcast(pstring workgroup, struct in_addr *server_ip) if (!name_status_find("*", 0, 0x1d, ip_list[i], name)) continue; - if (!find_master_ip(name, server_ip)) + if (!find_master_ip(name, &server_ip)) continue; pstrcpy(workgroup, name); @@ -115,10 +117,13 @@ static BOOL find_master_ip_bcast(pstring workgroup, struct in_addr *server_ip) DEBUG(4, ("found master browser %s, %s\n", name, inet_ntoa(ip_list[i]))); - return True; + if (!(cli = get_ipc_connect(inet_ntoa(server_ip), &server_ip, user_info))) + continue; + + return cli; } - return False; + return NULL; } /**************************************************************************** @@ -136,19 +141,21 @@ static BOOL get_workgroups(struct user_auth_info *user_info) pstrcpy(master_workgroup, lp_workgroup()); - if (use_bcast || !find_master_ip(lp_workgroup(), &server_ip)) { - DEBUG(4, ("Unable to find master browser for workgroup %s\n", + if (!use_bcast && !find_master_ip(lp_workgroup(), &server_ip)) { + DEBUG(4, ("Unable to find master browser for workgroup %s, falling back to broadcast\n", master_workgroup)); - if (!find_master_ip_bcast(master_workgroup, &server_ip)) { + use_bcast = True; + } else if(!use_bcast) { + if (!(cli = get_ipc_connect(inet_ntoa(server_ip), &server_ip, user_info))) + return False; + } + + if (!(cli = get_ipc_connect_master_ip_bcast(master_workgroup, user_info))) { DEBUG(4, ("Unable to find master browser by " "broadcast\n")); return False; - } } - if (!(cli = get_ipc_connect(inet_ntoa(server_ip), &server_ip, user_info))) - return False; - if (!cli_NetServerEnum(cli, master_workgroup, SV_TYPE_DOMAIN_ENUM, add_name, &workgroups)) return False; -- cgit From 8d9962f1d3093eb7d2524362685b858b68b6c9d5 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 14:59:21 +0000 Subject: Only link in libs when they are actually used. Works great here and on one of my other boxes. I'll watch the buildfarm. (This used to be commit 266c3970df9f5f9f617c49eee666c1db8e10c855) --- source3/Makefile.in | 66 ++++++++++++++++++++++++++++------------------------ source3/configure.in | 29 +++++++++++++++++++---- 2 files changed, 59 insertions(+), 36 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 8a7abe6bf7..fa302b5120 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -4,6 +4,7 @@ # Copyright (C) 2001 by Martin Pool # Copyright Andrew Bartlett 2002 # Copyright (C) 2003 Anthony Liguori +# Copyright (C) 2002-2003 Jelmer Vernooij ########################################################################### prefix=@prefix@ @@ -28,6 +29,9 @@ TERMLIBS=@TERMLIBS@ PRINTLIBS=@PRINTLIBS@ AUTHLIBS=@AUTHLIBS@ ACLLIBS=@ACLLIBS@ +PASSDBLIBS=@PASSDBLIBS@ +ADSLIBS=@ADSLIBS@ +KRB5LIBS=@KRB5_LIBS@ LINK=$(CC) $(FLAGS) $(LDFLAGS) @@ -717,12 +721,12 @@ bin/.dummy: bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(ACLLIBS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(ADSLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ + $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @BUILD_POPT@ bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -731,19 +735,19 @@ bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(LIBS) @BUILD_POPT@ + $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @BUILD_POPT@ $(KRB5LIBS) bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @BUILD_POPT@ $(ADSLIBS) bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @BUILD_POPT@ $(ADSLIBS) bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -755,7 +759,7 @@ bin/editreg@EXEEXT@: utils/editreg.o @BUILD_POPT@ bin/.dummy bin/smbspool@EXEEXT@: $(CUPS_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CUPS_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(CUPS_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/smbmount@EXEEXT@: $(MOUNT_OBJ) bin/.dummy @echo Linking $@ @@ -787,23 +791,23 @@ bin/smbcontrol@EXEEXT@: $(SMBCONTROL_OBJ) bin/.dummy bin/smbtree@EXEEXT@: $(SMBTREE_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ bin/samtest@EXEEXT@: $(SAMTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(PASSDBLIBS) $(ADSLIBS) bin/smbgroupedit@EXEEXT@: $(SMBGROUPEDIT_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBGROUPEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBGROUPEDIT_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) bin/nmblookup@EXEEXT@: $(NMBLOOKUP_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -811,7 +815,7 @@ bin/nmblookup@EXEEXT@: $(NMBLOOKUP_OBJ) @BUILD_POPT@ bin/.dummy bin/smbtorture@EXEEXT@: $(SMBTORTURE_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTORTURE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBTORTURE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) bin/talloctort@EXEEXT@: $(TALLOCTORT_OBJ) bin/.dummy @echo Linking $@ @@ -819,35 +823,35 @@ bin/talloctort@EXEEXT@: $(TALLOCTORT_OBJ) bin/.dummy bin/masktest@EXEEXT@: $(MASKTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MASKTEST_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(MASKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/msgtest@EXEEXT@: $(MSGTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MSGTEST_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(MSGTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/smbcacls@EXEEXT@: $(SMBCACLS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) bin/locktest@EXEEXT@: $(LOCKTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(LOCKTEST_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(LOCKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/nsstest@EXEEXT@: $(NSSTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NSSTEST_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(NSSTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/vfstest@EXEEXT@: $(VFSTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @BUILD_POPT@ $(ADSLIBS) bin/locktest2@EXEEXT@: $(LOCKTEST2_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(LOCKTEST2_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(LOCKTEST2_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/rpctorture@EXEEXT@: $(RPCTORTURE_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(RPCTORTURE_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(RPCTORTURE_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/debug2html@EXEEXT@: $(DEBUG2HTML_OBJ) bin/.dummy @echo Linking $@ @@ -855,11 +859,11 @@ bin/debug2html@EXEEXT@: $(DEBUG2HTML_OBJ) bin/.dummy bin/smbfilter@EXEEXT@: $(SMBFILTER_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBFILTER_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBFILTER_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/smbw_sample@EXEEXT@: $(SMBW_OBJ) utils/smbw_sample.o bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy @echo Linking $@ @@ -868,21 +872,21 @@ bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy bin/smbwrapper.@SHLIBEXT@: $(PICOBJS) bin/.dummy @echo Linking shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(PICOBJS) $(LIBS) \ - @SONAMEFLAG@`basename $@` + @SONAMEFLAG@`basename $@` $(KRB5LIBS) bin/smbwrapper.32.@SHLIBEXT@: $(PICOBJS32) @echo Linking shared library $@ @$(SHLD) -32 $(LDSHFLAGS) -o $@ $(PICOBJS32) $(LIBS) \ - @SONAMEFLAG@`basename $@` + @SONAMEFLAG@`basename $@` $(KRB5LIBS) bin/libsmbclient.@SHLIBEXT@: $(LIBSMBCLIENT_PICOBJS) @echo Linking libsmbclient shared library $@ $(SHLD) $(LDSHFLAGS) -o $@ $(LIBSMBCLIENT_PICOBJS) $(LDFLAGS) $(LIBS) \ - @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) + @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) $(KRB5LIBS) bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) @echo Linking libsmbclient non-shared library $@ - -$(AR) -rc $@ $(LIBSMBCLIENT_PICOBJS) + -$(AR) -rc $@ $(LIBSMBCLIENT_PICOBJS) $(KRB5LIBS) bin/libbigballofmud.@SHLIBEXT@: $(LIBBIGBALLOFMUD_PICOBJS) @echo Linking bigballofmud shared library $@ @@ -943,7 +947,7 @@ nsswitch/libnss_wins.@SHLIBEXT@: $(NSS_OBJ) bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(LINK) -o $@ $(WINBINDD_OBJ) $(IDMAP_OBJ) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(LINK) -o $@ $(WINBINDD_OBJ) $(IDMAP_OBJ) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(ADSLIBS) nsswitch/libns_winbind.@SHLIBEXT@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" @@ -995,7 +999,7 @@ bin/mysql.@SHLIBEXT@: $(MYSQL_OBJ) bin/ldapsam.@SHLIBEXT@: passdb/pdb_ldap.o @echo "Building plugin $@" - @$(SHLD) $(LDSHFLAGS) -o $@ passdb/pdb_ldap.o \ + @$(SHLD) $(LDSHFLAGS) @LDAP_LIBS@ -o $@ passdb/pdb_ldap.o \ @SONAMEFLAG@`basename $@` bin/tdbsam.@SHLIBEXT@: passdb/pdb_tdb.o @@ -1136,7 +1140,7 @@ python_ext: $(PYTHON_OBJS) echo Use the option --with-python to configure python; \ exit 1; fi PYTHON_OBJS="$(PYTHON_OBJS)" PYTHON_CFLAGS="$(CFLAGS) $(CPPFLAGS) $(FLAGS)" \ - LIBS="$(LIBS)" \ + LIBS="$(LIBS) $(PASSDBLIBS) $(KRB5LIBS)" \ $(PYTHON) python/setup.py build python_install: $(PYTHON_OBJS) diff --git a/source3/configure.in b/source3/configure.in index 3a6641d44a..d0c3e8e1fd 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -153,6 +153,10 @@ AC_SUBST(LIBSMBCLIENT) AC_SUBST(PRINTLIBS) AC_SUBST(AUTHLIBS) AC_SUBST(ACLLIBS) +AC_SUBST(ADSLIBS) +AC_SUBST(PASSDBLIBS) +AC_SUBST(KRB5_LIBS) +AC_SUBST(LDAP_LIBS) AC_SUBST(SHLIB_PROGS) AC_SUBST(SMBWRAPPER) AC_SUBST(EXTRA_BIN_PROGS) @@ -2065,6 +2069,11 @@ AC_MSG_RESULT($with_ads_support) FOUND_KRB5=no if test x"$with_ads_support" = x"yes"; then +ac_save_CFLAGS="$CFLAGS" +ac_save_LIBS="$LIBS" +CFLAGS="" +LIBS="" + ################################################# # check for krb5-config from recent MIT and Heimdal kerberos 5 AC_PATH_PROG(KRB5_CONFIG, krb5-config) @@ -2229,6 +2238,8 @@ fi AC_CHECK_LIB(gssapi_krb5, gss_display_status, [LIBS="$LIBS -lgssapi_krb5"; AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) +KRB5_LIBS="$LIBS"; KRB5_CFLAGS="$CFLAGS" +LIBS="$ac_save_LIBS"; CFLAGS="$ac_save_CFLAGS" fi ######################################################## @@ -2248,6 +2259,8 @@ AC_ARG_WITH(ldap, AC_MSG_RESULT($with_ldap_support) if test x"$with_ldap_support" = x"yes"; then +ac_save_CFLAGS="$CFLAGS"; ac_save_LIBS="$LIBS" +CFLAGS=""; LIBS="" ################################################################## # we might need the lber lib on some systems. To avoid link errors @@ -2272,6 +2285,12 @@ if test x"$with_ldap_support" = x"yes"; then AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $pam_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) fi +LDAP_LIBS="$LIBS";LDAP_CFLAGS="$CFLAGS" +LIBS="$ac_save_LIBS"; CFLAGS="$ac_save_CFLAGS" +fi + +if test x"$with_ads_support" = x"yes"; then + ADSLIBS="$LDAP_LIBS $KRB5_LIBS" fi ######################################################## @@ -2433,7 +2452,7 @@ AC_ARG_WITH(ldapsam, [ case "$withval" in yes) AC_MSG_RESULT(yes) - AC_DEFINE(WITH_LDAP_SAMCONFIG,1,[Whether to include 2.2 compatibel LDAP SAM configuration]) + AC_DEFINE(WITH_LDAP_SAMCONFIG,1,[Whether to include 2.2 compatible LDAP SAM configuration]) ;; *) AC_MSG_RESULT(no) @@ -3327,7 +3346,7 @@ if test x"$INCLUDED_POPT" = x"yes"; then FLAGS1="-I$srcdir/popt" else AC_MSG_RESULT(no) - LIBS="$LIBS -lpopt" + BUILD_POPT="-lpopt" fi AC_SUBST(BUILD_POPT) AC_SUBST(FLAGS1) @@ -3399,11 +3418,11 @@ AC_ARG_WITH(shared-modules, fi ]) SMB_MODULE(pdb_xml, modules/xml.o, bin/xml.so, PDB, - [ LIBS="$LIBS $XML_LIBS" ] ) + [ PASSDBLIBS="$PASSDBLIBS $XML_LIBS" ] ) SMB_MODULE(pdb_mysql, modules/mysql.o, bin/mysql.so, PDB, - [ LIBS="$LIBS $MYSQL_LIBS" ] ) + [ PASSDBLIBS="$PASSDBLIBS $MYSQL_LIBS" ] ) SMB_MODULE(pdb_ldap, passdb/pdb_ldap.o, bin/ldapsam.so, PDB, - [ LIBS="$LIBS $LDAP_LIBS" ] ) + [ PASSDBLIBS="$PASSDBLIBS $LDAP_LIBS" ] ) SMB_MODULE(pdb_smbpasswd, passdb/pdb_smbpasswd.o, bin/smbpasswd.so, PDB) SMB_MODULE(pdb_tdbsam, passdb/pdb_tdb.o, bin/tdbsam.so, PDB) SMB_MODULE(pdb_nisplussam, passdb/pdb_nisplus.o, bin/nisplussam.so, PDB) -- cgit From de8a78e7223f351838ef81085a7ec42f54a3740c Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 2 Apr 2003 15:03:07 +0000 Subject: Print out the 'freindly' error message from winbind. Also print useful information into it re the privilaged pipe. Also clean up some bugs in winbindd_pam.c Andrew Bartlett (This used to be commit e73b01204a8625946ff0fb5f9fc99dd959eb801c) --- source3/nsswitch/wbinfo.c | 10 ++++++---- source3/nsswitch/winbindd_pam.c | 19 ++++++++++++++++--- source3/utils/ntlm_auth.c | 10 ++++++---- 3 files changed, 28 insertions(+), 11 deletions(-) diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c index 5ec8e534aa..61c54b3738 100644 --- a/source3/nsswitch/wbinfo.c +++ b/source3/nsswitch/wbinfo.c @@ -447,9 +447,10 @@ static BOOL wbinfo_auth(char *username) (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed"); if (response.data.auth.nt_status) - d_printf("error code was %s (0x%x)\n", + d_printf("error code was %s (0x%x)\nerror messsage was: %s\n", response.data.auth.nt_status_string, - response.data.auth.nt_status); + response.data.auth.nt_status, + response.data.auth.error_string); return result == NSS_STATUS_SUCCESS; } @@ -502,9 +503,10 @@ static BOOL wbinfo_auth_crap(char *username) (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed"); if (response.data.auth.nt_status) - d_printf("error code was %s (0x%x)\n", + d_printf("error code was %s (0x%x)\nerror messsage was: %s\n", response.data.auth.nt_status_string, - response.data.auth.nt_status); + response.data.auth.nt_status, + response.data.auth.error_string); return result == NSS_STATUS_SUCCESS; } diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index d408a8b3ae..e65d2bb0f6 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -140,7 +140,12 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) uni_group_cache_store_netlogon(mem_ctx, &info3); done: - + + /* give us a more useful (more correct?) error code */ + if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) { + result = NT_STATUS_NO_LOGON_SERVERS; + } + state->response.data.auth.nt_status = NT_STATUS_V(result); fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result)); fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result)); @@ -176,6 +181,8 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) if (!state->privilaged) { DEBUG(2, ("winbindd_pam_auth_crap: non-privilaged access denied!\n")); + /* send a better message than ACCESS_DENIED */ + push_utf8_fstring(state->response.data.auth.error_string, "winbind client not authorized to use winbindd_pam_auth_crap"); result = NT_STATUS_ACCESS_DENIED; goto done; } @@ -282,15 +289,21 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) memcpy(state->response.data.auth.nt_session_key, info3.user_sess_key, sizeof(state->response.data.auth.nt_session_key) /* 16 */); } if (state->request.data.auth_crap.flags & WINBIND_PAM_LMKEY) { - memcpy(state->response.data.auth.first_8_lm_hash, info3.padding, sizeof(state->response.data.auth.nt_session_key) /* 16 */); + memcpy(state->response.data.auth.first_8_lm_hash, info3.padding, sizeof(state->response.data.auth.first_8_lm_hash) /* 8 */); } } done: + /* give us a more useful (more correct?) error code */ + if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) { + result = NT_STATUS_NO_LOGON_SERVERS; + } + state->response.data.auth.nt_status = NT_STATUS_V(result); push_utf8_fstring(state->response.data.auth.nt_status_string, nt_errstr(result)); - push_utf8_fstring(state->response.data.auth.error_string, nt_errstr(result)); + if (!*state->response.data.auth.error_string) + push_utf8_fstring(state->response.data.auth.error_string, get_friendly_nt_error_msg(result)); state->response.data.auth.pam_error = nt_status_to_pam(result); DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 82e6127d55..88913c8051 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -157,17 +157,19 @@ static BOOL check_plaintext_auth(const char *user, const char *pass, BOOL stdout d_printf("Reading winbind reply failed! (0x01)\n"); } - d_printf("%s (0x%x)\n", + d_printf("%s: %s (0x%x)\n", response.data.auth.nt_status_string, + response.data.auth.error_string, response.data.auth.nt_status); } else { if ((result != NSS_STATUS_SUCCESS) && (response.data.auth.nt_status == 0)) { DEBUG(1, ("Reading winbind reply failed! (0x01)\n")); } - DEBUG(3, ("%s (0x%x)\n", - response.data.auth.nt_status_string, - response.data.auth.nt_status)); + DEBUG(3, ("%s: %s (0x%x)\n", + response.data.auth.nt_status_string, + response.data.auth.error_string, + response.data.auth.nt_status)); } return (result == NSS_STATUS_SUCCESS); -- cgit From 75c1bf29a8d14e2d0458b8f89e347a5e374d3ea5 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 2 Apr 2003 15:04:47 +0000 Subject: Map a useless error code to a useful one... (This used to be commit 1afb2695a020424d014c4dee9c6a73620281aaa8) --- source3/auth/auth_domain.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c index 256c4532ed..7dca5914f0 100644 --- a/source3/auth/auth_domain.c +++ b/source3/auth/auth_domain.c @@ -175,6 +175,11 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli, &dest_ip, 0, "IPC$", "IPC", "", "", "",0, retry); if (!NT_STATUS_IS_OK(result)) { + /* map to something more useful */ + if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) { + result = NT_STATUS_NO_LOGON_SERVERS; + } + release_server_mutex(); return result; } -- cgit From 388af6585777b529877848b97c2b9c2fa9e35e06 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 15:08:31 +0000 Subject: Only link in popt when we need it (This used to be commit a5a980eb3efb37a6becacf043692361bdb4174b0) --- source3/Makefile.in | 42 +++++++++++++++++++++--------------------- source3/configure.in | 5 ++++- 2 files changed, 25 insertions(+), 22 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index fa302b5120..60ba100633 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -722,40 +722,40 @@ bin/.dummy: bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(ADSLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @BUILD_POPT@ + $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @POPTLIBS@ bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(WREPL_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(WREPL_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @BUILD_POPT@ $(KRB5LIBS) + $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @BUILD_POPT@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @BUILD_POPT@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(ADSLIBS) bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PROFILES_OBJ) $(LDFLAGS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(PROFILES_OBJ) $(LDFLAGS) $(LIBS) @POPTLIBS@ -bin/editreg@EXEEXT@: utils/editreg.o @BUILD_POPT@ bin/.dummy +bin/editreg@EXEEXT@: $(EDITREG_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ utils/editreg.o $(LDFLAGS) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ utils/editreg.o $(LDFLAGS) $(LIBS) @POPTLIBS@ bin/smbspool@EXEEXT@: $(CUPS_OBJ) bin/.dummy @echo Linking $@ @@ -775,7 +775,7 @@ bin/smbumount@EXEEXT@: $(UMOUNT_OBJ) bin/.dummy bin/testparm@EXEEXT@: $(TESTPARM_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(TESTPARM_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(TESTPARM_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ bin/testprns@EXEEXT@: $(TESTPRNS_OBJ) bin/.dummy @echo Linking $@ @@ -783,7 +783,7 @@ bin/testprns@EXEEXT@: $(TESTPRNS_OBJ) bin/.dummy bin/smbstatus@EXEEXT@: $(STATUS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(STATUS_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(STATUS_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ bin/smbcontrol@EXEEXT@: $(SMBCONTROL_OBJ) bin/.dummy @echo Linking $@ @@ -791,7 +791,7 @@ bin/smbcontrol@EXEEXT@: $(SMBCONTROL_OBJ) bin/.dummy bin/smbtree@EXEEXT@: $(SMBTREE_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy @echo Linking $@ @@ -799,11 +799,11 @@ bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ bin/samtest@EXEEXT@: $(SAMTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(PASSDBLIBS) $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) $(ADSLIBS) bin/smbgroupedit@EXEEXT@: $(SMBGROUPEDIT_OBJ) bin/.dummy @echo Linking $@ @@ -811,7 +811,7 @@ bin/smbgroupedit@EXEEXT@: $(SMBGROUPEDIT_OBJ) bin/.dummy bin/nmblookup@EXEEXT@: $(NMBLOOKUP_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBLOOKUP_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @BUILD_POPT@ + @$(CC) $(FLAGS) -o $@ $(NMBLOOKUP_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ bin/smbtorture@EXEEXT@: $(SMBTORTURE_OBJ) bin/.dummy @echo Linking $@ @@ -831,7 +831,7 @@ bin/msgtest@EXEEXT@: $(MSGTEST_OBJ) bin/.dummy bin/smbcacls@EXEEXT@: $(SMBCACLS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @BUILD_POPT@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) bin/locktest@EXEEXT@: $(LOCKTEST_OBJ) bin/.dummy @echo Linking $@ @@ -843,7 +843,7 @@ bin/nsstest@EXEEXT@: $(NSSTEST_OBJ) bin/.dummy bin/vfstest@EXEEXT@: $(VFSTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @BUILD_POPT@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) bin/locktest2@EXEEXT@: $(LOCKTEST2_OBJ) bin/.dummy @echo Linking $@ @@ -947,7 +947,7 @@ nsswitch/libnss_wins.@SHLIBEXT@: $(NSS_OBJ) bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(LINK) -o $@ $(WINBINDD_OBJ) $(IDMAP_OBJ) $(DYNEXP) $(LIBS) @BUILD_POPT@ $(ADSLIBS) + @$(LINK) -o $@ $(WINBINDD_OBJ) $(IDMAP_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) nsswitch/libns_winbind.@SHLIBEXT@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" @@ -1061,13 +1061,13 @@ bin/wbinfo@EXEEXT@: $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ $(UBIQX_OBJ) $(SECRETS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(LINK) -o $@ $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ - $(UBIQX_OBJ) $(SECRETS_OBJ) $(LIBS) @BUILD_POPT@ + $(UBIQX_OBJ) $(SECRETS_OBJ) $(LIBS) @POPTLIBS@ bin/ntlm_auth@EXEEXT@: $(NTLM_AUTH_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ $(UBIQX_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(LINK) -o $@ $(NTLM_AUTH_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ - $(UBIQX_OBJ) $(LIBS) @BUILD_POPT@ + $(UBIQX_OBJ) $(LIBS) @POPTLIBS@ bin/pam_smbpass.@SHLIBEXT@: $(PAM_SMBPASS_PICOOBJ) @echo "Linking shared library $@" diff --git a/source3/configure.in b/source3/configure.in index d0c3e8e1fd..266dffa38b 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -3343,12 +3343,15 @@ AC_MSG_CHECKING(whether to use included popt) if test x"$INCLUDED_POPT" = x"yes"; then AC_MSG_RESULT(yes) BUILD_POPT='$(POPT_OBJS)' + POPTLIBS='$(POPT_OBJS)' FLAGS1="-I$srcdir/popt" else AC_MSG_RESULT(no) - BUILD_POPT="-lpopt" + BUILD_POPT="" + POPTLIBS="-lpopt" fi AC_SUBST(BUILD_POPT) +AC_SUBST(POPTLIBS) AC_SUBST(FLAGS1) ################################################# -- cgit From b5c7e3377f91a811e1da03ccb18d62ce37f14950 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 15:25:19 +0000 Subject: Add EDITREG_OBJ (This used to be commit fef586d6cd9a4a754da858a29409ed2a7824cad1) --- source3/Makefile.in | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 60ba100633..4d11f1e988 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -294,6 +294,7 @@ GROUPDB_OBJ = groupdb/mapping.o PROFILE_OBJ = profile/profile.o PROFILES_OBJ = utils/profiles.o +EDITREG_OBJ = utils/editreg.o OPLOCK_OBJ = smbd/oplock.o smbd/oplock_irix.o smbd/oplock_linux.o @@ -755,7 +756,7 @@ bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy bin/editreg@EXEEXT@: $(EDITREG_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ utils/editreg.o $(LDFLAGS) $(LIBS) @POPTLIBS@ + @$(CC) $(FLAGS) -o $@ $(EDITREG_OBJ) $(LDFLAGS) $(LIBS) @POPTLIBS@ bin/smbspool@EXEEXT@: $(CUPS_OBJ) bin/.dummy @echo Linking $@ @@ -1123,7 +1124,7 @@ installdat: installdirs installswat: installdirs @$(SHELL) $(srcdir)/script/installswat.sh $(DESTDIR)$(SWATDIR) $(srcdir) -installclientlib: +installclientlib: bin/libsmbclient.@SHLIBEXT@ -$(INSTALLCLIENTCMD_SH) bin/libsmbclient.@SHLIBEXT@ $(DESTDIR)${prefix}/lib -$(INSTALLCLIENTCMD_A) bin/libsmbclient.a $(DESTDIR)${prefix}/lib -$(INSTALLCMD) -d $(DESTDIR)${prefix}/include -- cgit From c64d654797ea7bd975bdf488a1447a0ad10f096b Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 15:42:44 +0000 Subject: Link in lib/snprintf.o with editreg for use on systems that don't have snprintf (This used to be commit 7cd2c4474579114318554bc3b87b518fed218a93) --- source3/Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 4d11f1e988..cd0dc11ded 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -294,7 +294,7 @@ GROUPDB_OBJ = groupdb/mapping.o PROFILE_OBJ = profile/profile.o PROFILES_OBJ = utils/profiles.o -EDITREG_OBJ = utils/editreg.o +EDITREG_OBJ = utils/editreg.o lib/snprintf.o OPLOCK_OBJ = smbd/oplock.o smbd/oplock_irix.o smbd/oplock_linux.o -- cgit From 35d546ecd1efee9b5284cdbb9680363223d34a6d Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 15:46:25 +0000 Subject: Add KRB5LIBS to smbmount (This used to be commit cdaa3bf12e656dbd797882e89ce39ad76c45f6b6) --- source3/Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index cd0dc11ded..fbe8f1c165 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -764,7 +764,7 @@ bin/smbspool@EXEEXT@: $(CUPS_OBJ) bin/.dummy bin/smbmount@EXEEXT@: $(MOUNT_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MOUNT_OBJ) $(LDFLAGS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(MOUNT_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) bin/smbmnt@EXEEXT@: $(MNT_OBJ) bin/.dummy @echo Linking $@ -- cgit From 494f339ca8c726e1c91ce95c61eae2cb765c35b5 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 17:04:33 +0000 Subject: Add const (from a patch by Stephan Kulow ) (This used to be commit 8b5ad24231e5001e612c5fd4bbde2762caef5856) --- source3/include/libsmbclient.h | 9 +++++---- source3/libsmb/libsmb_cache.c | 8 ++++---- source3/libsmb/libsmbclient.c | 21 +++++++++++---------- 3 files changed, 20 insertions(+), 18 deletions(-) diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h index 0c905edcbc..a9f83cfbd3 100644 --- a/source3/include/libsmbclient.h +++ b/source3/include/libsmbclient.h @@ -257,8 +257,8 @@ typedef int (*smbc_remove_unused_server_fn)(SMBCCTX * c, SMBCSRV *srv); * */ typedef int (*smbc_add_cached_srv_fn) (SMBCCTX * c, SMBCSRV *srv, - char * server, char * share, - char * workgroup, char * username); + const char * server, const char * share, + const char * workgroup, const char * username); /**@ingroup callback @@ -277,8 +277,9 @@ typedef int (*smbc_add_cached_srv_fn) (SMBCCTX * c, SMBCSRV *srv, * @return pointer to SMBCSRV on success. NULL on failure. * */ -typedef SMBCSRV * (*smbc_get_cached_srv_fn) (SMBCCTX * c, char * server, - char * share, char * workgroup, char * username); +typedef SMBCSRV * (*smbc_get_cached_srv_fn) (SMBCCTX * c, const char * server, + const char * share, const char * workgroup, + const char * username); /**@ingroup callback diff --git a/source3/libsmb/libsmb_cache.c b/source3/libsmb/libsmb_cache.c index b1620042f3..67dc686b48 100644 --- a/source3/libsmb/libsmb_cache.c +++ b/source3/libsmb/libsmb_cache.c @@ -50,8 +50,8 @@ struct smbc_server_cache { * This function is only used if the external cache is not enabled */ static int smbc_add_cached_server(SMBCCTX * context, SMBCSRV * new, - char * server, char * share, - char * workgroup, char * username) + const char * server, const char * share, + const char * workgroup, const char * username) { struct smbc_server_cache * srvcache = NULL; @@ -108,8 +108,8 @@ static int smbc_add_cached_server(SMBCCTX * context, SMBCSRV * new, * returns server_fd on success, -1 on error (not found) * This function is only used if the external cache is not enabled */ -static SMBCSRV * smbc_get_cached_server(SMBCCTX * context, char * server, - char * share, char * workgroup, char * user) +static SMBCSRV * smbc_get_cached_server(SMBCCTX * context, const char * server, + const char * share, const char * workgroup, const char * user) { struct smbc_server_cache * srv = NULL; diff --git a/source3/libsmb/libsmbclient.c b/source3/libsmb/libsmbclient.c index f74a0be7f3..1da55ed4bd 100644 --- a/source3/libsmb/libsmbclient.c +++ b/source3/libsmb/libsmbclient.c @@ -350,7 +350,7 @@ int smbc_remove_unused_server(SMBCCTX * context, SMBCSRV * srv) */ SMBCSRV *smbc_server(SMBCCTX *context, - char *server, char *share, + const char *server, const char *share, char *workgroup, char *username, char *password) { @@ -358,7 +358,8 @@ SMBCSRV *smbc_server(SMBCCTX *context, int auth_called = 0; struct cli_state c; struct nmb_name called, calling; - char *p, *server_n = server; + char *p; + const char *server_n = server; fstring group; pstring ipenv; struct in_addr ip; @@ -1524,27 +1525,27 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) if (!context || !context->internal || !context->internal->_initialized) { - fprintf(stderr, "no valid context\n"); + DEBUG(4, ("no valid context\n")); errno = EINVAL; return NULL; } if (!fname) { - fprintf(stderr, "no valid fname\n"); + DEBUG(4, ("no valid fname\n")); errno = EINVAL; return NULL; } if (smbc_parse_path(context, fname, server, share, path, user, password)) { - fprintf(stderr, "no valid path\n"); + DEBUG(4, ("no valid path\n")); errno = EINVAL; return NULL; } - fprintf(stderr, "parsed path: fname='%s' server='%s' share='%s' path='%s'\n", fname, server, share, path); + DEBUG(4, ("parsed path: fname='%s' server='%s' share='%s' path='%s'\n", fname, server, share, path)); if (user[0] == (char)0) fstrcpy(user, context->user); @@ -1571,10 +1572,10 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) if (server[0] == (char)0) { struct in_addr server_ip; - fprintf(stderr, "empty server\n"); + DEBUG(4, ("empty server\n")); if (share[0] != (char)0 || path[0] != (char)0) { - fprintf(stderr, "share %d path %d\n", share[0], path[0]); + DEBUG(4,("share %d path %d\n", share[0], path[0])); errno = EINVAL; if (dir) { SAFE_FREE(dir->fname); @@ -2759,7 +2760,7 @@ SMBCCTX * smbc_init_context(SMBCCTX * context) slprintf(context->netbios_name, 16, "smbc%s%d", context->user, pid); } } - DEBUG(0,("Using netbios name %s.\n", context->netbios_name)); + DEBUG(1,("Using netbios name %s.\n", context->netbios_name)); if (!context->workgroup) { @@ -2771,7 +2772,7 @@ SMBCCTX * smbc_init_context(SMBCCTX * context) context->workgroup = strdup("samba"); } } - DEBUG(0,("Using workgroup %s.\n", context->workgroup)); + DEBUG(1,("Using workgroup %s.\n", context->workgroup)); /* shortest timeout is 1 second */ if (context->timeout > 0 && context->timeout < 1000) -- cgit From 46a6e1f0de1a0c366f4d80289804d0638fcede8c Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 17:10:05 +0000 Subject: Add static (This used to be commit 674d0ca5d84b64be395fbeff773c8dd8aeb1518c) --- source3/passdb/pdb_interface.c | 2 +- source3/smbd/vfs.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/source3/passdb/pdb_interface.c b/source3/passdb/pdb_interface.c index 95f587b076..8adcd9dbfa 100644 --- a/source3/passdb/pdb_interface.c +++ b/source3/passdb/pdb_interface.c @@ -61,7 +61,7 @@ BOOL smb_register_passdb(const char *name, pdb_init_function init, int version) return True; } -struct pdb_init_function_entry *pdb_find_backend_entry(const char *name) +static struct pdb_init_function_entry *pdb_find_backend_entry(const char *name) { struct pdb_init_function_entry *entry = backends; pstring stripped; diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c index adbde4994d..06aca51322 100644 --- a/source3/smbd/vfs.c +++ b/source3/smbd/vfs.c @@ -138,7 +138,7 @@ static struct vfs_ops default_vfs_ops = { maintain the list of available backends ****************************************************************************/ -struct vfs_init_function_entry *vfs_find_backend_entry(const char *name) +static struct vfs_init_function_entry *vfs_find_backend_entry(const char *name) { struct vfs_init_function_entry *entry = backends; pstring stripped; -- cgit From 4f59ed8e91a749b84b21187f6c65180ada2b13f4 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 17:54:25 +0000 Subject: Use entity for percent sign (This used to be commit 94eaa378dab7d15ad3896b89d2584309ea2d8c69) --- docs/docbook/global.ent | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/docbook/global.ent b/docs/docbook/global.ent index 659c448ed1..5f89a97593 100644 --- a/docs/docbook/global.ent +++ b/docs/docbook/global.ent @@ -6,6 +6,7 @@ + @@ -30,6 +31,7 @@ + -- cgit From d00b6f125fd98d1842cba57c7b509d52470c82d7 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 18:07:52 +0000 Subject: Regenerate docs (This used to be commit 20ee66b661e295cc9fb66f00b16de3b382a7e723) --- docs/faq/faq-errors.html | 4 +- docs/faq/faq-printing.html | 2 +- docs/htmldocs/ads.html | 165 +---- docs/htmldocs/appendixes.html | 176 +++-- docs/htmldocs/browsing-quick.html | 85 ++- docs/htmldocs/bugreport.html | 12 +- docs/htmldocs/compiling.html | 142 +++- docs/htmldocs/diagnosis.html | 30 +- docs/htmldocs/domain-security.html | 63 +- docs/htmldocs/groupmapping.html | 26 +- docs/htmldocs/improved-browsing.html | 104 +-- docs/htmldocs/integrate-ms-networks.html | 602 +++-------------- docs/htmldocs/introduction.html | 74 ++- docs/htmldocs/msdfs.html | 34 +- docs/htmldocs/optional.html | 611 ++++++++--------- docs/htmldocs/other-clients.html | 28 +- docs/htmldocs/pam.html | 212 +++--- docs/htmldocs/passdb.html | 56 +- docs/htmldocs/portability.html | 22 +- docs/htmldocs/printing.html | 58 +- docs/htmldocs/samba-bdc.html | 22 +- docs/htmldocs/samba-howto-collection.html | 563 ++++++++-------- docs/htmldocs/samba-pdc.html | 1015 ++--------------------------- docs/htmldocs/securing-samba.html | 38 +- docs/htmldocs/securitylevels.html | 295 ++++++++- docs/htmldocs/speed.html | 68 +- docs/htmldocs/type.html | 162 ++--- docs/htmldocs/unix-permissions.html | 101 +-- docs/htmldocs/vfs.html | 56 +- docs/htmldocs/winbind.html | 70 +- 30 files changed, 1993 insertions(+), 2903 deletions(-) diff --git a/docs/faq/faq-errors.html b/docs/faq/faq-errors.html index 20eca6adea..75f60aa326 100644 --- a/docs/faq/faq-errors.html +++ b/docs/faq/faq-errors.html @@ -132,7 +132,7 @@ Windows NT in the chapter "Portability" of the samba HOWTO collection

    No, it does not ignore -N, it is just that your server rejected the null password in the connection, so smbclient prompts for a password diff --git a/docs/faq/faq-printing.html b/docs/faq/faq-printing.html index cfe93d8ee8..a806b15de8 100644 --- a/docs/faq/faq-printing.html +++ b/docs/faq/faq-printing.html @@ -109,7 +109,7 @@ BORDER="0" >

    The setdriver call will fail if the printer doesn't already exist in samba's view of the world. Either create the printer in cups and diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html index ef019915d8..f37bbf0abc 100644 --- a/docs/htmldocs/ads.html +++ b/docs/htmldocs/ads.html @@ -13,7 +13,7 @@ REL="UP" TITLE="Type of installation" HREF="type.html">

    This is a rough guide to setting up Samba 3.0 with kerberos authentication against a Windows2000 KDC.

    Pieces you need before you begin:

    a Windows 2000 server.
    samba 3.0 or higher.
    the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.
    the OpenLDAP development libraries.

    8.1. Installing the required packages for Debian

    On Debian you need to install the following packages:

    libkrb5-dev
    krb5-user

    8.2. Installing the required packages for RedHat

    On RedHat this means you should have at least:

    krb5-workstation (for kinit)
    krb5-libs (for linking with)
    krb5-devel (because you are compiling from source)

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need -to get them off CD2.

    8.3. Compile Samba8.1. Setup your smb.conf

    If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

    After you run configure make sure that include/config.h it - generates contains - lines like this:

    #define HAVE_KRB5 1
-#define HAVE_LDAP 1

    If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

    Then compile and install Samba as usual. You must use at least the - following 3 options in smb.conf:

    You must use at least the following 3 options in smb.conf:

    You do *not* need a smbpasswd file, and older clients will
   be authenticated as if "security = domain", although it won't do any harm
   and allows you to have local users not in the domain.
-  I expect that the above
-  required options will change soon when we get better active
-  directory integration.

    8.4. Setup your /etc/krb5.conf8.2. Setup your /etc/krb5.conf

    The minimal configuration for krb5.conf is:

    8.5. Create the computer account8.3. Create the computer account

    As a user that has write permission on the Samba private directory @@ -291,8 +180,8 @@ CLASS="SECT2" >

    8.5.1. Possible errors8.3.1. Possible errors

    8.6. Test your server setup8.4. Test your server setup

    On a Windows 2000 client try

    8.7. Testing with smbclient8.5. Testing with smbclient

    On your Samba server try to login to a Win2000 server or your Samba @@ -349,12 +238,12 @@ CLASS="SECT1" >

    8.8. Notes8.6. Notes

    You must change administrator password at least once after DC install, - to create the right encoding types

    You must change administrator password at least once after DC +install, to create the right encoding types

    w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs?

    How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain ControlNextTable of Contents
    23. Samba performance issues
    23.1. Comparisons
    23.2. Socket options
    23.3. Read size
    23.4. Max xmit
    23.5. Log level
    23.6. Read raw
    23.7. Write raw
    23.8. Slow Clients
    23.9. Slow Logins
    23.10. Client tuning
    24. Portability
    24.1. HPUX
    24.2. SCO Unix
    24.3. DNIX
    24.4. RedHat Linux Rembrandt-II
    24.5. AIX
    24.5.1. Sequential Read Ahead
    25.1. Macintosh clients?
    25.2. OS2 Client
    25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?
    25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?
    25.2.3. Are there any other issues when OS/2 (any version) is used as a client?
    25.2.4. How do I get printer driver download working for OS/2 clients?
    25.3. Windows for Workgroups
    25.3.1. Use latest TCP/IP stack from Microsoft
    25.3.2. Delete .pwl files after password change
    25.3.3. Configure WfW password handling
    25.3.4. Case handling of passwords
    25.3.5. Use TCP/IP as default protocol
    25.4. Windows '95/'98
    25.5. Windows 2000 Service Pack 2
    26.1. Access Samba source code via CVS
    26.1.1. Introduction
    26.1.2. CVS Access to samba.org
    26.2. Accessing the samba sources via rsync and ftp
    26.3. Building the Binaries
    26.3.1. Compiling samba with Active Directory support
    26.4. Starting the smbd and nmbd
    26.4.1. Starting from inetd.conf
    26.4.2. Alternative: starting it as a daemon
    27.1. Introduction
    27.2. General info
    27.3. Debug levels
    27.4. Internal errors
    27.5. Attaching to a running process
    27.6. Patches
    28.1. Introduction
    28.2. Assumptions
    28.3. Tests
    28.3.1. Test 1
    28.3.2. Test 2
    28.3.3. Test 3
    28.3.4. Test 4
    28.3.5. Test 5
    28.3.6. Test 6
    28.3.7. Test 7
    28.3.8. Test 8
    28.3.9. Test 9
    28.3.10. Test 10
    28.3.11. Test 11
    28.4. Still having troubles?
    NextPortabilitySamba performance issues2.2. Use of the "Remote Announce" parameter2.2. How browsing functions and how to deploy stable and +dependable browsing using Samba

    As stated above, MS Windows machines register their NetBIOS names +(i.e.: the machine name for each service type in operation) on start +up. Also, as stated above, the exact method by which this name registration +takes place is determined by whether or not the MS Windows client/server +has been given a WINS server address, whether or not LMHOSTS lookup +is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

    In the case where there is no WINS server all name registrations as +well as name lookups are done by UDP broadcast. This isolates name +resolution to the local subnet, unless LMHOSTS is used to list all +names and IP addresses. In such situations Samba provides a means by +which the samba server name may be forcibly injected into the browse +list of a remote MS Windows network (using the "remote announce" parameter).

    Where a WINS server is used, the MS Windows client will use UDP +unicast to register with the WINS server. Such packets can be routed +and thus WINS allows name resolution to function across routed networks.

    During the startup process an election will take place to create a +local master browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the domain master browser. This +domain browsing has nothing to do with MS security domain control. +Instead, the domain master browser serves the role of contacting each local +master browser (found by asking WINS or from LMHOSTS) and exchanging browse +list contents. This way every master browser will eventually obtain a complete +list of all machines that are on the network. Every 11-15 minutes an election +is held to determine which machine will be the master browser. By the nature of +the election criteria used, the machine with the highest uptime, or the +most senior protocol version, or other criteria, will win the election +as domain master browser.

    Clients wishing to browse the network make use of this list, but also depend +on the availability of correct name resolution to the respective IP +address/addresses.

    Any configuration that breaks name resolution and/or browsing intrinsics +will annoy users because they will have to put up with protracted +inability to use the network services.

    Samba supports a feature that allows forced synchonisation +of browse lists across routed networks using the "remote +browse sync" parameter in the smb.conf file. This causes Samba +to contact the local master browser on a remote network and +to request browse list synchronisation. This effectively bridges +two networks that are separated by routers. The two remote +networks may use either broadcast based name resolution or WINS +based name resolution, but it should be noted that the "remote +browse sync" parameter provides browse list synchronisation - and +that is distinct from name to address resolution, in other +words, for cross subnet browsing to function correctly it is +essential that a name to address resolution mechanism be provided. +This mechanism could be via DNS, /etc/hosts, +and so on.

    2.3. Use of the "Remote Announce" parameter

    The "remote announce" parameter of smb.conf can be used to forcibly ensure @@ -198,8 +265,8 @@ CLASS="SECT1" >

    2.3. Use of the "Remote Browse Sync" parameter2.4. Use of the "Remote Browse Sync" parameter

    The "remote browse sync" parameter of smb.conf is used to announce to @@ -221,8 +288,8 @@ CLASS="SECT1" >

    2.4. Use of WINS2.5. Use of WINS

    Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly @@ -284,8 +351,8 @@ CLASS="SECT1" >

    2.5. Do NOT use more than one (1) protocol on MS Windows machines2.6. Do NOT use more than one (1) protocol on MS Windows machines

    A very common cause of browsing problems results from installing more than @@ -327,8 +394,8 @@ CLASS="SECT1" >

    2.6. Name Resolution Order2.7. Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number diff --git a/docs/htmldocs/bugreport.html b/docs/htmldocs/bugreport.html index ccac1c5779..0711f00f80 100644 --- a/docs/htmldocs/bugreport.html +++ b/docs/htmldocs/bugreport.html @@ -80,7 +80,7 @@ CLASS="SECT1" >

    27.1. Introduction

    27.2. General info

    27.3. Debug levels

    27.4. Internal errors

    27.5. Attaching to a running process

    27.6. Patches

    26.1. Access Samba source code via CVS

    26.1.1. Introduction

    26.1.2. CVS Access to samba.org

    26.1.2.1. Access via CVSweb

    26.1.2.2. Access via cvs

    26.2. Accessing the samba sources via rsync and ftp

    26.3. Building the Binaries

    if you find this version a disaster!

    26.3.1. Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed + on your system: +

    the MIT kerberos development libraries (either install from the sources or use a package). The heimdal libraries will not work.
    the OpenLDAP development libraries.

    + +

    If your kerberos libraries are in a non-standard location then + remember to add the configure option --with-krb5=DIR.

    After you run configure make sure that include/config.h it generates contains lines like this:

    #define HAVE_KRB5 1
+#define HAVE_LDAP 1
+

    If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure out why and fix + it.

    26.3.1.1. Installing the required packages for Debian

    On Debian you need to install the following packages:

    libkrb5-dev
    krb5-user

    +

    26.3.1.2. Installing the required packages for RedHat

    On RedHat this means you should have at least:

    krb5-workstation (for kinit)
    krb5-libs (for linking with)
    krb5-devel (because you are compiling from source)

    +

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need + to get them off CD2.

    26.4. Starting the smbd and nmbd

    26.4.1. Starting from inetd.conf

    26.4.2. Alternative: starting it as a daemon

    28.1. Introduction

    28.2. Assumptions

    28.3. Tests

    28.3.1. Test 1

    28.3.2. Test 2

    28.3.3. Test 3

    28.3.4. Test 4

    28.3.5. Test 5

    28.3.6. Test 6

    28.3.7. Test 7

    28.3.8. Test 8

    28.3.9. Test 9

    28.3.10. Test 10

    28.3.11. Test 11

    28.4. Still having troubles?

    9.1. Joining an NT Domain with Samba 3.0

    security = domain or - security = ads depending on if the PDC is - NT4 or running Active Directory respectivly.

    Next change the root# net join -S DOMPDC +>net rpc join -S DOMPDC -UAdministrator%password

    9.2. Samba and Windows 2000 Domains

    Many people have asked regarding the state of Samba's ability to participate in -a Windows 2000 Domain. Samba 3.0 is able to act as a member server of a Windows -2000 domain operating in mixed or native mode. The steps above apply -to both NT4 and Windows 2000.

    9.3. Why is this better than security = server?9.2. Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from @@ -341,13 +322,27 @@ CLASS="COMMAND" authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such as the user SID, the list of NT groups the user belongs to, etc.

    NOTE: Much of the text of this document was first published in the Web magazine Doing the NIS/NT Samba.

    Optional configurationAdvanced Configuration
    PrevNextChapter 19. Group mapping HOWTOChapter 12. Group mapping HOWTO

    Starting with Samba 3.0 alpha 2, a new group mapping function is available. The @@ -185,7 +186,7 @@ WIDTH="33%" ALIGN="left" VALIGN="top" >PrevNextStackable VFS modulesUNIX Permission Bits and Windows NT Access Control ListsSamba performance issuesConfiguring PAM for distributed but centrally +managed authentication

    PrevNextChapter 17. Improved browsing in sambaChapter 18. Improved browsing in samba

    17.1. Overview of browsing18.1. Overview of browsing

    SMB networking provides a mechanism by which clients can access a list @@ -109,8 +109,8 @@ CLASS="SECT1" >

    17.2. Browsing support in samba18.2. Browsing support in samba

    Samba facilitates browsing. The browsing is supported by nmbd @@ -152,8 +152,8 @@ CLASS="SECT1" >

    17.3. Problem resolution18.3. Problem resolution

    If something doesn't work then hopefully the log.nmb file will help @@ -199,8 +199,8 @@ CLASS="SECT1" >

    17.4. Browsing across subnets18.4. Browsing across subnets

    Since the release of Samba 1.9.17(alpha1) Samba has been @@ -230,8 +230,8 @@ CLASS="SECT2" >

    17.4.1. How does cross subnet browsing work ?18.4.1. How does cross subnet browsing work ?

    Cross subnet browsing is a complicated dance, containing multiple @@ -441,8 +441,8 @@ CLASS="SECT1" >

    17.5. Setting up a WINS server18.5. Setting up a WINS server

    Either a Samba machine or a Windows NT Server machine may be set up @@ -524,8 +524,8 @@ CLASS="SECT1" >

    17.6. Setting up Browsing in a WORKGROUP18.6. Setting up Browsing in a WORKGROUP

    To set up cross subnet browsing on a network containing machines @@ -556,10 +556,10 @@ options in the [global] section of the smb.conf file :

            domain master = yes
-        local master = yes
-        preferred master = yes
-        os level = 65
    domain master = yes +local master = yes +preferred master = yes +os level = 65

    The domain master browser may be the same machine as the WINS @@ -576,10 +576,10 @@ smb.conf file :

            domain master = no
-        local master = yes
-        preferred master = yes
-        os level = 65
    domain master = no +local master = yes +preferred master = yes +os level = 65

    Do not do this for more than one Samba server on each subnet, @@ -598,10 +598,10 @@ options in the [global] section of the smb.conf file :

            domain master = no
-        local master = no
-        preferred master = no
-        os level = 0
    domain master = no +local master = no +preferred master = no +os level = 0

    17.7. Setting up Browsing in a DOMAIN18.7. Setting up Browsing in a DOMAIN

    If you are adding Samba servers to a Windows NT Domain then @@ -628,10 +628,10 @@ file :

            domain master = no
-        local master = yes
-        preferred master = yes
-        os level = 65
    domain master = no +local master = yes +preferred master = yes +os level = 65

    If you wish to have a Samba server fight the election with machines @@ -660,8 +660,8 @@ CLASS="SECT1" >

    17.8. Forcing samba to be the master18.8. Forcing samba to be the master

    Who becomes the "master browser" is determined by an election process @@ -708,8 +708,8 @@ CLASS="SECT1" >

    17.9. Making samba the domain master18.9. Making samba the domain master

    The domain master is responsible for collating the browse lists of @@ -781,8 +781,8 @@ CLASS="SECT1" >

    17.10. Note about broadcast addresses18.10. Note about broadcast addresses

    If your network uses a "0" based broadcast address (for example if it @@ -795,8 +795,8 @@ CLASS="SECT1" >

    17.11. Multiple interfaces18.11. Multiple interfaces

    Samba now supports machines with multiple network interfaces. If you @@ -820,7 +820,7 @@ WIDTH="33%" ALIGN="left" VALIGN="top" >PrevNextUnified Logons between Windows NT and UNIX using WinbindIntegrating MS Windows networks with SambaStackable VFS modulesHosting a Microsoft Distributed File System tree on Samba

    PrevNextChapter 10. Integrating MS Windows networks with Samba

    10.1. Agenda

    Chapter 17. Integrating MS Windows networks with Samba

    To identify the key functional mechanisms of MS Windows networking -to enable the deployment of Samba as a means of extending and/or -replacing MS Windows NT/2000 technology.

    We will examine:

    This section deals with NetBIOS over TCP/IP name to IP address resolution. If you +your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this +section does not apply to your installation. If your installation involves use of +NetBIOS over TCP/IP then this section may help you to resolve networking problems.

    1. Name resolution in a pure Unix/Linux TCP/IP - environment -

    2. Name resolution as used within MS Windows - networking -

    3. How browsing functions and how to deploy stable - and dependable browsing using Samba -

    4. MS Windows security options and how to - configure Samba for seemless integration -

    5. NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS + over Logical Link Control (LLC). On modern networks it is highly advised + to NOT run NetBEUI at all. Note also that there is NO such thing as + NetBEUI over TCP/IP - the existence of such a protocol is a complete + and utter mis-apprehension.

    Configuration of Samba as:

    Since the introduction of MS Windows 2000 it is possible to run MS Windows networking +without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS +name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over +TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be +used and UDP port 137 and TCP port 139 will not.

    1. A stand-alone server

    2. An MS Windows NT 3.x/4.0 security domain member -

    3. An alternative to an MS Windows NT 3.x/4.0 Domain Controller -

      When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then +the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet +Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic).

    When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that +disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires +Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). +Use of DHCP with ADS is recommended as a further means of maintaining central control +over client workstation network configuration.

    10.2. Name Resolution in a pure Unix/Linux world17.1. Name Resolution in a pure Unix/Linux world

    The key configuration files covered in this section are:

    10.2.1. 17.1.1. /etc/hosts

    10.2.2. 17.1.2. /etc/resolv.conf

    10.2.3. 17.1.3. /etc/host.conf

    10.2.4. 17.1.4. /etc/nsswitch.conf

    10.3. Name resolution as used within MS Windows networking17.2. Name resolution as used within MS Windows networking

    MS Windows networking is predicated about the name each machine @@ -491,8 +499,8 @@ CLASS="SECT2" >

    10.3.1. The NetBIOS Name Cache17.2.1. The NetBIOS Name Cache

    All MS Windows machines employ an in memory buffer in which is @@ -518,8 +526,8 @@ CLASS="SECT2" >

    10.3.2. The LMHOSTS file17.2.2. The LMHOSTS file

    This file is usually located in MS Windows NT 4.0 or @@ -621,8 +629,8 @@ CLASS="SECT2" >

    10.3.3. HOSTS file17.2.3. HOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in @@ -643,8 +651,8 @@ CLASS="SECT2" >

    10.3.4. DNS Lookup17.2.4. DNS Lookup

    This capability is configured in the TCP/IP setup area in the network @@ -663,8 +671,8 @@ CLASS="SECT2" >

    10.3.5. WINS Lookup17.2.5. WINS Lookup

    A WINS (Windows Internet Name Server) service is the equivaent of the @@ -699,416 +707,6 @@ CLASS="REPLACEABLE" of the WINS server.

    10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba

    As stated above, MS Windows machines register their NetBIOS names -(i.e.: the machine name for each service type in operation) on start -up. Also, as stated above, the exact method by which this name registration -takes place is determined by whether or not the MS Windows client/server -has been given a WINS server address, whether or not LMHOSTS lookup -is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

    In the case where there is no WINS server all name registrations as -well as name lookups are done by UDP broadcast. This isolates name -resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse -list of a remote MS Windows network (using the "remote announce" parameter).

    Where a WINS server is used, the MS Windows client will use UDP -unicast to register with the WINS server. Such packets can be routed -and thus WINS allows name resolution to function across routed networks.

    During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local -master browser (found by asking WINS or from LMHOSTS) and exchanging browse -list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By the nature of -the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser.

    Clients wishing to browse the network make use of this list, but also depend -on the availability of correct name resolution to the respective IP -address/addresses.

    Any configuration that breaks name resolution and/or browsing intrinsics -will annoy users because they will have to put up with protracted -inability to use the network services.

    Samba supports a feature that allows forced synchonisation -of browse lists across routed networks using the "remote -browse sync" parameter in the smb.conf file. This causes Samba -to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the "remote -browse sync" parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on.

    10.5. MS Windows security options and how to configure -Samba for seemless integration

    MS Windows clients may use encrypted passwords as part of a -challenege/response authentication model (a.k.a. NTLMv1) or -alone, or clear text strings for simple password based -authentication. It should be realized that with the SMB -protocol the password is passed over the network either -in plain text or encrypted, but not both in the same -authentication requets.

    When encrypted passwords are used a password that has been -entered by the user is encrypted in two ways:

    • An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. -

    • The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is - then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. -

    You should refer to the Password Encryption chapter in this HOWTO collection -for more details on the inner workings

    MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x -and version 4.0 pre-service pack 3 will use either mode of -password authentication. All versions of MS Windows that follow -these versions no longer support plain text passwords by default.

    MS Windows clients have a habit of dropping network mappings that -have been idle for 10 minutes or longer. When the user attempts to -use the mapped drive connection that has been dropped, the client -re-establishes the connection using -a cached copy of the password.

    When Microsoft changed the default password mode, they dropped support for -caching of the plain text password. This means that when the registry -parameter is changed to re-enable use of plain text passwords it appears to -work, but when a dropped mapping attempts to revalidate it will fail if -the remote authentication server does not support encrypted passwords. -This means that it is definitely not a good idea to re-enable plain text -password support in such clients.

    The following parameters can be used to work around the -issue of Windows 9x client upper casing usernames and -password before transmitting them to the SMB server -when using clear text authentication.

    	passsword level = integer
-	username level = integer

    By default Samba will lower case the username before attempting -to lookup the user in the database of local system accounts. -Because UNIX usernames conventionally only contain lower case -character, the username level parameter -is rarely even needed.

    However, password on UNIX systems often make use of mixed case -characters. This means that in order for a user on a Windows 9x -client to connect to a Samba server using clear text authentication, -the password level must be set to the maximum -number of upper case letter which could appear -is a password. Note that is the server OS uses the traditional -DES version of crypt(), then a password level -of 8 will result in case insensitive passwords as seen from Windows -users. This will also result in longer login times as Samba -hash to compute the permutations of the password string and -try them one by one until a match is located (or all combinations fail).

    The best option to adopt is to enable support for encrypted passwords -where ever Samba is used. There are three configuration possibilities -for support of encrypted passwords:

    10.5.1. Use MS Windows NT as an authentication server

    This method involves the additions of the following parameters -in the smb.conf file:

    	encrypt passwords = Yes
-	security = server
-	password server = "NetBIOS_name_of_PDC"

    There are two ways of identifying whether or not a username and -password pair was valid or not. One uses the reply information provided -as part of the authentication messaging process, the other uses -just and error code.

    The down-side of this mode of configuration is the fact that -for security reasons Samba will send the password server a bogus -username and a bogus password and if the remote server fails to -reject the username and password pair then an alternative mode -of identification of validation is used. Where a site uses password -lock out after a certain number of failed authentication attempts -this will result in user lockouts.

    Use of this mode of authentication does require there to be -a standard Unix account for the user, this account can be blocked -to prevent logons by other than MS Windows clients.

    10.5.2. Make Samba a member of an MS Windows NT security domain

    This method involves additon of the following paramters in the smb.conf file:

    	encrypt passwords = Yes
-	security = domain
-	workgroup = "name of NT domain"
-	password server = *

    The use of the "*" argument to "password server" will cause samba -to locate the domain controller in a way analogous to the way -this is done within MS Windows NT.

    In order for this method to work the Samba server needs to join the -MS Windows NT security domain. This is done as follows:

    • On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. -

    • Next, on the Linux system execute: - smbpasswd -r PDC_NAME -j DOMAIN_NAME -

    Use of this mode of authentication does require there to be -a standard Unix account for the user in order to assign -a uid once the account has been authenticated by the remote -Windows DC. This account can be blocked to prevent logons by -other than MS Windows clients by things such as setting an invalid -shell in the /etc/passwd entry.

    An alternative to assigning UIDs to Windows users on a -Samba member server is presented in the Winbind Overview chapter in -this HOWTO collection.

    10.5.3. Configure Samba as an authentication server

    This mode of authentication demands that there be on the -Unix/Linux system both a Unix style account as well as an -smbpasswd entry for the user. The Unix system account can be -locked if required as only the encrypted password will be -used for SMB client authentication.

    This method involves addition of the following parameters to -the smb.conf file:

    ## please refer to the Samba PDC HOWTO chapter later in 
-## this collection for more details
-[global]
-	encrypt passwords = Yes
-	security = user
-	domain logons = Yes
-	; an OS level of 33 or more is recommended
-	os level = 33
-
-[NETLOGON]
-	path = /somewhare/in/file/system
-	read only = yes

    in order for this method to work a Unix system account needs -to be created for each user, as well as for each MS Windows NT/2000 -machine. The following structure is required.

    10.5.3.1. Users

    A user account that may provide a home directory should be -created. The following Linux system commands are typical of -the procedure for creating an account.

    	# useradd -s /bin/bash -d /home/"userid" -m "userid"
-	# passwd "userid"
-	  Enter Password: <pw>
-	  
-	# smbpasswd -a "userid"
-	  Enter Password: <pw>

    10.5.3.2. MS Windows NT Machine Accounts

    These are required only when Samba is used as a domain -controller. Refer to the Samba-PDC-HOWTO for more details.

    	# useradd -s /bin/false -d /dev/null "machine_name"\$
-	# passwd -l "machine_name"\$
-	# smbpasswd -a -m "machine_name"

    10.6. Conclusions

    Samba provides a flexible means to operate as...

    • A Stand-alone server - No special action is needed - other than to create user accounts. Stand-alone servers do NOT - provide network logon services, meaning that machines that use this - server do NOT perform a domain logon but instead make use only of - the MS Windows logon which is local to the MS Windows - workstation/server. -

    • An MS Windows NT 3.x/4.0 security domain member. -

    • An alternative to an MS Windows NT 3.x/4.0 - Domain Controller. -

    PrevNextOptional configurationUnified Logons between Windows NT and UNIX using WinbindUNIX Permission Bits and Windows NT Access Control ListsImproved browsing in samba
    2.2. Use of the "Remote Announce" parameterHow browsing functions and how to deploy stable and +dependable browsing using Samba
    2.3. Use of the "Remote Browse Sync" parameterUse of the "Remote Announce" parameter
    2.4. Use of WINSUse of the "Remote Browse Sync" parameter
    2.5. Do NOT use more than one (1) protocol on MS Windows machinesUse of WINS
    2.6. Do NOT use more than one (1) protocol on MS Windows machines
    2.7. Name Resolution Order
    3.1. Introduction
    3.2. Important Notes About Security
    3.2.1. Advantages of SMB Encryption
    3.2.2. Advantages of non-encrypted passwords
    3.3. The smbpasswd Command
    3.4. Plain text
    3.5. TDB
    3.6. LDAP
    3.6.1. Introduction
    3.6.2. Introduction
    3.6.3. Supported LDAP Servers
    3.6.4. Schema and Relationship to the RFC 2307 posixAccount
    3.6.5. Configuring Samba with LDAP
    3.6.6. Accounts and Groups management
    3.6.7. Security and sambaAccount
    3.6.8. LDAP specials attributes for sambaAccounts
    3.6.9. Example LDIF Entries for a sambaAccount
    3.7. MySQL
    3.7.1. Building
    3.7.2. Creating the database
    3.7.3. Configuring
    3.7.4. Using plaintext passwords or encrypted password
    3.7.5. Getting non-column data from the table
    3.8. Passdb XML plugin
    3.8.1. Building
    3.8.2. Usage
    PrevNextChapter 13. Hosting a Microsoft Distributed File System tree on SambaChapter 19. Hosting a Microsoft Distributed File System tree on Samba

    13.1. Instructions19.1. Instructions

    The Distributed File System (or Dfs) provides a means of @@ -213,8 +212,8 @@ CLASS="SECT2" >

    13.1.1. Notes19.1.1. Notes

    PrevNextConfiguring PAM for distributed but centrally -managed authenticationImproved browsing in sambaPrinting SupportStackable VFS modules
    Optional configurationAdvanced ConfigurationNext

    III. Optional configuration

    III. Advanced Configuration

    Introduction

    10. Integrating MS Windows networks with SambaSystem Policies
    10.1. Agenda
    10.2. Name Resolution in a pure Unix/Linux worldBasic System Policy Info
    10.2.1. /etc/hosts
    10.2.2. /etc/resolv.conf
    10.2.3. /etc/host.conf
    10.2.4. /etc/nsswitch.conf10.1.1. Creating Group Prolicy Files
    10.3. Name resolution as used within MS Windows networking10.2. Roaming Profiles
    10.3.1. The NetBIOS Name Cache
    10.3.2. The LMHOSTS file10.2.1. Windows NT Configuration
    10.3.3. HOSTS file10.2.2. Windows 9X Configuration
    10.3.4. DNS Lookup10.2.3. Win9X and WinNT Configuration
    10.3.5. WINS Lookup10.2.4. Windows 9X Profile Setup
    10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba10.2.5. Windows NT Workstation 4.0
    10.5. MS Windows security options and how to configure -Samba for seemless integration10.2.6. Windows NT/200x Server
    10.5.1. Use MS Windows NT as an authentication server10.2.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    10.5.2. Make Samba a member of an MS Windows NT security domain10.2.8. Windows NT 4
    10.5.3. Configure Samba as an authentication server10.2.9. Windows 2000/XP
    10.6. Conclusions
    11.1. Viewing and changing UNIX permissions using the NT security dialogs
    11.2. How to view file security on a Samba share
    11.3. Viewing file ownership
    11.4. Viewing file or directory permissions
    11.4.1. File Permissions
    11.4.2. Directory Permissions
    11.5. Modifying file or directory permissions
    11.6. Interaction with the standard Samba create mask parameters
    11.7. Interaction with the standard Samba file attribute mapping
    12. Group mapping HOWTO
    13. Configuring PAM for distributed but centrally managed authentication
    12.1. 13.1. Samba and PAM
    12.2. 13.2. Distributed Authentication
    12.3. 13.3. PAM Configuration in smb.conf
    13. Hosting a Microsoft Distributed File System tree on Samba
    13.1. Instructions
    13.1.1. Notes
    14. Printing Support
    14.1. Introduction
    14.2. Configuration
    14.2.1. Creating [print$]
    14.2.2. Setting Drivers for Existing Printers
    14.2.3. Support a large number of printers
    14.2.4. Adding New Printers via the Windows NT APW
    14.2.5. Samba and Printer Ports
    14.3. The Imprints Toolset
    14.3.1. What is Imprints?
    14.3.2. Creating Printer Driver Packages
    14.3.3. The Imprints server
    14.3.4. The Installation Client
    14.4. Diagnosis
    14.4.1. Introduction
    14.4.2. Debugging printer problems
    14.4.3. What printers do I have?
    14.4.4. Setting up printcap and print servers
    14.4.5. Job sent, no output
    14.4.6. Job sent, strange output
    14.4.7. Raw PostScript printed
    14.4.8. Advanced Printing
    14.4.9. Real debugging
    15.1. Introduction
    15.2. CUPS - RAW Print Through Mode
    15.3. The CUPS Filter Chains
    15.4. CUPS Print Drivers and Devices
    15.4.1. Further printing steps
    15.5. Limiting the number of pages users can print
    15.6. Advanced Postscript Printing from MS Windows
    15.7. Auto-Deletion of CUPS spool files
    16.1. Abstract
    16.2. Introduction
    16.3. What Winbind Provides
    16.3.1. Target Uses
    16.4. How Winbind Works
    16.4.1. Microsoft Remote Procedure Calls
    16.4.2. Microsoft Active Directory Services
    16.4.3. Name Service Switch
    16.4.4. Pluggable Authentication Modules
    16.4.5. User and Group ID Allocation
    16.4.6. Result Caching
    16.5. Installation and Configuration
    16.5.1. Introduction
    16.5.2. Requirements
    16.5.3. Testing Things Out
    16.6. Limitations
    16.7. Conclusion
    17. Improved browsing in sambaIntegrating MS Windows networks with Samba
    17.1. Overview of browsingName Resolution in a pure Unix/Linux world
    17.2. Browsing support in samba17.1.1. /etc/hosts
    17.3. Problem resolution17.1.2. /etc/resolv.conf
    17.4. Browsing across subnets17.1.3. /etc/host.conf
    17.4.1. How does cross subnet browsing work ?17.1.4. /etc/nsswitch.conf
    17.5. Setting up a WINS server
    17.6. Setting up Browsing in a WORKGROUP17.2. Name resolution as used within MS Windows networking
    17.7. Setting up Browsing in a DOMAIN17.2.1. The NetBIOS Name Cache
    17.8. Forcing samba to be the master17.2.2. The LMHOSTS file
    17.9. Making samba the domain master17.2.3. HOSTS file
    17.10. Note about broadcast addresses17.2.4. DNS Lookup
    17.11. Multiple interfaces17.2.5. WINS Lookup
    18. Stackable VFS modulesImproved browsing in samba
    18.1. Introduction and configurationOverview of browsing
    18.2. Included modules
    18.2.1. audit
    18.2.2. recycleBrowsing support in samba
    18.2.3. netatalk18.3. Problem resolution
    18.3. VFS modules available elsewhere18.4. Browsing across subnets
    18.3.1. DatabaseFS
    18.3.2. vscan18.4.1. How does cross subnet browsing work ?
    19. Group mapping HOWTO
    20. Samba performance issues
    20.1. Comparisons18.5. Setting up a WINS server
    20.2. Socket options18.6. Setting up Browsing in a WORKGROUP
    20.3. Read size18.7. Setting up Browsing in a DOMAIN
    20.4. Max xmit18.8. Forcing samba to be the master
    20.5. Log level18.9. Making samba the domain master
    20.6. Read raw18.10. Note about broadcast addresses
    20.7. Write raw18.11. Multiple interfaces
    20.8. Slow Clients19. Hosting a Microsoft Distributed File System tree on Samba
    20.9. Slow Logins19.1. Instructions
    20.10. Client tuning19.1.1. Notes
    21. Creating Group Prolicy Files20. Stackable VFS modules
    21.1. Windows '9x20.1. Introduction and configuration
    21.2. Windows NT 420.2. Included modules
    21.2.1. Side bar Notes
    21.2.2. Mandatory profiles20.2.1. audit
    21.2.3. moveuser.exe20.2.2. recycle
    21.2.4. Get SID20.2.3. netatalk
    21.3. Windows 2000/XP20.3. VFS modules available elsewhere
    20.3.1. DatabaseFS
    20.3.2. vscan
    22. 21. Securing Samba
    22.1. 21.1. Introduction
    22.2. 21.2. Using host based protection
    22.3. 21.3. Using interface protection
    22.4. 21.4. Using a firewall
    22.5. 21.5. Using a IPC$ share deny
    22.6. 21.6. Upgrading Samba
    23. 22. Unicode/Charsets
    23.1. 22.1. What are charsets and unicode?
    23.2. 22.2. Samba and charsets
    NextIntegrating MS Windows networks with SambaSystem Policies

    25.1. Macintosh clients?

    25.2. OS2 Client

    25.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?

    25.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?

    25.2.3. Are there any other issues when OS/2 (any version) is used as a client?

    25.2.4. How do I get printer driver download working for OS/2 clients?

    25.3. Windows for Workgroups

    25.3.1. Use latest TCP/IP stack from Microsoft

    25.3.2. Delete .pwl files after password change

    25.3.3. Configure WfW password handling

    25.3.4. Case handling of passwords

    25.3.5. Use TCP/IP as default protocol

    25.4. Windows '95/'98

    25.5. Windows 2000 Service Pack 2

    PrevNextChapter 12. Configuring PAM for distributed but centrally +>Chapter 13. Configuring PAM for distributed but centrally managed authentication

    12.1. Samba and PAM13.1. Samba and PAM

    A number of Unix systems (eg: Sun Solaris), as well as the @@ -119,6 +119,45 @@ or by editing individual files that are located in /etc/pam.d.

    If the PAM authentication module (loadable link library file) is located in the + default location then it is not necessary to specify the path. In the case of + Linux, the default location is /lib/security. If the module + is located other than default then the path may be specified as: + + 

    	eg: "auth       required      /other_path/pam_strange_module.so"
+
    +

    The following is an example 

    #%PAM-1.0
-# The PAM configuration file for the `login' service
-#
-auth 		required	pam_securetty.so
-auth 		required	pam_nologin.so
-# auth 		required	pam_dialup.so
-# auth 		optional	pam_mail.so
-auth		required	pam_pwdb.so shadow md5
-# account    	requisite  	pam_time.so
-account		required	pam_pwdb.so
-session		required	pam_pwdb.so
-# session 	optional	pam_lastlog.so
-# password   	required   	pam_cracklib.so retry=3
-password	required	pam_pwdb.so shadow md5
    #%PAM-1.0 + # The PAM configuration file for the `login' service + # + auth required pam_securetty.so + auth required pam_nologin.so + # auth required pam_dialup.so + # auth optional pam_mail.so + auth required pam_pwdb.so shadow md5 + # account requisite pam_time.so + account required pam_pwdb.so + session required pam_pwdb.so + # session optional pam_lastlog.so + # password required pam_cracklib.so retry=3 + password required pam_pwdb.so shadow md5

    PAM allows use of replacable modules. Those available on a @@ -155,19 +194,19 @@ sample system include:

    $ /bin/ls /lib/security
-pam_access.so    pam_ftp.so          pam_limits.so     
-pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
-pam_cracklib.so  pam_group.so        pam_listfile.so   
-pam_nologin.so   pam_rootok.so       pam_tally.so      
-pam_deny.so      pam_issue.so        pam_mail.so       
-pam_permit.so    pam_securetty.so    pam_time.so       
-pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-pam_pwdb.so      pam_shells.so       pam_unix.so       
-pam_env.so       pam_ldap.so         pam_motd.so       
-pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-pam_userdb.so    pam_warn.so         pam_unix_session.so
    $ /bin/ls /lib/security + pam_access.so pam_ftp.so pam_limits.so + pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so + pam_cracklib.so pam_group.so pam_listfile.so + pam_nologin.so pam_rootok.so pam_tally.so + pam_deny.so pam_issue.so pam_mail.so + pam_permit.so pam_securetty.so pam_time.so + pam_dialup.so pam_lastlog.so pam_mkhomedir.so + pam_pwdb.so pam_shells.so pam_unix.so + pam_env.so pam_ldap.so pam_motd.so + pam_radius.so pam_smbpass.so pam_unix_acct.so + pam_wheel.so pam_unix_auth.so pam_unix_passwd.so + pam_userdb.so pam_warn.so pam_unix_session.so

    The following example for the login program replaces the use of @@ -230,13 +269,13 @@ source distribution.

    #%PAM-1.0
-# The PAM configuration file for the `login' service
-#
-auth		required	pam_smbpass.so nodelay
-account		required	pam_smbpass.so nodelay
-session		required	pam_smbpass.so nodelay
-password	required	pam_smbpass.so nodelay
    #%PAM-1.0 + # The PAM configuration file for the `login' service + # + auth required pam_smbpass.so nodelay + account required pam_smbpass.so nodelay + session required pam_smbpass.so nodelay + password required pam_smbpass.so nodelay

    The following is the PAM configuration file for a particular @@ -247,13 +286,13 @@ CLASS="FILENAME" >

    #%PAM-1.0
-# The PAM configuration file for the `samba' service
-#
-auth       required     /lib/security/pam_pwdb.so nullok nodelay shadow audit
-account    required     /lib/security/pam_pwdb.so audit nodelay
-session    required     /lib/security/pam_pwdb.so nodelay
-password   required     /lib/security/pam_pwdb.so shadow md5
    #%PAM-1.0 + # The PAM configuration file for the `samba' service + # + auth required /lib/security/pam_pwdb.so nullok nodelay shadow audit + account required /lib/security/pam_pwdb.so audit nodelay + session required /lib/security/pam_pwdb.so nodelay + password required /lib/security/pam_pwdb.so shadow md5

    In the following example the decision has been made to use the @@ -264,16 +303,36 @@ program.

    #%PAM-1.0
-# The PAM configuration file for the `samba' service
-#
-auth       required     /lib/security/pam_smbpass.so nodelay
-account    required     /lib/security/pam_pwdb.so audit nodelay
-session    required     /lib/security/pam_pwdb.so nodelay
-password   required     /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
    #%PAM-1.0 + # The PAM configuration file for the `samba' service + # + auth required /lib/security/pam_smbpass.so nodelay + account required /lib/security/pam_pwdb.so audit nodelay + session required /lib/security/pam_pwdb.so nodelay + password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf

    Note: PAM allows stacking of authentication mechanisms. It is +>

    PAM allows stacking of authentication mechanisms. It is also possible to pass information obtained within one PAM module through to the next module in the PAM stack. Please refer to the documentation for your particular system implementation for details regarding the specific @@ -290,14 +349,18 @@ CLASS="FILENAME" on the basis that it allows for easier administration. As with all issues in life though, every decision makes trade-offs, so you may want examine the PAM documentation for further helpful information.

    12.2. Distributed Authentication13.2. Distributed Authentication

    The astute administrator will realize from this that the @@ -308,16 +371,9 @@ CLASS="FILENAME" winbindd, and rsync (see -http://rsync.samba.org/) -will allow the establishment of a centrally managed, distributed +>, and a distributed +passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware programs and applications. This arrangement can have particularly potent advantages compared with the @@ -329,8 +385,8 @@ CLASS="SECT1" >

    12.3. PAM Configuration in smb.conf13.3. PAM Configuration in smb.conf

    There is an option in smb.conf called . The following is from the on-line help for this option in SWAT;

    When Samba 2.2 is configure to enable PAM support (i.e. +>When Samba is configured to enable PAM support (i.e. --with-pamPrevNextUNIX Permission Bits and Windows NT Access Control ListsGroup mapping HOWTOHosting a Microsoft Distributed File System tree on SambaPrinting Support

    3.1. Introduction

    3.2. Important Notes About Security

    3.2.1. Advantages of SMB Encryption

    3.2.2. Advantages of non-encrypted passwords

    3.3. The smbpasswd Command

    3.4. Plain text

    3.5. TDB

    3.6. LDAP

    3.6.1. Introduction

    3.6.2. Introduction

    3.6.3. Supported LDAP Servers

    3.6.4. Schema and Relationship to the RFC 2307 posixAccount

    3.6.5. Configuring Samba with LDAP

    3.6.5.1. OpenLDAP configuration

    3.6.5.2. Configuring Samba

    3.6.6. Accounts and Groups management

    3.6.7. Security and sambaAccount

    3.6.8. LDAP specials attributes for sambaAccounts

    3.6.9. Example LDIF Entries for a sambaAccount

    3.7. MySQL

    3.7.1. Building

    3.7.2. Creating the database

    3.7.3. Configuring

    3.7.4. Using plaintext passwords or encrypted password

    3.7.5. Getting non-column data from the table

    3.8. Passdb XML plugin

    3.8.1. Building

    3.8.2. Usage

    Prev

    24.1. HPUX

    24.2. SCO Unix

    24.3. DNIX

    24.4. RedHat Linux Rembrandt-II

    24.5. AIX

    24.5.1. Sequential Read Ahead

    PrevAppendixesSamba performance issuesPrev

    14.1. Introduction

    14.2. Configuration

    14.2.1. Creating [print$]

    14.2.2. Setting Drivers for Existing Printers

    14.2.3. Support a large number of printers

    14.2.4. Adding New Printers via the Windows NT APW

    14.2.5. Samba and Printer Ports

    14.3. The Imprints Toolset

    14.3.1. What is Imprints?

    14.3.2. Creating Printer Driver Packages

    14.3.3. The Imprints server

    14.3.4. The Installation Client

    14.4. Diagnosis

    14.4.1. Introduction

    14.4.2. Debugging printer problems

    14.4.3. What printers do I have?

    14.4.4. Setting up printcap and print servers

    14.4.5. Job sent, no output

    14.4.6. Job sent, strange output

    14.4.7. Raw PostScript printed

    14.4.8. Advanced Printing

    14.4.9. Real debugging

    PrevHosting a Microsoft Distributed File System tree on SambaConfiguring PAM for distributed but centrally +managed authenticationHow to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain ControlChapter 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainChapter 7. Samba Backup Domain Controller to Samba Domain Control

    7.1. Prerequisite Reading

    7.2. Background

    7.3. What qualifies a Domain Controller on the network?

    7.3.1. How does a Workstation find its domain controller?

    7.3.2. When is the PDC needed?

    7.4. Can Samba be a Backup Domain Controller to an NT PDC?

    7.5. How do I set up a Samba BDC?

    7.5.1. How do I replicate the smbpasswd file?

    7.5.2. Can I do this all with LDAP?

    2.2. Use of the "Remote Announce" parameterHow browsing functions and how to deploy stable and +dependable browsing using Samba
    2.3. Use of the "Remote Browse Sync" parameterUse of the "Remote Announce" parameter
    2.4. Use of WINSUse of the "Remote Browse Sync" parameter
    2.5. Do NOT use more than one (1) protocol on MS Windows machinesUse of WINS
    2.6. Do NOT use more than one (1) protocol on MS Windows machines
    2.7. Name Resolution Order
    3.1. Introduction
    3.2. Important Notes About Security
    3.3. The smbpasswd Command
    3.4. Plain text
    3.5. TDB
    3.6. LDAP
    3.7. MySQL
    3.8. Passdb XML plugin
    4.1. Stand Alone Server
    4.2. Domain Member Server
    4.3. Domain Controller
    5. Samba as Stand-Alone server (User and Share security level)Samba as Stand-Alone Server
    5.1. User and Share security level
    6.
    6.1. Prerequisite Reading
    6.2. Background
    6.3. Configuring the Samba Domain Controller
    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
    6.5. Common Problems and Errors
    6.6. System Policies and Profiles
    6.7. What other help can I get?
    6.8. 6.7. Domain Control for Windows 9x/ME
    6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
    7. How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain Control
    7.1. Prerequisite Reading
    7.2. Background
    7.3. What qualifies a Domain Controller on the network?
    7.4. Can Samba be a Backup Domain Controller to an NT PDC?
    7.5. How do I set up a Samba BDC?
    8.1. Installing the required packages for DebianSetup your smb.conf
    8.2. Installing the required packages for RedHatSetup your /etc/krb5.conf
    8.3. Compile Samba
    8.4. Setup your /etc/krb5.conf
    8.5. Create the computer account
    8.6. 8.4. Test your server setup
    8.7. 8.5. Testing with smbclient
    8.8. 8.6. Notes
    9.1. Joining an NT Domain with Samba 3.0
    9.2. Samba and Windows 2000 Domains
    9.3. Why is this better than security = server?
    III. Optional configurationAdvanced Configuration
    10. Integrating MS Windows networks with SambaSystem Policies
    10.1. AgendaBasic System Policy Info
    10.2. Name Resolution in a pure Unix/Linux world
    10.3. Name resolution as used within MS Windows networking
    10.4. How browsing functions and how to deploy stable and -dependable browsing using Samba
    10.5. MS Windows security options and how to configure -Samba for seemless integration
    10.6. ConclusionsRoaming Profiles
    11.1. Viewing and changing UNIX permissions using the NT security dialogs
    11.2. How to view file security on a Samba share
    11.3. Viewing file ownership
    11.4. Viewing file or directory permissions
    11.5. Modifying file or directory permissions
    11.6. Interaction with the standard Samba create mask parameters
    11.7. Interaction with the standard Samba file attribute mapping
    12. Group mapping HOWTO
    13. Configuring PAM for distributed but centrally managed authentication
    12.1. 13.1. Samba and PAM
    12.2. 13.2. Distributed Authentication
    12.3. 13.3. PAM Configuration in smb.conf
    13. Hosting a Microsoft Distributed File System tree on Samba
    13.1. Instructions
    14. Printing Support
    14.1. Introduction
    14.2. Configuration
    14.3. The Imprints Toolset
    14.4. Diagnosis
    15.1. Introduction
    15.2. CUPS - RAW Print Through Mode
    15.3. The CUPS Filter Chains
    15.4. CUPS Print Drivers and Devices
    15.5. Limiting the number of pages users can print
    15.6. Advanced Postscript Printing from MS Windows
    15.7. Auto-Deletion of CUPS spool files
    16.1. Abstract
    16.2. Introduction
    16.3. What Winbind Provides
    16.4. How Winbind Works
    16.5. Installation and Configuration
    16.6. Limitations
    16.7. Conclusion
    17. Integrating MS Windows networks with Samba
    17.1. Name Resolution in a pure Unix/Linux world
    17.2. Name resolution as used within MS Windows networking
    18. Improved browsing in samba
    17.1. 18.1. Overview of browsing
    17.2. 18.2. Browsing support in samba
    17.3. 18.3. Problem resolution
    17.4. 18.4. Browsing across subnets
    17.5. 18.5. Setting up a WINS server
    17.6. 18.6. Setting up Browsing in a WORKGROUP
    17.7. 18.7. Setting up Browsing in a DOMAIN
    17.8. 18.8. Forcing samba to be the master
    17.9. 18.9. Making samba the domain master
    17.10. 18.10. Note about broadcast addresses
    17.11. 18.11. Multiple interfaces
    18. Stackable VFS modules19. Hosting a Microsoft Distributed File System tree on Samba
    18.1. Introduction and configuration
    18.2. Included modules
    18.3. VFS modules available elsewhere19.1. Instructions
    19. Group mapping HOWTO
    20. Samba performance issuesStackable VFS modules
    20.1. ComparisonsIntroduction and configuration
    20.2. Socket optionsIncluded modules
    20.3. Read size
    20.4. Max xmit
    20.5. Log level
    20.6. Read raw
    20.7. Write raw
    20.8. Slow Clients
    20.9. Slow Logins
    20.10. Client tuningVFS modules available elsewhere
    21. Creating Group Prolicy Files
    21.1. Windows '9x
    21.2. Windows NT 4
    21.3. Windows 2000/XP
    22. Securing Samba
    22.1. 21.1. Introduction
    22.2. 21.2. Using host based protection
    22.3. 21.3. Using interface protection
    22.4. 21.4. Using a firewall
    22.5. 21.5. Using a IPC$ share deny
    22.6. 21.6. Upgrading Samba
    23. 22. Unicode/Charsets
    23.1. 22.1. What are charsets and unicode?
    23.2. 22.2. Samba and charsets
    23. Samba performance issues
    23.1. Comparisons
    23.2. Socket options
    23.3. Read size
    23.4. Max xmit
    23.5. Log level
    23.6. Read raw
    23.7. Write raw
    23.8. Slow Clients
    23.9. Slow Logins
    23.10. Client tuning
    24. Portability
    24.1. HPUX
    24.2. SCO Unix
    24.3. DNIX
    24.4. RedHat Linux Rembrandt-II
    24.5. AIX
    25.1. Macintosh clients?
    25.2. OS2 Client
    25.3. Windows for Workgroups
    25.4. Windows '95/'98
    25.5. Windows 2000 Service Pack 2
    26.1. Access Samba source code via CVS
    26.2. Accessing the samba sources via rsync and ftp
    26.3. Building the Binaries
    26.4. Starting the smbd and nmbd
    27.1. Introduction
    27.2. General info
    27.3. Debug levels
    27.4. Internal errors
    27.5. Attaching to a running process
    27.6. Patches
    28.1. Introduction
    28.2. Assumptions
    28.3. Tests
    28.4. Still having troubles?

    6.1. Prerequisite Reading

    6.2. Background

    • domain logons for Windows NT 4.0 / 200x / XP Professional clients. +> Domain logons for Windows NT 4.0 / 200x / XP Professional clients.

    • placing Windows 9x / Me clients in user level security +> Placing Windows 9x / Me clients in user level security

    • retrieving a list of users and groups from a Samba PDC to +> Retrieving a list of users and groups from a Samba PDC to Windows 9x / Me / NT / 200x / XP Professional clients

    • roaming user profiles +> Roaming Profiles

    • Windows NT 4.0-style system policies +> Network/System Policies

    Roaming Profiles and System/Network policies are advanced network administration topics +that are covered separately in this document.

    The following functionalities are new to the Samba 3.0 release:

    6.3. Configuring the Samba Domain Controller

    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain

    6.4.1. Manual Creation of Machine Trust Accounts

    6.4.2. "On-the-Fly" Creation of Machine Trust Accounts

    6.4.3. Joining the Client to the Domain

    6.5. Common Problems and Errors

    I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your + can not log you on (C000019B), Please try again or consult your system administrator" when attempting to logon.

    This occurs when the domain SID stored in - private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. +> This occurs when the domain SID stored in the secrets.tdb database + is changed. The most common cause of a change in domain SID is when + the domain name and/or the server name (netbios name) is changed. + The only way to correct the problem is to restore the original domain + SID or remove the domain client from the domain and rejoin. The domain + SID may be reset using either the smbpasswd or rpcclient utilities.

  • 6.6. System Policies and Profiles

    Much of the information necessary to implement System Policies and -Roving User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft.

    Here are some additional details:

    • What about Windows NT Policy Editor? -

      To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. -

      The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. -

    • Can Win95 do Policies? -

      Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... -

      If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. -

    • How do I get 'User Manager' and 'Server Manager' -

      Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? -

      Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes -

      • Server Manager

      • User Manager for Domains

      • Event Viewer

      Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

      The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

    6.7. What other help can I get?6.6. What other help can I get?

    There are many sources of information available in the form @@ -1684,62 +1527,27 @@ CLASS="SECT1" >

    6.8. Domain Control for Windows 9x/ME6.7. Domain Control for Windows 9x/ME

    The following section contains much of the original -DOMAIN.txt file previously included with Samba. Much of -the material is based on what went into the book Special -Edition, Using Samba, by Richard Sharpe.

    A domain and a workgroup are exactly the same thing in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they -successfully authenticate against a domain logon server (NT server and -other systems based on NT server support this, as does at least Samba TNG now).

    The SMB client logging on to a domain has an expectation that every other server in the domain should accept the same authentication information. -Network browsing functionality of domains and workgroups is -identical and is explained in BROWSING.txt. It should be noted, that browsing -is totally orthogonal to logon support.

    Issues related to the single-logon network model are discussed in this section. Samba supports domain logons, network logon scripts, and user profiles for MS Windows for workgroups and MS Windows 9X/ME clients -which will be the focus of this section.

    When an SMB client in a domain wishes to logon it broadcast requests for a logon server. The first one to reply gets the job, and validates its @@ -1818,8 +1626,8 @@ CLASS="SECT2" >

    6.8.1. Configuration Instructions: Network Logons6.7.1. Configuration Instructions: Network Logons

    The main difference between a PDC and a Windows 9x logon @@ -1919,703 +1727,6 @@ for its domain.

    6.8.2. Configuration Instructions: Setting up Roaming User Profiles

    NOTE! Roaming profiles support is different -for Win9X and WinNT.

    Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features.

    Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory.

    WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT.

    6.8.2.1. Windows NT Configuration

    To support WinNT clients, in the [global] section of smb.conf set the -following (for example):

    logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

    The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable.

    [lkcl 26aug96 - we have discovered a problem where Windows clients can -maintain a connection to the [homes] share in between logins. The -[homes] share must NOT therefore be used in a profile path.]

    6.8.2.2. Windows 9X Configuration

    To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use/home" now works as well, and it, too, relies -on the "logon home" parameter.

    By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file:

    logon home = \\%L\%U\.profiles

    then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden).

    Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home".

    6.8.2.3. Win9X and WinNT Configuration

    You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example:

    logon home = \\%L\%U\.profiles
-logon path = \\%L\profiles\%U

    I have not checked what 'net use /home' does on NT when "logon home" is -set as above.

    6.8.2.4. Windows 9X Profile Setup

    When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.

    The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.

    1. On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

    2. On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. -

    Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me.

    You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.

    Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.

    Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.

    These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.

    If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.

    If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".

    1. instead of logging in under the [user, password, domain] dialog, - press escape. -

    2. run the regedit.exe program, and look in: -

      HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

      you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. -

      [Exit the registry editor]. -

    3. WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). -

      This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

    4. search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

    5. log off the windows 95 client. -

    6. check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

    If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports.

    If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace.

    6.8.2.5. Windows NT Workstation 4.0

    When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.

    [lkcl 10aug97 - i tried setting the path to -\\samba-server\homes\profile, and discovered that this fails because -a background process maintains the connection to the [homes] share -which does _not_ close down in between user logins. you have to -have \\samba-server\%L\profile, where user is the username created -from the [homes] share].

    There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter.

    The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension) -[lkcl 10aug97 - i found that the creation of the .PDS directory failed, -and had to create these manually for each user, with a shell script. -also, i presume, but have not tested, that the full profile path must -be browseable just as it is for w95, due to the manner in which they -attempt to create the full profile path: test existence of each path -component; create path component].

    In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.

    You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.

    [lkcl 10aug97 - i notice that NT Workstation tells me that it is -downloading a profile from a slow link. whether this is actually the -case, or whether there is some configuration issue, as yet unknown, -that makes NT Workstation _think_ that the link is a slow one is a -matter to be resolved].

    [lkcl 20aug97 - after samba digest correspondence, one user found, and -another confirmed, that profiles cannot be loaded from a samba server -unless "security = user" and "encrypt passwords = yes" (see the file -ENCRYPTION.txt) or "security = server" and "password server = ip.address. -of.yourNTserver" are used. Either of these options will allow the NT -workstation to access the samba server using LAN manager encrypted -passwords, without the user intervention normally required by NT -workstation for clear-text passwords].

    [lkcl 25aug97 - more comments received about NT profiles: the case of -the profile _matters_. the file _must_ be called NTuser.DAT or, for -a mandatory profile, NTuser.MAN].

    6.8.2.6. Windows NT Server

    There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.

    6.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0

    Potentially outdated or incorrect material follows
     

    I think this is all bogus, but have not deleted it. (Richard Sharpe)

    The default logon path is \\%N\%U. NT Workstation will attempt to create -a directory "\\samba-server\username.PDS" if you specify the logon path -as "\\samba-server\username" with the NT User Manager. Therefore, you -will need to specify (for example) "\\samba-server\username\profile". -NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which -is more likely to succeed.

    If you then want to share the same Start Menu / Desktop with W95, you will -need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97 -this has its drawbacks: i created a shortcut to telnet.exe, which attempts -to run from the c:\winnt\system32 directory. this directory is obviously -unlikely to exist on a Win95-only host].

    If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.

    [lkcl 25aug97 - there are some issues to resolve with downloading of -NT profiles, probably to do with time/date stamps. i have found that -NTuser.DAT is never updated on the workstation after the first time that -it is copied to the local workstation profile directory. this is in -contrast to w95, where it _does_ transfer / update profiles correctly].

    6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

    Possibly Outdated Material
     

    This appendix was originally authored by John H Terpstra of - the Samba Team and is included here for posterity. -

    NOTE : -The term "Domain Controller" and those related to it refer to one specific -method of authentication that can underly an SMB domain. Domain Controllers -prior to Windows NT Server 3.1 were sold by various companies and based on -private extensions to the LAN Manager 2.1 protocol. Windows NT introduced -Microsoft-specific ways of distributing the user authentication database. -See DOMAIN.txt for examples of how Samba can participate in or create -SMB domains based on shared authentication database schemes other than the -Windows NT SAM.

    Windows NT Server can be installed as either a plain file and print server -(WORKGROUP workstation or server) or as a server that participates in Domain -Control (DOMAIN member, Primary Domain controller or Backup Domain controller). -The same is true for OS/2 Warp Server, Digital Pathworks and other similar -products, all of which can participate in Domain Control along with Windows NT.

    To many people these terms can be confusing, so let's try to clear the air.

    Every Windows NT system (workstation or server) has a registry database. -The registry contains entries that describe the initialization information -for all services (the equivalent of Unix Daemons) that run within the Windows -NT environment. The registry also contains entries that tell application -software where to find dynamically loadable libraries that they depend upon. -In fact, the registry contains entries that describes everything that anything -may need to know to interact with the rest of the system.

    The registry files can be located on any Windows NT machine by opening a -command prompt and typing:

    C:\WINNT\> dir %SystemRoot%\System32\config

    The environment variable %SystemRoot% value can be obtained by typing:

    C:\WINNT>echo %SystemRoot%

    The active parts of the registry that you may want to be familiar with are -the files called: default, system, software, sam and security.

    In a domain environment, Microsoft Windows NT domain controllers participate -in replication of the SAM and SECURITY files so that all controllers within -the domain have an exactly identical copy of each.

    The Microsoft Windows NT system is structured within a security model that -says that all applications and services must authenticate themselves before -they can obtain permission from the security manager to do what they set out -to do.

    The Windows NT User database also resides within the registry. This part of -the registry contains the user's security identifier, home directory, group -memberships, desktop profile, and so on.

    Every Windows NT system (workstation as well as server) will have its own -registry. Windows NT Servers that participate in Domain Security control -have a database that they share in common - thus they do NOT own an -independent full registry database of their own, as do Workstations and -plain Servers.

    The User database is called the SAM (Security Access Manager) database and -is used for all user authentication as well as for authentication of inter- -process authentication (i.e. to ensure that the service action a user has -requested is permitted within the limits of that user's privileges).

    The Samba team have produced a utility that can dump the Windows NT SAM into -smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and -/pub/samba/pwdump on your nearest Samba mirror for the utility. This -facility is useful but cannot be easily used to implement SAM replication -to Samba systems.

    Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers -can participate in a Domain security system that is controlled by Windows NT -servers that have been correctly configured. Almost every domain will have -ONE Primary Domain Controller (PDC). It is desirable that each domain will -have at least one Backup Domain Controller (BDC).

    The PDC and BDCs then participate in replication of the SAM database so that -each Domain Controlling participant will have an up to date SAM component -within its registry.

    Samba as Stand-Alone server (User and Share security level)Samba as Stand-Alone ServerHow to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain Control
    PrevChapter 22. Securing SambaChapter 21. Securing Samba

    22.1. Introduction21.1. Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an @@ -93,8 +93,8 @@ CLASS="SECT1" >

    22.2. Using host based protection21.2. Using host based protection

    In many installations of Samba the greatest threat comes for outside @@ -125,8 +125,8 @@ CLASS="SECT1" >

    22.3. Using interface protection21.3. Using interface protection

    By default Samba will accept connections on any network interface that @@ -161,8 +161,8 @@ CLASS="SECT1" >

    22.4. Using a firewall21.4. Using a firewall

    Many people use a firewall to deny access to services that they don't @@ -191,8 +191,8 @@ CLASS="SECT1" >

    22.5. Using a IPC$ share deny21.5. Using a IPC$ share deny

    If the above methods are not suitable, then you could also place a @@ -230,8 +230,8 @@ CLASS="SECT1" >

    22.6. Upgrading Samba21.6. Upgrading Samba

    Please check regularly on http://www.samba.org/ for updates and @@ -256,7 +256,7 @@ WIDTH="33%" ALIGN="left" VALIGN="top" >PrevCreating Group Prolicy FilesStackable VFS modulesSamba as Stand-Alone server (User and Share security level)Samba as Stand-Alone ServerChapter 5. Samba as Stand-Alone server (User and Share security level)Chapter 5. Samba as Stand-Alone Server

    In this section the function and purpose of Samba's security +modes are described.

    5.1. User and Share security level

    A SMB server tells the client at startup what "security level" it is running. There are two options "share level" and "user level". Which @@ -85,6 +102,14 @@ strange, but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed.

    5.1.1. User Level Security

    I'll describe user level security first, as its simpler. In user level security the client will send a "session setup" command directly after @@ -117,6 +142,15 @@ requests. When the server responds it gives the client a "uid" to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this)

    5.1.2. Share Level Security

    Ok, now for share level security. In share level security the client authenticates itself separately for each share. It will send a @@ -139,6 +173,15 @@ home directories) and any users listed in the "user =" smb.conf line. The password is then checked in turn against these "possible usernames". If a match is found then the client is authenticated as that user.

    5.1.3. Server Level Security

    Finally "server level" security. In server level security the samba server reports to the client that it is in user level security. The @@ -167,6 +210,254 @@ requests to another "user mode" server. This requires an additional parameter "password server =" that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support.

    5.1.3.1. Configuring Samba for Seemless Windows Network Integration

    MS Windows clients may use encrypted passwords as part of a challenege/response +authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple +password based authentication. It should be realized that with the SMB protocol +the password is passed over the network either in plain text or encrypted, but +not both in the same authentication requests.

    When encrypted passwords are used a password that has been entered by the user +is encrypted in two ways:

    • An MD4 hash of the UNICODE of the password + string. This is known as the NT hash. +

    • The password is converted to upper case, + and then padded or trucated to 14 bytes. This string is + then appended with 5 bytes of NULL characters and split to + form two 56 bit DES keys to encrypt a "magic" 8 byte value. + The resulting 16 bytes for the LanMan hash. +

    MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 +pre-service pack 3 will use either mode of password authentication. All +versions of MS Windows that follow these versions no longer support plain +text passwords by default.

    MS Windows clients have a habit of dropping network mappings that have been idle +for 10 minutes or longer. When the user attempts to use the mapped drive +connection that has been dropped, the client re-establishes the connection using +a cached copy of the password.

    When Microsoft changed the default password mode, support was dropped for caching +of the plain text password. This means that when the registry parameter is changed +to re-enable use of plain text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate it will fail if the remote +authentication server does not support encrypted passwords. This means that it +is definitely not a good idea to re-enable plain text password support in such clients.

    The following parameters can be used to work around the issue of Windows 9x client +upper casing usernames and password before transmitting them to the SMB server +when using clear text authentication.

    	passsword level = integer
+	username level = integer

    By default Samba will lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower case character, the username level parameter +is rarely needed.

    However, passwords on UNIX systems often make use of mixed case characters. +This means that in order for a user on a Windows 9x client to connect to a Samba +server using clear text authentication, the password level +must be set to the maximum number of upper case letter which could +appear is a password. Note that is the server OS uses the traditional DES version +of crypt(), then a password level of 8 will result in case +insensitive passwords as seen from Windows users. This will also result in longer +login times as Samba hash to compute the permutations of the password string and +try them one by one until a match is located (or all combinations fail).

    The best option to adopt is to enable support for encrypted passwords +where ever Samba is used. There are three configuration possibilities +for support of encrypted passwords:

    5.1.3.2. Use MS Windows NT as an authentication server

    This method involves the additions of the following parameters in the smb.conf file:

    	encrypt passwords = Yes
+	security = server
+	password server = "NetBIOS_name_of_PDC"

    There are two ways of identifying whether or not a username and +password pair was valid or not. One uses the reply information provided +as part of the authentication messaging process, the other uses +just and error code.

    The down-side of this mode of configuration is the fact that +for security reasons Samba will send the password server a bogus +username and a bogus password and if the remote server fails to +reject the username and password pair then an alternative mode +of identification of validation is used. Where a site uses password +lock out after a certain number of failed authentication attempts +this will result in user lockouts.

    Use of this mode of authentication does require there to be +a standard Unix account for the user, this account can be blocked +to prevent logons by other than MS Windows clients.

    5.1.4. Domain Level Security

    When samba is operating in security = domain mode this means that +the Samba server has a domain security trust account (a machine account) and will cause +all authentication requests to be passed through to the domain controllers.

    5.1.4.1. Samba as a member of an MS Windows NT security domain

    This method involves additon of the following paramters in the smb.conf file:

    	encrypt passwords = Yes
+	security = domain
+	workgroup = "name of NT domain"
+	password server = *

    The use of the "*" argument to "password server" will cause samba to locate the +domain controller in a way analogous to the way this is done within MS Windows NT. +This is the default behaviour.

    In order for this method to work the Samba server needs to join the +MS Windows NT security domain. This is done as follows:

    • On the MS Windows NT domain controller using + the Server Manager add a machine account for the Samba server. +

    • Next, on the Linux system execute: + smbpasswd -r PDC_NAME -j DOMAIN_NAME +

    Use of this mode of authentication does require there to be a standard Unix account +for the user in order to assign a uid once the account has been authenticated by +the remote Windows DC. This account can be blocked to prevent logons by other than +MS Windows clients by things such as setting an invalid shell in the +/etc/passwd entry.

    An alternative to assigning UIDs to Windows users on a Samba member server is +presented in the Winbind Overview chapter +in this HOWTO collection.

    5.1.5. ADS Level Security

    For information about the configuration option please refer to the entire section entitled +Samba as an ADS Domain Member.

    PrevNextChapter 20. Samba performance issuesChapter 23. Samba performance issues

    20.1. Comparisons23.1. Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are @@ -111,8 +111,8 @@ CLASS="SECT1" >

    20.2. Socket options23.2. Socket options

    There are a number of socket options that can greatly affect the @@ -139,8 +139,8 @@ CLASS="SECT1" >

    20.3. Read size23.3. Read size

    The option "read size" affects the overlap of disk reads/writes with @@ -165,8 +165,8 @@ CLASS="SECT1" >

    20.4. Max xmit23.4. Max xmit

    At startup the client and server negotiate a "maximum transmit" size, @@ -188,8 +188,8 @@ CLASS="SECT1" >

    20.5. Log level23.5. Log level

    If you set the log level (also known as "debug level") higher than 2 @@ -202,8 +202,8 @@ CLASS="SECT1" >

    20.6. Read raw23.6. Read raw

    The "read raw" operation is designed to be an optimised, low-latency @@ -224,8 +224,8 @@ CLASS="SECT1" >

    20.7. Write raw23.7. Write raw

    The "write raw" operation is designed to be an optimised, low-latency @@ -241,8 +241,8 @@ CLASS="SECT1" >

    20.8. Slow Clients23.8. Slow Clients

    One person has reported that setting the protocol to COREPLUS rather @@ -258,8 +258,8 @@ CLASS="SECT1" >

    20.9. Slow Logins23.9. Slow Logins

    Slow logins are almost always due to the password checking time. Using @@ -271,8 +271,8 @@ CLASS="SECT1" >

    20.10. Client tuning23.10. Client tuning

    Often a speed problem can be traced to the client. The client (for @@ -389,7 +389,7 @@ WIDTH="33%" ALIGN="left" VALIGN="top" >PrevNextGroup mapping HOWTOAppendixesUpCreating Group Prolicy FilesPortability

    Introduction

    4.1. Stand Alone Server
    4.2. Domain Member Server
    4.3. Domain Controller
    4.3.1. Domain Controller Types
    5. Samba as Stand-Alone server (User and Share security level)Samba as Stand-Alone Server
    5.1. User and Share security level
    5.1.1. User Level Security
    5.1.2. Share Level Security
    5.1.3. Server Level Security
    5.1.4. Domain Level Security
    5.1.5. ADS Level Security
    6. Samba as an NT4 or Win2k Primary Domain Controller
    6.1. Prerequisite Reading
    6.2. Background
    6.3. Configuring the Samba Domain Controller
    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
    6.4.1. Manual Creation of Machine Trust Accounts
    6.4.2. "On-the-Fly" Creation of Machine Trust Accounts
    6.4.3. Joining the Client to the Domain
    6.5. Common Problems and Errors
    6.6. System Policies and Profiles
    6.7. What other help can I get?
    6.8. 6.7. Domain Control for Windows 9x/ME
    6.8.1. 6.7.1. Configuration Instructions: Network Logons
    6.8.2. Configuration Instructions: Setting up Roaming User Profiles
    6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
    • 7. How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain Control
    7.1. Prerequisite Reading
    7.2. Background
    7.3. What qualifies a Domain Controller on the network?
    7.3.1. How does a Workstation find its domain controller?
    7.3.2. When is the PDC needed?
    7.4. Can Samba be a Backup Domain Controller to an NT PDC?
    7.5. How do I set up a Samba BDC?
    7.5.1. How do I replicate the smbpasswd file?
    7.5.2. Can I do this all with LDAP?
    8.1. Installing the required packages for DebianSetup your smb.conf
    8.2. Installing the required packages for RedHatSetup your /etc/krb5.conf
    8.3. Compile Samba
    8.4. Setup your /etc/krb5.conf
    8.5. Create the computer account
    8.5.1. 8.3.1. Possible errors
    8.6. 8.4. Test your server setup
    8.7. 8.5. Testing with smbclient
    8.8. 8.6. Notes
    9.1. Joining an NT Domain with Samba 3.0
    9.2. Samba and Windows 2000 Domains
    9.3. Why is this better than security = server?
    PrevNext

    11.1. Viewing and changing UNIX permissions using the NT security dialogs

    New in the Samba 2.0.4 release is the ability for Windows - NT clients to use their native security settings dialog box to - view and modify the underlying UNIX permissions.

    Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and @@ -100,11 +98,11 @@ CLASS="SECT1" >

    11.2. How to view file security on a Samba share

    From an NT 4.0 client, single-click with the right +>From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click on the Properties entry at the bottom of - the menu. This brings up the normal file properties dialog - box, but with Samba 2.0.4 this will have a new tab along the top - marked Security. Click on this tab and you +> and you will see three buttons,

    11.3. Viewing file ownership

    There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected - to a Samba 2.0.4 server as root to change the ownership of + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the

    11.4. Viewing file or directory permissions

    11.4.1. File Permissions

    11.4.2. Directory Permissions

    11.5. Modifying file or directory permissions

    "Add" - button will not return a list of users in Samba 2.0.4 (it will give + button will not return a list of users in Samba (it will give an error message of "The remote procedure call failed @@ -500,13 +497,14 @@ CLASS="SECT1" >

    11.6. Interaction with the standard Samba create mask parameters

    Note that with Samba 2.0.5 there are four new parameters - to control this interaction. These are :

    There are four parameters + to control interaction with the standard Samba create mask parameters. + These are :

    create mask parameter to provide compatibility with Samba 2.0.4 - where this permission change facility was introduced. To allow a user to - modify all the user/group/world permissions on a file, set this parameter +> parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777.

    Next Samba checks the changed permissions for a file against @@ -602,8 +599,7 @@ CLASS="PARAMETER" >force create mode parameter to provide compatibility - with Samba 2.0.4 where the permission change facility was introduced. +> parameter. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000.

    force directory mode parameter to provide - compatibility with Samba 2.0.4 where the permission change facility - was introduced.

    parameter.

    In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users @@ -691,37 +685,13 @@ CLASS="PARAMETER" CLASS="PARAMETER" >force directory security mode = 0

    As described, in Samba 2.0.4 the parameters :

    create mask

    force create mode

    directory mask

    force directory mode

    were used instead of the parameters discussed here.

    11.7. Interaction with the standard Samba file attribute mapping

    PrevNextIntegrating MS Windows networks with SambaSystem PoliciesConfiguring PAM for distributed but centrally -managed authenticationGroup mapping HOWTO
    PrevNextChapter 18. Stackable VFS modulesChapter 20. Stackable VFS modules

    18.1. Introduction and configuration20.1. Introduction and configuration

    Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. @@ -121,16 +121,16 @@ CLASS="SECT1" >

    18.2. Included modules20.2. Included modules

    18.2.1. audit20.2.1. audit

    A simple module to audit file access to the syslog @@ -167,8 +167,8 @@ CLASS="SECT2" >

    18.2.2. recycle20.2.2. recycle

    A recycle-bin like modules. When used any unlink call @@ -238,8 +238,8 @@ CLASS="SECT2" >

    18.2.3. netatalk20.2.3. netatalk

    A netatalk module, that will ease co-existence of samba and @@ -271,8 +271,8 @@ CLASS="SECT1" >

    18.3. VFS modules available elsewhere20.3. VFS modules available elsewhere

    This section contains a listing of various other VFS modules that @@ -287,8 +287,8 @@ CLASS="SECT2" >

    18.3.1. DatabaseFS20.3.1. DatabaseFS

    URL:

    18.3.2. vscan20.3.2. vscan

    URL: PrevNextImproved browsing in sambaHosting a Microsoft Distributed File System tree on SambaGroup mapping HOWTOSecuring Samba

    Next

    16.1. Abstract

    16.2. Introduction

    16.3. What Winbind Provides

    16.3.1. Target Uses

    16.4. How Winbind Works

    16.4.1. Microsoft Remote Procedure Calls

    16.4.2. Microsoft Active Directory Services

    16.4.3. Name Service Switch

    16.4.4. Pluggable Authentication Modules

    16.4.5. User and Group ID Allocation

    16.4.6. Result Caching

    16.5. Installation and Configuration

    16.5.1. Introduction

    16.5.2. Requirements

    16.5.3. Testing Things Out

    16.5.3.1. Configure and compile SAMBA

    16.5.3.2. Configure nsswitch.conf

    16.5.3.3. Configure smb.conf

    16.5.3.4. Join the SAMBA server to the PDC domain

    16.5.3.5. Start up the winbindd daemon and test it!

    16.5.3.6. Fix the init.d startup scripts

    16.5.3.6.1. Linux

    16.5.3.6.2. Solaris

    16.5.3.6.3. Restarting

    16.5.3.7. Configure Winbind and PAM

    16.5.3.7.1. Linux/FreeBSD-specific PAM configuration

    16.5.3.7.2. Solaris-specific configuration

    16.6. Limitations

    16.7. Conclusion

    NextImproved browsing in sambaIntegrating MS Windows networks with Samba

    Date: Wed, 2 Apr 2003 18:32:31 +0000 Subject: Commit some more fixes for Coolo ... (This used to be commit e1a159c55fdeaa1620a3147105be4efd205560ba) --- source3/Makefile.in | 4 +-- source3/include/libsmbclient.h | 10 +++---- source3/libsmb/clirap.c | 2 +- source3/libsmb/libsmbclient.c | 67 +++++++++++++++--------------------------- 4 files changed, 31 insertions(+), 52 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index fbe8f1c165..e38e54bc83 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1087,7 +1087,7 @@ bin/t_strcmp@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_strcmp.o bin/t_stringoverflow@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_stringoverflow.o $(CC) $(FLAGS) -o $@ torture/t_stringoverflow.o -L./bin -lbigballofmud -install: installbin installman installscripts installdat installswat installmodules +install: installbin installman installscripts installdat installswat installmodules installclientlib # DESTDIR is used here to prevent packagers wasting their time # duplicating the Makefile. Remove it and you will have the privelege @@ -1127,7 +1127,7 @@ installswat: installdirs installclientlib: bin/libsmbclient.@SHLIBEXT@ -$(INSTALLCLIENTCMD_SH) bin/libsmbclient.@SHLIBEXT@ $(DESTDIR)${prefix}/lib -$(INSTALLCLIENTCMD_A) bin/libsmbclient.a $(DESTDIR)${prefix}/lib - -$(INSTALLCMD) -d $(DESTDIR)${prefix}/include + @$(SHELL) $(srcdir)/script/installdirs.sh $(DESTDIR)${prefix}/include -$(INSTALLCMD) include/libsmbclient.h $(DESTDIR)${prefix}/include # Python extensions diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h index a9f83cfbd3..f5d653f697 100644 --- a/source3/include/libsmbclient.h +++ b/source3/include/libsmbclient.h @@ -257,10 +257,9 @@ typedef int (*smbc_remove_unused_server_fn)(SMBCCTX * c, SMBCSRV *srv); * */ typedef int (*smbc_add_cached_srv_fn) (SMBCCTX * c, SMBCSRV *srv, - const char * server, const char * share, + const char * server, const char * share, const char * workgroup, const char * username); - /**@ingroup callback * Look up a server in the cache system * @@ -277,10 +276,9 @@ typedef int (*smbc_add_cached_srv_fn) (SMBCCTX * c, SMBCSRV *srv, * @return pointer to SMBCSRV on success. NULL on failure. * */ -typedef SMBCSRV * (*smbc_get_cached_srv_fn) (SMBCCTX * c, const char * server, - const char * share, const char * workgroup, - const char * username); - +typedef SMBCSRV * (*smbc_get_cached_srv_fn) (SMBCCTX * c, const char * server, + const char * share, const char * workgroup, + const char * username); /**@ingroup callback * Check if a server is still good diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c index 224c37046c..f05a65762b 100644 --- a/source3/libsmb/clirap.c +++ b/source3/libsmb/clirap.c @@ -233,7 +233,7 @@ BOOL cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype, SIVAL(p,0,stype); p += 4; - p += push_pstring_base(p, workgroup, param); + push_ascii(p, workgroup, sizeof(pstring)-PTR_DIFF(p,param)-1, STR_TERMINATE|STR_UPPER); if (cli_api(cli, param, PTR_DIFF(p,param), 8, /* params, length, max */ diff --git a/source3/libsmb/libsmbclient.c b/source3/libsmb/libsmbclient.c index 1da55ed4bd..06885c55e0 100644 --- a/source3/libsmb/libsmbclient.c +++ b/source3/libsmb/libsmbclient.c @@ -351,8 +351,8 @@ int smbc_remove_unused_server(SMBCCTX * context, SMBCSRV * srv) SMBCSRV *smbc_server(SMBCCTX *context, const char *server, const char *share, - char *workgroup, char *username, - char *password) + fstring workgroup, fstring username, + fstring password) { SMBCSRV *srv=NULL; int auth_called = 0; @@ -813,27 +813,6 @@ static int smbc_close_ctx(SMBCCTX *context, SMBCFILE *file) } - if (!file->file) { - - return context->closedir(context, file); - - } - - if (!cli_close(&file->srv->cli, file->cli_fd)) { - DEBUG(3, ("cli_close failed on %s. purging server.\n", - file->fname)); - /* Deallocate slot and remove the server - * from the server cache if unused */ - errno = smbc_errno(context, &file->srv->cli); - srv = file->srv; - DLIST_REMOVE(context->internal->_files, file); - SAFE_FREE(file->fname); - SAFE_FREE(file); - context->callbacks.remove_unused_server_fn(context, srv); - - return -1; - } - DLIST_REMOVE(context->internal->_files, file); SAFE_FREE(file->fname); SAFE_FREE(file); @@ -1087,12 +1066,16 @@ static off_t smbc_lseek_ctx(SMBCCTX *context, SMBCFILE *file, off_t offset, int case SEEK_END: if (!cli_qfileinfo(&file->srv->cli, file->cli_fd, NULL, &size, NULL, NULL, - NULL, NULL, NULL) && - !cli_getattrE(&file->srv->cli, file->cli_fd, NULL, &size, NULL, NULL, - NULL)) { - + NULL, NULL, NULL)) + { + SMB_BIG_UINT b_size = size; + if (!cli_getattrE(&file->srv->cli, file->cli_fd, NULL, &b_size, NULL, NULL, + NULL)) + { errno = EINVAL; return -1; + } else + size = b_size; } file->offset = size + offset; break; @@ -1290,12 +1273,15 @@ static int smbc_fstat_ctx(SMBCCTX *context, SMBCFILE *file, struct stat *st) } if (!cli_qfileinfo(&file->srv->cli, file->cli_fd, - &mode, &size, &c_time, &a_time, &m_time, NULL, &ino) && - !cli_getattrE(&file->srv->cli, file->cli_fd, - &mode, &size, &c_time, &a_time, &m_time)) { + &mode, &size, &c_time, &a_time, &m_time, NULL, &ino)) { + SMB_BIG_UINT b_size = size; + if (!cli_getattrE(&file->srv->cli, file->cli_fd, + &mode, &b_size, &c_time, &a_time, &m_time)) { errno = EINVAL; return -1; + } else + size = b_size; } @@ -1524,8 +1510,7 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) if (!context || !context->internal || !context->internal->_initialized) { - - DEBUG(4, ("no valid context\n")); + DEBUG(4, ("no valid context\n")); errno = EINVAL; return NULL; @@ -1535,14 +1520,12 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) DEBUG(4, ("no valid fname\n")); errno = EINVAL; return NULL; - } if (smbc_parse_path(context, fname, server, share, path, user, password)) { - DEBUG(4, ("no valid path\n")); + DEBUG(4, ("no valid path\n")); errno = EINVAL; return NULL; - } DEBUG(4, ("parsed path: fname='%s' server='%s' share='%s' path='%s'\n", fname, server, share, path)); @@ -1571,9 +1554,7 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) if (server[0] == (char)0) { struct in_addr server_ip; - - DEBUG(4, ("empty server\n")); - + DEBUG(4, ("empty server\n")); if (share[0] != (char)0 || path[0] != (char)0) { DEBUG(4,("share %d path %d\n", share[0], path[0])); errno = EINVAL; @@ -1582,7 +1563,6 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) SAFE_FREE(dir); } return NULL; - } /* We have server and share and path empty ... so list the workgroups */ @@ -1680,7 +1660,7 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname) srv = smbc_server(context, buserver, "IPC$", workgroup, user, password); if (!srv) { - + DEBUG(0, ("got no contact to IPC$\n")); if (dir) { SAFE_FREE(dir->fname); SAFE_FREE(dir); @@ -2760,8 +2740,8 @@ SMBCCTX * smbc_init_context(SMBCCTX * context) slprintf(context->netbios_name, 16, "smbc%s%d", context->user, pid); } } - DEBUG(1,("Using netbios name %s.\n", context->netbios_name)); - + + DEBUG(1, ("Using netbios name %s.\n", context->netbios_name)); if (!context->workgroup) { if (lp_workgroup()) { @@ -2772,7 +2752,8 @@ SMBCCTX * smbc_init_context(SMBCCTX * context) context->workgroup = strdup("samba"); } } - DEBUG(1,("Using workgroup %s.\n", context->workgroup)); + + DEBUG(1, ("Using workgroup %s.\n", context->workgroup)); /* shortest timeout is 1 second */ if (context->timeout > 0 && context->timeout < 1000) -- cgit From 0ae1b49b21204e05eb265f30a52e1c15d03bdcb7 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 18:45:47 +0000 Subject: Only use cflags and libs from krb5 when they appear to be working - fixes build on BSD machines that have a krb5-config that returns @INCLUDE_des@ for --cflags (This used to be commit e05d78699c6cf6a8340f85e4f55c871fbc100ebf) --- source3/configure.in | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source3/configure.in b/source3/configure.in index 266dffa38b..9ca12866a2 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -2067,6 +2067,7 @@ fi AC_MSG_RESULT($with_ads_support) FOUND_KRB5=no +KRB5_LIBS="" if test x"$with_ads_support" = x"yes"; then ac_save_CFLAGS="$CFLAGS" @@ -2230,15 +2231,15 @@ fi ######################################################## # now see if we can find the krb5 libs in standard paths # or as specified above - AC_CHECK_LIB(krb5, krb5_mk_req_extended, [LIBS="$LIBS -lkrb5"; + AC_CHECK_LIB(krb5, krb5_mk_req_extended, [KRB5_LIBS="$LIBS -lkrb5"; + KRB5_CFLAGS="$CFLAGS"; AC_DEFINE(HAVE_KRB5,1,[Whether KRB5 is available])]) ######################################################## # now see if we can find the gssapi libs in standard paths - AC_CHECK_LIB(gssapi_krb5, gss_display_status, [LIBS="$LIBS -lgssapi_krb5"; + AC_CHECK_LIB(gssapi_krb5, gss_display_status, [KRB5_LIBS="$KRB5_LIBS -lgssapi_krb5"; AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) -KRB5_LIBS="$LIBS"; KRB5_CFLAGS="$CFLAGS" LIBS="$ac_save_LIBS"; CFLAGS="$ac_save_CFLAGS" fi -- cgit From 48dff2870c48ee61c77b04c6aa83cf1bd80eb0ce Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 18:49:36 +0000 Subject: There's no need to use LDAP_CFLAGS, just use CFLAGS (This used to be commit 5d2fd222a9e4cccd232e492d1aea1dc7a64a1400) --- source3/configure.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source3/configure.in b/source3/configure.in index 9ca12866a2..5d880caef3 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -2260,8 +2260,8 @@ AC_ARG_WITH(ldap, AC_MSG_RESULT($with_ldap_support) if test x"$with_ldap_support" = x"yes"; then -ac_save_CFLAGS="$CFLAGS"; ac_save_LIBS="$LIBS" -CFLAGS=""; LIBS="" +ac_save_LIBS="$LIBS" +LIBS="" ################################################################## # we might need the lber lib on some systems. To avoid link errors @@ -2286,8 +2286,8 @@ CFLAGS=""; LIBS="" AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $pam_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) fi -LDAP_LIBS="$LIBS";LDAP_CFLAGS="$CFLAGS" -LIBS="$ac_save_LIBS"; CFLAGS="$ac_save_CFLAGS" +LDAP_LIBS="$LIBS"; +LIBS="$ac_save_LIBS"; fi if test x"$with_ads_support" = x"yes"; then -- cgit From e9a20f741965e9fff1645045cc385ddc68fcbd39 Mon Sep 17 00:00:00 2001 From: Richard Sharpe Date: Wed, 2 Apr 2003 20:17:28 +0000 Subject: More of coolo's changes for UTF-8 and some minor fixes of mine. (This used to be commit 21a99fdec321c44e31b69589248ff8d1cb927577) --- source3/libsmb/libsmbclient.c | 54 +++++++++++++++++++++++++++++-------------- 1 file changed, 37 insertions(+), 17 deletions(-) diff --git a/source3/libsmb/libsmbclient.c b/source3/libsmb/libsmbclient.c index 06885c55e0..41a6755953 100644 --- a/source3/libsmb/libsmbclient.c +++ b/source3/libsmb/libsmbclient.c @@ -65,7 +65,7 @@ hex2int( unsigned int _char ) } static void -decode_urlpart(char *segment) +decode_urlpart(char *segment, size_t sizeof_segment) { int old_length = strlen(segment); int new_length = 0; @@ -121,9 +121,14 @@ decode_urlpart(char *segment) } new_segment [ new_length ] = 0; + free(new_usegment); + + /* realloc it with unix charset */ + pull_utf8_allocate((void**)&new_usegment, new_segment); + /* this assumes (very safely) that removing %aa sequences only shortens the string */ - strncpy(segment, new_segment, old_length); + strncpy(segment, new_usegment, sizeof_segment); free(new_usegment); } @@ -243,15 +248,15 @@ smbc_parse_path(SMBCCTX *context, const char *fname, char *server, char *share, } pstrcpy(path, p); - + all_string_sub(path, "/", "\\", 0); decoding: - decode_urlpart(path); - decode_urlpart(server); - decode_urlpart(share); - decode_urlpart(user); - decode_urlpart(password); + decode_urlpart(path, sizeof(pstring)); + decode_urlpart(server, sizeof(fstring)); + decode_urlpart(share, sizeof(fstring)); + decode_urlpart(user, sizeof(fstring)); + decode_urlpart(password, sizeof(fstring)); return 0; } @@ -1334,6 +1339,13 @@ static int add_dirent(SMBCFILE *dir, const char *name, const char *comment, uint { struct smbc_dirent *dirent; int size; + char *u_name = NULL, *u_comment = NULL; + size_t u_name_len = 0, u_comment_len = 0; + + if (name) + u_name_len = push_utf8_allocate(&u_name, name); + if (comment) + u_comment_len = push_utf8_allocate(&u_comment, comment); /* * Allocate space for the dirent, which must be increased by the @@ -1341,8 +1353,7 @@ static int add_dirent(SMBCFILE *dir, const char *name, const char *comment, uint * The null on the name is already accounted for. */ - size = sizeof(struct smbc_dirent) + (name?strlen(name):0) + - (comment?strlen(comment):0) + 1; + size = sizeof(struct smbc_dirent) + u_name_len + u_comment_len + 1; dirent = malloc(size); @@ -1391,14 +1402,17 @@ static int add_dirent(SMBCFILE *dir, const char *name, const char *comment, uint dir->dir_end->dirent = dirent; dirent->smbc_type = type; - dirent->namelen = (name?strlen(name):0); - dirent->commentlen = (comment?strlen(comment):0); + dirent->namelen = u_name_len; + dirent->commentlen = u_comment_len; dirent->dirlen = size; - strncpy(dirent->name, (name?name:""), dirent->namelen + 1); + strncpy(dirent->name, (u_name?u_name:""), dirent->namelen + 1); dirent->comment = (char *)(&dirent->name + dirent->namelen + 1); - strncpy(dirent->comment, (comment?comment:""), dirent->commentlen + 1); + strncpy(dirent->comment, (u_comment?u_comment:""), dirent->commentlen + 1); + + SAFE_FREE(u_comment); + SAFE_FREE(u_name); return 0; @@ -2158,6 +2172,7 @@ static int smbc_rmdir_ctx(SMBCCTX *context, const char *fname) static off_t smbc_telldir_ctx(SMBCCTX *context, SMBCFILE *dir) { + off_t ret_val; /* Squash warnings about cast */ if (!context || !context->internal || !context->internal->_initialized) { @@ -2181,7 +2196,11 @@ static off_t smbc_telldir_ctx(SMBCCTX *context, SMBCFILE *dir) } - return (off_t) dir->dir_next; + /* + * We return the pointer here as the offset + */ + ret_val = (int)dir->dir_next; + return ret_val; } @@ -2221,8 +2240,9 @@ struct smbc_dir_list *smbc_check_dir_ent(struct smbc_dir_list *list, static int smbc_lseekdir_ctx(SMBCCTX *context, SMBCFILE *dir, off_t offset) { - struct smbc_dirent *dirent = (struct smbc_dirent *)offset; - struct smbc_dir_list *list_ent = NULL; + long int l_offset = offset; /* Handle problems of size */ + struct smbc_dirent *dirent = (struct smbc_dirent *)l_offset; + struct smbc_dir_list *list_ent = (struct smbc_dir_list *)NULL; if (!context || !context->internal || !context->internal->_initialized) { -- cgit From ab0bd4b63c2d08d336fb087705ec258d3ee04abc Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 21:48:33 +0000 Subject: winbindd should depend on IDMAP_OBJ too, not just link with it (This used to be commit 3e2b73fcc1b1a202df27a653c48fc43c2fc28bbb) --- source3/Makefile.in | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index e38e54bc83..8ac2a053fc 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -11,7 +11,7 @@ prefix=@prefix@ exec_prefix=@exec_prefix@ mandir=@mandir@ -LIBS=@LIBS@ +LIBS=@LIBS@ CC=@CC@ SHLD=@SHLD@ CFLAGS=@CFLAGS@ @@ -596,7 +596,7 @@ WINBINDD_OBJ = \ $(WINBINDD_OBJ1) $(PASSDB_GET_SET_OBJ) \ $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) \ - $(PROFILE_OBJ) $(UNIGRP_OBJ) \ + $(PROFILE_OBJ) $(UNIGRP_OBJ) $(IDMAP_OBJ) \ $(SECRETS_OBJ) $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) WBINFO_OBJ = nsswitch/wbinfo.o libsmb/smbencrypt.o libsmb/smbdes.o $(POPT_LIB_OBJ) @@ -948,7 +948,7 @@ nsswitch/libnss_wins.@SHLIBEXT@: $(NSS_OBJ) bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(LINK) -o $@ $(WINBINDD_OBJ) $(IDMAP_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) nsswitch/libns_winbind.@SHLIBEXT@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" -- cgit From 28ff00ab40089882957d230161c4e9ededf0965d Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 3 Apr 2003 01:51:11 +0000 Subject: Fixup swat warning. Fix winbindd dual mode in the same was as in APP_HEAD. "Ken Cross" noticed the problem. Jeremy. (This used to be commit 214b217b276f43edfddd1664afaae0fa6b2c319f) --- source3/nsswitch/winbindd_dual.c | 6 ++++++ source3/web/swat.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/source3/nsswitch/winbindd_dual.c b/source3/nsswitch/winbindd_dual.c index 207757bcea..3597171005 100644 --- a/source3/nsswitch/winbindd_dual.c +++ b/source3/nsswitch/winbindd_dual.c @@ -159,6 +159,12 @@ void do_dual_daemon(void) return; } close(fdpair[1]); + + /* tdb needs special fork handling */ + if (tdb_reopen_all() == -1) { + DEBUG(0,("tdb_reopen_all failed.\n")); + _exit(0); + } if (!winbind_setup_common()) _exit(0); diff --git a/source3/web/swat.c b/source3/web/swat.c index 9a133e1330..fa319bb3ae 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -1262,7 +1262,7 @@ static void printers_page(void) int main(int argc, char *argv[]) { int opt; - char *page; + const char *page; poptContext pc; struct poptOption long_options[] = { POPT_AUTOHELP -- cgit From 77dc0bc6bfdd2323cea3b7368abf8d7accba0697 Mon Sep 17 00:00:00 2001 From: Jim McDonough Date: Thu, 3 Apr 2003 03:30:25 +0000 Subject: The ldap idmap backend from Anthony Liguori (aliguori@us.ibm.com): This patch moves the ldap routines out of passdb into a generic library and implements an LDAP backend for IDMAP. THe backend can be enabled with "idmap backend = ldap" in smb.conf. THere are also schema changes to make sure to update teh ldap schema files. (This used to be commit 87c7c582c60521da3a93d997386fe79935012aea) --- examples/LDAP/samba.schema | 12 +- source3/Makefile.in | 9 +- source3/include/includes.h | 4 + source3/include/smb_ldap.h | 59 +++ source3/lib/ldap.c | 718 +++++++++++++++++++++++++++++ source3/nsswitch/winbindd_idmap.c | 2 +- source3/nsswitch/winbindd_idmap_ldap.c | 394 ++++++++++++++++ source3/passdb/pdb_ldap.c | 797 ++++----------------------------- 8 files changed, 1282 insertions(+), 713 deletions(-) create mode 100644 source3/include/smb_ldap.h create mode 100644 source3/lib/ldap.c create mode 100644 source3/nsswitch/winbindd_idmap_ldap.c diff --git a/examples/LDAP/samba.schema b/examples/LDAP/samba.schema index e801e0b847..a4435564ec 100644 --- a/examples/LDAP/samba.schema +++ b/examples/LDAP/samba.schema @@ -167,11 +167,11 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY ## ## Used for Winbind experimentation ## -#objectclass ( 1.3.6.1.4.1.7165.1.2.2.3 NAME 'uidPool' SUP top AUXILIARY -# DESC 'Pool for allocating UNIX uids' -# MUST ( uidNumber $ cn ) ) +objectclass ( 1.3.6.1.4.1.7165.1.2.2.3 NAME 'uidPool' SUP top AUXILIARY + DESC 'Pool for allocating UNIX uids' + MUST ( uidNumber $ cn ) ) -#objectclass ( 1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' SUP top AUXILIARY -# DESC 'Pool for allocating UNIX gids' -# MUST ( gidNumber $ cn ) ) +objectclass ( 1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' SUP top AUXILIARY + DESC 'Pool for allocating UNIX gids' + MUST ( gidNumber $ cn ) ) diff --git a/source3/Makefile.in b/source3/Makefile.in index 8ac2a053fc..9b2cffe86c 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -275,7 +275,7 @@ PASSDB_GET_SET_OBJ = passdb/pdb_get_set.o PASSDB_OBJ = $(PASSDB_GET_SET_OBJ) passdb/passdb.o passdb/pdb_interface.o \ passdb/machine_sid.o passdb/util_sam_sid.o passdb/pdb_compat.o \ - passdb/privileges.o @PDB_STATIC@ + passdb/privileges.o lib/ldap.o @PDB_STATIC@ XML_OBJ = modules/xml.o MYSQL_OBJ = modules/mysql.o @@ -581,6 +581,7 @@ WINBINDD_OBJ1 = \ nsswitch/winbindd_group.o \ nsswitch/winbindd_idmap.o \ nsswitch/winbindd_idmap_tdb.o \ + nsswitch/winbindd_idmap_ldap.o \ nsswitch/winbindd_util.o \ nsswitch/winbindd_cache.o \ nsswitch/winbindd_pam.o \ @@ -597,7 +598,8 @@ WINBINDD_OBJ = \ $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) \ $(PROFILE_OBJ) $(UNIGRP_OBJ) $(IDMAP_OBJ) \ - $(SECRETS_OBJ) $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) + $(SECRETS_OBJ) $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) \ + lib/ldap.o WBINFO_OBJ = nsswitch/wbinfo.o libsmb/smbencrypt.o libsmb/smbdes.o $(POPT_LIB_OBJ) @@ -948,7 +950,8 @@ nsswitch/libnss_wins.@SHLIBEXT@: $(NSS_OBJ) bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) \ + @LDAP_LIBS@ nsswitch/libns_winbind.@SHLIBEXT@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" diff --git a/source3/include/includes.h b/source3/include/includes.h index de87f82709..bf71ed54cf 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -856,6 +856,10 @@ struct functable { struct printjob; +struct smb_ldap_privates; + +struct smb_ldap_privates; + /***** automatically generated prototypes *****/ #ifndef NO_PROTO_H #include "proto.h" diff --git a/source3/include/smb_ldap.h b/source3/include/smb_ldap.h new file mode 100644 index 0000000000..1a30b853e7 --- /dev/null +++ b/source3/include/smb_ldap.h @@ -0,0 +1,59 @@ +/* + Unix SMB/CIFS implementation. + LDAP protocol helper functions for SAMBA + Copyright (C) Jean François Micouleau 1998 + Copyright (C) Gerald Carter 2001 + Copyright (C) Shahms King 2001 + Copyright (C) Andrew Bartlett 2002 + Copyright (C) Stefan (metze) Metzmacher 2002 + Copyright (C) Jim McDonough 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +*/ + +#ifndef SMB_LDAP_H +#define SMB_LDAP_H + +#ifdef HAVE_LDAP + +#include +#include + +struct smb_ldap_privates { + + /* Former statics */ + LDAP *ldap_struct; + LDAPMessage *result; + LDAPMessage *entry; + int index; + + time_t last_ping; + /* retrive-once info */ + const char *uri; + + BOOL permit_non_unix_accounts; + + uint32 low_nua_rid; + uint32 high_nua_rid; + + char *bind_dn; + char *bind_secret; + + struct smb_ldap_privates *next; +}; + +#endif +#endif diff --git a/source3/lib/ldap.c b/source3/lib/ldap.c new file mode 100644 index 0000000000..73ff50e159 --- /dev/null +++ b/source3/lib/ldap.c @@ -0,0 +1,718 @@ +/* + Unix SMB/CIFS implementation. + LDAP protocol helper functions for SAMBA + Copyright (C) Jean François Micouleau 1998 + Copyright (C) Gerald Carter 2001 + Copyright (C) Shahms King 2001 + Copyright (C) Andrew Bartlett 2002 + Copyright (C) Stefan (metze) Metzmacher 2002 + Copyright (C) Jim McDonough 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +*/ + +#include "includes.h" + +#ifdef HAVE_LDAP +/* TODO: +* persistent connections: if using NSS LDAP, many connections are made +* however, using only one within Samba would be nice +* +* Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK +* +* Other LDAP based login attributes: accountExpires, etc. +* (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT +* structures don't have fields for some of these attributes) +* +* SSL is done, but can't get the certificate based authentication to work +* against on my test platform (Linux 2.4, OpenLDAP 2.x) +*/ + +/* NOTE: this will NOT work against an Active Directory server +* due to the fact that the two password fields cannot be retrieved +* from a server; recommend using security = domain in this situation +* and/or winbind +*/ + +#include "smb_ldap.h" + +/* We need an internal mapping of LDAP * -> smb_ldap_privates so we implement + it in terms of a VK list. It's a little backwards but its quite efficent */ +static struct smb_ldap_privates *head; + +static struct smb_ldap_privates *get_internal(LDAP *ldap_struct) +{ + struct smb_ldap_privates *ret = head; + + while (NULL != ret && ret->ldap_struct != ldap_struct) { + ret = ret->next; + } + + return ret; +} + +#define SMB_LDAP_DONT_PING_TIME 10 /* ping only all 10 seconds */ + +/******************************************************************* + find the ldap password +******************************************************************/ +static BOOL smb_ldap_fetch_pw(char **dn, char** pw) +{ + char *key = NULL; + size_t size; + + *dn = smb_xstrdup(lp_ldap_admin_dn()); + + if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) { + SAFE_FREE(*dn); + DEBUG(0, ("smb_ldap_fetch_pw: asprintf failed!\n")); + } + + *pw=secrets_fetch(key, &size); + if (!size) { + /* Upgrade 2.2 style entry */ + char *p; + char* old_style_key = strdup(*dn); + char *data; + fstring old_style_pw; + + if (!old_style_key) { + DEBUG(0, ("smb_ldap_fetch_pw: strdup failed!\n")); + return False; + } + + for (p=old_style_key; *p; p++) + if (*p == ',') *p = '/'; + + data=secrets_fetch(old_style_key, &size); + if (!size && size < sizeof(old_style_pw)) { + DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n")); + SAFE_FREE(old_style_key); + SAFE_FREE(*dn); + return False; + } + + strncpy(old_style_pw, data, size); + old_style_pw[size] = 0; + + SAFE_FREE(data); + + if (!secrets_store_ldap_pw(*dn, old_style_pw)) { + DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n")); + SAFE_FREE(old_style_key); + SAFE_FREE(*dn); + return False; + } + if (!secrets_delete(old_style_key)) { + DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n")); + } + + SAFE_FREE(old_style_key); + + *pw = smb_xstrdup(old_style_pw); + } + + return True; +} + +/******************************************************************* + open a connection to the ldap server. +******************************************************************/ +int smb_ldap_open_connection (struct smb_ldap_privates *ldap_state, + LDAP ** ldap_struct) +{ + int rc = LDAP_SUCCESS; + int version; + BOOL ldap_v3 = False; + +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) + DEBUG(10, ("smb_ldap_open_connection: %s\n", ldap_state->uri)); + + if ((rc = ldap_initialize(ldap_struct, ldap_state->uri)) != LDAP_SUCCESS) { + DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc))); + return rc; + } + +#else + + /* Parse the string manually */ + + { + int port = 0; + fstring protocol; + fstring host; + const char *p = ldap_state->uri; + SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254); + + /* skip leading "URL:" (if any) */ + if ( strncasecmp( p, "URL:", 4 ) == 0 ) { + p += 4; + } + + sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port); + + if (port == 0) { + if (strequal(protocol, "ldap")) { + port = LDAP_PORT; + } else if (strequal(protocol, "ldaps")) { + port = LDAPS_PORT; + } else { + DEBUG(0, ("unrecognised protocol (%s)!\n", protocol)); + } + } + + if ((*ldap_struct = ldap_init(host, port)) == NULL) { + DEBUG(0, ("ldap_init failed !\n")); + return LDAP_OPERATIONS_ERROR; + } + + if (strequal(protocol, "ldaps")) { +#ifdef LDAP_OPT_X_TLS + int tls = LDAP_OPT_X_TLS_HARD; + if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS) + { + DEBUG(0, ("Failed to setup a TLS session\n")); + } + + DEBUG(3,("LDAPS option set...!\n")); +#else + DEBUG(0,("smb_ldap_open_connection: Secure connection not supported by LDAP client libraries!\n")); + return LDAP_OPERATIONS_ERROR; +#endif + } + } +#endif + + if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) + { + if (version != LDAP_VERSION3) + { + version = LDAP_VERSION3; + if (ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) { + ldap_v3 = True; + } + } else { + ldap_v3 = True; + } + } + + if (lp_ldap_ssl() == LDAP_SSL_START_TLS) { +#ifdef LDAP_OPT_X_TLS + if (ldap_v3) { + if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS) + { + DEBUG(0,("Failed to issue the StartTLS instruction: %s\n", + ldap_err2string(rc))); + return rc; + } + DEBUG (3, ("StartTLS issued: using a TLS connection\n")); + } else { + + DEBUG(0, ("Need LDAPv3 for Start TLS\n")); + return LDAP_OPERATIONS_ERROR; + } +#else + DEBUG(0,("smb_ldap_open_connection: StartTLS not supported by LDAP client libraries!\n")); + return LDAP_OPERATIONS_ERROR; +#endif + } + + DEBUG(2, ("smb_ldap_open_connection: connection opened\n")); + return rc; +} + + +/******************************************************************* + a rebind function for authenticated referrals + This version takes a void* that we can shove useful stuff in :-) +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +#else +static int rebindproc_with_state (LDAP * ld, char **whop, char **credp, + int *methodp, int freeit, void *arg) +{ + struct smb_ldap_privates *ldap_state = arg; + + /** @TODO Should we be doing something to check what servers we rebind to? + Could we get a referral to a machine that we don't want to give our + username and password to? */ + + if (freeit) { + SAFE_FREE(*whop); + memset(*credp, '\0', strlen(*credp)); + SAFE_FREE(*credp); + } else { + DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", + ldap_state->bind_dn)); + + *whop = strdup(ldap_state->bind_dn); + if (!*whop) { + return LDAP_NO_MEMORY; + } + *credp = strdup(ldap_state->bind_secret); + if (!*credp) { + SAFE_FREE(*whop); + return LDAP_NO_MEMORY; + } + *methodp = LDAP_AUTH_SIMPLE; + } + return 0; +} +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + a rebind function for authenticated referrals + This version takes a void* that we can shove useful stuff in :-) + and actually does the connection. +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +static int rebindproc_connect_with_state (LDAP *ldap_struct, + LDAP_CONST char *url, + ber_tag_t request, + ber_int_t msgid, void *arg) +{ + struct smb_ldap_privates *ldap_state = arg; + int rc; + DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n", + ldap_state->bind_dn)); + + /** @TODO Should we be doing something to check what servers we rebind to? + Could we get a referral to a machine that we don't want to give our + username and password to? */ + + rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret); + + return rc; +} +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + Add a rebind function for authenticated referrals +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +#else +# if LDAP_SET_REBIND_PROC_ARGS == 2 +static int rebindproc (LDAP *ldap_struct, char **whop, char **credp, + int *method, int freeit ) +{ + return rebindproc_with_state(ldap_struct, whop, credp, + method, freeit, get_internal(ldap_struct)); + +} +# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + a rebind function for authenticated referrals + this also does the connection, but no void*. +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +# if LDAP_SET_REBIND_PROC_ARGS == 2 +static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request, + ber_int_t msgid) +{ + return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid, + get_internal(ld)); +} +# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + connect to the ldap server under system privilege. +******************************************************************/ +int smb_ldap_connect_system(struct smb_ldap_privates *ldap_state, + LDAP * ldap_struct) +{ + int rc; + char *ldap_dn; + char *ldap_secret; + + if (NULL == get_internal(ldap_struct)) { + ldap_state->next = head; + } + + /* get the password */ + if (!smb_ldap_fetch_pw(&ldap_dn, &ldap_secret)) + { + DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n")); + return LDAP_INVALID_CREDENTIALS; + } + + ldap_state->bind_dn = ldap_dn; + ldap_state->bind_secret = ldap_secret; + + /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite + (OpenLDAP) doesnt' seem to support it */ + + DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n", + ldap_state->uri, ldap_dn)); + +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +# if LDAP_SET_REBIND_PROC_ARGS == 2 + ldap_set_rebind_proc(ldap_struct, &rebindproc_connect); +# endif +# if LDAP_SET_REBIND_PROC_ARGS == 3 + ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state); +# endif +#else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ +# if LDAP_SET_REBIND_PROC_ARGS == 2 + ldap_set_rebind_proc(ldap_struct, &rebindproc); +# endif +# if LDAP_SET_REBIND_PROC_ARGS == 3 + ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state); +# endif +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + + rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret); + + if (rc != LDAP_SUCCESS) { + char *ld_error; + ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + &ld_error); + DEBUG(0, + ("failed to bind to server with dn= %s Error: %s\n\t%s\n", + ldap_dn, ldap_err2string(rc), + ld_error)); + free(ld_error); + return rc; + } + + DEBUG(2, ("ldap_connect_system: succesful connection to the LDAP server\n")); + return rc; +} + +/********************************************************************** +Connect to LDAP server +*********************************************************************/ +int smb_ldap_open(struct smb_ldap_privates *ldap_state) +{ + int rc; + SMB_ASSERT(ldap_state); + +#ifndef NO_LDAP_SECURITY + if (geteuid() != 0) { + DEBUG(0, ("smb_ldap_open: cannot access LDAP when not root..\n")); + return LDAP_INSUFFICIENT_ACCESS; + } +#endif + + if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + SMB_LDAP_DONT_PING_TIME) < time(NULL))) { + struct sockaddr_un addr; + socklen_t len; + int sd; + if (ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd) == 0 && + getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { + /* the other end has died. reopen. */ + ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); + ldap_state->ldap_struct = NULL; + ldap_state->last_ping = (time_t)0; + } else { + ldap_state->last_ping = time(NULL); + } + } + + if (ldap_state->ldap_struct != NULL) { + DEBUG(5,("smb_ldap_open: allready connected to the LDAP server\n")); + return LDAP_SUCCESS; + } + + if ((rc = smb_ldap_open_connection(ldap_state, &ldap_state->ldap_struct))) { + return rc; + } + + if ((rc = smb_ldap_connect_system(ldap_state, ldap_state->ldap_struct))) { + ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); + ldap_state->ldap_struct = NULL; + return rc; + } + + + ldap_state->last_ping = time(NULL); + DEBUG(4,("The LDAP server is succesful connected\n")); + + return LDAP_SUCCESS; +} + +/********************************************************************** +Disconnect from LDAP server +*********************************************************************/ +NTSTATUS smb_ldap_close(struct smb_ldap_privates *ldap_state) +{ + if (!ldap_state) + return NT_STATUS_INVALID_PARAMETER; + + if (ldap_state->ldap_struct != NULL) { + ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); + ldap_state->ldap_struct = NULL; + } + + DEBUG(5,("The connection to the LDAP server was closed\n")); + /* maybe free the results here --metze */ + + return NT_STATUS_OK; +} + +static int smb_ldap_retry_open(struct smb_ldap_privates *ldap_state, int *attempts) +{ + int rc; + + SMB_ASSERT(ldap_state && attempts); + + if (*attempts != 0) { + /* we retry after 0.5, 2, 4.5, 8, 12.5, 18, 24.5 seconds */ + msleep((((*attempts)*(*attempts))/2)*1000); + } + (*attempts)++; + + if ((rc = smb_ldap_open(ldap_state))) { + DEBUG(0,("Connection to LDAP Server failed for the %d try!\n",*attempts)); + return rc; + } + + return LDAP_SUCCESS; +} + + +int smb_ldap_search(struct smb_ldap_privates *ldap_state, + const char *base, int scope, const char *filter, + const char *attrs[], int attrsonly, + LDAPMessage **res) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + + SMB_ASSERT(ldap_state); + + while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { + + if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_search_s(ldap_state->ldap_struct, base, scope, + filter, attrs, attrsonly, res); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smb_ldap_close(ldap_state); + } + + return rc; +} + +int smb_ldap_modify(struct smb_ldap_privates *ldap_state, char *dn, + LDAPMod *attrs[]) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + + if (!ldap_state) + return (-1); + + while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { + + if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_modify_s(ldap_state->ldap_struct, dn, attrs); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smb_ldap_close(ldap_state); + } + + return rc; +} + +int smb_ldap_add(struct smb_ldap_privates *ldap_state, const char *dn, + LDAPMod *attrs[]) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + + if (!ldap_state) + return (-1); + + while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { + + if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_add_s(ldap_state->ldap_struct, dn, attrs); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smb_ldap_close(ldap_state); + } + + return rc; +} + +int smb_ldap_delete(struct smb_ldap_privates *ldap_state, char *dn) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + + if (!ldap_state) + return (-1); + + while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { + + if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_delete_s(ldap_state->ldap_struct, dn); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smb_ldap_close(ldap_state); + } + + return rc; +} + +int smb_ldap_extended_operation(struct smb_ldap_privates *ldap_state, + LDAP_CONST char *reqoid, + struct berval *reqdata, + LDAPControl **serverctrls, + LDAPControl **clientctrls, char **retoidp, + struct berval **retdatap) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + + if (!ldap_state) + return (-1); + + while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { + + if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid, reqdata, serverctrls, clientctrls, retoidp, retdatap); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smb_ldap_close(ldap_state); + } + + return rc; +} + +/******************************************************************* +search an attribute and return the first value found. +******************************************************************/ +BOOL smb_ldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, + const char *attribute, pstring value) +{ + char **values; + + if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) { + value = NULL; + DEBUG (10, ("smb_ldap_get_single_attribute: [%s] = []\n", attribute)); + + return False; + } + + pstrcpy(value, values[0]); + ldap_value_free(values); +#ifdef DEBUG_PASSWORDS + DEBUG (100, ("smb_ldap_get_single_attribute: [%s] = [%s]\n", attribute, value)); +#endif + return True; +} + + +/************************************************************************ +Routine to manage the LDAPMod structure array +manage memory used by the array, by each struct, and values + +************************************************************************/ +void smb_ldap_make_a_mod (LDAPMod *** modlist, int modop, + const char *attribute, const char *value) +{ + LDAPMod **mods; + int i; + int j; + + mods = *modlist; + + if (attribute == NULL || *attribute == '\0') + return; + + if (value == NULL || *value == '\0') + return; + + if (mods == NULL) + { + mods = (LDAPMod **) malloc(sizeof(LDAPMod *)); + if (mods == NULL) + { + DEBUG(0, ("smb_ldap_make_a_mod: out of memory!\n")); + return; + } + mods[0] = NULL; + } + + for (i = 0; mods[i] != NULL; ++i) { + if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute)) + break; + } + + if (mods[i] == NULL) + { + mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *)); + if (mods == NULL) + { + DEBUG(0, ("smb_ldap_make_a_mod: out of memory!\n")); + return; + } + mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod)); + if (mods[i] == NULL) + { + DEBUG(0, ("smb_ldap_make_a_mod: out of memory!\n")); + return; + } + mods[i]->mod_op = modop; + mods[i]->mod_values = NULL; + mods[i]->mod_type = strdup(attribute); + mods[i + 1] = NULL; + } + + if (value != NULL) + { + j = 0; + if (mods[i]->mod_values != NULL) { + for (; mods[i]->mod_values[j] != NULL; j++); + } + mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values, + (j + 2) * sizeof (char *)); + + if (mods[i]->mod_values == NULL) { + DEBUG (0, ("smb_ldap_make_a_mod: Memory allocation failure!\n")); + return; + } + mods[i]->mod_values[j] = strdup(value); + mods[i]->mod_values[j + 1] = NULL; + } + *modlist = mods; +} + +#endif diff --git a/source3/nsswitch/winbindd_idmap.c b/source3/nsswitch/winbindd_idmap.c index 4b4d9eb8d2..23f4b4d081 100644 --- a/source3/nsswitch/winbindd_idmap.c +++ b/source3/nsswitch/winbindd_idmap.c @@ -28,7 +28,7 @@ static struct { struct winbindd_idmap_methods *methods; } builtin_winbindd_idmap_functions[] = { { "tdb", winbind_idmap_reg_tdb, NULL }, - /* { "ldap", winbind_idmap_reg_ldap, NULL },*/ + { "ldap", winbind_idmap_reg_ldap, NULL }, { NULL, NULL, NULL } }; diff --git a/source3/nsswitch/winbindd_idmap_ldap.c b/source3/nsswitch/winbindd_idmap_ldap.c new file mode 100644 index 0000000000..b0b260e34d --- /dev/null +++ b/source3/nsswitch/winbindd_idmap_ldap.c @@ -0,0 +1,394 @@ +/* + Unix SMB/CIFS implementation. + + Winbind daemon - user related function + + Copyright (C) Jim McDonough 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "winbindd.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_WINBIND + +#ifdef HAVE_LDAP + +#include +#include + +#include "smb_ldap.h" + +/* Globals */ +static struct smb_ldap_privates *ldap_state; + +static const char *attr[] = { "uid", "rid", "domain", "uidNumber", + "gidNumber", NULL }; + +static const char *pool_attr[] = {"uidNumber", "gidNumber", "cn", NULL}; + +static const char *group_attr[] = {"gidNumber", "ntSid", NULL}; + +static long ldap_allocate_id(BOOL is_user) +{ + int rc, count; + LDAPMessage *result; + int scope = LDAP_SCOPE_SUBTREE; + long ret = 0; + int sanity = 0; + + do { + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), scope, is_user?"cn=UID Pool":"cn=GID Pool", pool_attr, 0, &result); + + if (LDAP_SUCCESS != rc) { + DEBUG(0,("ldap_allocate_id: No ID pool found in directory\n")); + return 0; + } + + count = ldap_count_entries(ldap_state->ldap_struct, result); + + if (1 < count) { + DEBUG(0,("ldap_allocate_id: Multiple UID pools found in directory?\n")); + break; + } else if (1 == count) { + LDAPMessage *entry = + ldap_first_entry(ldap_state->ldap_struct, + result); + LDAPMod **mods = NULL; + pstring temp; + + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, is_user?"uidNumber":"gidNumber", temp)) { + return False; + } + ret = atol(temp); + smb_ldap_make_a_mod(&mods, LDAP_MOD_DELETE, + is_user?"uidNumber":"gidNumber", + temp); + slprintf(temp, sizeof(temp) - 1, "%i", ret + 1); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, is_user?"uidNumber":"gidNumber", temp); + slprintf(temp, sizeof(temp) - 1, "cn=%cID Pool,%s", is_user?'U':'G', lp_ldap_user_suffix()); + rc = smb_ldap_modify(ldap_state, temp, mods); + ldap_mods_free(mods, 1); + } else { + DEBUG(0,("ldap_allocate_id: unexpected number of entries returned\n")); + break; + } + } while (LDAP_NO_SUCH_ATTRIBUTE == rc && ++sanity < 100); + + return ret; +} + +/***************************************************************************** + Initialise idmap database. +*****************************************************************************/ +static BOOL ldap_idmap_init(void) +{ + static struct smb_ldap_privates state; + ldap_state = &state; + +#ifdef WITH_LDAP_SAMCONFIG + { + int ldap_port = lp_ldap_port(); + + /* remap default port if not using SSL */ + if (lp_ldap_ssl() != LDAP_SSL_ON && ldap_port == 636) { + ldap_port = 389; + } + + ldap_state->uri = asprintf("%s://%s:d", + lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", + lp_ldap_server(), ldap_port); + if (!ldap_state->uri) { + DEBUG(0,("Out of memory\n")); + return False; + } + } +#else + ldap_state->uri = "ldap://localhost"; +#endif + return True; +} + +static BOOL ldap_get_sid_from_uid(uid_t uid, DOM_SID * sid) +{ + pstring filter; + int scope = LDAP_SCOPE_SUBTREE; + int rc, count; + LDAPMessage *result; + + slprintf(filter, sizeof(filter) - 1, "uidNumber=%i", uid); + + DEBUG(2, ("ldap_get_sid_from_uid: searching for:[%s]\n", filter)); + + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), scope, filter, attr, 0, &result); + if (LDAP_SUCCESS != rc) { + DEBUG(0,("ldap_get_sid_from_uid: user search failed\n")); + return False; + } + + count = ldap_count_entries(ldap_state->ldap_struct, result); + if (1 < count) { + DEBUG(0,("More than one user exists where: %s\n", filter)); + ldap_msgfree(result); + return False; + } else if (1 == count) { + /* we found the user, get the users RID */ + LDAPMessage *entry = ldap_first_entry(ldap_state->ldap_struct, + result); + pstring temp, domain; + uint32 rid; + struct winbindd_domain *wb_dom; + + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "domain", domain)) { + return False; + } + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "rid", temp)) { + return False; + } + rid = (uint32)atol(temp); + wb_dom = find_domain_from_name(domain); + + if (!wb_dom) { + DEBUG(0,("ldap_get_sid_from_uid: could not find domain %s\n", domain)); + return False; + } + + sid_copy(sid, &wb_dom->sid); + sid_append_rid(sid, rid); + } else { + /* 0 entries? that ain't right */ + DEBUG(0,("ldap_get_sid_from_uid: not user entry found for %s\n", filter)); + } + + return True; +} + +static BOOL ldap_get_uid_from_sid(DOM_SID *sid, uid_t *uid) +{ + pstring filter; + int scope = LDAP_SCOPE_SUBTREE; + int rc, count; + LDAPMessage *result; + uint32 rid = 0; + struct winbindd_domain *wb_dom; + DOM_SID dom_sid; + + sid_copy(&dom_sid, sid); + + if (!sid_split_rid(&dom_sid, &rid)) { + DEBUG(0,("ldap_get_uid_from_sid: sid does not contain an rid\n")); + return False; + } + + if (!(wb_dom = find_domain_from_sid(&dom_sid))) { + DEBUG(0,("ldap_get_uid_from_sid: cannot lookup domain from sid\n")); + return False; + } + + slprintf(filter, sizeof(filter) - 1, "rid=%d,domain=%s,objectClass=sambaAccount", rid, wb_dom->name); + + DEBUG(2, ("ldap_get_uid_from_sid: searching for:[%s]\n", filter)); + + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), scope, filter, attr, 0, &result); + if (LDAP_NO_SUCH_OBJECT == rc) { + LDAPMod **mods = NULL; + pstring temp; + fstring dom, name; + int sid_type; + + winbindd_lookup_name_by_sid(sid, dom, name, + (enum SID_USE_TYPE *)&sid_type); + slprintf(temp, sizeof(temp) - 1, "%i", rid); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "rid", temp); + + *uid = ldap_allocate_id(True); + slprintf(temp, sizeof(temp) - 1, "%i", *uid); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "uidNumber", temp); + + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "uid", name); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", "sambaAccount"); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", "account"); + slprintf(temp, sizeof(temp) - 1, "uid=%s,%s", name, lp_ldap_user_suffix()); + rc = smb_ldap_modify(ldap_state, temp, mods); + + ldap_mods_free(mods, 1); + if (LDAP_SUCCESS != rc) { + return False; + } + } else if (LDAP_SUCCESS == rc) { + count = ldap_count_entries(ldap_state->ldap_struct, result); + if (1 < count) { + DEBUG(0,("More than one user exists where: %s\n", filter)); + ldap_msgfree(result); + return False; + } else if (1 == count) { + /* we found the user, get the idNumber */ + LDAPMessage *entry = ldap_first_entry(ldap_state->ldap_struct, result); + pstring temp; + + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "uidNumber", temp)) { + return False; + } + *uid = atol(temp); + } else { + DEBUG(0,("ldap_get_uid_from_sid: zero entries returned?\n")); + return False; + } + } else { + DEBUG(0,("ldap_get_uid_from_sid: unknown error querying user info\n")); + return False; + } + + return True; +} + +static BOOL ldap_get_sid_from_gid(gid_t gid, DOM_SID * sid) +{ + pstring filter; + int scope = LDAP_SCOPE_SUBTREE; + int rc, count; + LDAPMessage *result; + + slprintf(filter, sizeof(filter) - 1, "gidNumber=%i,objectClass=sambaGroupMapping", gid); + + DEBUG(2, ("ldap_get_sid_from_gid: searching for:[%s]\n", filter)); + + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), scope, filter, attr, 0, &result); + if (LDAP_SUCCESS != rc) { + DEBUG(0,("ldap_get_sid_from_gid: user search failed\n")); + return False; + } + + count = ldap_count_entries(ldap_state->ldap_struct, result); + if (1 < count) { + DEBUG(0,("More than one group exists where: %s\n", filter)); + ldap_msgfree(result); + return False; + } else if (1 == count) { + LDAPMessage *entry = ldap_first_entry(ldap_state->ldap_struct, + result); + pstring str_sid; + + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "ntSid", str_sid)) { + return False; + } + + string_to_sid(sid, str_sid); + } else { + /* 0 entries? that ain't right */ + DEBUG(0,("ldap_get_sid_from_gid: not group entry found for %s\n", filter)); + } + + return True; +} + +static BOOL ldap_get_gid_from_sid(DOM_SID *sid, gid_t *gid) +{ + pstring filter; + int scope = LDAP_SCOPE_SUBTREE; + int rc, count; + LDAPMessage *result; + fstring str_sid; + + sid_to_string(str_sid, sid); + + slprintf(filter, sizeof(filter) - 1, "ntSid=%d,objectClass=sambaGroupMapping", str_sid); + + DEBUG(2, ("ldap_get_gid_from_sid: searching for:[%s]\n", filter)); + + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), scope, filter, attr, 0, &result); + if (LDAP_NO_SUCH_OBJECT == rc) { + LDAPMod **mods = NULL; + pstring temp; + + *gid = ldap_allocate_id(False); + slprintf(temp, sizeof(temp) - 1, "%i", *gid); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "gidNumber", temp); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", "sambaGroupMapping"); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", "account"); + slprintf(temp, sizeof(temp) - 1, "gidNumber=%i,%s", *gid, lp_ldap_user_suffix()); + rc = smb_ldap_modify(ldap_state, temp, mods); + + ldap_mods_free(mods, 1); + if (LDAP_SUCCESS != rc) { + return False; + } + } else if (LDAP_SUCCESS == rc) { + count = ldap_count_entries(ldap_state->ldap_struct, result); + if (1 < count) { + DEBUG(0,("More than one group exists where: %s\n", filter)); + ldap_msgfree(result); + return False; + } else if (1 == count) { + LDAPMessage *entry = ldap_first_entry(ldap_state->ldap_struct, result); + pstring temp; + + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "gidNumber", temp)) { + return False; + } + *gid = atol(temp); + } else { + DEBUG(0,("ldap_get_gid_from_sid: zero entries returned?\n")); + return False; + } + } else { + DEBUG(0,("ldap_get_gid_from_sid: unknown error querying user info\n")); + return False; + } + + return True; +} + +static BOOL ldap_idmap_close(void) +{ + smb_ldap_close(ldap_state); + ldap_state = 0; + return True; +} + +static void ldap_idmap_status(void) +{ + DEBUG(0, ("winbindd idmap status:\n")); + DEBUG(0, ("Using LDAP\n")); +} + +struct winbind_idmap_methods ldap_idmap_methods = { + ldap_idmap_init, + + ldap_get_sid_from_uid, + ldap_get_sid_from_gid, + + ldap_get_uid_from_sid, + ldap_get_gid_from_sid, + + ldap_idmap_close, + + ldap_idmap_status +}; + +#endif + +BOOL winbind_idmap_reg_ldap(struct winbind_idmap_methods **meth) +{ +#ifdef HAVE_LDAP + *meth = &ldap_idmap_methods; + + return True; +#else + DEBUG(0,("winbind_idmap_reg_ldap: LDAP support not compiled\n")); + return False; +#endif +} diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index 264de8d0f0..eaef7f37a7 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -6,6 +6,7 @@ Copyright (C) Shahms King 2001 Copyright (C) Andrew Bartlett 2002 Copyright (C) Stefan (metze) Metzmacher 2002 + Copyright (C) Jim McDonough 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -51,36 +52,13 @@ #include #include +#include "smb_ldap.h" + #ifndef SAM_ACCOUNT #define SAM_ACCOUNT struct sam_passwd #endif -struct ldapsam_privates { - - /* Former statics */ - LDAP *ldap_struct; - LDAPMessage *result; - LDAPMessage *entry; - int index; - - time_t last_ping; - /* retrive-once info */ - const char *uri; - - BOOL permit_non_unix_accounts; - - uint32 low_nua_rid; - uint32 high_nua_rid; - - char *bind_dn; - char *bind_secret; -}; - -#define LDAPSAM_DONT_PING_TIME 10 /* ping only all 10 seconds */ - -static struct ldapsam_privates *static_ldap_state; - -static uint32 ldapsam_get_next_available_nua_rid(struct ldapsam_privates *ldap_state); +static uint32 ldapsam_get_next_available_nua_rid(struct smb_ldap_privates *ldap_state); /******************************************************************* find the ldap password @@ -157,496 +135,17 @@ static const char *attr[] = {"uid", "pwdLastSet", "logonTime", "uidNumber", "gidNumber", "homeDirectory", NULL }; -/******************************************************************* - open a connection to the ldap server. -******************************************************************/ -static int ldapsam_open_connection (struct ldapsam_privates *ldap_state, LDAP ** ldap_struct) -{ - int rc = LDAP_SUCCESS; - int version; - BOOL ldap_v3 = False; - -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) - DEBUG(10, ("ldapsam_open_connection: %s\n", ldap_state->uri)); - - if ((rc = ldap_initialize(ldap_struct, ldap_state->uri)) != LDAP_SUCCESS) { - DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc))); - return rc; - } - -#else - - /* Parse the string manually */ - - { - int port = 0; - fstring protocol; - fstring host; - const char *p = ldap_state->uri; - SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254); - - /* skip leading "URL:" (if any) */ - if ( strncasecmp( p, "URL:", 4 ) == 0 ) { - p += 4; - } - - sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port); - - if (port == 0) { - if (strequal(protocol, "ldap")) { - port = LDAP_PORT; - } else if (strequal(protocol, "ldaps")) { - port = LDAPS_PORT; - } else { - DEBUG(0, ("unrecognised protocol (%s)!\n", protocol)); - } - } - - if ((*ldap_struct = ldap_init(host, port)) == NULL) { - DEBUG(0, ("ldap_init failed !\n")); - return LDAP_OPERATIONS_ERROR; - } - - if (strequal(protocol, "ldaps")) { -#ifdef LDAP_OPT_X_TLS - int tls = LDAP_OPT_X_TLS_HARD; - if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS) - { - DEBUG(0, ("Failed to setup a TLS session\n")); - } - - DEBUG(3,("LDAPS option set...!\n")); -#else - DEBUG(0,("ldapsam_open_connection: Secure connection not supported by LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - } -#endif - - if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) - { - if (version != LDAP_VERSION3) - { - version = LDAP_VERSION3; - if (ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) { - ldap_v3 = True; - } - } else { - ldap_v3 = True; - } - } - - if (lp_ldap_ssl() == LDAP_SSL_START_TLS) { -#ifdef LDAP_OPT_X_TLS - if (ldap_v3) { - if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS) - { - DEBUG(0,("Failed to issue the StartTLS instruction: %s\n", - ldap_err2string(rc))); - return rc; - } - DEBUG (3, ("StartTLS issued: using a TLS connection\n")); - } else { - - DEBUG(0, ("Need LDAPv3 for Start TLS\n")); - return LDAP_OPERATIONS_ERROR; - } -#else - DEBUG(0,("ldapsam_open_connection: StartTLS not supported by LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - - DEBUG(2, ("ldapsam_open_connection: connection opened\n")); - return rc; -} - - -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -static int rebindproc_with_state (LDAP * ld, char **whop, char **credp, - int *methodp, int freeit, void *arg) -{ - struct ldapsam_privates *ldap_state = arg; - - /** @TODO Should we be doing something to check what servers we rebind to? - Could we get a referral to a machine that we don't want to give our - username and password to? */ - - if (freeit) { - SAFE_FREE(*whop); - memset(*credp, '\0', strlen(*credp)); - SAFE_FREE(*credp); - } else { - DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", - ldap_state->bind_dn)); - - *whop = strdup(ldap_state->bind_dn); - if (!*whop) { - return LDAP_NO_MEMORY; - } - *credp = strdup(ldap_state->bind_secret); - if (!*credp) { - SAFE_FREE(*whop); - return LDAP_NO_MEMORY; - } - *methodp = LDAP_AUTH_SIMPLE; - } - return 0; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) - and actually does the connection. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -static int rebindproc_connect_with_state (LDAP *ldap_struct, - LDAP_CONST char *url, - ber_tag_t request, - ber_int_t msgid, void *arg) -{ - struct ldapsam_privates *ldap_state = arg; - int rc; - DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n", - ldap_state->bind_dn)); - - /** @TODO Should we be doing something to check what servers we rebind to? - Could we get a referral to a machine that we don't want to give our - username and password to? */ - - rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret); - - return rc; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - Add a rebind function for authenticated referrals -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc (LDAP *ldap_struct, char **whop, char **credp, - int *method, int freeit ) -{ - return rebindproc_with_state(ldap_struct, whop, credp, - method, freeit, static_ldap_state); - -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - a rebind function for authenticated referrals - this also does the connection, but no void*. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request, - ber_int_t msgid) -{ - return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid, - static_ldap_state); -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - connect to the ldap server under system privilege. -******************************************************************/ -static int ldapsam_connect_system(struct ldapsam_privates *ldap_state, LDAP * ldap_struct) -{ - int rc; - char *ldap_dn; - char *ldap_secret; - - /* The rebind proc needs this *HACK*. We are not multithreaded, so - this will work, but it's not nice. */ - static_ldap_state = ldap_state; - - /* get the password */ - if (!fetch_ldapsam_pw(&ldap_dn, &ldap_secret)) - { - DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n")); - return LDAP_INVALID_CREDENTIALS; - } - - ldap_state->bind_dn = ldap_dn; - ldap_state->bind_secret = ldap_secret; - - /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite - (OpenLDAP) doesnt' seem to support it */ - - DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n", - ldap_state->uri, ldap_dn)); - -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(ldap_struct, &rebindproc_connect); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state); -# endif -#else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(ldap_struct, &rebindproc); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state); -# endif -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - - rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret); - - if (rc != LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - DEBUG(0, - ("failed to bind to server with dn= %s Error: %s\n\t%s\n", - ldap_dn ? ld_error : "(unknown)", ldap_err2string(rc), - ld_error)); - SAFE_FREE(ld_error); - return rc; - } - - DEBUG(2, ("ldap_connect_system: succesful connection to the LDAP server\n")); - return rc; -} - -/********************************************************************** -Connect to LDAP server -*********************************************************************/ -static int ldapsam_open(struct ldapsam_privates *ldap_state) -{ - int rc; - SMB_ASSERT(ldap_state); - -#ifndef NO_LDAP_SECURITY - if (geteuid() != 0) { - DEBUG(0, ("ldapsam_open: cannot access LDAP when not root..\n")); - return LDAP_INSUFFICIENT_ACCESS; - } -#endif - - if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + LDAPSAM_DONT_PING_TIME) < time(NULL))) { - struct sockaddr_un addr; - socklen_t len; - int sd; - if (ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd) == 0 && - getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { - /* the other end has died. reopen. */ - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - ldap_state->last_ping = (time_t)0; - } else { - ldap_state->last_ping = time(NULL); - } - } - - if (ldap_state->ldap_struct != NULL) { - DEBUG(5,("ldapsam_open: allready connected to the LDAP server\n")); - return LDAP_SUCCESS; - } - - if ((rc = ldapsam_open_connection(ldap_state, &ldap_state->ldap_struct))) { - return rc; - } - - if ((rc = ldapsam_connect_system(ldap_state, ldap_state->ldap_struct))) { - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - return rc; - } - - - ldap_state->last_ping = time(NULL); - DEBUG(4,("The LDAP server is succesful connected\n")); - - return LDAP_SUCCESS; -} - -/********************************************************************** -Disconnect from LDAP server -*********************************************************************/ -static NTSTATUS ldapsam_close(struct ldapsam_privates *ldap_state) -{ - if (!ldap_state) - return NT_STATUS_INVALID_PARAMETER; - - if (ldap_state->ldap_struct != NULL) { - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - } - - DEBUG(5,("The connection to the LDAP server was closed\n")); - /* maybe free the results here --metze */ - - return NT_STATUS_OK; -} - -static int ldapsam_retry_open(struct ldapsam_privates *ldap_state, int *attempts) -{ - int rc; - - SMB_ASSERT(ldap_state && attempts); - - if (*attempts != 0) { - /* we retry after 0.5, 2, 4.5, 8, 12.5, 18, 24.5 seconds */ - msleep((((*attempts)*(*attempts))/2)*1000); - } - (*attempts)++; - - if ((rc = ldapsam_open(ldap_state))) { - DEBUG(0,("Connection to LDAP Server failed for the %d try!\n",*attempts)); - return rc; - } - - return LDAP_SUCCESS; -} - - -static int ldapsam_search(struct ldapsam_privates *ldap_state, - const char *base, int scope, const char *filter, - const char *attrs[], int attrsonly, - LDAPMessage **res) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - SMB_ASSERT(ldap_state); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_search_s(ldap_state->ldap_struct, base, scope, - filter, attrs, attrsonly, res); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - return rc; -} - -static int ldapsam_modify(struct ldapsam_privates *ldap_state, char *dn, LDAPMod *attrs[]) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_modify_s(ldap_state->ldap_struct, dn, attrs); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - return rc; -} - -static int ldapsam_add(struct ldapsam_privates *ldap_state, const char *dn, LDAPMod *attrs[]) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_add_s(ldap_state->ldap_struct, dn, attrs); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - return rc; -} - -static int ldapsam_delete(struct ldapsam_privates *ldap_state, char *dn) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_delete_s(ldap_state->ldap_struct, dn); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - return rc; -} - -static int ldapsam_extended_operation(struct ldapsam_privates *ldap_state, LDAP_CONST char *reqoid, struct berval *reqdata, LDAPControl **serverctrls, LDAPControl **clientctrls, char **retoidp, struct berval **retdatap) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid, reqdata, serverctrls, clientctrls, retoidp, retdatap); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - return rc; -} - /******************************************************************* run the search by name. ******************************************************************/ -static int ldapsam_search_one_user (struct ldapsam_privates *ldap_state, const char *filter, LDAPMessage ** result) +static int ldapsam_search_one_user (struct smb_ldap_privates *ldap_state, const char *filter, LDAPMessage ** result) { int scope = LDAP_SCOPE_SUBTREE; int rc; DEBUG(2, ("ldapsam_search_one_user: searching for:[%s]\n", filter)); - rc = ldapsam_search(ldap_state, lp_ldap_suffix (), scope, filter, attr, 0, result); + rc = smb_ldap_search(ldap_state, lp_ldap_suffix (), scope, filter, attr, 0, result); if (rc != LDAP_SUCCESS) { char *ld_error = NULL; @@ -665,7 +164,7 @@ static int ldapsam_search_one_user (struct ldapsam_privates *ldap_state, const c /******************************************************************* run the search by name. ******************************************************************/ -static int ldapsam_search_one_user_by_name (struct ldapsam_privates *ldap_state, const char *user, +static int ldapsam_search_one_user_by_name (struct smb_ldap_privates *ldap_state, const char *user, LDAPMessage ** result) { pstring filter; @@ -696,7 +195,7 @@ static int ldapsam_search_one_user_by_name (struct ldapsam_privates *ldap_state, /******************************************************************* run the search by uid. ******************************************************************/ -static int ldapsam_search_one_user_by_uid(struct ldapsam_privates *ldap_state, +static int ldapsam_search_one_user_by_uid(struct smb_ldap_privates *ldap_state, int uid, LDAPMessage ** result) { @@ -730,7 +229,7 @@ static int ldapsam_search_one_user_by_uid(struct ldapsam_privates *ldap_state, /******************************************************************* run the search by rid. ******************************************************************/ -static int ldapsam_search_one_user_by_rid (struct ldapsam_privates *ldap_state, +static int ldapsam_search_one_user_by_rid (struct smb_ldap_privates *ldap_state, uint32 rid, LDAPMessage ** result) { @@ -750,111 +249,11 @@ static int ldapsam_search_one_user_by_rid (struct ldapsam_privates *ldap_state, return rc; } -/******************************************************************* -search an attribute and return the first value found. -******************************************************************/ -static BOOL get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, - const char *attribute, pstring value) -{ - char **values; - - if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) { - value = NULL; - DEBUG (10, ("get_single_attribute: [%s] = []\n", attribute)); - - return False; - } - - pstrcpy(value, values[0]); - ldap_value_free(values); -#ifdef DEBUG_PASSWORDS - DEBUG (100, ("get_single_attribute: [%s] = [%s]\n", attribute, value)); -#endif - return True; -} - -/************************************************************************ -Routine to manage the LDAPMod structure array -manage memory used by the array, by each struct, and values - -************************************************************************/ -static void make_a_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value) -{ - LDAPMod **mods; - int i; - int j; - - mods = *modlist; - - if (attribute == NULL || *attribute == '\0') - return; - -#if 0 - /* Why do we need this??? -- vl */ - if (value == NULL || *value == '\0') - return; -#endif - - if (mods == NULL) - { - mods = (LDAPMod **) malloc(sizeof(LDAPMod *)); - if (mods == NULL) - { - DEBUG(0, ("make_a_mod: out of memory!\n")); - return; - } - mods[0] = NULL; - } - - for (i = 0; mods[i] != NULL; ++i) { - if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute)) - break; - } - - if (mods[i] == NULL) - { - mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *)); - if (mods == NULL) - { - DEBUG(0, ("make_a_mod: out of memory!\n")); - return; - } - mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod)); - if (mods[i] == NULL) - { - DEBUG(0, ("make_a_mod: out of memory!\n")); - return; - } - mods[i]->mod_op = modop; - mods[i]->mod_values = NULL; - mods[i]->mod_type = strdup(attribute); - mods[i + 1] = NULL; - } - - if (value != NULL) - { - j = 0; - if (mods[i]->mod_values != NULL) { - for (; mods[i]->mod_values[j] != NULL; j++); - } - mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values, - (j + 2) * sizeof (char *)); - - if (mods[i]->mod_values == NULL) { - DEBUG (0, ("make_a_mod: Memory allocation failure!\n")); - return; - } - mods[i]->mod_values[j] = strdup(value); - mods[i]->mod_values[j + 1] = NULL; - } - *modlist = mods; -} - /******************************************************************* Delete complete object or objectclass and attrs from object found in search_result depending on lp_ldap_delete_dn ******************************************************************/ -static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, +static NTSTATUS ldapsam_delete_entry(struct smb_ldap_privates *ldap_state, LDAPMessage *result, const char *objectclass, const char **attrs) @@ -877,7 +276,7 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, if (lp_ldap_delete_dn()) { NTSTATUS ret = NT_STATUS_OK; - rc = ldapsam_delete(ldap_state, dn); + rc = smb_ldap_delete(ldap_state, dn); if (rc != LDAP_SUCCESS) { DEBUG(0, ("Could not delete object %s\n", dn)); @@ -901,7 +300,7 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, for (attrib = attrs; *attrib != NULL; attrib++) { if (StrCaseCmp(*attrib, name) == 0) { DEBUG(10, ("deleting attribute %s\n", name)); - make_a_mod(&mods, LDAP_MOD_DELETE, name, NULL); + smb_ldap_make_a_mod(&mods, LDAP_MOD_DELETE, name, NULL); } } @@ -912,9 +311,9 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, ber_free(ptr, 0); } - make_a_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass); + smb_ldap_make_a_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass); - rc = ldapsam_modify(ldap_state, dn, mods); + rc = smb_ldap_modify(ldap_state, dn, mods); ldap_mods_free(mods, 1); if (rc != LDAP_SUCCESS) { @@ -938,7 +337,7 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, /********************************************************************** Initialize SAM_ACCOUNT from an LDAP query (unix attributes only) *********************************************************************/ -static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, +static BOOL get_unix_attributes (struct smb_ldap_privates *ldap_state, SAM_ACCOUNT * sampass, LDAPMessage * entry) { @@ -967,15 +366,15 @@ static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, } ldap_value_free(ldap_values); - if (!get_single_attribute(ldap_state->ldap_struct, entry, "homeDirectory", homedir)) + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "homeDirectory", homedir)) return False; - if (!get_single_attribute(ldap_state->ldap_struct, entry, "uidNumber", temp)) + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "uidNumber", temp)) return False; uid = (uid_t)atol(temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, "gidNumber", temp)) + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "gidNumber", temp)) return False; gid = (gid_t)atol(temp); @@ -993,7 +392,7 @@ static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, Initialize SAM_ACCOUNT from an LDAP query (Based on init_sam_from_buffer in pdb_tdb.c) *********************************************************************/ -static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, +static BOOL init_sam_from_ldap (struct smb_ldap_privates *ldap_state, SAM_ACCOUNT * sampass, LDAPMessage * entry) { @@ -1054,7 +453,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, return False; } - get_single_attribute(ldap_state->ldap_struct, entry, "uid", username); + smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "uid", username); DEBUG(2, ("Entry found for user: %s\n", username)); pstrcpy(nt_username, username); @@ -1066,12 +465,12 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_domain(sampass, domain, PDB_DEFAULT); pdb_set_nt_username(sampass, nt_username, PDB_SET); - get_single_attribute(ldap_state->ldap_struct, entry, "rid", temp); + smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "rid", temp); user_rid = (uint32)atol(temp); pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET); - if (!get_single_attribute(ldap_state->ldap_struct, entry, "primaryGroupID", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "primaryGroupID", temp)) { group_rid = 0; } else { group_rid = (uint32)atol(temp); @@ -1119,42 +518,42 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "pwdLastSet", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "pwdLastSet", temp)) { /* leave as default */ } else { pass_last_set_time = (time_t) atol(temp); pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "logonTime", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "logonTime", temp)) { /* leave as default */ } else { logon_time = (time_t) atol(temp); pdb_set_logon_time(sampass, logon_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "logoffTime", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "logoffTime", temp)) { /* leave as default */ } else { logoff_time = (time_t) atol(temp); pdb_set_logoff_time(sampass, logoff_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "kickoffTime", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "kickoffTime", temp)) { /* leave as default */ } else { kickoff_time = (time_t) atol(temp); pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "pwdCanChange", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "pwdCanChange", temp)) { /* leave as default */ } else { pass_can_change_time = (time_t) atol(temp); pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "pwdMustChange", temp)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "pwdMustChange", temp)) { /* leave as default */ } else { pass_must_change_time = (time_t) atol(temp); @@ -1167,9 +566,9 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, * that fits your needs; using cn then displayName rather than 'userFullName' */ - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "displayName", fullname)) { - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "cn", fullname)) { /* leave as default */ } else { @@ -1179,7 +578,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_fullname(sampass, fullname, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "homeDrive", dir_drive)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "homeDrive", dir_drive)) { pdb_set_dir_drive(sampass, talloc_sub_specified(sampass->mem_ctx, lp_logon_drive(), username, domain, @@ -1189,7 +588,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_dir_drive(sampass, dir_drive, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "smbHome", homedir)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "smbHome", homedir)) { pdb_set_homedir(sampass, talloc_sub_specified(sampass->mem_ctx, lp_logon_home(), username, domain, @@ -1199,7 +598,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_homedir(sampass, homedir, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "scriptPath", logon_script)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "scriptPath", logon_script)) { pdb_set_logon_script(sampass, talloc_sub_specified(sampass->mem_ctx, lp_logon_script(), username, domain, @@ -1209,7 +608,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_logon_script(sampass, logon_script, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "profilePath", profile_path)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "profilePath", profile_path)) { pdb_set_profile_path(sampass, talloc_sub_specified(sampass->mem_ctx, lp_logon_path(), username, domain, @@ -1219,13 +618,13 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_profile_path(sampass, profile_path, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "description", acct_desc)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "description", acct_desc)) { /* leave as default */ } else { pdb_set_acct_desc(sampass, acct_desc, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "userWorkstations", workstations)) { + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "userWorkstations", workstations)) { /* leave as default */; } else { pdb_set_workstations(sampass, workstations, PDB_SET); @@ -1237,7 +636,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, hours_len = 21; memset(hours, 0xff, hours_len); - if (!get_single_attribute (ldap_state->ldap_struct, entry, "lmPassword", temp)) { + if (!smb_ldap_get_single_attribute (ldap_state->ldap_struct, entry, "lmPassword", temp)) { /* leave as default */ } else { pdb_gethexpwd(temp, smblmpwd); @@ -1247,7 +646,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, ZERO_STRUCT(smblmpwd); } - if (!get_single_attribute (ldap_state->ldap_struct, entry, "ntPassword", temp)) { + if (!smb_ldap_get_single_attribute (ldap_state->ldap_struct, entry, "ntPassword", temp)) { /* leave as default */ } else { pdb_gethexpwd(temp, smbntpwd); @@ -1257,7 +656,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, ZERO_STRUCT(smbntpwd); } - if (!get_single_attribute (ldap_state->ldap_struct, entry, "acctFlags", temp)) { + if (!smb_ldap_get_single_attribute (ldap_state->ldap_struct, entry, "acctFlags", temp)) { acct_ctrl |= ACB_NORMAL; } else { acct_ctrl = pdb_decode_acct_ctrl(temp); @@ -1325,7 +724,7 @@ static void make_ldap_mod(LDAP *ldap_struct, LDAPMessage *existing, the old value, should it exist. */ if ((newval != NULL) && (strlen(newval) > 0)) { - make_a_mod(mods, LDAP_MOD_ADD, attribute, newval); + smb_ldap_make_a_mod(mods, LDAP_MOD_ADD, attribute, newval); } if (values == NULL) { @@ -1340,7 +739,7 @@ static void make_ldap_mod(LDAP *ldap_struct, LDAPMessage *existing, deny the complete operation if somebody changed the attribute behind our back. */ - make_a_mod(mods, LDAP_MOD_DELETE, attribute, values[0]); + smb_ldap_make_a_mod(mods, LDAP_MOD_DELETE, attribute, values[0]); ldap_value_free(values); } @@ -1348,7 +747,7 @@ static void make_ldap_mod(LDAP *ldap_struct, LDAPMessage *existing, Initialize SAM_ACCOUNT from an LDAP query (Based on init_buffer_from_sam in pdb_tdb.c) *********************************************************************/ -static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, +static BOOL init_ldap_from_sam (struct smb_ldap_privates *ldap_state, LDAPMessage *existing, LDAPMod *** mods, const SAM_ACCOUNT * sampass, BOOL (*need_update)(const SAM_ACCOUNT *, @@ -1534,7 +933,7 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, /********************************************************************** Connect to LDAP server and find the next available RID. *********************************************************************/ -static uint32 check_nua_rid_is_avail(struct ldapsam_privates *ldap_state, uint32 top_rid) +static uint32 check_nua_rid_is_avail(struct smb_ldap_privates *ldap_state, uint32 top_rid) { LDAPMessage *result; uint32 final_rid = (top_rid & (~USER_RID_TYPE)) + RID_MULTIPLIER; @@ -1565,7 +964,7 @@ static uint32 check_nua_rid_is_avail(struct ldapsam_privates *ldap_state, uint32 /********************************************************************** Extract the RID from an LDAP entry *********************************************************************/ -static uint32 entry_to_user_rid(struct ldapsam_privates *ldap_state, LDAPMessage *entry) { +static uint32 entry_to_user_rid(struct smb_ldap_privates *ldap_state, LDAPMessage *entry) { uint32 rid; SAM_ACCOUNT *user = NULL; if (!NT_STATUS_IS_OK(pdb_init_sam(&user))) { @@ -1588,7 +987,7 @@ static uint32 entry_to_user_rid(struct ldapsam_privates *ldap_state, LDAPMessage /********************************************************************** Connect to LDAP server and find the next available RID. *********************************************************************/ -static uint32 search_top_nua_rid(struct ldapsam_privates *ldap_state) +static uint32 search_top_nua_rid(struct smb_ldap_privates *ldap_state) { int rc; pstring filter; @@ -1609,7 +1008,7 @@ static uint32 search_top_nua_rid(struct ldapsam_privates *ldap_state) #endif DEBUG(2, ("ldapsam_get_next_available_nua_rid: searching for:[%s]\n", final_filter)); - rc = ldapsam_search(ldap_state, lp_ldap_suffix(), + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), LDAP_SCOPE_SUBTREE, final_filter, attr, 0, &result); @@ -1658,7 +1057,7 @@ static uint32 search_top_nua_rid(struct ldapsam_privates *ldap_state) /********************************************************************** Connect to LDAP server and find the next available RID. *********************************************************************/ -static uint32 ldapsam_get_next_available_nua_rid(struct ldapsam_privates *ldap_state) { +static uint32 ldapsam_get_next_available_nua_rid(struct smb_ldap_privates *ldap_state) { uint32 next_nua_rid; uint32 top_nua_rid; @@ -1675,14 +1074,14 @@ Connect to LDAP server for password enumeration *********************************************************************/ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) { - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; int rc; pstring filter; pstrcpy(filter, lp_ldap_filter()); all_string_sub(filter, "%u", "*", sizeof(pstring)); - rc = ldapsam_search(ldap_state, lp_ldap_suffix(), + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), LDAP_SCOPE_SUBTREE, filter, attr, 0, &ldap_state->result); @@ -1710,7 +1109,7 @@ End enumeration of the LDAP password list *********************************************************************/ static void ldapsam_endsampwent(struct pdb_methods *my_methods) { - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; if (ldap_state->result) { ldap_msgfree(ldap_state->result); ldap_state->result = NULL; @@ -1723,13 +1122,9 @@ Get the next entry in the LDAP password database static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT *user) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; BOOL bret = False; - /* The rebind proc needs this *HACK*. We are not multithreaded, so - this will work, but it's not nice. */ - static_ldap_state = ldap_state; - while (!bret) { if (!ldap_state->entry) return ret; @@ -1750,7 +1145,7 @@ Get SAM_ACCOUNT entry from LDAP by username static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT *user, const char *sname) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; LDAPMessage *result; LDAPMessage *entry; int count; @@ -1794,8 +1189,8 @@ Get SAM_ACCOUNT entry from LDAP by rid static NTSTATUS ldapsam_getsampwrid(struct pdb_methods *my_methods, SAM_ACCOUNT *user, uint32 rid) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = - (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = + (struct smb_ldap_privates *)my_methods->private_data; LDAPMessage *result; LDAPMessage *entry; int count; @@ -1850,7 +1245,7 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, SAM_ACCOUNT *newpwd, char *dn, LDAPMod **mods, int ldap_op, BOOL pdb_add) { - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; int rc; if (!my_methods || !newpwd || !dn) { @@ -1864,11 +1259,11 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, switch(ldap_op) { case LDAP_MOD_ADD: - make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", "account"); - rc = ldapsam_add(ldap_state, dn, mods); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", "account"); + rc = smb_ldap_add(ldap_state, dn, mods); break; case LDAP_MOD_REPLACE: - rc = ldapsam_modify(ldap_state, dn ,mods); + rc = smb_ldap_modify(ldap_state, dn ,mods); break; default: DEBUG(0,("Wrong LDAP operation type: %d!\n", ldap_op)); @@ -1915,7 +1310,7 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, ber_free(ber,1); - if ((rc = ldapsam_extended_operation(ldap_state, LDAP_EXOP_X_MODIFY_PASSWD, + if ((rc = smb_ldap_extended_operation(ldap_state, LDAP_EXOP_X_MODIFY_PASSWD, bv, NULL, NULL, &retoid, &retdata))!=LDAP_SUCCESS) { DEBUG(0,("LDAP Password could not be changed for user %s: %s\n", pdb_get_username(newpwd),ldap_err2string(rc))); @@ -1938,7 +1333,7 @@ Delete entry from LDAP for username *********************************************************************/ static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * sam_acct) { - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; const char *sname; int rc; LDAPMessage *result; @@ -1985,7 +1380,7 @@ Update SAM_ACCOUNT static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; int rc; char *dn; LDAPMessage *result; @@ -2057,7 +1452,7 @@ Add SAM_ACCOUNT to LDAP static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; int rc; pstring filter; LDAPMessage *result = NULL; @@ -2136,7 +1531,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO return NT_STATUS_UNSUCCESSFUL; } - make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", "sambaAccount"); + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", "sambaAccount"); ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, True); if (NT_STATUS_IS_ERR(ret)) { @@ -2153,15 +1548,15 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO static void free_private_data(void **vp) { - struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp; + struct smb_ldap_privates **ldap_state = (struct smb_ldap_privates **)vp; - ldapsam_close(*ldap_state); + smb_ldap_close(*ldap_state); if ((*ldap_state)->bind_secret) { memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret)); } - ldapsam_close(*ldap_state); + smb_ldap_close(*ldap_state); SAFE_FREE((*ldap_state)->bind_dn); SAFE_FREE((*ldap_state)->bind_secret); @@ -2176,7 +1571,7 @@ static const char *group_attr[] = {"cn", "ntSid", "ntGroupType", "displayName", "description", NULL }; -static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state, +static int ldapsam_search_one_group (struct smb_ldap_privates *ldap_state, const char *filter, LDAPMessage ** result) { @@ -2185,7 +1580,7 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state, DEBUG(2, ("ldapsam_search_one_group: searching for:[%s]\n", filter)); - rc = ldapsam_search(ldap_state, lp_ldap_suffix (), scope, + rc = smb_ldap_search(ldap_state, lp_ldap_suffix (), scope, filter, group_attr, 0, result); if (rc != LDAP_SUCCESS) { @@ -2203,7 +1598,7 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state, return rc; } -static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, +static BOOL init_group_from_ldap(struct smb_ldap_privates *ldap_state, GROUP_MAP *map, LDAPMessage *entry) { pstring temp; @@ -2214,7 +1609,7 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, return False; } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "gidNumber", + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "gidNumber", temp)) { DEBUG(0, ("Mandatory attribute gidNumber not found\n")); return False; @@ -2223,14 +1618,14 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, map->gid = (gid_t)atol(temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, "ntSid", + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "ntSid", temp)) { DEBUG(0, ("Mandatory attribute ntSid not found\n")); return False; } string_to_sid(&map->sid, temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, "ntGroupType", + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "ntGroupType", temp)) { DEBUG(0, ("Mandatory attribute ntGroupType not found\n")); return False; @@ -2243,11 +1638,11 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, return False; } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "displayName", + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "displayName", temp)) { DEBUG(3, ("Attribute displayName not found\n")); temp[0] = '\0'; - if (!get_single_attribute(ldap_state->ldap_struct, entry, "cn", + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "cn", temp)) { DEBUG(0, ("Attributes cn not found either " "for gidNumber(%i)\n",map->gid)); @@ -2256,7 +1651,7 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, } fstrcpy(map->nt_name, temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, "description", + if (!smb_ldap_get_single_attribute(ldap_state->ldap_struct, entry, "description", temp)) { DEBUG(3, ("Attribute description not found\n")); temp[0] = '\0'; @@ -2298,8 +1693,8 @@ static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods, const char *filter, GROUP_MAP *map) { - struct ldapsam_privates *ldap_state = - (struct ldapsam_privates *)methods->private_data; + struct smb_ldap_privates *ldap_state = + (struct smb_ldap_privates *)methods->private_data; LDAPMessage *result; LDAPMessage *entry; int count; @@ -2378,7 +1773,7 @@ static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map, return ldapsam_getgroup(methods, filter, map); } -static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state, +static int ldapsam_search_one_group_by_gid(struct smb_ldap_privates *ldap_state, gid_t gid, LDAPMessage **result) { @@ -2393,8 +1788,8 @@ static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state, static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, GROUP_MAP *map) { - struct ldapsam_privates *ldap_state = - (struct ldapsam_privates *)methods->private_data; + struct smb_ldap_privates *ldap_state = + (struct smb_ldap_privates *)methods->private_data; LDAPMessage *result = NULL; LDAPMod **mods = NULL; @@ -2444,10 +1839,10 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, return NT_STATUS_UNSUCCESSFUL; } - make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", + smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", "sambaGroupMapping"); - rc = ldapsam_modify(ldap_state, dn, mods); + rc = smb_ldap_modify(ldap_state, dn, mods); ldap_mods_free(mods, 1); if (rc != LDAP_SUCCESS) { @@ -2467,8 +1862,8 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, GROUP_MAP *map) { - struct ldapsam_privates *ldap_state = - (struct ldapsam_privates *)methods->private_data; + struct smb_ldap_privates *ldap_state = + (struct smb_ldap_privates *)methods->private_data; int rc; char *dn; LDAPMessage *result; @@ -2504,7 +1899,7 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, return NT_STATUS_UNSUCCESSFUL; } - rc = ldapsam_modify(ldap_state, dn, mods); + rc = smb_ldap_modify(ldap_state, dn, mods); ldap_mods_free(mods, 1); @@ -2524,8 +1919,8 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods, DOM_SID sid) { - struct ldapsam_privates *ldap_state = - (struct ldapsam_privates *)methods->private_data; + struct smb_ldap_privates *ldap_state = + (struct smb_ldap_privates *)methods->private_data; pstring sidstring, filter; LDAPMessage *result; int rc; @@ -2553,12 +1948,12 @@ static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods, static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update) { - struct ldapsam_privates *ldap_state = - (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = + (struct smb_ldap_privates *)my_methods->private_data; const char *filter = "(objectClass=sambaGroupMapping)"; int rc; - rc = ldapsam_search(ldap_state, lp_ldap_suffix(), + rc = smb_ldap_search(ldap_state, lp_ldap_suffix(), LDAP_SCOPE_SUBTREE, filter, group_attr, 0, &ldap_state->result); @@ -2590,13 +1985,9 @@ static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods, GROUP_MAP *map) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + struct smb_ldap_privates *ldap_state = (struct smb_ldap_privates *)my_methods->private_data; BOOL bret = False; - /* The rebind proc needs this *HACK*. We are not multithreaded, so - this will work, but it's not nice. */ - static_ldap_state = ldap_state; - while (!bret) { if (!ldap_state->entry) return ret; @@ -2664,7 +2055,7 @@ static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods, NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) { NTSTATUS nt_status; - struct ldapsam_privates *ldap_state; + struct smb_ldap_privates *ldap_state; if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) { return nt_status; @@ -2691,7 +2082,7 @@ NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, co /* TODO: Setup private data and free */ - ldap_state = talloc_zero(pdb_context->mem_ctx, sizeof(struct ldapsam_privates)); + ldap_state = talloc_zero(pdb_context->mem_ctx, sizeof(struct smb_ldap_privates)); if (!ldap_state) { DEBUG(0, ("talloc() failed for ldapsam private_data!\n")); @@ -2729,7 +2120,7 @@ NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, co NTSTATUS pdb_init_ldapsam_nua(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) { NTSTATUS nt_status; - struct ldapsam_privates *ldap_state; + struct smb_ldap_privates *ldap_state; uint32 low_nua_uid, high_nua_uid; if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam(pdb_context, pdb_method, location))) { -- cgit From b5989bdb1c5b3bb40e993f8ced85696c27e498dc Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Thu, 3 Apr 2003 06:16:53 +0000 Subject: Fix a compile warning in slprintf format string. Possible typo: winbind_idmap_methods -> winbindd_idmap_methods Fix wrong format char when generating a ldap filter string. (This used to be commit f9cb23e68753337676876b97b145e04ad423e184) --- source3/nsswitch/winbindd_idmap_ldap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source3/nsswitch/winbindd_idmap_ldap.c b/source3/nsswitch/winbindd_idmap_ldap.c index b0b260e34d..7ffddf9ac4 100644 --- a/source3/nsswitch/winbindd_idmap_ldap.c +++ b/source3/nsswitch/winbindd_idmap_ldap.c @@ -77,7 +77,7 @@ static long ldap_allocate_id(BOOL is_user) smb_ldap_make_a_mod(&mods, LDAP_MOD_DELETE, is_user?"uidNumber":"gidNumber", temp); - slprintf(temp, sizeof(temp) - 1, "%i", ret + 1); + slprintf(temp, sizeof(temp) - 1, "%ld", ret + 1); smb_ldap_make_a_mod(&mods, LDAP_MOD_ADD, is_user?"uidNumber":"gidNumber", temp); slprintf(temp, sizeof(temp) - 1, "cn=%cID Pool,%s", is_user?'U':'G', lp_ldap_user_suffix()); rc = smb_ldap_modify(ldap_state, temp, mods); @@ -305,7 +305,7 @@ static BOOL ldap_get_gid_from_sid(DOM_SID *sid, gid_t *gid) sid_to_string(str_sid, sid); - slprintf(filter, sizeof(filter) - 1, "ntSid=%d,objectClass=sambaGroupMapping", str_sid); + slprintf(filter, sizeof(filter) - 1, "ntSid=%s,objectClass=sambaGroupMapping", str_sid); DEBUG(2, ("ldap_get_gid_from_sid: searching for:[%s]\n", filter)); @@ -365,7 +365,7 @@ static void ldap_idmap_status(void) DEBUG(0, ("Using LDAP\n")); } -struct winbind_idmap_methods ldap_idmap_methods = { +struct winbindd_idmap_methods ldap_idmap_methods = { ldap_idmap_init, ldap_get_sid_from_uid, @@ -381,7 +381,7 @@ struct winbind_idmap_methods ldap_idmap_methods = { #endif -BOOL winbind_idmap_reg_ldap(struct winbind_idmap_methods **meth) +BOOL winbind_idmap_reg_ldap(struct winbindd_idmap_methods **meth) { #ifdef HAVE_LDAP *meth = &ldap_idmap_methods; -- cgit From 536eda24033cadebb7db47e5affa9a6d118ea109 Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Thu, 3 Apr 2003 09:50:33 +0000 Subject: More doco updates. Another few days and it will be cooked. (This used to be commit 79e66288f96b029208d11b3aa095002de9447020) --- docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 759 +------------------------ docs/docbook/projdoc/PolicyMgmt.sgml | 261 +++++++++ docs/docbook/projdoc/ProfileMgmt.sgml | 631 ++++++++++++++++++++ docs/docbook/projdoc/samba-doc.sgml | 4 + 4 files changed, 914 insertions(+), 741 deletions(-) create mode 100644 docs/docbook/projdoc/PolicyMgmt.sgml create mode 100644 docs/docbook/projdoc/ProfileMgmt.sgml diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml index 5180901fd3..18fda67123 100644 --- a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -9,772 +9,49 @@ - - - April 1 2003 + April 3 2003 -System Policies +Advanced Network Manangement Information -Basic System Policy Info - - -Much of the information necessary to implement System Policies and -Roaming User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft. - - - -Here are some additional details: - - - - - - What about Windows NT Policy Editor? - - - - To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - - - - The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - - - - - - Can Win95 do Policies? - - - - Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... - - - - If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. - - - - - - How do I get 'User Manager' and 'Server Manager' - - - - Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? - - - - Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes - - - - Server Manager - - User Manager for Domains - - Event Viewer - - - - Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE - - - - The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE - - - - - -Creating Group Prolicy Files - - -Windows '9x - -You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -tools/reskit/netadmin/poledit. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab. - - - -Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the My Documents etc. -stuff. You then save these settings in a file called -Config.POL that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on. - - - -All of this is covered in the Win98 Resource Kit documentation. - - - -If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings. - - - - - - - -Roaming Profiles - - - -NOTE! Roaming profiles support is different for Win9X and WinNT. - - - - -Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features. - - - -Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory. - - - - -WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT. - - - -Windows NT Configuration - - -To support WinNT clients, in the [global] section of smb.conf set the -following (for example): - - - -logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath - - - -The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable. - - - - -MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes -meta-service name as part of the profile share path. - - - - - - -Windows 9X Configuration - - -To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use /home" now works as well, and it, too, relies -on the "logon home" parameter. - - - -By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file: - - - -logon home = \\%L\%U\.profiles - - - -then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). - - - -Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home". - - - - - - -Win9X and WinNT Configuration - - -You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example: - - - -logon home = \\%L\%U\.profiles -logon path = \\%L\profiles\%U - - - - -I have not checked what 'net use /home' does on NT when "logon home" is -set as above. - - - - - -Windows 9X Profile Setup - - -When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders. - - - -The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file. - - - - - - On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. - - - - - - - On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. - - - - - - -Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me. - - - -You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password. - - - -Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'. - - - -Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created. - - - -These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set. - - - -If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server. - - - -If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". - - - - - - instead of logging in under the [user, password, domain] dialog, - press escape. - - - - - - run the regedit.exe program, and look in: - - - - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList - - - - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - +Remote Server Administration - - [Exit the registry editor]. - - - - - - WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). - - - - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. - - - - - - search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. - - - - - - - log off the windows 95 client. - - - - - - check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. - - - - - - -If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports. - - - -If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace. - - - - - -Windows NT Workstation 4.0 - - -When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter. - - - -There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter. - - - -The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.) - -In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown. +How do I get 'User Manager' and 'Server Manager' -You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one. +Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', +the 'Server Manager'? -The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. - - - - - -Windows NT/200x Server - - -There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords. - - - - - -Sharing Profiles between W9x/Me and NT4/200x/XP workstations - - -Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows. - - - -If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. - - - -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. - - - - - - -Windows NT 4 - - -Unfortunately, the Resource Kit info is Win NT4 or 200x specific. - - - -Here is a quick guide: +Microsoft distributes a version of these tools called nexus for installation on Windows 95 +systems. The tools set includes: + Server Manager + + User Manager for Domains - -On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'. - - - -Select a user profile you want to migrate and click on it. - - -I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC. - - -Click the 'Copy To' button. - -In the box labelled 'Copy Profile to' add your new path, eg: -c:\temp\foobar - -Click on the button labelled 'Change' in the "Permitted to use" box. - -Click on the group 'Everyone' and then click OK. This closes the -'chose user' box. - -Now click OK. - - - -Follow the above for every profile you need to migrate. - - - -Side bar Notes - - -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page. - - -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. - - - - - -Mandatory profiles - - -The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN. - - - - - -moveuser.exe - - -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. - - - - - -Get SID - - -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. - - - -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList - - - -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. - - - - - - - -Windows 2000/XP - - -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: - - - - -Log on as the LOCAL workstation administrator. - - - -Right click on the 'My Computer' Icon, select 'Properties' - - - -Click on the 'User Profiles' tab - - - -Select the profile you wish to convert (click on it once) - - - -Click on the button 'Copy To' - - - -In the "Permitted to use" box, click on the 'Change' button. - - - -Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible. - - -You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword. - - - -To make the profile capable of being used by anyone select 'Everyone' - - - -Click OK. The Selection box will close. - - - -Now click on the 'Ok' button to create the profile in the path you -nominated. - + Event Viewer -Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool. +Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE - -Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. +The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE - - - - - -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is: -"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders" - -...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. - - - -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): - - - - - -On the XP workstation log in with an Administrator account. - - -Click: "Start", "Run" -Type: "mmc" -Click: "OK" - -A Microsoft Management Console should appear. -Click: File, "Add/Remove Snap-in...", "Add" -Double-Click: "Group Policy" -Click: "Finish", "Close" -Click: "OK" - -In the "Console Root" window: -Expand: "Local Computer Policy", "Computer Configuration", -"Administrative Templates", "System", "User Profiles" -Double-Click: "Do not check for user ownership of Roaming Profile -Folders" -Select: "Enabled" -Click: OK" - -Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed). - -Reboot - - - - + diff --git a/docs/docbook/projdoc/PolicyMgmt.sgml b/docs/docbook/projdoc/PolicyMgmt.sgml new file mode 100644 index 0000000000..d9d2495673 --- /dev/null +++ b/docs/docbook/projdoc/PolicyMgmt.sgml @@ -0,0 +1,261 @@ + + + + John HTerpstra + + Samba Team +
    + jht@samba.org +
    +     +     + April 3 2003 +     +Policy Management - Hows and Whys + + +System Policies + + +Under MS Windows platforms, particularly those following the release of MS Windows +NT4 and MS Windows 95) it is possible to create a type of file that would be placed +in the NETLOGON share of a domain controller. As the client logs onto the network +this file is read and the contents initiate changes to the registry of the client +machine. This file allows changes to be made to those parts of the registry that +affect users, groups of users, or machines. + + + +For MS Windows 9x/Me this file must be called Config.POL and may +be generated using a tool called poledit.exe, better known as the +Policy Editor. The policy editor was provided on the Windows 98 installation CD, but +dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +comments from MS Windows network administrators it would appear that this tool became +a part of the MS Windows Me Resource Kit. + + + +MS Windows NT4 Server products include the System Policy Editor +under the Start->Programs->Administrative Tools menu item. +For MS Windows NT4 and later clients this file must be called NTConfig.POL. + + + +New with the introduction of MS Windows 2000 was the Microsoft Management Console +or MMC. This tool is the new wave in the ever changing landscape of Microsoft +methods for management of network access and security. Every new Microsoft product +or technology seems to obsolete the old rules and to introduce newer and more +complex tools and methods. To Microsoft's credit though, the MMC does appear to +be a step forward, but improved functionality comes at a great price. + + + +Before embarking on the configuration of network and system policies it is highly +advisable to read the documentation available from Microsoft's web site from + +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. +There are a large number of documents in addition to this old one that should also +be read and understood. Try searching on the Microsoft web site for "Group Policies". + + + +What follows is a very discussion with some helpful notes. The information provided +here is incomplete - you are warned. + + + +Creating and Managing Windows 9x/Me Policies + + +You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. +It can be found on the Original full product Win98 installation CD under +tools/reskit/netadmin/poledit. You install this using the +Add/Remove Programs facility and then click on the 'Have Disk' tab. + + + +Use the Group Policy Editor to create a policy file that specifies the location of +user profiles and/or the My Documents etc. stuff. You then +save these settings in a file called Config.POL that needs to +be placed in the root of the [NETLOGON] share. If your Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the Win9x/Me registry +of the machine that is logging on. + + + +Further details are covered in the Win98 Resource Kit documentation. + + + +If you do not do it this way, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings. + + + +Install the group policy handler for Win9x to pick up group policies. Look on the +Win98 CD in \tools\reskit\netadmin\poledit. +Install group policies on a Win9x client by double-clicking +grouppol.inf. Log off and on again a couple of times and see +if Win98 picks up group policies. Unfortunately this needs to be done on every +Win9x/Me machine that uses group policies. + + + + +Creating and Managing Windows NT4 Style Policy Files + + +To create or edit ntconfig.pol you must use the NT Server +Policy Editor, poledit.exe which is included with NT4 Server +but not NT Workstation. There is a Policy Editor on a NT4 +Workstation but it is not suitable for creating Domain Policies. +Further, although the Windows 95 Policy Editor can be installed on an NT4 +Workstation/Server, it will not work with NT clients. However, the files from +the NT Server will run happily enough on an NT4 Workstation. + + + +You need poledit.exe, common.adm and winnt.adm. +It is convenient to put the two *.adm files in the c:\winnt\inf +directory which is where the binary will look for them unless told otherwise. Note also that that +directory is normally 'hidden'. + + + +The Windows NT policy editor is also included with the Service Pack 3 (and +later) for Windows NT 4.0. Extract the files using servicepackname /x, +i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, +poledit.exe and the associated template files (*.adm) should +be extracted as well. It is also possible to downloaded the policy template +files for Office97 and get a copy of the policy editor. Another possible +location is with the Zero Administration Kit available for download from Microsoft. + + + +Registry Tattoos + + +With NT4 style registry based policy changes, a large number of settings are not +automatically reversed as the user logs off. Since the settings that were in the +NTConfig.POL file were applied to the client machine registry and that apply to the +hive key HKEY_LOCAL_MACHINE are permanent until explicitly reveresd. This is known +as tattooing. It can have serious consequences down-stream and the administrator must +be extreemly careful not to lock out the ability to manage the machine at a later date. + + + + + + +Creating and Managing MS Windows 200x Policies + + +Windows NT4 System policies allows setting of registry parameters specific to +users, groups and computers (client workstations) that are members of the NT4 +style domain. Such policy file will work with MS Windows 2000 / XP clients also. + + + +New to MS Windows 2000 Microsoft introduced a new style of group policy that confers +a superset of capabilities compared with NT4 style policies. Obviously, the tool used +to create them is different, and the mechanism for implementing them is much changed. + + + +The older NT4 style registry based policies are known as Administrative Templates +in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security +configurations, enforce Internet Explorer browser settings, change and redirect aspects of the +users' desktop (including: the location of My Documents files (directory), as +well as intrinsics of where menu items will appear in the Start menu). An additional new +feature is the ability to make available particular software Windows applications to particular +users and/or groups. + + + +Remember: NT4 policy files are named NTConfig.POL and are stored in the root +of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password +and selects the domain name to which the logon will attempt to take place. During the logon +process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating +server, modifies the local registry values according to the settings in this file. + + + +Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of +a Windows 200x policy file is stored in the Active Directory itself and the other part is stored +in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active +Directory domain controllers. The part that is stored in the Active Directory itself is called the +group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is +known as the group policy template (GPT). + + + +With NT4 clients the policy file is read and executed upon only aas each user log onto the network. +MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine +startup (machine specific part) and when the user logs onto the network the user specific part +is applied. In MS Windows 200x style policy management each machine and/or user may be subject +to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows +the administrator to also set filters over the policy settings. No such equivalent capability +exists with NT4 style policy files. + + + +Administration of Win2K Policies + + +Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the +executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console +(MMC) snap-in as follows: + + + + + + Go to the Windows 200x / XP menu Start->Programs->Adminsitrative Tools + and select the MMC snap-in called "Active Directory Users and Computers" + + + + + + Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item. + + + + + + Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create. + + + + + + Now left click on the Edit tab to commence the steps needed to create the GPO. + + + + + +All policy configuration options are controlled through the use of policy administrative +templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. +Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. +The later introduces many new features as well as extended definition capabilities. It is +well beyond the scope of this documentation to explain how to program .adm files, for that +the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular +version of MS Windows. + + + + +The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used +to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you +use this powerful tool. Please refer to the resource kit manuals for specific usage information. + + + + + +     diff --git a/docs/docbook/projdoc/ProfileMgmt.sgml b/docs/docbook/projdoc/ProfileMgmt.sgml new file mode 100644 index 0000000000..ffbc65f767 --- /dev/null +++ b/docs/docbook/projdoc/ProfileMgmt.sgml @@ -0,0 +1,631 @@ + + + + John HTerpstra + + Samba Team +
    + jht@samba.org +
    +     +     + April 3 2003 +     + +Profile Management + + +Roaming Profiles + + + +NOTE! Roaming profiles support is different for Win9X and WinNT. + + + + +Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features. + + + +Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory. + + + + +WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT. + + + +Windows NT Configuration + + +To support WinNT clients, in the [global] section of smb.conf set the +following (for example): + + + +logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath + + + +The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable. + + + + +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path. + + + + + + +Windows 9X Configuration + + +To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter. + + + +By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file: + + +logon home = \\%L\%U\.profiles + + + +then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). + + + +Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home". + + + + + + +Win9X and WinNT Configuration + + +You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example: + + + +logon home = \\%L\%U\.profiles +logon path = \\%L\profiles\%U + + + + +I have not checked what 'net use /home' does on NT when "logon home" is +set as above. + + + + + +Windows 9X Profile Setup + + +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders. + + + +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. + + + + + + On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + + + + + + On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + + + + + + +Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me. + + + +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. + + + +Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'. + + + +Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created. + + + +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. + + + +If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. + + + +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". + + + + + + instead of logging in under the [user, password, domain] dialog, + press escape. + + + + + run the regedit.exe program, and look in: + + + + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + + + + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + + + + [Exit the registry editor]. + + + + + + WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). + + + + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + + + + + + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + + + + + + + log off the windows 95 client. + + + + + + check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + + + + + + +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports. + + + +If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace. + + + + + +Windows NT Workstation 4.0 + + +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter. + + + +There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter. + + + +The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) + + + +In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. + + + +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. + + + +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. + + + + + +Windows NT/200x Server + + +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. + + + + + +Sharing Profiles between W9x/Me and NT4/200x/XP workstations + + +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. + + + +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home. + + + +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. + + + + + + +Windows NT 4 + + +Unfortunately, the Resource Kit info is Win NT4 or 200x specific. + + + +Here is a quick guide: + + + + + +On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'. + + + +Select a user profile you want to migrate and click on it. + + +I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC. + + +Click the 'Copy To' button. + +In the box labelled 'Copy Profile to' add your new path, eg: +c:\temp\foobar + +Click on the button labelled 'Change' in the "Permitted to use" box. + +Click on the group 'Everyone' and then click OK. This closes the +'chose user' box. + +Now click OK. + + + +Follow the above for every profile you need to migrate. + + + +Side bar Notes + + +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page. + + +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. + + + + + +Mandatory profiles + + +The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN. + + + + + +moveuser.exe + + +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. + + + + + +Get SID + + +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. + + + +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList + + + +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. + + + + + + + +Windows 2000/XP + + +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: + + + + +Log on as the LOCAL workstation administrator. + + + +Right click on the 'My Computer' Icon, select 'Properties' + + + +Click on the 'User Profiles' tab + + + +Select the profile you wish to convert (click on it once) + + + +Click on the button 'Copy To' + + + +In the "Permitted to use" box, click on the 'Change' button. + + + +Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible. + + + +You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword. + + + +To make the profile capable of being used by anyone select 'Everyone' + + + +Click OK. The Selection box will close. + + + +Now click on the 'Ok' button to create the profile in the path you +nominated. + + + + +Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool. + + + + +Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. + + + + + + +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is: + +"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders" + +...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. + + + +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): + + + + + +On the XP workstation log in with an Administrator account. + + +Click: "Start", "Run" +Type: "mmc" +Click: "OK" + +A Microsoft Management Console should appear. +Click: File, "Add/Remove Snap-in...", "Add" +Double-Click: "Group Policy" +Click: "Finish", "Close" +Click: "OK" + +In the "Console Root" window: +Expand: "Local Computer Policy", "Computer Configuration", +"Administrative Templates", "System", "User Profiles" +Double-Click: "Do not check for user ownership of Roaming Profile +Folders" +Select: "Enabled" +Click: OK" + +Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed). + +Reboot + + + + + +     diff --git a/docs/docbook/projdoc/samba-doc.sgml b/docs/docbook/projdoc/samba-doc.sgml index c002214b77..db421bc690 100644 --- a/docs/docbook/projdoc/samba-doc.sgml +++ b/docs/docbook/projdoc/samba-doc.sgml @@ -27,6 +27,8 @@ + + ]> @@ -115,6 +117,8 @@ part each cover one specific feature. &PRINTER-DRIVER2; &CUPS; &WINBIND; +&PolicyMgmt; +&ProfileMgmt; &IntegratingWithWindows; &BROWSING; &MS-Dfs-Setup; -- cgit From 5a3e48d10060dfe952deb16111350dde7c55a54d Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 14:11:09 +0000 Subject: Fix typo (This used to be commit 028b05e1bb366fa075541177a253749bb38f5ea7) --- docs/docbook/projdoc/PolicyMgmt.sgml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docbook/projdoc/PolicyMgmt.sgml b/docs/docbook/projdoc/PolicyMgmt.sgml index d9d2495673..6eb3a09a97 100644 --- a/docs/docbook/projdoc/PolicyMgmt.sgml +++ b/docs/docbook/projdoc/PolicyMgmt.sgml @@ -236,7 +236,7 @@ executable name poledit.exe), GPOs are created and managed using a Microsoft Man Now left click on the Edit tab to commence the steps needed to create the GPO. - + All policy configuration options are controlled through the use of policy administrative -- cgit From 4a514a493f7cf7ff51f829ec465ed7583d535b7f Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 14:33:59 +0000 Subject: Remove compile info (This used to be commit 0aba351a6218ac4d33db7fbbfba4e8c3097cb68a) --- docs/docbook/projdoc/passdb.sgml | 32 ++++---------------------------- 1 file changed, 4 insertions(+), 28 deletions(-) diff --git a/docs/docbook/projdoc/passdb.sgml b/docs/docbook/projdoc/passdb.sgml index fa2d75bd34..8e7a409167 100644 --- a/docs/docbook/projdoc/passdb.sgml +++ b/docs/docbook/projdoc/passdb.sgml @@ -830,18 +830,6 @@ ntPassword: 878D8014606CDA29677A44EFA1353FC7 MySQL - -Building - -To build the plugin, run make bin/pdb_mysql.so -in the source/ directory of samba distribution. - - -Next, copy pdb_mysql.so to any location you want. I -strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/ - - - Creating the database @@ -862,7 +850,7 @@ contains the correct queries to create the required tables. Use the command : Add a the following to the passdb backend variable in your smb.conf: -passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins] +passdb backend = [other-plugins] mysql:identifier [other-plugins] @@ -978,35 +966,23 @@ Or, set 'identifier:workstations column' to : -Passdb XML plugin - - -Building +XML This module requires libxml2 to be installed. -To build pdb_xml, run: make bin/pdb_xml.so in -the directory source/. - - - - -Usage - The usage of pdb_xml is pretty straightforward. To export data, use: -pdbedit -e plugin:/usr/lib/samba/pdb_xml.so:filename +pdbedit -e xml:filename (where filename is the name of the file to put the data in) To import data, use: -pdbedit -i plugin:/usr/lib/samba/pdb_xml.so:filename -e current-pdb +pdbedit -i xml:filename -e current-pdb Where filename is the name to read the data from and current-pdb to put it in. - -- cgit From 313258fc6d7a197cf98f463f5c6ccf881591d62b Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 15:41:36 +0000 Subject: Add documentation for new messages in 3.0 (This used to be commit c44cc1be750b86a0bc9dd8063aef13c9c19176f6) --- docs/docbook/manpages/smbcontrol.1.sgml | 278 ++++++++++++++++++++------------ 1 file changed, 176 insertions(+), 102 deletions(-) diff --git a/docs/docbook/manpages/smbcontrol.1.sgml b/docs/docbook/manpages/smbcontrol.1.sgml index 6632e07269..e19aabedc7 100644 --- a/docs/docbook/manpages/smbcontrol.1.sgml +++ b/docs/docbook/manpages/smbcontrol.1.sgml @@ -1,4 +1,6 @@ - + %globalentities; +]> @@ -16,6 +18,7 @@ smbcontrol -i + -s @@ -44,6 +47,8 @@ OPTIONS + &stdarg.help; + &stdarg.configfile; -i Run interactively. Individual commands @@ -70,107 +75,12 @@ message-type - One of: close-share, - debug, - force-election, ping - , profile, - debuglevel, profilelevel, - or printnotify. - - The close-share message-type sends a - message to smbd which will then close the client connections to - the named share. Note that this doesn't affect client connections - to any other shares. This message-type takes an argument of the - share name for which client connections will be closed, or the - "*" character which will close all currently open shares. - This may be useful if you made changes to the access controls on the share. - This message can only be sent to smbd. - - The debug message-type allows - the debug level to be set to the value specified by the - parameter. This can be sent to any of the destinations. - - The force-election message-type can only be - sent to the nmbd destination. This message - causes the nmbd daemon to force a new browse - master election. - - The ping message-type sends the - number of "ping" messages specified by the parameter and waits - for the same number of reply "pong" messages. This can be sent to - any of the destinations. - - The profile message-type sends a - message to an smbd to change the profile settings based on the - parameter. The parameter can be "on" to turn on profile stats - collection, "off" to turn off profile stats collection, "count" - to enable only collection of count stats (time stats are - disabled), and "flush" to zero the current profile stats. This can - be sent to any smbd or nmbd destinations. - - The debuglevel message-type sends - a "request debug level" message. The current debug level setting - is returned by a "debuglevel" message. This can be - sent to any of the destinations. - - The profilelevel message-type sends - a "request profile level" message. The current profile level - setting is returned by a "profilelevel" message. This can be sent - to any smbd or nmbd destinations. - - The printnotify message-type sends a - message to smbd which in turn sends a printer notify message to - any Windows NT clients connected to a printer. This message-type - takes the following arguments: - - - - - queuepause printername - Send a queue pause change notify - message to the printer specified. - - - - queueresume printername - Send a queue resume change notify - message for the printer specified. - - - - jobpause printername unixjobid - Send a job pause change notify - message for the printer and unix jobid - specified. - - - - jobresume printername unixjobid - Send a job resume change notify - message for the printer and unix jobid - specified. - - - - jobdelete printername unixjobid - Send a job delete change notify - message for the printer and unix jobid - specified. - - - - - Note that this message only sends notification that an - event has occured. It doesn't actually cause the - event to happen. - - This message can only be sent to smbd. - - - - - + Type of message to send. See + the section MESSAGE-TYPES for details. + + + parameters any parameters required for the message-type @@ -180,10 +90,174 @@ + + MESSAGE-TYPES + + Available message types are: + + + close-share + Order smbd to close the client + connections to the named share. Note that this doesn't affect client + connections to any other shares. This message-type takes an argument of the + share name for which client connections will be closed, or the + "*" character which will close all currently open shares. + This may be useful if you made changes to the access controls on the share. + This message can only be sent to smbd. + + + + + debug + Set debug level to the value specified by the + parameter. This can be sent to any of the destinations. + + + + + force-election + This message causes the nmbd daemon to + force a new browse master election. + + + + ping + + Send specified number of "ping" messages and + wait for the same number of reply "pong" messages. This can be sent to + any of the destinations. + + + + + profile + Change profile settings of a daemon, based on the + parameter. The parameter can be "on" to turn on profile stats + collection, "off" to turn off profile stats collection, "count" + to enable only collection of count stats (time stats are + disabled), and "flush" to zero the current profile stats. This can + be sent to any smbd or nmbd destinations. + + + + debuglevel + + Request debuglevel of a certain daemon and write it to stdout. This + can be sent to any of the destinations. + + + + + profilelevel + + Request profilelevel of a certain daemon and write it to stdout. + This can be sent to any smbd or nmbd destinations. + + + + + printnotify + + Order smbd to send a printer notify message to any Windows NT clients + connected to a printer. This message-type takes the following arguments: + + + + + + queuepause printername + Send a queue pause change notify + message to the printer specified. + + + + queueresume printername + Send a queue resume change notify + message for the printer specified. + + + + jobpause printername unixjobid + Send a job pause change notify + message for the printer and unix jobid + specified. + + + + jobresume printername unixjobid + Send a job resume change notify + message for the printer and unix jobid + specified. + + + + jobdelete printername unixjobid + Send a job delete change notify + message for the printer and unix jobid + specified. + + + + + Note that this message only sends notification that an + event has occured. It doesn't actually cause the + event to happen. + + + This message can only be sent to smbd. + + + + + samsync + Order smbd to synchronise sam database from PDC (being BDC). Can only be sent to smbd. + Not working at the moment + + + + + samrepl + Send sam replication message, with specified serial. Can only be sent to smbd. Should not be used manually. + + + + dmalloc-mark + Set a mark for dmalloc. Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support. + + + + dmalloc-log-changed + + Dump the pointers that have changed since the mark set by dmalloc-mark. + Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support. + + + + shutdown + Shut down specified daemon. Can be sent to both smbd and nmbd. + + + + tallocdump and pool-usage + Print a human-readable description of all + talloc(pool) memory usage by the specified daemon/process. Available + for both smbd and nmbd. + + + + drvupgrade + Force clients of printers using specified driver + to update their local version of the driver. Can only be + sent to smbd. + + + + + VERSION - This man page is correct for version 2.2 of + This man page is correct for version 3.0 of the Samba suite. -- cgit From 101b52e0bef0b21282d5fd0503acde89bc680bb1 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 15:43:16 +0000 Subject: Give warning if 'drvupgrade' doesn't get a parameter (This used to be commit 55d9ef08a7585f69466cd4c0b30ce33841d52b33) --- source3/utils/smbcontrol.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/utils/smbcontrol.c b/source3/utils/smbcontrol.c index d622edd69f..ec4f41cad6 100644 --- a/source3/utils/smbcontrol.c +++ b/source3/utils/smbcontrol.c @@ -633,6 +633,11 @@ static BOOL do_command(char *dest, char *msg_name, int iparams, char **params) return False; break; case MSG_PRINTER_DRVUPGRADE: + if (!params || !params[0]) { + fprintf(stderr,"drvupgrade needs a parameter\n"); + return(False); + } + if (!send_message(dest, MSG_PRINTER_DRVUPGRADE, params[0], 0, False)) return False; break; -- cgit From dc1245b6187b675a981f1485c24774c178475dc7 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 17:09:33 +0000 Subject: Update for 3.0 (This used to be commit 28ba8dabb3abba2e787f424ab4e7550e5f8b6524) --- docs/docbook/manpages/smbmount.8.sgml | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/docs/docbook/manpages/smbmount.8.sgml b/docs/docbook/manpages/smbmount.8.sgml index d17e4e6bcf..12f64c7354 100644 --- a/docs/docbook/manpages/smbmount.8.sgml +++ b/docs/docbook/manpages/smbmount.8.sgml @@ -99,6 +99,11 @@ password = <value> + + krb + Use kerberos (Active Directory). + + netbiosname=<arg> sets the source NetBIOS name. It defaults @@ -140,7 +145,7 @@ password = <value> dmask=<arg> - sets the directory mask. This determines the + Sets the directory mask. This determines the permissions that remote directories have in the local filesystem. The default is based on the current umask. @@ -148,7 +153,7 @@ password = <value> debug=<arg> - sets the debug level. This is useful for + Sets the debug level. This is useful for tracking down SMB connection problems. A suggested value to start with is 4. If set too high there will be a lot of output, possibly hiding the useful output. @@ -157,7 +162,7 @@ password = <value> ip=<arg> - sets the destination host or IP address. + Sets the destination host or IP address. @@ -165,14 +170,14 @@ password = <value> workgroup=<arg> - sets the workgroup on the destination + Sets the workgroup on the destination sockopt=<arg> - sets the TCP socket options. See the Sets the TCP socket options. See the smb.conf 5 socket options option. @@ -181,15 +186,14 @@ password = <value> scope=<arg> - sets the NetBIOS scope + Sets the NetBIOS scope guest - don't prompt for a password + Don't prompt for a password - ro mount read-only -- cgit From e3e9e4fbc54d50ff931d83d9fc29b188ba8128aa Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 17:26:13 +0000 Subject: Update for 3.0 (This used to be commit 4e2828165b664ed90ddde308acc06fffb9db4947) --- docs/docbook/manpages/smbtar.1.sgml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/docs/docbook/manpages/smbtar.1.sgml b/docs/docbook/manpages/smbtar.1.sgml index ffb5087347..0492a3a574 100644 --- a/docs/docbook/manpages/smbtar.1.sgml +++ b/docs/docbook/manpages/smbtar.1.sgml @@ -16,20 +16,20 @@ smbtar + -r + -i + -a + -v -s server -p password -x services -X + -N filename + -b blocksize -d directory + -l loglevel -u user -t tape - -t tape - -b blocksize - -N filename - -i - -r - -l loglevel - -v filenames @@ -100,6 +100,11 @@ + + -a + Reset DOS archive bit mode to + indicate file has been archived. + -t tape -- cgit From c8b342144458e48ee4f94116778684af651c6122 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 17:26:55 +0000 Subject: Update to 3.0 (This used to be commit 2259117e6505c0ccb1b4ece78e2355b7493d1b2f) --- docs/docbook/manpages/smbmnt.8.sgml | 7 ++++++- docs/docbook/manpages/smbsh.1.sgml | 3 ++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/docbook/manpages/smbmnt.8.sgml b/docs/docbook/manpages/smbmnt.8.sgml index 6d48b12b9b..8c07ed2eb4 100644 --- a/docs/docbook/manpages/smbmnt.8.sgml +++ b/docs/docbook/manpages/smbmnt.8.sgml @@ -1,4 +1,6 @@ - + %globalentities; +]> @@ -23,6 +25,7 @@ -f <mask> -d <mask> -o <options> + -h @@ -88,6 +91,8 @@ + &stdarg.help; + diff --git a/docs/docbook/manpages/smbsh.1.sgml b/docs/docbook/manpages/smbsh.1.sgml index 5a53c53be3..78b4f0ad16 100644 --- a/docs/docbook/manpages/smbsh.1.sgml +++ b/docs/docbook/manpages/smbsh.1.sgml @@ -70,7 +70,8 @@ - &popt.common.samba; + &stdarg.configfile; + &stdarg.debug; &stdarg.resolve.order; -- cgit From c57096cb03951c9e849858d5b10f56ed462e936a Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 17:44:51 +0000 Subject: Update manpages for 3.0 (This used to be commit edd15d36f528b64f3ab961908bcd43111e08244b) --- docs/Samba-Developers-Guide.pdf | 4 +- docs/Samba-HOWTO-Collection.pdf | 10073 ++++++++++---------- docs/docbook/manpages/smbspool.8.sgml | 14 +- docs/docbook/manpages/testprns.1.sgml | 2 +- docs/docs-status | 16 +- docs/htmldocs/Samba-HOWTO-Collection.html | 13613 ++++++++++++++-------------- docs/manpages/findsmb.1 | 2 +- docs/manpages/lmhosts.5 | 2 +- docs/manpages/net.8 | 2 +- docs/manpages/nmbd.8 | 2 +- docs/manpages/nmblookup.1 | 2 +- docs/manpages/pdbedit.8 | 2 +- docs/manpages/rpcclient.1 | 6 +- docs/manpages/samba.7 | 2 +- docs/manpages/smb.conf.5 | 92 +- docs/manpages/smbcacls.1 | 2 +- docs/manpages/smbclient.1 | 6 +- docs/manpages/smbcontrol.1 | 132 +- docs/manpages/smbd.8 | 2 +- docs/manpages/smbgroupedit.8 | 2 +- docs/manpages/smbmnt.8 | 2 +- docs/manpages/smbmount.8 | 2 +- docs/manpages/smbpasswd.5 | 2 +- docs/manpages/smbpasswd.8 | 2 +- docs/manpages/smbsh.1 | 2 +- docs/manpages/smbspool.8 | 2 +- docs/manpages/smbstatus.1 | 2 +- docs/manpages/smbtar.1 | 2 +- docs/manpages/smbumount.8 | 2 +- docs/manpages/swat.8 | 2 +- docs/manpages/testparm.1 | 2 +- docs/manpages/testprns.1 | 2 +- docs/manpages/vfstest.1 | 2 +- docs/manpages/wbinfo.1 | 2 +- docs/manpages/winbindd.8 | 22 +- 35 files changed, 12146 insertions(+), 11882 deletions(-) diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index ca67bef976..ffd8bd128d 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -2728,7 +2728,7 @@ xref 0000186776 00000 n 0000186871 00000 n trailer -<<93af2445d6880037f24b021f8ddba00f>]>> +<<189abffedc06aaee73d71f659ae7c647>]>> startxref 187413 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index b2fbe18a31..8cbf9dbcd4 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -1,6 +1,6 @@ %PDF-1.3 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -20,48 +20,48 @@ endobj 16 0 obj<]/Interpolate true/Filter/FlateDecode/Width 24/Height 24/BitsPerComponent 8/Length 223 >>stream xUQ0 58@4wo%wR+8C+N"]ׂ*W ,D1|Ši"%~0)܁1lN!31T4HԆ<<~Z>yn.H>LKb؎џ'4Y}-?f&tA{27L}On4KI" PBhïG]z$>.mcoendstream endobj -17 0 obj<>endobj -18 0 obj<>endobj -19 0 obj<>endobj -20 0 obj<>endobj -21 0 obj<>endobj -22 0 obj<>endobj -23 0 obj<>endobj -24 0 obj<>endobj -25 0 obj<>endobj -26 0 obj<>endobj -27 0 obj<>endobj -28 0 obj<>endobj -29 0 obj<>endobj -30 0 obj<>endobj -31 0 obj<>endobj -32 0 obj<>endobj -33 0 obj<>endobj -34 0 obj<>endobj -35 0 obj<>endobj -36 0 obj<>endobj -37 0 obj<>endobj -38 0 obj<>endobj -39 0 obj<>endobj -40 0 obj<>endobj -41 0 obj<>endobj -42 0 obj<>endobj -43 0 obj<>endobj -44 0 obj<>endobj -45 0 obj<>endobj -46 0 obj<>endobj -47 0 obj<>endobj -48 0 obj<>endobj -49 0 obj<>endobj -50 0 obj<>endobj -51 0 obj<>endobj -52 0 obj<>endobj -53 0 obj<>endobj -54 0 obj<>endobj -55 0 obj<>endobj -56 0 obj<>endobj -57 0 obj<>endobj -58 0 obj<>endobj +17 0 obj<>endobj +18 0 obj<>endobj +19 0 obj<>endobj +20 0 obj<>endobj +21 0 obj<>endobj +22 0 obj<>endobj +23 0 obj<>endobj +24 0 obj<>endobj +25 0 obj<>endobj +26 0 obj<>endobj +27 0 obj<>endobj +28 0 obj<>endobj +29 0 obj<>endobj +30 0 obj<>endobj +31 0 obj<>endobj +32 0 obj<>endobj +33 0 obj<>endobj +34 0 obj<>endobj +35 0 obj<>endobj +36 0 obj<>endobj +37 0 obj<>endobj +38 0 obj<>endobj +39 0 obj<>endobj +40 0 obj<>endobj +41 0 obj<>endobj +42 0 obj<>endobj +43 0 obj<>endobj +44 0 obj<>endobj +45 0 obj<>endobj +46 0 obj<>endobj +47 0 obj<>endobj +48 0 obj<>endobj +49 0 obj<>endobj +50 0 obj<>endobj +51 0 obj<>endobj +52 0 obj<>endobj +53 0 obj<>endobj +54 0 obj<>endobj +55 0 obj<>endobj +56 0 obj<>endobj +57 0 obj<>endobj +58 0 obj<>endobj 59 0 obj[17 0 R 18 0 R 19 0 R @@ -104,48 +104,48 @@ endobj 56 0 R 57 0 R 58 0 R]endobj -60 0 obj<>endobj -61 0 obj<>endobj -62 0 obj<>endobj -63 0 obj<>endobj -64 0 obj<>endobj -65 0 obj<>endobj -66 0 obj<>endobj -67 0 obj<>endobj -68 0 obj<>endobj -69 0 obj<>endobj -70 0 obj<>endobj -71 0 obj<>endobj -72 0 obj<>endobj -73 0 obj<>endobj -74 0 obj<>endobj -75 0 obj<>endobj -76 0 obj<>endobj -77 0 obj<>endobj -78 0 obj<>endobj -79 0 obj<>endobj -80 0 obj<>endobj -81 0 obj<>endobj -82 0 obj<>endobj -83 0 obj<>endobj -84 0 obj<>endobj -85 0 obj<>endobj -86 0 obj<>endobj -87 0 obj<>endobj -88 0 obj<>endobj -89 0 obj<>endobj -90 0 obj<>endobj -91 0 obj<>endobj -92 0 obj<>endobj -93 0 obj<>endobj -94 0 obj<>endobj -95 0 obj<>endobj -96 0 obj<>endobj -97 0 obj<>endobj -98 0 obj<>endobj -99 0 obj<>endobj -100 0 obj<>endobj -101 0 obj<>endobj +60 0 obj<>endobj +61 0 obj<>endobj +62 0 obj<>endobj +63 0 obj<>endobj +64 0 obj<>endobj +65 0 obj<>endobj +66 0 obj<>endobj +67 0 obj<>endobj +68 0 obj<>endobj +69 0 obj<>endobj +70 0 obj<>endobj +71 0 obj<>endobj +72 0 obj<>endobj +73 0 obj<>endobj +74 0 obj<>endobj +75 0 obj<>endobj +76 0 obj<>endobj +77 0 obj<>endobj +78 0 obj<>endobj +79 0 obj<>endobj +80 0 obj<>endobj +81 0 obj<>endobj +82 0 obj<>endobj +83 0 obj<>endobj +84 0 obj<>endobj +85 0 obj<>endobj +86 0 obj<>endobj +87 0 obj<>endobj +88 0 obj<>endobj +89 0 obj<>endobj +90 0 obj<>endobj +91 0 obj<>endobj +92 0 obj<>endobj +93 0 obj<>endobj +94 0 obj<>endobj +95 0 obj<>endobj +96 0 obj<>endobj +97 0 obj<>endobj +98 0 obj<>endobj +99 0 obj<>endobj +100 0 obj<>endobj +101 0 obj<>endobj 102 0 obj[60 0 R 61 0 R 62 0 R @@ -188,48 +188,46 @@ endobj 99 0 R 100 0 R 101 0 R]endobj -103 0 obj<>endobj -104 0 obj<>endobj -105 0 obj<>endobj -106 0 obj<>endobj -107 0 obj<>endobj -108 0 obj<>endobj -109 0 obj<>endobj -110 0 obj<>endobj -111 0 obj<>endobj -112 0 obj<>endobj -113 0 obj<>endobj -114 0 obj<>endobj -115 0 obj<>endobj -116 0 obj<>endobj -117 0 obj<>endobj -118 0 obj<>endobj -119 0 obj<>endobj -120 0 obj<>endobj -121 0 obj<>endobj -122 0 obj<>endobj -123 0 obj<>endobj -124 0 obj<>endobj -125 0 obj<>endobj -126 0 obj<>endobj -127 0 obj<>endobj -128 0 obj<>endobj -129 0 obj<>endobj -130 0 obj<>endobj -131 0 obj<>endobj -132 0 obj<>endobj -133 0 obj<>endobj -134 0 obj<>endobj -135 0 obj<>endobj -136 0 obj<>endobj -137 0 obj<>endobj -138 0 obj<>endobj -139 0 obj<>endobj -140 0 obj<>endobj -141 0 obj<>endobj -142 0 obj<>endobj -143 0 obj<>endobj -144 0 obj[103 0 R +103 0 obj<>endobj +104 0 obj<>endobj +105 0 obj<>endobj +106 0 obj<>endobj +107 0 obj<>endobj +108 0 obj<>endobj +109 0 obj<>endobj +110 0 obj<>endobj +111 0 obj<>endobj +112 0 obj<>endobj +113 0 obj<>endobj +114 0 obj<>endobj +115 0 obj<>endobj +116 0 obj<>endobj +117 0 obj<>endobj +118 0 obj<>endobj +119 0 obj<>endobj +120 0 obj<>endobj +121 0 obj<>endobj +122 0 obj<>endobj +123 0 obj<>endobj +124 0 obj<>endobj +125 0 obj<>endobj +126 0 obj<>endobj +127 0 obj<>endobj +128 0 obj<>endobj +129 0 obj<>endobj +130 0 obj<>endobj +131 0 obj<>endobj +132 0 obj<>endobj +133 0 obj<>endobj +134 0 obj<>endobj +135 0 obj<>endobj +136 0 obj<>endobj +137 0 obj<>endobj +138 0 obj<>endobj +139 0 obj<>endobj +140 0 obj<>endobj +141 0 obj<>endobj +142 0 obj[103 0 R 104 0 R 105 0 R 106 0 R @@ -267,54 +265,54 @@ endobj 138 0 R 139 0 R 140 0 R -141 0 R -142 0 R -143 0 R]endobj -145 0 obj<>endobj -146 0 obj<>endobj -147 0 obj<>endobj -148 0 obj<>endobj -149 0 obj<>endobj -150 0 obj<>endobj -151 0 obj<>endobj -152 0 obj<>endobj -153 0 obj<>endobj -154 0 obj<>endobj -155 0 obj<>endobj -156 0 obj<>endobj -157 0 obj<>endobj -158 0 obj<>endobj -159 0 obj<>endobj -160 0 obj<>endobj -161 0 obj<>endobj -162 0 obj<>endobj -163 0 obj<>endobj -164 0 obj<>endobj -165 0 obj<>endobj -166 0 obj<>endobj -167 0 obj<>endobj -168 0 obj<>endobj -169 0 obj<>endobj -170 0 obj<>endobj -171 0 obj<>endobj -172 0 obj<>endobj -173 0 obj<>endobj -174 0 obj<>endobj -175 0 obj<>endobj -176 0 obj<>endobj -177 0 obj<>endobj -178 0 obj<>endobj -179 0 obj<>endobj -180 0 obj<>endobj -181 0 obj<>endobj -182 0 obj<>endobj -183 0 obj<>endobj -184 0 obj<>endobj -185 0 obj<>endobj -186 0 obj<>endobj -187 0 obj<>endobj -188 0 obj<>endobj -189 0 obj[145 0 R +141 0 R]endobj +143 0 obj<>endobj +144 0 obj<>endobj +145 0 obj<>endobj +146 0 obj<>endobj +147 0 obj<>endobj +148 0 obj<>endobj +149 0 obj<>endobj +150 0 obj<>endobj +151 0 obj<>endobj +152 0 obj<>endobj +153 0 obj<>endobj +154 0 obj<>endobj +155 0 obj<>endobj +156 0 obj<>endobj +157 0 obj<>endobj +158 0 obj<>endobj +159 0 obj<>endobj +160 0 obj<>endobj +161 0 obj<>endobj +162 0 obj<>endobj +163 0 obj<>endobj +164 0 obj<>endobj +165 0 obj<>endobj +166 0 obj<>endobj +167 0 obj<>endobj +168 0 obj<>endobj +169 0 obj<>endobj +170 0 obj<>endobj +171 0 obj<>endobj +172 0 obj<>endobj +173 0 obj<>endobj +174 0 obj<>endobj +175 0 obj<>endobj +176 0 obj<>endobj +177 0 obj<>endobj +178 0 obj<>endobj +179 0 obj<>endobj +180 0 obj<>endobj +181 0 obj<>endobj +182 0 obj<>endobj +183 0 obj<>endobj +184 0 obj<>endobj +185 0 obj<>endobj +186 0 obj<>endobj +187 0 obj[143 0 R +144 0 R +145 0 R 146 0 R 147 0 R 148 0 R @@ -355,54 +353,54 @@ endobj 183 0 R 184 0 R 185 0 R -186 0 R -187 0 R -188 0 R]endobj -190 0 obj<>endobj -191 0 obj<>endobj -192 0 obj<>endobj -193 0 obj<>endobj -194 0 obj<>endobj -195 0 obj<>endobj -196 0 obj<>endobj -197 0 obj<>endobj -198 0 obj<>endobj -199 0 obj<>endobj -200 0 obj<>endobj -201 0 obj<>endobj -202 0 obj<>endobj -203 0 obj<>endobj -204 0 obj<>endobj -205 0 obj<>endobj -206 0 obj<>endobj -207 0 obj<>endobj -208 0 obj<>endobj -209 0 obj<>endobj -210 0 obj<>endobj -211 0 obj<>endobj -212 0 obj<>endobj -213 0 obj<>endobj -214 0 obj<>endobj -215 0 obj<>endobj -216 0 obj<>endobj -217 0 obj<>endobj -218 0 obj<>endobj -219 0 obj<>endobj -220 0 obj<>endobj -221 0 obj<>endobj -222 0 obj<>endobj -223 0 obj<>endobj -224 0 obj<>endobj -225 0 obj<>endobj -226 0 obj<>endobj -227 0 obj<>endobj -228 0 obj<>endobj -229 0 obj<>endobj -230 0 obj<>endobj -231 0 obj<>endobj -232 0 obj<>endobj -233 0 obj<>endobj -234 0 obj[190 0 R +186 0 R]endobj +188 0 obj<>endobj +189 0 obj<>endobj +190 0 obj<>endobj +191 0 obj<>endobj +192 0 obj<>endobj +193 0 obj<>endobj +194 0 obj<>endobj +195 0 obj<>endobj +196 0 obj<>endobj +197 0 obj<>endobj +198 0 obj<>endobj +199 0 obj<>endobj +200 0 obj<>endobj +201 0 obj<>endobj +202 0 obj<>endobj +203 0 obj<>endobj +204 0 obj<>endobj +205 0 obj<>endobj +206 0 obj<>endobj +207 0 obj<>endobj +208 0 obj<>endobj +209 0 obj<>endobj +210 0 obj<>endobj +211 0 obj<>endobj +212 0 obj<>endobj +213 0 obj<>endobj +214 0 obj<>endobj +215 0 obj<>endobj +216 0 obj<>endobj +217 0 obj<>endobj +218 0 obj<>endobj +219 0 obj<>endobj +220 0 obj<>endobj +221 0 obj<>endobj +222 0 obj<>endobj +223 0 obj<>endobj +224 0 obj<>endobj +225 0 obj<>endobj +226 0 obj<>endobj +227 0 obj<>endobj +228 0 obj<>endobj +229 0 obj<>endobj +230 0 obj<>endobj +231 0 obj<>endobj +232 0 obj[188 0 R +189 0 R +190 0 R 191 0 R 192 0 R 193 0 R @@ -443,52 +441,52 @@ endobj 228 0 R 229 0 R 230 0 R -231 0 R -232 0 R -233 0 R]endobj -235 0 obj<>endobj -236 0 obj<>endobj -237 0 obj<>endobj -238 0 obj<>endobj -239 0 obj<>endobj -240 0 obj<>endobj -241 0 obj<>endobj -242 0 obj<>endobj -243 0 obj<>endobj -244 0 obj<>endobj -245 0 obj<>endobj -246 0 obj<>endobj -247 0 obj<>endobj -248 0 obj<>endobj -249 0 obj<>endobj -250 0 obj<>endobj -251 0 obj<>endobj -252 0 obj<>endobj -253 0 obj<>endobj -254 0 obj<>endobj -255 0 obj<>endobj -256 0 obj<>endobj -257 0 obj<>endobj -258 0 obj<>endobj -259 0 obj<>endobj -260 0 obj<>endobj -261 0 obj<>endobj -262 0 obj<>endobj -263 0 obj<>endobj -264 0 obj<>endobj -265 0 obj<>endobj -266 0 obj<>endobj -267 0 obj<>endobj -268 0 obj<>endobj -269 0 obj<>endobj -270 0 obj<>endobj -271 0 obj<>endobj -272 0 obj<>endobj -273 0 obj<>endobj -274 0 obj<>endobj -275 0 obj<>endobj -276 0 obj<>endobj -277 0 obj[235 0 R +231 0 R]endobj +233 0 obj<>endobj +234 0 obj<>endobj +235 0 obj<>endobj +236 0 obj<>endobj +237 0 obj<>endobj +238 0 obj<>endobj +239 0 obj<>endobj +240 0 obj<>endobj +241 0 obj<>endobj +242 0 obj<>endobj +243 0 obj<>endobj +244 0 obj<>endobj +245 0 obj<>endobj +246 0 obj<>endobj +247 0 obj<>endobj +248 0 obj<>endobj +249 0 obj<>endobj +250 0 obj<>endobj +251 0 obj<>endobj +252 0 obj<>endobj +253 0 obj<>endobj +254 0 obj<>endobj +255 0 obj<>endobj +256 0 obj<>endobj +257 0 obj<>endobj +258 0 obj<>endobj +259 0 obj<>endobj +260 0 obj<>endobj +261 0 obj<>endobj +262 0 obj<>endobj +263 0 obj<>endobj +264 0 obj<>endobj +265 0 obj<>endobj +266 0 obj<>endobj +267 0 obj<>endobj +268 0 obj<>endobj +269 0 obj<>endobj +270 0 obj<>endobj +271 0 obj<>endobj +272 0 obj<>endobj +273 0 obj<>endobj +274 0 obj<>endobj +275 0 obj[233 0 R +234 0 R +235 0 R 236 0 R 237 0 R 238 0 R @@ -527,52 +525,55 @@ endobj 271 0 R 272 0 R 273 0 R -274 0 R -275 0 R -276 0 R]endobj -278 0 obj<>endobj -279 0 obj<>endobj -280 0 obj<>endobj -281 0 obj<>endobj -282 0 obj<>endobj -283 0 obj<>endobj -284 0 obj<>endobj -285 0 obj<>endobj -286 0 obj<>endobj -287 0 obj<>endobj -288 0 obj<>endobj -289 0 obj<>endobj -290 0 obj<>endobj -291 0 obj<>endobj -292 0 obj<>endobj -293 0 obj<>endobj -294 0 obj<>endobj -295 0 obj<>endobj -296 0 obj<>endobj -297 0 obj<>endobj -298 0 obj<>endobj -299 0 obj<>endobj -300 0 obj<>endobj -301 0 obj<>endobj -302 0 obj<>endobj -303 0 obj<>endobj -304 0 obj<>endobj -305 0 obj<>endobj -306 0 obj<>endobj -307 0 obj<>endobj -308 0 obj<>endobj -309 0 obj<>endobj -310 0 obj<>endobj -311 0 obj<>endobj -312 0 obj<>endobj -313 0 obj<>endobj -314 0 obj<>endobj -315 0 obj<>endobj -316 0 obj<>endobj -317 0 obj<>endobj -318 0 obj<>endobj -319 0 obj<>endobj -320 0 obj[278 0 R +274 0 R]endobj +276 0 obj<>endobj +277 0 obj<>endobj +278 0 obj<>endobj +279 0 obj<>endobj +280 0 obj<>endobj +281 0 obj<>endobj +282 0 obj<>endobj +283 0 obj<>endobj +284 0 obj<>endobj +285 0 obj<>endobj +286 0 obj<>endobj +287 0 obj<>endobj +288 0 obj<>endobj +289 0 obj<>endobj +290 0 obj<>endobj +291 0 obj<>endobj +292 0 obj<>endobj +293 0 obj<>endobj +294 0 obj<>endobj +295 0 obj<>endobj +296 0 obj<>endobj +297 0 obj<>endobj +298 0 obj<>endobj +299 0 obj<>endobj +300 0 obj<>endobj +301 0 obj<>endobj +302 0 obj<>endobj +303 0 obj<>endobj +304 0 obj<>endobj +305 0 obj<>endobj +306 0 obj<>endobj +307 0 obj<>endobj +308 0 obj<>endobj +309 0 obj<>endobj +310 0 obj<>endobj +311 0 obj<>endobj +312 0 obj<>endobj +313 0 obj<>endobj +314 0 obj<>endobj +315 0 obj<>endobj +316 0 obj<>endobj +317 0 obj<>endobj +318 0 obj<>endobj +319 0 obj<>endobj +320 0 obj<>endobj +321 0 obj[276 0 R +277 0 R +278 0 R 279 0 R 280 0 R 281 0 R @@ -613,53 +614,53 @@ endobj 316 0 R 317 0 R 318 0 R -319 0 R]endobj -321 0 obj<>endobj -322 0 obj<>endobj -323 0 obj<>endobj -324 0 obj<>endobj -325 0 obj<>endobj -326 0 obj<>endobj -327 0 obj<>endobj -328 0 obj<>endobj -329 0 obj<>endobj -330 0 obj<>endobj -331 0 obj<>endobj -332 0 obj<>endobj -333 0 obj<>endobj -334 0 obj<>endobj -335 0 obj<>endobj -336 0 obj<>endobj -337 0 obj<>endobj -338 0 obj<>endobj -339 0 obj<>endobj -340 0 obj<>endobj -341 0 obj<>endobj -342 0 obj<>endobj -343 0 obj<>endobj -344 0 obj<>endobj -345 0 obj<>endobj -346 0 obj<>endobj -347 0 obj<>endobj -348 0 obj<>endobj -349 0 obj<>endobj -350 0 obj<>endobj -351 0 obj<>endobj -352 0 obj<>endobj -353 0 obj<>endobj -354 0 obj<>endobj -355 0 obj<>endobj -356 0 obj<>endobj -357 0 obj<>endobj -358 0 obj<>endobj -359 0 obj<>endobj -360 0 obj<>endobj -361 0 obj<>endobj -362 0 obj<>endobj -363 0 obj[322 0 R -324 0 R -326 0 R -328 0 R +319 0 R +320 0 R]endobj +322 0 obj<>endobj +323 0 obj<>endobj +324 0 obj<>endobj +325 0 obj<>endobj +326 0 obj<>endobj +327 0 obj<>endobj +328 0 obj<>endobj +329 0 obj<>endobj +330 0 obj<>endobj +331 0 obj<>endobj +332 0 obj<>endobj +333 0 obj<>endobj +334 0 obj<>endobj +335 0 obj<>endobj +336 0 obj<>endobj +337 0 obj<>endobj +338 0 obj<>endobj +339 0 obj<>endobj +340 0 obj<>endobj +341 0 obj<>endobj +342 0 obj<>endobj +343 0 obj<>endobj +344 0 obj<>endobj +345 0 obj<>endobj +346 0 obj<>endobj +347 0 obj<>endobj +348 0 obj<>endobj +349 0 obj<>endobj +350 0 obj<>endobj +351 0 obj<>endobj +352 0 obj<>endobj +353 0 obj<>endobj +354 0 obj<>endobj +355 0 obj<>endobj +356 0 obj<>endobj +357 0 obj<>endobj +358 0 obj<>endobj +359 0 obj<>endobj +360 0 obj<>endobj +361 0 obj<>endobj +362 0 obj<>endobj +363 0 obj<>endobj +364 0 obj[323 0 R +325 0 R +327 0 R 329 0 R 330 0 R 331 0 R @@ -693,62 +694,62 @@ endobj 359 0 R 360 0 R 361 0 R -362 0 R]endobj -364 0 obj<>endobj -365 0 obj<>endobj -366 0 obj<>endobj -367 0 obj<>endobj -368 0 obj<>endobj -369 0 obj<>endobj -370 0 obj<>endobj -371 0 obj<>endobj -372 0 obj<>endobj -373 0 obj<>endobj -374 0 obj<>endobj -375 0 obj<>endobj -376 0 obj<>endobj -377 0 obj<>endobj -378 0 obj<>endobj -379 0 obj<>endobj -380 0 obj<>endobj -381 0 obj<>endobj -382 0 obj<>endobj -383 0 obj<>endobj -384 0 obj<>endobj -385 0 obj<>endobj -386 0 obj<>endobj -387 0 obj<>endobj -388 0 obj<>endobj -389 0 obj<>endobj -390 0 obj<>endobj -391 0 obj<>endobj -392 0 obj<>endobj -393 0 obj<>endobj -394 0 obj<>endobj -395 0 obj<>endobj -396 0 obj<>endobj -397 0 obj<>endobj -398 0 obj<>endobj -399 0 obj<>endobj -400 0 obj<>endobj -401 0 obj<>endobj -402 0 obj<>endobj -403 0 obj<>endobj -404 0 obj<>endobj -405 0 obj<>endobj -406 0 obj<>endobj -407 0 obj<>endobj -408 0 obj<>endobj -409 0 obj<>endobj -410 0 obj<>endobj -411 0 obj<>endobj -412 0 obj<>endobj -413 0 obj<>endobj -414 0 obj<>endobj -415 0 obj<>endobj -416 0 obj<>endobj -417 0 obj[364 0 R -365 0 R +362 0 R +363 0 R]endobj +365 0 obj<>endobj +366 0 obj<>endobj +367 0 obj<>endobj +368 0 obj<>endobj +369 0 obj<>endobj +370 0 obj<>endobj +371 0 obj<>endobj +372 0 obj<>endobj +373 0 obj<>endobj +374 0 obj<>endobj +375 0 obj<>endobj +376 0 obj<>endobj +377 0 obj<>endobj +378 0 obj<>endobj +379 0 obj<>endobj +380 0 obj<>endobj +381 0 obj<>endobj +382 0 obj<>endobj +383 0 obj<>endobj +384 0 obj<>endobj +385 0 obj<>endobj +386 0 obj<>endobj +387 0 obj<>endobj +388 0 obj<>endobj +389 0 obj<>endobj +390 0 obj<>endobj +391 0 obj<>endobj +392 0 obj<>endobj +393 0 obj<>endobj +394 0 obj<>endobj +395 0 obj<>endobj +396 0 obj<>endobj +397 0 obj<>endobj +398 0 obj<>endobj +399 0 obj<>endobj +400 0 obj<>endobj +401 0 obj<>endobj +402 0 obj<>endobj +403 0 obj<>endobj +404 0 obj<>endobj +405 0 obj<>endobj +406 0 obj<>endobj +407 0 obj<>endobj +408 0 obj<>endobj +409 0 obj<>endobj +410 0 obj<>endobj +411 0 obj<>endobj +412 0 obj<>endobj +413 0 obj<>endobj +414 0 obj<>endobj +415 0 obj<>endobj +416 0 obj<>endobj +417 0 obj<>endobj +418 0 obj[365 0 R 366 0 R 367 0 R 368 0 R @@ -799,60 +800,60 @@ endobj 413 0 R 414 0 R 415 0 R -416 0 R]endobj -418 0 obj<>endobj -419 0 obj<>endobj -420 0 obj<>endobj -421 0 obj<>endobj -422 0 obj<>endobj -423 0 obj<>endobj -424 0 obj<>endobj -425 0 obj<>endobj -426 0 obj<>endobj -427 0 obj<>endobj -428 0 obj<>endobj -429 0 obj<>endobj -430 0 obj<>endobj -431 0 obj<>endobj -432 0 obj<>endobj -433 0 obj<>endobj -434 0 obj<>endobj -435 0 obj<>endobj -436 0 obj<>endobj -437 0 obj<>endobj -438 0 obj<>endobj -439 0 obj<>endobj -440 0 obj<>endobj -441 0 obj<>endobj -442 0 obj<>endobj -443 0 obj<>endobj -444 0 obj<>endobj -445 0 obj<>endobj -446 0 obj<>endobj -447 0 obj<>endobj -448 0 obj<>endobj -449 0 obj<>endobj -450 0 obj<>endobj -451 0 obj<>endobj -452 0 obj<>endobj -453 0 obj<>endobj -454 0 obj<>endobj -455 0 obj<>endobj -456 0 obj<>endobj -457 0 obj<>endobj -458 0 obj<>endobj -459 0 obj<>endobj -460 0 obj<>endobj -461 0 obj<>endobj -462 0 obj<>endobj -463 0 obj<>endobj -464 0 obj<>endobj -465 0 obj<>endobj -466 0 obj<>endobj -467 0 obj<>endobj -468 0 obj<>endobj -469 0 obj[418 0 R -419 0 R +416 0 R +417 0 R]endobj +419 0 obj<>endobj +420 0 obj<>endobj +421 0 obj<>endobj +422 0 obj<>endobj +423 0 obj<>endobj +424 0 obj<>endobj +425 0 obj<>endobj +426 0 obj<>endobj +427 0 obj<>endobj +428 0 obj<>endobj +429 0 obj<>endobj +430 0 obj<>endobj +431 0 obj<>endobj +432 0 obj<>endobj +433 0 obj<>endobj +434 0 obj<>endobj +435 0 obj<>endobj +436 0 obj<>endobj +437 0 obj<>endobj +438 0 obj<>endobj +439 0 obj<>endobj +440 0 obj<>endobj +441 0 obj<>endobj +442 0 obj<>endobj +443 0 obj<>endobj +444 0 obj<>endobj +445 0 obj<>endobj +446 0 obj<>endobj +447 0 obj<>endobj +448 0 obj<>endobj +449 0 obj<>endobj +450 0 obj<>endobj +451 0 obj<>endobj +452 0 obj<>endobj +453 0 obj<>endobj +454 0 obj<>endobj +455 0 obj<>endobj +456 0 obj<>endobj +457 0 obj<>endobj +458 0 obj<>endobj +459 0 obj<>endobj +460 0 obj<>endobj +461 0 obj<>endobj +462 0 obj<>endobj +463 0 obj<>endobj +464 0 obj<>endobj +465 0 obj<>endobj +466 0 obj<>endobj +467 0 obj<>endobj +468 0 obj<>endobj +469 0 obj<>endobj +470 0 obj[419 0 R 420 0 R 421 0 R 422 0 R @@ -901,40 +902,43 @@ endobj 465 0 R 466 0 R 467 0 R -468 0 R]endobj -470 0 obj<>endobj -471 0 obj<>endobj -472 0 obj<>endobj -473 0 obj<>endobj -474 0 obj<>endobj -475 0 obj<>endobj -476 0 obj<>endobj -477 0 obj<>endobj -478 0 obj<>endobj -479 0 obj<>endobj -480 0 obj<>endobj -481 0 obj<>endobj -482 0 obj<>endobj -483 0 obj<>endobj -484 0 obj<>endobj -485 0 obj<>endobj -486 0 obj<>endobj -487 0 obj<>endobj -488 0 obj<>endobj -489 0 obj<>endobj -490 0 obj<>endobj -491 0 obj<>endobj -492 0 obj<>endobj -493 0 obj<>endobj -494 0 obj<>endobj -495 0 obj<>endobj -496 0 obj<>endobj -497 0 obj<>endobj -498 0 obj<>endobj -499 0 obj<>endobj -500 0 obj<>endobj -501 0 obj[470 0 R -471 0 R +468 0 R +469 0 R]endobj +471 0 obj<>endobj +472 0 obj<>endobj +473 0 obj<>endobj +474 0 obj<>endobj +475 0 obj<>endobj +476 0 obj<>endobj +477 0 obj<>endobj +478 0 obj<>endobj +479 0 obj<>endobj +480 0 obj<>endobj +481 0 obj<>endobj +482 0 obj<>endobj +483 0 obj<>endobj +484 0 obj<>endobj +485 0 obj<>endobj +486 0 obj<>endobj +487 0 obj<>endobj +488 0 obj<>endobj +489 0 obj<>endobj +490 0 obj<>endobj +491 0 obj<>endobj +492 0 obj<>endobj +493 0 obj<>endobj +494 0 obj<>endobj +495 0 obj<>endobj +496 0 obj<>endobj +497 0 obj<>endobj +498 0 obj<>endobj +499 0 obj<>endobj +500 0 obj<>endobj +501 0 obj<>endobj +502 0 obj<>endobj +503 0 obj<>endobj +504 0 obj<>endobj +505 0 obj[471 0 R 472 0 R 473 0 R 474 0 R @@ -963,56 +967,55 @@ endobj 497 0 R 498 0 R 499 0 R -500 0 R]endobj -502 0 obj<>endobj -503 0 obj<>endobj -504 0 obj<>endobj -505 0 obj<>endobj -506 0 obj<>endobj -507 0 obj<>endobj -508 0 obj<>endobj -509 0 obj<>endobj -510 0 obj<>endobj -511 0 obj<>endobj -512 0 obj<>endobj -513 0 obj<>endobj -514 0 obj<>endobj -515 0 obj<>endobj -516 0 obj<>endobj -517 0 obj<>endobj -518 0 obj<>endobj -519 0 obj<>endobj -520 0 obj<>endobj -521 0 obj<>endobj -522 0 obj<>endobj -523 0 obj<>endobj -524 0 obj<>endobj -525 0 obj<>endobj -526 0 obj<>endobj -527 0 obj<>endobj -528 0 obj<>endobj -529 0 obj<>endobj -530 0 obj<>endobj -531 0 obj<>endobj -532 0 obj<>endobj -533 0 obj<>endobj -534 0 obj<>endobj -535 0 obj<>endobj -536 0 obj<>endobj -537 0 obj<>endobj -538 0 obj<>endobj -539 0 obj<>endobj -540 0 obj<>endobj -541 0 obj<>endobj -542 0 obj<>endobj -543 0 obj<>endobj -544 0 obj<>endobj -545 0 obj<>endobj -546 0 obj[502 0 R +500 0 R +501 0 R +502 0 R 503 0 R -504 0 R -505 0 R -506 0 R +504 0 R]endobj +506 0 obj<>endobj +507 0 obj<>endobj +508 0 obj<>endobj +509 0 obj<>endobj +510 0 obj<>endobj +511 0 obj<>endobj +512 0 obj<>endobj +513 0 obj<>endobj +514 0 obj<>endobj +515 0 obj<>endobj +516 0 obj<>endobj +517 0 obj<>endobj +518 0 obj<>endobj +519 0 obj<>endobj +520 0 obj<>endobj +521 0 obj<>endobj +522 0 obj<>endobj +523 0 obj<>endobj +524 0 obj<>endobj +525 0 obj<>endobj +526 0 obj<>endobj +527 0 obj<>endobj +528 0 obj<>endobj +529 0 obj<>endobj +530 0 obj<>endobj +531 0 obj<>endobj +532 0 obj<>endobj +533 0 obj<>endobj +534 0 obj<>endobj +535 0 obj<>endobj +536 0 obj<>endobj +537 0 obj<>endobj +538 0 obj<>endobj +539 0 obj<>endobj +540 0 obj<>endobj +541 0 obj<>endobj +542 0 obj<>endobj +543 0 obj<>endobj +544 0 obj<>endobj +545 0 obj<>endobj +546 0 obj<>endobj +547 0 obj<>endobj +548 0 obj<>endobj +549 0 obj[506 0 R 507 0 R 508 0 R 509 0 R @@ -1051,10 +1054,9 @@ endobj 542 0 R 543 0 R 544 0 R -545 0 R]endobj -547 0 obj<>endobj -548 0 obj<>endobj -549 0 obj[547 0 R +545 0 R +546 0 R +547 0 R 548 0 R]endobj 550 0 obj<>endobj 551 0 obj<>endobj @@ -1116,52 +1118,52 @@ endobj 593 0 obj<>endobj 594 0 obj<>endobj 595 0 obj[594 0 R]endobj -596 0 obj<>endobj -597 0 obj<>endobj -598 0 obj<>endobj -599 0 obj<>endobj -600 0 obj<>endobj -601 0 obj<>endobj -602 0 obj<>endobj -603 0 obj<>endobj -604 0 obj<>endobj -605 0 obj<>endobj -606 0 obj<>endobj -607 0 obj<>endobj -608 0 obj<>endobj -609 0 obj<>endobj -610 0 obj<>endobj -611 0 obj<>endobj -612 0 obj<>endobj -613 0 obj<>endobj -614 0 obj<>endobj -615 0 obj<>endobj -616 0 obj<>endobj -617 0 obj<>endobj -618 0 obj<>endobj -619 0 obj<>endobj -620 0 obj<>endobj -621 0 obj<>endobj -622 0 obj<>endobj -623 0 obj<>endobj -624 0 obj<>endobj -625 0 obj<>endobj -626 0 obj<>endobj -627 0 obj<>endobj -628 0 obj<>endobj -629 0 obj<>endobj -630 0 obj<>endobj -631 0 obj<>endobj -632 0 obj<>endobj -633 0 obj<>endobj -634 0 obj<>endobj -635 0 obj<>endobj -636 0 obj<>endobj -637 0 obj<>endobj -638 0 obj<>endobj -639 0 obj<>endobj -640 0 obj<>endobj -641 0 obj<>endobj +596 0 obj<>endobj +597 0 obj<>endobj +598 0 obj<>endobj +599 0 obj<>endobj +600 0 obj<>endobj +601 0 obj<>endobj +602 0 obj<>endobj +603 0 obj<>endobj +604 0 obj<>endobj +605 0 obj<>endobj +606 0 obj<>endobj +607 0 obj<>endobj +608 0 obj<>endobj +609 0 obj<>endobj +610 0 obj<>endobj +611 0 obj<>endobj +612 0 obj<>endobj +613 0 obj<>endobj +614 0 obj<>endobj +615 0 obj<>endobj +616 0 obj<>endobj +617 0 obj<>endobj +618 0 obj<>endobj +619 0 obj<>endobj +620 0 obj<>endobj +621 0 obj<>endobj +622 0 obj<>endobj +623 0 obj<>endobj +624 0 obj<>endobj +625 0 obj<>endobj +626 0 obj<>endobj +627 0 obj<>endobj +628 0 obj<>endobj +629 0 obj<>endobj +630 0 obj<>endobj +631 0 obj<>endobj +632 0 obj<>endobj +633 0 obj<>endobj +634 0 obj<>endobj +635 0 obj<>endobj +636 0 obj<>endobj +637 0 obj<>endobj +638 0 obj<>endobj +639 0 obj<>endobj +640 0 obj<>endobj +641 0 obj<>endobj 642 0 obj[596 0 R 597 0 R 598 0 R @@ -1208,7 +1210,7 @@ endobj 639 0 R 640 0 R 641 0 R]endobj -643 0 obj<>endobj +643 0 obj<>endobj 644 0 obj[643 0 R]endobj 645 0 obj<>endobj 646 0 obj<>endobj @@ -1366,50 +1368,50 @@ endobj 755 0 R 757 0 R 759 0 R]endobj -761 0 obj<>endobj -762 0 obj<>endobj -763 0 obj<>endobj -764 0 obj<>endobj -765 0 obj<>endobj -766 0 obj<>endobj -767 0 obj<>endobj -768 0 obj<>endobj -769 0 obj<>endobj -770 0 obj<>endobj -771 0 obj<>endobj -772 0 obj<>endobj -773 0 obj<>endobj -774 0 obj<>endobj -775 0 obj<>endobj -776 0 obj<>endobj -777 0 obj<>endobj -778 0 obj<>endobj -779 0 obj<>endobj -780 0 obj<>endobj -781 0 obj<>endobj -782 0 obj<>endobj -783 0 obj<>endobj -784 0 obj<>endobj -785 0 obj<>endobj -786 0 obj<>endobj -787 0 obj<>endobj -788 0 obj<>endobj -789 0 obj<>endobj -790 0 obj<>endobj -791 0 obj<>endobj -792 0 obj<>endobj -793 0 obj<>endobj -794 0 obj<>endobj -795 0 obj<>endobj -796 0 obj<>endobj -797 0 obj<>endobj -798 0 obj<>endobj -799 0 obj<>endobj -800 0 obj<>endobj -801 0 obj<>endobj -802 0 obj<>endobj -803 0 obj<>endobj -804 0 obj<>endobj +761 0 obj<>endobj +762 0 obj<>endobj +763 0 obj<>endobj +764 0 obj<>endobj +765 0 obj<>endobj +766 0 obj<>endobj +767 0 obj<>endobj +768 0 obj<>endobj +769 0 obj<>endobj +770 0 obj<>endobj +771 0 obj<>endobj +772 0 obj<>endobj +773 0 obj<>endobj +774 0 obj<>endobj +775 0 obj<>endobj +776 0 obj<>endobj +777 0 obj<>endobj +778 0 obj<>endobj +779 0 obj<>endobj +780 0 obj<>endobj +781 0 obj<>endobj +782 0 obj<>endobj +783 0 obj<>endobj +784 0 obj<>endobj +785 0 obj<>endobj +786 0 obj<>endobj +787 0 obj<>endobj +788 0 obj<>endobj +789 0 obj<>endobj +790 0 obj<>endobj +791 0 obj<>endobj +792 0 obj<>endobj +793 0 obj<>endobj +794 0 obj<>endobj +795 0 obj<>endobj +796 0 obj<>endobj +797 0 obj<>endobj +798 0 obj<>endobj +799 0 obj<>endobj +800 0 obj<>endobj +801 0 obj<>endobj +802 0 obj<>endobj +803 0 obj<>endobj +804 0 obj<>endobj 805 0 obj[761 0 R 762 0 R 763 0 R @@ -1454,57 +1456,57 @@ endobj 802 0 R 803 0 R 804 0 R]endobj -806 0 obj<>endobj -807 0 obj<>endobj -808 0 obj<>endobj -809 0 obj<>endobj -810 0 obj<>endobj -811 0 obj<>endobj -812 0 obj<>endobj -813 0 obj<>endobj -814 0 obj<>endobj -815 0 obj<>endobj -816 0 obj<>endobj -817 0 obj<>endobj -818 0 obj<>endobj -819 0 obj<>endobj -820 0 obj<>endobj -821 0 obj<>endobj -822 0 obj<>endobj -823 0 obj<>endobj -824 0 obj<>endobj -825 0 obj<>endobj -826 0 obj<>endobj -827 0 obj<>endobj -828 0 obj<>endobj -829 0 obj<>endobj -830 0 obj<>endobj -831 0 obj<>endobj -832 0 obj<>endobj -833 0 obj<>endobj -834 0 obj<>endobj -835 0 obj<>endobj -836 0 obj<>endobj -837 0 obj<>endobj -838 0 obj<>endobj -839 0 obj<>endobj -840 0 obj<>endobj -841 0 obj<>endobj -842 0 obj<>endobj -843 0 obj<>endobj -844 0 obj<>endobj -845 0 obj<>endobj -846 0 obj<>endobj -847 0 obj<>endobj -848 0 obj<>endobj -849 0 obj<>endobj -850 0 obj<>endobj -851 0 obj<>endobj -852 0 obj<>endobj -853 0 obj<>endobj -854 0 obj<>endobj -855 0 obj<>endobj -856 0 obj<>endobj +806 0 obj<>endobj +807 0 obj<>endobj +808 0 obj<>endobj +809 0 obj<>endobj +810 0 obj<>endobj +811 0 obj<>endobj +812 0 obj<>endobj +813 0 obj<>endobj +814 0 obj<>endobj +815 0 obj<>endobj +816 0 obj<>endobj +817 0 obj<>endobj +818 0 obj<>endobj +819 0 obj<>endobj +820 0 obj<>endobj +821 0 obj<>endobj +822 0 obj<>endobj +823 0 obj<>endobj +824 0 obj<>endobj +825 0 obj<>endobj +826 0 obj<>endobj +827 0 obj<>endobj +828 0 obj<>endobj +829 0 obj<>endobj +830 0 obj<>endobj +831 0 obj<>endobj +832 0 obj<>endobj +833 0 obj<>endobj +834 0 obj<>endobj +835 0 obj<>endobj +836 0 obj<>endobj +837 0 obj<>endobj +838 0 obj<>endobj +839 0 obj<>endobj +840 0 obj<>endobj +841 0 obj<>endobj +842 0 obj<>endobj +843 0 obj<>endobj +844 0 obj<>endobj +845 0 obj<>endobj +846 0 obj<>endobj +847 0 obj<>endobj +848 0 obj<>endobj +849 0 obj<>endobj +850 0 obj<>endobj +851 0 obj<>endobj +852 0 obj<>endobj +853 0 obj<>endobj +854 0 obj<>endobj +855 0 obj<>endobj +856 0 obj<>endobj 857 0 obj[806 0 R 807 0 R 808 0 R @@ -1556,37 +1558,42 @@ endobj 854 0 R 855 0 R 856 0 R]endobj -858 0 obj<>endobj -859 0 obj<>endobj -860 0 obj<>endobj -861 0 obj<>endobj -862 0 obj<>endobj -863 0 obj<>endobj -864 0 obj<>endobj -865 0 obj<>endobj -866 0 obj<>endobj -867 0 obj<>endobj -868 0 obj<>endobj -869 0 obj<>endobj -870 0 obj<>endobj -871 0 obj<>endobj -872 0 obj<>endobj -873 0 obj<>endobj -874 0 obj<>endobj -875 0 obj<>endobj -876 0 obj<>endobj -877 0 obj<>endobj -878 0 obj<>endobj -879 0 obj<>endobj -880 0 obj<>endobj -881 0 obj<>endobj -882 0 obj<>endobj -883 0 obj<>endobj -884 0 obj<>endobj -885 0 obj<>endobj -886 0 obj<>endobj -887 0 obj<>endobj -888 0 obj[858 0 R +858 0 obj<>endobj +859 0 obj<>endobj +860 0 obj<>endobj +861 0 obj<>endobj +862 0 obj<>endobj +863 0 obj<>endobj +864 0 obj<>endobj +865 0 obj<>endobj +866 0 obj<>endobj +867 0 obj<>endobj +868 0 obj<>endobj +869 0 obj<>endobj +870 0 obj<>endobj +871 0 obj<>endobj +872 0 obj<>endobj +873 0 obj<>endobj +874 0 obj<>endobj +875 0 obj<>endobj +876 0 obj<>endobj +877 0 obj<>endobj +878 0 obj<>endobj +879 0 obj<>endobj +880 0 obj<>endobj +881 0 obj<>endobj +882 0 obj<>endobj +883 0 obj<>endobj +884 0 obj<>endobj +885 0 obj<>endobj +886 0 obj<>endobj +887 0 obj<>endobj +888 0 obj<>endobj +889 0 obj<>endobj +890 0 obj<>endobj +891 0 obj<>endobj +892 0 obj<>endobj +893 0 obj[858 0 R 859 0 R 860 0 R 861 0 R @@ -1615,221 +1622,222 @@ endobj 884 0 R 885 0 R 886 0 R -887 0 R]endobj -889 0 obj<>endobj -890 0 obj<>endobj -891 0 obj<>endobj -892 0 obj<>endobj -893 0 obj[890 0 R +887 0 R +888 0 R +889 0 R +890 0 R +891 0 R 892 0 R]endobj -894 0 obj<>endobj -895 0 obj<>endobj -896 0 obj[895 0 R]endobj -897 0 obj<>endobj -898 0 obj<>endobj +894 0 obj<>endobj +895 0 obj<>endobj +896 0 obj<>endobj +897 0 obj<>endobj +898 0 obj[895 0 R +897 0 R]endobj 899 0 obj<>endobj -900 0 obj<>endobj -901 0 obj[898 0 R -900 0 R]endobj -902 0 obj<>endobj -903 0 obj<>endobj -904 0 obj<>endobj -905 0 obj<>endobj -906 0 obj<>endobj -907 0 obj<>endobj -908 0 obj<>endobj -909 0 obj<>endobj -910 0 obj[903 0 R -905 0 R +900 0 obj<>endobj +901 0 obj<>endobj +902 0 obj<>endobj +903 0 obj[900 0 R +902 0 R]endobj +904 0 obj<>endobj +905 0 obj<>endobj +906 0 obj<>endobj +907 0 obj<>endobj +908 0 obj<>endobj +909 0 obj<>endobj +910 0 obj<>endobj +911 0 obj<>endobj +912 0 obj[905 0 R 907 0 R -909 0 R]endobj -911 0 obj<>endobj -912 0 obj<>endobj -913 0 obj<>endobj -914 0 obj<>endobj -915 0 obj[912 0 R -914 0 R]endobj -916 0 obj<>endobj -917 0 obj<>endobj -918 0 obj<>endobj -919 0 obj<>endobj -920 0 obj<>endobj -921 0 obj<>endobj -922 0 obj[917 0 R -919 0 R -921 0 R]endobj -923 0 obj<>endobj -924 0 obj<>endobj -925 0 obj<>endobj -926 0 obj<>endobj -927 0 obj<>endobj -928 0 obj<>endobj -929 0 obj<>endobj -930 0 obj<>endobj +909 0 R +911 0 R]endobj +913 0 obj<>endobj +914 0 obj<>endobj +915 0 obj<>endobj +916 0 obj<>endobj +917 0 obj[914 0 R +916 0 R]endobj +918 0 obj<>endobj +919 0 obj<>endobj +920 0 obj<>endobj +921 0 obj<>endobj +922 0 obj<>endobj +923 0 obj<>endobj +924 0 obj[919 0 R +921 0 R +923 0 R]endobj +925 0 obj<>endobj +926 0 obj<>endobj +927 0 obj<>endobj +928 0 obj<>endobj +929 0 obj<>endobj +930 0 obj<>endobj 931 0 obj<>endobj -932 0 obj<>endobj -933 0 obj[924 0 R -926 0 R +932 0 obj<>endobj +933 0 obj<>endobj +934 0 obj<>endobj +935 0 obj[926 0 R 928 0 R 930 0 R -932 0 R]endobj -934 0 obj<>endobj -935 0 obj<>endobj -936 0 obj[935 0 R]endobj -937 0 obj<>endobj -938 0 obj<>endobj -939 0 obj<>endobj -940 0 obj<>endobj -941 0 obj<>endobj -942 0 obj<>endobj -943 0 obj<>endobj -944 0 obj<>endobj -945 0 obj<>endobj -946 0 obj<>endobj -947 0 obj[938 0 R -940 0 R +932 0 R +934 0 R]endobj +936 0 obj<>endobj +937 0 obj<>endobj +938 0 obj[937 0 R]endobj +939 0 obj<>endobj +940 0 obj<>endobj +941 0 obj<>endobj +942 0 obj<>endobj +943 0 obj<>endobj +944 0 obj<>endobj +945 0 obj<>endobj +946 0 obj<>endobj +947 0 obj<>endobj +948 0 obj<>endobj +949 0 obj[940 0 R 942 0 R 944 0 R -946 0 R]endobj -948 0 obj<>endobj -949 0 obj<>endobj -950 0 obj<>endobj -951 0 obj<>endobj -952 0 obj[949 0 R -951 0 R]endobj -953 0 obj<>endobj -954 0 obj<>endobj -955 0 obj<>endobj -956 0 obj<>endobj -957 0 obj<>endobj -958 0 obj<>endobj -959 0 obj[954 0 R -956 0 R -958 0 R]endobj -960 0 obj<>endobj -961 0 obj<>endobj -962 0 obj<>endobj -963 0 obj<>endobj -964 0 obj<>endobj -965 0 obj<>endobj -966 0 obj<>endobj -967 0 obj<>endobj -968 0 obj[961 0 R -963 0 R +946 0 R +948 0 R]endobj +950 0 obj<>endobj +951 0 obj<>endobj +952 0 obj<>endobj +953 0 obj<>endobj +954 0 obj[951 0 R +953 0 R]endobj +955 0 obj<>endobj +956 0 obj<>endobj +957 0 obj<>endobj +958 0 obj<>endobj +959 0 obj<>endobj +960 0 obj<>endobj +961 0 obj[956 0 R +958 0 R +960 0 R]endobj +962 0 obj<>endobj +963 0 obj<>endobj +964 0 obj<>endobj +965 0 obj<>endobj +966 0 obj<>endobj +967 0 obj<>endobj +968 0 obj<>endobj +969 0 obj<>endobj +970 0 obj[963 0 R 965 0 R -967 0 R]endobj -969 0 obj<>endobj -970 0 obj<>endobj -971 0 obj[970 0 R]endobj -972 0 obj<>endobj -973 0 obj<>endobj -974 0 obj[973 0 R]endobj -975 0 obj<>endobj -976 0 obj<>endobj -977 0 obj[976 0 R]endobj -978 0 obj<>endobj -979 0 obj<>endobj -980 0 obj[979 0 R]endobj -981 0 obj<>endobj -982 0 obj<>endobj -983 0 obj<>endobj -984 0 obj<>endobj -985 0 obj<>endobj -986 0 obj<>endobj -987 0 obj[982 0 R -984 0 R -986 0 R]endobj -988 0 obj<>endobj -989 0 obj<>endobj -990 0 obj<>endobj -991 0 obj<>endobj -992 0 obj<>endobj -993 0 obj<>endobj -994 0 obj<>endobj -995 0 obj<>endobj -996 0 obj<>endobj -997 0 obj<>endobj -998 0 obj[989 0 R -991 0 R +967 0 R +969 0 R]endobj +971 0 obj<>endobj +972 0 obj<>endobj +973 0 obj[972 0 R]endobj +974 0 obj<>endobj +975 0 obj<>endobj +976 0 obj[975 0 R]endobj +977 0 obj<>endobj +978 0 obj<>endobj +979 0 obj[978 0 R]endobj +980 0 obj<>endobj +981 0 obj<>endobj +982 0 obj[981 0 R]endobj +983 0 obj<>endobj +984 0 obj<>endobj +985 0 obj<>endobj +986 0 obj<>endobj +987 0 obj<>endobj +988 0 obj<>endobj +989 0 obj[984 0 R +986 0 R +988 0 R]endobj +990 0 obj<>endobj +991 0 obj<>endobj +992 0 obj<>endobj +993 0 obj<>endobj +994 0 obj<>endobj +995 0 obj<>endobj +996 0 obj<>endobj +997 0 obj<>endobj +998 0 obj<>endobj +999 0 obj<>endobj +1000 0 obj[991 0 R 993 0 R 995 0 R -997 0 R]endobj -999 0 obj<>endobj -1000 0 obj<>endobj -1001 0 obj<>endobj -1002 0 obj<>endobj -1003 0 obj<>endobj -1004 0 obj<>endobj -1005 0 obj[1000 0 R -1002 0 R +997 0 R +999 0 R]endobj +1001 0 obj<>endobj +1002 0 obj<>endobj +1003 0 obj<>endobj +1004 0 obj<>endobj +1005 0 obj[1002 0 R 1004 0 R]endobj -1006 0 obj<>endobj -1007 0 obj<>endobj -1008 0 obj<>endobj -1009 0 obj<>endobj -1010 0 obj[1007 0 R -1009 0 R]endobj -1011 0 obj<>endobj -1012 0 obj<>endobj -1013 0 obj[1012 0 R]endobj -1014 0 obj<>endobj -1015 0 obj<>endobj -1016 0 obj[1015 0 R]endobj -1017 0 obj<>endobj -1018 0 obj<>endobj -1019 0 obj<>endobj -1020 0 obj<>endobj -1021 0 obj<>endobj -1022 0 obj<>endobj -1023 0 obj<>endobj -1024 0 obj<>endobj -1025 0 obj<>endobj -1026 0 obj<>endobj -1027 0 obj<>endobj -1028 0 obj<>endobj -1029 0 obj<>endobj -1030 0 obj<>endobj -1031 0 obj<>endobj -1032 0 obj<>endobj -1033 0 obj<>endobj -1034 0 obj<>endobj -1035 0 obj<>endobj -1036 0 obj<>endobj -1037 0 obj<>endobj -1038 0 obj<>endobj -1039 0 obj<>endobj -1040 0 obj<>endobj -1041 0 obj<>endobj -1042 0 obj<>endobj -1043 0 obj<>endobj -1044 0 obj<>endobj -1045 0 obj<>endobj -1046 0 obj<>endobj -1047 0 obj<>endobj -1048 0 obj<>endobj -1049 0 obj<>endobj -1050 0 obj<>endobj -1051 0 obj<>endobj -1052 0 obj<>endobj -1053 0 obj<>endobj -1054 0 obj<>endobj -1055 0 obj<>endobj -1056 0 obj<>endobj -1057 0 obj<>endobj -1058 0 obj<>endobj -1059 0 obj<>endobj -1060 0 obj<>endobj -1061 0 obj<>endobj -1062 0 obj<>endobj -1063 0 obj<>endobj -1064 0 obj[1017 0 R -1018 0 R -1019 0 R -1020 0 R -1021 0 R -1022 0 R -1023 0 R -1024 0 R +1006 0 obj<>endobj +1007 0 obj<>endobj +1008 0 obj<>endobj +1009 0 obj<>endobj +1010 0 obj<>endobj +1011 0 obj<>endobj +1012 0 obj[1007 0 R +1009 0 R +1011 0 R]endobj +1013 0 obj<>endobj +1014 0 obj<>endobj +1015 0 obj<>endobj +1016 0 obj<>endobj +1017 0 obj[1014 0 R +1016 0 R]endobj +1018 0 obj<>endobj +1019 0 obj<>endobj +1020 0 obj[1019 0 R]endobj +1021 0 obj<>endobj +1022 0 obj<>endobj +1023 0 obj[1022 0 R]endobj +1024 0 obj<>endobj +1025 0 obj<>endobj +1026 0 obj<>endobj +1027 0 obj<>endobj +1028 0 obj<>endobj +1029 0 obj<>endobj +1030 0 obj<>endobj +1031 0 obj<>endobj +1032 0 obj<>endobj +1033 0 obj<>endobj +1034 0 obj<>endobj +1035 0 obj<>endobj +1036 0 obj<>endobj +1037 0 obj<>endobj +1038 0 obj<>endobj +1039 0 obj<>endobj +1040 0 obj<>endobj +1041 0 obj<>endobj +1042 0 obj<>endobj +1043 0 obj<>endobj +1044 0 obj<>endobj +1045 0 obj<>endobj +1046 0 obj<>endobj +1047 0 obj<>endobj +1048 0 obj<>endobj +1049 0 obj<>endobj +1050 0 obj<>endobj +1051 0 obj<>endobj +1052 0 obj<>endobj +1053 0 obj<>endobj +1054 0 obj<>endobj +1055 0 obj<>endobj +1056 0 obj<>endobj +1057 0 obj<>endobj +1058 0 obj<>endobj +1059 0 obj<>endobj +1060 0 obj<>endobj +1061 0 obj<>endobj +1062 0 obj<>endobj +1063 0 obj<>endobj +1064 0 obj<>endobj +1065 0 obj<>endobj +1066 0 obj<>endobj +1067 0 obj<>endobj +1068 0 obj<>endobj +1069 0 obj<>endobj +1070 0 obj<>endobj +1071 0 obj[1024 0 R 1025 0 R 1026 0 R 1027 0 R @@ -1868,34 +1876,34 @@ endobj 1060 0 R 1061 0 R 1062 0 R -1063 0 R]endobj -1065 0 obj<>endobj -1066 0 obj<>endobj -1067 0 obj<>endobj -1068 0 obj<>endobj -1069 0 obj<>endobj -1070 0 obj<>endobj -1071 0 obj<>endobj -1072 0 obj<>endobj -1073 0 obj<>endobj -1074 0 obj<>endobj -1075 0 obj<>endobj -1076 0 obj<>endobj -1077 0 obj<>endobj -1078 0 obj<>endobj -1079 0 obj<>endobj -1080 0 obj<>endobj -1081 0 obj<>endobj -1082 0 obj<>endobj -1083 0 obj<>endobj -1084 0 obj[1065 0 R +1063 0 R +1064 0 R +1065 0 R 1066 0 R 1067 0 R 1068 0 R 1069 0 R -1070 0 R -1071 0 R -1072 0 R +1070 0 R]endobj +1072 0 obj<>endobj +1073 0 obj<>endobj +1074 0 obj<>endobj +1075 0 obj<>endobj +1076 0 obj<>endobj +1077 0 obj<>endobj +1078 0 obj<>endobj +1079 0 obj<>endobj +1080 0 obj<>endobj +1081 0 obj<>endobj +1082 0 obj<>endobj +1083 0 obj<>endobj +1084 0 obj<>endobj +1085 0 obj<>endobj +1086 0 obj<>endobj +1087 0 obj<>endobj +1088 0 obj<>endobj +1089 0 obj<>endobj +1090 0 obj<>endobj +1091 0 obj[1072 0 R 1073 0 R 1074 0 R 1075 0 R @@ -1906,412 +1914,417 @@ endobj 1080 0 R 1081 0 R 1082 0 R -1083 0 R]endobj -1085 0 obj<>endobj -1086 0 obj<>endobj -1087 0 obj<>endobj -1088 0 obj<>endobj -1089 0 obj<>endobj -1090 0 obj<>endobj -1091 0 obj<>endobj -1092 0 obj<>endobj -1093 0 obj<>endobj -1094 0 obj<>endobj -1095 0 obj[1086 0 R +1083 0 R +1084 0 R +1085 0 R +1086 0 R +1087 0 R 1088 0 R -1090 0 R -1092 0 R -1094 0 R]endobj -1096 0 obj<>endobj -1097 0 obj<>endobj -1098 0 obj<>endobj -1099 0 obj<>endobj -1100 0 obj<>endobj -1101 0 obj<>endobj -1102 0 obj<>endobj -1103 0 obj<>endobj -1104 0 obj[1097 0 R +1089 0 R +1090 0 R]endobj +1092 0 obj<>endobj +1093 0 obj<>endobj +1094 0 obj<>endobj +1095 0 obj<>endobj +1096 0 obj<>endobj +1097 0 obj<>endobj +1098 0 obj<>endobj +1099 0 obj<>endobj +1100 0 obj<>endobj +1101 0 obj<>endobj +1102 0 obj[1093 0 R +1095 0 R +1097 0 R 1099 0 R -1101 0 R -1103 0 R]endobj -1105 0 obj<>endobj -1106 0 obj<>endobj -1107 0 obj[1106 0 R]endobj -1108 0 obj<>endobj -1109 0 obj<>endobj -1110 0 obj[1109 0 R]endobj -1111 0 obj<>endobj -1112 0 obj<>endobj -1113 0 obj<>endobj -1114 0 obj<>endobj -1115 0 obj<>endobj -1116 0 obj<>endobj -1117 0 obj<>endobj -1118 0 obj<>endobj -1119 0 obj[1112 0 R -1114 0 R -1116 0 R -1118 0 R]endobj -1120 0 obj<>endobj -1121 0 obj<>endobj -1122 0 obj<>endobj -1123 0 obj<>endobj -1124 0 obj[1121 0 R -1123 0 R]endobj -1125 0 obj<>endobj -1126 0 obj<>endobj -1127 0 obj<>endobj -1128 0 obj<>endobj -1129 0 obj<>endobj -1130 0 obj<>endobj -1131 0 obj<>endobj -1132 0 obj<>endobj -1133 0 obj[1126 0 R -1128 0 R -1130 0 R -1132 0 R]endobj -1134 0 obj<>endobj -1135 0 obj<>endobj -1136 0 obj<>endobj -1137 0 obj<>endobj -1138 0 obj[1135 0 R -1137 0 R]endobj -1139 0 obj<>endobj -1140 0 obj<>endobj -1141 0 obj<>endobj -1142 0 obj<>endobj -1143 0 obj<>endobj -1144 0 obj<>endobj -1145 0 obj<>endobj -1146 0 obj<>endobj -1147 0 obj<>endobj -1148 0 obj<>endobj -1149 0 obj<>endobj +1101 0 R]endobj +1103 0 obj<>endobj +1104 0 obj<>endobj +1105 0 obj<>endobj +1106 0 obj<>endobj +1107 0 obj<>endobj +1108 0 obj<>endobj +1109 0 obj<>endobj +1110 0 obj<>endobj +1111 0 obj[1104 0 R +1106 0 R +1108 0 R +1110 0 R]endobj +1112 0 obj<>endobj +1113 0 obj<>endobj +1114 0 obj[1113 0 R]endobj +1115 0 obj<>endobj +1116 0 obj<>endobj +1117 0 obj[1116 0 R]endobj +1118 0 obj<>endobj +1119 0 obj<>endobj +1120 0 obj<>endobj +1121 0 obj<>endobj +1122 0 obj<>endobj +1123 0 obj<>endobj +1124 0 obj<>endobj +1125 0 obj<>endobj +1126 0 obj[1119 0 R +1121 0 R +1123 0 R +1125 0 R]endobj +1127 0 obj<>endobj +1128 0 obj<>endobj +1129 0 obj<>endobj +1130 0 obj<>endobj +1131 0 obj[1128 0 R +1130 0 R]endobj +1132 0 obj<>endobj +1133 0 obj<>endobj +1134 0 obj<>endobj +1135 0 obj<>endobj +1136 0 obj<>endobj +1137 0 obj<>endobj +1138 0 obj<>endobj +1139 0 obj<>endobj +1140 0 obj[1133 0 R +1135 0 R +1137 0 R +1139 0 R]endobj +1141 0 obj<>endobj +1142 0 obj<>endobj +1143 0 obj<>endobj +1144 0 obj<>endobj +1145 0 obj[1142 0 R +1144 0 R]endobj +1146 0 obj<>endobj +1147 0 obj<>endobj +1148 0 obj<>endobj +1149 0 obj<>endobj 1150 0 obj<>endobj -1151 0 obj<>endobj -1152 0 obj<>endobj -1153 0 obj<>endobj -1154 0 obj<>endobj -1155 0 obj<>endobj -1156 0 obj<>endobj -1157 0 obj<>endobj -1158 0 obj<>endobj -1159 0 obj<>endobj -1160 0 obj<>endobj -1161 0 obj<>endobj -1162 0 obj<>endobj -1163 0 obj<>endobj -1164 0 obj<>endobj -1165 0 obj<>endobj -1166 0 obj<>endobj -1167 0 obj<>endobj -1168 0 obj<>endobj -1169 0 obj<>endobj -1170 0 obj<>endobj -1171 0 obj<>endobj -1172 0 obj<>endobj -1173 0 obj<>endobj -1174 0 obj<>endobj -1175 0 obj<>endobj -1176 0 obj<>endobj -1177 0 obj<>endobj -1178 0 obj<>endobj -1179 0 obj<>endobj -1180 0 obj<>endobj -1181 0 obj<>endobj -1182 0 obj<>endobj -1183 0 obj<>endobj -1184 0 obj<>endobj -1185 0 obj<>endobj -1186 0 obj<>endobj -1187 0 obj<>endobj -1188 0 obj<>endobj -1189 0 obj<>endobj -1190 0 obj<>endobj -1191 0 obj<>endobj -1192 0 obj<>endobj -1193 0 obj<>endobj -1194 0 obj<>endobj -1195 0 obj<>endobj -1196 0 obj<>endobj -1197 0 obj<>endobj -1198 0 obj<>endobj -1199 0 obj<>endobj -1200 0 obj<>endobj -1201 0 obj<>endobj -1202 0 obj<>endobj -1203 0 obj<>endobj -1204 0 obj<>endobj -1205 0 obj<>endobj -1206 0 obj<>endobj -1207 0 obj<>endobj -1208 0 obj<>endobj -1209 0 obj<>endobj -1210 0 obj<>endobj -1211 0 obj<>endobj -1212 0 obj<>endobj -1213 0 obj<>endobj -1214 0 obj<>endobj -1215 0 obj<>endobj -1216 0 obj<>endobj -1217 0 obj<>endobj -1218 0 obj<>endobj -1219 0 obj<>endobj -1220 0 obj<>endobj -1221 0 obj<>endobj -1222 0 obj<>endobj -1223 0 obj<>endobj -1224 0 obj<>endobj -1225 0 obj<>endobj -1226 0 obj<>endobj -1227 0 obj<>endobj -1228 0 obj<>endobj -1229 0 obj<>endobj -1230 0 obj<>endobj -1231 0 obj<>endobj -1232 0 obj<>endobj -1233 0 obj<>endobj -1234 0 obj<>endobj -1235 0 obj<>endobj -1236 0 obj<>endobj -1237 0 obj<>endobj -1238 0 obj<>endobj -1239 0 obj<>endobj -1240 0 obj<>endobj -1241 0 obj<>endobj -1242 0 obj<>endobj -1243 0 obj<>endobj -1244 0 obj<>endobj -1245 0 obj<>endobj -1246 0 obj<>endobj -1247 0 obj<>endobj -1248 0 obj<>endobj -1249 0 obj<>endobj -1250 0 obj<>endobj -1251 0 obj<>endobj -1252 0 obj<>endobj -1253 0 obj<>endobj -1254 0 obj<>endobj -1255 0 obj<>endobj -1256 0 obj<>endobj -1257 0 obj<>endobj -1258 0 obj<>endobj -1259 0 obj<>endobj -1260 0 obj<>endobj -1261 0 obj<>endobj -1262 0 obj<>endobj -1263 0 obj<>endobj -1264 0 obj<>endobj -1265 0 obj<>endobj -1266 0 obj<>endobj -1267 0 obj<>endobj -1268 0 obj<>endobj -1269 0 obj<>endobj -1270 0 obj<>endobj -1271 0 obj<>endobj -1272 0 obj<>endobj -1273 0 obj<>endobj -1274 0 obj<>endobj -1275 0 obj<>endobj -1276 0 obj<>endobj -1277 0 obj<>endobj -1278 0 obj<>endobj -1279 0 obj<>endobj -1280 0 obj<>endobj -1281 0 obj<>endobj -1282 0 obj<>endobj -1283 0 obj<>endobj -1284 0 obj<>endobj -1285 0 obj<>endobj -1286 0 obj<>endobj -1287 0 obj<>endobj -1288 0 obj<>endobj -1289 0 obj<>endobj -1290 0 obj<>endobj -1291 0 obj<>endobj -1292 0 obj<>endobj -1293 0 obj<>endobj -1294 0 obj<>endobj -1295 0 obj<>endobj -1296 0 obj<>endobj -1297 0 obj<>endobj -1298 0 obj<>endobj -1299 0 obj<>endobj -1300 0 obj<>endobj -1301 0 obj<>endobj -1302 0 obj<>endobj -1303 0 obj<>endobj -1304 0 obj<>endobj -1305 0 obj<>endobj -1306 0 obj<>endobj -1307 0 obj<>endobj -1308 0 obj<>endobj -1309 0 obj<>endobj -1310 0 obj<>endobj -1311 0 obj<>endobj -1312 0 obj<>endobj -1313 0 obj<>endobj -1314 0 obj<>endobj -1315 0 obj<>endobj -1316 0 obj<>endobj -1317 0 obj<>endobj -1318 0 obj<>endobj -1319 0 obj<>endobj -1320 0 obj<>endobj -1321 0 obj<>endobj -1322 0 obj<>endobj -1323 0 obj<>endobj -1324 0 obj<>endobj -1325 0 obj<>endobj -1326 0 obj<>endobj -1327 0 obj<>endobj -1328 0 obj<>endobj -1329 0 obj<>endobj -1330 0 obj<>endobj -1331 0 obj<>endobj -1332 0 obj<>endobj -1333 0 obj<>endobj -1334 0 obj<>endobj -1335 0 obj<>endobj -1336 0 obj<>endobj -1337 0 obj<>endobj -1338 0 obj<>endobj -1339 0 obj<>endobj -1340 0 obj<>endobj -1341 0 obj<>endobj -1342 0 obj<>endobj -1343 0 obj<>endobj -1344 0 obj<>endobj -1345 0 obj<>endobj -1346 0 obj<>endobj -1347 0 obj<>endobj -1348 0 obj<>endobj -1349 0 obj<>endobj -1350 0 obj<>endobj -1351 0 obj<>endobj -1352 0 obj<>endobj -1353 0 obj<>endobj -1354 0 obj<>endobj -1355 0 obj<>endobj -1356 0 obj<>endobj -1357 0 obj<>endobj -1358 0 obj<>endobj -1359 0 obj<>endobj -1360 0 obj<>endobj -1361 0 obj<>endobj -1362 0 obj<>endobj -1363 0 obj<>endobj -1364 0 obj<>endobj -1365 0 obj<>endobj -1366 0 obj<>endobj -1367 0 obj<>endobj -1368 0 obj<>endobj -1369 0 obj<>endobj -1370 0 obj<>endobj -1371 0 obj<>endobj -1372 0 obj<>endobj -1373 0 obj<>endobj -1374 0 obj<>endobj -1375 0 obj<>endobj -1376 0 obj<>endobj -1377 0 obj<>endobj -1378 0 obj<>endobj -1379 0 obj<>endobj -1380 0 obj<>endobj -1381 0 obj<>endobj -1382 0 obj<>endobj -1383 0 obj<>endobj -1384 0 obj<>endobj -1385 0 obj<>endobj -1386 0 obj<>endobj -1387 0 obj<>endobj -1388 0 obj<>endobj -1389 0 obj<>endobj -1390 0 obj<>endobj -1391 0 obj<>endobj -1392 0 obj<>endobj -1393 0 obj<>endobj -1394 0 obj<>endobj -1395 0 obj<>endobj -1396 0 obj<>endobj -1397 0 obj<>endobj -1398 0 obj<>endobj -1399 0 obj<>endobj -1400 0 obj<>endobj -1401 0 obj<>endobj -1402 0 obj<>endobj -1403 0 obj<>endobj -1404 0 obj<>endobj -1405 0 obj<>endobj -1406 0 obj<>endobj -1407 0 obj<>endobj -1408 0 obj<>endobj -1409 0 obj<>endobj -1410 0 obj<>endobj -1411 0 obj<>endobj -1412 0 obj<>endobj -1413 0 obj<>endobj -1414 0 obj<>endobj -1415 0 obj<>endobj -1416 0 obj<>endobj -1417 0 obj<>endobj -1418 0 obj<>endobj -1419 0 obj<>endobj -1420 0 obj<>endobj -1421 0 obj<>endobj -1422 0 obj<>endobj -1423 0 obj<>endobj -1424 0 obj<>endobj -1425 0 obj<>endobj -1426 0 obj<>endobj -1427 0 obj<>endobj -1428 0 obj<>endobj -1429 0 obj<>endobj -1430 0 obj<>endobj -1431 0 obj<>endobj -1432 0 obj<>endobj -1433 0 obj<>endobj -1434 0 obj<>endobj -1435 0 obj<>endobj -1436 0 obj<>endobj -1437 0 obj<>endobj -1438 0 obj<>endobj -1439 0 obj<>endobj -1440 0 obj<>endobj -1441 0 obj<>endobj -1442 0 obj<>endobj -1443 0 obj<>endobj -1444 0 obj<>endobj -1445 0 obj<>endobj -1446 0 obj<>endobj -1447 0 obj<>endobj -1448 0 obj<>endobj -1449 0 obj<>endobj -1450 0 obj<>endobj -1451 0 obj<>endobj -1452 0 obj<>endobj -1453 0 obj<>endobj -1454 0 obj<>endobj -1455 0 obj<>endobj -1456 0 obj<>endobj -1457 0 obj<>endobj -1458 0 obj<>endobj -1459 0 obj<>endobj -1460 0 obj<>endobj -1461 0 obj<>endobj -1462 0 obj<>endobj -1463 0 obj<>endobj -1464 0 obj<>endobj -1465 0 obj<>endobj -1466 0 obj<>endobj -1467 0 obj<>endobj -1468 0 obj<>endobj -1469 0 obj<>endobj +1152 0 obj<>endobj +1153 0 obj<>endobj +1154 0 obj<>endobj +1155 0 obj<>endobj +1156 0 obj<>endobj +1157 0 obj<>endobj +1158 0 obj<>endobj +1159 0 obj<>endobj +1160 0 obj<>endobj +1161 0 obj<>endobj +1162 0 obj<>endobj +1163 0 obj<>endobj +1164 0 obj<>endobj +1165 0 obj<>endobj +1166 0 obj<>endobj +1167 0 obj<>endobj +1168 0 obj<>endobj +1169 0 obj<>endobj +1170 0 obj<>endobj +1171 0 obj<>endobj +1172 0 obj<>endobj +1173 0 obj<>endobj +1174 0 obj<>endobj +1175 0 obj<>endobj +1176 0 obj<>endobj +1177 0 obj<>endobj +1178 0 obj<>endobj +1179 0 obj<>endobj +1180 0 obj<>endobj +1181 0 obj<>endobj +1182 0 obj<>endobj +1183 0 obj<>endobj +1184 0 obj<>endobj +1185 0 obj<>endobj +1186 0 obj<>endobj +1187 0 obj<>endobj +1188 0 obj<>endobj +1189 0 obj<>endobj +1190 0 obj<>endobj +1191 0 obj<>endobj +1192 0 obj<>endobj +1193 0 obj<>endobj +1194 0 obj<>endobj +1195 0 obj<>endobj +1196 0 obj<>endobj +1197 0 obj<>endobj +1198 0 obj<>endobj +1199 0 obj<>endobj +1200 0 obj<>endobj +1201 0 obj<>endobj +1202 0 obj<>endobj +1203 0 obj<>endobj +1204 0 obj<>endobj +1205 0 obj<>endobj +1206 0 obj<>endobj +1207 0 obj<>endobj +1208 0 obj<>endobj +1209 0 obj<>endobj +1210 0 obj<>endobj +1211 0 obj<>endobj +1212 0 obj<>endobj +1213 0 obj<>endobj +1214 0 obj<>endobj +1215 0 obj<>endobj +1216 0 obj<>endobj +1217 0 obj<>endobj +1218 0 obj<>endobj +1219 0 obj<>endobj +1220 0 obj<>endobj +1221 0 obj<>endobj +1222 0 obj<>endobj +1223 0 obj<>endobj +1224 0 obj<>endobj +1225 0 obj<>endobj +1226 0 obj<>endobj +1227 0 obj<>endobj +1228 0 obj<>endobj +1229 0 obj<>endobj +1230 0 obj<>endobj +1231 0 obj<>endobj +1232 0 obj<>endobj +1233 0 obj<>endobj +1234 0 obj<>endobj +1235 0 obj<>endobj +1236 0 obj<>endobj +1237 0 obj<>endobj +1238 0 obj<>endobj +1239 0 obj<>endobj +1240 0 obj<>endobj +1241 0 obj<>endobj +1242 0 obj<>endobj +1243 0 obj<>endobj +1244 0 obj<>endobj +1245 0 obj<>endobj +1246 0 obj<>endobj +1247 0 obj<>endobj +1248 0 obj<>endobj +1249 0 obj<>endobj +1250 0 obj<>endobj +1251 0 obj<>endobj +1252 0 obj<>endobj +1253 0 obj<>endobj +1254 0 obj<>endobj +1255 0 obj<>endobj +1256 0 obj<>endobj +1257 0 obj<>endobj +1258 0 obj<>endobj +1259 0 obj<>endobj +1260 0 obj<>endobj +1261 0 obj<>endobj +1262 0 obj<>endobj +1263 0 obj<>endobj +1264 0 obj<>endobj +1265 0 obj<>endobj +1266 0 obj<>endobj +1267 0 obj<>endobj +1268 0 obj<>endobj +1269 0 obj<>endobj +1270 0 obj<>endobj +1271 0 obj<>endobj +1272 0 obj<>endobj +1273 0 obj<>endobj +1274 0 obj<>endobj +1275 0 obj<>endobj +1276 0 obj<>endobj +1277 0 obj<>endobj +1278 0 obj<>endobj +1279 0 obj<>endobj +1280 0 obj<>endobj +1281 0 obj<>endobj +1282 0 obj<>endobj +1283 0 obj<>endobj +1284 0 obj<>endobj +1285 0 obj<>endobj +1286 0 obj<>endobj +1287 0 obj<>endobj +1288 0 obj<>endobj +1289 0 obj<>endobj +1290 0 obj<>endobj +1291 0 obj<>endobj +1292 0 obj<>endobj +1293 0 obj<>endobj +1294 0 obj<>endobj +1295 0 obj<>endobj +1296 0 obj<>endobj +1297 0 obj<>endobj +1298 0 obj<>endobj +1299 0 obj<>endobj +1300 0 obj<>endobj +1301 0 obj<>endobj +1302 0 obj<>endobj +1303 0 obj<>endobj +1304 0 obj<>endobj +1305 0 obj<>endobj +1306 0 obj<>endobj +1307 0 obj<>endobj +1308 0 obj<>endobj +1309 0 obj<>endobj +1310 0 obj<>endobj +1311 0 obj<>endobj +1312 0 obj<>endobj +1313 0 obj<>endobj +1314 0 obj<>endobj +1315 0 obj<>endobj +1316 0 obj<>endobj +1317 0 obj<>endobj +1318 0 obj<>endobj +1319 0 obj<>endobj +1320 0 obj<>endobj +1321 0 obj<>endobj +1322 0 obj<>endobj +1323 0 obj<>endobj +1324 0 obj<>endobj +1325 0 obj<>endobj +1326 0 obj<>endobj +1327 0 obj<>endobj +1328 0 obj<>endobj +1329 0 obj<>endobj +1330 0 obj<>endobj +1331 0 obj<>endobj +1332 0 obj<>endobj +1333 0 obj<>endobj +1334 0 obj<>endobj +1335 0 obj<>endobj +1336 0 obj<>endobj +1337 0 obj<>endobj +1338 0 obj<>endobj +1339 0 obj<>endobj +1340 0 obj<>endobj +1341 0 obj<>endobj +1342 0 obj<>endobj +1343 0 obj<>endobj +1344 0 obj<>endobj +1345 0 obj<>endobj +1346 0 obj<>endobj +1347 0 obj<>endobj +1348 0 obj<>endobj +1349 0 obj<>endobj +1350 0 obj<>endobj +1351 0 obj<>endobj +1352 0 obj<>endobj +1353 0 obj<>endobj +1354 0 obj<>endobj +1355 0 obj<>endobj +1356 0 obj<>endobj +1357 0 obj<>endobj +1358 0 obj<>endobj +1359 0 obj<>endobj +1360 0 obj<>endobj +1361 0 obj<>endobj +1362 0 obj<>endobj +1363 0 obj<>endobj +1364 0 obj<>endobj +1365 0 obj<>endobj +1366 0 obj<>endobj +1367 0 obj<>endobj +1368 0 obj<>endobj +1369 0 obj<>endobj +1370 0 obj<>endobj +1371 0 obj<>endobj +1372 0 obj<>endobj +1373 0 obj<>endobj +1374 0 obj<>endobj +1375 0 obj<>endobj +1376 0 obj<>endobj +1377 0 obj<>endobj +1378 0 obj<>endobj +1379 0 obj<>endobj +1380 0 obj<>endobj +1381 0 obj<>endobj +1382 0 obj<>endobj +1383 0 obj<>endobj +1384 0 obj<>endobj +1385 0 obj<>endobj +1386 0 obj<>endobj +1387 0 obj<>endobj +1388 0 obj<>endobj +1389 0 obj<>endobj +1390 0 obj<>endobj +1391 0 obj<>endobj +1392 0 obj<>endobj +1393 0 obj<>endobj +1394 0 obj<>endobj +1395 0 obj<>endobj +1396 0 obj<>endobj +1397 0 obj<>endobj +1398 0 obj<>endobj +1399 0 obj<>endobj +1400 0 obj<>endobj +1401 0 obj<>endobj +1402 0 obj<>endobj +1403 0 obj<>endobj +1404 0 obj<>endobj +1405 0 obj<>endobj +1406 0 obj<>endobj +1407 0 obj<>endobj +1408 0 obj<>endobj +1409 0 obj<>endobj +1410 0 obj<>endobj +1411 0 obj<>endobj +1412 0 obj<>endobj +1413 0 obj<>endobj +1414 0 obj<>endobj +1415 0 obj<>endobj +1416 0 obj<>endobj +1417 0 obj<>endobj +1418 0 obj<>endobj +1419 0 obj<>endobj +1420 0 obj<>endobj +1421 0 obj<>endobj +1422 0 obj<>endobj +1423 0 obj<>endobj +1424 0 obj<>endobj +1425 0 obj<>endobj +1426 0 obj<>endobj +1427 0 obj<>endobj +1428 0 obj<>endobj +1429 0 obj<>endobj +1430 0 obj<>endobj +1431 0 obj<>endobj +1432 0 obj<>endobj +1433 0 obj<>endobj +1434 0 obj<>endobj +1435 0 obj<>endobj +1436 0 obj<>endobj +1437 0 obj<>endobj +1438 0 obj<>endobj +1439 0 obj<>endobj +1440 0 obj<>endobj +1441 0 obj<>endobj +1442 0 obj<>endobj +1443 0 obj<>endobj +1444 0 obj<>endobj +1445 0 obj<>endobj +1446 0 obj<>endobj +1447 0 obj<>endobj +1448 0 obj<>endobj +1449 0 obj<>endobj +1450 0 obj<>endobj +1451 0 obj<>endobj +1452 0 obj<>endobj +1453 0 obj<>endobj +1454 0 obj<>endobj +1455 0 obj<>endobj +1456 0 obj<>endobj +1457 0 obj<>endobj +1458 0 obj<>endobj +1459 0 obj<>endobj +1460 0 obj<>endobj +1461 0 obj<>endobj +1462 0 obj<>endobj +1463 0 obj<>endobj +1464 0 obj<>endobj +1465 0 obj<>endobj +1466 0 obj<>endobj +1467 0 obj<>endobj +1468 0 obj<>endobj +1469 0 obj<>endobj +1470 0 obj<>endobj +1471 0 obj<>endobj +1472 0 obj<>endobj +1473 0 obj<>endobj +1474 0 obj<>endobj +1475 0 obj<>endobj +1476 0 obj<>endobj +1477 0 obj<>endobj +1478 0 obj<>endobj +1479 0 obj<>endobj -1470 0 obj<>/XObject<<>>>>>>endobj -1471 0 obj<>stream +1480 0 obj<>/XObject<<>>>>>>endobj +1481 0 obj<>stream x+2T0BCs#c3\..}7K#4K=3cS`g`NvurT(JM.QpO.M+I, r endstream endobj -1472 0 obj<>/XObject<<>>>>/Annots 59 0 R>>endobj -1473 0 obj<>stream -x[rG}WLe=>mɖUUb'&,$Gˋ/@7!-9l%U.9FG}%)ϒ&O:.Ow?ӓ.wA"=sp4uspdU6|Ú:-ANj@:i>:Iʔ(Ԏ-XFsШQ`H5b dIŀ(%B4K .Km2ik8!f61,%[dO:L-h Urbp N9\ex!`_: vc0M7"(p+1A$e/ÔgiѻA4 -44cf۱m -бgiE&R,GJʺdd PEHX~;5i 1XeYbMڱǢgY19 τl^u,/Nc<%3D9q%M6l0XUud[e -lp)8^9U%2eV4:{2/:L)1[c~c?״gVkc+Xis2K ( lP7ADu9(;ɉ,6`c1? ī(#axƀ׹A4L[ZJzL"Q7cR1l!IVv,w+(9vKxQu9A,RYKk0/uh`!tr`[J1rm=[ryUk' 9a-I4,+vy5 5W9(H1XdWz ɱ}cYk1زI1Xh;$8aX=cֵ͍#p1z Ag -+EALlzP"d+lC~9Á!-YcO,Tۂ8]9*ʉ*]]IUcEQlP%mHz qs(TY₁)8L9ʉ]es|mAr1AHsCz 㷮`jzm4m pKcr -,bc`>4Z["Rn!4g`$dDZiFz aX0sܰ7i|Ĭi;/#$ie`8zCR1:3@U7YVn5 r -SAHY6쐊rȑAJ?/[5a{̜ڊHfJr )pAFNȊ:A3 -aֱǴXxj[vu~4*8 S4cm-ʐ8qeːCuDXc􉕥Gˬv}vHuS)~ A3rfoL -HY.'Ui.4TRb"IC0pG\$cȃ 0!>Ȫ<&!WЦ#6uPOs(v<@)9H*n:pL/g|k 6''+⁡9*rؑS$i vI ӧ z *H`24J9K];ljq!k ‡ -[ raI`nT"ǃAPu& $2ApHqV BE9awX\i8 -:?aXHQHX.L$x#T`Æ>sRG݋篑UaV{ F±OryaW)7 {Ti!OƇL[?8]̑(zcJH?!wozIXP 2.?Yc*X&pq}!|EtjY1<[-~;zS,m0.K2LMnm9 eWf'j`qK.& Q[#ob6pѭ?4@ -})'TbW㌦-n3|Qs$J/CL- -S,]>545d*qO?kRuhwsb6yXw6@8 'ϩ_T`ԹwK~nu"ɝ=ͯW!rk1=Hfb:o&uߢ ֖41qJؑBbPkv[)ݠ̱l&vՃnWEi "lH(5O f:mw;UEڨڰ"u]j.cߏH**zK' ?-$RX}ULNW֟ )Vz'Lp"s<lKM+ -jfA`ʋDo`ba?`S4u o=`гi|<9HuΤ|oގY\* -T<'n-ۿ"J֗?cO&65]wn-@e;U$U;{H"hJ{lN>B{Q ^xd15~uq?N}eUY\u(5z5Nmf[_ILQAo Q -OPd)Yx|{Tj`y-!ę]8v@]=ϼ|YQs)cⓖjyL֑fon!ҥ_NIrS -j 墽I9V98|5Wpr=瞨Ri_BYjbwK[]'Kp`6;a|U}K\pCy@Slz3[r*frV߽~a3HKumOS94;P0 }3$M0z唣1ppVo8i>DlO_0&g3S$Nk$g1M)ǍyIdd"CW1v;7ӛߨJ@{0mѧpCjfs;' "n]8J8-{yo>. cxϓmWwZ5V>_+y;רZ8כzws.H</Gb273[r[ -XIҤClN?N-Uendstream -endobj -1474 0 obj<>/XObject<<>>>>/Annots 102 0 R>>endobj -1475 0 obj<>stream -x[rG}WLSA܇/[YoEY'RJĄt7!)˒7yL_@h'E"ʬjI>D;>ںǟGE쉃GcUVTՀl7t[Nՠ ,GM/Fj+QvvbRVy?k;SC;aJَJʠMχq蠉cUfdh8D["W#F;c>o: c^e%Vq`lߏzq^`D(j\^.c8TcƔ1``Jwv<oӴbbPW٘mn!H/l1غ -*V| vodhXX7OIn&\iT—tr2WA7FrD)Bt]R8q] H1ulXb먱t:7٫HA,eʆ! `CFG]f`&dMÐ0 dK 0rr1TRS H\Q#=\!0XƵuU]!s -c:8;W:a;h 9șr\#=L,yCL,ALf9.kGzRiSkAu#'@&]EK샀Hznagm&`F[6TcZsJ: aW6 )H*\Q WJzAԚsPFcà2aP6hPct[90ؠSeeвwW:h -i$1%e?'qt5v;$1& OTxaE8[[9aIz 9πuq$h9RE1a cH;aȞ #=; qubc=RW\^hnιFҋL 4g,Ie0!xPu!tXDP`fE9):UcW`ŧEl}&<`f/V7rѕ"n*1k0!*l Gq5NAZƔbz m=q`ږ) oZ01e$m$}QWK)x &TeW`f_:1ApXV{LGrPN:l9R,T~k Ri4(2%19 v٠6r鰈bq&9H tAp.y@AA Oe5 c>jAp( Ghgsi;)8]qQAX_$N5k)Y~Y0_ 8BL Rp#K!9B6 rQ{~+%DgR7wy^lֻzw_ -.`^4;)W݀@'ojGh,nWb}ٮ&f͗1K fzG -bh^n~.˴#/' l?w:$Q~r}f;gCӵQo}QGt^a&@ebR7{|ݏ1{K[S\s w]JX҆[o'ff_pFu앶ɇLTf%}ԲȖbh_Ƭ;8ٱ͒o;Ƕdr!KcXQ@E^AK^る1n\Z: -J1Uh'ehń^ﶛqj_HԪ)Ip[†&q?lVpV4*3$=o!o&⪲J 72g0Rb76&`jol+R&Ɲ0T4NJ>ol6=f:8jnȨ#f\|VyYi㈝RfA~%H}ۤf+ZU/6sk.Zz.JK|Wo{#5?(@HE#Ԍw|m6$;ϧJj$m<xz\hiՐZo_ P|܊#~bZq~2_v.!ffXU|yލ;қq>:>m\yBK|VlP+i$SrE -_{H&*G{ogQaE8CX A>&ePK=[},oGb[?BLRu]~yKqmJǸ:~_?Yفz KmÃy EÖeOns ~f$^#ɧ$!MH;.aBjp!z!zzLo^HYz>g">tmO_'_Ȳgj|=;})/.{Vt[!`Ut/'?>P6endstream -endobj -1476 0 obj<>/XObject<<>>>>/Annots 144 0 R>>endobj -1477 0 obj<>stream -x[]w }c CO?=u^)JRQ{/0`IQPiiurf bЖq3-#|{~4U]ݰHzp,I=,Cz #/e ǡ> یUl04وVpڎi\# Qhvl?$ T64l12FL#6TـiDـaQ*bd؅#G41Xl7i1L\t=VM\L,MO\0"1.@p s!_Ȉi3nM#; SC l`!+Ԩ%qKpTr֌, ll`KqRge/u6`m7`8TXۈuO*QʬS6s]8 ¢j1X8Yـ'0w1ؚ>؀[ tDgcbj*16sT 0X$v]KQe $1x91mE؀^ۀUVp]RT@$Jfn \ɈM&eҘEű -T1He@S 22 Z&+lU`bD Am\흌lUqHk1Icu -FK@$(DClOȈ9X3ie-LV z5.@+̸1 6i#+T 180pL`{'#搌-?t%L|8HQ!X6$RdNBsHDNBsBNF 쨿Fq"l`,,mfa&g#rRZv̈-+-IKy 291Xq S q㈩ꄆp6`l`˖`mUU\IT +Źi5d24b6`]IE "%l`nƞ&"G1:\ZU Tpo(}DiاPJX)Y -L6.@Į2 EavRfy<.E)ei];':+JNFLRP9ۖ)0?gփ2@4rFFAy l`! 넻j#x̗E(q<鎿MƠ"+.0QMi9'R ؀ ù:(g:*M\Ȉ9(]t6`0fꠍ&:4q2FF.J -,ol\<8" -:INJ6v;_7L$:n MMSIb:tw+q(WtqVi?SZGCDZlW:ڰ+_]׈Ci*-%N%+|^i_Cn1Sٱ5Jv49[* -1'ta!BÕHuM3oe ^DZs{~8vyPg>'h/};&gߌ)V+K7Ve0:ຯ*VQKV ~vӖl N5r}??SD>tѽ_?mU<^{;c?E%cw*0OWʍ^;>,qSs#޾ӽ ^l{]>g'9$\IIvX|6o4Y›[ؚx{KJ޿$n&QMnCλ_x+Qb~3Z3?#-ct_Dߚun,UH;x\LWëj6Ɋ8]&L|¿#nn72jjXe2_ǀS;tXכ.Y7z}o ^xQsmsVs|at:rf{im*8_O}ڦ`ym(N7ӵTQw.gv͊}4Et#wH1='9d%7Y-E)]A?.lݮkf%;mUI Iju<O+>/XObject<<>>>>/Annots 189 0 R>>endobj -1479 0 obj<>stream -x[MsW!*w{O)Zl,RR9HM`|ο^,$Q%]eۙYKR:K*^O@OhUSmrURp3p<6lei ς4 T3}F`FT`U:-,k*3 Z V4U`uCV` ,QL36UҦڿHPMrCZ 6/ayȲ R@2pΥVI™ZnݏE/hk -̚rS3`y -ŘSYr<z堜dS>dy14ɸaBhC9Q ]&19 5+JZLfu%wD@nhsݖ9 4(ELs Z ֶ,p%A\DIJ$e:d  G7M#YDfGu:sxI! *k0Xk0SM[!`e-[֤NbuIfT`G0"ˇesIB`eYV ik0⹲Z8'D2p@EH/g ::`R0dl*Vɬ - - Gbt w VYCsLHZLԤEV`ZyadE$`"yΥ"lI1hq mDyK_@4p2*mX(N7:,p4Hbw^S 2Pi= -2ɽrC;g ='鄒CZLaB"Ӗɑ.gzNYI1hQcv k0DnoX-l[Q(n@ly$-F#5lMa %Ӷ)4+k1آ"omE'G?UsqV)+`RѶΰ"RJ(s^HZERVD -mRe F[ݰadY [I@)p.%?TbtY`Fʠ dP:ȗ*l&[UaJ閁v9/{$-&](e%sfW4NPrkvMMNX/|PIb)G,1n DCĕΤm蹆2 3pfDDIɊM- ͕5>%ʊ*9Td Tq^i8$6l^ N`(9L2'xDT@tV`P/bkXI -~5rG}% ErШn g "b t*k0؆CeFF <ҁ6` :S@Z Iر`[7`@J``PF!dz4.s6X"0P>`PVYIԡa UubϢ4'|Z;ϝ98A#i1惢a PWӶE&SY`RmK"~9r"P9I -LJZ 9*2d\\Yibho3`oacǤ*k05++`Kvؖžw\Ȟ"M"m3iE!F߱gP*QccKB5PCr*i8&b)s ߾C!.׈2vȱ8:Qv4"HAstA7;CˮPa9CI -C;)mŷˤĚE.WxvW~[wۿ^VMG&$f߼z'C'o`)=CXO~;~94Vn}MqF_)2.hdq]C]azakAkvviU٢6~\: *}瘫Y}5[Ϯ&,xݠQ7~M|uI -1I"GnQ9(bF%atfH4K#'n%Å!^<S΋.yDtWHMwr$LH#4Lu=cJ@$*L?r`F9B~6]9?F 74dڱ9'xrrćW|v.q=zÁ09pcPgr4"P7,GNJ"Bx~S'%Lgz¯W?QִƧ% iӸMRJ3M`>j5bQ'Ԥlѓ(GL^bq3_rG 3kS;zƇtY a++$Zih*) `ӳ<(LgY(qGwwR,_7]֦/(l-\hnFySi5GɁ_yowMw.Ƣ,tA"/7orz1ԭv羐;bp,/Ģ9*9d;Rrv0VK1DqD4廳sRhE>OsiIbSwyf.exNc6nvjUEC6W?!2,'RN]h"ٗQe trqz"JoTޭ먨OkO_{ؤ_. pq([_p%ֲ# X/YZGty1>&pOO2^7_k2I -&b˘'3ǑADA0Oݪ 5c$,M렪%PЊIbk>[HH(cn^< X=p)nO ңG(f7)|W~K7 .meǽ+siN2LI~r].|V }~4DlPdmneѣNڞI'IM%Ljn]uQ.~{B\.w/%fi+#'#w?!>a5t?]p>R>#&ǟe &y.P4=ϓP -MQ[*ς^\X_29mn7bs{^ -z*۸:xAWbn+jĵO)/iMF9{9#[}QZ_jnǐnz7BQZ|\;N7l#qloVO/QDn(ͤWW>ت1_un;7ߝ.䴟WŻ.)NHbzwOŋ?kQendstream -endobj -1480 0 obj<>/XObject<<>>>>/Annots 234 0 R>>endobj -1481 0 obj<>stream -x[v[7}W΃4+I5ʲt\]č3V}H  5yVdd8KV#sA*;}GXK2r,[h+s.jąaIDzLʒ'9aMga}"6Cu͂(cP#Wc&(/5V'% lȅ3ct0[8V̫ d&5%=FXnE4{)XHD9Y^Q %!B`#I}j1HcԵ: 5kk8IfhTѐ]HcI2h#ɪ\\e[:LᇎulKX NcYDUAtZҴ)"MGd`F.ꥤǤ'X"#ea -]hP-$c4`:aب: :P1Xgֶba(∅#7 -XrB\3(`Xb!ul3( Lȉ|9*ō-RdhZ:Liެð=7eE!`2 Lȉ9(-2Ɗ2uX1Vmeϕeeg&QLF )1XEx*<0XʳE(þa`DNWAt*(12';0XY`c#a[SC0 qDĐ"ȱ@m+qY' lVe,ehO5D@kDSDݏ?vb` -1ul[4V L2{ r,CGɱDpr2T&3MxKR ' - -o,f*L/v <|>]N9́&lq}qhj -xEIExno]m>~EKSl1׳=\,_qb!]~VP֧J'T\꘯'/×RB˳ΌsI5"q@Y%~\ڣpx)u -WIuPu*`Vb_]ϡ&Af,"l_>ny!S -ԘU ;yX/reMḛ{i@v-n?}=O;%0t• Q[#`7MWS;" a'^N*?_!5Uugk~V­ -Av)C߷^V -yI\Kr7SBk:(|?)%]R?HJ/$ˣ7$3-+v<ݽT igiZx:ksx"JV2EQؼDH%͝-(Aua.o7KI5f#bu@a+ɔa)|h*#q֟Nד;Gtw)nC;2`#&[רFm$Ar8qKUrsn;%{I3v/bJDZ9 -*bo-~gѕOp{lr4^9ُ$HLGMqԸi -C'T;!.v2³OJz8Zy x׊i> y.|c[ݬqoޜ|9(Nﴲ~q Q nN*o5ُIq_d}mw/yBDWۮɜ=^.{n!CQ., ɣY,f3Jq7f-GUί (-Η(FBMFi4M ~ʭ ~Ͽ&"WN$ U_ǽU\iLuYz`sp'U}ݞ)CK[Jǝ^u&5Vf:iY{BDӪVmL4xPrvDp{=jiHF$z$zFߜ1UW UHڜ#Xtjp[$څ7Yx[xak:bvI"V@Nۤ{p^'_Ob7dCud/uxNO"Qk׍s砺wCB5ŅWϯ5“aVVkͥ'ZZ_? sdzkI2í";*;1ɄvP4/YFWr3 M/Zw6bەS% [,*ݯ`rd'Ы?{a|Onwx]4*d q3N1}|1DR( *(ILcˊu'2ffBJ\ ߼ǻihVtQ'$nX<½3G<`n9AmX7\xWa}TݺSL~EA1xu gf+{M6@\ehf87b_ȋu?Oi|endstream -endobj -1482 0 obj<>/XObject<<>>>>/Annots 277 0 R>>endobj -1483 0 obj<>stream -x[KGϯ bGtOaY& .02z,i/3*52wkG>}Gee=%)wI%yV'$7oh*ۉ`LO \%e9 g*qi1 i1جԖ5lՎ44PrЀ DC7K"Kne2Іs+1m'M,T!*$%ݨŤd5xd.%SҤl+k";%CGڰ<4d =\F]D,+6{]3r]:BgH6yYQd9 <Ulm蹦?$@&mh4K"-Be1faEGM<'#5$4i)+]9sG \%m9YF@#m -{P@ߡrah2 -@%-p -ra &QV[Z\ZÂJZLZK>M H*~(3$pp$S^9 N@9*Q@ 4MIby5`z$b%HݣdlFc e"NHmJZ B) oPG!qܬ,3 %;K9vV0&Q@eh%-QcD v hJJâPhCϱ3h)URfМ -( PuREpP"# Eh*eB=W7ve o/~#t?F+>cm%~lia؛>=K>ngݚͼՏ`; -4 mP`'\R|n6{ԝizѷ8NC:8Vck[3Db 7vW9"u=]wI'恫a#+ЕQHB3kbkӆz3=)5D='AQGMRaeXV7ﺙ6zY[eE.AOQ=s$W\3 yS\~2TqX?_8N -[eW^8mn×~;U J^85 w6՞7<$O'o[t ⵱W IKfx^̆yfKՋC=n~uEF{$.F-67c罾$C`®̌8P[ss7bhPUOZ#|Mp*cUm(Hi3Rd ֊>= -?Eoຳ~=_|)Ե98p匃;MLYBTCgcr%tج,Tetވa] ^ܫk1_(8v}r9٫sc-9 -^Bl=\ #i욽jOn Zy^y?3hb}#ޱ/ 6Ӌ 'M8Ϯsc\q^ts;ѓL ?\Oo7XZw;%ٕv/#q蕲)Mo& *zp1pYƉVXf/T(8 [;+oe3g tܫQ􊫼CF[3;q8^O -؅pbZP?]P6ukIJl'S_ciԅ[IylX[8JCX?>kuGxƵ}w1g$B =(c$ue_LQ8F_dyzKV <wc>3z`=ɂݛ{/yW2]ޅWx[6,9lkɥ_u@61WrG9 -$~iyxBYY6xJht ܞ8L[}eĚ#̞43,?-<$!8=B"o45MFw ߸,*n+x{y+ޥZ?o߭l^*Z@\@xńxk2,`+653|^rB'}> aCiС;Ѫ4nY=jV9qmӳg?%/6ïHavBMՅ96:m}˓AD8endstream -endobj -1484 0 obj<>/XObject<<>>>>/Annots 320 0 R>>endobj -1485 0 obj<>stream -x[MsGW-ك˖,>ig"-$G;$ʿ*%rR͛Fh4s%)͒&O:I'~'I]v:)I*:spTդvK'\'YMrGz siJH`nR9EM -Cn:i>›<`IJfdUI9Nڒ84A$*1"(7a{$;Nn`댌ձbNMJ5 bVc2H06'MP8)Ieٜ% #@͉\VdkǤp ;aLX;c=[0XQ-6Q%R಴*%=JزPX:aQ+*oڊ8Y#=Ƥ]XɇP{ H%cye5wzUQ$.9FzL -RcElYp&6pAClN_0ؚ;aCCXv]e 'k!wǹ;kSRzD^h;V@6 -bhnk܅RAE ,!däc+5a/~)Q4 `ݑ 5R6 o u#=%c&?P̱Öl,/LYa+ Ѕ\Ry5cL -Y XTJm[D0)\*cʳ(ѹEi23o"p;~1PHIl(-$ X@RtUcw#c&66: / a8ubJƊyF20 !A*Fz XV 09Ic:mvJe9[0aǺn:b\>Eݮ?ˁa/ -M|s'b 8[c-Ɵ<-7d!nW,fԡi bSfJWRnmqEG%G!~'Rw۸u3\Fĵat_ W<چ5 mN[.=>Zvs8}xw2>^ج>YRvh|?ƟUw/|Z-hYp2Esʃ&ExGny/ $>%"%aA@QeC?Yq/7H. ȐN})p)ݍ6U;' -wɠ~~dg^{]+A9Nģ_A|7|Bǟ4NģchN7?Ar*| #{]CNG ⫡ G +e\m9ݓăMMGOWQ[PU|spiۑ=ܫr%?an?]?u=QX7 -pY+bqǍt -%YϛKg>/XObject<<>>>>>>endobj -1487 0 obj<>stream +1482 0 obj<>/XObject<<>>>>/Annots 59 0 R>>endobj +1483 0 obj<>stream +x[rG}WLe=ӖlYU%vbqK/y(bLr0$VR3 h4z'Y,i򤨓I:JDy#=IÿˤFM≃ˤ$QiQZtT,A4LQH&F%ڕ)Q QU[Q)5cUj Vub(dIŀ(%B4K .Km2ik8!fFz fڭ`kc^&yZ +4MUFք*9ʀU1L)k 1@Xv9XD~#10- [DR*r٥Jk0/uh`:9a-[Av@SiYϼ5@p0$R쫜,2M=Xɾl}m1جl,4X"uGϘum1ypFsc}Ln0JQ&5 +ې_vp``KVXb)A=&S`=!7``NdWrJhDWcUXQ%E0TI2EÜ)+"Uֽ``N4SrhhaY%y0Dh[Fn\s):-R?}k1XA["/|[B'/ǰ;ҷܯ*4<+cHmTb~l䴛r= c* VEjX86b37F 3rC /1kI:B1X,r / 8:eM"G3e` spb`,M=QQX`r41@q92H%ct à: ;uӴZ[ӌTIa".ȉYX1hF!: /Cm/FeG4r +FzL6X'bu1:.l{2pZGA85IXY}jgIKP8i$Q;e"KQ;3a!'oΤ@(J(.rR aBC%!6/4d` a}4M"=<0(5AV1 g68#@ͷO,AZV)tcz8t^v 89Yqu[ Q( Î: )N[3He>XcVAqQA \ 8N3A\kX>TW*H`4 Nr tJ9 o,0N5 i͕) CrI +,9۽kBrLU BBBvplg )r%6#b?힍<}D%M7 Qod|ͷx<~)X`|.4J_?VdAqQRajj,vXE<2kwb6[MrG&t5Iz~;78"2<,:+(rFL==BHe3di|>Y]stTyq\1ZzqK1/(iE7!uqDlO\?U~"VOs96ˮŕsnv|{KjC"n8xq#U(F'KPa0?4ͺ8.cWcyw[<iOqBv¶,*1ytX7 ,pzߐ8UG;8^Ʒp2YaPg_}3~?U/Dg*Ki*f{1s.G,ps3|Qu#2J{O]M- +,]@5SjVu7cBH~36ŋjΉlݿ3<~QQ>-yuם$n~-^̿˥<ۇǘ al6p*+J'X[Ĭ)aW~Q n'5v32pڃy,]=g&d&γ!@֬>96zqe~>.z'FՆ%\I_صQ)+8d{lIgqTEo%ޱD7e\ +YjxA *cq7YOpŵ .Zd_=`puI= xiPgQ!}YSfi"MAVWp04 ~!xrIM^:X9ۅx`OZq{;YqkE/M*ojFu_ vx8N5=">FqbEdLMB%M7f)ۓx6~4yM(&ɛ٦_lա)}{(?' 4f#X5rhDF_/َ&6`똈av ]>A߱y.ao 'D:n rYϗwz;c-jzU¶Ki^;I>)*e[I +p+}>)1zx9Nފb(m#x\]\p>u+ Ez|h>:__D׬q:n`M6Zb*Rc08T)}*%KR~ '4toq@j}K*tI= T;ȣg%|w&!Ø.tv MUTSW#M(Lʱ: 88ϥҶ/^ O@%Wu/^s|bْ4?V x3+rtpsCQE?N8sDi3tC$~̐Da )Go*cdyĖIcm<}]!MT+g +H8lHR|ke:ZwDFu^AOblz2`~R(qoE-l:,dx]ϯvd0()Gvz综)̑6@&˻p/ﴸK%d~/]_j㘚f^oV{ι %z/8 YOon*`%9Hveٜ$}1~?Vendstream +endobj +1484 0 obj<>/XObject<<>>>>/Annots 102 0 R>>endobj +1485 0 obj<>stream +x[rG}WLSA܇/[YoE^'RJS̈́8砻 I,[Iþ ,E֕Yf|I=]gU?)"Xeg\gM>\g]=vF`۪tM0d9i"t\g}1lulA:JLq`z 'c8JlH0q"W5Uc=8aCm;aLBz FuNGll0#6tq +gl \gXArBy_1R+:z#+"}\A8>8bp)Fz * c0XX~LN_whN494gErStH2]m*k\x`C 9(9N11ضD4 aj6d9!z5LR\/v -#$1ZY0[m+f %:Z`]ݴrs gZH9ӆnEUTCd! (381 vڑsT5geMp+ @&--qE^* :)1[0hGAؠ+ ֜E$ "n] A#W9UtJ0e@16 Z7bAlרb: 6aЊ W "^%=O0%e2VT1igOigjW%Or?0Z: it`Kk`X#$~5>$9@:)Izf "i` n#ǭ+J%C6kPI11a : Vl:  +6L apsCJf`Z+cL([ǴZcxR{a0Q[aIεv,2$tpXPW JsTc7f ,h:  kӶA_ +0q" +1&Hau,bthÜ0wc=+c`l~X&N +ٱEZ~ +auTCX>l؜mM(NpɡTA YԑarB9]EceBɐ P`f :E1Xo1Xi6`Ygb%<$( #![" qcNەc E6uƐD6gpJb+pP-%|mN}[bߖ) 70pFB}s04IJ,J`Fz !X1W*ctC(K2ظ3YBS6XYȅ4HiI Ɔn%I+\6Bg0SA +l8PNgE8v}:HX'% q:ކ* >3 jk:; +R('֌H]22[2}E 8#PS 8l6(A*g*EA_sG$>'qA<7h\zKu2'D] *+-*2R9f!0-n"8bwR{m 8 MAfAprQ.d}n`>1xAh$Yd9$tr!j"T ⼒8<\?x 9n_:;#|<|zȆɰ-6V- +:aƊf'%}nwK@'eՄI\ tU?\n.z[~.wl7{=ZY(08b|q0+Wag?(a:/MʖS; HA$1l ((FVek XOdM~TkY-Q`%me:)a7K2TŠ3o'A\F}K*A&Ti~!KvyrsVQc6PN9V`&f.܍|!^h&M{lNc_ kVV@U+zwnԯ $RNUIm$U9>|=S +}l7Hn6h5lQntߟdl%H+:1l.<X7m?]_CzɟMJnN_&`g$\:cp7s;VQDMR|R2o+xe$hA0qFA %L6;_fܠ9p[Fs%S*f8شwqXU@jz``I(X~v2VF{# ޽FWŊ"?78a Λ:phGu +=W_'O&vxP9l!}nɢUI1PLe:KҸ%?PÓ #^*Q5QC A֝;GO$6zGN+䫤#7نCԪM6\LوA z}ܔ1*z}]g[ ѸQ71b;8oa:"]R"r.~^^-w Xbv .J6\+Hww_QڗlۛpiQ ӅiU,ůFǁհ'{7 +g/}$X<.1 w"9JJh[rh>ڇb4͘Zd"'e*h#*i$`ȱpG5^YJ::\$%L= QY34̠x:Op+)%6'Pɳ .kI~GxqRRiM)KvpoooȨb+GͨQVa}2ѴqNRr;S$|j|vWq#Qi\d}v>S߀+>;Yju,h\eRe›of[ǫ~wk9RTtp՗F)5!?HSҷd'v{UdV7.>c2χHg$.ZZG5֋稻oCvq$^,vXu86sw]Cv 15MŢZ9Z,bw-fZC6΅Gh,4;gZݧL%|"eAqK}(8{3}ߑ-/dIgK3H,V~,؄ q;[R )7+.Q;q_ßtrvjP17S29򾫅(Y4 &Z>>8ikI;RQa7:FOTvnB[_sƫky# c}\->/XObject<<>>>>/Annots 142 0 R>>endobj +1487 0 obj<>stream +x[MsW!@8RhLY2c2QR9$&%罞^%JT%|x;3===ݽ>ɳ!gmM6Y<EKT#"+G<򉃋8YW +7EUo`EV͠t{ ,plS*?ah:ATq94l49Uq`ա-;z {"y ޺CʒAC+`r;q* $6RIiao`p/[rz`Šj:Up 9)nFz_38AXI &P9)#5kNJ@mZ칱A .L"\dzQ+ BJz +gix@r FzE2=+F3r85U9q[8ĂE3h1XֳAx9'rc_ \3 Rc.PZeÒy\O-9(cF\)FĨG'8c0N"E'8D +#=GʱEpo=0ض%XGj8[lb +oM\R^yTaH;aj{LU;X*ϟ-Z8AU\귕S5r-qxRsf-m4CEam`G5a(:3(1Xܪ~f9%8JM +.FQARqÕ9e3F\N$Uh)WSrbX#=0wC=c6c-5V|l@&4D8F9N+Gz vU4vQ3PEsPFFI8^ ͓lSYvCn0bVZz j`괙= +c=k6"iئEnǔs(1$ˆz V:LC1ؖc0 + +yL3E$m,3E;qufrT0G1``X_ EJsI(Ya 08~f"l4D# H #TUcXRYY@g#)]2qq% K9aX1eXiNf gH 1,ĴC|IRiEcôM(´8A DLšJz U6%XA7rf\: $: 96S`G.v5%=HCE|Ţ: : qΠlX`#` 3EJz06" 밚`86YV3!Pdi +u@rVdiĂ9ʻ9H~1XJ @I,ohg@fk<0XĎʳò9wmBy]aptоT~6Vܗj\JOrVtj$sU:c۴aIaR*lȱǴJCBkW0-_, +6h9jrrKFz[CDhraӔP9`)破KjQP'H2)3R ՝ժ R2Ho`vh4y˵$ ȇv(SAZՀrrBq&}2F&)1!5\8pqqpAqYljbPDH[L^ E(R:qI"oA*QAp'(" +ߪ@dr=X ACxV 8_W82/x96"r(g FgWO Κʮ?O_β՛j-?_Q8n9Ga'}f| 6̇Id?aHX¡CƓ_gO>?W؁"Ly֫۰*-qvV+~xjNYд@ INBNtx>YU=THTi`i}k"[=~o<尋pvzW+%o΃#rE +N|qqx "j2٥X#'g1[\? M4ۑ3` 4PrnS!Olo{9S̱n׃jkql?({\*Ol;yV-PrC= ~N~`׳v])mno'Xd/Qd_nejP1MU]pwl"D 'Z1]_Ro;ݽmU&=|5ofw!#"_%|2!*.8{.ԇt/Y{1gr;GY%#5j(WSUj;K~Awvw)8T}=~>v% .*m1*/_Mҏsq^ghd~V󥹺%!c)sc9%-,<( C)V9z< 9*¡vfٻ_FnvLFpwV:^϶Co,lroe16]7իBt - C[Ny#Rx9M)8P_Ւ,]}\4pJp[YDM'I+anD HNڷWg+QJ;t7P 5 C3oisndbs3^qG:\EgP`9Ac/g\z}8YUeC.'@}BiHBrq:_&Zr|-}ݣ~oFS'\3f,ًHrRbk:ꬻ>>N ؝6/b4Tۅ*oE>Iwc_73X[473^WcSqO,]1-.:m;V0Bx堓̽dg1K +7'^+%`n/ՎaW?riWJ>AͽGX¡cewKIc| VOY2&BV;l<_MP9+\{Ž@i6H5.VVx+[gC#+JgozvCp2޿<2[~Aӓf^ItȟO_NroNn > .*-zb^{\U.\*`~b=z~ڠj-ޒuERq5 +mN)T]R>7;~zFs~yw +}Gxn9_8^s&uԇsē NHp1i_O$=4 >O=Ocmc6 aq$T\߆6.s>}0fbM|mj/B%/=X+;Ft:M;l=g-7,|U64N/^ ?o! Vy_YƏ->悧SӗNg!MmͱJ|kVӫሏsՓ?Klendstream +endobj +1488 0 obj<>/XObject<<>>>>/Annots 187 0 R>>endobj +1489 0 obj<>stream +x[rG}Wcj̕3H묷bVJQĄ(ȕpInUJg@f,I,'tK2.[w( `\rpTh8I[*9LՎJZF lQ- fQHiZ硡7ul[.:Hygup5I '=[:TR,Kac<%u올l,/Zc<^.,/1.5,X6KuxEo0VDj + "10%|Rc,Z ʢ\b`.,d1φzLv 2u2(;YhHO2I* s&m2#y"u[I0alhц*+Y e`NRc,Z۱Hu߳ )yH@&pಬ!d`5a8"8c& 罙=[[t,S)SN4"Bc&e[±cE$Ku%)pA%=VX@"c, :VD6d`".K:cFʢUfGd`|i1pdL[%6pAv%=&](P67m'%y@X&8^Ж(1X]YEK'0\H2#e`SI60p e rr~J971XdVg ,=07VT3hQ86)sK GI%cˑXV00'TAL(1ؒ5a0Ү(+viH\I$Fz yh`!1e`6 +\ے) DHI r : v\@:`۬?䁔X9z`g0+e)120C.öJz,Bو"BYc&u7cR'יH(=ccEJi \*1Fuu,B=d` 0)KYZ +H^C<7y)8I6c8g&Y)Xicbq`qo՞u,ʳ^ùRy "guys=t#k +ټT(ظe,Q!za&z8ayO#=\9s,.K!0-!p$+ÈHHcE?&+YZdN( iBC,<;CEU?9$p䨘VI@=K12%mtf)jm$@E`$*:ED"aX6Ee C$n PbXY :e94_<vб(5e` PO(<P"7: AoY!0z7~]w(Ja$RIޢC(fT!|@t ?);Ng)tݱ+Vұ 6?pDh)q dJjôuP`w&J9HF#6 "5 +c{"1Kfٹ(LJ-RD ,o1~|(suCht>]u9i#q ?g]qbBެz7@ +]ξq:ކKm J5>ޯ;\K Cx7PŴ`dHf +خ;~t 9+p7yqUWע826F|-2&Iv1v;4*x"T̉hH+Vyt{?JW]v] !A2ܲ~G5'Tlד-gt &p +eSQy5O>ᥢȳna^UD:'j+'[BAj_?LVK -23W \KFS5j3pvlӵaն%jKTy!\u)U'.HY{lS%'ִ +'4畚$ּYÇ ژD/ ʯ{}lUD:[w;Jok9ܻ ) ŝO +Fy=_ +Z2_ `sgPsS69wDWjylԹq(9=̧R"NާᚐKݫC@+n :|Qn{>Li$YTw%eDŽ1mE<δ- |vIO}gZCB+&9`:Yx$7U٭2SaH@5ЧGK`'bB꟧ȹYwK +"? >WG6UO#'6@[ҊGn?nX}W`ܣ}jw3_ȩG+Uxp D%'W䔽SKwۅx`j8)Ӏ7mB]ȑ؉N޿{?z--"6!5Y X +^EOå +z\&Ԧ^s+|ur /R_p4h}j;p;:,$7}ؠO {mx;7ݿQmH6˲I%oOlևntK=[<5>[oun8,9m7lm2lݡ|߭U'KBG/o>U`A0C]* +{:_Ϧng|@ׄx1E|U ]^p}7Yxc9[K:%Q^ݰ{@ޗVث̧bɐ.*]HhP>﫯gk]>u5>T[>xsJzK؏άwQa+Tu;n!ydzk5d1ˋUq;^3o#">%/U^z6w{@?C^Ưj|?2~BҌjvǾUl+S/l\^tB$Ni,#mpY5bW`g%'47NVN-=q +L?g).P @ƅpX,§NMW[Oǔ&9;: +|YRX2?/_endstream +endobj +1490 0 obj<>/XObject<<>>>>/Annots 232 0 R>>endobj +1491 0 obj<>stream +x[]sSG}W샍~Iz +l!"-e 93}%lLRpttt {Mո:Y<KշSwQ5yu(Eu}\T]*ui #ۏF v2/:F ҏøMOEnE*࢚6U>$ jFȮe?u )av΀ Dúݟ2bmCI?l1h6`Im`~ـ1ߣvVM[SG,:ΪzlYܶL09ـl)06bƊ)i)3LQ8UɈ)+z`:,$l#0=Yƀ;(Ā +@>e#O^Km&V 6FhXulKiİlJAQ˃18 3VMcHRS;##VBgaЂÜ "[d4jĉ\eڡL+u"R OD*d؀9hl`k:*x. +p2E02bNMH"=-4sNȈ1( tLm q l`#Z`܈NA[UI-V+lQ##IwV'(;A;+\ȈuZG7e\no$+`.}{aÈ1"B +1 mo[ۈcΚŬ5rv2ɎP8#؂ p]91ؖ+3h0 # 4\TV|t +DQDUUR=j)[pҩsiKj0FwZ894;7N%Ix^sNaG;X̩ :myl185|80)36`8Hbs6bOcSqj]ln%Ȉ,CY`;f؀!ՠ*fwM.RFFA1XLX:+P)A -nR91Em" vkW!"we1#5Y>mt-\t'nFBg}peP9>J;N#"9"K l`򶲆: +8©_81Em5c +SguФ%"\BaKct O 2 l`'UFZPH\aN[&#$. +©NFL="0X]`ŭ8 +8QK Ld4 ,6qd;al mFBOPG$P6`eZYg p gn(\ XÈ¿`g) VtVEXg$/cWa"qFfqs<@pgl+~ÙNN*oH/-N>ˇH?Ƽ(ٻ'Gz]3zˇmOJ#9 5 O`l5u X.~^o Ji"42q2ߺǬmT' ;*v8;(771՛@go~'ODI eo,ccIa$2#?~|!溼dv5Gͯ[Wv%\g-|v[^:V,uej[JcNzxr1!S=CI;Z` T;gxS88K{Q,\x$ty[z8[+ۺm6j/GQF Lգ/g -'PR[:z^_TGq-J}ͭd↽Uto۾r}ntZR/~ťnO*Ն +VͤfpvdxD'ӳmzjB:nf +8~1Nir$Z-gnvZ2q&'zפfӴK`pr'6:`kt/|bJf+Vj3V2^doyr{1M<8ͺ`(=~X[;ꛫ6ȭXEujߠAhkWׯ~6vwtGxm:]Zg~~2ᗭ;hxS4hG3cWlYfI6Zo'^-fx;Cgէ.\my!f}t5eMw7ޔ-i!AO^.7zxy)) >L82^VؙZ7 Yͭty~ǃe.]Ճ7뒐67NLx3z9?Tϖ'|gm-x4勸t=>eendstream +endobj +1492 0 obj<>/XObject<<>>>>/Annots 275 0 R>>endobj +1493 0 obj<>stream +x[MﯘCa|)^EVY"\G䬖?$W@ d+)]7hэF%)uI%yV$œIR-8URp̐ImYV@p^рr`@e @4t%$by 5lKN # 2N=׶h .InȲІg 5 8=RòЕo( 6 s P{,CCs.s0 KI!I',T!Ԁ&rLxd.1Mʊ “U2PM/%@mrIR,, +]~d]z92G&E9(Bo8E!8vc8`\9rJRvMyo |p( +[" @HcKCD2" Sec41< CQ(9t#$zE# r.xm>̦C*GEh[F d9U",v +!)FBJP8@p99Glg 8L5j;8aBbElBpEfu7R 3NUCe*PhSN*)P0c1p{%H;,683.9Jx]rY~۟ +QK2fϮﻇ}whA̟a3lt>lz^ 4SzUf=Y<4/:y d:BEJfzŸgfM-o#{[U|6۬]hz ٦@31l|%Tc?:=A!$0X!1E\{/ãbO0(sgdQQU;z 0 %c5Xn-?!r$4K$PeqYȕMZC|fE r1u_2?lo/w~+GLBP!8p>v^b5WJGx>/Y!9~R:rIr2" #KpVBb0ִ[}xa!U !lrP,/wl#M&^˺ iydHbdA5X$ś+}/jCbM' AQ*C[Wvr{$!qȂgs6xeŶ-SEr5ב_AET_7oDڡ̘Waw{i&=%-DmvkG?|vwLqάyg®dfTAEcDzGhUZ!O9chsΉIՆ1m2hc' >|zx7w}j썪G,L faQl[6nQ&2}9i1' +Pdd7nm\AyQ'r*]x8 ?>t+o@5V 혁goT1i*6BNRO0e7٨\,:; :!Ѓy9^w1Qk߸o+_1XY0n_脚G::JRq4dV*D(6!Лy;Oo){A5&mIɛnN.=9qg;XBhs TM +V;{A qר3nhb(ֱw &~loWr)QA*6JqN|z=M›\Q߬duqrkx?2]Wyq/ℇ@ m.Y ǏAIoj=>q`珙Pp7d%W  tܫ(Suln|!ɮF\WjfʳSX<'&; >ωF_I)1]|:-F[RrHTK 2W̖յd9k|s:5=>]hAp-d2>w_[&(V3\֚,/oq`<.8.&ܵpU.1>N^pn~ɋq4Vڻ봥9_4^_Y1endstream +endobj +1494 0 obj<>/XObject<<>>>>/Annots 321 0 R>>endobj +1495 0 obj<>stream +x[KsWvUD/%%Ƈ8+%BaqM +HgeURVޭ43"M?M,'lb<t% $y3JX'/$e98MҌG$i2Gz ψϧGz v2 lӌJ',HT^b& z* QHf>0<)`VըÛ$d_1|<=05)kc[un9{ ,BcrԸYy {[y )zzIqӓ1آYC\ezp̨La` MXYz^:cXɹyO`0rFV +r: !m1XY6aMݳ/} } +UI}/c%\c&r"2ar.1/c=ۤcUo` 1iO l&y gI`S2cCeeϖu)@=9*ŴNyaEEX¢IvOKXNRRVNJ:00uBlJzLPp` +: &c(VzLISҐS'piX%= dcC1X3ceJEnd`S +,}#=ƔP0a1XqcJ)2%J lJ 1x(Z,+c&dCc[: #míJO)uĕ΀&,+=pae+1MRb7)E FI! bu\XT0؆Jֶ@BU{Y4_Ckkq\=pDK+81ʑ=lbBii#$9#=%za1X6cBm,9_)}x҂j2PkNֺcEzLvISc.Ӡ6lt sL1BIPt"˔zc1TXiMX%{ QXza%%:7aS`7GˉL8l˰,sʠ.bBJzL`e倠f QJ̤{pb:L { + szL6%kc=2l[`䰼&qP1Xl : :Lmb4))1b0؆bXy(K[=4pTNKBN"=X6cM6c%d&cQ^*z )?m:0%F %8.A1[N-Fz a@FZ1 -=D'oeI8* fd*#cC@FgF$封"K3QSsB3j4ئj IWg4גPPXL"bh1_c׎ se`Y0#M!){!)0q +{  Y@`1?THߗa`ZN5SR"ÚQdXt'<.:0rH +8;cXI #e@P ѝDzL桒a,'<&<&6pA #'6"VY=RIJzUVĢjE+#.QcEіj1Jzb8C +20#.Qc,ŪRoQr,Ί*00"A)@X K[F$(` D +`fh頔QXgHV J9*'@#30IP o#cH)zT0Ƹ7W/^'WKp(8WjίVpyjyHern~7*a#ue4f!(O#\N7|wNsaZgalnpKb\ʦXS+̕Ο1B3X"Z[;NS[IxS]8jq|LtqI㴻(Y(+8O/-x]^4RO> +'|'#Ǝ;_0J*eݴ waSgB7hQ%<2>0؏7*z*^n!3V\vŎnYznE`ʜ4ৗa]tUUǶV?::Faiw*yjJl^̾BDV{10xlY6фhDMn mȼ[VY_جPYu*N+dITau/'Ee?PHto+R+AXs+ֺb'=`o5$f~:Nkqٵ/Y%˦jԑ7OԟΔ*oŞmS"ͷ5O?rt%La aXvm x/fy!A=d ӴN*?¨0ũGW;ZtCj&~txN^L%QP,٢R.I^aGG2]k%H!-ˁD%/Údzӵv2rk+=RQL}5ޛj?55G-N?>xjM^D,.W#Ǭ'2/j&9YX1 Hn +nvơo;u.Ƒ"^?tH%M,909hć6ʧfv+,K)9+8\v=vXⷒ>ñGw²;ܴ]URx)~y\>? lSa7RuxDݎS;+hdީɝjG3l/W` KXa>_cR,K]ޚӑIɊI߉zp3.6Rp&ĵa8f#/ۆ5mد Zr!񭅵Xo_8;x8Y;.5+lh<>ApTڟϋ Z-{v}2 ޓ;URN ^.lo-2QJUeqǏ-ӢNBNFwgW =::v\DW;HaCF:&$Orֈ;~֘0ϮCfn>-pY}]O^Lkc]9cuCclQO0?SX^9zmnh̉io3]T8Wx YN+Q ;e҆bƎk5;15:m3Bl9)T + _{T + sTG?/lx+ +B!(WǞB|BC($_ܫ=/Ð *GC?BoW!>y^ + mtNEI*Emo.C^SWn>u6Z>f]OoϿ۝3w;z)~uiYAx:J~|p"mg 9Qa8ÿb.<9 }wZz/ " endstream +endobj +1496 0 obj<>/XObject<<>>>>>>endobj +1497 0 obj<>stream xA0 g;Gz3Ѹ?@H$"oN^LӤ{k_AR s"MpA[XlDŽf i+A/GBhrPC8$yײm'R?Us跡F.]Ƃ jq?xyƜ;endstream endobj -1488 0 obj<>/XObject<<>>>>/Annots 363 0 R>>endobj -1489 0 obj<>stream -x}]SJSٜ ,ɟfM[HSEnd[KJr~59w폑Nb7_&KnU }ti4v8%$eM>+d @4J{. NWvX.ŲRpf8*7Ee`f(PX@]H3ӅH,HaYZ,pck0t <#7L' T #8f"X` &aj=m!&'U KB gi#@IEjj0l:k0(mk0t(`Γh{ba, bؙqSLkTQ8nώ&lX9F'5m5ذqT\CF/iGT k mk3ְKc9nZ,!Ox ˀxakpxJvŰDk1T۰n8H,æ [/$KTf*I% ;5XdNe GroK)h=I%A -$&q;mOZ h0ul,s,"TŰc5X2/WD`-MeG -9LHE'ķu,?SE>ycʜE KC,9Xa lrqr` '^{(V:`QJG Kr5.`Z, }THDHƲԅ FR"́$5X+a C`k0:&rbX֒V&%^Qg5D|ٰro!`r Ű!`XN01?^E`ll۳1͡;SJjjYr4dau`ؙ]uVt<`X}Î}r"Eetck0,fD~C`k4^fZY``X:k0p`k@^E@XqLXVd'GE178[>ޔ[ cENԣ@'^Dg,(\ڕd>EDԲNVN.<&{ ~  3P_冖S7 ibE΄Xay <RϪ:i"Sk}1%c7!z;uI#DK偛s\R8sXT:G (x^VoN#PcjFA!fKvIQ[j?ݣ -ֻfH)IMA2X*y}{mu8ǜC4t>r/'Rr˹>UGh_t!˨׫ڎT3ߨƑ~R\F9u6?z,nREj掉$aE)NOmȾ,fki :gVl+LjĆ}NWcUW7n[m -4{}S ;wwE5?#ϒw.VQ/GN=-LLun~]`V_vmew}S?rbԻmvZk;uQ]+X2_6U::xηQER}B @ao~z+|˺yU1V̝&cR1/"in\M.]^Ϗbjw}p;+k?L6fl?d`~KU SzEj!D]s5oNDyEF}ݔ~reK&,~^V]Swd_n˸(Ѷu˚ hs rrӚ-K2XIn7~_Py1eY/ݿ?_fP/Bd-ZHo57/>亦:BZfF;G;}Kԋs^.B#]dl7P>m/oncJkvˤd,M3gSkB ĮC)䇻m2c2̳uM[Eamt:䑎K*8r_!endstream -endobj -1490 0 obj<>/XObject<<>>>>/Annots 417 0 R>>endobj -1491 0 obj<>stream -xZrF|Wc4$pu%qNWgGg1{HHBL -ڧb!\q133 ȿ]dal6d?>tQyX4CV'3څ `9gɺ2gS9_ih;`l++j6Y)+xY>ɄU &3a=b1)l/ YP.3JX j9fcb:Yb Eϊc[0)hU g`KJU @ȺTvReyC.U”je+R͹lb#|ɽ/DlV8 ٲ"[_b]Xa$V0r[d-d+!OKYy6>C`5.W܂d+J#V1yA1mQ@9Z\ `I rH`(aS)6fBV0XD8 db+Q̱6FB6 7H<: sC4uʦb2V)\X`ϐ" -5U  -``A$`Șf颋lO9i,]T'] 8N,kMju#nUtل -*Eq]ŬYŔjld=F[>4ʐMH73 - mX` .u``HV175>kl?.}(W ( DH*;y.`bd{3sC7 tV4 ~dq?}XБ8XXs<9Rlya fKH!` !d+jC5,bV![V0ͱ -&[ lQZ1e9g0L1g -Xw<7~A[ 8ayV XW78PL\ބkYX`ql3&ςYj<,H7*;YKW< #(. -KV0ӝB 1G5*`Md7fq⬵f+.blʣg P 9a1g1Sm9i+X$L`8k`$:Al}Y\+PQplȖ ǘh)Kfcaho|T -Mz) 6\bY1X{ -I*f /՜rf<Յ 6̄8 bxAq],bOmXzV b$[P7x.›-ؐI%b%V0(Ub]p\ +RV1XBMUX`qӨTѳcY4*QxDn"v[(+uKmm uGLYyb#L,YŮ\X -!2S;f`n.[Й f -ƲvM ->fPz`qcj䲉 &V09Q,҃V1XTggUU vXOE°wx1zX1Ȟ=۞K?8gVU.ΙPU "&e@M6(VV H*w 6^y .)A -k -kw[aCc9BRJ1X{[,V%֊ƿ"(̄RX`QKp!!s,س-uSL^=kc -se#VlcYm9r-ep YJ!=^D*3DK'2` fvDfW5t;1d" )o -9j#g#NV&t2`L”H\@w /-%.Ap%(rA>`3p]t7 \ q H\Xď-#+pSŀ-g  -W>h\fKpX.gDBAA5Ԁ-M8C, #A9r00# 7 hn%=vf}w%ޢ\~7 9OuWwouTWp6s$6_tؾ`g=5ơM»v_5}vu´iWW=>TPuw:rb1TmG]Sg}k:}5 -w΀]w/?v]_İUZޅz6!\ۋgi öv ߘFaP3Ѕ }O2z;s;{Sp;۩5wM f[}y>Bg({ ɏp9ǃ{-l[~A@(E+F~Vkzu6~=>.Py5~8o'Tx))߼ ;^vx׺hU asz䣣'! d|k6,/?}mJUZD.WvŹ>-|| ߌ*| - =Xo0MWy{`Ů갩qa2n}٠xSѧpukS[)8]F~xp]wxDdMsi@O`0'?c2*qI t'%p:l]8Jnj?͇sIVyCϕ+k -Lo;>4VX -=vato )\6wOLE_PZՆ Bu=tyl5Kxj_Dz Y`e]s63Qc_ 'Dϟ??){}N-,68 j{CuΨN7ƌu=ʪߗ+#w V R`\tΎ%@]\`v=0>Ӛ]=F2<*?#;u0R9s+/75nd/֐Ut="FTkEC'aovopz:w]Yסws煊1 7Éjh+0vI2{i;īN7q؜Ÿ7񉏿ZNW|>deYߠ'?/u?õendstream -endobj -1492 0 obj<>/XObject<<>>>>/Annots 469 0 R>>endobj -1493 0 obj<>stream -x}YMsW!`xJS%++HBb@IɯO L*UN3󱳻B7"n9g$4Oƅ${v3Y0Ei03` `llkdĪ, -rJNTH6l0 e' E `㐩 (yNf1)DS&J5Ixb0b -F-Afl-f89<[ 6MGZ vm F}1I` %a̚ O"AҌT Ӕ_`lVW2 ql05eg ) +Sq`:ιk{k*hD ҉)Kt)I m5m5)<[  -k1Xrj>d! -1`󘒽`gc QaBk1XT %`gӑf (b'aY @ S̀ X5@2[C5,3 5;>Gj!lVĎ4 -`" !v - ?b"cltphI )Nɳ8F $yMQL)#סauYP 06a*H=i6HI pǏZIL{@8Ō'̙(3ҌY`q,3Mm CcJE%CC&V,4K^:$K:(X]3/r?ѯޗ4Ű#TܪVOLX86y{VLY--`31`g'5HdWTj$m)_ -2FB2$<>N%Q1&|=`yBx[ b`%24}-XC8ͳУE 2,ȓg Fb1z)ǂ^\ۺeS:wTۮ>Ǧ޸{gwDEpEN3C@5R1rAOT-Jݼ, f2xSlJwWz/+nߔۇ/vj-0o^(eXtR8qlv(, :=/eRlǍ}:k]t#6`.7·t08-Mݶ/4ż:2pu=es`>֐<|绯nhǫڌ60f.fDK]Wc3tNɛn,O&8MݕX*VKwj'^][<S~]W,EعBwK "7m\הè:pdntb/ܼ+ r6//?~d-eD& -c[7|5+⥨֢\sٔR=qxJav˾|Fݢ.ǖSC~?T_?Ǧ M1z}.0V>/XObject<<>>>>/Annots 501 0 R>>endobj -1495 0 obj<>stream -xmWrF+vJIrdʎsAHM -ui*W> [_HYDqJn_?- -kJw hK˅`- -PE2*X*H -MT`KIaR.$+vS+ȓq a!rz ֆ&Sq$ SAndIAbWaH;"1ͬxMإƦ ذ!ێrπsƜLv*sUlu+B' -Y'Mx@ $H -뤖 dqHD0$bÞUx< 2iΐ exbSdf4ҜCLtbӐzVaD\d(b恑Z-xbfM ?8&1M9Ixf6&!Ifaj\pFUb@l){H'u!g֍F!  -s) -X"m$ -ss؃g5 ?ڲ`lYc8,+ ֥sCΝ$cNbIȳ\1O { V+VauZ-PU,!Z6Nd )WQǤ bg!`Od1r>%eAP"UT' VNJ"qdž!*R>/XObject<<>>>>>>endobj -1497 0 obj<>stream +1498 0 obj<>/XObject<<>>>>/Annots 364 0 R>>endobj +1499 0 obj<>stream +x}]SJSٜ ,ɟfM[ )End[KJr~59{*UtO#nMݪ<D>$hFq4pKI4ݣz7&|V8Pi\<R.]C"!`A,`agarܞXBR5ҥ[aG$bة4a .pY`-Mg^I[7rM#UJȁ5v41kȜF,2$ޖR@T{JHLv۞6`Xa)]b X攱5XNE~_a2 kd^Z , ϏrD OoX~|Ɣ9R5&5XN+s*m-  KOڤd'N 3*6\p3S4&C}(.D䢕"ƙ*t> +L@D@ +xC?p!oO*VP3r1X޸\p*/= X$&9?5ZAϩ [p<9mxV#'L PD3aP\p1{/iƓ[>Y>_]YG~)V]g]Нk"SX--gVf\}]\zyWyV.3W2/7{S5m.]*-@H.H1p}ȫ6f+@o$;''.I; +S5cZmvǢ{P|z׬ 2>%)uu)HXK2oTkTvu}7{nоC*9[nr9׻MN9DpzUQx[>8rԏRʗ~"ޞ\RJu޽@M1{W( ٗEl Dg̊?wH Pϩќ}ꪒM]UrMf/0kAqq=nnfB$?޸Y*"yPxuu͏l>Xpm|νmVs\z Xk?wG.vkeXKS>wJ'#S4vS?9HO>a(MwᑸO/w%_\ߟ՗ܝWSji2&2*POC(VЪvW #ocf̶C槹TŚ0W6?I4'q_.ni*MWa$M!\dkIe5z::On +m[w9Q1= -W.Y>ز$賕$fC.ae~.޾e?^߼}>=?|AL#'꒱xjX#+Z{Muh*:PtZkw/>>l;t:!k)8|?y%endstream +endobj +1500 0 obj<>/XObject<<>>>>/Annots 418 0 R>>endobj +1501 0 obj<>stream +xZrF|Wc4$pu%q㳘B$$!{mH$*%.z9:Uص?>pQeXa4{0L%M[@mGÂ%Ǒ5šqbׅe CX0#^C +amA%[Ueq"/ ٲlV0XX6 +fPeҊ)y<ۄaqPV0|º+J ͳu@Nไg%sUZ,P--Ј#u ߁ +ƲvGM'^b=(hvv{*Ux9k.X`jYXXGA!bH*Gϊjt]h?;b$*O#6tGKnb=ݳ9*&mq9+G fK&mɆ,j7piઍb5t06w  !+0g;PbEa뫰"!Gϊ4*`^lhX/Q¾,]L7aFؿҔG| {nZ 3Cfj7{p/#VlcY9m癆pUn!K)NjBCnn$^l2A "unXĐg0%/ +9 ;ίycO;:IfM*zbjkE$` 手V%PC\p c'.Ap?D bOdgA]H1rσ%P 3#gh2-g6 J" 3 -q EW?r9 od&C`$M7KC5&!3.AnYr!4q [٧@pt,=,c<,/K2LKVK'Sv/߮va{?*u}k,|jb^\> 绾;,ݩqp]7UxӵUs 9C?3-`@w9a۟Cp a5>U?d@m]wPVBp_?<]uWIZç淗ﾷ( l\xz|0ߓڎtT!\N9zۦ@fk~>^Bg(G ks4;c5;~Q@(GE+F~VkmxMnߺS˷85;7*=v^e=^~o慝rM]>~nu3Yok4}/xI'$_> 5sP[#P6Qocuq ]>w屘͟i*4=~X0MoOE)j._î Yf|yswu"u PC8b"$>d_7|9Qx՜g8* q8/x]Q4W-qc8k,GM={MmP'+OONٳl}2a2ov ftRW ֕& +~:<>xuፗ[7u*. 6O]?0Iwm)+߯ 1mj1lixa`ݡ;6G$>)?qa|ag_/O1"YZ?$,{\57>!iM`5My"0v}r80 -wF.G&S#cCi!uwmxw=^[1;QS渥~w}%,_0%p7ٝ8'6>b=mhв,?ӁXpsendstream +endobj +1502 0 obj<>/XObject<<>>>>/Annots 470 0 R>>endobj +1503 0 obj<>stream +x}YrV+bB4 )['d(Eق$$!& J| 6D:T gܜM'Seogy<$K phgMI`Y7.Ɠذj,isҘfY(i L +Đ4I;pbA6It';f&^X1 I!%cFoFM'.$@`A +&Xa4FVo RFQ(66̏g ei"ibQ,HLdz3=3YNY6 *)T,I%k3SIa fcY5#k0\ Qu0Dn&Hbh0؄YU@EșC,*OЭ5P 323_O i1XJlXC&|(^ؔa 0I љQ byh&ϩaU(+`D`3C;`س3rzY0z j#ޞds1$B4JBA`c~`dP)URo2>ҁ2'^7( FɬAg P1xݝ}&YVK-؜>\ˮ~t7szuz9~i ^WOvƶƇut]QT2nj>J 3՟?\Q>18x5ENZun^l%,w]lJw[z/ѭp}S>|7UkE4C/xEy y-T[;i(xfBA Sv4R6/U9+nW7HQbzlŲֵ"x;/;~>\^az+Fٚoͱb]}WᗺY2e{.ݦ@ 0vU|7876!w]w+c]Z!X`vޫvhj [^ +qb*}0žC5}aM5e0ROvAMw{q| `?(AǤL -dHZlx777⥨bOn)%#s 3/;<%?!a޽3B-ەǥz~GS\Sbܿt]\õժ8p|q5r{Ãu)K4DOfW4U Iz\?q9-kIّ-kX=ܺ|)%q`ELˎ*W>rq垏XtsHe1g+6?g')Hendstream +endobj +1504 0 obj<>/XObject<<>>>>/Annots 505 0 R>>endobj +1505 0 obj<>stream +xmWrF+5ޏSJ#[Uvt+B,PP>=vH\%۳3?Ҁ„3~Gƣ$KsOhB W s(Jd, |&Tao|ZiDf͘dgu88b4J(H_ +Rҙ=,l0Dpqل%F9G + =kRLF$WBy8"l#.\J+q̳MR[LȃbAWač3R{ +sZv֘R?49ł8G2Hs +GRBj 6HR*[Ul`|@z)Ս +αVGS/Ŝ C&TH0Ta.'U{ZQY%E.&kidJ)&>FEU)W0՘Xyy&Z9)nȜH(Rc68!ʦ}0)H|H5c_hFhDlȽXcڔضR$*)'lcAUñ<:`qB %`qEVxO!WZ[.UΘPV^0ˇMXy$兵 t apc0O'bf%E+[ cy-DX4ɇp(*ȘEG=ͥΘ|9V\ +7b?6OTaX+K_ ͳ1 RrP1Y<+;XZ(EVk .Mʟأ 8)p}0[0 ċ,`^ws~YV8%1(d~LYr$/#ALfA +2Wۛo[2RѦ-@gR;o#}O/xq{$K8o8.ۂ n|zYS:*Cnnxq8u0vNou~ t,_RSRo<;1OuտeEwEDrTzZbuS%<z/˲ɨ;\v^ꂮYKx3^ó +Bqيïӊ2^CWu[uunc,XJmZނw*V,qJ,!SS#8J*y9>/XObject<<>>>>>>endobj +1507 0 obj<>stream x+2T0BCs#c3\..}7K#4BHP$YSO=5/(1G!3$1''$3?O3$ BMr = !)f \CT&lendstream endobj -1498 0 obj<>/XObject<<>>>>/Annots 546 0 R>>endobj -1499 0 obj<>stream -xYnH}We3@ˆ%JO ;N4> -67"%$=.IY a]n]" %Kd:Mu1&(rMi-Յ(6d)ĝXr 38N,%Lf>B풜U .'-;Fe L;e4xAѪ` ,hÊT`.q` 0LF$;uff+Yw)*d* g 'zIƪ6D` Lo` $'Z 6Yye1ؙ˺LxX'1<ΔFa0r -`1Xyőfdҡ 8q̰C9,O H"eblZ2:ǽbl YzbBoX+q /sƕ2W>f\[({e1a6e.큵.s/7t QJkFAzuҢRQ)HV -\V=8(MZb woMEQq -Z fx >Yc3!ӟB< 8Do% RŸ pAn{H70 9\1ރNy};q%5 8ic -6rWH~Ol!2ټ6}Կo1Kc+HS>o{4uu'E]N `绝tyuK^oG-*TW'ss%ĪD^ۻ[{(|}{z+mo"2ѻۓ.;%.@ɿ7t{]t.?\]R){Т|gQ8P~rtbD?4Gm#N] P\yujɺ}]eOy[t˝ N-|+]~/3SuK?I:OJLlv&6riRgY/>ɷi:y)E(ejMS̓(N5җ0`eF6;k-mmMD3/rM޴Mp_\͏x==-?aCtYg4e9tkhxs: <jJ,ѶgAIozЋ{$?#`˺n`WEVX~))d\oNe1: -yn㧵\kLB|ۦo6͎Ê%E&7Bs{,8|-fw|O֝[\DZemλ,߆"9Mu/N.I9e|ZwHSkJ֛y?#0s,Q7I[d~4!P7\-FSUN?߆; .ޢÞ)iq:mn\y**w}-vb}$}ӕ?/74I[rp>/XObject<<>>>>/Annots 549 0 R>>endobj -1501 0 obj<>stream -x=n0~966!ks jPmDDT -5@1QuJ<)F>/XObject<<>>>>/Annots 552 0 R>>endobj -1503 0 obj<>stream +1508 0 obj<>/XObject<<>>>>/Annots 549 0 R>>endobj +1509 0 obj<>stream +xYr+fO/\$KvTeIc)e1%Dm}ιMt_ʤ}?Yh&/4YdYg`?Ad4aMM@*9kI+Aa0SlI>B팜Q!#5;D +%,h81PA1dB"@"pX*Lќ{Va Y`m9d,lcA4kÉ 3W9!8{Gj 6U,G"<0YD=pmI<9VcQ~`S), ;Rc3lZ FNUl2X*`I,f!;:Rc:Ҩgg[U|5LٗNVcGTֳ +sLYj 6 YN3vg;K9$'!eN@am zNA) ԘȂL +fp&Yؔ zFSq=kELȘ+DQn$# R +fY 9fsstIr kcw5F`Yf]DŽlˍI +bTD9/$ɑPR`ȄUѠ1Q'j '$`1p6OQ/,:"V6jd5HE70wvHTךm P?XwR11+8B25; gf',cS '9;r;9qvyRc8+=X$,|kCh} EeY yJ3{%AT rT'50ؔK[ +ER* V."JVa/F՘kb+Hcn,^`#umSeĄV0 +2Q"HNb(Ӽ4"RPUA9QpP!tF&{Һ +q9PUDĪ ! Gj `xYm޳r^Ƹba E* Qp( +0|ʊzVatclvțuQcz6(r`5K#6XTa{~Hb;h֪'#oQ! Y9)Ir5,pUuEwT1pڱ O%# Dw3H0?JdH+ k<*L< =1؈WlbI40X\%0<+3.ƀ"P+HXaoUʱ3 gYYT2ovm,{,0X(VaEEfkWvy@xIq f=YUQ.dZŸK;˜wv;9n1!f* hGDXiz* Su +ʼ1c2DK9Y( U.Y2U.YY$!Z[<3X M F-c<'吢ˉJViy, ppKMXE:Q _NNA#9k<㹢$C}k 8zCÜw N!cq2c䤮<XM/{ +kwY].>}a_tN,V&~p ]-m~_F gϑxz-,f(7eSvTͺ5mc^ڟfhlL_O)H@p]=R޴ڝYAn^L̹P^͛ir?]_̯X˘)2@\wmߛ)sٵ?{&ܵwJʥ^UrYӡdi452(UݴoC&J݉sQ}p柽L;췇n\4M {o͢.U]IIHio{7wP׫/խ쉢f)͟?7ۮeᲹV%3 "1envo[ٸfUՅ|rU ERE'0;S.m E3;7Oˤ\jx;R@$g|[k~{ie9h漴 +Umy}g6&. +JGEp7Xsf(:.#Psuy"J~4JſL\(1ϻ-(iy:n|)k{=mRmyT|<̶_%4R|#re:c=(ϔ{j͎Wnvk +ק{aɖD~[.b;UO;vܺZNSΚ_Evulq MᣉoNˌo",ѳt&<z$\\[6"зAr8%X"1tNNn%O_˃"N S'j̨zqK$endstream +endobj +1510 0 obj<>/XObject<<>>>>/Annots 552 0 R>>endobj +1511 0 obj<>stream xV]OF}ϯڗ 8 Iԇ6jZT;w&;*+$sϹg^HC i67 fKlt8 TP8< f{q:lgoNN& FR5d6 &Q0:<8_Wg42E?ٜkji( GZӢseBKik|}h|I? zB̜E$°͂)R-U"^LZҩw fUM"A"/4*~VeBC^(Q6*jjˀ+ Gvdu!9N±vJ< (iMJWpPK6b(tV7TJź\]w] WcbyLJkPTѕQFezc?qLa0 B~gQ<Rlk6e<40o+ cU@8moAo}F=h:y#WGqzxcQTאLÂFb2ODѥdK^0U2#BLַсLW$LFF'nl؉TĀx#v`(f B xNơ' CݸD+\px;K8[I#1F_<XO8D22[F6vL6R+Y-x҆ia3&VJZ8 a2f_W*Ø ;h3֓=o73n]%fQ^cwn"bKA 5WkN:x:]C+6覢/(zg~#lk+ya%ޙ%cFM}yՎ#$F $іW±q%xBXi9nw4 :([id4kS%H;〞7eʮ:Owꤊ%*w/nKݍj&N"qCe.)?:$ ! ȟusc,aġ}$st^vW CPNI}͕Qմ̾wET7lk+TeKd*=B4pkۃNJߑ aWWA@D.$"~qYBaECvrb R vm)dyȉ_^<-̙W=. vFS7)Ӣ eҦX$Gd]"W-_C.XbTnWT*“ciJ{OW}i! -ʵGSro 3.Zc9i-DW">g'w ctϩHd`jtPo>&s/9Cܯ3kpendstream -endobj -1504 0 obj<>/XObject<<>>>>>>endobj -1505 0 obj<>stream -xVko6_qWl IJe~Àl]}m >mH\Rrl'%Hk}{ιz)F4RV] !MgdD G6`X3qL;Hd~~bp34٧-sBᐖY܉#hZ؊V(MBjڛB譤/CIf&^Nb~vd_^>3)Gvr_ 'sRK$_O,kBnmZTmIOkIARK(x#e:HZ^=To.ix~PKjMs)Qf%x*6RfZJo/yQBr8%16TLc36 -]*E"@H_0"K`B@윴jIyBW`PLqj1L]LƱnt/t3>o|Тo00&\:tȃb3Al(tFH - {伉ӻ<-3UEi^vaۛJd *4jjTpnglNN9*ᢣ*K&[fi<GNȈ IFZ=y^|頂ơvz"LLI`  T\c}g} -)Dg]!@pWi+!S㺙?kN]Nn􏞻PK%=eP:3bhx?jCH a̜9]M` -=qd8RnzUvRR)d286ɕÞn5,[K8\GfpQY9/'mO7o=Lt=9e" d];2b Wݟ%򼣰=˨ E% Z<à|(`I~'rݭ^.$jH_k5_z>e08>_r_+6x}գSɺ(=ZcfSxty pB!(#d]吹wH`vXS_zۀJ! =+&l__ͺ -R4ɑR_x9  W`L(5א -{8W-=W.#'zRQnqc?n7O.n/} -*x"qltInK>KD%Q -Ϩ2)W!/7juOwOn%d$ϤVrg秪U:*h`:{|L".?_gkEdM(P\c{?.xgNfd6}_]ᾰ`endstream -endobj -1506 0 obj<>/XObject<<>>>>>>endobj -1507 0 obj<>stream -xW]o6}ϯKS Vbdzݐ4 `]ƛ1(@ITZ"UsIqn%ޏs9z0S|Bg3ʪfdJ9>O#dg''7>E$9-rBSZdGo^V?o/_8}>N.~řE~J*k7~E+geM6ZTkcJBe2Bd'ՍҎ -UJNBNcUBRpLCV*Iզq4F l'k趠ZKFp4qn2Ofb-5mMKzX;95rqGZN6tă6VY_p>>/0UTY6sMΎ3L9+JH;ղikZlH$z{y-x%eBJT"mLZ[eADYʜ$ukZnd:Ӕyrm UbSI%I'Y+5T7&-e6)?@ 3mnrД -mQ w,w7Ճ.z-Y9į".>q{9HKv)1$:%ː - >="ҲAC܀Nc43kZyʌڂhKHACJK72ND?Nt`3U 7/nw,^T6zn8c!h "y/=26l& y ]|xG291H joP=eT8ae&0ac"w $/[leT3gg2y r:02BlaH-пٹylX &tliz1N愠T>CƉE#ze^;bHeP2H|K -R쭰*B ^#~4Yv*6qC(#T~Ώ ,,੩+z8\ aȴ+WGpk[+8 +ʵGSro 3.Zc9i-DW">g'w ctϩHd`jtPo>&s/9Cܯ9rfendstream +endobj +1512 0 obj<>/XObject<<>>>>>>endobj +1513 0 obj<>stream +xV]o6}ϯ+6bٲ]Àt]!=mH\Rrl'%Hk8s,!~SxJYu6L4&#.y?+i&9>s0乃t:Nfog )->]"'diʭ9&/HlҴ-i(+HzH?DjdF.A}N$&jy/MFۻ3Cꏸr$h+Wp2'kITȲv*Vp9QD L$*Ū;99Rc3YKu)V9YK+ބ>aV"n#eU%>I,tN 7SrcmME46I{hiЅR4:+q> #*heIK6@'Ux__DY/t*?$d&LA7-*@S cȥC<(Z_>ZZH'aNOhDK@Λ^Y|hyp-J0*oư+tR 1mPQSR$s[csrqPmUY2a7r5CHK82uFF -ȅO"7dTsCM{t76sa2eOҖdpg==WL)&B<4eN B~q^sB7:?{RC-ۆCXq;雺F'GjG"3(P.:}A7]`~VN}.& +k f}[LѵJ1ku|ۖC "aB~mj(p> 'خ%C|Ap +*J$J}T&_11fL\A*P^i6pX^A|IEKS BǍq:->/XObject<<>>>>>>endobj +1515 0 obj<>stream +xW]o6}ϯKS Vldzݐ6 `]ƛ1(@ITY"UsIqn%ޏs9r41Lh19e8|zhv)o$bLrě OhY bA˜`4&AB9dj#(`V41MɜXniR4"'P1vZQ ]+U*n>& L:UͶ\kv#FJRNCcښ'1[R8]]G^ɥ!~нRAa)Ha,mYp:Q2'Iƴ[2Y夥4eީx[CإhThI,I6q ՍIKY9i2M%7L[惬DdZ|frl&4@)k[ݍr Kbr~V_%kg7ȪK)k'OuS&k+ph3r~2$AOcl5}#g7-h;y3L-چVzx2cB![`N'L| `[tn:|ÙT6cAk{rCLN@@*H=zZ7Ա<T +~AJb<>W#[@ˉur2Y`*fﱲ?iBl1;mTqq3vS ټHXۆ ]ߎq{Z6߿ٹylX &tliz1N愠T>CƉE#zc^;bHeP2H|K +R쭰*B ^#~4Yv*6qC(#T~Ώ ,,੩+z +8\ aȴ+'pk;+8 ~Ž dN (i6K1hƘ-ʄJ!J^_ 1J)xPȞ/Ez2\Ϗ|! -9'&lrϳ1 YPuwtqn4Ŷ5/x.'bߌCmU,/-XF~b,R,..1(AP9R=Fxދx<!iԘ:|9IvLf&~e0qz[s`ތGB^{G ,]c@ &*Ls -z?1"ǻ0Nr^A 6vq-[>@ٷ79a&ۏW+3@kp Z$ Z![s~PОyD U{so?5y,rLɳԯXQVƯ[fҒj -Q;Y 6zJl°O|;ȶG?2¤j*q*g /NNc17r.U&TShWw/b޻_6Z+q?kGR_LAB?\YwP>걵{]W Ķc2{rs/~ll_KzF7t>Mr<0oMްendstream +9ϧlr) YPuwtqn4Ŷ5/x>'bߌCmU,/-XF~b,R,..1(AP9R=Exދx<!iԘ:|9ILf&~e0qz;`ތGB^G ,]c@ &*Ls +z KcicǠa_ីi-N잁eY\0 bǫcu 5-hxu-ːwmA?(@ڼA"=9pSܼupY9YW(+-B}iW5zw¨=Py%`a'= d#aR}5 ~ӁGг'ﱘV*S~dv*)s;Xt 1}iv8̟5F )/ G`@{(Zq?y =. _nǫfrb1]s#ھG7<]Op߀XalQtmݔ7Y=?6/ir޿ᅗύG%7l1Kr20GCޯendstream endobj -1508 0 obj<>/XObject<<>>>>>>endobj -1509 0 obj<>stream -x]R]o0}WePH,D%[ire16".T|;#[cBvAFH(\#3^M}8F0$3T5x_zS8 ϧD^JcgL'U}0 q{l1ʼ8i$Yfi?4>U= .Vendstream +1516 0 obj<>/XObject<<>>>>>>endobj +1517 0 obj<>stream +x]R]o0}WePH,D%[ire16".T|;#[cBvAFH(\#3^M}8F0$3T5x_zS8 ϧD^JcgL'U}0 q{l1ʼ8i$Yfi?4O*$Uendstream endobj -1510 0 obj<>/XObject<<>>>>>>endobj -1511 0 obj<>stream +1518 0 obj<>/XObject<<>>>>>>endobj +1519 0 obj<>stream xWMo8W zi 4Nqvovئڋ\z%bCZoHJ/ @"͛ѿgsϜV >]ǫZެN.ϖ緛hqIL]nhS\IS% зVYin t+%/ɺ罳m3۷|nIyry-¦RJ[4|e[]V"~Q2TX5EPAj+LI8 !)TH[@ ]S9UFKYltD1KOle;<.m-aMHo%{Vκ_'mLAk2kDYJl>|_d#+I+B6G:)<vY>CPeMOʔ1>0Z0 alTdCeWBWb6g{d/T[ͮ9;|$ RsqH8 [Tz-g[m)OJ>=Iٱ췱: @@ -2766,10 +2748,10 @@ alTd >zQb1(jt =̺ sA8Z}d#WX͜B+$fL)kK "9|OJbE D2SwYTjiEm$S1BHYR/τ#Ó $?%2HE9kwYT]]8Ñ@Ɖ[OEaL"ƀA꘏PcєarEDbfHƣmrZ{ gG8sPh [nuP=z-P$&q44v  ;N5u*%d!#x2HV<V?w<*Pn+NaZ j>('Y)Kfch1F1T}=w431#;Kaxe6DG+&1c ʀ rDtrR}t#'b* JHH lfGahM)Lq Ad x7EgVfJ]#1c=ո~1EK!o>cPP&B_hи,Be -[`~*q3ML $+Cm_"(-2yK/ TBw0@ }̤.,`9J`Mh1͢񝐚UXEo.kR#Pڿ%_H#Xs-f #?NC;1j),Nk`nH5Nj%xvTbEKbEaB"e0_Ʋ5F8VC\T=t$4i_((_!Qd✿~E%3 )XX3vDl th^ i׋>T>j9[]<~9v(endstream +[`~*q3ML $+Cm_"(-2yK/ TBw0@ }̤.,`9J`Mh1͢񝐚UXEo.kR#Pڿ%_H#Xs-f #?NC;1j),Nk`nH5Nj%xvTbEKbEaB"e0_Ʋ5F8VC\T=t$4i_((_!Qd✿~E%3 )XX3vDl th^ i׋>T>j9[]|9vendstream endobj -1512 0 obj<>/XObject<<>>>>>>endobj -1513 0 obj<>stream +1520 0 obj<>/XObject<<>>>>>>endobj +1521 0 obj<>stream xWn8}W |II Ciˮ]a((HKJq{dE1P`[*3s3ß's.t>%r,_TܬO>Y^i^h.EB̎RkvN e#s*1meV^8b\S<:ZJԩ෧/h2Yw׎ldN"5rBWMP-RiPFFZjJ,}iQJdu_'TKGL*췒&Vph6n'qeS=J@:$oV)\Usp$D4Yn\)Y*z}ZQx8)J&~y^QeCt@t!3Uˈ=B6Y.wڗ '94K^":I<Ÿ(FKQ Ih-Q{ӧ^s7+\jL|:tV aiP8vZPkA ̑myT9 X/ZinDj?V2c)DY)4r(-T3 "e^ׄ _VX޿o31qNx;waսS HԻbD"{Lhƚܪ)[>C|BHch!S =|,y&A%#V7{/gAc@q`݂;9fgF7T+"Fˇj9( T~[!| {?N)+7CpXX-D dJx~\O4^U{2i @@ -2777,10 +2759,10 @@ x o,ϫf!G?l:N<Ǔ녕Xطt c^g8oz72vlgk 7ihS*Q&7zp$17M8ʟ-ePWedQbR Û-3X(<]08㾛{p 00E)$fG! Ҵ0,Xf y3O1 |9 Gg!C ך06с(;eh'F~ce7p-,>!ϹbjFt  -KfhThy")W3J>u>¡OǍ߷NXΧ%ׅE3[xv~ErѬ>yrQ|~4Ȃ:Irf0a!wAVۨA6fǎeX8 8вgoKmBMH0INȤH6I/%I ߍ"\>Η_rynϫ7ЭD_u]ΐc/|"\^r@ n}nendstream +KfhThy")W3J>u>¡OǍ߷NXΧ%ׅE3[xv~ErѬ>yrQ|~4Ȃ:Irf0a!wAVۨA6fǎeX8 8вgoKmBMH0INȤH6I/%I ߍ"\>Η_rynϫ7ЭD_u]ΐc/|"\^r@sn}dendstream endobj -1514 0 obj<>/XObject<<>>>>>>endobj -1515 0 obj<>stream +1522 0 obj<>/XObject<<>>>>>>endobj +1523 0 obj<>stream xWn8}W q>$eͥ[EAKF"]Rd;JP`u$q.gΜ8Pt61A?i skˍy2޸[aj|/LO?^ҤuM5A*%i}ӗ_̓E.GI~ Eo8u~oo&#ݘnjO !$&6 >] QKAtTy;]&eFϥ~ua2'do}.2iZS4 *< GB]*v#* QOڟsx` :E+`JiRYKX^i) 8J5"W-E[Hh#YgFus5%XLլ@\u8795enhZRدh|-zr8 &1Se9k[[bz,蠂{G TK{XUʗL1+(nX3!C#PR8h @@ -2792,23 +2774,24 @@ x l罵/aos^X:T6VepA#i|$W1٘ELX8xEQ3N-T(0+<͢8uXqCI DPdcEq V9euzANR@6Hkt`Π)Y4@hz1_ab`h‹OJR! pgFK-2F  leXyPJB]83=7'%W?"q pz ehv)L_rdjyvIq݈ۙbX -Qk94MZ{SIϛ'x+>{S޻oRXoQr6>+4N!endstream +Qk94MZ{SIϛ'x+>{S޻oRXoQr6>+4Fl_endstream endobj -1516 0 obj<>/XObject<<>>>>>>endobj -1517 0 obj<>stream +1524 0 obj<>/XObject<<>>>>>>endobj +1525 0 obj<>stream xWnF}WLRi,`'Na ܈i4E$䮺%)[o2ɝ9sf5FJˣ~ԧ x6!~<Ѭ{*>:{7&)NOqz"FR{ڮU!ɯ%\ZGބ+p^ZJ>RbI*4+bt88;MNnKڪ0hL} gHt/!onhc7)yZ8J 'WʌqV(I 홋RZ~-|rmF,(][x3"KA%+0ek _)v4i%=fK"1h zTtDnpw-$qd[,c~F$@r"8V(lZZkElHKQ&C* tUڑ6c=B;ueqAPeǪ0(ܟP_(4DZE)GY3$^uno}Ǽ]|`#m|J=A^T,dڍ^U!,KrJPn?fՄ.lJ$F*Dh:LB/B;nYut4eaM"zkB|BaHz2!-Kti@+bFKLYN 4C$,jUJ?!5 ƀv!AvkW7eyq1NB,'܊j0$9%/YPAU[+Aq5e`f(!x@U&uAG 5Hqg[y L bJ#GZHNk>\JƎAe-vXr]ff"nqnVjy#=0OKƙ`0 YDѡ>< MՌ>(-5SհѶ4L0}iyq$Ǥ]Fj f^CNAz_<g7[jܓZȷ6JQ/%Vix<@%Ƈ {7B;=QM'ʼa؄GNWd6YX= 5JVW9OP/Έ}=o2Vf9ZIvOkwD|qX{gԉu6 fp=Ɓ9'x(UQrkSgJcVZ=z0BS`*}Auh=ܗĉ KRr,X24( 8W6pܬdnxX<%C{L.'wzqz\1:K(P,7 9vu, -;yJ״_ta/,h:O#A:STa[```1Ah{_d<##64Y@LSb1Y]\{eڡM FP_NP0ޢFðySx4a*1E̬Yhr>G|hyy{uIw|x"V.^vr:=m6iN;'h:a]]Gʘendstream +;yJ״_ta/,h:O#A:STa[```1Ah{_d<##64Y@LSb1Y]\{eڡM FP_NP0ޢFðySx4a*1E̬Yhr>G|hyy{uIw|x"V.^vr:=m6iN;'h:a9~;endstream endobj -1518 0 obj<>/XObject<<>>>>>>endobj -1519 0 obj<>stream -xTMo0 W9@p;C\Pd9Vk$7Ϳ%7];,C"G%7)26I6=FBٻ{ $ %$l2AM4 /r}]sPN ຀BÕv IYN !4 ;J WwSp %a~yC\t\7R;P]rьe$A_NM{#e@[PҢn i}fCİBN: )\<6K<#QV]ZK%)^Isw`#n\;51(ԈO톈f 3V{(q JBb)Æ!}ⵑA%  _=[ov c8#Ō&l_`u+&>? x@]<2j"S'q=,y[;by-+7$gޫOX46 Waaؑv^;d㥤M-˵$V;߃eUeE)w@?`]w6K6iʏuEpZ[UNT>/XObject<<>>>>>>endobj +1527 0 obj<>stream +xTMo0 W9@p;C\Pd9V+$7Ϳ%7];,C"Gꥐ7 &GU 'PTƓ|O-IE8i:$K)!4LjGO|R<YdSB. 3Ρ]LFGIXT4kqaNFhgKn09%I )ro +8h$jgv1kξӐbɆn]AW7I ֈ%%jtZ*I2'5Ιށ2<Ę3;P Gg%P *c(j}OqM)L6̐ qO`j6gDcw$o=1N3TGG[IUMh׃dCw?>H(HR1E z˓Oz:KQV9by-+7$R [>/XObject<>>>>>endobj -1521 0 obj<>stream +1528 0 obj<>/XObject<>>>>>endobj +1529 0 obj<>stream xWn8}W pjE/liBKŵD*$WgHɱU/(93gΌ.&4ƿ -4[PZ]1ͧdA%~OJ/hL8$7xGpdA }}G1s^,oh$XKK;U:7^Mb#|'ؘ,,$Y{k&+&tqhtfRI93K4yS-92ψWLATAД2'oZJm[{& NV$&5U-,劼 rX!'5D}ٜ.9{=!X{ǥ3W(K<"t,8՚ػt?ޜ;B$K R1YZ'? WeIFm\X92e0>$3F9FJY*mK ORd6 @@ -2820,29 +2803,31 @@ u/ 0*R»8Yж,K"Mڳ'`cE2r_hH>pv1m /DCr>{LYHk㜂D$\A A;DC*3cgs -(#e&U{*1S4ۂقx0NxdfVUVYlXCͱ,?*uͰa *\4T$#ѡqΆ0OT0ˮoċc@U5~9S6a3G wE fWG;سJg~Y?^jx,Jd=TŬh̐ҝJq&(F5S"8YMHYid2On}0FB=rG8ajjД7hT0C7Ԕ-X(aEV~Vh^=畖u(ҟX=Zݯuu5&$#;|U7f;UpT - @am䯕>E2^贃3+ב[|o«,Yt5_|Of t' aqirv/% !endstream + @am䯕>E2^贃3+ב[|o«,Yt5_|Of t' aqiX_|% endstream endobj -1522 0 obj<>/XObject<<>>>>>>endobj -1523 0 obj<>stream +1530 0 obj<>/XObject<<>>>>>>endobj +1531 0 obj<>stream xW]S6}Wܷ/7BLXN-'Zd˕d v:0Ėt?9W`H i6` h<G#g<Ÿdp<Gi'p|L˔i0e<::ӟNq`@4LynJ-fFY4_nRUE mš6keW/wd]`[[`|?zq/5מGUCіHl$ 8vH@)om@w(PXKZ5h5 MjvWq ;BIR:3yT_.em`$NJb_[:n1=2o[Y[OzFR;["NW \stц쾰K `M4~#0 |K6g{JM"5* -?,|p{lR +WV}0672-}m}ny;o?;|LI4ӫO|$UI.-lp&l:Ǘ?endstream -endobj -1524 0 obj<>/XObject<<>>>>>>endobj -1525 0 obj<>stream -xV]oF|X-JdEn6 -ȓt1uwv%I`Hُ/g9|L۳Q6dӫ95x:f}gśKsZdv5EI0ѢrBؗ/p>FMکLl(:*6ʮ5e g铱]PQ@1jhCF[aF4'8^uA!8(\yUUҟFJ{2+j\M -cפ,۴okxz/6x~uז *oUElMkNoepy5}/}t(/zUI޽a:wy>ͮ[ GU՚6yژa[XGx񇭣vCQn^ݱ0P"0d'>؝NH? 0˳KdH;Vh[JH[Mt=-c3ĸwԇT+ 9г/.MUU.OU >`Y6hPo,H'T^ʷΔ.aAmGLDDTCf087.g!ʯ-;ӅY5܁AB4脟N|{Pndt"ȴ`hzBԗsvlUŃhuP>ԛSߙA."-Óa>b:v1Xh={Ǣ+u0kb#6H_+ ! b*۷ IrA@wAN(Ƥp-PSݼ[4 rT2# &i^PdIJA `Zo :TTj/J2D*nYWp2M}M3xmD5ƻs}U/,Iܣ]0Pя(XTh ښsZ*T+kh2++lTn .t,.w5"?3Цi6]s>/XObject<<>>>>/Annots 567 0 R>>endobj -1527 0 obj<>stream +?,|p{lR +WV}0672-}m}ny;o?;|LI4ӫO|$UI.-lp&l:Ǘbyendstream +endobj +1532 0 obj<>/XObject<<>>>>>>endobj +1533 0 obj<>stream +xV]oF|X-ZdEn6 +ȓy1uwv%I`Hُ/'9M✦s*6'lBg =ǯ״Y6C>f^/O\Pr -KBɄ(lV[®|*(V +U+SRtTTk@'cK tF2niC]-08F^itA!8(\zQkQҟFZ{2kj]C +cIY6" ^f]9Aԥ#Xr':Q55}n*[M%bPq%\e  Cӱ%}xz,.H Uh4rTa[XGxǝvCQnNݲ0P"0dG>ؽVH? 0ϳOd?H{xVh;JH*iՖ y]t +XL.+1 Jb4{zv\Sťk1]u*G, IDJյ @ԙv4v>J (}hwL gF,:DfN)lua-w {c6`fӋO:xgn\\ RXOrnl **]<N{EJ: d(QAr:<#.TY CvP#wޢ؈3AB6 +rtrl3~}3Н?|GP1)fX7o@M2l& {k(lVvAUSmEƚhPԶWcjOgiOYF5xwĜ~_ Fkh To#J#6#ZCtk\V +zj)8sp6233As] Z}gg зPuyʋ$Oi&(&NyhF/8%<hsjh y04mRe +]KUw|z҇n/06D$.JW?be?I%jq$N<3zwN 4WP( -]!CH +KX<9` 4yKqp VȏX^YkntqX@9{kjG+B)Z{+6bp|*l$vbt%êad%k_TYR9uǢᔶn?`k\iXyy治 9n)4>z.\QpJ8u4`\qh,[/__˓N.!,endstream +endobj +1534 0 obj<>/XObject<<>>>>/Annots 567 0 R>>endobj +1535 0 obj<>stream xXn+ ތ H M<1$psڴȦct7T7)r2@ S9zbZi2E#|r"|9FT8DSNW,8ZbuO:EsOQ4nxXPAx6q|أY4ix/MX.{#)͒lΗ.cO3.bj3V#9 >MFK?N _\ R&̗ ڤ.#$O,VkxQ!T#Sڝ~_DizJ{?nP{d AM~_=?u!JT[̊2/pA,xNs,ptF92S:8XZPvP{K1!u; 38{=}y!=f6FO}CgW\ײL̩rT k$5G6xzl e*}-I]$Hnєg(pEj` |Dj8U\ e[vRTtoA 8 8ݍ[L{E +!@HwaEicn(w 9Q.3YY;X0xno u8x~c3I]~\,eS&Tioӵ~TR<^;2@2]&6c׫0046o4]1 枥%Tr%v_]F¤żkݖ^í+*;5.&SW ul̋Ĩ䡍[d4Cz9Fzx~`Xu5Us3YeVy\QgȓyۮD_?SS+062鹀waV+l},F4]L|.|yOendstream +dw 8?>aV+l},F4]L|.^ oNendstream endobj -1528 0 obj<>/XObject<<>>>>/Annots 574 0 R>>endobj -1529 0 obj<>stream +1536 0 obj<>/XObject<<>>>>/Annots 574 0 R>>endobj +1537 0 obj<>stream xWr6}WL3cyƦudI-y$! 1IhE߳)SƑlJٳπCM(ɏQ?hJ$SNSFs^O()/ WW#|6b/#iu4i8Ēlew+i%H=>-(DUYjdJf_i.͓4d 4g)6Y1%: F#ZDR&4KIfI˾*59R{p @)8N2% G0Jڈ PntpH"$9M[mi܆(履22q8=|GQoޜRZyHI|jZ |8pPXWf$K0mwW|\havP[L @@ -2866,32 +2851,34 @@ P PnOºtLuP(7/8ɯZ2zTɣ?ڍ(n6XseY${T2;7dmkfpVibT8 pc4s(<8跁UAXX `tUAs".OBsgټJ:Kw_ng1P5h"!öJ6LEƵ ɀ َ*Δt/3Έ²{uх=Az(47:dl[ŹrFSRڮ`APGwj[C``adr"E,*`($OmQܢe2G`|!{8s`7|taٝB;³òuBko@m6ڈP7@lCuxfZ@]8Jn.S =b,mbDN O- ˞ z~HL)ӕqWp`#rQj]4 H4χB|yݰO9Mplpx0k fX^2Z:~ױc\~v~ =)wA;M="pYf?t<9%"N6WYzRf (+|w 2Pӳmxv_&Bիvs8V](v>3S+W'٧39ZdB@`'4JS%程ntRpB@~reSҏ`8`>/XObject<<>>>>/Annots 589 0 R>>endobj -1531 0 obj<>stream +1538 0 obj<>/XObject<<>>>>/Annots 589 0 R>>endobj +1539 0 obj<>stream xVMo8W IJ%;|H`7&z$aK(GIf8ސ#f) h$ͼ" 9_ig ͗\zKrBhh[ޢ٢f x͢km%2U<{[vc:[4G~gk:?-\y>\5slo~T27ՌV١R۫mMyLUsb%+R/Q|m4I#MjvgvBrMqJkQ#|jYmH'N9 ~Ni䜧S%il$ΫW"oJ T*w%y%=sA-7=p␳l;~A@EwXp+6fš/awLD#9u!547$S Q&ŠJsl[uRгmżvo۶$o)ZM?]+LN[vν̣b_ۢ6Üa3S d0ԕ`BXZ],DЀ2Ř&\ cL#Sk;SN:U &SKZ7qQ'W  !=jߩA^hon' {#$<74$ gRdV'7%`{1G0sUQ1 -*x>p<#:pꂘ&A2{63ns"J3Ǯ^:v}w{nN9Kԣ9-ð׿_R>6 V e >i&<͘y477 Q`n1HTjendstream -endobj -1532 0 obj<>/XObject<<>>>>/Annots 592 0 R>>endobj -1533 0 obj<>stream -xWn8}W Rbv@K.BKT"U3|m&)Μs8vԧ~4ňh؛$#Nx=+) $X@><:bcIdLuAӣݻa2-f9Ɯh=D<2JXQJ/;=;,<\iI~%yC^IM 3fLNڧ]~wfxέ(7{'4rF g o0bH?@ȰN?$ʨ&x~#bm:NVj?m*9ᣄ|é8bED>w-(W܏yX9Y'3}LO̭#+ҝrl VEAZ Z3&EWtꫩ(nKiL}UIS,K/ cMVU2Us8˧McOyu,L*xi~C'Vb Fvǽ+#@ ߡܯx 7߉'sO@`*Éd4utOz# 0H&}!]L.o낉ҵ¦P}YHFnsiQvVJ2y6*ʿk&19cB(hn2v[- 5(CZNoA,ߟ`?j/ssVWi'oi5Mf,다׉G.geɪbg+\JAMR|mWvZ'5tB7pYm J.zu_B Pea1:Ѫ*_3ECKƑ,qBSVP}ApaԐA~mHԫ񞳲L(灘UFUvlqL)f8 Fw,;8SЊa3ZqVBPԩ}xܿi;N&<+Ѹ6 b߸A`Y蒐P_K6L宆h.V4*{ja  E0|s@ Xјr>K[S{ʤUO Z=6V-uR")1˨t)I/t{~7k? lbxݛ=>L4nSF}efYsey#Ǖs.P-ח% `<;5<ĉڦ՝i3ǚP-f0n3]zL\ז+Y1פ{F bz}yޚ)!twv7Ɛ1h7rwJendstream -endobj -1534 0 obj<>/XObject<<>>>>/Annots 595 0 R>>endobj -1535 0 obj<>stream -xX[SF~Wu: &3<8fB;L݇H -ٕl#C|\> t<8?F]:D}: ?#iptݯ1ϩ=?dtwbrptuBM? i4[,Js/MRGB[2INSi񲔛;'ח[_TLHjELĒܟZ=|M$\,BGsh:KU.RyZPT)dgҭTgT6 TM$&X?Q}/CL-_C,):"S"\P|a,͍i)@% -aJ% ع$NuDo,Jb,Ou_x+ufH"ЌYO$XݢDcimfԚ8k6IfV^t)fsƞgmz[mcu~'1y!uv#RQ,i7 ΨswQ:( -k "Nrx@6fc^şshy#=|'QA(\F 6A CY/nCoތo :594LCc ,YFU .Nsq |]:hԣvMaƇQb ->L{k'~ڱaJ^ ۋG?UN.KsPTΆ]Z-Q8oM>]8;mdK)ZIt⇄vWX |]6Wlc4 s =$?ܒKsѼֱ-%3w7t_3}֦ -'|Jr]a" /2V5c6gz#uE{8 T< Fd S:fB],Z8lMiֺԹ48[p?cAUG ‚Qso+k}퇰 q8]̏,\T8Y:Em=ZdBE8({3:{r^΃D cQ1Ԟt '֗&oaܭ/톕v eJ8:.N59tM5?am+t\2ےUW'Ki?,Uۡg z|yn~bji WpxSðX(Ǎ`{w}4m&;YYÄEqMJ --XLψ #[F?zgō36Zm*0v2t4xI`,ස(_endstream -endobj -1536 0 obj<>/XObject<<>>>>>>endobj -1537 0 obj<>stream +*x>p<#:pꂘ&A2{63ns"J3Ǯ^:v}w{nN9Kԣ9-ð׿_R>6 V e >i&<͘y477 Q 0_}ڌ HJjendstream +endobj +1540 0 obj<>/XObject<<>>>>/Annots 592 0 R>>endobj +1541 0 obj<>stream +xWn8}W Rb@K.BKT"U3|m&)Μs8vң.~z4`DiqM4N 'c㿕 $Y@[><:bcAdLuNӓza2/tntI%Ɯh]-(D <2RXQH/;=t,>ɥҒZ;*'iJgJ3^͔7Ox. h)XUC6BEL> d|DbyBu!QF ΍i9ZMX댏󁎧 +1K|%~\Phx2ӧ$Jn8Bz%E,Ǯ@% +h88cr ڋ\tEb!VhTW4e./0vuZkt\)S|gn왣q^64oʽcI/0rZ,"7~"Szet$Ac;z9?r ?@0DQ25[::'yỸu$ > ʐۺ`"7t:TP`ҹjTߙr˰Ҋ<)`Acj3yyRZ2G$͡H45CK a=6A2O::T"H:QfH=lamǼڱ?ZlyAk[5 =TyFX}s}[A0VXɃ3)r(V-*/AgZ.;D +VǦq#;p`6Q#@|@@@7wr)-NJIf6- Rڡ DLEv2J?`;󖇝cxKxB|}U +@'ƺu*K#}auqb7{Q4=nvɲ$]Nd<w=;/ V?#XQi4ЌB + :k>/XObject<<>>>>/Annots 595 0 R>>endobj +1543 0 obj<>stream +xX[oF~8pV)$ZIŎU$@#r(1!gؙ )ɔݦ"kօswnh@}h<Q?Y43RGO|AY4&!׳3 hBh2Yo,L+̓4]eJmm%9MJn_0n]MH~sR%2!]J#\eʟ/sKҩ?wэz1rԧ̒ P,FW$uFe$XB6G Z<+dnC<~YQ9]@s.6w/ڄ(:cncCTts!p^AEdT[J\=3}Ib6`,o0a!P-,gD#[Fo8ōӳ_6Zm+0v2t4x>O[<Y~4[V0 h]K)yޖIFx79tg4WEaxoǃ}$o4 3fv(^endstream +endobj +1544 0 obj<>/XObject<<>>>>>>endobj +1545 0 obj<>stream xVo6_qUiO*! ! H϶R^2mӺ&16vJٴ}6)mھi {l7$N ٺ{>tȋ!J|'),Y= `%q,0˚ Qb@l^jr(-$a "9d(ʵ[ؑ{R\VN,4Om!ZĚiGJ$7aVB l^X }!VXe @@ -2899,54 +2886,47 @@ S/ /+DITT'kr4Qg.քc*-6v$&ъ'*?S"fj6P'6̱(O6T"ى< k.g=8[zOkI|ѐ M.g Kmlnaѿ ȼ T$]@) g*[4]jr&i> wT8 %Aۜ!ȃŚrV;|4UƳTL==T.+淘~V`ZmO}Û>,тux ϔU`VXx*v}/5(9R,C؏GA؋dE t;QR[日#{IQ8z1O5S)AP {~wd}|^dzE99Qr%%+ W>/XObject<>>>>>endobj -1539 0 obj<>stream -xWn6}WLqHl}^.v.b((DG6 )9A\ϜOblD)eIF4)%Gk$ncґ$xqO,ys'MY #E9(E6'ãnKQLwWlv$ﯯd|vvU0up҇͗ϿmƂq@;87*sU/\Bqɍ1,4,Av%i]KUS^|҉wRUyw1ehک(350m29<U#3 邌RA2QikCG8i"(9ez]jJ >F҃mH7m^T;U%.+ !e?aRMg4ΰ5 ](6ױw1 -m#Ts2saE*܏#r ~J2Q5{ߐ~@EZJDYLPE% MD}dЍtV0Gޞ!TjB&CZBw|[F(u) #`üAP -sRqd7L#[xr:.d2)hzڣ5x:\ic -vAm5;|L/]ޫZP hm.ԲmWtMM ]IZjSa]ל,p nA -2ӉWyNQ\sRFݞC4ʡ]p3UG[v Fo}k+}^g5 -ö@g*GB9i3̋.q,vVg%x -n -g' -M;"F"vm"g%j)]vpaUQ75͞,Jk~0!yj4 gn|]:7d ;u'.A6~{rORO%;b#Lŵg%9fc>Po͘3Kۚg_xM_NUǴ>"͌Mc7غ-15(I&c7(۝ﳾs.]Q`ztك3x u| FSXJ׸H|Y+a|{  ~,(nh~ UzU' z洹f~C?w nNp͚* t z% \۳it^Fe)-r_`  -\k4ܩe%ЕWk`rV^{ZC‡c*^!tu*4v0Lp գ*zBpQ;ޏ L/w﹵nN}])ޫc$a40~>5;x/J;/_^rYΦs`k^/N>,2endstream -endobj -1540 0 obj<>/XObject<<>>>>>>endobj -1541 0 obj<>stream -xWmO8_1R6ZtwRIKgm3Ni5%gfyVzۇc߃t`4Ⱦ 'ҟlzp Uz "*1i8&P+SU{pq:.<,Ζ?Z={VQ,roH3a+0)o@R$2iƦ."-BH/Vm+ou֬)kHͱ'/n 6P>4Fv®EwͪS%-(ՏƥlFfA` :8ze>/ -BfXT/0#d8l*@i4!{-<9$M#Mq:偈ta,>@ qAv7^ ްwa |Lйga6v;0HɭjHSS Bޜ.?*qB>_>>/XObject<<>>>>>>endobj -1543 0 obj<>stream -xS]o0}WG*!F&m^*M6;:5P!$K{>qdqT9e,C׬ƪohD5 -MG-eM g6.X8^q<|gxW0{ESjBwC89J0#C,P t5q3}Zb NbAAy} Nbx۪MIeIgazk{u/|tg(V9Y$d hNR)TR;$'RCPIdS6İyl:ݫQ oƸ*,{! 9¦)>J&8ޖ>@Ú.Zo]B \w0H9`:kQ^N?\z&Q!w߶wn]+|6HpڌAPrnHl８UbUYzm_G~endstream -endobj -1544 0 obj<>/XObject<<>>>>>>endobj -1545 0 obj<>stream -x+2T0BCs#c3\..}7K#4BHP$YSO! U!?M!3$1''$3?O3$ BOzs=s3 -!) #\C&endstream -endobj -1546 0 obj<>/XObject<<>>>>/Annots 642 0 R>>endobj -1547 0 obj<>stream +~&P<ڼw|;g m_(Z\'cWC>}|^dzE99Qr%%+ W>/XObject<>>>>>endobj +1547 0 obj<>stream +xWnF}WL$%n}p5 (XKi%Wq=K*D%F!ș333g! 'ِFSҳA0lLikzZ)i)yN82L36O2N SZ(uMq8"hiwV .~]LVKE&eTx\\8"Λw&ϥe콱}Lr:IJ~YGt9{([-ZvHh]6߫$W(H;CdZ9C:b,mtRi=Y&2&De*QB삖eA$h8!6yA*K8N8&h4oa9c0-x.}r,w^`G8.(9ЫpڷFg _;OZ=  +XڬSZ^.o?,U"g?L"4 4v}S"E'+iCBĮא~:N]hHeR"5lcU˞ d̆lJ}itׅc>f)Lˆ_2ʷ>70}ƼO977;DBN +j}~xܴ@}ˮi)G mÝ6 R{ףH3s酫%-鱾 XM +vuwW%TaxET٣3WE'>buBt'vd 33%*/` !c͏-)sis=> | qy|wa1 NPRZ@8Q-OϵYS^,r:o +'=x 3;OR{ + i  ^qV (tN&8wGT:]ؤ8_`{96CĸeX?qwبN{ZH ^I(V8}crxnĩf-Vcils,V&+-FڶRbp:]u~zߎg`6vOCw sq?:endstream +endobj +1548 0 obj<>/XObject<<>>>>>>endobj +1549 0 obj<>stream +xWnH}+ "a[e HIfG!] im%ߪN1d;ɘԩSVz ^؃" >(7_ڎ/0O0x1 ~#b.HW+C,X\.'WEgpq8~;j )V0JΥGy no`ʭ7$̱ ,7dU{mb\5=CI-tCx`!= f@zPjO&<1$'eF!έ>/XObject<<>>>>>>endobj +1551 0 obj<>stream +x+2T0BCs#c3\..}7K#4BHP$YSO! U!?M!3$1''$3?O3$ BOzs=s3 -!)F #\C&endstream +endobj +1552 0 obj<>/XObject<<>>>>/Annots 642 0 R>>endobj +1553 0 obj<>stream xIss 6_Zm9$Yҡ36EXj4ѿ,93\*3++S+¢ }XTjpq>,qCQ'#=̱RpYN\NeҀL:t9Y8c$W$ HVSyHa6بv6Ivj5YY&lpVW8)HChQfއ(Qb-cA#5 8Xl(3E-c$Y[tNDiY+Չ{Qa3dWV뢴 :,:,s9XS\S.vQH^DQqưsð96*^,b5am(*XkvXXlT<bYՆL]Ĉc|ʬÔTG1QljI/6k;zdaX7uZX`kRPp d,9/S A21lU*uva Ϭ vgֺJ͉:C:z%6E$BjȈFӐXn:ق8aXlQ96:EOSXiϕ jȤǰ֙_Sd㘝Y5bX;qN}5{ [ T1,vTbU!˞ð UfTfV0r*+밂l y>!saD 2K"z,tD0,fYltPrıXs9:˙uX5{ DlQlLa̒wbXYTaXYa]×q41b&CuX۵CYaJvrXpÇ8V '>GکDz K9: KL): ;NeaF 91lz1!ɬðNYa'+ٳQ=zTÀQ]b不sV3YAXWR&=V40,#܉ dŋ±VąUF8c4Xaj: ʉfaҘyYUٮʺ qY* C!1KTcff0,4s: P|"0,ٮl:rfu Acݺh;߹Q Dr/r+} T> zh"l<4V\v%#"8ST&  R˖ I4fTk Am"#'ب ]L4 [Dz tF30괏UJŀl:S4s2~Y-YYLFZdA8;LR-( !ĜSeA) ]34>j1ĜWJEd4>hzeLF%cFCsH)De%qr\ox9-'X݇Y?nR (p,2c9M#͂t%gO_ 7<pymof͡Mm7k9E\{O.uجku߄!|]w.=vpy=uׇM{Ñ7m_B~tmC4u۵}s菓g3ɔU]ڛZWґƕz޷h}g2MH2Ϸ$\uxkMyɭ3 /= “uUZ'Wvk:i;5Z/.w -kR!W3 :6uq&fC6a|mvݑ(V [\nwZH_$C REx$ds2jeC9|u}0.]V7]~{r&~o03N󧮽?\?b F҉o2x$J`^t nR6GAK^:oDeEn}_:7bp׻J跜?v7ץ)c^u]vʼ7 o}hЅfwg=MyE*á(Us~;O߽z̅doloǾ >vœRhUTH~T/]1Gre.Ir 1Bylo S$@YOuk*>cniRױnR|ݏ!p䇗/0\7׶>xs!W Uo f=j8ݱu޸cDn&xvn.fo uۅo6}C -˱n`~zXL4=wALv> Yʜ3MyJ:Z ˦b;{쵕чxjh1?I;SsIC[q'iwWk\viekZ|4Kqh8:$`^أ+h4fOK%&\odcL -I<endstream +˱n`~zXL4=wALv> Yʜ3MyJ:Z ˦b;{쵕чxjh1?I;SsIC[q'iwWk\viekZ|4Kqh8:$`^أ+h4fOK%&\odcL*W|uyϳJendstream endobj -1548 0 obj<>/XObject<<>>>>/Annots 644 0 R>>endobj -1549 0 obj<>stream -xUQMO!+ޱ{0`s4ݍ5wАyyo/&!HJLpA/57Vs>bak\{HQ]VBZbb¸ĶPBQ%&2,hV[Cqƀ-[:v!%6J[+iGGH)DOKGPCr{'[a+(EyK'܍~Ð֩,KMQ܈6? )'Դ-mJeͽcDpqendstream +1554 0 obj<>/XObject<<>>>>/Annots 644 0 R>>endobj +1555 0 obj<>stream +xUQMO!+ޱ{0`s4ݍ5wАyyo/&!HJLpA/57Vs>bak\{HQ]VBZbb¸ĶPBQ%&2,hV[Cqƀ-[:v!%6J[+iGGH)DOKGPCr{'[a+(EyK'܍~Ð֩,KMQ܈6? )'Դ-mJdͽcD\qendstream endobj -1550 0 obj<>/XObject<<>>>>>>endobj -1551 0 obj<>stream +1556 0 obj<>/XObject<<>>>>>>endobj +1557 0 obj<>stream xWn8}W |hi4[_hH/I )) I93O=i2⬗ht=Lht5U8'Ϻ4|[3I;6b륥QB:ͅ/aѬh&'V_03~?\%LBi:~N8z ּ!pJJIZLjO؊ /df^茦Ѳ/FV]\4\] :;^1SNK>siۡ?XU{mA:׽Vq{>fL^d2Pe;k\WBɤ*6~cH9ZBJX+a8I`lሩ[V`" K%nDGУ6{Xt!AQIȑkO^"9GI?_1w&ɘk3LqE@rH!ިMtCUU,ikNerDW TLt8V(xV+)-.F' +vBbCm)H>iZK-- : p(a XʄKdx0V2hD +:BvTtI> *< ӯ0Y1*[fS` kNP rzQ3NPtwPyc9Oe\V JKpQ + @@ -2956,53 +2936,52 @@ x {=2eq}nB@k0NM6= I|7~t?+] w h `l֨o٢ӕ>khrK_`qN|JZ=>Mnl7jZ<=BS-'^4ๆ]g[yո|t;Wc0냤ކ^lm&;faeɠS+3.ֺ8~&,릉Z+ 9U`ϟG )^1*v1J` E+@ -~U+OXF9QdsW`ERk+#+h7 ik_ޡ5x戺v$Q_xnMi.6Z5yE# Q~^$3A\= 'qs(p&?< թ7endstream -endobj -1552 0 obj<>/XObject<<>>>>>>endobj -1553 0 obj<>stream -xV]o6|ϯX+vNߜK-p{ PPe":8E>Y8_c_dFiy6Fts;_JʛE4Ս8߸Ϯ>h<8GbNqFH0QM7׈JK~#<)G*c(J(F*4%/y[Sc%5~$ciUBhq%h8a &^Y6CK>,kONa eЩWF4;\L՚ I8dU)ޔBid(Fr@.=JF)Bx+fJicv;RxY`RBZ,j , -F8")dS6㐻 AU2=-:ѵ.}/k|K-!p2mFn͡OtQU'J6s ڱw܀"/^dh/T'8Oy`G꺓UcJ醔FVGّ!}%V(렚hӿ7d;nQsW&4^qf7H_G(d~~맆]y -Č7a0ld8/d^tB1Tɖ"0?ҙ9z'a$iZG;t\Ԟm5Kud>IV -009)=e‹>K<T Y7,1A9o]"@5ZO xֈY<N>@up$jW$P~wk%Y %; -ۘ-߉re+8/L_+֖,[*XK :xZ;|ѴrQ:++}A-?s;,TCOPuN:;4",":XwZϿmA[]OC5oĖ;u9voS">ɻ8t~" nZ9@gWa{0;E;<'7endstream -endobj -1554 0 obj<>/XObject<<>>>>>>endobj -1555 0 obj<>stream -xWMo8W |N8v("^ -Q6TI*JPI+7oތ\fnzGx\?^S!/ҋ W/W I6c==LIUE*ST6|(ﰲ,Y:w&PY4}cPMH߅dkƛx81:7fi:f6tqRn-]8x1/)R;GýC0]CЉ6'Ƈl KKOr(yACf8SXC]Jz0]0ʠmUU{sij02]GrB+-t,YG&J*<x*fc*%?sw6;F)eZ:q=fdLDoCh2<Fǣ +~U+OXF9QdsW`ERk+#+h7 ik_ޡ5x戺v$Q_xnMi.6Z5yE# Q~^$3A\= 'qs(ư&?< 5endstream +endobj +1558 0 obj<>/XObject<<>>>>>>endobj +1559 0 obj<>stream +xVn6}W Rb;}s6]@7*%@AI͍DjIʎg(qM\̙3gŘFbB9(gK=77Fhq4߸/n>i<8GrAqFH0QM׈IK~+<)G*c(9Z(F*4%|X= Ꚍuq +Ǖ*~1x +q6x@eXI4o>ώy4מ +)94@ʠS&|n 0p$ɪR ̓)hoMQ \+{(ƍRVn͔9wj&d)ƅ45!MY& D{Y 'iNERȦl1wt dzZt\%.ky]^NokY;C*t?9Z@FLRXGU*JTV̩.hb{W#Kp xP(J<U* +҂^V )B[R |R2'X;%eGZ&.<̞ Xj^ڐ׆w㟰G1G!^Nh8YqH_G(d~a]E +Ča0ld8/d^B0Tɖ"0?ҙ;za$YZG;t\הԞm5Kud>HV +009)=e‹>K<T Y7,1A9oW]"@5ZO xֈY<N>Bup4jW$Pwk%Y %; +ۚ-߉re+8(LW_k֖Z"H :xZ;|մrQ:++}A-s{,T/COvPuN:;4",":XwZϿmA[]OC5oŎ;u%voS">ɻ8t~"nZ9@ga{0{E;<<[לOWUTj LXP[|z<":ms/k;-rv^W8G-wy=9(J!,ۃlp$M c'7%滹KMq6A`n +Rv KP/["hʐ9\xEY4{ZvVm(Ud<=Bb !00&p2\v0iȎʝ2 t!*:W8L`W8 +~SCLJ$ mp{n-yyٞ]sߗSͣpܯ@wl#fe}ؽ2\x~|-fb M'⯋7endstream +endobj +1560 0 obj<>/XObject<<>>>>>>endobj +1561 0 obj<>stream +xWMo8W |Nl'v("^ -Q6TI*JPI+7oތ\fbIYuu7=~?{ҋ W/W I6c==LIUE*ST6|(rOY2?"u>b)Lh? ƦX \ ֲ5櫍7pcLu 8oFt=Vm=0M鿀Dӎuԯ<7Gj8yRe$4FRBT>65wx[}c)w};r5pK"@F  BxpLcĀ&cCkי6 MQ^gp#s4zĠbJ_" \:1۰z cӂ(:`^8p2R^!ze6 T "2&zݶU]{:([)*`\ cM4H66dFaY 9ϭLYr00'z$zUTF ;?R|,ݾ[px1/)R;GýC0]CЉ6'Ƈl KKOr(yACf8SXC]Jz0]0ʠmUU{sij02]GrB+-t,YG&J*<x*fc*%?sw6;F)eZ:q=fdLDoCh2<Fǣ b =ʈ),͓QWC7Qqi: J*װBW&p8c(z` Mqkԕ^SbsBm;pf(A &ѶZS~0/NeU>N24 !-.yjgsno @@ b8YV4GHh(dkBsS:<H7c?},byuɃJB0w%i%ݾ{EI+zyT$FgP+IkVbH7vpr _L:Z~ >4< -ԑ;yZ#V輻L8eiƞBnuTiDڡPi  qu '`4hɁʂ` Fh}dx$qG<شG^ǥCA5Z ۮ4 F O#P%$0H"NXsص!jXAwBX{N26> +q~:v7+u">qHlRR"-x *M>X~^1;,W?0Zpw< Jvwè)[&<)8r+:;&l7-S–fF@ESZ ircŅ$Lj3ƢC!i?K{vYmyQܸ6q0Z`4*$^-v_~~<}\="_It|L'߫|endstream +ԑ;yZ#V輻L8eiƞBnuTiDڡPi  qu '`4hɁʂ` Fh}dx$qG<شG^ǥCA5Z ۮ4 F O#P%$0H"NXsص!jXAwBX{N26> +q~:v7+u">qHlRR"-x *M>X~^1;,W?0Zpw< Jvwè)[&<)8r+:;&l7-S–fF@ESZ ircŅ$Lj3ƢC!i?K{vYmyQܸ6q0Z`4*$^-v_~~<}\="_IW1?'߫|endstream endobj -1556 0 obj<>/XObject<<>>>>>>endobj -1557 0 obj<>stream +1562 0 obj<>/XObject<<>>>>>>endobj +1563 0 obj<>stream xXn8}W b;,Ї,tw}%f#*I~!)ٖ[m"r̙Q~\icOfFyu1F4-Ms|JZ_[^\k\- h_f&'i_"K7Vwܝx'sܽ(= \Tt+?5~ £ $'h[Yy奒ߑG2&pf3ZnwWj*t$8@h|SH8*˭Zɂf哠xuʁhQZ83rRɹc]^Vu̬4Rt#DZ.ސ| H$ 1T|32c4pY] (Ctr(7Zo@ @HJx5h]Co9C,K&|imMS]3 ̚·]$HeYF;fbK[ f/Tg#ץ8Dx0t{< C-l,S\gN4b WH-daml/àUʶUwpyHVp-e*kdJ{ 'kaU_ȴyu~|@  ު,L Р([%1*L=ǩObVVF/[#< svBCB>/S k֞s]Ju7lQg`2lh] kYs`$Xe1D/0 O]k9R}PQ.5*J4Zn5JY͚~J TكۥȞ3Ǘ7$Di4-1WtT TOmJ8Ω i\m,zCR&7<$K=_͈鄬>+N]hdU#̡&_ccgxM<:](d $/aTߢT+n8aՑډ:9l'뽦S6e/|ׇ\XY;1HB9g c1¿MfsbƷc@U|<(GJq8Q ,6xkjKƨYNZf5l9_J)-XA.!P"ՇOP}P: 4U[i|t2?fLl>[ęs3c?./-endstream -endobj -1558 0 obj<>/XObject<<>>>>/Annots 649 0 R>>endobj -1559 0 obj<>stream -xW]o6}ϯԊf;,V`MA7 @AKtF"]rsIJvT&%~{νWΆ4!F4R^ t2&T|~)iogf?iܚو&JZg qyͻׯg7iFEq@˼)Km:ʅɂ'cIXSk|3ʹZYg RIn-yaӝ/ ?#en?kU{~N*vvv0FD^JagO1U.2:c_79G0z,N|Go(xOi/-l4 5q?=r-BT+AO, ܺIe6=HJυb%\Kir2<sѻd.nպD1Fܓk^QtA12ךG1X;"+C-e!PK<>-y‹}J<zHIm~Jt_xFlDN"î ƃG3cE*kbzF(NbWγR ޙK-V%* -Y*M؎;3z83ဧc:;Pu'44zjBqNT*SN'rg-O0ðhK{Ra\CƓߘڙrh-궒')ӄeQ2N֪)?)#߇Q&Rsɼ1Ѣ;皒5}Cnzq'W'`XbZ !oUX RE۱ fs; [[ЅP(UNg9ZF@b.( Vԭ5;.](Ni!O'T,8 fp(KNZsSS*#0^j1=2 N-X -Z:*lU!b{P++q_ðBH?x~R!!hJn(Mib9B N5nB8GK{$S"hjK@T/?J[qz6g]wqk -5Yu[xW ;b -rx lwZ=7U(:Ӏ3RZ:]{!)XZ4R0ɤY\c67h}Cdtm*^~絗arwʤɅ +Q:>pX:N؋,$R?F jb -+f|,A q,򃫇A41 k6;b8NakkA_Fc'ҪdPjJ%x?=a ķsq3Ocv8K|L3'kB_6y]AVy?६`bx$M`2gl쏳cnendstream -endobj -1560 0 obj<>/XObject<<>>>>/Annots 654 0 R>>endobj -1561 0 obj<>stream -x}U]sF}W! Y@g@Bh=LZKg::.ѮݕpsϽ6(oDӘ&) B<]mL $q(Aޕ gknnG>MaSs;I2 f` -iNLHY~GyS s_Py( -1+nvU=Ԫ9p(YI1kubZó 3ZW E6S';rjjunH>4a/Ґ.,)gGjǬUrf8ʕ4*K]ص:H$+A50 x p+i/BQw@Yk=kJC;~dg:h)$@UWUasZf]+eJr^8H -m7Ah7_ O:W[@=6AQsh!oP+ -Z qby4W{X4^ FoDQےtJU'Iy쟄l^H_bsoߑvNAjbFϴܬg| R(ǧNM -c֠mhRk~k'  Ø>/XObject<>>>/Annots 657 0 R>>endobj -1563 0 obj<>stream +3{~B7ǩ*Jsmr6(" Xl6OokŒ>U[i|t2?fLl>[ęs3e?./p+endstream +endobj +1564 0 obj<>/XObject<<>>>>/Annots 649 0 R>>endobj +1565 0 obj<>stream +xW]o6}ϯԊ3lִtDl$#)';d[=mR[ǹ{ِ;.'Wgl+?~+4ϲ1U4_J[l[7o4ƗlDc%3Oܸf׋1 X!lJ"8E[aՔyV6ŠJziBRRdAгO$5\-ɬ҅yvtByTo6yհ^"En?+U{~N*v v0FD^JaO1U.2:c_9Gc0z,V|Go)xOi/-l4 5Ǿ?r%\TKAϪ, ܺIe6O=HJυb)\Kir2<sѻe.>ٺD2Fܑk^AtA12ך1Y"+C-e!PK<> +-y‹}J<zHIm~Jt_xFlDN"î ƃG3cE*kbzF(NbWγR ޙK-%* +Y*M؎;3z83ဧc:;Pu'44zkBqN-U*SN'rg-ladt[p0ݎFbl4אfצ&Z"q4aYTˌ*e9EO~Ԝv2;LιdFҫ;?|Iլ~ $ֶ䟱][G"7R8s0ј^ɸ+SAKX]*\ls*ae}:=[VSGY(f.dʟ/#5_b T&s'25*QFa4N~Qڒ}x {߳9SOս[Sxɪc0P׊wՐ #& 灗&{K_3 13!իoڵՍE#.LLŕ;fsq.k~rnLo<؏QunC4"ba:B;JA)cȏ~bH"-10a.ց۠иb +"ApjZ.?ztA(ӏ^q͸#I,e1vRz!J6;q0TSh'3t [f,/KLx>[ʍ + /epKOt2q x8Olendstream +endobj +1566 0 obj<>/XObject<<>>>>/Annots 654 0 R>>endobj +1567 0 obj<>stream +x}U]sF}WT Y@g@Bh=LZKg::.ѮݕpsϽ6h߈1MRʫ8od %IkE4$=XCws;l +Li8՘*K)>/XObject<>>>/Annots 657 0 R>>endobj +1569 0 obj<>stream xVMs"7+ 3|:7ĉ+ekJgF4{+\Fݭ믝Ii`L>>ٿ<ڙIF0RIh]AO8F#fNp.DR HIz鈮 }\:s4[dJ<'j%j,z\p$* XKW =X] 4S7"ٵ)TޚPD$&<9N!U_iQ\WxbHiڜ&ɘO\wfMuVr8CWڑuDuSTEnc~%|8+Fگ8B/i.ͭAv ) + ,9̖!UK]i¹9vW{m*pMhR B;C!%(4Z7F5#(cm%j -f:3qz7vFeI:BL09ˬ[āendstream -endobj -1564 0 obj<>/XObject<<>>>>/Annots 702 0 R>>endobj -1565 0 obj<>stream -xW[sV~WK'ݐLlj$ݘN'΃DQC L)ݳoo#\yD#q)>kEkf@t#gJyDTNR9ݍtA9ހ;cg6hp S0;%Ī ]LGTP¢%z^NϝqBs -¹` ΄B_=ϛX6xAEޞ'DCOS10V= %vbϛ$} "‚3YUiFD+rbP W*R״R&mmVUu95QU:Ҍ(:CN}Ssj-Ri:->\|qT*YJFSBwIL5,ZP(*OZ_Yһmv2Ui62P9qs8Za[(o^"JfZ繪 -% Yguc TCi|Cx[$%*B<ڃȚb 5DZQ+*gԙMbT#4S0%`tAXl,{RT" fY3Z`ߺ6~^&.4= z4(<LJa K8{0R4= ۛ7t9CV^_|~qpxlW$mй^9+[D\IQ#5-kT-PE;_qVZhUuJHKlבq6*E}>آe$/*CD:c|ʴ~˫i -mVBSkxgf[U6]ru"ܳ~w' O}l:;,~mh $PKaCei -z[2O:ow܃ʳ~LVv9zPV]̖<+ A,8J7w%Jn͏%#.9/[Tm`ޏ S?6DuZrG:~VK]E9١YcsrM$+~еc^X$J.h^x%}ǮjeH}IiCGDX# (F\Ho -.B؎QqJ#y֧]#r@mcnߜt2WёLZ9tZcDS︦W\^ 𤋴Y~kgc.LjG-ޏvZ/vw3.֟1MR[[{tgc;_8th7џendstream -endobj -1566 0 obj<>/XObject<<>>>>>>endobj -1567 0 obj<>stream +f:3qz7vFeI:BL0?eGendstream +endobj +1570 0 obj<>/XObject<<>>>>/Annots 702 0 R>>endobj +1571 0 obj<>stream +xW[sV~WK']@f2'D&By)GTRK]yL[PS7Dd36†p(UjY]J/](aRHZߤuZ*G{pY)XJ}cY)#uvZ+jDZT?(A ؄<]$8 BSjUqP0iyNoYLJB/SqJ JaYaIàFrgq5%wv{؃4g_:0k-:+a銈\,-6jEju%u +(1EKfN ­vw3.֟1MRg[[ ;_K)nk8MYendstream +endobj +1572 0 obj<>/XObject<<>>>>>>endobj +1573 0 obj<>stream xXے6}\%Q<+ٲDT&I09i\(%WmyݧOn)MgJ7dB-yIۛ[Ni嵋Ւ69adBlK tk{ylSU;%,F .dE˜c+{x3F&0-/4%+^(SAsZo6Lu!O>-nk*E]s)b ~dR/=vK b4Rő~o9=R3"Cw4`h~F Ԇ$$m reߴxɽ˲lOܽsGl,5g@xy\f/~Zhq~ո`qϵx|]HrLS2@RUuzBS8|u4\U gka-xWd *0zW9 3q[[t,?u]$RpTs-G#\TmqtcE)~OT/[=?Rp A)Xv`!sɔ伌}ID4L^=^.Q{G | ݹw/4O8[H J7 }+L(egr8 vI,S2He&5)VwZ[˸|ÞeFCL{ f'*sݓm?yEkGc}=&54$ k"j `r+sHXH IȞF!c)w p F*ۢQf*ʋk^;8QȖ)Q4rHxu6S @@ -3031,10 +3012,10 @@ x $dZ31d%Bp_PEOFv*p<2T\GCy)D;_AB7:y\xsgIQB]1xɓs>gFXŝ d Zrƈ\.5*Pڙ+t6 hWu|L3W3P /KT! d;|$$qG{)Y$J<}8nitXc{dm1d]So<9 KXX4gE.e>hl'?2x27ħ{k@C +0:)[S-FGS!k,] ʏĘ.N FޮPs1L d>_-+Q ctijѐ+ǭta QMn\KnHB1;/Bf9>DgI\:K -F=GFF;^+4̸<$\4TʵwEț5nJֺY(xdtd|j%! F/|hH‚u{ WZi?q[wȟdXCS~s-Pqendstream +F=GFF;^+4̸<$\4TʵwEț5nJֺY(xdtd|j%! F/|hH‚u{ WZi?q[wȟdXC;~s-xendstream endobj -1568 0 obj<>/XObject<>>>/Annots 705 0 R>>endobj -1569 0 obj<>stream +1574 0 obj<>/XObject<>>>/Annots 705 0 R>>endobj +1575 0 obj<>stream xWkoH_q7[ ZoI]um UR`0=Ca;36IJI=uvQ?t:8;}:N>'8=:e4?GJG(D'8ш }< )h`ɘfҧYR&Ts)JI/g_qݞ,Z&qojM]̕,›&`0 Pޝ$C-Z2ƫ*Jql*]SVNJ-etH\Qt- Mbmt>ku_]H ͷE؂q8ߛh#/tH-ѠH$dTHӭz(9$vOReTeV2'~@$77&BU dpL.ceR'd2 2Eƞ0[ ˌ l\ha{NO&atN@ft0 g5C,qefrXg @@ -3045,10 +3026,10 @@ q ff&ksLf+E6w;qnDŊ='ic;j9OZ85Zٰ]'YSd<`bnz{CsƶV ZJ[Jٷ0[&rw*% A?`ĽVf=K ;jEu&a 'հ^B![`zkJ݉ib7 q+'6*҉uj/b)ctB J2Gg{G{[=RT80$wUٟc=ly -3JVF-`S@C-Z8Ch)%rhds5I[~gJ2l^*%\R8o݇oZ"**0Z|m#r\~a74۫n4~8X^_it\iv >9`ܷ,?xGwاfGjendstream +3JVF-`S@C-Z8Ch)%rhds5I[~gJ2l^*%\R8o݇oZ"**0Z|m#r\~a74۫n4~8X^_it\iv >9`ܷ,?xGw٧fGhendstream endobj -1570 0 obj<>/XObject<<>>>>/Annots 708 0 R>>endobj -1571 0 obj<>stream +1576 0 obj<>/XObject<<>>>>/Annots 708 0 R>>endobj +1577 0 obj<>stream xWkoGίr[HfaaCC>b|a$;dfטs VUE0;yιKi2ј3H4Β7|Gw/o쌲)ϧZ8O%v?&{+,rdLA(Ow3J3/xnvMcR54ʶ`0~}Tq1RkYt{mkA=+P;3G%kR'tm}uJ{ktNNd\קM\ ݴ[^c44U:Bf#g^n/\^pc+PCD:/z4"$K&)~L6b?:UHendstream +O-12{H{!|%AUj-v#_B?҉76[!4\rB7 ҕ|Q q''[-B_zq_laF,<Bby)V^Z~Q(An= b-O#$%b3=8NFQnAA&>nvMcR54ʶ`0~}Tq1RkYt{mkA=+P;3G%kR'tm}uJ{ktNNd\קM\ ݴ[^c44U:Bf#g^n/\^pc+PCD:/z4"$K&)~LAHendstream endobj -1572 0 obj<>/XObject<<>>>>>>endobj -1573 0 obj<>stream +1578 0 obj<>/XObject<<>>>>>>endobj +1579 0 obj<>stream xXn8}W]]$%ia4Q46. Dl$Q%=CR&m֡乜9sf{CgHRV]7'4lG1r$fYoT$eIWņTE./(2'?3CI򐔣6ji2s&{MIogt4g8@:5 _\T+_|ccݩG^wc<EK'8?:ٶhPȰl)mE<a GOx UY-sjQK% -g-n {%@G* ]їѿ7[Q tB@Kk_*eA\`_E2yxxa& /8QFo7N|[ĆNh7qىs[pMx~UxGa؃ƙ{16p0W;?>ۛC0"-DrvKTrʲJ;*˚a=U@Q͒1JFɀ9RMo ~6]K.yа\gM( @ܤCp RVK󪊛U `?'p%Js|QFl~{?}/~Yg=x|ۛC0"-DrvKTrʲJ;*˚a=U@Q͒1JFɀ9RMo ~6]K.yа\gM( @ܤCp RVK󪊛U `?'p%Js|QFl~{?}/~Yg=x|>/XObject<<>>>>/Annots 713 0 R>>endobj -1575 0 obj<>stream +1580 0 obj<>/XObject<<>>>>/Annots 713 0 R>>endobj +1581 0 obj<>stream xW]o}/ )D}Zp IkAňR3ܙisgHIw6Iޏs=׫VJy2unK/?_-dMUV[IWerMVެq*~W{ܼ}Ξ7-`Nt|)Wy:H5|'HShUn &1ph*>C<{O`H9ml%2儏M4]%G4Z)$Q\n$N~dl&-EYS[+R Fe N\ b{5%(`*^FCAϤOglDuC;QnҴ SZǔׅ.(+wg-m|k'ڀH Ll ~o͐TU T{3W#G\@RTCmvx8Q/g*IobNކ FcYKqnQ2''i϶ACXJ$S|#ZrFdףd`Q5'*ӛ-WTy% ol*U:x r|Υy Z"3iS!px8B` -,Gjdgա ޹'O c2u)tb-\@x>jӮIh׃E3 JHVP& )QhԅMzcJ@P3CWBܙ /M@1"yb)rAVSNqeH)s8]4(D 2tDed'ַ>np@l f?p2U \QLO~h @@ -3086,18 +3067,18 @@ xs gw>,'g Bs9nRͥ prJv&qyqcϳ~E 543X{:f䈧 -Z}=+>=n9n;Nө)]J.ݬh]n?T4.].ݡR w+nxczN]T5oL&endstream +Z}=+>=n9n;Nө)]J.ݬh]n?T4.].ݡR w+nxczN]T|_78&endstream endobj -1576 0 obj<>/XObject<<>>>>/Annots 730 0 R>>endobj -1577 0 obj<>stream +1582 0 obj<>/XObject<<>>>>/Annots 730 0 R>>endobj +1583 0 obj<>stream xXMsFWRRR"HH%Z̺R  en|R7=],3u4?fce'#o7ϧ'~{4ޜ2OoRZވ)~8`'Y\Q ^^^ orDVdD..LS(W.39MET_*]*K!E*REfK֩zJmM=K K~*Iw_z2?}07<}r3kнJcgfoٜ*UI8v6sfE{XmiQHYK61UFՙNR6.5|0t~1ՑNSPA D6Dnw,G m}i.N#ol*Lx:B7،I@کܝr.ॶ2h5tahT8\[ycrW>J*MF*Y6j qh2Rz|1z-fJU?v=R=v*oD "Dߨ\NHEOTN(p*7@f+V-F["{ Nԓ64 }eӇ38!\P^2gw=N&D(S lXe]w<#=,iݩyf*um5E=(Gq炗ZQs5Jɔ1KA\MN"DZH``xoPEeգÆA>b9wߛ=l,P_gT`Pls"-V2Ӗ;.ړҏʎ(uDvJqqsUQQwuСe7?D*dv|$"Z54"ڐ,un 'oGnkX8S(ced@z1a|-Sj"!ǥQ\e2BM0zY8Eֲzu4CfB A4!>PIl)QiRӻz./  ۧ0@ M(yĹphgʝG%!rR3O0gxQ G RSdt/g_Tjk,LCA)eޤ*S9'-"{ޞApIX6Pn.@N dj'ixn;|KXqUYYJQy\׋ψFc{>xkm4fxo*uw ;W ̠o&ahXg>.nicAB]~4@d]um0<*@ iaj'В0b )F$`.b~[;,L&_~SMDً6CsozXcug5BE m(Dø 9:_e`2f3\է| 3ocd=?;ڡ}1¹g@R^e8ؑ[b1[Lwf>/XObject<<>>>>/Annots 735 0 R>>endobj -1579 0 obj<>stream +1584 0 obj<>/XObject<<>>>>/Annots 735 0 R>>endobj +1585 0 obj<>stream xXr}Wt$HFFX٤< 9`;3=0m֦l`.ݧOgSϔ3/l&o?bR|(l~Ui>3|]/I_qͱfɿ_T_]~V5߽YҪ{'*/^"6Y@i~h~C$^m]x烼t>N[]لS6uU]lZi|Ֆ6d֪@V%d]Н;F89_h:mP.x姲`<f 3{]O(/aVłt5%"UVt`FuJ*b [U:OVk{p/.٘@Yw5CiʻN8 o5Ǐ(鷃wHUvnDFl'N I|1>z*ilةSV_pI۷)3Ay @@ -3106,10 +3087,10 @@ x zd}F)1(aQ V bw=|26w2"jP}e>*w9^E&╌XANhn gsN; ff!F*svrU 8JV&RUqXұS,Mu+Kד0Ku,>hJ <BѨY hEs~ [w˸5%$_:H{c$ò!UZ<)IoO Vh} S57SkPmrEO\3P0w2[@ _j(M Z#Pl]t}@YEZL%?AF._EփA,nt;;uP-~KS15sSLo1jD"bY_Z4o@|o\n^>|>i5 l*Te|^ELɖG N'wArjWmu@ӆCA`Utf >l"08k.حbFHdbG%P.`*hQ0R6]C[(:Xodx<ׄ}t,܅z0>ru}V -\pC}5q$^ggV !H7ͪ2 X4w ?5<:CA ƏPt2I7<*d^%D%^覫fNUֳwg>v툄w _W˫bIaՒfu׳endstream +\pC}5q$^ggV !H7ͪ2 X4w ?5<:CA ƏPt2I7<*d^%D%^覫fNUֳwg>v툄w _W˫bIa5g?endstream endobj -1580 0 obj<>/XObject<>>>>>endobj -1581 0 obj<>stream +1586 0 obj<>/XObject<>>>>>endobj +1587 0 obj<>stream xXko_1@%ٖ䶸:qci}Y+scpVY,.R4@cg̙33z0>h<A?It2!ך_i0Nq0H&48;mu<S hãɘf~f\W*z0dp2[*|XkGRamEӢ*Kpkw5^ O8]?:Y'Mlqٗ>'puzUlQm'Y&S6 nsk[g8S=:NNsUW\(RYipÝ\ES9Bg M$ΙEi~h< 9߬L6,r AT 4UYO.WhZc<$:36I/:Y XfEÈ>y#(SRaIngܮI58 xkcjfOXֶ$F%-,n`zFeK(䔓) TapcJR=iRA7$s̈́H| i±̮$n-j-Qɴ{v%ρ/ת5ֺ ~Bhy .bt+M5UȘs=>O T*TH|1'[7Kƻ3i1[`y萺!r +F x# Ҵ'Ra;|*/BltPM mrax#Ψ9 0,OϨwzt~^oPe;uNr SLGcv ](Z L.,/}80,V4ٿ~6# X?1 لrܵJ].:yg-caSM?7 s˃2mFi.),VkFVm'8=? -I&!~&h 'Z6JBP~7 }Oǧx4 t~??$endstream -endobj -1582 0 obj<>/XObject<<>>>>>>endobj -1583 0 obj<>stream -xmTak0_q)83iW}Ŗc5Zri #,Gݽ!G̐U@ơ NS+e:yH Dd*i RִЎPf AwUqN[dzP.{Zq*}f"n'{Zf[.\`36$P+洏J4:5G|PgWvMÉii]K̖Tv6jR ]t.j0Q2!cC\%$ -ylKdVjC+Ӻ`?zՈ=s;J@N˵mK\=́U ,_^RLhTH䶒$vI}vU&з`Ȣ6mCe-+Ѫi#_N)0W69k}J{VѡY)JT厂QR`ZoJ}u#RTNymcL>=GF981xPޅ9D68h6rwGwtq(Hg !x"I"ө'x}\⹶\۬ɷ31 LE(pםv#~M.(<sS2G?HO.}[endstream -endobj -1584 0 obj<>/XObject<<>>>>/Annots 738 0 R>>endobj -1585 0 obj<>stream -xWn8}W Зql@Qi6>ms#H%Y`4$r.gΜWi<w6B8r29` -^p{DJ6@8GfAchM/$ o\HgRY e[S8|n%zN􂁆~/M&f0> +I&!~&h 'Z6JBP~7 }Oǧx4 t~??$endstream +endobj +1588 0 obj<>/XObject<<>>>>>>endobj +1589 0 obj<>stream +xmTj0|W Rv=8BZzp/yQl9VK%7c%`9ّٙ!G̐U@ơ NS+E:H Dd*i BִЎPf AwUN[dzP.{Jq "}f"n'Jf.\`6kO$P+洏J4:5P+DDܴ~bK*;\s|y\@HH5)І^rnf.:^}Q֐1orލY![031mwۍx0M|O]d۵5Qy,te9 >O}Yendstream +endobj +1590 0 obj<>/XObject<<>>>>/Annots 738 0 R>>endobj +1591 0 obj<>stream +xWn8}W Зql@Q x$DH"Rq{lGIX *˙3g&O3ɐƔ~ǛtgdDiҧdry:O!0'>L0Һp5^аObO4|(x\oDdEfX +c]ҍ)tmL3t`$~y$8띍OAB?*YɧZY$"Sznh07WreԔ"k B\n,!.VR!%F8W!5l9%m۰ZI B!7$,eҦZ,OJأ3Ir]ZgMs"O%~*DQ:fŇ9gHhEar6<:K5գu)-Nstfͣ3 m0W_,w3 =`dLj!*(3hiFh_B>r29` +^p{DJ6@8GfAchM/$ o\HgRY e[S8|n%zN􂁆~/M&f0> gsO˯ܲch !pn -5XFei2LwO lrD+BT[S -EPALapfREYb4@øABS!!.ꡝӼnQ5:9c3g&U'VkGlbAȘW8_E>{(xm!b *P -^:7KY(#[˄gh0z7VlO `eU[㾏5jSMvrO'"A<0- -]y_a^нEvD5Ptl0#VX24QDЇmEQV1ٸ>& U,xK n93)gՊ+E*t Z\>#o-/y@,Zg\+/ ѝtW_(TB_}7H|en+À%QA]0d2sbNkBrXkf1A -n ʆ1m_IlրHcP%&D H;ޅw!YTإe\02֬\M";),&~sF/:bmy}jxeNob@i\h2J&)΀>/XObject<<>>>>>>endobj -1587 0 obj<>stream +5XFui2LwO lrD+BT[ߟW:0hֿK'W|#ԓېJJ,V)w7l39~ z^5@;.*JɩzXw#JY3RRtZɢ !F=b-Jr^zFWI;RA%&0wlK|ՈZ +p#Ꜳt98B,3 dZ: pfXie)K0;>X.ϥz6d)^Y &0N8ZTâ,1ay )ǐw vяi^710uဣG@6 dLK"=P(Eh /lnzȹV23ލ[=E3GA-Xy~1ָc̀bS~S~ƣGdfK@tA! yd7L4[e1HOz>/XObject<<>>>>>>endobj +1593 0 obj<>stream xWnH+C$ >eD$Y~V͐2Mۻ"0"in:H2h"iyOr:'CϦ<_eg/g2| '>dd jwYD[;|n,sIJI- ]}0 c p f. <׺1p{9~P^v¦ӕx+ -jSu&k{7!ax}K%ksb/YnŨR˯)Z_Uvov:s` $Tol@=L^mfu Fdv6$am sدR`ɣeL9Io?k8de菣endstream +Z1 gh8-nW8oTbp("PX̠r Vͮ2dmML²@D9,2m3HA E]'J{y;> $Tol@=L^mfu Fdv6$am sدR`ɣeL9Io?k8de菣־endstream endobj -1588 0 obj<>/XObject<<>>>>>>endobj -1589 0 obj<>stream +1594 0 obj<>/XObject<<>>>>>>endobj +1595 0 obj<>stream xV]o6|Xb8p(hӴ6PMQPeN"7KIN( N3{-GTj^.knAJRe%$꩕&| 2pU[~eV7s!ޠӸ<:~2^.9 U[(8VAIWϠοB睫CpC # =ʆ`K-(8rll z} ``Ψ"`C)\]Ka!8.:!i<5Fo8c7/`v=IoGA|(zU)7szFN=Yvz={+kQNV=&Y&O9-7E,رLXo@o7$]wB{;~xYꦒPNyhɉ\4{ۆ p*wpq>NZ7 - D5Yްb=l/ 4U`TKr(jmrUfp*^g;!tB,e,k-]OQOY4 }H>dG5P(|0?5Olf5mKendstream + D5Yްb=l/ 4U`TKr(jmrUfp*^g;!tB,e,k-]OQOY4 }H>dG5P(|0?5Ol&|j+Iendstream endobj -1590 0 obj<>/XObject<<>>>>>>endobj -1591 0 obj<>stream +1596 0 obj<>/XObject<<>>>>>>endobj +1597 0 obj<>stream xVn7|WJu$(PV KikU(C,-2gf'jC.'M%!޻xYI\^%Cz?LNn&3 G4y&m](QN Gn(3PJYN}30}tbwQE$W'ȚzӼV$oIS]5{e|N i`OsJWF#ҙY.:/3lIIV4\9MRg?9k'Ix*TE3Sf T\Դ>l"DQx>40{HW6BRZ[Wx-KU-[INh棦T }H w`%kQʳ9.hq;{A{͑N/rd #nqǘl&ML/ ƿ%-e2!{/:#Sd@ -ʢ)#gtjDQgش' +OKèW [tVF.%&mZ.H#ɿ+2AK^S*keQ뚡4zhj R\ztY" -dؘzcWH SZΥOvzq\o4R*JdvFό0@Vz/ZC}9$gGȵ%S@_ vh YXNׇ՗/N!J99fpy40l]|5g2 1 Zd`o w]UҲ?V™hRoGсΈӀ>f2+#3`i'Yvixc ZʱJB(9~pnp8N!=L§8VAM{2{zC`FMBjY5C9AM8Db)0-C ~ӪyчN;l%$a|3ݯQ􈬃)E6h\8Vڡ#.F:mP >Cˑb<P9oEɜ]pǀinͥ.9^^$ҰS\1cvK]HԔU35}Q\Ums"K𒠾R9F7UYY6~Ԫ] WRZ7v91p&Db1F/ #q1qJendstream -endobj -1592 0 obj<>/XObject<<>>>>>>endobj -1593 0 obj<>stream -xuT@_1񋜱+pq&~8=scBB픮unBaͼyofR;D; 5[@>,eY:f9+.nW7!aUQbA%PVb`KXE#Q9p؃fDcP[WWk"x`k2.jk gR(R8 {D)H>/XObject<<>>>>/Annots 749 0 R>>endobj -1595 0 obj<>stream +dؘzcWH SZΥOvzq\o4R*JdvFό0@Vz/ZC}9$gGȵ%S@_ vh YXNׇ՗/N!J99fpy40l]|5g2 1 Zd`o w]UҲ?V™hRoGсΈӀ>f2+#3`i'Yvixc ZʱJB(9~pnp8N!=L§8VAM{2{zC`FMBjY5C9AM8Db)0-C ~ӪyчN;l%$a|3ݯQ􈬃)E6h\8Vڡ#.F:mP >Cˑb<P9oEɜ]pǀinͥ.9^^$ҰS\1cvK]HԔU35}Q\Ums"K𒠾R9F7UYY6~Ԫ] WRZ7v91p&Db1F/ #q1pJendstream +endobj +1598 0 obj<>/XObject<<>>>>>>endobj +1599 0 obj<>stream +xuT]o@|WRZW!OQZiS_(Ϳ4 vvggv( SO!+@ @^9=Ocx0Rt +6} 8?^4UEՋ=@'Xe,epƾY=4QtN=Xu8Pځm',AW=&0`fē`rhuEjPhUɝ7[ R\Ը~\1pH|OA riu"+\~2yGE-4rkcyI!M +Q$xD|r+$ޏh~Q-wR霴'"ߥ*4,ʁ3=h6H4Ex kz& ~h־)p_ڻ~&B,ځӰW@;nAē*.tT`:go$أ4q[2(;QPhˠ%,5ZjN擩9>v&]ಧs:{rh;ڋRv ~C~,Sɝ *UxF_ߒqʎ^zf72Y%=o; +Y!كԑ&1'p"x8] +3*ڑ e+l^mm˛ Z a$ovfFn/afA۳ cl.*iJޱ e+ga n#F%8ہ`:.vŰiA",%;P8\[R=j&G@2\n|y4?F_Gendstream +endobj +1600 0 obj<>/XObject<<>>>>/Annots 749 0 R>>endobj +1601 0 obj<>stream xWao6_q0ղi tòDl%%{GRX ݽ{|4WJ1M.(dO~ydN<ɨt1*i9XdLɈ7'dW]c7ؑ?˻4R6]$c6OE\y:8κS@ɜbwHҸuEcm8wӌmQ"c[5YiUd|z'NZ$Z$v6AOTJ`D JVki#΂IEZ[5ѕwBvI2 2J`fD # C+>@I%DO(KY_{s~Fwy7'9HAZ䟚}vF=>)ݔgzlJ"!%R]+c]y<ŪH:pzwJIN%(7vZMyc;VEq7 PJUKR5^o>\>6 k(~ ^Ԝ..[Q>6F "8'\n@fS͹iq@Z_?Ȟ:4AB~:7ǽk9jz'|#04jrysjUP#&?{"Nh45qD[q|=9z<(pNVɢ$rp/ .*. FgT#D! Z*Qkл=w/u ƞ4X;Nge ©{ɼP^),EɆ du`W6|P;[Í\VZ󵤯+SF+u P,F*D 8$㸒,iVH8BKPI<Нk|ºDC"8M !afW/==XyuY(Nۊ=.yǂ / - ԉ(n5JY KQ?~0v+y.-k(ift|P,#d}Kvz6!HHuu8=8Z2~VQxxLj!nXm4W /^Vz ^^j_,Kf@Kf5mH>endstream + ԉ(n5JY KQ?~0v+y.-k(ift|P,#d}Kvz6!HHuu8=8Z2~VQxxLj!nXm4W /^Vz ^^j_,Kf@Kf5mH>/XObject<>>>/Annots 760 0 R>>endobj -1597 0 obj<>stream +1602 0 obj<>/XObject<>>>/Annots 760 0 R>>endobj +1603 0 obj<>stream xWr6}Wl֙Nlj;qJ"! (hYH>t2 ={o>O '^ÛohLi2'*?V9yM;wVҪ3 oAQ⊯5׼;o؝Γa.}zɈqłk쎦ɸ:˻߀xOf3{ӥOx8c6Q`  sw@<W@4Vc {v^!8}Zy2" "=(-3L!?n7/1n_B;'쟐7 :Ň"zt>͋*-9.{)o$iOgob @a@Lzr5D.6֚T:G_` O *voLi#^^ >j.D+yijJ }f",YJJM 2Zx)כ VS+ vfB̅%ޤ&?ӚvV ]S x|ӂC>.RPa%!&y' @@ -3192,242 +3169,165 @@ x +W%{ `#y<&gG?t1mb 3! ~h]Jjk FKD_#)zv*k9IHy2HaGgfAm/~});]i-0nUe2CxZY>SN@sW-Vx8p!C zP O!E(_fҡ>>aJgiBM2LKU)Zv[2޴p*cSsXͪK-U;ns)38/6*"VdglFL]֚>JȅoZpj2ՊഭbǑf -(6c{rn@3z£YKmKqajD'8ctQ x_dOB{Tr~GBPAhEQCs0xϴP7̹Pgj"'3Cʿ<Bl\ `A'FmH`JdrY "bִle@)HF00ĩNʙx Rp{xqJnǍJYp+X<&%нW!)4Gt96h~0[L5(ŠQHǢBBVne2!*}pbdZ./ }8F8-LOr chY521 --؇A|9utUN#DEZ;Z@loGFqi mxla-gct%fL h<^0J/@U= n'f /һEPh⸲! y yGC幄9,q[-%\Sqe+t9j>l>1nXQ4 Lϕyhf2`mv|}K8t-oJb2[;b<F&}լ(4Lp RR"P@Yy$ |ڛ1gd: ~=-endstream -endobj -1598 0 obj<>/XObject<<>>>>>>endobj -1599 0 obj<>stream -x+2T0BCs#c3\..}7K#4BHP$YSO1,1/95E9?/-3($3?O3$ BUs=s3 ]!) S\Co)endstream -endobj -1600 0 obj<>/XObject<<>>>>/Annots 805 0 R>>endobj -1601 0 obj<>stream -xXMsW!4IR^{ثU @?RJvUr=*aU緟t -XD%3*_$+YJ =q -DΖ\RHƇgE,aZQ"NV,[#R̈́.s>$KbMsY투LFT1aJ"V]R8.."s1"SI!9kHQN׬4Ol]g kBbrE0|3)4\Bf7JjnQDk8Kvע#wI[9vudr35!04,c\As\Ro"-J,aZDEf6Y#WYg 9l.X`9>4]۝e #1WT>[Q&j,aPɜ\*u"<:uVgd8t"Iֲ9p(ĤjQ$Y`ꐳe>,a۞53[$,a~]Yk't@!(Cf1\;Y`1=ag %LF3.3-,Ma͌f2.c8v&M MT{DH#(IH`Mꢌj"%,)Ne% ^F 2cy]%b%"V:&U0wA$chKnf.c̦VQL2ZYbt-F%ly@Y3>$ nĩ04/UUd1<)R7 n$sYKA"SXns0X\YF,a8qpgYs -ǤHnr"sʱŬ"vdY`WkqYR!e v\0;X악) ,\EZxud-Ϭ]ck6% hdϲ\3c -D-mZT!s>}v % v<;KX|ֈf1Xpx,a0u0X ^TY{ŋg>Շ5/ȳxwV7uUk@: ] A]mCXJ X '_RPHe C 4;KX‘ @jWHݍ -TCpՅs(Y:י̓!z8؆aO9sCa7X(܈Ó!2`1~W8D#eJP15EXQꡣW9D@ q -z8 -;|t,FC3tXΉm+ e[ՕpWé0 >nU}ŋ(ۦ -wv20OfOLMyB{޶P5Co+^4]!\z[WcgX/e˼)|hZl5ֿ퐛?w;{B(Y X{7-{ -of>F⻫OLY(e/_S]e;Dvfbt>|Qˡ0Y_(X5.ߡ{"}r>1VcU5fJCT/]_pCk_"hUa߻_uGO*f^-ZֽgKG%N)vSs/@Mg=6<`!}=uvuo!;Ce)#e* tT}ljWxBvOB+~ЭD|!|^wNϼ=߁wO"4)f(Xtv+ݘL* P |GQ^շ'U{>/XObject<<>>>>/Annots 857 0 R>>endobj -1603 0 obj<>stream -xYnF}WcXӼKzZx;cϬhD*9$( EAO׽&0> ,4Qj6񟗟o?BS7GFci* vR* V,X;"фA^B؃lP Ul"*Lg°'5Lil:ڵ>'솾0 IsUl2*̈ivԋ]AZ;UQ1XY#vkF:aL -v:VaVaF͎AxRAYafcƞtS9a~dr^B""3~(#مd"`2':sDIKB52ʭh,)H(1Xl@j 9YYrXn͌^'讂P&,/"E5.&ؗ p9 `咑jb:YD9QdI0qX,9Va>ǯcmRP/>@ş!8EpHcUgultj 6'5V5`ϑ,*̀6c.# eӱeI(1XAct=-9e,CT4G@UlXC*̀3tvOz@ĄL )"pH`D`<(p=`F3U,`SVm)%x,'g9 r$ƒaηX@2KSRcf)A8Q{C#2I Q8Y\Ec⒃t:Rc QԺdt<=-,D -p,՘-ű]4RAθ"* hTx5MC]]}V -EA%lAYaxyYmb>S Ѭ0YI* MYH* p -ή7﷨>dL:LalI1+HD-c˼@YM"kKh*. rl@ʙ`f)v_#ӡ af@>Xʣ±nڋd{}IDŖD{\)ZEx!Lsa= ` t !TR,:X՘ Q -'pEf"\byC⒃Pɑ8ã`\ -pNVa8AGVcnˇ<;g[$icOe(زZgbFis"FlSIc. R*4nXR`7(Va"l;*|fױv,I$"3/!U>̆UIY ʨpݓ/VXaWb7:ᣋ [#keZr { Ðer.7ku^T`0hJ9!h 8s35(ۼn̶2fכ[ܢv!3˼mrgd'[ LCs3XQ7ee=uU3^ڴuVr\3/ه^5rS!57枹߾g&ߚ \[<;mv~-2>՘ew:UĄ/zaDzmi<75/VYS/"Vօ/3YQ^d?A.X$)C^lr9sl|v ,{'Y}{Z ;!XSӡ5J2(+ JR52ouu4OKZJhnC$Ӷԧ9UsQokƬ#y^I~1ˏϻ6`>,dRa쌮#RK~>:s8TV%KtoÖ?0>MX8>W[j˕*/%CqI7V1 z$"(]Q7F=*1 t`koq]ċGd_\d:tR49Z@w_p짻9,1mDK^ʻAZyMi45ih8>/XObject<<>>>>/Annots 888 0 R>>endobj -1605 0 obj<>stream -x}XrHWa  kplX,gY#3#V7ZV< z:*")bIri07(X2BKgA9WMˠ`t8̃Z 6Z rk02^f%R * - 0!8(I-5YFb"b`"50UQ/i&I3i1fh5lz`UY_Y̾Np,X,DFA"#dPREʲikP4q^gcuҰtU&:$9:RLP̲-Og) -ePC F"_.,> 8]ECr2xA{e -|ЉsQf@9LZ V3KvܳN:Ԙ/@30:%X<ta#p@U!bRCZ#y#yWieI8bN~ԧ9J<̤Ŕ-,%na,oE}[덾Cn~AA6];Hw ЎrwE^ o3FcwȺGI-/߭ehmOpa/_=Fo>ԭN}@.2vrxʾU\n_C\hwJ}^Ax7vК-O\wۮZnf\Tvֶ-[ݎr~{sۍ\lc eV/} ^zlmwPe'a>N6en5澾^em;giP{zԇ4vܵ}(v;sļb}z,$CSkgu6Ǟlp>pI7"o=:?G~_nNc -p1k7j=7o_zz t6ݦ}vΊ_>@!zܿendstream -endobj -1606 0 obj<>/XObject<<>>>>/Annots 893 0 R>>endobj -1607 0 obj<>stream -xW]6|_1o\RT^9'W|HH- ZH..]V03& ƴlIiq3&x*ZboAlڧ73VU MhX-(ou³3V7(Wf"Z,|͗hㆦr]›t$ZVO"^l- hr*iWl/lqD ҫ3z)cS 7́$U!je4iJkEuڐ*\RW FJE+sP9V&A[Qн3S,*|ZQHQܿbJr{Ph~V:3gKv4`D4yF-_|*E@;>jO5_aJ|*\ҡ2Wie9Qlꏲ­^)UeT}w3!C. =l~wRoEeďt}PǨ4]_ؚ`p߭pV};p$b_|C@RN&U} -[65olg[;n|D;1 cà - cA0Q)@s0~u@ee`cSD^ǓCf1, qXc;YC Xz.<*[%j^MeM{^FuTDh$s˾)BMЮR99%^m==G:QjHdCgp򬴮7'{pԊ V|1olzxI$$PaX!6JvW!t 5R 3,7YYىI' Yd)”=,;I;r΢\u)r3J(gQ2bQd.T7.W|7qD/u%R}A{)Ds #޶mzn˥uQ R8`! 3Ɛ0VZ*`ǶbZ$#"@$ftð\bJcVVL:#wurqDU TPy:};t< -z87'_2]ϲI -Z#Z?mDSgLV -:w8#[&1Lߥw3|r;V);N^2`lũM' ,DΛ'kYA $ImLnYI$\|m׮}2Ӏ!XNyj k{Ac -2KaFg%롽~ _H B>Oq -qvqADȑG7/Ndr= -̱ӱ3b])uIn4g.'ݺ([[?,P#?v͓%l a#1gN0ڜ:fԮ򣒽ua\zp2IH*W~^y;Cy]>7 KvdoKxcX5p,j2Cen1i밃]t5mjEɳt O|\ -5錯<:Q -aboMӻïï;0_xZkuof+yZ}.1{t_endstream -endobj -1608 0 obj<>/XObject<>>>/Annots 896 0 R>>endobj -1609 0 obj<>stream -xW]oH}ϯPJ@*CFMHnWeU =3Nʿsgl8ĝA?N )tYrK hG*A!So~m %{Gr)c6OkWy,PB'!2ߞ,E"P m*)%eҶqYP+cYçt;V -iҊ8SyoS Ӭ̶D c̄9ޝdׅ %"R;G,)B3eɊUP9媂mX#0HGKbd2RX#]2aQ ]+3mŝ6 -2Ia hLNdIlmk 6-$`GFë&95[.z6)2 qF{h(Dt߅FDz$t vOaUH^Yjy؛|*ۦuq$,4iS[lX#h&-KiDm~M]<֘/\&7Щ>A?2[@0[#XC/6,^a+V/ eh6:yYdR,͗=||ލa>Dpk*^VylU!#PD͵^e>XF@gD΃Y>2f{ L Go[P ǫzt T득*%~a= j-|p]z%RL@;r&[᜖b_T?2Z# -&[OǕVV@ak+%~j>2O||yercnD -'z37X;\dgo5pE[7{6F5mq~a]l`||1 ]iw,MckL&X Sz~kĽ\m*: z/'^o{.Ù*RHsS1o VJNV>JTq_NW=}@ {5`}ҁ&st;Vt+T]UI@fH5+X9*{jV F`: 7 S(ɻm9`4Xw0ƛtHIo^+d4!r8t endstream -endobj -1610 0 obj<>/XObject<>>>>>endobj -1611 0 obj<>stream -xWmo6_q30lŲ)IŚE\t<Dl$%)Ebkaĉ{yNbL!&gh@e4lC|?Oh~i4 v s  Qܾ=?;yIL&3H'OAk}Pe.Ԫ2)]>1qNq\6mĥ$WtG;]QQYG֒:^ֺ# -餉^KAka[ZJYRȔ=SJԏGnyėD84m*^bctr8W96]T8mvQ+V(#v!MDɈF*[|seߵ?V^O b%(-PP]6e~N 5>*K*b{eiIhvFi* -bF׵WG !tel +u)A(P,AV$ i EUӨoYph#/vP#aԉn,j ՄZ#NpJcsɭ,NU΍No:= fxu[kv$Q~b`ѥz)f +5ԥf]@zhb Cs 1,DS$Q&?Ό.Hdzf)ㅕkp : gNZɮy2a@͟)\~r^g * Jl9hG.]%/,~4mK0u' >P6 ΖQDbHo=ʢnd J$0 -[ʴ2d۞uDWwa `?w0o&0_ a7CMlZG+,ފR?tIQ1}՝be?m% p +E<* 0Z<`kvК 5(9ȥ',_qDsF@E/V%F[9[ʞG8 Az>/XObject<<>>>>>>endobj -1613 0 obj<>stream -xXnF}W bd&y)[vFmZA"F$W%-{fvI( $rݙ9sa<:~.攖GG/9EFl6Ezmhg*TkUM&uۼ]x+S>QjZnL[=Ɣ_|!|YkkG3]Lϑؗ)-[Cګr?jwTRSrbjO9 QKzL˦VjCKMUmRUԊc(L>[gsSh]UXْ <@.V*vk]q,y1&ID -nAƋK*ՂZ+Z5nnT{7EGU ˓QyRkSPrJڃ:][aP -I}^+rnxxH r:N#} }҅Nk:kN y%oR#ʹv;~m"Cv3%`ϬA2㐑u{[ܠQhVWq,Vml4ѧZuՌƃή*Hnaf#mii0JSCku3HhTPT1#bƱjBځRt2@9f-kP'b:KBVVq٫IbJE&$R,T)oL8IԞ)>@O-[Nƴc̀LӁ:AZmL*Ӑo<BJh4P[!LaڋN!,92U?(Jפ  ՠV pa8'͟ԤZ[ @",⋝.m[ Zy(h'Ț b f5[8V< ծ4 !ْ35Ox`t -TWp1$,fx- -Рݒ=? E -S*P*0. 0p" "#V駚;U}d5I9»Wg#wqlp# azLϾ{G -$g~(F=i'Asd'gSvnpMpSOpU1(Ua}lwqÛۻ?o|]DH7ԿI| } apM,̌zced`u0$xGDVХC= DR?-@$SN4Ix @%c_ g -kC˜=ac+Tsc5</q]ͮs۟><|6^HY p~9ɉZ@o ׋L<~쓵Ɣ,2 -KDSKP -e25q#%\| -}^`BR0PVYI4$>n5L)j{TOl*0G` ke3юRB'/D\ooR C;Ev!("ɋO|<7t'o{A+ZzVĢN?~ >\;9C{V#G nMV#5/ax~F6Y^0^c{D,P34uf }y` I|u7ҧAOr{桢M.n,`o͓.xU-2lV@TG<K˅,)B})D /fM`[i+opݮ/7LLɋ /xXwȹ&{:&Y~XOE -d" 66r mY8OŅ?o>*>Plt. ϯπsVOoYtiU \nĿgsPn+UnV]^_N//w;endstream -endobj -1614 0 obj<>/XObject<<>>>>>>endobj -1615 0 obj<>stream -xW]o6}ϯ\?Ne, dDl(Q#);;dGHסhZ8<.4)-gt$Z,Ɍ%~ᯕW UtJ%m2BɄ60Sy.,SH A$OBғų oE*wMywy5Mk6NY1GUf~Cƾ8/2%͓I ɓ SΊ1eP)cnTO|jqSdJp.B;Q!h@8 AV/Q6 -k(DrQ{E(V8!2v3 ^F{6I*c1`챂Kf'H/ZD6TaA_w2Hfa!l6Az>ڐ1y,"h?6دRS`2^;H==o]Y20.SceCiwn{Iar' q7(aU8 /fDȊT80*yy%k9^\J G)3Y٩ #c1ʪ+{hֆqmxVde|Oֲ]ۇL_p -+f؝>c~Ǫ|3wҸcA+9m!4j:-뛻7>/XObject<>>>>>endobj -1617 0 obj<>stream -xWn8}W Kvloi.۠ͥA-T]$[&EFȹsf 4h8$?A$Oa8 t:=OBA04h:s#i_ 0"_x?;8zKfKD4aA<,9 -ALzRB-hf( ;h;GRWlsL.EZ]DGH=)˦`fDP4"[D-Uq1}TVZw|Uܞ+heQQ]PfyY9iz>Ƃd|N)s =Zi!ڄ^Lڞ*iGCjOxBϫo~] -(AkQ MZDEwEA4QI䰥U496&)9n -((em]bF+r/JޑwS.d}˻t)t\T凑>&$SCVs}qY2zIAag*L8 ʥ;_7rI0kj3Qq)ι3ݣy.{XWͶ_sIoXrMp1ջ|Oѣ];qz.i0Q/uu g">*{{@n"dg`r*3 ]gF(A(s6:2f%pv/"dS˦9=֔f|ط!~`Ѯg{v~*G=Oҟ B7dLS|^> 9#=endstream -endobj -1618 0 obj<>/XObject<>>>>>endobj -1619 0 obj<>stream -xW]oH}ϯD -6H^V4Q&M+eƞzP; m7 -왹_{iPo@Qz4y}ꏆ?4;TGo荨?<7ti|, ^ ˂i&'gi2`fKzwџJfi)Go'߯6v!eJJK[L~yABRJinRH$뇅ؤB3ݾɟm! -W² ]=$ g&I9?F;9[3'ޝv{1Tie\&:j1a0v/qg!VtaҬ,dަd㘬LdTP!7RmŖ/Vs9ͶM­Pۥ B†U#V8Ӳ(V41{d馪FA* -s-;%X=m`ڷ<-((I*ҒH1-R'JBBܥJf4 Nrgɣ-5r"oSI"jHrxA3۹e╚92+A =SyE3E n.Ə?078LX r甮߻5A ;}/\)5YމT<˭# KfFS!tEB 0 -@`UM[uFUO#>r _b;|((m@(/5&{= #N?5>P\+A%i_(<49<_!1F'W -#n -fwuJc1ݩ(7 -2@ 4Κt"ˤgr}؊QEQ4\ziG=Nm+ĂN?Wnꉷ#Wۀ~=nu93Z, ņQ}78 pKӁ>wyiGaǽ_\Zþ7K`ۯ&dZendstream -endobj -1620 0 obj<>/XObject<<>>>>>>endobj -1621 0 obj<>stream -xSAn0 b(Zޜ:EXE[\EL$+5,;"Qjg;@A`V)$+)W%#B\MYuyQAmI Nf06AqM@?8w#܎ڞK##{Z*6VF%VOڇb̈́{L?V?}ɊQݡ~FE;}g@-Q >_zôg4uද]aΠ:8#aQy~ -E;0uof:9,-%BbHӖgcB׸|KEϬE ͥ4 Q3&y(Yu aX(~jvzjsȮn@8"s|b\DL -%~XghAyyOA:endstream -endobj -1622 0 obj<>/XObject<<>>>>>>endobj -1623 0 obj<>stream -xWR9}+xrs; -v"\xgdFi"q{xTmQPƣG?ic9el:tN<ǯ״'g'w۷4b[ vf&\n)}{>i_4雱[Y7)LL@6ޕ&w|"XjG>?Z)l*>4[ʍ*cw1SVmJ,Lk6lSP wܑz4RJ]< FmLSH2< U\7 \7%  i]ur(L^rwMj)}+k]dž`ЊI'DNw(rc(A;]Ql8.8҂!u-QvН &jr}}ۄg(-p4o,j85.h8;ZgmZkB7VPzt֯n!)e14ޣL=j\A~5@ǴeNbd>p@p^ۦ0Y#b,1^{njm4PG vQ iH N ieLkF,&w@w0ͣ˒$=tS&h?UX9_1Ai3|zA0<Eɧ-qn޽x/ -COT[p^%Jí(n -7*IW?hzO;92!¡a*&w3L(7\E2#jy!V=إ] ޅ2H8c]>U<: `]7/i&>b56Yy\C,F?aVC>4&; ft2n.Ȅ~u%r -"re>`\r!A+z6H avEnB]*PWX -KpDxp^0CBez\ -:~ +P; 1" -@g;bC@UUyV=)S%tnM/s ƉO -:UM:m|CmVQH%n):mIT[qm} lZϛ@(H\ԙQW|ْ끘}fO&Hn˜ID$y9k;psy Ԃ˰`x/"fxZ]-灲X!QISp-:l 0loc $5 4fWP\FkV,?qojU0WMkHzt{KYk5v>8^_+[ffPendstream -endobj -1624 0 obj<>/XObject<<>>>>>>endobj -1625 0 obj<>stream -xWMsHWtqTa-۱\M BEf@GϨ?^~dBcLh19EۓhLw.<ůkt4;,hbV`2FYReOQ$m(VFFNlJg+h2 N DKi]83Re^P`66ugf`"'Dh_p&D]Rl4bAtICzs8pceTdLBuou:[||p8S#LlN΍$Tp=\P-}~-ש,v-nI3 q8߱#kC%2PU2d`Z9e,mdT7IqI2sjόs_E{"VE~ىldRȅ-cZX`T=T. l#d<ƽp1؈VeYU]YX45@3ڏ+}YOTx3a`&\|ﶀk9^nlbـ1 ֻCI;$Oȓ+[ -T!hR :ou>He3ֲ3HɈnAcv -`ƞo. HFUF6Y)ސzQN"PV9dб*1RLty'*hMH8Kږ7l;0A|!Y34=z-RC]vl?T!sA~m9@eCm|lX03(2ZKdhFUxTGa0d`xB|osN0J{n^2]zQ:; (#y|! md:D|Qdڳ``^%L c14YnZ?"?i[' GAH'Tjê_#ŋ2ʑ(T¯5_|dMG~~?tw1o9/Yhevg2ȼ z5:7|g!ܜ76_+0b}F}2]tqӗNۥ2ܵ1fY^ye/,/ƃ!FZj]Yo kh6XHLѼԆU 9_)* v%{ǐjXyRX*̫b"x>QfN(7)#]aT\,] S&v5 ;&ą DcW}Q9/=oۃ凫Kz0+zw<  ibnKl1-؉.lfua'4endstream -endobj -1626 0 obj<>/XObject<<>>>>/Annots 901 0 R>>endobj -1627 0 obj<>stream -xWMs6WeƖ-[ޜi3p|HPBL @ֿ[(ҝi'#ݷo?NtsZ]ՒbvA+|/nV ,z̮zvI-ON̂t*/ޯO?N^izNzF_L[T.XJIeJi 2ڽ]a]fK n#ȩ1xJvBoj'ŕ˴&)_lic^N_!8OKrdR[U :&mHNj%cwb+ALY;OCT]Y4Ms\@V l#kLǜ I~*ުg0G|[Y0ҚD5-Y!VrǷ3Zj!EK뽩aFZu.p$BȖ {v.c"efT`B {N0G`y>8#](E>*%fϯQ͝ptG*byJ ̾w;~+5lO[?z,RWS_x0KQCibgkNY;kD~H&T*g*YƯ#"fndG RXFKu=iR-TQ*]% -I4{Kɓet"@"Q NtHLQ ut;9I3e7yFUx iDngd`Nzj*j&w2,z8Sµ+fP[m,xd B+V>W7c - /!mw%I -j3ԗTfi"}?cp^]npCX;3P&~(jodRp$fd2{x0#:{(QgHE7KcTäӂ$FϏU)$GZQ9GD)Nmw9>8Nv~8 -Ih^Dl,/,=J@0GYcr}Iwy03j:|? JvA:>ZA c;qq)y\^ݔs;3S[:` -*kr& ֶzPv(CjHaI<"kkCvϺp-_飬'ց,.dCLUWG΀9C@p 5y4(n }(\,vH*C - -zi6cM-oߠ_|7 ~W77xA+B s4V؁na抖+p-nw63I]ik=k7.}K]wT^/?N?endstream -endobj -1628 0 obj<>/XObject<<>>>>/Annots 910 0 R>>endobj -1629 0 obj<>stream +-؇A|9utUN#DEZ;Z@loGFqi mxla-gct%fL h<^0J/@U= n'f /һEPh⸲! y yGC幄9,q[-%\Sqe+t9j>l>1nXQ4 Lϕyhf2`mv|}K8t-oJb2[;b<F&}լ(4Lp RR"P@Yy$ |ڛ1gd: #~=+endstream +endobj +1604 0 obj<>/XObject<<>>>>>>endobj +1605 0 obj<>stream +x+2T0BCs#c3\..}7K#4BHP$YSO1,1/95E9?/-3($3?O3$ BUs=s3 ]!) S\C[)endstream +endobj +1606 0 obj<>/XObject<<>>>>/Annots 805 0 R>>endobj +1607 0 obj<>stream +xY]o}>@!Eg7nܵR(@KĮH$eK\ζ'qKs('__~Jh<]Fݕ[M9k(7n6j06_`jh14jghfH2I'f@@̢pBiE!-ܲ]̂7j1e59O4[ 6MY.Yy.*@ ͣĐE`Kf+.e(Z vOZX kƒ +bxe1؅DLbLHs2sɓMg VXsX /#l`3j"R1Bnj\!C8.-Q)ϪZ4 tvF5jgҦ5FW4X5(k`>83 jqS]lelsVR-jÍU$SP,gN1tNŁ5./a SXW êS9(DcnL:0&4X"e \ѩ k0+>`ѩ֮`5[qG#Z4y,8+Ȅ{f5 {k׳c,]bpW (#\\} O5/V9H@:[2TX.[ "|@(Mz-',j` 5ٝd1s`g|7ևuB [)QS 4cծN"a f4p +33pD5fi b--k0&0+6a fHêWxJ|Wiͭ3*L,[2Z\a s-]!7ΡH3)y?25>Ϲ# k0#F1J|`ծ c̪ YT vk0k5ڍM!L +RS3ou*nX,?@W^?ӈ9|Y+W!5pi>XT@KN(`I!s\2*ʈ3}{/33e {7p2Q|U.@֕n)}ÿb@Pa)#7p/q}G\[?|t&O64CnOj?n>=NVz]Q?n_/ʮ8DzN]ٻa_ =\4k5кS_Fn/f_]@ݱW۴N/bNv:lMclpz]<J>m3IY/F]ofSnrxnSͮ!nǶsb I侔u;5tUSC%MD 盿۲GݏлٺٶϽvכM~_Qbmى7#x@ޡ/7^ܶ*NT;S~iB6\.B/RO[">7:軩lr3݋3!P"z`#l u^,nݶ|+&Np'@&FHO bMj(vK/u;z`~m +M.\t N]}E!VʇNX?ԱuV$V5ݶu7ʷrXh6,G=`{J'Oi]{'Mt< Gy:5/c})Іm?m8}]̍};[VHٞ*E 8"z aÛw}Wx`Q䚜0~pa}Q5?>/XObject<<>>>>/Annots 857 0 R>>endobj +1609 0 obj<>stream +xYr+f7ɥm]'d].{KQ$9!|SJL3>C0MBZ,D?ÿ~&Q(f $&,tR8msh`=ކ$*&3/%<=M! ut:ɺ:Lͦ6%r8 1XT0"=0yp8.F`lc;lV ?0e$If@$22Yc1]d0ة4r"0H[-ftXPf5aTLې͙(ALOƮ8LJc[z vL^aG0fhdct,0Ȱ#.sE8G9'(!K=d Yw&tTÑE"0d`X79KRjXu)tueSA0dg)0 Ǣ1 7]*_rv{vŗ04Qz HX +@Dh6,HK`,ʇl0X44b-.6lrAaxKcj4sˍɂ"0,GF0X\6gfD#'0B#J^z ei& Ӯ!>1+HDcYU X Ne\-eAMs- 96v]ә kEL1jL32Q)\TV!b}2Z9acR9Qf|bbFEWz4y=aHC*>9iA0]X9\bV4Qco,ԳoCz:gIR9{V}4|d;zv?5af`yl/*' +rgC& G%5aN109;:xL60ƃ;(nKH{!eA !*=M*{ :f0;P +0b/<+/Ae%fANsb7®Ss8V5Ryy'D݉u,FYa7gF)\#"YXaWz3^>vq^ +rv{VkbK1XdXD^Y +rv{V.+jD|oT+HdcؕoR:Lk4z ;0X~rÜ)},&ٳ+>tqnYVjX/\uE t5j& ++$!x3A8鱺bzYQ3!܃ +."!ԦŲâGsd,zI1axacx1m>(v#>txK#=r,+3{7Nt/8 8V8_Vs?/'8GR 8e~yv]-fӰ_@\|6 .mSpT/e},_u3q@XeIxhڧ vaߖr|>UJA$;yXaONu`4WL»n]އzMܪ˴pߪ}*>LlzG7hcaz`SXl_r +7Kכ;xq4<ݾmVpvmStm0͓i|Rݟ(r[D]}w㡑C#$וA-"}&a bՉ!Дp 쉍n8aG:9$:nYX?2]$BUHiUkscdr|55KQQ׫-cpr\>G#q$?>sT;d_Й]$# Ie:.1.$es0sdimxSƁf?dG3޹R{),VۻGs?mu[kdU +\ø~\|v gs|P# lOP_ +(.:%Е+hS/`w\ '4WX]aJs(B,.)WzSN(yz8<{?>/ yg:G.oxpF'.>B?my-]%'pY2<x|{{9Wi1ASwy.pjendstream +endobj +1610 0 obj<>/XObject<<>>>>/Annots 893 0 R>>endobj +1611 0 obj<>stream +x}XrF+Cr㔲(Qd9AhTtς؁H\eWwz{gf+ +?Bگ|O> +"/7izٛ$ z~Ŋ,tt` T,}f!ń+±jVaI6C8) RG6*hZ+aUl<=O"A{SHL(Aڃ R~l3UOGTVY(+LSRv*L嘕u{)Yb_B r +Eg*lǞ)NAfRchT1S.Va"dfV,%E$&,-9kC* 60K̿Xk8mgx&3lر1t³aŊ)6 Xdf4Q' l31Xmdر +8͊Us* BNb]0#50,[* KϖM#Bt/NQW-)YVXIff$sEX,⮁0Zt)DT#1o + De8RcL`sLo0$Ks`DG8VařYk &[ C8g,G Ƙ9M`ؾv!9!+RRvB0$u` c0:,x.-,T!.)H,Y6Ub,? (@⬂ȊH36lP lʏbF}>Ŋ>&"@bc3aaQq:"aY(qmATLqlEbRD$P>dVD)H0EqN* 6M}`SvnӉ h&5l.X+YYNvPt$hI)aa_Y"j,zDq +B4w`*(VaXkGr@ +@a +XvP͑ iegc^P tP"5 +P̣bebiwN(P#gIi̱bܯݭ\Tyfj]7wկzԵMm6]o_`r)o`!¸:s=o!\/ywǧՑg>vfaowm-{ӏC3g4Wb^=6/mh~gū&Y7tO4_?M7ݩtx>7OӰ'a7o?䞹jFfhͦ1Cce?sWx|TX[~ǘ)780_e]Aޔu$bYD<1͸OV.+u%ٲ4`.m7^BcڛklO,cŮ9m,Fz,}߫ٷ+FC^v26U{~\;ϐj78ӏETFT߫]s(rHzǘ>)NDA1>/XObject<<>>>>/Annots 898 0 R>>endobj +1613 0 obj<>stream +xTMo0 WhZv/C&[$baVYJQݤ0ta'&G?<|1-/gǧInIB!LC?AgSVM͌P-O0B~x}K^+!\B$4BJbET0n`p12y,a(F(XJ H3"iA9lN fV5RΡt3׬c3EZ(b5\TFTs* *$,nsc^V;߄,^CzY^k9npҨ$QmK/Gp2^wRtj)Ib]߃k:}᧝:U;=|ϛA cJ8a@XSl^ +<].>Iwv3l[%V>/XObject<<>>>>>>endobj +1615 0 obj<>stream +xWR8}+xTAP;[S0;d.(cK!-SEAXG?ic9el:tN<ǯ״'g'h> +/.iM6.ThOSr;}Ҿ2!gi)7cs txgoFS\em+ M";<9E8 p荱Ob5+}o uST|iU'9c4"LYlx1Ϛ:A7 ܆d_j=#b rYm%͵/8q|g2mus W viJ3j]ux(sU!A ~ +zPR쁄SRo,ʔBCN%*E[jJԸx>?ݦ+J LC#X^i-rGhH=)u>DS1M!xT4T9r4p$D3rwams=# 0x5ժ)VUڮvu8\C@+&u9Oޡȍ#ND4tElJ F׵D[9@wJ׃Qq\im&[I @` ~ODGLjk o00E0"BRcD8h.0G+0zt:0`j3hi˜"0U]kA+|L0T۷MaG @ |YbyRa% (qTq FQ@`@mSw$FYf *0 x7oLrD|auYO}ҋiĥ ,\a,%{* ֌LYݗ9Lh-&` G%I,{5YL?~*Ircf q9y|7O/ [WECl 0ݼp +COT[pް%Jí(n +7*IW?hzO;92!¡a*&w3L(7\?"[a + +a<oyThNZ|aL$Gޱ.٪Vҋ؆TmkWY4@T2.!@ZWo uV:ghEkdB CZu9G9lLfwSl0.9=ND$0RA"7.LK%J"Aq@< 8qxfri!A2=.Jj|YN͝\u1I^!ta xg*>/XObject<<>>>>>>endobj +1617 0 obj<>stream +xWMSH+|26`l-6 d\M5ڙQ-((ׯ[L?OdFx|LwS:=F_;Nk'g.oodNflt\"N&1}VVT.IJfC4ke҅} +c4cG9YE&eʤ)2?kip56O*W33iiiRU@X"O/8lk.hr2rTI)ߠ?C.!xLNe.62%:ڬnn:|x<\|p8S#B^έd4p-\P-}[ ж4CV+pp2ƳzQ:#n)yrekj2-MYb +VXZ>c-;:tqy m4[-n7`P+@\fl| D`d [Q5m.R&HF4r?TE ֢,' U$d.׀P?VA吖h˛=d s>tf4MO^P}]#tp:d<ȕuܯlkf`E3::Bkwmר*a>0l&L OHWsթv FiPw A Ww0 +Ty^#;TBْ Ӈ%_½[I&}ͨڅٿ^~z^NVRh +#~vHi\6`4b9هrTqbꐁX=͙Â0ZJ\4s͗z( +mCw-p+&vi6 Å9f`\(ƼȵHx٫B>/XObject<<>>>>/Annots 903 0 R>>endobj +1619 0 obj<>stream +xWMs6WeƖ-Yޔi3p|HPBL @ֿ[(ҝi'#ݷo?ΦtSZzAIqv5%?c%eK_~=Oo'ts3QAwӃ73Xw4]:ɋ)Sox:LIUWzK%K2S)mSF06)lrqoH9*Jd'ϭv[\Lg͖6a5$WSPDct{LoҞ'WDWQIKZ`]+MvN|ȝ!RV$JUX.lJ؈TX!ʒ0?*VF0A@;OR#^ ILI\J9T3VC`!T&9,6cNހǞ x<#9|O{vB۝LjbQ2r̝-w0Px59v& ֶzPv([G8a'2}R]atL:=fb5@1Av@DᒿfGRWPdAi3v 0}g܆8 mύr ^­HfXYtu/n״X՗+ݚmtg@.6znX^:_'-ؽ_g?endstream +endobj +1620 0 obj<>/XObject<<>>>>/Annots 912 0 R>>endobj +1621 0 obj<>stream xWnF+XldI.ЃąMZzeE.MH]FVovIuQ@.wv͛7_Gh1|!޴?2,`F9M 2zu:&y8w<4GgΖ%뽺,9[ 'g^MyfAYE4`2ZnP&/%݌V)/J!{cdaȲ%KMke F>c7ȸ*S.XwZ-2!aH`%z0J%)[ㅶ}J`j^ 2?7x$t!mxFmO քY[)h|f*V6Ä2ȥuv 7U#*v hwarf6RW۫.̕1J0L2€A>[zZq8OuY'$Tax>o0KF'5trv#,$s*X4[#0YYt]93ùglBhM2q:/ȢGr}U<$,ۉ tq֏ OpCvpҽhM~zi 3Tu>(rP/R.-t+"mB `.YsuRVxw 5+3Jx#4q֬kDS9[ br6TnJ|3ZHN~ͩ{z l?b?lVhGbRQe{[\/QCݸ=@)&9}/=/F9{U$.Y8DN"5\ !PP SZ5 2Frk F8][arm%ѬR -ATmQXSVp$օ-urCN lC秚G9%鵞P!s/0v~J11[T.Yc@tw7~vQM={_50l#C[@ y?_Ng~F`}QT\cdED E'\Wz39rp%U;iw&}Ǧ7lC秚G9%鵞P!s/0v~J11[T.Yc@tw7~vQM={_50l#C[@ y?_Ng~F`}QT\cdED E'\Wz39rp%U;iw&}Ǧ7>/XObject<<>>>>>>endobj -1631 0 obj<>stream -xSMo0 W=Ijv[aj`^hYR& G:vv=taY)齧_Q - =)KXe (i\ox\$m-kHS(jڒmr(*$B̔-(hlhe|Ym56Mendstream -endobj -1632 0 obj<>/XObject<<>>>>>>endobj -1633 0 obj<>stream -xWnF}WL"hI-/Em4iAȕ6ew="\7a"wvf9s'sgN_R^2|Ͳ-V_#i{--fruEp|'])Z' dtR-V5;ӗ=̗4 -.r%}F9|--&${])ݐ$ĦKIyglҕqdu 9Mq^f'N6b';b85EH"1&[o,;NqElɉrp[e#U8/" DٞᝠoM8W -!c(t-5hކ'`6P@Yx 3fc+x/,[p;uxRWȨ],qT&yN06_Zɺn [U -h9*TьY8( ^ʪ6J>k퐋B*X8Џ/_'_)|~?ij$l}UۋALp#DMdkR8id)fQ;XᴱpUF -^75QUr\ZQr\%?-X|S@ ¢9ppW 5 ʨE^aJ#/P7ISwe7|RF#ķE|!Sx 64 czn-Q7I.riQOCz t/FAL G2HM/(<ǓQǿ3xtF}YP[ɗx=15A{.Jv=~RcKw$0uS@4{^ TK~Н!ŰJ}9A.CǬndyT!>/XObject<>>>>>endobj -1635 0 obj<>stream -xWn7}W UxW7[N>f @$fv)5THe{ܕVk(r̙33gg@!~` *3ȮiY~az߼asl\Ӵ~c}\U>Z3W)o:*N Kӿt1H&8*a;DXT̾b4NAF dgifp]djvND~レ<ֆnNoHxZK/h.*e7d꠴)ygEtX~/"jZKvwa`i*%" fS?#/֮8\Xpj5yU!}FߜB`RmYL/30N,%l= @Z ="t81G+ں R18|Kɀb2z EO3MXZZHe! 쀩aX \;&nb`3ceFN[¿K^ uۛMG.[5i>& -2zkc%0W"T!ad]Xsgyڔ 5 :U; 'u(qlX5 -%x:TK]i^jنdeJBK[4 QCFlmMQ,/H -UQڊ2i5sm""t0륜ZKTV&K=[d}Ps ;+}A)C*jQ?r[g1t^@jeጓV҆1oh!F슛[W}z6qR75wWLxieGlY.~0m^G0u -VkJB)OZ=2?V[姖JhC@fv؃  Ckm -[U,Zϵ:6>}: -"As%$qX6ZćlNbLd{qZ3莓!1 c!D!lUd뀰 -,FYڔ;qsVr19-_Qǽ 9 cwj[.Aqpk)S';^UJ(Qh aӄ }c#Fcjv6Hkz$Xx*i / 7y.WUyy^T6q** IHnB= P*ȧ~\7)t]u|Lƒί# dBF ^6UB)NLgG l!0v.ZĶ=h\AjukM`v}R>>Zxi3Vҁ4F>zok^֞P:=,m뢋^[~syuK^F;5ޥ`jJendstream -endobj -1636 0 obj<>/XObject<>>>>>endobj -1637 0 obj<>stream +1622 0 obj<>/XObject<<>>>>>>endobj +1623 0 obj<>stream +xSMo0 W=؉kv[aj`^YR&5GIv=taY)齧_Q + =)KX (.hJ: Mt[Eui +UC[򲀪JOLƂ2ƆV:/(23ʝl1@h:I`hhl%G$ZہrP=^-}U^ީZw ÉfpŴv<[ne G3"kNmHqs*NQ3ځ#ڱ +5xB(sḘ̏{]Ľ"gB;2vp":dEyI +XE?%6>endstream +endobj +1624 0 obj<>/XObject<<>>>>>>endobj +1625 0 obj<>stream +xWnF}WL"h/Em4iAȕ6ew="\7a"wvf9sGKZgI9^P-2|\,ή._#is- Zm`rqyEp|']%:' -~2]-g\y~r N>f->EU j厶WnpJ,GjeFJR#[Gt.nZYiaAip\TʻcAJr;.t%e8iL6ko KSf_~qFH5 'v+tx'w3UqJe>Q$7 M'@V6HL_n= #*( V=keṱTk#2j[9Kf%$;mL/` +lBV5d 8ZJUG$=Ji Od;;d|jB +9Kx6$vbїJB-kpb{1Jn T*'-, Ō>j}C04k#6vJ<#HtF=Znk_+֪VB]%kov +hU~P@X{֢Z;`etQ(*5Ni%ꯑ0iaǙOT[Ic$6(ɽ!bJZF e{HWv­F>E.-byvY/7Td5((a=V齹 EEGx22w&O/j+2r#A4f"hDžYvaPOjFnKqO +u70P/6e UM,Or{1)>(oS(tT[o{oNNnSWHW4gTKvS[l~^NHQzY +* l0!m/8[K:L/[([0):2kv+tH4FlGiZ?vpy˻3?? 38}t}ȯS03$Ǡ^f ~ɸ/5P} nNgߢi4\)uI7n1kpq.4/蠪~qRӐ>/XObject<>>>>>endobj +1627 0 obj<>stream +xWn7}W UxuCn4@o\jXsIZVg]iJl"gΜ93P?i44Ug]x6/+d{ìӻyK><^Ӭ~c%~\u>ZP)o:*Nͫ ׳;}aKzK0b ++,\e of߃i}9' [Q SwLAw8&=]ПF= KOw]|G[S6Rk $'ZR&C *(~JY`7]-b%?ڢҒka#l)XZ; +I`Kᤷˏ=ZM^GK7[T9ˌS!sy *(V0NZx8AuS2nOO3&M]0.rCD-> +SK'ðaǛ9GLV ++ fjo%&,ЋV&#^قT)sp4)-ȍGQpnS)~նqTbwK@NZ:: m!ؽ ,tjq4r#F!Z<6ԑVf+G'~Jo2 +Y߹/ԛ+Ccϯ dBF ^X&UB)N3LgG l!0.ZĶĭ=h\Ajyou`}B>>xn3ҁ4lF>zok^֜P:=l뢋^[8+^F;p0ϳ?jJendstream +endobj +1628 0 obj<>/XObject<>>>>>endobj +1629 0 obj<>stream xXo6~_q04jr8{Cڮ@hQ@GVUR~ߑ,;qa0y@S,RZ⒲dN!M(ɂK_C^Φog rܽƒY2hSf+׉3\ Gg]'W_f4IgнT}oR4*#Ҭx۪u#\< ض"Z/iB2^}][زH뜲Cͭu96]PLU(7eiސUSfkjXQUM)2OLh@ŋ>g}fSedBgA`۹VUpq0VX ht~hlu=tB퓮n隣Vw98ra!p^OE{7Cp2SB!7:ƙ7 RufwM#V0^ԑKhUhgאRGii2QN5ml+/NF&92ePDVLR5 ZS0EB3+P,8XؒdzcaE}jw}2o;f̓.Sл2QZQfFAkT{༌E cp22-܈}Na_Pj]]$g.܍: Mg{}{i.iz + CsB<Jض9&!sBu,^j2`|;w‹$k^w$O|16(?f&3wbH>ܵ:}H <a[e<{m*,3]w~aC=ݲ3&EdIVg]),oR+QƷZ;('߿7pr0-zTY|EVw _#(Wb}>QU:>^,#H>Q^z%_pr<]RT LnJHtHCxynqȑȧ>Ƨ!A0t{SB;.P-$Jt !32@'jI[-:W@c1@/<+DA\?y U }V[~"pq_y]§2C(en6&"^36U] R1,?kc@x]̯g#31u=k P㫱Vwmei3[RbUݿq@tH'לYoAX`x #'BkDD#ֺĴv#m~nb_̿L:RC(>,@87ak 4"v/"! ndc():OYHd >ХcJukx },>ndM=‰C5,d@%]wG!Bs%:Q~:J|!i6m/@ gc~26,Jwq1s_"" -5 6xszLfW4Y{B`EjD\rӁaĖ;W 5JEG%(X^ogyendstream +5 6xszLfW4Y{B`EjD\rӁaĖ;W 5JEG%(\ogyendstream endobj -1638 0 obj<>/XObject<<>>>>/Annots 915 0 R>>endobj -1639 0 obj<>stream +1630 0 obj<>/XObject<<>>>>/Annots 917 0 R>>endobj +1631 0 obj<>stream xUMo6W̭+Pd{KSlk{ P$D$F0,"͛7ߓ[zIj2lQLf%Nѱ_Q0y"YargE $d8h9Fpdm|x-LѦ p\jrVfc.ׯgcqUV[ZpIrFcNlՈNMP9P(tA[ssa B-y pκ,Q.?B{<8(UM NH]Ը 0WiG޾>ňeu&'sI8$)yJ)g_o7Yt̹R಴疱R.™)ÛÊ Ul1nrwl]N9RrJ/iDSu@i|{!>3^;{r\.ú.:ycsR-oT ءMk$)_$>X&g6𒬟t欷@,h=j22WEg w{0׆( ۭȳa P++D>uIghX⮢V9S -Ĭ(n&xedL\4I˽UmN[RYB58h0??..h@sKK7um]:RѸf3) _ 0}m)RA=8ْ΅Bӵ{g ۔4p0l#FByԠk|ykW.WGnÒrBXQX0+7xmk`c d,J_zBOD]:ry|+EMfV&s:@֮=Dk[!lޔ~lDkm8}| ܈IqW#(=@z2GFÙyucWݦ@?7HpIoVkc{z'gG5ul=Sklp@X/endstream -endobj -1640 0 obj<>/XObject<>>>/Annots 922 0 R>>endobj -1641 0 obj<>stream -xWMSHW5UXrn]vة9Dd/z4ccFc/!~"t: !l?>G·`D%$8u -%AwG r.PZR{h k6.' - >^x蝦6L+8,8Yf3•Ft_QMJ}6wNq8 -jjit=(rG12ѷAUݨfIR".B -#Oh*ʅ ӹ4D%EUʇVt)*eJC\U#3v?AİZ >_ҼXnSD)3Zsrtkh-kL Ť'nDu+m({>SQ&pj@fHWdbDAy[YD'kZn UEI oٕr]@ --2Fzf5)Wz<$, vZ(g]2Y*)W+`$HfqW+ |EM;EȲs! 庸2?&dŇKk3i)Sy9F˦Y Cb:AlP.yƼ!92GQ2,g% CF;sH>U[fޟl TJNבt;}wڦ-sY -J R] h -y#x~݋!x|s2nz,(7\[C^|icoc5z7 ?RU[th4ZFrmuA3шTX, -I\.b< FOh-% -YRVdt` TWy˚Dbۆ6K2*C+t,KhT~qUUHNg]N(F,صiWKm`5ymg;Q 肣0=r5WYGza5\KH&zbK&@7֟07|w4e*xw#̘zRIi- &{v^=|yD&= Zsq;A3l`i+ -m!٠1';v6hmIĽ|Xo3 -]mŖ{ 0}r`ZPhJ*'o}$*[PBI]T)s>+.Tp:2L0ۃIJ@89Gvt'Z2G3c%=|&<_v}}Ċ`b>',V4zߒʌlrC/XY1q= Eyߢ|q݁8vSV%{:Q->ZqLendstream -endobj -1642 0 obj<>/XObject<>>>/Annots 933 0 R>>endobj -1643 0 obj<>stream +Ĭ(n&xedL\4I˽UmN[RYB58h0??..h@sKK7um]:RѸf3) _ 0}m)RA=8ْ΅Bӵ{g ۔4p0l#FByԠk|ykW.WGnÒrBXQX0+7xmk`c d,J_zBOD]:ry|+EMfV&s:@֮=Dk[!lޔ~lDkm8}| ܈IqW#(=@z2GFÙyucWݦ@?7HpIoVkc{z'gG5ul=Sklp@H6ɿendstream +endobj +1632 0 obj<>/XObject<>>>/Annots 924 0 R>>endobj +1633 0 obj<>stream +xWRH}WUkd K !SyXa,$h${ӣc\XӭND}D4|HI}\}|3]' +}iډC\σ'A]ءx2|g&xl9UE#Xq?Q087ѐihm4{Y'>24KmFtbUˊA@*kU>ҴYtUξgQl|Q@7e]Ij耢GGGUlt%Kr)<(LZUzc~F+Z!() bBL}zk%npE +d`N>|NLiVr~I˵ҍ 213. O܊NP|&"M.C̐HSh\[kbf-7ctp*IyÆȞJD )lB= +V\SrrN, v+gYRY2)׉+eo)<}W> +@2pz-CT)ue~JȊ gs2Rrn%3<uz SF7U"ϣ JYm/y5cxsde'oY$Kw:yduF˦]/̼;?=#Y'A 穔#nM8:%ϳ0i*Y$- + P%.G<~7c_eا#2I1tY"rU$CmnP7&s(ko[ Xjd# V&oѨn[j^GKp XX|Ӌ}+x^ P7[Jl ,,@4.5B75m?dU +) VX\(1Ь5)S*8wfQ wݔx JrDZ `,e"V7s*~yyۗW+Ij~tٞvXkl8\}lY>!'RJᮆK҄$Ep9}hNy+6Tvp:RL0;IJ@89Gt'Z2C1f>/XObject<>>>/Annots 935 0 R>>endobj +1635 0 obj<>stream xWkoF_q[D(PDZ6bhzc afH+{̐bT%X%H4׹>74xFQ O &C<&`{cNe-`N,X@n8ҝX{l̺3n#xp]ؗ!

    X>$-LD@nVɉ]Q/`N:| VտXbp"ZtA~\[_T"ӂvZe0\Lغ94DRW4gRҼ(2@*Hu/Џwۿ:Lɀ6zHd#x!; gAuH},&U ̯)B6Xj nJ̹ )3@]1{ ~P" IdkL%sBԘT6s| |pGEG{ek\988 hB}Kǖg:Q$?#|u`  o^ai5LMb .KKɶ>0\֢BGLȌ_~DiciP)5h˘[Y F< h-]kHP)v4%#oC9ڙӖ Oue.xpO[`Y"G@/),b ThpŸ5^8`0F0gWa'j1!Ɔ53̘3V 9쵴!xֆC epɿDi Uy4Ci4\ֲ2تpD=3 \QbIE\AFȸ\L6ݨ jx:nA&]!2 C0I_V͉UTsR3S;[Yv"D20< в阂%hG7djUX A!P/Av*j{ JS\lh[yTjk#Chy8[Q^rcm1[?ؑkK|';m?̉_c'p |3I[^fY@йsxh=TΞ ikรe+Q\a|z"IE4LvJtbrq^alێ[! `AEo25:m1^ch[S/e/ kߖ>5Iiά>(;!~_\B}uIt\|Ct<׭tG:+W~ntC$ oJV7GKǚnbLln6<|G}Kw5d,#fxbW7״_^QͽNng \?IDɛp@ -[4b.g b̚/7Mendstream +[4b.g b̚v{'Dendstream endobj -1644 0 obj<>/XObject<<>>>>/Annots 936 0 R>>endobj -1645 0 obj<>stream +1636 0 obj<>/XObject<<>>>>/Annots 938 0 R>>endobj +1637 0 obj<>stream xW]oF|ׯX-ɲ$;n(>ȓt1SxwvHSSA`1;;4ل3kl:i2>x8f*y}) `Mi<~ M+vCItq|j9}7+`Hyt>"{sE *-UQLzGIaV4WRƺlɮE'46wUiBeQ_/tG4[l48U^R4sg'z;T g"NamY͞N!4qI~4?,`LK(0G%NUשqeRul/͢. q`4mĕ&MikĹ+j`]LL 0qlx:תПOEIʍB5ۨ6񋜖Ҿ*Bt{JJUO/%(̙ckbm18B_ţ*GÇ3NQv#C*guͲ-|S{W`w'vvAhp:z85h>nuN[F*bfYk.:7{ ]PƮ$,`GLm`S=9rG3uCv<]E]xH!⸍N3drhJIء1B\̎L񆙆2raŕ% Y.h9a5 T..D~ !ՙZr+iɏ}66 +S R @@ -3439,10 +3339,10 @@ j OYDGzִ| %r(S;#`#:h5)&ݓ'Z'GR9f.KZ֪PG"VuUTf[T,7Zbg61}箊7G)@>.|'G-WKYĎmE<mA;ف e W "rp/_Z߅F^~XfdAbX(SѕF28f6/Tre[5cSbQX6Fy ^" -=-#,+g#&O|gIY32[dÇ+״\5#1Ԅ l_Q!]5 \KXnOwo”x~u潱AKN;B\5ѪaU+tfDoYQyx~(dU~ &(Bfu3F4RkS7a*v"9zv.t0rZJmO|bh2F9oF˛K~a 1KW?tMm*;0o:endstream +=-#,+g#&O|gIY32[dÇ+״\5#1Ԅ l_Q!]5 \KXnOwo”x~u潱AKN;B\5ѪaU+tfDoYQyx~(dU~ &(Bfu3F4RkS7a*v"9zv.t0rZJmO|bh2F9oF˛K~a 1KW?tMm*;2o:endstream endobj -1646 0 obj<>/XObject<<>>>>/Annots 947 0 R>>endobj -1647 0 obj<>stream +1638 0 obj<>/XObject<<>>>>/Annots 949 0 R>>endobj +1639 0 obj<>stream xXmOHί;5 zG{C^!p&K Ԃ@lvwg^" @@ -3450,81 +3350,84 @@ z it`EJ E}+\7&F $<+!sYJʴ^Ij$L˒ncI Y6TdQDVT)eJ"bIR.s%R sh^0|}}N맬]MS_}b-Zr0ZVx0L7/PtS*%[lɀVEZѠ=`Y*DCu$yU˦+QE!1Jdk/ UF{u, WR7"qh ,T5(`֐S+@R'[H.ԭj~2оDYz0YYjv18ɫه2LYf ®7ϭd<ߏn۩K6˅ jO\'4{{E5"dDt5q!F\ Iv=ar?җY\Yx?a~td'r>_V]éIUMʓ={N?]3zsyMӷ>]<)Si}2s..|'%~ie2g['}4?^DjX.ڠAMσ -@t{(:i5B$Mw0KmTo+e!VysXYJ\(ךf%bV`Z7Ac%>ka `Ki*k`ϵB)E0etMUg]-JSg1}V-ܬ @9\U 3`7*̅JpèYAi7]󜼗ɪAu/鲒eky(M$-fբAe^AeN|R%O8N7q;_ǻ`9n<ܰ"!pW w`0yF3fu֍15o)?PPL07˖kpo"=K=mZֽځ =9&x)VǮ;لW HUZT+Oi8"A7h=lS}(LDbDvc\F#0|w-#/Pbvc*/[2M)D-Uc"ߎk(Le&]!{#C-+QsXҭLs繪!;CEJ^vZ2C8k P&\ d]wǦЩ,3}uh ْЅ20Y?WTe}K5Zi 5adlw`%C0<*.e>8~Me.agSVAfZ4H\<!a]HY:dg/4+?FY.}G kW凈0OB$ʴu1hK^]d1ŇQЂܴh<_a&h :deƳ aK;e|۶gp0WGKka `Ki*k`ϵB)E0etMUg]-JSg1}V-ܬ @9\U 3`7*̅JpèYAi7]󜼗ɪAu/鲒eky(M$-fբAe^AeN|R%O8N7q;_ǻ`9n<ܰ"!pW w`0yF3fu֍15o)?PPL07˖kpo"=K=mZֽځ =9&x)VǮ;لW HUZT+Oi8"A7h=lS}(LDbDvc\F#0|w-#/Pbvc*/[2M)D-Uc"ߎk(Le&]!{#C-+QsXҭLs繪!;CEJ^vZ2C8k P&\ d]wǦЩ,3}uh ْЅ20Y?WTe}K5Zi 5adlw`%C0<*.e>8~Me.agSVAfZ4H\<!a]HY:dg/4+?FY.}G kW凈0OB$ʴu1hK^]d1ŇQЂܴh<_a&h :deƳ aK;e|۶gp0W1K>/XObject<<>>>>>>endobj -1649 0 obj<>stream +1640 0 obj<>/XObject<<>>>>>>endobj +1641 0 obj<>stream xVkO8_q#V&MHe Z`i5~7vg;c;{$c-6>{BOcHVp:)q Άe<@L}}fY˔Ad´#a#7+ztEC/@AzQ:$p2@@ sa&z-wK T&$¾?u@gEuЌAH2w {&]皜݁TpEq 1@C.PgG].EU ̱r*J]pqpŪLq$#03_3bO*6e+@]\_YLXɓy|:Ba[s'^Ssyyc&_dz6QSlim2v9X՜?%0݃9Ok`{y0fZB ut ㅇூj: t.e`6/z񘷀fa?~N[@|ZM%q]ϕ8|L 0H~ ,/P{DGFձYf(WS3Ia5,\{ Yj0wy=|]JNv^p +6S6N|l'R{g, noBL޲w$-p/ @25(@ƈNA@xnkKv}%8;e.jpc ¢ nZ=< r*"+}Uv0QIhp;H97ܬ;!S>kTH4}cG83;/qxح8#{?.q/N ̳BBJbN[X4,JPD!]{BGRH ׇ>+R RWmV׉ 2sOFn\qW?hò(( lsW)(ylvA Hv%e(mtuAʶYq2mzJ[$Lm[ɔp&,am٬ 3Vב֚ -TV'WeA$$%"1-"<Ui%1exf~y<_YbD&MS6ڡ7S'C279[Lendstream -endobj -1650 0 obj<>/XObject<<>>>>/Annots 952 0 R>>endobj -1651 0 obj<>stream -xWMs6WQF%w=m7a&=%L3i `}>&lIY9'c>Z4Xѯmџ*@g~ݫ8V[Ti5,@șH(۝1iIWժr ߈/'̈&JHm[%G:6>8x=,@O Na(8sE,;K83`w1+hM|"dO i ` zy(nHojk?g|t?_endstream -endobj -1652 0 obj<>/XObject<<>>>>>>endobj -1653 0 obj<>stream -xWko6_qO)ˏS`ҴY5kzhPBRVa}Rbs4!MFtvNi~4Hx7I4N~V= -aq>śpz0Yzрz,g aBd4J"=$Q֔V /*eC~ؗ)v##t5簙U<ƹJ:]fٝUCp1?wW?4GQp7D+!Hdȸؕ(RH2Yh;Ej*kYK<@cT -Go! Z"H%BZʢM,qa,@¦kJе$'pJTo3REAoő3:,q Yts?ivLp-ӑ~@rm~tx܄'coZ;X^ Vb#i%*mDWh*ZZiݩ(*Sz0|Q9\k̚Jtb 5Đ_jUxdrQb5 ,.(׵"g kl<^}+Q|4Wi` -ZB #rOx,d X'v#RŖV_Oə@Z&b`I c -C<pXv [{bkpSH<ōAYY w&欹8άW_ U(I>IT*^Ob 9\㥠RV|Z@N4;N_JFYw4CzmN;9: pL 4Oo] /crrnOJ!>ƢYa:#i}^B3y +߱65sk6 jxiN0Е؂0Xv詒X4q\6Z ,=dgeC*}]f}ǷLDlWªM^MT(y`DXkTЦXo)PSoJT$MX>"ϴ1gEJ_޾[#}0i_mز&!rr@Ǔq29B|:fߏ*|!endstream -endobj -1654 0 obj<>/XObject<<>>>>>>endobj -1655 0 obj<>stream -xWmOFί){# %QS --WUaml]s9U}f6mr/ط;33뻝1|BCJQ4hMhv4#iv307XB)ahDdZH[]Ld0UFN&\jq3EA&h-WڡаfrWxUgY͈Qt-Ww,#;F7iS 8/FA-.bٰ?}Y<έVĮF <6>~[1ڃժ9/ڲװ D&l4J -AKQ"Fn8M芥A">+ كVCB%ewCKrB2GKCst7˥%.]"Nk I@>%̤prWE,.HaՊct>t7^VZ;ͥ$Ow mw!ʯPsDl2cdk2Ue4 hdٸgYE^ձy_{}Ѓ1!X zC8 -uYad s +TV'WeA$$%"1-"<Ui%1exf~y<_YbD&MS6ڡ7S'C27' sl Lendstream +endobj +1642 0 obj<>/XObject<<>>>>/Annots 954 0 R>>endobj +1643 0 obj<>stream +xWr8+(F{ˉk&Le@$$!!(_=@S]T6 `== gB)q4ƓOo"ZbTPO)chJ0v3.\V +G +j$CYSaG"o9/A`r*u K~[YKFhƇkLK_*ۗ]qݥp72E +d(Ew7`y$OeV"ϝ\q8pY[Pů߽C>@ +sb +%clFo?~M>F(8Wa<(Ë!䩔65Ӷ7,@șH(۝1iIײV ?/#̈%&JHmŏG:4>8x3k,@>/XObject<<>>>>>>endobj +1645 0 obj<>stream +xWn7}W bْčѸqk)ڥ$J{ϐV\rng:C:=4>ލ &c⿕|vz}}>ta9͎ "[Vɯ$JxIU(SV-þLl ̜ki"Mo?ͬ -~7Uґ(2*wj<$}w7$R_ - Aj%CƵ=·G4Įt!BY\ܑ,RSh4Fp&^0{|@B䀼$QKh$#x8p:RQ [Guy2(p nV7FXKdEӽ.Qf(dn |gCp;vyIw(iv,1/z +hlG7F͞~>U*}$m#ܴ㎠ +n̑R9=F1/}0ͮ*k+Sxk*BA٧b)ǣS +R.BoQCr?Cq[C+Q>ADژ V! +J m{B" +#an+` V DB)BLj8r9̸m*K\G%:%(Xpen1$ZUg-WX 1F@3D9@۵loPg krq(hjū$G`!BׅōE'IT*^Ob 9\㥠RF|Z@GV4;J;_JFY4E v suR@h4޺<_6Y;oV*]Jgi+I z %|;hwX1ID?̅q>l:BWb :b@O`SJVcupq]|Ch3?9X O" t2] +"7ya6&Ba#Z#6zKzzS:i|&0/?+U%5I+mÖƠ;>364*{!endstream +endobj +1646 0 obj<>/XObject<<>>>>>>endobj +1647 0 obj<>stream +xWmOFί){ GhA""QS +-WUaml]s9U}f6mr/ط;33뻝1|BJQ4hMhv8#in30XB)ahDdZH[]Ld0UFN&\jq3EˣA&h-WڡӰfrWxUgY͈Qt-Ww,#;F7iS 8/FA-.bٰ?}Y<έVĮF <6>~[1ڃժ9/ڲװ D&l4J +AKQ"Fn8M芥A">+ كVCB%ewCKrB2GKCst7˥%.]"Nk I@>%̤prWE,.HaՊct>t7^VZ;ɥ$Ow mw!ʯPsDl2cdk2Ue4 hdٸgYE^ձy_{}Ѓ1!X zC8 -uYad s E|$ -h*P K+a#`:7T&qZqwj_~<3s>x .֔e -rjbt'Ce3ʶQU[;`m|{AfAYb_f6hYd! &K08]Q -Zo@ݞqg2Oml/h-Cw5I_O5Ov[4tVy`=tp@B'Xɧ/[>lEG{¦Ή rL/'49=Kzю  -wZ&B']rA04%*W햙-eC3" ֻ:4w"geM=I)SM3բ4T ;q+PC?3m0_z""MKHR NtQ'Ϩ~8So.*O..g.o|M`J\>q4 Ùc: |¿pq +h*P K+a#`:7T&ɸ^;5 +?9wOH<kʲ\mka5 1d:ē!`VٲDeĨT6>  , 3Z?4 ㊈蔬H2 Ɛ@v`PS7nO83'ot6Nm l$/|ΧUښ'dRTt2dUOx0S~:8lǓ`xRVSmOW"Uȣhk=aSDwy9|CYhIȅiY;-PuwѮY9 RSMZ +Hv̖u]z޳lvD&$Ӕ&jQSi8Oáng=xt%Z$':~(Nu* aoqQO9:q8™.*/O/.o|M`J_>q4 Ù#: |¿pq -| -`s7?>[foxi꿛?e"sbޖzn ) |ΟZZ>);Y5'ݣb|G)ZGߞѹ7|{߆{r - #~2ϢDX/;UT#7endstream +`<3>o㡽zـ|n~|'8r7_-Vosg"D½-}I)AнS +?*2}NSvjN#2S<4?;soTw߆{r + #~2Ϣ!Db痝US#7endstream endobj -1656 0 obj<>/XObject<<>>>>>>endobj -1657 0 obj<>stream -xWkoF_ 6*y&yiEE~|gHaM$۝]=ictNIq6G49Wiex(><h4&^آeMU~`<)Z +1648 0 obj<>/XObject<<>>>>>>endobj +1649 0 obj<>stream +xWkoF_ 6*y&yiEE~|gHaM$۝]=icZLh:8#OfW \O4e2z(><h4&^آeMU~`<)Z sRSɖxlD9.lC*ɮvOZq\UdjjKPEnI ⟸rf&zK^kv;훼F>Ncc|aO2Q9ulMmV\Z1HҶu*dnIC]'C*mZ;-=;c޼,`:qg,'.Z~  00zpuJqk F4䡃GkG*4CStbץG̎/XSoP v!::mƹuu%ϋB^X 'co̺B2g Vh:.=yn\o99dک$~_zd 8E`Mm2+VGL£YL_t]smM/ rs{RjGFNqS:= pyq} G$ނ~y>~s |QINZSYnE½2L.wΡRD 8CÀf" ATk9}XӒK9P7i*^7gLm| A-s,6 mRA|@.J`3-ɵs"34%vX Y1~5lgg -<Tߏ\d~!jd2y(ah~c>/XObject<<>>>>>>endobj -1659 0 obj<>stream +1650 0 obj<>/XObject<<>>>>>>endobj +1651 0 obj<>stream xW]OJ}WL!R^ TЕ6ofwMĵ~H;gΜ:Q`(/UA4"OFKȴp7POsUavr#lm2#iLUVJ$Frxv Lp!^@hCPMҌ;~:('-ѫe ۼ;&'y5qSMjS@Gr+M%;:X053O 衩ADUg*^d[0!Q%TL^! RCZe8fQGd-\߃F/2_Fohρdr#OmW@?cIu7-*ӎqւ ZAԽL)T]0=**U}`>dhF#:pAM0W*ѽA(^n1ŲQԡE'b0O}Aw{>Baw;#G_ʗ۲k( ;jż;$I80!F%._dqY+sI muǡQrL T2A #^CpƵ)mUFf̥h|OHU44X9U#?A)RCBp['~5g\t?wt*|w-Ҥw P[q Yy,{beϿ!IJk/ dZ]]p4WBxMߠyl'!z(G i5=`sL t{ΖhK)/\p&G)n`P6Mk>/XObject<<>>>>>>endobj -1661 0 obj<>stream -xTn@|W*UIM0~tFC}<`m喤;wrV%ݏYD!>LhfaRt :X yp&/%N5E1e['I08 V}UOtk] -]w=Ebپ:ܐ앸7U]TrI@\ɞ;,lkL] -{th`EuBfd4M>R7VqXB۪ 2 >;UBvitrB|4(獵F }! -N٦(ƷC,\/#L:mG ܺ<+|6£5E(Aa]*u{1'={ -4Joȴ;PI뚬еq#* -{.Vvp^K ݹ& -#Ў[rv=\`]`I -c>0J#0G .tId:~wOWLz] kh U~^1 -wP짩C;~@endstream -endobj -1662 0 obj<>/XObject<<>>>>>>endobj -1663 0 obj<>stream +@ښ}S,/rq_8>/XObject<<>>>>>>endobj +1653 0 obj<>stream +xTn@|W*UIM?:J#UЇ>am喤;wrV%ݏYD!> Z&T40)VALqi;8H^*\˅xy |fEQLI%; )/Σ84nZp.h?_}+K*3 +[.i3W x%SWzGvm/+5]26XQ:!ͣepG{H +߸E^OmUwS٪i!4@Fmk:9!>wSҌ>k'l݋q]tۡk.\Wgd F{̗Tn]p@>|NȚy"H.:˽@i7dZ$vuM֏ 8At+;8VY/%ۄ\tNOhG1%#k<8$Jo/2L/:r+W-FO|+*V5l~-[/Nm#I"A}&g 58leJp9eKZ$[Zc"=#oX G3?lyy)$OWC>2 @endstream +endobj +1654 0 obj<>/XObject<<>>>>>>endobj +1655 0 obj<>stream xWMoFWLuh,ّ-5IXiuKr)mJrݥ%e-(|yfdJ3Ō.U'9]^\$K\.{NSqj}2~AsZ2_,iIvzM'VmƺtY L2)nLycxlz鵭*[|>v=VScT6PTzO& LJei<)U\-3B{@Q.t%yU紵;/oK뵮6J-` J7%?,v=?(\S !>:;O C;4Z9`΄y*ˍu'4iS?Mw'g2Dt) d8 dF]:'h@(ة,[lD>7(cLJzMj4x 9gznV+ܴfDP7B#2t9D9*Z٠=Pw:nԒ3Dr|A2@6&k#OP#ʒ+03Wp̓Fw0%Ժ /Ͱe޾\+ ,fF'yf"ŸвSn^;G[scaMzS}2SJ@L!q %O}"32mK @@ -3535,10 +3438,10 @@ F }}@@@0*y)@Fg0\C3$=ϣ/d/1@JS7jtlt&RG}Zc^Jlj2 17AJ: P5eX&u Rrw_p0 =)Fʛ\oefwց8 > m5[Ďjy薱uk66XlFuvSr#󚸧*]Zk6"EڜFb0s -*X;\~UF?b|gǏG QY\x!~?5p<V?A`y˯ڱ}i5>y{u>!`3x#ReǍyw0q9`LuwM#ވw=ܓO"+$$zy7TxLehlo'ºFendstream +*X;\~UF?b|gǏG QY\x!~?5p<V?A`y˯ڱ}i5>y{u>!`3x#ReǍyw0q9`LuwM#ވw=ܓO"+$$zy7TxLehs6䷓h=endstream endobj -1664 0 obj<>/XObject<>>>>>endobj -1665 0 obj<>stream +1656 0 obj<>/XObject<>>>>>endobj +1657 0 obj<>stream xXr8|W̲*uˤDJdV98x{ LBb `ҊdU$ 0=4фwJI~/i2(~5ǫ˲09e,G=nq4Sb')- &ZBZJ8'kIKUJ#" Qe47MU.je4݋A"yveI6L)Φl?/_,TGIn#6c$~hSӉKcsyB(N]xHq:8DٺhF۹Zn|8$cVԲ`W,2gHn~=}=$BqkTj["EU-qț¾LO%ҙ[U:Pʧ6cNJ{"ɔ.[@^l;.P̖=*^JcU{x^]N ku5y!MhwٰC@]ѐyS>et: }͒yhd- Yqkۄ\m߬$w۵g%Vh\"?Y˴OU)ryOijȒ*K b|(ph(s44@{+#8 N`>կWI {6F?Mh*^ =PS߆"eK׹itr~_렲mkazRdEo~x7џ!pFŵZڞ}>|qPEljJaQXYƦYZ.Q\TR?{PgiE;5O̸GtتOsn @@ -3547,61 +3450,61 @@ x 7xhtsakYhL6ɸy%0c_\%U ^η>У b--xp!w+c0p/ !_SP*w~hDMLiF^K/:Bzjx*Z"&,wlwuwd،ޛ<(PtBOh>+Ń*`Sgy}_z{[tCLdwYЌ_\P'6( ^ -OҴzt{?7,+b{Z*L>_%;FD'נ Uı g(,tOM%ͭ{ o:Np6_"j-*YȜkmSUz Ot2 w!o~qg!endstream +OҴzt{?7,+b{Z*L>_%;FD'נ Uı g(,tOM%ͭ{ o:Np6_"j-*YȜkmSUz Ot2 wY_q_g!endstream endobj -1666 0 obj<>/XObject<<>>>>>>endobj -1667 0 obj<>stream +1658 0 obj<>/XObject<<>>>>>>endobj +1659 0 obj<>stream xWn7}W 9Ю.%@j؍[- ]xܐ\)=CUΥ j#"vΜ;ClBYu2H4O3_L5YIlL! `H|rApo0y֝RiIt{VBW0Jv^e=2:<9rMI犦,˜?%8=P2*,Q8l@/m@z4Nnj4"X|9<!Jv5c󇖿lCgp6hP[.'\(SY=е cl#CL|EKh4HD˫m\3 |$= 8& G軔 ښ6a%._trpȹĘn͖~S(d՚[I<~ŏjB =G\,x*^[2lBl#o3 ǭŒghjyݫ7U&2!N| R'A $C ;p eE,jaږfZe9Y͜BedIaAG,&E#jR%ۃleE aE|L5Y$*1W%1352Y( 飔uJBϔx!|GNLV{bړSSF%4뛕NgrdaN'p˖}y]Fe - FD IЅ#0k5ŐqD+agU-0,bvjl*TÊE'2Das&1cv͛p s;}Κ0m>g"nl׷W)>m&P0|tt {e](O!gߙ.h2'_pJ?a K2G$ݼO߹e+ɯ' -4Iendstream -endobj -1668 0 obj<>/XObject<<>>>>>>endobj -1669 0 obj<>stream -xV_o0S%Ֆ4h>4H-d/nb$lSs[@ eNd%gߝw怍&e+R;pd .~`[mw{ OQHBw>/XObject<<>>>>>>endobj -1671 0 obj<>stream -xW]s6}Wq^Hi`3ΰI7O[`ml˕IJJ4uf-KGW+]kC =q[kZ%M-jO@_Oٿc~NC ܗ#3SbOR )qOH}׾8I K)R4@&|7U/$hB*Ǿr/DD ,iD`Qx<)g>x_qnAߵ'ieaۃBjLxuaʚZ4R(,k~_BǓXP,&2ꐎ26zܪ=Uח$l@]uMw{|cf2gp`3aU-JaM1kOsWG^TP!R߇L1A~[0f4PM/ /6j`z3q [@P֫U3&^$Ѐl= Kh' _ʒ[-f^ǹ8Y2^$!BClkBƻ,hhBdBhv4q@9eXfv4*~Uy?T@$rf2B"., - j@RT7Id%Z -Qobx'%,2,. dk7b|eaFAdRf:1CV(Xx -S'nhR.J=tx`:HKB`} !x*H̥%!3to##ze6J\.(1M$x3'tm);;gO='" }4,hBQ~*TҁssYz?jx95eo|NȾ&ӻ[Uw5z.%ْ3diѓ>%}K:U4G=hշUkzj[gJ̳ݷ>J=V֤ʏ`v[ꛬXnd2wϭE?׎j?kAD,endstream -endobj -1672 0 obj<>/XObject<<>>>>>>endobj -1673 0 obj<>stream -xVs0~ر/tnP=郵1*'O B# Eh6: ɗoC :Noݸpn_|Јixdm~64Pu;,s:i'dDzUkj;pfZ CJOä`C3a\p/LiR|6ʇw/5y6cVqsS;Fn'5AG)B uZ)7a=,)$f>2Mi%)te?ikeN17j[ïcpzw40:.sn$@^=RPI,#{q ^JvAHHö m,sJgǜr>)R=tp Уi}pB$W^lIMd߆"x'[> /d>Ů:2tv=ID-ʯgnHR"ڏ -Fsb<ȯ6h6KY sMⱘt .8BTV n:2AH5f(i%71DT -TJZX$exyn<_(;fS幠K\É2}x^ \ynB*j"U$BAew{D뷱ɉT){p}1@epɼ͚Œid?I\saq;uX)ӎ0{endstream -endobj -1674 0 obj<>/XObject<<>>>>>>endobj -1675 0 obj<>stream -xW_S0їzNoVfJO Eᴄ 釿@RH N.dw? ׇ`ٹĝgF' 5]} )#o7#ːEq(ȯ\@>9е!W"6{{B ,hҽrTP'7S70HƲ)'JM[G6v&cteFk[ȱTt [L.G+‡gOpOaJK tR}cmpg۳*Xu )a/S8Lj۟Gzt\?h?~B+zO -~E8W@ڞ K ϫG'–g.+'W"? tjmu &<#eYC,;Bk}d ƟEQ!'gK%K4rntvk⚼VdѮHیY+]t23S{q4?'WZݩ"U)n.'/(60e թ ,ݔ* -fY+DEVi;PVE}LҔj~+Xeuj/9uKT]L;PNR"`*YtAAJu˔-k{4a?a 8y{iօ -W$X-Ä,&I.@o]TiPi5qRԤ6364>/XObject<<>>>>>>endobj -1677 0 obj<>stream -xW[s8~Wq6I -;@LlpċEX$'L~Iv~|:7g 5}-~߀qF hԏ<Zf7WHD<Ñ%g*$ 4=} 8CR -^XZ(8("fQh$ٵrN%bAdWV^-=pkP0p,5iXKxɃS!r04TP7_ `Kqp1[uIoX}ϭ 9 J¥ -P^@* $^T&(ȤdѺ҂XR]4G b"%Z5O║ƼW*7~y9@bb]I{RĆΧz0iqWe}=w jP[xJB]->FSsL_B[B]-.HM iUWg3o객".k_v :_/XȦST0[n+AQoz]LlovAxwx[v5 4Kj{9~/63}9tovi1W}_'&t"S -/^OR\1z~?uendstream -endobj -1678 0 obj<>/XObject<<>>>>/Annots 959 0 R>>endobj -1679 0 obj<>stream + FD IЅ#0k5ŐqD+agU-0,bvjl*TÊE'2Das&1cv͛p s;}Κ0m>g"nl׷W)>m&P0|tt {e](O!gߙ.h2'_pJ?a K2G$ݼO߹e+^ד +3Iendstream +endobj +1660 0 obj<>/XObject<<>>>>>>endobj +1661 0 obj<>stream +xVo08K-iRJ}i`ZȈ/nb$lS?~@ǜJξ;怍3h!jvڷ+.mٶ $2 k4< F! ݱr_tlq[9^D]H w ^+-BT*&P 2IŰLU!cV0r33 + JFi@R!_ !ϩJy\ ԸzQ`8ק'^ǽx"^` CZiVmH1]E^05f`f4f2(拻;TC; +.\9[`n<+o⻞}ᮂcCA'4>/XObject<<>>>>>>endobj +1663 0 obj<>stream +xW]s6}Wq^H4̤3,gp/Xr%lv{%CWSgزttuѹ?6 3蜃׾} eZ-p 1S{fewwo]7`'_ +ɸ'$.>K_ +YF$ pE )|J NrpPw^D4!c_ ""AV4"@|;)g>|qn`feaѥBjLxuaʚvZ4ۥ{QdYANb9BBrTȐ&c:*&Jq:bV]_># +ړeɷW"w9.fb>ɵ ˜;=OVP#+}7x^/=U 1^)I?xQCʛKe~3'hQ=ÄI@+C5=;:4HTR[)GGQQt·35@HoM򃢿 C9۬Vr'ΘxQxKr ( ,D,i}˃|.KnEd8x`Y 6- +I F_hri(̹SaZI= ]eD,%\X`cA"Հn"&K$ˍ"]ũX!84OJXerY\@~ŒJQL/vk)uMuc$JPQL\85d?]0zt<.̱"zO%CXUKKDCGFڤ l] +QcHjnO>QvgO='" 4,hBU~*Tҁչ(`\cA5<7Z'slߌ-ϪӻK}=ləEI¡v*wZ>۪}޳Z~a3%w% +W(kB0{-MVonu,pw2CaaQ;GvwUȭUAD,endstream +endobj +1664 0 obj<>/XObject<<>>>>>>endobj +1665 0 obj<>stream +xVs0~ر/tn@z郵1*'O B#g&Eh6: ɗotOոt?k+G ؽk8ܷkkwɸ5_i?uSvK o*@, +r͔2(%diFٜW*߽iqi9!GE4eE+|@A*R=ќ:*+Fx2k0Ě+>M>g"8=LeeP?\0QB*w׾%&PTrd c(ŋ-x{h|bMz!^r x(S{{I@$f84ҡ&RŝO"Hְ! +X^XC;*o.(^|DР>-P(|Lkk8$\azQ"iTvzX)ޙ0{endstream +endobj +1666 0 obj<>/XObject<<>>>>>>endobj +1667 0 obj<>stream +xW_S0їzN=gDZі+> 釿@RH N.dw? ׇ`ٹOk3RF#o7#ːEq ȯ\@>9е!W"6{{B ,hҽrTP'7S70HƲ)'JM[G76r&ctiFk[ȱTt [L.G+‡gOpOaJK tR}clpg۳*Xu )`/S8Lj۟Gzt\?h?~B+zG +~E8_W@ڞ K ϫ'–g.+'W"? tjmu &<#eYC,;{Bkd ƟӳyQ!'gK%K4rtvc⚼VdѮHیY+]tk23S{q4?'Zݩ"U)n.'/(60e թ ,ݔ* +fY+DE>Vi;PVE}LҔj~+Xeuj/9uKT]L;PNR"`*YtAAJu˔-k{4a?a 8ysaօ<Ka|$Doh緍q4Q(8)jDz™Ɲ4>/XObject<<>>>>>>endobj +1669 0 obj<>stream +xW[s8~Wq6$ lw34,3 aX\IN= t~|:7GM} +g,j_Z߄?E!4f ~P?~kMp[M{\=#Mܾ> G~3H' 'LIB*D** tLzB:0c.$̹6|ga\aw/)6Q?7v4/vu?nwzۊTS{T_W]06ƣ?#]]{.kd )W?oc^^כck1=ds)bCOSM_ {Va4a긫;5(l-<%WTddʮb`/[[$ +ynjTXm7uNXk/I`,XdSA)z׭a7_uЕcۨn[qi7]c \_w݉߻q-Q{vzWFRl]f [ީL_x4Pp̓L jn/zw恏Wk:Wa)s}OR\ik_Vuendstream +endobj +1670 0 obj<>/XObject<<>>>>/Annots 961 0 R>>endobj +1671 0 obj<>stream xWnF}W +I.EZhbRR0ȕĘ䲻K+*=|Q\ʰ-r93gΜY}Т&~Z4hSOQv k>u|oWKZΠtYY=چu2jUW)ͪ^3jxڭz=g cxA8n1͗?ėڤyxF?=8hjCxhaVb8Վ 2iInׁ4l/ɫ6X'7R{Wϟ7OXz79l2Ouѵ]ӛ.:-<&.8)::Bۭ?NRpà~ir-i^r&^ŘDtv:s.G)ZQ+?i$}C2ڳc?iA* sGf=7I$MeڥV6m0vuR$vM+{YJ[Z*M0R*-m!R%E"$7V)Nu#00NS1'5ToZ1-Ds:odz&L rD~v`PY8S=LoW9b#t5FZZ2vQf-}BxP&Jo@ 4r(Htzn8aB69b!-8ac4ЬaT&T,Ӈ5:>ȅt#ڢRi8^XV$f }BuhUr01!M;;;⡀,~UQиԮI7L8M7b vFQrS`SGX#H&yq-Pzfi, oXҢJ 2:T-Y؉v\[[f > !mާAJjwDTFɕ͵a&5'j9D6Bs܁+če9*4|5(;+&jGhQABEŜ]wV04'Ps-tiW9E\w_4Ecz˒. z_΀erk5?{\R`>0 f5FcCitOLRmU3ly{WwZ}h\]3`",QK+и/Uzip58TyMnNT:l-JJR NdE$yx=U]* \KdIJ{($9M&dG*?tjJ^T܃ /}ń4ɂg\. =;:bo|5y<@8BHz m~{ -Yh*wje[?#w³]a->޼t7_NqvTXUT"&[;o>u`V~?<jendstream +Yh*wje[?#w³]a->޼t7_NqvTXUT"&[;o>u`V} ;jendstream endobj -1680 0 obj<>/XObject<>>>/Annots 968 0 R>>endobj -1681 0 obj<>stream +1672 0 obj<>/XObject<>>>/Annots 970 0 R>>endobj +1673 0 obj<>stream xWnH+ :cn68 $e9 Klml)YI-#gA\W^~\$?وnVqO|&S|V*?Opg8Qw~P2 G}୛v&LNwob4 6tW{$olt{g1% -s8g|1-Ა5:Q IQc1.!oP6"TMACL[&JRD 23~? ɵN5ŽB[W>5Ty)#?Z;QDgL+(a`tDPfP7伜 KE>J$'cn1  ^|zGS7tÐ聾SF>kk~ mU xO1/ w׌lQXwS eI) vaj־t-X0ښ)n/gx:iEÅ4%f 7ן0帹\ă/6űWP!~S#/: (uH 7];%f(3 h,RA{Xvإ{Lz0D} ~ -L' MHXdw޿яu 3%x~C, I8-x;` !;Q\LsJ9~/;.,endstream -endobj -1682 0 obj<>/XObject<>>>/Annots 971 0 R>>endobj -1683 0 obj<>stream -xW]o}%r*Rd9@pr*4HnP@"W$..eS-Drw̙3ßg=G}QewG/Ӱ73 Fӷn׏_CeRr QK)iuiqֹPGl .4Iј3ХEƚTYe6%y5FRR,;NdڦXVLU% eܪXFrZ)XYإwI+OQ0hH+!56uE L7}NtަFCLkcIYȱكuFtJLXmߊT%nD2Y&$U҄i.zpI|KW#OCIaz]̯o'qq:Yav8Phn&~|OOl]DoGǡ>,.Z3s/y7U_W|&^4'' cyl4:,r||h{6p'%f(~|oo7ł_!T~ )ߏy -k+ȶSvCgs5~#f*L[Wd{:wOt:m2-e?P$)hRZ[RL%-邃e𬬸Ä=1"U3g D!d+F}ƬdDX@-v3!%7? 6^^$ -rx"K\XV TĐk9i9ɼ2{VAh=NRHk[@l a4cALR0A$ezǮOS]{v9r99IuAY}͓.+PK O|:RѺ@pq[q(|4 -_Vp~ɤM2߈<.潱jnK)qCynu~@%_"͆V*MAa'2r,wݮKY+͕l||\Q~MKn~j#mZuIIj؆*^kF[DQXt|xe'k,K]'jAv2D+YK1Gj&ێӒhM(*C/3yQ-F2U/M0(Z _ (1mU'rax ͤS,b*`>J Fi/zEYOJ%Or޲Lr2X'wn0wzSz#2-]+ř"8q.w%jء8o]顔i-Z2cFWBE)#x#8afB́5{u0Gd==M"xN V\WBsJ~SvK'`~o;wnLJWzF^ts57gLx;+%gO0o / [8ٷkendstream -endobj -1684 0 obj<>/XObject<<>>>>>>endobj -1685 0 obj<>stream +L' MHXdw޿яu 3%x~C, I8-x;` !;Q\LsJ-~/;.,endstream +endobj +1674 0 obj<>/XObject<>>>/Annots 973 0 R>>endobj +1675 0 obj<>stream +xW]o}ׯ%r*Rd9@pr*4HnP@"W$..eS-Drw̙3ß>ק)Z? ]я&4?#ՋzKk2`]RF*/pi8֭OVfH>-װ5<'Z&@qVkRg;B7s[IIvf:ib[r2UQZ$($rbc[2[iBƜ-Za9_&p<^8Fģ #I`['X:+ʥL`p*Od:KG@瀗0(_Zgª8N*M#2'%u&HpAMճK|`7=` }O +OWzqu3owŔBs=#x|dZ$z;?,d}tԞ\#mTx{0r0G0xˤ99\xX'c3ߥieC;Ň[(1Fx"xA ,\ +YPcH?PgA4 WppN[A[0_h>vVL¸*'c}wq7hk58l%Kǯ"ENVkײ U*(UnI,geŵ0&쉩`Kt1g +Y&X4}iלmKMF^oSl Yp-n}fSXUIy( G.{+˵%픠mJ I0(ʘCA+|NjeZTfϛ$/5*p̿vNS 28u,I&Ly8ᄘter*D8uP:AiLDtR07OVZs%i-__+W_`ǒۺJwVGaZů>v !2Q$QDM+RɩZ,+f+ EJCR_8х$Zr,о#^~2U/N 0(Z (1mU'rax ͤS,b*`>J Fi/zEYOJ%Or޲Lr2wX'wo.1w9zS#2-]+ř"8s.w-jأ8o]顔i-Zcex"Zl%Ч &#'&݋XM% +1iᓁjz蒇kpJ49iV7XqYrrT^Q +͡*MTOLV^x_mĿ߽^sEʋOWܤ0,0X=8%aO_oenZqPַֿ̓kendstream +endobj +1676 0 obj<>/XObject<<>>>>>>endobj +1677 0 obj<>stream xWmOFίKa A"RA[EEm%h޻`{:򡿽5!UC${vggݛ?:b|7dBNi8ǴHO~kMѫOWt-Si67嚮 V*[{Gz墄>?(U%-5-gkw7xrL~߮]:5[?Mߊ*fiTBxReɁrK*]6Ԫ'</wrM)6ZOmLI!SJ\S8B,l 2 pts~;ӳ~Θ\+S;s@$pɕ<NԖ=\m}.A!$bJmڤuPF[^j8vKrV.BtPn= rP5E71egf_)PpXb$,1 :eXAVmbPThU#xU{bepS7IJsj7C&UT|C9p*ksfUVfV a)S\km9B!?0iwk[S2gf`G9-c#Ѩmi6xMluWΡI64\#D-ē?sgⵕ7s t2`/1q)3:h 6MBOYrtgmF$wDžZʙL%\cq\wN]!!_74ƮƠctv ]]]D-~h`e2jk;Qi !TvTCPV̰.c, >ٶ:"?znc/-[UD_H:q/Fw?ڋha in*5#iS93+('c N{¤!EzN>@1ч} Jfdv:]̪"e:$5 P MɤG2 *vO ֖zJNI0ﻊ &:ľ%Ga KZBXjvTHsQDg 1TbɴjQtF} ,l6%"y|}`k2yEv7,O!|Sd[aV>qr &l7I͓o1\ #$y%:)jV5WSoO1O~Ke@¦M -m,Z$Ob?9INzk}h>#A :@oRAϒ_up^}Suendstream -endobj -1686 0 obj<>/XObject<<>>>>/Annots 974 0 R>>endobj -1687 0 obj<>stream -xW]o6}ϯf,Ɏ2keXq Pm1H⺿~R&6`h'Ls%?e;㜦s*4Id͏{,(;'sjh:͒|xWe-V4?9E (Vr$4ɏފ“YQ^\V'Zk%yC;*I+ca$+%qgO ϒ"اKx~1t,?|N4ϲYvrN4KӿPF^,MNY~5˳fY?|q>N.* s#ltYRk}[ZGX+h3vƍJ{aZ%%-fY(> Gw$*~U#cU4#S`,Ms4c4k 4 yΏxU D3:h)sə] /Et@ZĆG{sfRhX F "P:/*wuyB l3Xiluj":ĎՃw`=A7/wgIUqq~x+gf3Sbڧ7\N8IO4?`Mn5Pyza'he%>Nq+(_T|w@y9Llf6?IG9.l"o{sendstream -endobj -1688 0 obj<>/XObject<>>>>>endobj -1689 0 obj<>stream -xXko_1.I˯qR^dIh7IaߛM?PE3$f[X$"53̌ϣ>ӧ ǔy:O~:pqT/_66 ao t0bQG4_ K{c"-̋I; AOyz6|~};|w{IE-iO+I{?##K)u,`9ķIUup[[ӵKad0Eݏ 0UY'EAz +S)5my&at]^Sz]d$N2uUsPV,IeO+VH92Q ܨjeئQOKGR 38K8;Ԗ˻@ >Fs0I'۝#G&^[7 A ymT%̶r{;Z)dumr -o~Q,x+  2 6|IRXʤ/k(-e2^_Tn GSO -~Uh|zFW3S igǁUQ2P&xҕ.zM„D*', uV(ԄKo= NƔQKi9 5 lEaWY,̉NƷ~1򷩮>@^~Eږ[>؏mpb+UhW 9]v^*Ni9}X.s?mX`pyvzw%J0u|'Dсsۯ]9(û+OYpP`!"di&CЏw;K&5h)_; GX~b(aд>'3!d% -~q~ Xaho{:?{3yڛ i|>N ̮|bz^avW:=>QJ?sJUʠAkzX6s6 藣rH2endstream -endobj -1690 0 obj<>/XObject<<>>>>>>endobj -1691 0 obj<>stream -xXob*Jdvc5ΩKIwrײ͐+%DΏ7o hDgoDcL)-g4L%Jf~49F4_%33}h5mMzC斚~pZ/7w'*+Z\{ZUsGM0itmf -(+ckn HԨZg{81U-MMf?Vnˡ%gOp!LYSwTDHr&_c*V?y zd4_#WWXjR{X_#-f)LjI(Sz]+KRU8Fy@'I')YW -[U#{]{|+RG*ZkR VkUe'" ʤt*VR)-k#{+KiS͒)m7&>Pw!.klͰu+;|R0w!;_gC8]ҚX??d(6ɚdAVLQᅏ54I]uS鞔^RYi뀢P*Ԡ \PMWCuH1 -\UMñPU,Ϥ0x4RsAht,+jPo#8'/ JԬ\^C?S|"2rwk0֍5t s'C]KgunwdEF턈&l=ǙWRNS9M-?MY+AGP0{V0!(aTG8ṙ3 ~,)b^h ls,/=Zfie-0x:;_Iьrdds2&3'ZIb;* w:PwAק5Zg*Bޅzi6cǤ2PW +.ƃԵ^W06*`tRgQ=(aCZ굱` &:2 K` -U/$:VĨ\x (]ҁ+Ps&ah_"#<3&@;rpXQg  57X0[ț)fZ|wcm@SVV-B+f<Ѷ5s4V,wsTXbB+rgNtYڍ5XQ2)9 Cdi<~R6E4̡ ьwdn7";'x1>ǽ6x~YLt~1U#DfԢ F2?M/ 3$Bh8~X[g=JPJGd @r.aǹ8ml(O@p Hu# UۍGy3#mx jp+1^[IһҤ`U Mo*xí a# EbCE+>/9YJv_"@Л>>u&HwTSh-qUs1 j^K2Y|q7lơv{%>@90:-Ml>/XObject<>>>>>endobj -1693 0 obj<>stream +m,Z$Ob?9INzk}h>#A :@oRAΒل^}Iuendstream +endobj +1678 0 obj<>/XObject<<>>>>/Annots 976 0 R>>endobj +1679 0 obj<>stream +xW]o6}ϯf,Ɏehn˰vY֡%b#*IuΥ$'Mm$NbK~8(wFs*4IdՏbd͓954fI>`ÌkX.hY)-ß M򣷢dחW䤽VllhjIސaǻJFxX)IJl{Y?g xY|Aם4K<47j-EiϹ + +G?]6,XM k4 +;]jӇx`nh"943CiAG( mM/+㰙**c/ԚZk]׶~ƚuOaW#  +):khlD6"5+De!ԩvZ:;pNW駂S*tU0ҡC?GX.VL,P K#~i#1tBQ.@H`kk0dFiߕJ6>n@}⯤vnl6Ժ%a^UTuD4`Mˏ|̤Ѐ 8h%kE't^T*+ 6#/g$!^ն +E8%t= b@z2=8xk7-;{DFox6e Q PcPƞ~7})D T`{[rOc@8#^i#N7LQ@3S &O(Ch8ny`^a.1]Pi 'n +EaL74I%Z?LG4[]n!(-ΆiVyߞO&6)^87uB@kGfR]14GCClX)EaQ{NoF^.'K gKφp WO^<}6|:2;ˡQBK$ɇ] } c @s[þ-%ӟTLW{ Zy+Di oϽw+5ߖ4O.L/X0OX#%"tD%!y~u bBCƄf%VrL c4;+/|(jЗ^鷇=%S(ōuPB]e6u0: dAY9㌗xt:$=|:aKkC): + x +Vf'IBF)p#(rA wH8o쇉endstream +endobj +1680 0 obj<>/XObject<>>>>>endobj +1681 0 obj<>stream +xWkO#ί( C{Ů!Y% DD +3Nw=cfDHfzqꜪ?O4S: yѼe毺7gﳓ g_׷wTԒ&AYD32JZΒ[J +Q0oC|T[g5]Fv ^8? SuR߰1u\FgFU=\ݕ~AHfJIb!SW1iŒ]Աb#e͍Z;Z[mt.E./b;Cmk +$ wHq&d0_r2)+*,6-=FKYmԓ񼡟`x:DU0-^QhEAhBiq`v̦)TĤ XR>-Vn eQ+PhP̥ҿa@gHm)`)eIz(E2#)b@@~۶gPOp) +x.*  +E\pFD3l>K mhV%*E*0ek|TQ#DZ[2dS 됅'AoPOZJSCxW@rDv[X,6M|#6K/UWb V@]ҽd,q{]ga;d@t)l &`ӽA)i +%Jl2 2%!8HB&oD@(zY1e2l:t ~0tqo`-@l JM.TizW;Z )6-hVB5%zxJC~t=?+Hendstream +endobj +1682 0 obj<>/XObject<<>>>>>>endobj +1683 0 obj<>stream +xXob*ʖHvcΩKIwrײ͐+%DΏ7o hHoH'Gsr?GҴ:傆CrJpi:(sM[Sohۯwp;ϳb4R-_&`0Ѿ6Roш-sֺ>o~=PV']Ӫrş{?lYO~Km3cׄP@Y[lvC@¥F:Q,ɭjmljR46Zea,>mlkéC3뇴2eM߉S!՛ Κ|s>X5h|rxWTiq0{-4O9>F|NBu@SM]X2BA0:I:`n'gNɺ4`'Pت1+}J\! ȗZ=R:XLMo"^*C=VW&5TY<+Q./Ғ ?9I6<,\vcRJ8 {Rq KYgO:_gC8]ҚX??d(6ɚdAVLaᅏ54ROpQ7LArkr>AHz8EV.č׫&ϳ;&UוRhXa4M]E흞| caVN-NXv˹IuϋB6^k `#T&;APe!JBCle;Kʕq%8g2f%2>3ht#uFnh ;a^~ ˈ)JHY[,o֪w7ֶ ;j`{(1y.m&XN3Am[3WQJczx<}L%&"wvkऩ|Mo q;;\%i"CL)a]f#sFN >Q4uv|e)2 2_:% W2Q7hɈ3yJL_y"soq X2 \q'.DWX'{1W ,T$^6T obD;1p )>T$ 9 +`t%X5tGfE;fi[RlDmya*hg,*QWVovp9zfg7 b鐛Siu<&K<]`R;J7ΤQh89+& +2VTNFf#T PB_s-1cvcH~~• taUj?}\Ν8")|28|Xΐ +d@a n+UC+uc%傺.?;㴭IL?e 6&?svs UK6VZl7O\1ÕwlLzmE'JJ W34XK8z 28p, { D,hn>V9څ3A:C osrC謏aP&_9⋻a3+ʱlnb>Kp܍߆?X '1r_ƃ#KKj$dz~L^ c[?1endstream +endobj +1684 0 obj<>/XObject<>>>>>endobj +1685 0 obj<>stream xWkoF_` ,i6Pv\#.DeE'h2:򘻣ޑ&ER$3 oB)4Y?LSZ?~Lt`i~4?]FR6\FsLh)axL&nh'*GNS)\.)5œ4R(1QEIS[DTX>Pf"ѮPtMln0d4_Wm7\ \]DkcHd"=gy v1pLZUJĨM:pb`: tx G!GKpN$Ln Obz%ŸեqB6=zOo"*4{X1iexuH [}LVyx[1nE*`t%p\7&E`O|Clqm!i/ φV&{v ="}r&8]XHJT _+\ @@ -3674,52 +3582,52 @@ P m7fV}3^S^ gm1"{ :p ŋ̣ Yꪣ0ŮЇa5 {`m-2#{\23֥ .":ʼsyy,rkY%%l~;<_D$]QzA@^nadP|QAV06Gm˻﫫^3(koyl(Aq L@S(q$HJ~RWϿ8+pAQ_ɰ-Ǟ~ǝ1b*Ňl`1MAdmq+z  Rv̗ -L&Z{=#7ٺ1E2.L9LZ۾U]#䎧tfP1 w?d:gsq$L1,?iiZΧPGhp -peMP h4njB}8(4- ?̣40Nhu|půxUֵsQoHyg0.l48<s~s&iF4YmtFdnj<1xJhݖr^}X3_Ƌ~}9zflendstream -endobj -1694 0 obj<>/XObject<>>>>>endobj -1695 0 obj<>stream -xuU]F}W\]eW6`Q6ٮm6ZP E{=R\a[!q?ι^?Ih8}Htg xgxNmkO)ei4洔8eq-QT]Kmu%UK%Il6SPhkVOd M{jZcALaEq6EQa͚횂Ѧ[L]jNYBt#Y0]Di֫! pDYRj 1Q`t Oq;3v@LM-drmu]ݐ@uFɋ8ڶ;UV(s] ->t6T/۶1baFiY4vÚNOޒ̚8:5R?x]KVys'[ut|_@Fv%XgT RQ\ YՀʚBIWtP0"QJvT@iM?m -? l:ހ7(S@ODޤ5 GR9DKFK!HWr%ѤX\]@FDqiJ'-xMU-[^r5仜En_%G*y*7b?XT~أ>/XObject<<>>>>>>endobj -1697 0 obj<>stream -xWMoFW rrP[d[vzK08n =".%(M-6l͛ד\$)O泹\-frysdr/ޮO^-˹3Z]:ؙIr.WUkYfɚT~u[gltim峱ܭ_<&NMzcJrcQunT -%>I3Q ڡ~]VpڄȪ4{1 ߁;H1Gx/Sf-t~b@,iA,g/GN;]h]NKj J"=O/&ƓblMXeG&֡ @f;h dЈJ5cX&iu8&rlz*tNb)I`Z;*ACD^[GI'Z{C%I\fkb#09b C^Z1%AcNUAU=G1$;08{Lu@d+=i:5HOSnD-ې6XR9&uJraCKFJyHqok5܀v$Jn6r[='yO<d8C鐐!԰C5rsEZ/!֟ f򑁛WwCaLZ_Oqq~=,W^k,Ĩě:J+%g-^1M5C8 -T5z2{ĥsmZ\ T !M0GU1.prq͡'{KQ.B ∐Fy(>HF"?rӅt ]un`IlA r;8QG36(God+DHTv]`07}?*v4ˆU?Й]R6,* uv]?j}D -Y[K]n"SY%3h4b;F;FyԷ- >2jX{0Z1.H܉іr -sbOLrȕ-%RkTq>Ĉyr]=wSlNd*g0,%Gݓ]59X 1I@x>{ -})JA"tV0LD!esDVG?K -s0v/;Bwa[ae|0.,+#x'Ԫy;#dXi1G٬X_aڦ͛㧧˫?Os=i zߤru3[]-DZW|䷓9endstream -endobj -1698 0 obj<>/XObject<<>>>>>>endobj -1699 0 obj<>stream -xWMsHWtq2Uc1GCZ Yb -4D3_g$Q5ݯ{}2~.V'錮/y q6lz[,|\_,ohfN'߽rPO8-Qrxh#6ζ5'rpGm,p],5}u2%[gv6M&nu (IVC&#UJY#FK5SyCv>0{1]T&[m[O8STPCʸ/3ҞM.8ĭgXWzr?8<Oi] ~v;@7ei;dQfLʴSiL 4Ζ%  MTktږ} iAk߲©rʤ*2- >٭΄ZL`[H@ZlRšQw6kmO{;$] [(@AfG8MH>E3 -r͉.u- c+daY}g]&lj:, GT|c[8>MzjПhڋWt媡Px+g+#)4edsFuR=E)7R60NX30l{*mZ:S 1D['.}y;pgA2 X(GQO]]nN7EX$e FmM2Ŝ; -TȐQPΠd`dQN8L%n2_)X`CNŶtbE;~հ=(7Q{ VBĜb z +Q$c 2CVpҝNv1P4BkU#=w+ RT. C)^O;PE$G\%s5?1fI$H60d~ \ cjRHg<Ƭn(dJ+3B uO P S*{„2VJ-A-eBGcW3,cX7b\pw s Z$DL*WFLCgᥣ"edb2pKL}g4p(@3!(JU86=SjcJ.AcCC+7(AĢ>!:, -.4ڨv?%/a"nF+'eVG58JP\REX"'oLĻo3ʢ^lNöVCA`b)RK6eņЮS v\1Bmm{R8/p7*T@}`-$eeX'^NWUƥ~q+xmZv* -:C,*3Ѝ)6 EWUx0Q8pݺbҎ> C);5()VAl00mU@j9!'/ֳD)}E&Dž fork(hZxqgJw7YtvB! C[1C7ޡӽT\=/xxb5e;=_閗WwWd~-š *φnfX뙼3O:)Ǯendstream -endobj -1700 0 obj<>/XObject<<>>>>>>endobj -1701 0 obj<>stream -xX]o6}ϯK3 QlqҾ -[lv Dl(Q%xޯ߹$rv($x?=~=t3(l4f4XIex1]g˓ˏoi\_`jJq4u1sIZxIh|N QmP,o$RV䞶ozTuau^Gt1& 5x +L&Z{=#7ٺ1E2.L9LZ۾U]#䎧tfP1 w?d:gsq$L1,?iiZΧPGhp -peMP h4njB}8(4- ?̣40Nhu|půxUֵsQoHyg0.l48<s~s&iF4YmtFdnj<1xJhݖr^}X3_c zfendstream +endobj +1686 0 obj<>/XObject<>>>>>endobj +1687 0 obj<>stream +xuUmo6_q4,YWC,@mM(%6TDʞ='ٵlyw˝_z KhhJy{d.?$ќsOh{ Ɣ$\xt>&9-%Z2$L$:ߒv۲҅$6B)(t7 hu~g~զՍ1lpJJE_Uڋ)LQ< e(fMNyϷ횂֦]Lm׷[U"FGt][“6f)EA]RHZƒPҁB?c`p|:(K0UJ4H C5yw'uZɫ8ڦ3e[VV.er TBɃmo#i Esx>-IˬQ8*⣌ZS.Μ "Zn1) }٥8`Q7(E9փ\,+5P#ݸo`eL#i-po:Lƶ +^{O6o 8ё7e#iME‘T.u[**Q@Hej\emAk4;)+Ȉ#{ CiKAYr>^D9}m+]f|WN]stۚM+t,F dz'=|iSwpGCOv#Ob MO!t|~t%&ikRT o~Qro-}0뿻cL>̇*+BﺧF#a(a'äGZ?EO}=•{c/\&xw%d"k vl|6…;x6CPYLyeS_?-endstream +endobj +1688 0 obj<>/XObject<<>>>>>>endobj +1689 0 obj<>stream +xWMoFW zrP[dErzK08n =".%ŨM-6l͛׳\k.\$)ϮfWjj/Sk‹bx9{,dj}#T` +Ow]|5OdF9eNk+M]nbٕ\.0ql*n-rq87Jxl)ylF8vkUcE$.kFH׮墤C/#yTHJ+d~3i]qچyi70T8zvY&Y^k,Ĩě:J+#g_0M5C8 +T5#z2{ĥsmZp\ T[ Ǒ!M0GU1.prqͱÏ'{KQ.B ∐Fy(>HF"?rӅt ]un`IlA r;8QG36(Gd+DHTv]c07}?*v4ˆU?Й]R.,* uv]?j}D +Y[K]n"SY%3h4b;F;FyԷ- >2jX0Z1.H܉іr +sbOLrȕ-%RkTq>Ȉyr]tSlNd*g0,%G=]59X 1I@x>{ +})JA"tV0LD!#esDVG?K +s0/{Bwa[ae|0.,+#x'֪>|y;#dXϜh1G٬X_aڦ͛ӧ?Os=i zߤf^֫8^ٯgendstream +endobj +1690 0 obj<>/XObject<<>>>>>>endobj +1691 0 obj<>stream +xWrH+8ı㘣!K-,q +4D13ޯ3(Țn>ft}IW JdJf9_^%8Er:|Ň>O.i6kZg)G'k.=}I6R 5^Zr&fK+剽Sk2 o3\z/ oMޯL|vZNia[C]&oq:He%vf+!I֑)Cs%KטQX)#REoƫDLJAtIUއ\|H3^0[L&3.W5=B9RⱯ_I/ >5$3 mJ1־q"Af؃Viݠjĭ =q1. +܁M0H7`qE=uhǗ.,¢ )IWW ר4Mmcjq\U')a0^WFGr%+\%r +ř'f*_p J w*+"*k `D /Xi +::t~sT$}~&DDH^2l +mCnuꬷ㍁Z1ZEQ#X@^qgrJA"!ByIz %3$3П3$~Hn|$ɢ2m7G:Su.c1saLiE3cV2t`p!MST2SXU( j|ЍNަϰa݈%s z΁BkT).=#:,.4ڨ?#/a"nF+'cV58JP\REX"'oLۇYӁQweQA'QLaVCA`b݆)RK&eņЮ3 v\1@q^n0TeZH:)p Ƞ{+٪ny؇FC^ƄÄBd%+K{ tcJlMrCsUeMT&mbҎ });5()TAl00mU@j9!'/ֳD }E&Dž for(hZxqgB7YtB! C[1C7޾ *ގ=/xxb5e;=˲_WMVVd~-š *ϯXb |\?' bnjendstream +endobj +1692 0 obj<>/XObject<<>>>>>>endobj +1693 0 obj<>stream +xX]o6}ϯK3 Qlu +[lv Dl(Q%xޯ߹$rv($x?=~=t=(l4f4XIex1ͦ'oi\_`jJq4u1sIZxIh|N QmP,o$RV䞶ozTuau^Gt1& 5x %pȥ3LzH.iW9T*Yٶ}q"dV)5mFۉJVpB'ʵ57.6qDq>Q -R_(PU\8Sgn/&0*9ǘL T%|Kdd,sRe)o'jIcaQ_dveɓ ?*D|QETPNƂpi{+vqF?5 YD7iZ g )3y`.eLck1Ј`YOI`AZMI%fT$SH\h oRQ-={GJepn)W"fcbL/;ܢ>,X@ Z'B3sӢ:aQ"mje$>GՇ;8R7(&R `ղFܽOB9zoLpKhM\ eQ_UcU6&V)$]~ Rv.cV($<2 >c+b6}m%қA[mSۄ^@]Ia&7 r]CC@C18$k$xP%&wni#Bqzh"ƀ OcB Ud>ap†]#1\ -p SKÁ`YPբ[<b!{rBwކ(~E$~ݱ]A2s^UyҬ@EݴF"Ÿ YiDz:F:Ga;҄%E)bDh̑1yXW0Pg:#8=-~8ojp9?#~cc 2vzz04a?lrO?K*ast7^pk) VA tj`i!i;$D~t=cPd4q 1H!k 7Fc,JS`Eyהּӌu^e!B}.cSm@Cyӎ4+~˃8<(ƪe6k(  vҩqNqnFr]V@1D6p_}հ -9 xϜ\>h *#J5-^6´ZXj ּF/ae*rؼM }v'/Q3p1{vҠZO+ b8m/{I['lphAp8|xͮowqݛ7tc݁e/m6"8e?/O~?j"endstream +p SKÁ`YPբ[<b!{rBw귽 'Q<.pIcAOdrTs4Y81ɋVsiE .?s9/ógWqӈ ڟu&SQru.v#4Xc Kt=R~U1=#Oc󠭱`HuF qz2x=ns~G;e +X+`>h~$~T +1^,oн< ᮃ :"RxAF!C9w\I8 H{dEAi ;~cB-oʍX|`!Lnm ()Yi=v+4]}C<]{05lǻi Vqy PU |SmP@^/p?S i@ e$blzvabsn#9}T T& 9G`k5+[ݑ˽liy 9^ b T 4vy O^^ fX!abVAq RV@p^vN< @/=q& +;z nwtor8Ӎ}\t.G܏_zv}{&^~jendstream endobj -1702 0 obj<>/XObject<<>>>>/Annots 977 0 R>>endobj -1703 0 obj<>stream +1694 0 obj<>/XObject<<>>>>/Annots 979 0 R>>endobj +1695 0 obj<>stream xXQS7~W[ CJIi&Їtl $G՝208N~|?c:zoTxϓ3|N -qqҋxZL^xËQxrZ49>/ݷ;f x;=?G4+o[&R2Z|ƖQZOHaZŸA\| 4x 1gw{#:#f[o"}y'E_?^MqS4[Hx X^%ncʕupsh&TEDBWnUҕ.k*MiʕrKD26ЀNg/C0uo,lHۀ-a^tN C(XHv4:[svB:&yɇe G)֪.Qzd>r`KjH"9݂G&{$JU9A*=^wA\fF+;Hz?SDвfvlV떁)-+7 \^5 H AOԯaPAK*9c`x{0è=`83Bk``U1P)s"lRMѧOiMү-$Q4el} . d SؑG%ZCIJTyуU@_1/[֡KLڇޑpeX C8-+칾 hNQ k~R62HD)ؤsY~!W @"f]Xl뤁8+Vvb*X>ʢVW @@ -3727,10 +3635,10 @@ H AOԯ 0Aa(1}.R\s/b.s*r}ÆMmELfr,l56 3O4<6)f|-gHj1 MFY.ih&d6y)0c,+,P 5Wh+SiyMS'ec\Dj@(a=lm?DdZg .eY2Q \JxXgxB q-rskרJ``Tb̅K):C\ /NIB-30i2uCf&x I(Y'i9ntsu)u ң6+ @6V_;jf6!ōU0˶Rr{Đuݬ1bE4Uޘ7u8.e)T iMw|qalN0>_{|endstream +CMmdצѤ1Ce747\Ш?p&C8_91Ktj̓ 8@+4G3^}}H"qmûTX;G /M?6%4HBuHbqdim?kiQr+ig2nDPW(OAsq[l9 '- oIbT&3n+a:VnTkāO{FMv>V_;jf6!ōU0˶Rr{Đuݬ1bE4Uޘ7u8.e)T iMw|qalN0шu޿ύ|endstream endobj -1704 0 obj<>/XObject<<>>>>/Annots 980 0 R>>endobj -1705 0 obj<>stream +1696 0 obj<>/XObject<<>>>>/Annots 982 0 R>>endobj +1697 0 obj<>stream xXMs8WTIԗ-ٵ-'Rr$!cAT*eׯ_7ŒJEe-~^i Mzbݴr~1˫h;\|f]WzփUpן=mt9KzKTBY.2ʔXkKMi +Hѻo:]UD۪4;:uR=%jR@HYWex8;}bA ( h.5c5;aM*޳7 ԸG|nVd'> +lŧ-R\}0ȒKCgJ4+S"Zyރ}>0tLR?Μ¥]C`>B #12T'뎰x{QhTXW,{Ո>F|cO\S l$L{T}'9p lu-oh&,7U6)%3iS$lT%͡\ ! 8>.Kd!Q9O/yG}əX(Ąb Fָ-50 a˭8/ A2ʌgwf.ĥ* *uݡ[FtAxc>rWD3E 0pq8plm/gUXk.\3VWzbit~׹EwHg_tܾT\o8![Ju-p` C45 nr9ar~hXEm}>R]!qcpb={ȅy:U+V[bҢ/qb@Y ~]uG۾#6==\=c[>P>0@|x5Z&3 F̝K50㳣xxwQԦLlԚ$Ec.qʠ|儰pmUؾ^X0UI,]K(6f^rw tn79S('ۄPRnon &g]UGͤdB i'ݛL<]b~2RP2cyh(A'k)N\xaLgrL8y AcV A<+o,1A-;(G@Wr,#Na>b">6w|ea>/XObject<<>>>>/Annots 987 0 R>>endobj -1707 0 obj<>stream -xW]o6}@1eɎۀt]<@I͆=R`?~Öx] -u.()ple3)\:ϯ5?#v i>l^~?fs64X dR6܎2kia4KYrir+Xw²g/_pO24@䊕\°ģSͻ8v\)IM)!قB\K [Ppn?Oixq[(]rX˜Э4{J}#ڎwR kx=$a !-o;y] ,k`p9PRUVl -WQ/Vda2Ur,;.%C ~vǜӰyZ]f@cg &BM\~BT`.\⍡`vk"IHpH04?:4{wx̞a~g[p'ESfGg^@1 ٵ6NDWxQBT(z  -[po$5$Ci[/j7XKؑC2Ϯ*Øds/N~6Ez>M -D؇y5vF+Nw' gPs,#٣{D#J=PZp~GUU~XV|7aZuTJvWՅZb&]lA݉/8U:'ڻ?%N,ο${VFlY; -nFȔWa;GsܜŨv ʵP8% -3x6)ĸpnx#0X8< Q\ugry-ĚKmP{=:r{@Я &eDGGa8b%lidjt8E+}\T r8 ѕÍ@+Sۏըa!|.(鎰cو:鱅gK0$ذh:TŌbUukx>\|| 0 QZ3% :zF6*It:̽,)"9ĈɐC(ykT:\ W %_5 /ǎl/^x`r5oO -KaI§|ein,GO\endstream -endobj -1708 0 obj<>/XObject<<>>>>/Annots 998 0 R>>endobj -1709 0 obj<>stream -xVko6_qעŲ؎`&)2M( -ѶRTI)KR$.8`H1~t b~ 9bD 4DP]X ֆ{&i8ESxM[Lͺ0K>x$>hʡ%7na`p)Hv2ŗ,JZ晥?TkJܗ6R䊖F7}=Gp7z\s^oDߝW( -&RQZ^Pk -K~% =o?ݙTxAvԢ EA{ZRRf2|AJnh%p54~~݅eUZJ2Mـ@@ՃWWya/9̅]) \jR3D"N;wqNA.4p&[K aWؼ\\-)euR|A]ӝ#Zޏ~zty{[gS`@qэO ^ۖk<+sDus ڳL%QHowP!/RZ0p|D7ta=uү9kNE1`߹?w2s10VZCy:ٕn^0@^.ۓyuvkjyL=oT. eBP G>ik_|mizn 9# -vYx.rNMM^!u2s;t}i@lY*ڏѼЙ敶6d}/\ -SEnlLxO{enRt}w&虇ۂl5>2J"[@Vi7a:-u& -9\!'LwYiyQ[ke -p1HW07Uuȁ '_STSe[KG'`и{L"4)RsNqnH+Iߺ8gL.4,('+,1nKpa-6hayR+rp2A hLB!(A,1lȪmp>/XObject<<>>>>>>endobj -1711 0 obj<>stream -xVmoFίHp:1BN:UIwQ/nJeװá@JU<@?\u7(u}o⿤nÚ?5  G (@5'uZA}"z+B5F!vw`4LL*ݴ'!@,284x7R(iš9EWD-4)hoxw݁7F9DK - --RH TB|'BfD3!"ΝmژX_ -rKi'ʸJH91_ƶc\QQ9SϜ߉l#tgE"M(&sShI3'7YIiOHY;I ` -vB@) K.0+^~YPc.,t#/}TQrcQbS% D!٫#\n\Qjm RilK xQBa#r %ќOuWio:LFW֦ 0/3 Ū Xh14BuiBT2%Mal}4U0ł#:Aݷa*+2ku{mjr K <0δGKH*|]vmOEUsSfPG4|>/XObject<<>>>>>>endobj -1713 0 obj<>stream -xVmo6_6g$Kv1$h]m1qUHU9^E1~y/灏)}ԝ"gűO!ϱJI#\П$=bOоXէ?u$suV}&N-Z+) uTy>/XObject<<>>>>>>endobj -1715 0 obj<>stream -xV]oG}W\9B*eI*>Ikj`ffd9:w~{ν?)M4PVvl@dztNr=4_d/9`@30et_mMZWT kEύ4"6dyd -sdq+::zmwotf>!5kWT^k =1Vt׭x=iYT=Zk[gu(U\^ADIcMR/9YHrSNm`!X2o~/OBIߐĖjV.^R(u޶ϕCtuJxȢpd$WkοC.ߟ0i~fJDY"Y"/L"rvѾ=ay%cJ +bť\:MCTa( /(RVDpSZI˞I NUM|v^qL߶S*N9 >BO hZv<i vxJ}RnwLZTuϷή}} Jdt1NYH.A*E kWԀOяIr6JO7`l#k<G5 -]r(C9iʍj7tkaX {1تZfa7$V6BTxIn,`jq`^5 Ε}O݀q!6MeI{6"'#WRAQrHEfeDi0'׀ i8 MP b 4jNqx3zͼ75e" -qUX DY)"y0@t1ʽZ{Ih] -Eoc%@Hfu;x,FxIn/n./NW:kJsY[t^Q34xqNjec{3|+w5=w.>;tEendstream -endobj -1716 0 obj<>/XObject<<>>>>>>endobj -1717 0 obj<>stream +޴XO\ qendstream +endobj +1698 0 obj<>/XObject<<>>>>/Annots 989 0 R>>endobj +1699 0 obj<>stream +xW[o6~8@1u%j H׵Cm: Dl(w/lqlwnߡ%oW)LPԣ0:ˮ5ſV@e,yr1X_~0J36$MY56܍R$p[&,cOv9]dFcXVܓ=OZ9} TnCL$:5P("5b/0,r(}lmdc:&tA\TG(E{]?w׷ob. s~haNjJM;<0IXCf˛:}dZlZ(#t1pe4T5M.U}s%7%(0M3,;,؜!?cμlj+)ȕVJ# +ck% dsh&91K2nJj[7twJy7c2?%Zba ΆiCw׎|:KX2;,2;2>C)ϮEDvq$bWŃ:Da[hm7FR{AI2T>mAr^|| 0 Z3 ZzA%6*ItUHjTXYbs@d"Lqz5*wl +.ſ  /ǖl/^x`rӷpG0$XJjSoeibm9r_O\endstream +endobj +1700 0 obj<>/XObject<<>>>>/Annots 1000 0 R>>endobj +1701 0 obj<>stream +xVko6_qעŲ,?I h-.BKT"URg`?~璔*mðD>=~>R!'4RZQ7^$QL(fh +kI40c=h_`=:ج{:,8M>3-t cxu.'^|d3|\1SjUYZNC}YjC.EhetS$Oa w"W[My~?|[)u%$w]q޸Nރ_ ood7@- +kYU#%e&3ʗTjY(YHSi]jYV%u)ܴ yT=xv5x؟sOB5ܼKRJ\yhcQCIo./mBwWBq&> +}jޏKՊR]\'X)'$5:=88ZGWwo.n~Gu6(/;mIh/2WA4ܴ9=TBp 7y!WҒ{$+G~uyX3(t*B [ޕ9 +}ɮuSd/ ໸}"O~z\T.qM^-o9g[$ZE$"L'mMy-0;cΠ[j[˝-d!X(z>W &XMbCZV~ 4%4| +WeZ.sc xރ,s琢3|g}[PY>RHdōuNmqKS$77vm*ҵ<̍ec]k)-r`ATd jv%|A},4!.;5J2Yj݉ Iw|44@ [7 Tei4d/I\؊AtԊ-0Au`2P"~P+K}!_ j-\"_ƎY`M]k}Y Qw(N&;KEGBVo^K08 [V;, XȢ`)a`Wĕks;k(wYvG^"D0-;QA}(ֈnX +zHm>u7ѼՊі0+YF>/XObject<<>>>>>>endobj +1703 0 obj<>stream +xV[oF~WHZVUnM۪Ҿ1Lbϰ3㰨gfl JU=g{ t!DYuxCw%vI!Hp?b@Nyw?}$~<:v +/2 } P\SɩMQi]g \ kJo47㪈j$*}Nd;+µiz\b2gy2<.14#p2{CddљEk^X<¶NrY(0aB +B% 1 5B`tDy쓥 Ï3'*l]@$ ɼ^=rKt*Rk[vVKe/7DE %Ds>ՑL{pc2B]Y.5ü`LJ9U {)b&iH1ӄdJjl}4U0ł#:Aݷa*+2ku{mjrz^z0a?l`i{&RcPd+WU۞ g!bd_*7!&4Ö)!`,';M*  1g !q!sΑHv$BFLA5Q/-8q21K*3%f6J /35|c*4;Fo>6ycVWF-fd.ӐPhH0*L&JxpamJ{(=<2d|Bu"E[Sɶoo/Z/Oۋ4ZP*6n.B!_YD8u(ܔx: O|XĹqđ  hvS/#rɨhD!nӣ>.fZ6c;endstream +endobj +1704 0 obj<>/XObject<<>>>>>>endobj +1705 0 obj<>stream +xVmoH_D4=կI݀ZAhtcoR{7x Օ.i.!Ż3wI]a4v'L ɼx4)IAҾy2BbI&z>w$su> 'nxZVI*.\&ZyXE?BT%U)Z;Bͳw:A!;ad9[ZV*OKFPV.\)@Z9ҘR);8!጑`|:RF٫:=#^!7^اX R^1B?)Ys :9SZD9%#b$,ZKrLdQeF*75~+0h)/UHh0UճYICT0944hA=E%u)P}>ޱ@_[ُO,]Ii*pR}@~^zJPՓ +"8y\re|iT-p`M0$+jMjZFeÑtq`]#(ZC%%_kg"r̯!}} ˜ α]oJK"YrSk|%[-%Y99,M<0 }} ~ʼnG !BdV0zC4[78vgIa! tFۿ!5f%4$+嶚a1{6Y".(RS⚧wmDZMչ}O;A"{'] G3jMۈӬttDmi:Ft4˓cY,x&A)h4V9Ujt+L١37𺲧2ntҵɈyendstream +endobj +1706 0 obj<>/XObject<<>>>>>>endobj +1707 0 obj<>stream +xV]o6}Hlʲmdn=dÀ-6cTIFlζt8"׹ܫϝi2QBi #O';>Fē \;̀| W_2i˛Cg@at_]MJT +kEϵ4"6dyd +sbr+:9zmoM}C&+rdk<{Եc8s^I[jm{f2.{ֶ("]PT+ADQmM/9ZHbQF}K60{F,jo~/OBIߐĖjV.^Rf\movxQv'p!<'%Rm ]w,qxLXCvO 5ɏ+AEbz4uG$ajҧg0 k<G5 +]r(C9Д#nVz%%èqc]#,O(D\^VU2 %$zxhl rs F 68_y\3,N[ad{jD \tSg#r2r%.tXìV]Z~p( d~> Й?t p_+@Lpjuó9{]S]HAa?NjXdS)k#]?Q2C6x[ FY{/i3ZW=mhYN/K^⠮+dLu6yN8~kП S 1^yZYXތ)K.xrWsaEendstream +endobj +1708 0 obj<>/XObject<<>>>>>>endobj +1709 0 obj<>stream xX]o9}ϯҾP) IIRZuU+Uf7ڞRkaL~@(:{׳)M3KQYM .kugogw4|#W'5/x6ャ{۸RU2X-hZԟ7, ogJK+JV`cږ"(k.i dc^{e8T۪Pd>6CٍZ~ ajg{P6Aѽ$)ӯg~GFI_'vֆ_ҧ/3>T1BH^%>Lg⪸)L}I_R-UI_ff:\X*EfTVz26̑0*螾4>ː#@W\]Zשv +ɯ [:I,|i/M.-ufᤸEYƄJPE@=S 8&r%ӪPa&VRmJ Ldc]-tN-Oho!O#HPVFh=T!A T 6 1WI F,` n?S-`ԙ1(H2.&wxJdCz3kgN|zQ~Ej{* ek8yS -$I h"T^p\l:2敃o @?M? 9jB;)-PpKv&tkpa,;н^k@b A@L21xyWIÝK˻X=1ŤswA-d-I;7KXŤNKհ#ѕڷ^7vD&Gw;1k\IqNhY { DL|?)+C yDcw^q~׿ t;qNAԞG&N=: cԮƯML[dxYα7ye2빯CF o7 oф.;(_׉XX^wvmMħM<-=|yRܛR"}l'r:÷W~ ^9^>:}zk˦d].7,ը=\|>4\nK|Ngo?H;pendstream +$I h"T^p\l:2敃o @?M? 9jB;)-PpKv&tkpa,;н^k@b A@L21xyWIÝK˻X=1ŤswA-d-I;7KXŤNKհ#ѕڷ^7vD&Gw;1k\IqNhY { DL|?)+C yDcw^q~׿ t;qNAԞG&N=: cԮƯML[dxYα7ye2빯CF o7 oф.;(_׉XX^wvmMħM<-=|yRܛR"}l'r:÷W~ ^9^>:}zk˦d].7,ը=\|>4\nK|Nng H;pendstream endobj -1718 0 obj<>/XObject<<>>>>>>endobj -1719 0 obj<>stream +1710 0 obj<>/XObject<<>>>>>>endobj +1711 0 obj<>stream xWێF}+JKioaQ&  iԴ۸Wv/;|}mf2 SN]\B!LG0 x̦xbޯ{CX'%Ma.XӁ/Hli V+m Ljd\0 a L6VŖa.3v̀1b۬ `2JѐHȋTs"oV7`%3Qp T"KqJ "NP'6`,ր hJĎ,=Grqjf}A+AlO N`~(aSWWdq++bc+~X#~P TZLԷ~J7f|j] .C0dX;yT1ע9omth:\mF.M"uÊեƣRYpo51n1;7=qrMr +E!3e8_՛h^ 2wS9۬9#Y} #<@xTgĨٞZӞ"͆4H{5D3/zY- oޟ1Kendstream -endobj -1720 0 obj<>/XObject<<>>>>>>endobj -1721 0 obj<>stream -xV]o6}@lَ-M@da@@KV"Us))NT؀&Iޏs9ALc|ǴtNI9Gc̣ ͖ Jt|-O-LƳO| FcM%^1mn>4I>JLѢ QPۑIm?~YF(ELLY*\?r="B]"kOSkG'r9p`'5Q7Ni*S3T(-Id@iVmV\z -e$6sJM-$U֔w>ܐkE;{lԖ֢ -DN2J2﬩]KTUÂgysڢ/ˇ"4d^RhΚfb6 HT* k=rڕh`TV(ahzeÅst)Yk -J&7,+ -8)5m/A+z*TRf>OuKl2ܶuK!Cph)OIec xkʣZԙe9ȴ5wWا \7tL/q 6Z5_yx|U`k -h4fFe"50slm84-0ndy+,:NQ|IYkEDF'ExjXpsY K -iL 5UKS5d,xV 0%1y/kjJ6VpM&y Gb0eV!RXU&2lTop - .g^񬼜2ܾ뫻W`g\tcna}Cr6_F yG䓿o ~Nendstream -endobj -1722 0 obj<>/XObject<>>>>>endobj -1723 0 obj<>stream +ڗJml >qjf}A+AlO N`~(aSWWdq++bc+~X#~P TZLԷ~J7f|j] .C0dX;yT1ע9omth:\mF.M"uÊեƣRYpo51n1;7=qrMr +E!3e8_՛h^ 2wS9۬9#Y} #<@xTgĨٞZӞ"͆4H{5D3/zY- foޟ0Kendstream +endobj +1712 0 obj<>/XObject<<>>>>>>endobj +1713 0 obj<>stream +xVn6|W`,_K߲Ii}(esW"$e~PRh]6&y.sfR!F4RR(4d>~,,h~naO~,p7gj[Y}r_ğ g I8}R!Z[fQ + tUl@Og9Bп $L) X,$|0̰Fdˏd4Pq` OJW.iera]>-E5.\_"TADZ/PHDt\qPx_+ԩwI,q?8ĉa? l\*@=Rs@1kzZC*ڵ؞Brh7gT(ah:eÅstu)Yi +JW&w Y`0qRj_\3OU1"'|V'diTML6S61VG3Xsicoaou tL/q 6Z5_yx|Ut`k +h4fFa"50Kl94-0oodyaWXͣanN-a4j62_[j"kGPw+3<֥@TkJtk<==s,+IQQ^n%1y'kj +6Fpu&y Gb0eV!RXU&2lTop + .g573Yy>"ܾhg\tkn~?m9Σμ#^׽?z~Nendstream +endobj +1714 0 obj<>/XObject<<>>>>/Annots 1005 0 R>>endobj +1715 0 obj<>stream +xWo6~_qK] #DZ]ڴk<úm.T\(Ɋ+ƦI;{%4Ռtqv\ϧwgoq!+d"X T8>7_oʝb$F)z;!_ޢN)yV 2S.xTE bSB*G-=ԍf d2ZUЄ@5 }cConw*{^5 W[SbeN:QzR6Z!L&b GﱡJn1BbJٍAԦln +جHu]X8˜#r\-d ͳf{If{C1"8DaA1ă8ҁ2:q@<0P@6[ڹC bŀVD[+xnHX)iGoY)9Gt/zAc? zV4doWg$wendstream +endobj +1716 0 obj<>/XObject<<>>>>>>endobj +1717 0 obj<>stream +xX]S}W[[ @7&|݋{KU[cil"x5#,$@diG}4|BSʣQ2xLlv'WiZSOYGÛ3iD9!hDl5EA.˔7Ϊؑudؕl +?Bekr5U!m_G#:L<|>0yUzCWlG8-/tEKW7c/^ȍѸN}B=r +M+MHSKcunB|EcPT5e6bG>E0 9 cu+r%RceK +^>ZYJ3ȿ-Y jF+COV3 ,X/wJsi.t=>O$J+f$~ΠizSءHShfSs0wiL3[6d.*oT^IW( }]uԐhX~3k Hus Xb Mcp}s3#`zA5&QL# 1p{qMPf/12r.ϮdI?0lߥsSWT֮^)^|%)2queTz919BD- Q%LcIbe^吪P^hmmоw@c mY:@bzkLAh >/ڊְ$a?ŪoE~JS+&`G{^oz|ΟR(X}BtŕjkNaNU]kQV,k~>Gj['p ~#O8of/G^RX^ hH~lwMDtڨj^Jes3iQ6bUi;C3Ro +wd @S%nမeta|Z!v#(Yyh*=8 $8)0yd^=,ŹAf'K6't up9E-\&$+GGYwWzQ`ۄܙr-D^3&7KoO\xJk ѷvGxYUByԔ*^K{h.[4ٺ\dh’`Tué8U|Z{`Wg98xTԭ,hWq>> +GD6ިy%? &gEӳї_ϻ˫/_ﯥȍTX^ :3'H1g + +LPwZ!*0uk 8<֞Zt_W,h]" YօEp)LQBowuq!WkǼw^;';RVpg; Dl1ܨ +\FgC=ebz1AL{f'M. aȚa ЀeDCPZz\Qw +s{e +6aۤ||3o4*i ziej 3l`Re+^ E?/= ecG!7KDATd -50atʷgvԦȵPbXKtϔqNh2ÛΎ4&tެ|-{h"/q<,<>eqYk_-ȎWNT +,*  ȯQ-+!ņ2H(;lp$DG~qoH3p.A N:#W<grǛL2հ +o% +t)*`jm^^?T&]YYݮNKw3*$[^}f"_m{{M{zGqjuּ)SNgɌ_@.~1s8NNG|}>C ^+sӇendstream +endobj +1718 0 obj<>/XObject<>>>>>endobj +1719 0 obj<>stream +xXnI}WxJ${Kp H!@8vҙiMfmVZ'}SNUQzק GGGgq29>4͎~R<?N~쿤w>We3i:%9M3^]A4QeshfrI| +.rdzi˙'7cRe&}'MIaŸ́|!f6lp4ep6ϵ ]ҋ׎tD7vϕ~i܀+^: ^ 7`i0Bv/&I*փzT* );+gS47p +.LȵderCfD $e0 +lҮC [ snSV-T^sV +|2^IÃQryYC?no"7`T* | Mz%LiiS0-'P-o7{]Zܿ" 旦w!.$;"3?SZ杮P *~ټ.4;}D3gq UN{2#t`$bק!Ȅ +>dqrl]QR@Ӳ¡-( X,AG6Bʁg*;3?9[XHjC•%IO:)+ n (€\Ĉ]˗Cq] +5* hP$-a_qsUZ)|Sr*%J^C $h}XH}TBj kЩuBQ?@ձ@rEeͭB +K!e԰Sz=)Afj'Se)Y*_ȽeEk9&B֔h_B,럵RrԃMX~r/6;GD'C[LqG2;۫kXlljگ[O6_W v 0yaR4tXAn+9-| .Ɩ)*ˎ9]Yogl]|} "_kʖM.SW0mpB *ޫS׺=qu:;w7o/3L0-!k7W4gT`\@W~HztϓqS\z %뛸d!lnJ'"%~]JNoX+[CmJB)}5[Ei C?aa\g\]܊{#_]`4_S1҉]RA'kf+dR&+LbM 'zȫ + k<+#nD +:2=c ujA%[y3T/JQg]ܞ?Vm\ &B$zʹg82bs8߰4wdf1CwSBag!A6;q'M~mҗN堤z~ve؅4ɵϙ BsíFŗ- x6q|٬0%>5.ڸ +Uezv$o X8 A,Y0V9w9GZ[ +C#xv=pȂpwqd {K&?· +!u{x3% \ҬmB#<;#Ro$?=|k4mMendstream +endobj +1720 0 obj<>/XObject<>>>>>endobj +1721 0 obj<>stream +xWao6_q lŒK׭Zm\l@=DY\${GJtk ,ɻwc>b7YB)U3ų( o!4#ūxJ?zE#L%M3<'%_]?7d>N8^.~dDMgsZfޤ:YSztcP;= ?%𼥶'C1 ߬[iax~ac`c篃D<Ғ}[ ӜiwN%eSr$^cXQ@gqx.#el`Ԯhxr'pFE2WNv el gSYTd!DɇDw}ýkY;g!g>/XObject<>>>>>endobj +1723 0 obj<>stream +xWko8_0pp +ت8š\D]uQeH菿YR=#є&N(<ūe]i6OOۣ .ͳK_ +N29ϸ>,Ln;Xw!ͲdJ%qãՓ!Je1 +y2LU34xXRv0Jvm\IwM3NucAFP2*DRnTڪZ52N2zQo TFr+\. f(4(vp]S viMMR䛌0!Q-֛^q]>ixZcQurӭt 3JxIWX\AhEg8~- J8rp)[)L*I ld +[-"{hZNRZs}^-tdfHjG.Ff>"<<Ρ)K^wCGm+)$ +Vy#~s :dSo#ZcaTFhYwunkld-ޣ4*V`,h vֈvE8hz}|f6Mݴ)'j +CēN3p׌qEר A_gJOmG9@Q 0k9 A2La=5\ y, jao kM3Cu[x% gƧxz0J4t4-hp8Yb"# 8D5wf&z(4]HU.)qiv:8H| P?##  u^sҺ}o]w^2͸% \qƃ6ݺ֠OҰbx9D-W9b< x\v\SF!.cJg_>"18->/:PM{nBؤqm[*=aD/wZV|$ +xx-~ 60@+0r/ҡ +rT^~ƒjA) pU#-Vk|@2y[Cvd|>k_+o Wk^53. #jendstream +endobj +1724 0 obj<>/XObject<<>>>>>>endobj +1725 0 obj<>stream +xWnH|W46 ђlvޜ85.65Qȑ8ΐWáde" YawWUW7:zLJ˓a2:˛kN%F4]暦pHaA;P6JisܲEsZB{G4ׅf΍AJ8 sฒ;R .9ISQoa0)uOBX| ]^m*Q~bVoReF!~AݞOZ>b\gB=;ԙ*ZZ:UQ]!wGϏw?}lbnlq ]@&sg0UwpA ?:Ϫzb3QD|BXZN U\sAߥfm̴)rfT+UYΙ.tz_ W=geTNWp8D<#lݷqP8riҺ04J&OO:>vJ4DYa?~+R a9S?My񊒍1vSkL&SKp +㺖j%;O _+W& -T+FH\fr^={QXnJLg@ND26PXțG~&)~:J =; wM=[[iQC^kn>*]fq^Oq^t&ox{Eʡ%<|hʵ3Qkt|d0.3}(Xay10~do^k!X3sUFmڡOwOC?I']9Ih0mDy҅)0L#(YBop28b(a4 6쉇BSi7 者\]Ϗw]Kut8UqcDsԍ7@M ڶ;pM`6JYߨZ%O4bF&%z;s9Vh#.!G ƛSYhTf7~/t9I&W-d$':$gendstream +endobj +1726 0 obj<>/XObject<>>>>>endobj +1727 0 obj<>stream +xWOH~*'! Q(*WN\l&俿ovr= ]|7? Bi4(?:gS|jJ`|v?q0<; ݃Na?Ɓ8߄teAzLaH')-bѝX*K#ohycuLiA~)SZcRqRGQe.|x,̦-~ d8E|T*g:KSxk2Wyd-)L2*IL.ө|>iKGNk[G^v8G PeUl/$vU +~ŭOa(cikw-I A$]+l*gw Pau{qGxEb8"j]*$+8yN4Xΐ=0Gcc hӿ>f:,I@"6O`Ls"WɐypP_4dɴ+u&[mRuM-f# d0ٮ +qSNdT[ߧB ׺<&*߾oq@ĥHg]UƢtm鑠R916vaz|Du8o.sVK-ƒ Q|&c#gĞ&M'rG>/ 䨁X]uVȳ*:4'=q~˵. esv>9w n;EYC1%ZtCz\Q&X&,zh&[QZ=WDsU#<}~N t"LHcM . .X&Th+8nAExʱn._yPFqyb)_O|#v`}y\~zbfxh#wf97Ma!A{-Rft(D7,0vdO_Y*13hg*izI s !Sg4|lƋU=ҪJc}αVcYͺi I֞i`nq2x`^-ѲPe>/XObject<>>>>>endobj +1729 0 obj<>stream +xW]oJ}ϯT 7(!M{s+Y{ml]JUjUq|9gfG]ȧui8z> #\)$-݃q`p| M]H|Ddg9]i|>890^%# +bB.$zKv-I,O ?eKH eRd5jU+whv1" C%-DAwJSºYM^X2|zEzɮ~0XxDF#ɤ\u)уtRŪKGe4BtWP$ZP.UIn# EzYTr2iɈ첈Ri:v% +3("5 2u0i-L8+ +η0Eh&XX/M˨] ɾQ!Qj"2ڣ@ TP*&o(2pE_Ѥ %:bG\ 2&9UttT"2JRiY6G)x΀z|Σ|JcD$=:40Ekqim +ewiѤ,tz'%2 H +Vq-}J|2 9f? 3*,!̪b.v$`3 *9eh=h([Kn oQJWX2[Ca¢>T+e,bxb0˱`o~t96\~]Ӈq򀫙 +m҆>0`0/-n[91*r7Nf8*2-M33U3/&sT]ur(Q?E^^Y<;.1y=>)! +_wCD e;%jֵ"4y{'cKjҖ6XFvW&XM ũX<$*jwAB8YH{P52NTgَ.+Ƶh +4dd"#K-T ǠPҴJ7TUִȊş[aα\hp?&aE2|NX.ud %"U֖zC }TK7ZT >rrUm**{h-2'VZLP鋤}=ﻍB_Z3qXsWп@I/Ju=^]OaXhmXO"~G鮾>A+*痡*ݾE]<Uz$r|.$OBP"-oRyǍ``YO7`~9mU*AD_l>5H-|cI'n+mR d.]zC|u/ˤiE|p܆!Ňz#w|>#e9endstream +endobj +1730 0 obj<>/XObject<>>>>>endobj +1731 0 obj<>stream +xWnF}W hօKkavA[@/kr%nL2ܥ},XQ" +۰ĝۙ3z?!":RZ|pDS1Mi ]Slu( >G%-Β1!% ][gx؁Po`VZ6WpoL,{te +@m|g{ ؤ4Eue.5 4`=z[֕迳Т0FF׸iq1i7@56@aC\Y_"Cw j_6WTD(EoQ rhv3* Sf8o3ܢ7i875ߦ*qV~G BBDfJ6"^"ܞ=xv05tΗ,9a00}6 +A45vm?zn8}O'j7xGFZ}d]Ih+t%O?nTZknKYJT 5DUIQ+weG4-ZTCU˅iС>/xZ{uW<s0Vm{c|~/U?x̠:~; n8-(goN"GrՃ,@';^U[S*yخ &=-2m XЁs,HǓJ-lNw)pcJc%u-7)Ӭ_F۝/+7=kh^>v[/'Mx=y?|89;% PÚ6<^=ea8;@|LCA|_oo P?Հ"endstream +endobj +1732 0 obj<>/XObject<>>>>>endobj +1733 0 obj<>stream xWoH~_1D - poihtHr=xYbvM;]+T|ӰG+Jg)FhD=<4 p_7F]ǣhL=|?~i~ֹSKh̻xn6bKATrmEgMԼ:25ѫ7Ϻ pKk&Ko:!9|;(GN&2R)p=qFf/b+)7GV: ->Vt0idI]S~yxSbJ +Spx|#5PD&'e>*re="p}jCJM]ڬ~Vh#O= {YUiYEbucg -> .RK<BjZ%";_Q[Ѣuww8Q֤*rG*7j"+JŲ>>%A}#|$W$!Af2ҨͧI)KrC_nD8eꔊ`|ŮrmJ1aIIk ,;B! Ɖ q cQҪH^B=R:z|9!={8lx,Ϗka^%ET9S‰=:(D!Z}FXB2%2ZJ)R8D>qbh.H}瞧c!lfGȣF-E,`{ZEWK y[ЇNioӇCh1CD+2; ~Snj4>g~z9,'3fh q'CSX(SqM@k#DYl(cHz4"? X8*!2o{*,I&Ʀ͞ŹG--inv+i|-#zKc;XOq8⪔YlUXhi+q%o@}a&ikN VM ;Se)ED^@;2I?,m -~YvF^2u0b"uj %mklBd@^@w{W!̓unҦR 2eѻRq;,G)?΁BPE|(`+.ZMNxX:(͑a2⮃C@cƕX,9D4g!SRy9wq/fyR-UP$mexOJL *cG{*O0sHJ1.T]lVnKt>4^j ʱ<:KVQ{, -nhډEda4(#yE1=޲. $K5,f|-ɽLq: pTR_`M!kAIa-Ƃ]*$I?F:/lS9gL?xendstream -endobj -1724 0 obj<>/XObject<<>>>>>>endobj -1725 0 obj<>stream + poihtHr=xYbvM;]+T|ӰG+Jg)FhD=<4 p_7F]ǣhL=|?~i~ֹSKh̻xn6bKMu.VJ~FߔNͫ#-Wc_|s>Kfbs;8ڽ÷rd+)" 7Ѓ?Mgd;ҙ~!-rCxijsH˙ÈlESǞFdJܕ1W9%FԺ2 x7RS^ H$mr]vޯ.Yx# ק6d{ŮoŁ62ðUPϝ5Ln]{ V7F}ѨQp"5>Өz ԯvάU"2Sōѹ5-Zww75mM*"wrq*ҽr4\,[[ a\P)+n9GrE"d!#|rԉ/?$&AJ3]&٭N W*1oSL}V03) `XЀ)<%+Գq Sc}?w`Oʆv U"]D߸>qOH=%8ۣB418g5΁Q-$3\,dR}-U<9z'M/W>8 V}y:?&zfv<)ylԢ^*x\E^yL +'}6}-/\?L_03D$yR*ø7VV*As&ϡr0cfFJ`q29U<H.ܤ$F?bNņ2P4'@#"-⸸ +',¢dblpzzZ{ѩN"/ђVhͧ84&-Jnа8U\AeC!ÜF뗞z`go%\W *(I/PrYڶƶ-D%tWwBŬ2+s*:8t >j\ŒCT\ Nf 82:>E)5ls!o +i,zi"\E"6X $`pꑘ2vOj:ث2\O%/lѥFhTL'C{nKyˣcDke`[UǢH^d^NJ>/XObject<<>>>>>>endobj +1735 0 obj<>stream xWn8}W )P˖:)(m} -Q6tI*gH%6MD&vΜi9]i2e#ٜ+>ƏT8dvJyN >f+Z-KK[UJ'x2k*eQnFpɭ/$47ʔ3y_<_/^h0eSr=ݔ%:uJy`KjY~gTki#D/k>A,FtH,b2](ힴ3@ up,%%NJĤ2q*hE:{ZI2?kcp]2(2\R|1jب-lc8ވ;6@4Ωneb (2r(MZJ$9 j *NTGYRiVd!Thok\^|Tf]i4"yĜO!?) qD^@W,251%f@:Ƹ?U%PS%ЄD1DGذIІ((bµ9]Y#BDcUB%DLJ; ̹‹ %9[ -)F>Dڠ6urz7HS(7r@:渚PX $K\ь;ivhS5>mU-ο`J[Q<KN -}J'1)eu%,ٻEvZ|Ρ@kсC?JO!pEgm6K `rskWTڞv*`8;9sYofNfK dpQbwȐOGD 3:-`sBbrj?&y+r㬃7D›TF`1m/:΢~>ZYp 612餄>/XObject<<>>>>>>endobj -1727 0 obj<>stream -xWMo6W Ch"[N-iݏz Pmq#*IomĶҲYdf vyO/&ڹEF ytt5R֪#oMWD;Q g+ eMX*D].n%& OZÀW;QL*f}mnJzl79fw/L3'v -f8t6 e֧<kX.Hi?k/F$ •RpclI'HXy-Ӹh#$ilk]vJ.r(XӵۗRݑ1WKU ۣs?y?FG@ **\<Ρ}bgCb3B~xS sC3-8˿wñ<*;u(*2k'E%S |#|TyV :{ \n- &eS}CQ>BV*%$iew )O<@PCX^ơFФ dk:}gwDP-$ Aē2C;#L(4$ճ-"HceN4+tgr]^g/5ۂvHZ( -m9$'cup^ -;kfI0ڬPx O ?|D=8ɃœDݰ7N 屧EHVKY/@z )#5⨦0;M7)7(1zo9Zo\zh8KWM&J\a ԐL> 1a|S)3 O'<o103PBjDYrǍEF2P 18=a싣5ΩT -Wh fE?Z$`mx1 V -<+pCRФA/D뫰$ V8 :;peptΥrCM@%-/fpX ȼ[Y X.i }n>>It;I}3%)rȾ[ - 3QC^!`zR&ϋO'eE%ƴh; u`_B i @WEvоqRѡ^0y8DiV ; Аh V7 S$fX';C)x13p:P rI_EW'1c.T+<PAh Hܓ[Qw>:*sKt0䝄>N"b..12CO@q)b\D'b0q|MBt.aA5][|+,AqŋAAKqEe,=}&z~3EO;~/So57lvEbY.~_^y/pkQendstream -endobj -1728 0 obj<>/XObject<<>>>>>>endobj -1729 0 obj<>stream -xX]S}Wtl-6ar -u] \l*yFf鞑m&U{|8}t dDYyѠwJgx=iyp9?8ԧič9^>ͳCjaßd4UXĉ0k:p*Dߟo> GW*Uһ <1>C}aw:+R %mo> D[;fn65?n3g.SE"ScÆ{\O44? -ԓHah.VQ@J<*z-8' U&&pϺG5h,= ސ 1hxCDeT4ڬQ-™UWԱ$Ƣ^EicP\#mrXxBDǛ* -.v|\f1qM TyuD@S匍LP,M&IuqUd3,DMYwA7zry4q^gruʻg|8sZ1BK&*tF_ыh r]ixQ kb%]z6iG*+ď{%VH-⠍`v!(q4Ǥ}@%i|@vr8J-md(Vj (R w*m]jo,=z۾Cn k sJǧטM!t -cX:LŇȌ5!O b;zaC 8is@uδA3S$#ǤٕޙnӊEz5~"x,о$B"`VVZOe'C6 @05 ܄rrp١[wVޔʿ"}QPxgKą Q+QtGcB*P -jE'iu>/XObject<<>>>>>>endobj -1731 0 obj<>stream -xXko6_q|Iص,bH,V 0sHx~璲xP5(J}s7!~Ft:ʪ`H'1cd1F8rrvJIN|8$;}xe)Vn@j hiQIR&l)ΔWFSiSSӋ*KrMIV`J!koH`(FJohm^G*IL*A ʖŠKW"8&3u5>$p 9}Q:7/v -G'QLJi8EBo}g8 sw^.i.IP~mԳ("uZDz!ڏ74BLSh n~g?k -d#`,cY xmBVA+Wt6Kt<aa} $tfJ@.|=FT]zeSzht~~Fw*ƙ㵭Fs9yy,+ȉۊ"i7xGW%PZd:=gi)8GPw -󳮓]ćwbhw\oH(nP, i{b _&6d4% $kT\=*$!--cu)XMtz[6TJ64t=VvQk}넿h5Z#W<ԀVJ Z:詷{뤝G utr- Zڲ5'K~tn": ]cо([Ep{1;#= -Zbfe'P ήnЏ6\N~M&{Lf4jvV07+B]]u= B2ocƙ܋I&N|0mХC *l\ -є0S,mםɸs ;˝hQ)_ vlk**/m68CcxH LE8N"ZkQh32S h^7wwk7NEpqZlhTޚ+ܭxY RseQ)yq`/IY*q)SAZ9?*VhyeWެ)9juξ\pbl$,nݒNANTpcuUՓ\1[NiںOSr^Vi5XUךIWmJRJTVI{]6 ۽H[,+@~?Y$Ǜ7:/ -Ύ+'|_]^н5A tm;j3[w㓳c\e${endstream -endobj -1732 0 obj<>/XObject<<>>>>>>endobj -1733 0 obj<>stream -xWmOHί߀HrĽ$Kސ-ٵΛ-%ٙgyfzХ~tѣEAա~k@ |JtWطw&8hu节9\CLPSSCN6,$݌O1&irEތ$1oIGƓQ]\RrC3IY i[tW~9WDtn^$tl4"Q8I0S+ 6ӝnuB*'Š(2t&(M2r4[5ڝ+re&;˔H%[z- RF~`Hc0k w˃>LFj"A NK`~ ݓ"e -RBfΞ#5=qXhZnBq\](mj*ӈ_>k/KI? o?`װC'np}և#Ki?rCmd&+a̕1,8Sa]Mb"8ܲH- -k 84oaaf,QV҅qq8#_MW4X{,Þ.49RDѹPVZ̷lEC/5X[x'jYxCڎ RtsgFkPҸukkGTݲdB*4W, ^hN}rh]RD419- (=q +ֳVD&-$EĘ";ivҠJ|o^nm 0 JViP*,(u -5MJlr9ci'/c4М }k A{quCܾnNϺ<t/ZY2 ~'l\ԡT -4 _+4\aqƏ,ܵzb{ +f?d䩁!\gyPZ_{n g[C9qR8?bx CY6(\Vػ,Ke_A543/w#HqՍ'k -Ƹ> IVuJ/~Yı]@{pjd,', -t瓛tN LHZ9huJpKFӰ~GN -:)jy߻7J׵r+γZ/&YoIF+/Fe/N뇛kz}h%k;uZo?[qCo.[*|t}Djendstream -endobj -1734 0 obj<>/XObject<<>>>>>>endobj -1735 0 obj<>stream -xRMO@+,P@ڨq KKSʂwJRGl6 ͼ73oK#*e.&aBqDon#QXԺ 9҂(a!ApE٩B\wNDhV/e-w٠P.۩CYdKZ\!O>-55=gxjVf-nTUnE[0D. 0y<3?&iҷ0fģ 4obbl}*endstream -endobj -1736 0 obj<>/XObject<<>>>>>>endobj -1737 0 obj<>stream -xWMOH+J\`$7 i3aicǽLU=*" իWL -t; eUrEyrGw<ÏT7wl|!=fWus{GiNs+ٗR54Kn[뜖m+29;hoyC},e -ʴ^/~ũATzː -z'6w +ΉFzFٽ zkg__ϓ~/)ŗ|vZ+`"PKhsHၤʭ1OLȼiPuRke*VX#Sh(k@2腬@<#D0ը T`b-anxaq}ޣ%-#N%gc]|%~ˡ' %*nG=fx'9 -\f'趗 qϏi+Cv[qEJ"τ8uB`aF@c(`{NFI^)W|oJ 'uNjY;`ᛏ Z -JsĘLv2{7)/Dr:?r^רnχKqrr;+"#e -p4s^rx؄kU{/wt?J/dWG{-SM4-CPQ^{ dDXՎҲ<9#QR#V#/ -6,|rjV;Kq%$TE"v63s~OHFu͂XkKQ\1F/Ţ%(Ax7m+Ehni5[*O[׊Cgtq8J}Fp,=ϣځkw6[ -s? qN[7-^pV._n?i] 6a2HO: ‚endstream -endobj -1738 0 obj<>/XObject<<>>>>>>endobj -1739 0 obj<>stream -xWr6|Wx:S{F-ɖN!M$XTidd vft3Zi::Oiq9Otq99M|p74[ѦV˫mr6NfW"gRW۲kO7ͰWOm۝[_[[DN״.|_ۤR*Lioʒvlv:=a}-+ {!EN-cɳɥ~%قd-s -ڶ۪V:tR-uSr[ONdEF am+UUer0gL#GOW-<TZj_.AY;U==WVV[j|T_U -TQ,geJw -h(` -`}}N Cؓs'F(Pu"eՈۈU0}X#qM_,Fsn.fkMRxJYm`/̶c~w=Ke7: hڣb~ND"%ZI!Ԥmѻi"Mk-h_Q͊$d+|ÚKL >l-ZgB" 8h -@^3i1 sl[r>{t2:^~ -o;nȣP[# -G;IɛEFB Þ%*ϡ`pWAXuD8Ja2%}Ό`;Xਔ9s@ wx豊Lޱ-X^ TT~s+1a5.pFy6xh2+{B݈KlbDM!(p`^5<m:&{BuexUVc /g+A'Ϣ"1^i@``a(6]<^';|9EPZ5.QkrH4"=0ty9\/' Zj's<{T+-Sc¡71oq_O<]_J& -?aWFI6!dx>Tļ5:we?F"WF9[kՂuk[~ͺ -w/gL5s˫dy9Ƿ9^8_7G \endstream -endobj -1740 0 obj<>/XObject<<>>>>>>endobj -1741 0 obj<>stream -xX]oF}ϯo!Zp0d ۗ -RmH}A{ؠH=w>1!U ;s䯳z@%yQߧ(TKCI!SsYҼ;%tB?_<+c'7ͻ[!A^o2R<]KrRm2IkQ&o%RȜk%ާ^<|[Y^(V+ @$*̮LB&eDғXebih.W -oTNF%B -(:51zqQ+ jY0ڟF^`q:7:7*O[XPm/tx_ϟY~:1{!s^`4 S1_?Foa%5qcoNk Z}:X{]zR>yU࿣@?o8U~ⴇ_־oWbNG:`?su H+Fe=8XrÀOd +}^a -T<}KGz+_\ -fS2q :q].rhJ`*,x#V=Ǵi$r] ~&0?Z=3E5l9)k뉡DDc*B ᜙ <˜nCAMEKfrF@*6o`0`GTP٠."w6%>mn k%g%#v -'`rT?2hҋZgc.ҀH<㰷Z=c09̻xj.eHtR5 %269/hN=h5FKH6ǩ:o*hn?=l\a4*g*WP(s˨v7#hhЖۼ]32",w\NIl9c]!{,(]媲t^#ssвZ(,%FWE"Q<mcM.i}0՜vug>m)W9;/U}:W^ ڂ:F64"i-|eZ4o7gUWUR\ -^.r5Jk\v/4M*-DdzCew׬'{-< - -kF[hߝbǝӸ 4`V~OPpKO{)>/XObject<<>>>>>>endobj -1743 0 obj<>stream -xWnF}Ẉ]HHR-$i4+X:K,)Ҭ -He\^vsS/!B:h4tӛ-{ 5-o`<"a0i\I\D".ǙO8?\~ i*)fbt3o e$RF"etRKy7DB;En;¿[t^jƥ"+6[ !6S}*4mt*UPm^D5GlBoIoxNQ@SbO+, [hx )C[sp_[ՆbMKpD4٧"]]x-"ֹu*3GVև#yO2Oyq'\-.yP `3.:z,3bNs."iN^Zr&0)a=ՎNt`\xsةuFVhBy*Q9SUŽkYC$q ت"N -`Z]B}{zEkI@ E;%O5!9ӢD[WY^5YYU\b05/ΧCBQ'tIYx֮]TJU( JeMM.GGpVƣ%_4譴F-u@!g'݊FW?iA :1g>u@'b{ :>:{\ECAPPπ\}Hkoܻfd>P },O\hR}-rgo~SޤWR|ZA\6C ?*J+صϘx[!t[mqV6+3Bwx `yL1:mѯ+"m'Frtft}9Ey%)eFG!c,Vii5L ;udB'J< q6IjU-~}5`Fj $wxB:a/&ok4ޏ꺮ܖESkb"7T))ѨBIudDc7lJFT< !r(/2'4&?!_Yxʻ|t:8endstream -endobj -1744 0 obj<>/XObject<<>>>>>>endobj -1745 0 obj<>stream -xWnF}W he@4J -0VRژU./ -4uj4o;s̙_f"r4f4q<[^௒֣3cZXX^:#>:*-0!TTT -dEɌ8]M#=DKH1~:49]+ sY5Sӭ -7#`Mח>^Ǜ /9R|y?8:7=MQC0XNhSxY -:G y~1>"i/n~p_xG¼{+fI/-$L^?WYc+ ܥGYɥo{mTng*mPP-J:i BVe-m{R}I/HvJP4C&MjBgvBL]d83\xPddmN#CBPsSe+u 3bN䔚rϖpIB?ɪLF4M)Ķ67>ԖgmE4b_lA jZZncjg e1O1ڙG^p9Ydx-Sǧn@=-̗OL@qvz)9bf^;y4gUٔooWwHmI.r838y'Si!&:b?PeSeMazR 2ZIw 0jn`@9֪R]hw;Ѡ_%..ma)Ʀ%Gihh#mz[G=0GnBF{nW:ÞVk{f+<{ [#g`€s M~"|5{fc&Bi RAGZÏji?وں+ЮnصTr#/|IY+RsQ{QX2 -\ } Sdx {MXUu`Uu-ۭ>1P6_{tBZ_@b@=,i~nAݚ̏Rr>/XObject<<>>>>>>endobj -1747 0 obj<>stream +}J'1)eu%,ٻEvZ|Ρ@kсC?JO!pEgm6K `rskWTڞv*`8;9sYofNfK dpQbwȐOGD 3:-`sBbrj?&yڰ8ͻQf,9yyL˺OVV@܂`/>lLp:)\9`*Z`[w[tE19eqCƴ5 [l;p\BsjE*%Qs,Ԃ@y.)?fvJd+Nb=0K˴[R{ʆLk"FHR)ovSjݾ )$ @41h|ǵ;^w'ak$B?kr1v= +N҅%^T=Yf)1WX8[&?Q/l$;-1roS1^zr޶V]k.f#tik0S#-S) C9ByԂ;&R`⥌E_45z6U'N"1j&v5x>[|BYx~ o ? ]<jbtSގz?7m&endstream +endobj +1736 0 obj<>/XObject<<>>>>>>endobj +1737 0 obj<>stream +xWn6}W ܇zD$d-iKa} Pmq#*I IɎ66Ab[Μ99Cs1)~gt;4|on=bnhVKfMFoV`7KvD;W>/M4,:xU*GUIrKI"HZ3UJ2Z&F墪T +MwҒY'\m` (t5}cnJ:l79fw/LYJS9^3Fm[s,[kX.wHn?+/F$ •RpclA'HXy-Ӹ#$ilkUJ.r(Z6Gۗy)Ę%*t_9zwܼ#r B%ZTS=]i>I1Ž3!_A!zXsf?kх>{'ؿ߹gTBـ:yIR% ˃T˼@Ws*>G<J\Us ]LPmxJQ2t)!狨 !+i֒񲈁[CJpI'5- !qhKZukguPghj'YVk1UCP=.3 +{fzt߉z-tLmc} f[nAXm!Vrr;Vyb3 O2 *n,/М H/ +ԃ<( ꖽ0uZ\(-CZ"x3lH'5)mʽOFXE͜|x{w dTjC$]cA\*l-6+@Vj +=f da؎9 p +L 1fx4bL#H@ Ee7~nXB5pG?8{n`Zc9+8R4\BNV0>~>IkPG.[+pb^aqRASt^’7b8[$gtj0[h=vn>sqm'@L"ne0bm(vr`'mv*Ӻ$q̔@ A>o"Fnm(4lF]0ΟyZ?/?= 8,JiQKw&ϹlI"fX )}qRѱ^0y8DajV ;Аh V7 Sa3hx,J!<Kgn:PsrI[_F/1{c.T+<PAh Hܓ;Q>:*uwsKt0 B&|1-ӡIc`Jgn;8M1\."A`8cX!1u_ U#hkKq|7a#x1.(wIg \qK-pO_ LS_u n[.[Ct>c.kWendstream +endobj +1738 0 obj<>/XObject<<>>>>>>endobj +1739 0 obj<>stream +xX]S;}Wtl]p nZ \l*<# +3D`{gdIսIm>R>}CNGt<<x?S״<}/qc|9`@?|5x1э*u.mϦ;?&7W7ӫ_4Y{f2M&5vE_1|̆hha +`u$^+;U6E|}8\p̟\ V! 68~~hWJ].䖴7@m}f{\:+ +vL) +emj~f6]6`CEVdž :+GOh8l( ԓHah.VQ@J<*z-8' U&&pϺO5h,= 1hxCDeT4ڬQ-™UWԱ$Ƣ^EicP\#mrHhBDȧ* +.v|\f1qM TyuD1@S匍LP,M&IuqMd3,DMYwA7zry4q^gruʻg|8sZ1BK&*tF_ыh r]ixQ kb%]z6iO*+ď{%VH-⠍`v!(q4Ǥ}@%i|@vr8J-md(Vj (R w*m]jo,=z۾Cn  O1C2"HukC$ņw +ǷF>}]p^Ҏ6q +igIFI+F3 ;,kJD20*XցM )}HEFpN t%l`V{1"<jkI uHYCz#)E[̳Ζ\M VZ^t= AunlwRM!(Wy5 "Ѵ:RM4fŋ`jP }2-G5`Gdj'˃#bMo?]m->J4J$omIf"֊f</S"+J:E8c6ZV.4P!W90;y[R܃k9(ڲn3JxVj&n#mYjTO&$$&ԋo};;=|> 1OOΧt2,6 盽tw:߯Og# +σMVendstream +endobj +1740 0 obj<>/XObject<<>>>>>>endobj +1741 0 obj<>stream +xXko6_q|Iص,Ma@f qX[Q@@KTE"UJKʎAڠ@+qιވч1PV C: =_+ػH_hDI#'( d^UoO, H #M#-*Iʑ䗒2-!9C"ҙh*yljzVeI2)CZ*pPi6% ?:Ł6A|@ -m+@8iI9(ARXyi*#Sg5d'r;J._$ʒQ) H6bi dN= %E; ʯz>Zd4W\/DFibܣ?oɜ +UJvk̼"Mq "]Lx " %t 1k/M*hc~fIὀ8MNi:I.p@B;gF{ L<7iDiHCd9BYha `uHbmӶ78DG%5fG2U +^Պ gͣR=ʏZǑ-jӥWV=,=YFggt2k)<^zl42wwj.iH} wtYr~EӃy˻; ugۺ9;:<y#yuJR Ap7 hnCH֮-MSIFj:ՓQRN^#2V"HPGeSi@ŭdCCgmcm'ENN:Y5rC oѠs{zNi{ZPAg)2 Bš-Zs2/GW&r![;F {xV~U73Z<@Kp*q;,mlV(x̛|R;N,4l%x(wtT袿|揫 as9|dr?;OdvMh7~m|3"Ե>}וQsހ/-v? =&,m91̽dc뀼6j ]<;0&0jM1by٘>ǰܹƌʜ` ζ֬BxlCDJ8g2.iw"XBE*Tl@krمJʰ].7-/,v2`-4hߓʀB.6c5o frg$~DxjCq:mj N`@8iV=SL&k$Z>c^ +D11PKg&祌.B?y nͭ~,Lrla_$%CY1xUk +`,V""QZ▃(,A. uHƝ&1cqRC5ܒy[,<W*\(; 6 }<o$@Ѩ5m孍W[<ʢ&7)Rp7._zu(UR|4s +~T|YSs}I2:Yhۻ%X) \Gb Ӵun弬4kiϫ5ڶЕБ4h.M5\m@{%iHY;WhCG0Hٱקot_W? N2?8;kd wp!f C\|oMON'?qGl`/!endstream +endobj +1742 0 obj<>/XObject<<>>>>>>endobj +1743 0 obj<>stream +xWmOHί$E#U'Y6lwͮ 3k;o{wggyA:yC҃NCAkHs|JZtطw:8hv蒂^CLPSSCN6,%]L1WwqzYތ$1oIG&ӛq]\RrCsIOIKi[tW~9WDtnQ$tl4"Q8I0S+ 6ӭnuB*'Š(2t.(M2r4_5](re&;ˌH%[z) RF~`Hc0k w˃>LFj"AKN")&cA>J|_&'E4@. +[3̂=Gj{.>7ѴNNs_TT129!:— 8|8aHO1G a39i_ >LV$n+cYp +öD"qu˖g;C#Ld*1J&м aDEXIc}|5]ѴNs$ua"΅=Uh.xEdUf+rz=Z;qmVězvlr &87j]ƍCXT] >%2/LVIbY2@pC` +-^Jw|`k7ch ԧc j<&ig , ǁWL:~?y8(%%"p4h-zgnѰbލJ/@+魐O( gƀdKLNWpІ#R*k4s q DB&%z¨B}{PllU>mGnCDxQaТtFwJ~EHdbvbpw2/24Q? +?BDh\ 1 0<#&_Bؙrty) )Z(WM0T3S# 0*Ur'(\ ه:JkeKC2,}=ݵ~ђZOl/pct<502K,/ JkkOxR x H@3'N*R3W 2zf>#q6+j5{7{`0y 1K#ƌf~f%3n)bvs-UQAקC3ܪV/ך8Ѡ hOSNMO$%Uvu;nz[|z=Iݹ A+Mr9NN~)(tOUIIYCX E-{FVNx_xyR d-w +QtxYpivu}ExLTz`N~+nmEkxCeހ`rendstream +endobj +1744 0 obj<>/XObject<<>>>>>>endobj +1745 0 obj<>stream +xRn0s\^qHUsh +GLBpw AJՇbYݙ} $f`!L.+@endstream +endobj +1746 0 obj<>/XObject<<>>>>>>endobj +1747 0 obj<>stream +xWQOH~Wx)H7(W rR鴱^]߮4!1<*Jo'S¿)h>Jz>Ong +Mfӓ˯hvEiP[JsB+|})Uj =֍wʻm0vMRPJJMr1F4?cӄo%W쟍\t?2I{:SpJ@jʚPjGd%eѶ )K*t*ZNU4bNH^t1wB]R 1Xl !R*Q됰O4)_:ƶv {R{ ִKe:o)w`]R+-eLJڑZPNYϐHvP4RA.p{Sg j3_KTVZ[n0Ը+D>Lf̜.j1-kƷgalA'xJAhj /^bm4Ui]{J<]>> Y}V/dF3QXʼꄠNfa|yDne֨)HB7O~AWS1!SZxWKczy ǧQ: ʊf>s=ā =D[_.C~<.zi%]>%ʠ3waME&u$1JvF5KjL㊇z_5zXȗu KYP=DջS#R +T>҂n{蓢l젽ky= *Tf*b0{D;SmU.Cv*8x 5\8'*Ufr4{9rr}N)ೃ*^x]$ZqECJ$6Vn͈ybBMڬے(S""#@=Da-~?^.2hD/duIX%FMˎ~a s[ ;MDv(iq",8K *,/[=h(VtTpsgd=1K=!Q(]W2;ADP5{~LX ߊSG,PeG.SzQ|&̬1-bDuG 3ҼJC#~dyGL{R餯 6{ 4?GbNf'`-x Z&HC5^A:XP]Qn|s9ogq́28_L/97FE<@lBۍΊC +*V ;%˗f2+ڣ&ѡG(g(W dDXՎҲ<9#QR#V'/6,|rjV;Kq%$TE"v63w~OHFu͂XkKQ\1F/Ţ%(Ax7m/Ehne5[*O[׊Cgtq8J}Fp,=ϣځkw6[ +s? qN[nZq]~}}ħv^t`2HO: fendstream +endobj +1748 0 obj<>/XObject<<>>>>>>endobj +1749 0 obj<>stream +xW]s6|tDÖN!M$X߽0ALiSZh<$_͒]^/z\>yŇ.icaɄlzl%vrh)s2Yɳ-ߙjKծ6wuŁnPn +M{SEMےoT ́eznNQ-N..4#Мr*c qYVy;mFW6;2SZ(;r6:#(*Rfa>69#GՏW%`}]Nq CؓsG†ߵN([@jm*.>,zu/`73{d JtNXm`Ͷe~w=աtfz4P1L'\BT9-ʋ@;Rhp"$ડVo/?(- s:a]mh,'-j4gA4A̡ qy-çubxkU[Trhs>I!lM"4VUfE9O%>`MPlP&,aK 4d$HCh!jPk`&m-D5a}Cl*͞G[v@>=!z :0{tC%U>ku#yS_$(|\2 Der#s5H+֙κx͔68>gFp0XBw,p=7tj衊LީYN Tʍt<x~&eB<Ƣ](6啩.4by$lh$%"wjoP[cҕ>sm]&FׅI?kUc/mj ZN̓ AYrW`^;6 >87.m!31n\+PEil乖p4_Cm/`(DrYhn8&V^f_ cp sB$"tD +!2?p_wX7o?$O_X+J( +̬rc8FڻA(wȬu#.r 6T;Xh!]-<WY}5[ +:gH]uWRM,L <F)Pė? $&1^zKU#U<,D1Cts5:~X]B W=EG}أd]aП#mytJ2 U@t 5v?"պH!;$t&-) 7x7_紘׭ۏo7nw6mKܽ?1_.josX8-y?NpGendstream +endobj +1750 0 obj<>/XObject<<>>>>>>endobj +1751 0 obj<>stream +xXn6}W[Xv @m}1Pms#(^dYRȴHr04_L#O(ٜ̞NoP|AOKL0Hi CzJzatwji()1dE.KZzgT.糧vAq Fֻ~w2$(ћmQʔR'Wy)TR7UVm&i_V[Ika2;eɇij,DFRXi}˵Tb JZafP&E!O"OQl22k7*'7D!tp iX@ar:ĥZUf4D޵΍Je'ֿT[Ke<<>/n7g޻ς芏=w9u/0)Û 渱:e ۧSށ:^׃QVէ?NubAW%~foitND_־oWbwu/yAlJQYiz?' + Srԍss +uWxf"AAI" d^.l@zXx(Nkﲴ-ԘC RpϹ\3i[ r;*͡ȩɩ! !}hV֩P6HXx [wwߛIzZLBEX 52xmȴxsf[$8B_'ՋM2>ҳZgc.ҀH<㰷Z=c09̻xj!eHnuR5 %269/hm%A$h]~owa*:WJcYdʵ.T)JD`'2zQhm^a. +; +m.m]payG[Tap>@FWlԢ/ @UpkOGXFKwsí @5rpiϠ侴ɔ+*^+C/pmqTs# w)gʖ>_2yap3+T*KY)xQ^j/j^b5.qKVD&W١k֣k}=P~E 5-N1{i\w0+ f}ا^[y>/XObject<<>>>>>>endobj +1753 0 obj<>stream +xWnF}Ẉ]H /E rZ# +bem1wi%EU@l}~/㐢1l9xƧ״Ń|}ZUR(of ,p=q&9>C\-%j-y{)HDJtRKy戂7 +EB[Ev[¿]t^jƥ"#6KC\V дU^(TAqZj'ҷݭ^c;bzKxÛt +=BcZaTo:Ekk4Vzkp-{CzER46[&TR0BHun,msRqHSʧK|P `3.zz,+]&:DB%1:.~ f?{Lȃ-Q;Xʌ` qt゛NtHm0D~΋Ti,X^Βl&3MeF?wRӢ(C++bL(RMM-y7.&,yP ɹ$&$TߺΊBm\p>%ʞ8ѕH³n5ZTR рnTVj6@ls\P(~ΊxԶ$Өh8d;dz[h~'GFv̅ 2FMGq7# M,P4 E (x:ƽkFg]eYK~/匠^7.wM}1uMzQ,ŇHŕ]2G%PipUo#€ؼ$0V8wD+3Bw8 2`yL1zm1l*&m'Ze9X3q"Ezh۔Yp2B[#1MӴ*5L7EXo(RRY FIu=g7}7E?bO+}e|c G͆ѱϟyGS}9܄'+K8O!>Z;_?<8endstream +endobj +1754 0 obj<>/XObject<<>>>>>>endobj +1755 0 obj<>stream +xWnF}W he@J -0VRژU./ +4uj4o;s̙ߣf,r4f4q<9?1_%)]F7'Ǵʱdq~FlFt|(VRaRQP)+d?7zTQF(k62SoVG3(YTTO[(Jo?ԮRF@)2aIlI`S9iVi $3 7yX8-: %@,G&o0y\e.pBrJ"gB'SQAAY(!"lPI.ٶ2Z}F[ZK$Ec ^6픮hLՄm,qgV񨡚"λ$bG91ۇr +A(˨WjEghɜ)5-B~U'i*!<S=R^M mn|}?- aۊhľ0@8i'0=FTb샟b|3#NDžs +ZOzZ/h8#+Sr4Ӄ̼w7itGs("A)=-\V]}pfqSOrC>Ltľ:L[?˦ʚXd;A`/$sfU* 2ﶂAxW JKW]T]2ŽoPMK|tdFt'lC(zga\t'ʵh +>Xt=-WVy-@쉷wA`%MMe E4}kvrSduFA(|+ d.|h^n + +RouW]Wk+L'K_J  'U +"8z![wBle2u[#B;0[zO_ .z t7}bm׻M%l鄀& +y[{XzkN 6*4݂ݚK{*t\,UG-tgB@|pb&dHM3>0>p…[&+C|0Zlur:YyJ*cPg]=__Z-$S5J%:Җ̤5B?=$,PK/ #J +G k{6Lqfߜ7/w>]E_*!&^9mLfVГy8Mو\F<~endstream +endobj +1756 0 obj<>/XObject<<>>>>>>endobj +1757 0 obj<>stream xW]oH}ϯSAIH6mWcU.1aه=N dH !gǹss0 LrFgsd<9_]3$h9M2(!L(OPZJ55%eź(s/fX_YU!U=CY\i~X >@FI%hz6iYZ:7 R*\wTh3c)3TjcUNQ G^5Wkp.=,R c,fJ&CdQ"B;6gg;bI UaukdKVj)kΦ?c6F$l3ePUMoh'I/9oR~ڑlJJ4[v1\ys4ρ5Bf~ⱷ=-ƐNl D~%!ǐ Q9W@A{ϟ>yBT;bir{!ZՕ;6h-Gha Lzm8ƯJid=Dc4µ1P -s )5\DܗSS\N@Vp"&GFZ(:D]= ՍD#]Kf6T>ڴvi1HP4YF)|(V9=I+zO=$4וķM{!ncNOHbB[x͐-bt"r'"˙/Fwl܄6?L_K%LJQ EՐU:L -%5HNOAaր0(/~L0^Ct^N"Uǜ퓶wGzIdB} :/ՇkBYGgnO1-zPO?ӗG6FSȳVY"? @2}-B=U%!5L6st/ +~;EڭM-OV6ߺjiXCr}l[ a蔹A6|{aq̯{%`ـ/r.a7#-tA_fhW.q- ;uur s;4#$ -zXx:醴$۰ǎD!5JgY]ro` _/Qb>҃ʛ? k/).5op]f9AvYYU9*ު U u^x]ѭρb;v[LڏIAᯧgQF}< -2?3As$#b~UgAIYK*& 9g |x~ 'a{o݈e54!MFѾ׭0t\ it8W=Yl@9by0mV\ǂuf/B3QaW[vsF: M99}=R`K,}>/XObject<<>>>>>>endobj -1749 0 obj<>stream +1758 0 obj<>/XObject<<>>>>>>endobj +1759 0 obj<>stream xW[OF~ϯ8 I UDhQEH[al/d76vR!D\Ιsɗސ| i:¬{>3oB')>[H{Uop}B!b̦}VB~-i*U\W8XnDIRR1 PHrM2,'DXT"ź.eAAcU>|Y[U< U=ytvI< ZF?n4I"H[Q`96I悳x.aM"-ߦq#k-K-Pe P1֎I+J4D)PAk"J")`ŗUG}DKPg*iduUmI=B,NU ҿpO MCsbG=?:Nо7xPxCw紓ᩐ, .mkT>˔irjsh‘.)ÖëVRG cnig[>Y,Mf%j)έ:zţ -7Г(D&ނ]@»$6n (@P7< *Qhj$Ӻ9ReDwו3$ j[H݋[HF<#m芮qVi66Ѡ޻Ms%J4󽓧H\ UtyW)K }/:Cdtzn8|Nsp}FC<}lH?yS@˜5k˻ۋ=)2.q\ Lh~,`fIR@PSO,D;S{7s9,+#H2^5,@AHf0L7vʾ=^W})lsK|i2=eap_Ϙ aI|{ᩙ ѯ>_ߴNG0X>5mWｿdRendstream +7Г(D&ނ]@»$6n (@P7< *Qhj$Ӻ9ReDwו3$ j[H݋[HF<#m芮qVi66Ѡ޻Ms%J4󽓧H\ UtyW)K }/:Cdtzn8|Nsp}FC<}lH?GK~eΚ̵žgv +">OL}Vbe.pB1:mTJ(RXV+}dՑ? +'ɢڌrPZwv-[>YƤk8A!#%qi\'쁨0g<m!ݒL3? ??YtXkUD_~2-[!8%hi:r we6\H@5z" d爭P}Umt<㈎i:Z=m,~ qc|lS+.c.+nOF>/XObject<<>>>>>>endobj -1751 0 obj<>stream +1760 0 obj<>/XObject<<>>>>>>endobj +1761 0 obj<>stream xWnF}WL6uCl46J  -eEč]KZ,)Kk( ;!9s̅^ M4PZ^>Mfͦ<N<.>~ؚLɌROz0Kf }vUj얼*׊jGkMuTՇ7X XN \r>R{9 i]ULBih} eI:\Ƴk|BTϱ>Fɐ}TkJ٦\܆vR% lZSijz^?|"\j2vzoa9( qiwץ4J^&Ra^CEyu7T |dpV2^-uqE1s -A?#kۑ5X;`Req16;X`m jSbV`P aWDDwvi^9kЭOqۭF;!|d-当4X?HmP&:l1'3^}fҥh3A및\t}#̶شhcK̶E5VOE:Yi$vǧ Ye5n6T6×r  Éo=)O,F#iy=endstream +eEč]KZ,)Kk( ;!9s̅^ M4PZ^>Mfͦ<N<.>~ؚLɌROzOf }vUj얼*׊jGkMuTՇ7X XN \r>R{9 i]ULBih} eI:\Ƴk|BTϱ>Fɐ}TkJ٦\܆vR% lZSijz^?|"\j2vzoa9( qiwץ4J^&Ra^CEyu7T |dpV2^-uqE1s +A?#kۑ5X;`Req16;X`m jSbV`P aWDDwvi^9kЭOqۭF;!|d-当4X?HmP&:l1'3^}fҥh3A및\t}#̶شhcK̶E5VOE:Yi$vǧ Ye5n6T6×r  Éo=)O,KшA|Z^ud\(endstream endobj -1752 0 obj<>/XObject<<>>>>>>endobj -1753 0 obj<>stream +1762 0 obj<>/XObject<<>>>>>>endobj +1763 0 obj<>stream xVMo8W ri -Xd9[nrɅ(DjEj>(EaMrͼ7wSWL%JEF5w[<%Bd w×51r$t !dBI, d3x*}cmD -3bMCҝt7,ɝ&<`V4m-XmP! -Jĕ5hSGIBr\eJ/IXRŐq08iDA+i̋6G-][4g?ʑk EUImI::"#U+BYtzH8' -iҢa)=^td 뙒`YUW\ 7ܔ| !%;Qxܯ$ѩAݞP?Ĭ6N2i=l挧ZPYˬ}QvֶF ŽZvKjJ{ ʋe"(e ,I?QAs3jSUuꄨ#b2W?5J2f7jG~IOG!LJx ]5p o"$D8 -8gpԓ*=u~d:?ZS?2<&"hC0zMM(+X:n=SsN{Q]X®apKpMSDє%mԎS@X01ES:zgfg/c [zd9=N58?Nfށi,:ŝT!@w7>oxYZ 2SC@-!^k?թeH{rXR&P۴x}Pf?}D滄9~6iS>Á`]כ]Z?YsGijendstream -endobj -1754 0 obj<>/XObject<<>>>>/Annots 1005 0 R>>endobj -1755 0 obj<>stream -xVM6W CZ\Hݤnrv]E%ItIʎ}ߐ(Y dg 罙1M7ՔfKJ$_h%4E棠gIqGjhJI<6_|t ֟/5ki|Ϟ~ttfM m\6K:|uDou:*5꽣7:Ɍ6/O2|X'KrFJ=2lU81R#Bѻ -)]`:G -aW jCovFT&-.,=YyFx^ -}P(䙏*L:myS< \84$D_YJ2ڤrJ6ۑ( -}G:4l㊓PHTeD Y$)#0"DF(D{IFRIBgF"5poGHmgN^_:i]QcF/͕ւS)\Y8]/Ri*I!ÆXL P0הTE9k 0|K}&Yq|yFj5Y_}mDoCd\l!#?mDVVa7F9(S|)6r]G -D=OW q[BkP+Ϟ-Q[R }Ƿl;O]xpMРk(YR%HW]mZ @w͖ܻ =,Ց 0Q[h՟o:ʛYNtV "@} 8؎۶oGUP/^hX-}!+y&¿c~HKBڦas]Y -GiJey) Kꏵ)WhtTWc)fl\*㠛QYMaמL/^T)J{gb `0!WFIA/*U؋ FXK8aᕗI+譹xP? R& -SW yKVWfL] nY/b(Kendstream -endobj -1756 0 obj<>/XObject<<>>>>>>endobj -1757 0 obj<>stream -xuAs01GҔ[;N/\JJ2>&mi -Ì-?g -MhRgxAyKZ+tRՑ7}xǚ}g+JXvԛ:- ]zzA7ق4]9:2.IkH -MttsD**,Qvo_OKSendstream -endobj -1758 0 obj<>/XObject<<>>>>>>endobj -1759 0 obj<>stream -xV]o6}ϯ)K>t[]ax]u(hHJRqw.I%KD/ǹ {Abͩ6ܬ\*bw5sZohWF^tWz!žQa{KFW/beV%n,2鼅t$j}7Xo%-rV|VwR^PͯңXMStA[?ݞWWcH>/XObject<<>>>>/Annots 1010 0 R>>endobj -1761 0 obj<>stream -xVMo8W ziK?m6E{(PeH쨇[e ̛ u ? -S7~œK]K.K^*.l5xOJ{t7؎!"C-ہ~J^V)CmAta#sʄǐ{42kzm{ -NE)|l?])L0cgbt3V#"  !EvNYhըi#muC1Dd| M?0Kik .N1"`-8zĴS?BnD"zqܨ+7TLAދ ںNnCO)ԣhv r/{ztNoG.Yys4tt^łAa֨AtnZ(e1}4ބ.r@!O5 ᖒGf`r=S*tYvgdx^^Z(XiG3x^n'ƍq>ԁN*`bxj4?gT / m5OչW;0$jq=w{X6p LCCC -[l2Ȧ?Wj -3}״ykb۪bs su8OvיKERVt8xXܰ y!S+C^) %57ʶXKh -e(Az2{(A|)Xc @v݊COd7UFd.w;vW6︞hsFxbx/xeÆ$[כ_J endstream -endobj -1762 0 obj<>/XObject<<>>>>/Annots 1013 0 R>>endobj -1763 0 obj<>stream +X>A@MwaBKF""U5~P(EaMrͼ7wSWL5e" +#Z]V IEz!M6vp_|8}$9!A>Ԣ6ۂLPV*%lFOZth3aqX)Hێ|%:lԩ$emEK4(B\pf8ujq(%+IPn*l%\ GKcFipNp'^䬶=hB98$ IԵԖA)s2c :ˡ*u@硷s]Y&-֑3$`EGF) Ɵ尯K䊂:\sSn%0tlt0DVTqDAw;BIfF;9O$J=yDCe#BEYFf8Pjj+- bjd&D!j/D +oL¨F:Ɔ,?UUߩ^?"&Skq#[gaPLfPzF'bFScBcrM18C 'QG!LR?:L/GgGd]Dt<. Ӑ)GzΡ&>zxמuz3u׍!V{"ܒ8= ,@a4e.cۺ6L霋âOrKgy3󳗱{儝`@em IꝞ{ mK|C\y;@tcNAy^*l@w=o|ӳRd{1L)sdjp2[B c vpyj\:J;i;6t}znw sl},8/# &-!p}+~?%hendstream +endobj +1764 0 obj<>/XObject<<>>>>/Annots 1012 0 R>>endobj +1765 0 obj<>stream +xVM6W CZ I(uqD[L$);}CJdQh$97f4ߘVS-)-h_"T|͛W%q-I4j+%MѴ%ͦKv|q;8oٓo}a3YtB-W<$dE8w:$Qf譲RIdFkUȗO sx>%JJ2D6*)1kStR5`toSl;4K:T2ip)dvdATpRJEAG%O|2UԙJI0ų˅›]eDj:g}&E `0*iM]r-Tۑ( +sCjjG +Bli aћoOˆRwj_s95Z46Oƥv^9FN%%*j4MDpNh3u/ ^c +l?%_&m]J +B<{L"F~nI5LMk8[&a {8(MgwiGtqޒWlEwҟm;۳\&P)S؃QqC5b1Q +OhB]I? gUx%X nuV5uч\{D +i Z'#}&~JJ![h +\)3b?}ۗmz8XyV\^ gzAniN'I?;YɟX6"ՇUPLc2z_7 ݵedm" U<7^'O@п{?S(cI1pw_ӹ4~}v8zM7ZSX2+t%ͺtl3P seXVƉq/p7EZ`A{/vܶx8AzNG&bZh[JV=X}ћM%ω(MM#.AX[*$,U?֦\}JtYPA[^tЏ[2QBϻ\g6crjnȭ&v|y-@x`lendstream +endobj +1766 0 obj<>/XObject<<>>>>>>endobj +1767 0 obj<>stream +xuOo0 -j7S=r۰vEZm,y~OmY a㏏HhoBdX+,^Ӻ92$˃f$bCg\nSO= ү(C8;c_U²޴ I蒜ӓ"ڽ,V9w֑xtLX{GRhҦ5 +.! TRB=%i ebSyT=N2AЉ c]dEiX RYX>Gq+oAxK`Mc6_ LnwIG%#4×.&ajJ M3AɁaAhIHgeZiux@jTIQ-J"49+ɡva3:v|Q{DQleȢ2 F +Srrb"4]oZ [PVID:16WT<(LV +BJnʱl=5mcw=:'Y"|lIY%0yRMX 4lkkn.!54JvY}dаJ)q uj\F QLSK".2J6i\ZO5/Xz41&f2)/UdmVw?6_EߦX&Y>8Eendstream +endobj +1768 0 obj<>/XObject<<>>>>>>endobj +1769 0 obj<>stream +xV]o6}ϯ)K>t[]ax]u(hHJRqw.I%KD/ǹ {Abͩ6ܬ\*bw5sZohWF^tW"[/7>lo5(j%8XY +čEF70^DW4]+M"].ي/N*r *UztCi*.?hV#ۓj?pN9RBA9Op +s-ʘR9Gh#xipQjBFv$Z<(H4MOPYx*:j8!c 3ZV*` 9я&YS%C':E5Wn#p S+@ ,i + rl^<QwT:?#<u"9X⛔^bM̜y~jĻ8HL6Aԟ ڳl1DrׅUl";'{,yjT 4϶֡eg"_2>%lBGݴEF`=b!Y7f" +EWF?fnԎBho rE}m]'TMUW7M!TQU;qj=v:#9rۇy:T:b 0kTJ :7oBXGMAoI +phalHpK#YSJ9ȞG ,A32[gű ^InšWQ*E2ˌ;~}rM+w\O9#r<1Y^_] SaCkJendstream +endobj +1772 0 obj<>/XObject<<>>>>/Annots 1020 0 R>>endobj +1773 0 obj<>stream xeQr0qnɴ%6EQji+v: z#c#PH4}2^wX3,G.9}/'#mJՆbAiCd[uK -稛Y7j_\ 8>Ѕ0e<̎zPC0g&ϬO^.0 -Mi5vhtY}bLa#t_x^B !A7h -#mœ%iendstream -endobj -1764 0 obj<>/XObject<<>>>>>>endobj -1765 0 obj<>stream -xWMo7WMI!I@Ӥz( ;2%$ײ} w%YH°.g{o&\Li)]h'l<5^6z9^l:^~uq & V%!/>TM]nKwY:?j@>K]w肦課OL;ɤdKJR9 joP]&H6Q]26ɸDQL{1*z5I䊊irF.&Sz1mq0G/gc+ -NH6u?7}*6IKS%~lQ.E[2}EåIrv>܏JޘNgh:w -˩R.iW٢FHs3=p!yVœAɗD*m@z/ GGP)5ǖ 顫!뚵%/%AZ`#ژx -^ɑd~յߍPR9|RۏȷšY Xn5"xI -wڴVZf6wH=m~񯙌z3k! m[_)te4yL7jaov(d䨧5 4-:)kTR܈P$Nٴ:vAJ@gh>C{C13}XtpIxf Rހ3 wL (+Ŏ xH Fc½ZB#6&vbFuq>wnX. 1(;Rab jObH܊vj>;ƋgϨa8UPĶG`8[sø0)z۪;IdgS.$!~8B#śɥ^)kNi -o1j|E{ŁKnULPN{d0K\{\f :M;4 ǏPg)ut{qVŨmHrl[L=CO1T˚dQπc+t.jagq}٩*_3BD *j )z7tv='{v8GX&utg񠖽;LG-yx!Q KFIUêmMiUa'+Jng,\PxMvR^9l2֗%=[(>|:ֈMv5i \U.>/XObject<<>>>>>>endobj -1767 0 obj<>stream +稛`5/. WwOwBlgfG=!qg}baTHҧJJYۦ;4z q:>o1w0y:/{:7zMLeDto#!br-htʋm{['_/mendstream +endobj +1774 0 obj<>/XObject<<>>>>>>endobj +1775 0 obj<>stream +xWMoFWMI"N4 4M +ȕ1.-,)B;3o{3"9~r.hgsz +Z\s_i+7׫lygWP1AV7RP.jO";]ݩv^˛uzb| >Z\#CƭV,ێ0";U84 c0X2x{3z?PoνiRe;զTqw-Kצ -G$[5=hC,9i T GGڣ SM:t4@} 4ZZHn}3lh60xW2/?9qJ+Ì\ǬOMg%}"4Y$- AKӂmD­)+B$YҏjK87 [ʡ;(;)yHk~U@ׅ| +Cwr:!!|~)ꩪGMCGM3N +~ꯠ(5T 7o/ ga]{)]GA3d@)Q#áBy4!SOiL6u fr42tX +8XY\avJǃ g8Ă:1uʠэy]]`)uHt;d\-SutgN;wܕ+$^[j%A"@V΢c?TU iDa'+ʸn(g9aVZ]PxMR^9wl2֗$#[[(>|:ֈ-#jbB*SylTpV}v/i?/^9q}ſkendstream +endobj +1776 0 obj<>/XObject<<>>>>>>endobj +1777 0 obj<>stream xVn8+@S -]b0]MgASF"5$sI~ƈDqιoV͖$4b|~]|P,ljhqNyN,+ڔ)mͧlGٽ -A=u- izQ*ebQ`؞J<<0%}Hucs)Ϣي7o)YVM+Ld9UrRb!|" @ٖǔl}[6M#eK4Q=!&s [ʝ]ˏ0 U$zH[gP!g8EY&n`IhF*tpP,!|G9R<[d3>=>"_q+2師, p9ϊ*[#w:mn9&Gڮ.!oIj,ˮURﴌ0]zD@0!Tj/э^p* C飘!Tہ!Q\CߺNҧ#˝ Z:\C*C$ꍥҢwۗHt+_{le=3UwE/Y/p|_e&S<2uG5NSD$5Fɠ9 !b>"J؂ +vjEj&Yz5c-EP&zAbl^yjT}3A8xh*^a "E/.FCʚCc;ش>mGPϪLؐ mx|RkpU=f+{ xZqgLROi;yDCP*>|FAЂVk,U@W1 {1~W]Gm%\T>Zc[g{6ru>{U;Q*kLg. ðM fgj6SMFSޣ jM$Dޚu%;Q/lpWzwpXоL<_uIBז"@u|]=3RaV%XO+~SzF,q |Uz_s]RDň>wQNlunO=^Ur~YhQ,;?ӣ߰Gʎl7>/XObject<<>>>>/Annots 1016 0 R>>endobj -1769 0 obj<>stream -xV]o6|X)#WEQk/.~%V#:?$] Cܙ]~Lh -.(-xß*lE*i:Ǔ_A'ͮූ] Fo(j2w3Vf/*+kJPy39Zm5ҟ#li/, I~*_?<$NjP˒ +)WrYd͐Haڼ(h#Bg2nki*\wǴKF0ԃ.P22aLSdm e*3_7]Bc-RZ x#{1JbrFJE€dl8t;xsp5 lA;Q"#l@2vOd]VSl"*$n䣎:Ȧ x4nbJHw}srgk9O&[ '"V6Vda}# -;@MUڒ|ҥlkpT]\G>n__p~u5H3`PK7( 2? 7}O|vs4#tdvA+ #aib)@j[c pMasV:T=O"w `Sҋ{tChrƗѝ};AlQ"/\ap mM]Los&{P@CK -Y7`gwtp#Ӏmky -jE t T0֘gJ<Ґ;ܾ+7QTiژ~- _k30p;msaY>84)m1冪Z[ ,^>/XObject<<>>>>/Annots 1064 0 R>>endobj -1771 0 obj<>stream +A=u- izQ*ebQ`؞J<<0%}Hucs)Ϣي7o)YVM+Ld9UrRb!|" @ٖǔl}[6M#eK4Q=!&s [ʝ]ˏ0 U$zH[gP!g8EY&n`IhF*tpP,!|G9RYg}z|xEVJebqWYrbk5*TQG<;6Lyyd<갏4kHHkA[sB|D=@VXՊDM\"j0Z75*|}YM&تzը2=g8pаUh" D^0\ѕ5viO}%U+[!@!8{V9#5i𴎥"q5:NvdT(|@%׃X#c> ca7J@9xZ|<im䚍1 Y}v)TטD\aFvlq 8XcGԚ\I4;%5K8lwdq'^nଏ5J'j +};}yV3-E=z0Pg¬0!KJᱞlSWKb(YHNB#.;'}j,{@o=ѢXwGga胕O%nxx5;Dy[m\. +܄،}endstream +endobj +1778 0 obj<>/XObject<<>>>>/Annots 1023 0 R>>endobj +1779 0 obj<>stream +xV]o6|X)#WEQk/.~%V#:?$] Cܙ]~Lh -.(-xß*lE*i:Ǔ_A'ͮූ] Fo(j2w3Vf/*+kJf1TgrHk.V?{9 NG<^X$TFxFI8,e T%oVRH51)ɚ!I:yQF2dd5 RTZeQ!-i`L]Jxee˜|Wڊd%UfHnt"ZZGA9 5Ff1]Pc +䌔-+62pwj k$*A 12v2E^G؀,eɺ,DETBIGuNMi4/η9X]sM^a'AOXE,$m"ÐGFw뛪ҵ%Kۡ4$St}ܾ @3Rj*JgoPd~0oX%ԩ5JiG8삌WFfSӜJuS>W#2-Qu6zfD&d1$.2D娍/;v2DآE^n8tX׻pM(l ڳnrHM%GKU/X'$U/.>=js)r`n1ϔ +yy!)wF}W o^0Z1['+݃gBalv%w²|8q` hR$c U:GYƽxN*{% +@,xpxExAdɳ>ޯ:?Cn{ o<#Ok$sIL7Bk +P̘n]cXl4Gn눧#ϝA×釙v}-%AJC<2qCwDuuWF+~ 8&E*L{VwRAH 3G#xpt{_HD5:bR=I3Mq+ 067kpX7#G #1SI+Vsx9 O\gOJ%]>ߴeEX u[wtKGWat{ͯ?^3op tendstream +endobj +1780 0 obj<>/XObject<<>>>>/Annots 1071 0 R>>endobj +1781 0 obj<>stream x}Y]sF|ׯطUL|+Y9'/>K/ J8|g̀T]*fggk_[-#gnX 2a\A.ɂd;w{aޅtFZ 6Nfl ."2I ]O. ʃea/%ElCè"THg#UBb @@ -4058,176 +4052,176 @@ C 2YOe T);wUwdIG45q!`h-elɲ`ĚT`=*vb-f~ed!q$3,D!V|~#iؑ5,Ԥ# u-Z̠dby4l0MٺA VT W +q,Ư2} 2=81oxYa fTk03 JjXgxe3G<|Uk1`anb"+%hbb!\x%. P /WY.WVRb Obh,`(`JbqbW3 , e}W+Ap+ Mxa #sf`xC"3Z3>r `z`XFQIk1، eX&8#A>nb5,jHYnė7bq! L],>+k0ge ƺ`#JE8gإm< Ʋ(+H%x% -2ґA)k0,Q`FE5,ޗ!J,)W@L73q%Pz` Ăs(x'pA01$ ,pD?[=b2l1XȲ#xH-+uȎ:Dw 7aO?vGpj2#f(d]e 9(k0le}(#Cy||)d($i1ؘ*IPE۰" dCQ!8\S(:\'L6!Bf3cx!TN!8md80mWa⻦"'^*M(Eu񭋀"p2ar#(E;f(IQϊm\|/77p(MRvo1cB%Dx]+]uMݗu?<Ob|bPCnv_U]w<0?m5X]֚w͡^} ~.@ŋ{W9m|N.wV}^eWp{<]5FkV><.Į?UH.g>5m_qMBf͡68o֍YS)_7 ~lWڟHrp Fon>:k#]^]7q[^7} -w*nm654A=/Oi_/ iėQii~vƱʩGkXOsIyO/)ikY-΀6-mphYH!.p8$ei+0iw}6Տendstream -endobj -1772 0 obj<>/XObject<<>>>>/Annots 1084 0 R>>endobj -1773 0 obj<>stream -xmMs0=+!NdtrL0Lj\xlGjYɿ#_Ui(J?ȝ'q( )@1fh4:Q)8V 5RcqU@MeBhN,FgTWJsh7)~9\SBEXEIB>ϴY$D{L]0)`EQo?V+Ԏ- .U05(@c*Yx}N^Vw]ulG -3JśZ٭xYޙwⵚ1*T+obxg*ޕǑfb*T+6aXޙw쵞ޜW]({3H/JFjc슬e*^GxYޙwGpnc߽XygF$.93>nǿ2Qḧ13#6GPendstream -endobj -1774 0 obj<>/XObject<<>>>>>>endobj -1775 0 obj<>stream -xV]o7|X)Y}CƁIkiwTHwvI)9a[ٙY~9?3Œd:b>,iquszM<-OiUc*>S|S>n:jO ݫP־vWdBtx,{./.9vyE ]~ 747痀7W78o:EGQu/6NhLM;7Bm&HmuɛuCW1)]$^Q)06.k@Uz͏+] 4.DP*=FNփ+ ^Pk?:?˕qMXÉ^8(Tݿ{☝Ic,VY5 F:Mg4)[Mލ+BրVmQeTrqv^?Y;lkԫ])m[ej0aҧga([Rt,`>='ch-9ߨTcjp Ə(Rz l #ՄnAjo72GLU$twsFX۴;J9tBu8حa0rR|8 ݹ [+V^ QDXrh:ЛSŒi6dsN)ـg3푫aVj%Tޠ}Y1I| -0xE%N^NΚG T.2:]L#AD=N?JɭAb 0O7hLq,c: -#RV {'$g1J@p^P!k`C!y>ƆO }1)%+1S_2LqPzRк<Ĕ$F@[I׀S"[T-)I4mWp!0,qA"͡y^`Y0$QRps%H>n_fSF܈iC!}Q3?;GL25Z/)- ΔWt<@!I - g"JSqe?\RЩo`Z¥ pRqe=AR;Xⓩ|Hc>/XObject<<>>>>>>endobj -1777 0 obj<>stream -xVMo6W |iC v@Q J,n$R+Rq_7udoz($@ 3o޼yW3gF9-bJi4x6ܬܿXo&K'V۫46xmF@46ʒyM)ZMd)Ѿ\!Rf,L':#-I"M$PU*E3B7ZTmZЮD@a!2t,֟ŋrLIg ^j٨Jj'28PԘqN:rRxکJ!xyPICE 8{UqP W 㬶NVNw{Etݠxv6JAk/$SZ7-eiRF rZKnhTy4b,"ZFIK|N53+}:ѸU^V6Z˝q UEUmE" +2ґA)k0,Q`FE5,ޗ!J,)W@L73q%Pz` Ăs(x'pA01$ ,pD?[=b2l1XȲ#xH-+uȎ:Dw 7aO?vGpj2#f(d]e 9(k0le}(#Cy||)d($i1ؘ*IPE۰" dCQ!8\S(:\'L6!Bf3cx!TN!8md80mWa⻦"'^*M(Eu񭋀"p2ar#(E;f(IQϊm\|/77p(MRvo1cB%Dx]+]uMݗu?<Osp6ץy6 `r(ڪkj5oeC_Heq]ߒHxq/?'ͣە9 \ҽʮyv׻jܭ|xW]2]\΂>5m_ڢ77f+o-|,_uDdbw ˸*[w}֭53|o񱿟z4pFCI5CEnܺ-z=rl͏+:W ;Կ_< p/og.-de+x蕮 =鞟[h_ߢiݱ+7vG}lDzhjVߟ]}no(eqW8[=jh;yǶ9dH=l}J+w7\on6{ZMle$Wu|+yծDá:q맢~<0JaP C}oUf76<-8 +$:(qlSnnfψ%WS)_7 @s+LO _$]9 87rW_ъMt^]7q[^7} +w*nm654A=/Oi_8FGXtK菍ٴ؊i~vƱʩGkXO>/XObject<<>>>>/Annots 1091 0 R>>endobj +1783 0 obj<>stream +xmMo@9e9UT9TJ;vj\w>غȲϾ3WAKCf:H +Y>}R+pg$m\P=q +9CT'*6! 4R,FgTWJnRr,&KE$% blg UJ,PPtJ)XQT͐jq޲Riny ;)ƤV*Yx}N^Vw]ulG +3Jś&[ +3Jś(nT3;ST& {*T+/#ĔUxW*^^ +3Jٛx:{s^Qw ʰKIFG~Q]5`Wd-S:*T aNϭ< $ԒicÑXOez:} }=8+^gPRPTL'1>/XObject<<>>>>>>endobj +1785 0 obj<>stream +xV]o6}ϯS 8N6k`k-J$6蒔]KuAs9\~=?SقhMh>d _^ NS%[^@ -+쵸eIgoWWZhvуrE+*:_dERT(R݇T)T55pUdn[y7vhK;7ӳiն[*&elT)4*0|UQmUiZ+ӪzpE7WڍNr%UX֨D'>CqN-9wyب^ HVo;5-yOէ:ƕBƀFRiTr(62wIlcԩm")m[i*0aW~(Rt`>'ch-9_֔cntp M_Fۓ7t.X^F+ˌnAjg7:GLU<$Tneqե^dE0n\Ѓ +`D{ǁ7ή'@`%*Tk>= 5>r0 Ħ'6y-0#h Y"Ep{*lX8:Qpp 3(s_LFXBgtwPTY]@@|| ؅i?AENDxԁ*@69\2a8mh>eT"Dp1dtp$NqzDDi %6X76|.}%Y㧐q~2M|~?pSZ| JEpS"e me&=\O`c(7Zs(O$i}aXx1{}ώ6"!HRc2-}8⽤ECu/I0pIk 0#{WL~vҟw?ܾ6ӖEf~wx.ABtowi: Weɜ,@?";CGGJD?KD +9H[d@qLᬷLۏ*$pf,=Ŋ^qo\7Iߞ^)f Kq +\*\**rY)ZRxl,ف*>/XObject<<>>>>>>endobj +1787 0 obj<>stream +xVMo6W |iC v@Q J,n$R+Rq_7udoz($@ 3o޼yW3gF9-bJi4x6ܬܿXo&K'V۫46xmF@46ʒyM)ZMd)Ѿ\!Rf,L':#-I"M$PU*E3B7ZTmZЮD@a!2t,֟ŋrLIg ^j٨Jj'28PԘqN:rRxکJ!xyPICE 8{UqP W 㬶NVNw{Etݠxv6JAk/$SZ7-eiRF rZKnhTy4b,*ZFIK|N53+}:ѸU^V6Z˝q UEUmE" [!+P>?k)TRShr@![ Dgֲ(#ҏ4-$UFjPP[tgi1_[! Ej 0+sqѻ@PK5joe3h1C`"aiϰlAh6\ ;2FIK'<ބRpZ|YT$tf27McW 1f1%{A/%Z9thx=pMrs:9:T7*{Vʠ%̥ﺟlvUDHWr1c plzf .5dF7Taj-wߘ\=B@Ws^`tBE}Cl{ay.\Wn*$*)2ja|U0=4H=MHqQ2؎Xaڌ{D~-Z`ziY< 1tVG~OF]`ɢƁ7źF6W'(GnWB`4v`+֩`G'lТ5]˿ôMho{e P -yeΛ~ػ7 aytG5 Rɤq/xÁzz˫mXz۫߯۬endstream +yeΛ~ػ7 aytG5 Rɤq/xÁzz˫mXzَ۫߯۶endstream endobj -1778 0 obj<>/XObject<<>>>>>>endobj -1779 0 obj<>stream +1788 0 obj<>/XObject<<>>>>>>endobj +1789 0 obj<>stream xV]oH}ϯ⥩Ը!%t68}==wl Ͷʇu9ד iԣt|4 4?#i]Ň -Gk8)J~]^?LuETٷX (A8.JNosI4Va mLm#+S_phc4.d^>G$(1"N~x2 {s6h,{Cֱs*K xhV-U ĩL{"Eu&oe7ςT*̫Y6+ ZFT;C"O=3;HAF\om n(=Tǰ_١LmDj5meZxpԐ 5? ,(sD`/+Z& ,d"2YύJRA q0NԂ9 5%x߲`R` æؓ;%#rsO?ӛ?botS&^KuGx@i;[z1Zw5-/?)j:BzyMfFLwF_]LIJmZZ͘HW9z1cIҏ6h#eemNT)ضPD -M>xpT6t _xZ(3JaQ@V6=8 qH+肑F>@ AW_j@>/zvF0BI35^^[,{dvBrx(~O+s Ckk|5TTOM]k4 K$5Q&AL/b~{!f>7cS@obiiAR[jˡze=nLV\UUAb-F< 6NyvpVON)yj@fSLզh\-@ƌrF乍[, QϿ~o ״j0$ɟ'dendstream -endobj -1780 0 obj<>/XObject<<>>>>>>endobj -1781 0 obj<>stream +Gk8)J~]y0h&o/Plq!\ +ii+,8 +GV: N:%ir{7]\/2|8˛M6b'IPbD&92l!]epRӵݧmX3%cWU7![$S_kCD8Q'2M(*oYTWmVH%:<1wuDP'{gY;wޑʭz"#BuQH{aտCljʴv?!.\kx F/ʹ8XJJɝ4VxbS ޶u1/RM*w2a[4m pcAT>i/Vb"sqB9Cp +U3OrRSTn(\#$>Nȧ-X 2wFJ MPmOEV 'ȡV%^B|nZ:҂ՖC3l <"{LF[Lxa; +, l>ᬎN3*JSXVͦb':_M8)5[ eyޔ~^cSi‶npwPLSql/镇*k/n%tp0 +ϥ@k#%h$vaUkjW~}}y4ӝ̠5vki{fkG!pzY:}lE\ŋW> '+bG"Mɩ_ʾO>.qՌ&4ZCG͵6<|%-qsRY8ug<yi`IL?Oendstream +endobj +1790 0 obj<>/XObject<<>>>>>>endobj +1791 0 obj<>stream xmUMSHWBjc1lr[]92F@QfF8}=X։)(i=u}WLҜn!"AYG6k*7}FqL 5KB/.mJzid۾~׊:GҾ1MI2sS5uT$lJY Ei!hQ 'ʓ%.'?X~sQXkJe}L  G$55zA u/28[8L`p=F)89,&4zp,Ftj}s^k4%4eZ>\ "8@:(ј_ aP}r!~D9ѿyf?'rL~||I} lcF}ܒp`j&  0M'хxSܛ - 8c€š4V|)Oˊǐi7%s\MJz:|7״ D6/kQ^$iNЗq[o|Zlõſendstream + 8c€š4V|)Oˊǐi7%s\MJz:|7״ D6/kQ^$h#/,D*? +نkw?endstream endobj -1782 0 obj<>/XObject<<>>>>>>endobj -1783 0 obj<>stream -x}Vo6} 8vO].C,<D\$R%D"%w޽{ד! H'd@E2|#YIy0]FI2~}urFZH2i &]D奥$^lT_lpzwhOIBo%BѦwF\DQ755O]9c^pWB&ae NBiU2UJ1`# ((LoIjǿJ/i8k*O W +1792 0 obj<>/XObject<<>>>>>>endobj +1793 0 obj<>stream +x}Vo6} 8vO].C,<D\$R%D"%w޽{ד! H'd@E2|#YIy0]FI2~}urFZH2i &]D奥4^lT_lpzwhOIBo%BѦwF\DQ755O]9c^pWB&ae NBiU2UJ1`# ((LoIjǿJ/i8k*O W F ,'cLyԑ*B`B>}eI> -g{JG*,nhߛ)!&媐z.}zpq0[ș ;NQR)~qu5lp5ƈu*|,d[ab` }4SEd%e3> J4%d ^vLUؗc-_(ǐu2lkXvA~DVD! ^'فp0)u-*<)v4HE ;DX>tG`䥑NοIN}bhy^ֽKtcYPZ[ ˛C30iQgl?Ov54xdSB qMT,r$ujjlZ!G hf߶Vs.(Ng@1,JfЁ7G8O?c0'юg-k6jm|j`qnxVUXӜhӁlZ='Kp]7Vxbo;Px26j( Z*.Ej }nqNuH. ]c.ѝ%X]*v SB 5CE?őٛc˪w\۫H\I ;gm #KC _epCAZIbf`a" Nm pY*Q0fh/f -c{E-6{p;zJve{l[K/Ma\!T^'Lflb2`p0苟la_\ d:O#ܺ|8V'EFendstream -endobj -1784 0 obj<>/XObject<<>>>>>>endobj -1785 0 obj<>stream +g{JG*,nhߛ)!&媐z.}zpq0[ș ;NQR)~qu5lp5ƈu*|,d[ab` }4SEd%e3> J4%d ^vLUؗc-_(ǐu2lkXvA~DVD! ^'فp0)u-*<)v4HE ;DX>tG`䥑NοIN}bhy^ֽKtcYPZ[ ˛C30iQgl?Ov54xdSB q4X6H< #h C`g2%(m#7\QG΀2[cfY"\ yWth^fѕ̤5O-!&Yf*[F'g5OX%gj2Hڦ)AMHG<8+dέϯ"O' B/[J0PKf/')OMn-kv蚮h2EFOh+X8`gQb2ʊ \]-K0' +V]it +M'ZN,TG1ں /Tr~BLx~AWFk:]B H^Lu7ށ[l1U%:wޯb\l %D_-.ørC}4O+~٠"d`?YC 0žO'tL/Fupr1ޭN<+Pendstream +endobj +1794 0 obj<>/XObject<<>>>>>>endobj +1795 0 obj<>stream xV]o6}H"َC[?l@ E$U~:y6KK}ebJx=J^/`6K凔i])_ )Om~p9:vۯo/Xv4Ji;޲m0<0pAf੎ąƞeoޝtz\~SNy}xt$5~Q,(f;E#c9*d:G <*Ad:塴Pxgiz -pJ/!z%Ϭy#lFM41DpWS`ܪX9- i%GUsd+UQm)v! д뽐to Ol_F!i-DA+S L=)EwV"adh {,B$i, ~LC_Ra&e39S P9.`KĂ74QeQb! Z!F2v^ doWw5u:-LkRs%UE7f#/ (u7n~Z`!nHY|x Օy@fHhoKeeDz(ev>/XObject<<>>>>>>endobj -1787 0 obj<>stream -xm?O0wS2icĀ8USoϋBeIݻ+t$J\!)ޣf;LM%L…q49G` -`df|; -*$>I)Z`MhO0 ǩHzBl>/XObject<<>>>>/Annots 1095 0 R>>endobj -1789 0 obj<>stream -xWn7}W bV]Kav+44R. %1撛%׊^=C$[ -!A%93gΜ=9:4RoHY~rӰ7wc~'X7wYwÁ^ʩ?&iw }}39͗`8|Jvv%u D -fA֯v5Q4޽=}t=8⦳Z9[2kP T2SK2K[+kxՄ:^?UЭȔ֭w@_%4_WKdY_M3Y>#Lh-kj=VwrK^:OʓXq>)GAsn0r-E *su (W$M2fmӋw6‘/Nr@󜼍kT %LxJT#\<вV,d`|FGv=g!\2PPKGV^oI0\4C8zժTpDLW x| m->76:BT $qEO(; |'x^~\dk#]8@na 9e)\`?$]TZ?[[1eeu2EQ p.o'$N(l9_+U2&dl6( -dN:suЧ5X.png{׾!Ȟ -}J7> l>܌a9|R:/sE*b}l6 xd7$kkvuG"M~֥(V<Ԧe; CSp,ժ[g.}eAWy~( FQU?-weE(۠g) -`Rt$[ qDiu\R=?Zjzq^ -Xr5, j"CB|tÅY|etzyKRo"YZd >v#ow#l=zhOөaXZZq9e(A%Oי MVH{ߥ*6l]IXE}T;A]ZAioFBT&puȅNhTebF^cAn6p -"M@#(HuA6%S{ޘbGUf&s (c i!]VO"KGHs5q U~ |\n=qrxЀa[\,G]?^>jwrOn@'H-^Uee5 -Cę >/XObject<<>>>>/Annots 1104 0 R>>endobj -1791 0 obj<>stream -xWo6~_qR,GɚIk0,@KV"5QbE=iU[$^LtpBi@hWϽ4,g^FQr̛~7sZE -JMƚECoFjT5IRzSJ7ήöM/\4(S2htc#oF0}s~+>NH^W;bk+')tS(ծBRjjʂy- 5JFhc6(H|"Z$6vO*OD^(z|O0^4{~F:L!p{-slJMgenȵ}:tec$X'YմP_Uy󻷓Uf -iSu{_c44W T*Xdt)3&09H6S^&rVOP\`.A3q{;5Z ߝvDD:m+ OP9" -i㫛𕡑eC-@lŊGo=y%t?*>M$YW揯svysʑTP\OB5$!! <B6BORp]Պc -TiYT6ϨMFjZ.E˚{RB)>7 -~> 5-ꝳ83օ&07c@r׶SZ+VH€OtEvݙ[WDao3eX{1/ǫ &d*t4@B6SKV@2ײxnq/AlBUm0F1 ^y:u/=ǵ'$)Vwa&[>UB !y}B#L3]w\ݬpgpd+K޳'vϱe{DHıH u0E6L;rx8yu 2^x7hX>HT{a^޿+fCVIAuEs!CYUFƌ~S&ofٝj/@m&mwWîdڴA֏;OT}qWJ _a_,iUg{ fSm^V-?˸޵>ˠhmlsw E -l21^{4 n[ܵuefh83,Ɂ/T]t}$/?/5 ~ Tʽ"eV=I(xN4ᛇޚ-1/a8\|/GIx>/XObject<<>>>>/Annots 1107 0 R>>endobj -1793 0 obj<>stream -xW]OH}W\ҬD*$B%nӕVc{L=gLȿsvUUsϽuң.O1I ?p? 'n@׭~p7ݾwQZ9 {Oqs?\#?9S%?l[IRɁs$cEdh+"J5c -tgu\[4>ȈDF* s̊&$nk%~JY2(W27%ZJsoAs,"Uc#$a ^Z:=!dF:;9^eޛήvlS>Aߓ/ق*P s]y}6IH0W4v{{>y{wpY,Vӯҟ.71?;4zĕtPƭY-D5~R۹2ize#Ah"nTʜv˜# -"۸DZXk"0+= -@o yuR1LJStk.2B~!]ӆ|Ȉe*0 #'>/TH2:?\N$d"ЅLۆfv),9C|h4pOʞH :MCT.fJf|Oc 8>dP¨N3[J -L6m2rV)ji_87xDE7pTgU2(AEp`FAH)Q7\H'zl??5 <0@SƄ4c&Y,/3x9YL)^gջ9 T*1 J8+NA܉Lld~J`SYӵd%@1Nh/B -RIvTuOEJY \.0zN \!ҌVR&j)&΀!U\H "̹79jңo,G!ۆb[>D4@ Rt*dTgպ(A&luf'Ch̘OF SP6?cp ->om LXe8Yꆍ<8a*4OүB _CckG% xes+bt1yzVtD9yW.Ft?C߹뺍3 - G)37+HG7-4G{@ qcy莎ur HrH]Q䫞zAlfY߄ʲ QUG/gsnؾ׉t-r$d52!,T Z;7Ϧf7qw·q*L& rSng`؎Z=xKzL˛ŗ.a*Q17d@s7.. ]''c R(8>^ca1WN,wu/ !endstream -endobj -1794 0 obj<>/XObject<<>>>>/Annots 1110 0 R>>endobj -1795 0 obj<>stream -xVr6}WDI.NfXv$V,LM$d{e[Zօ$vYݛ -b:SRјfgw-)Xz7'ќ8RI": Wtǎmz)M&8lAԹ&߮.sF!|^-/O6¢_r89E \F׫׫N5eҘvy=뙷3s䍸5RV;yo=TZU]!1mDQPKybPFɱ{hoWItǏf))cfغ$6R2JʤK^mJ ['mHd՝VJnVRmu9I"KUw ZY?5MoԆS_x)KZ{#ZboQDcs . +pJ/!z%Ϭy#lFM41DpWS`ܪX9- i%GUsd+UQm)v! д뽐to Ol_F!i-DA+S L=)EwV"adh {,B$i, ~LC_Ra&e39S P9.`KĂ74QeQb! Z!F2v^ doWw5u:-LkRs%UE7fI(~">JzcVX`#=!R(o>FEcCuv)8} Rx~Y4J0q_6 onY-ΒLx:: ]'*B,"ѝRKơ5. F-Dɤ‚!nђ3/"4ȍаN*3"4jb;x4^vi] 0Z6ePTU` '·٤3ǯmb 9nkGB&$P;bxށe7Ͳ4.g,?yB𦆷(so,0ʝx% U<ޯGG{1mendstream +endobj +1796 0 obj<>/XObject<<>>>>>>endobj +1797 0 obj<>stream +xm1o0wSt g$J+u6:`RGMʲ$w$"F +Lp%Snthΰ-dӐDi Sp!`uxQ|>f lz!$]'׍޶pFE uORʩ{?c*Lq܀ŦvOo|e/7R*j7|ݕxU#}5ZڎfarBlgJsԃ:\Ί'3cendstream +endobj +1798 0 obj<>/XObject<<>>>>/Annots 1102 0 R>>endobj +1799 0 obj<>stream +xWn7}W bVź䥰]_)q +(+Jb%7K{\I +CKrfΜ93zԡ3uhإހ,9Aoh.>ׇߎ:dLA2I~4 #Ω7īGɰ~i;wups~]u{8U9~ss9;jߌ{F  G4\DeIaBS+]Mni%w/ON%]t2[)GY}Kf`!jBfj2Rfa\xeMSgX_'} +>t2޺/Kft醌]JHi*D ~tM-rRgJnKIyKӣ2sv4>o~F.(yRߐrb.<E*d.Wf٬vzZ8@I8~qb. /BijZR<5ڊ9loYS=D \\ XJ:`(в I&f'Q/Z(j.O!ɯ H/~m*/A@\X LGhzǻgE2C\NRQyy@5]V`[ .sQ%x_o \V~~Ak–R%oBvgcwboV$X1=W =Xv+t;Ѹ ydD,4c P?.`x`fxL 竕 +`yWuŻv{^'KF^+|ֵH7i6BbX[(P.{& MP +l(ʂ12Pt[,1@$["ʢ%PFrR >HbA6T㒉0zպ +NnkޯX6DZ _,N#YZd >uCo#lm=zhOaXZZq9e4/A%O!MVH{߅*6l]JXE}T;A]ZAyoFBT&puȅNhTeb=D^cAn6p_ +"M@(HuA6%S{ޘbGUf&s (c i.]VtO"KGHs5a sU~ l\n=srxЀaw[\,]?]?jwrOn@'^H-_Uee5 +Cę bǾ3>28F_ώ<Eendstream +endobj +1800 0 obj<>/XObject<<>>>>/Annots 1111 0 R>>endobj +1801 0 obj<>stream +xWo6~_qR,GɚIk0,@KV"5QbE=iU[$^LtpBiҍrjȕn]mQ;_0hQ(;;"5etFނ`V|&)w0):VOR"P]GԥbՔZЕk,ɍ&]mdQ8sK Dе&ImJET7Px.a½ifytzCf8ZHaa2zke_t H*iO28i+wo'aV vc,0hh@ Tұ*;/SfOM`sm2LΟJ%z].7f#HvkF[u;eU<268|StV2m cϵ+sDxJ4G`^)_qi$;4*M2n/gk5sW(6_1tiTEmV}W7+C#˒Z:Dي2G_{J6 +%ZT|H9d_(-# 8 qkHBBxDk+ > Um*ml ສǚ%Ҳ mQ0f\.5TS.}n! |@:#߳kZ*;g qgf #3bM2`nƮ;x)*mӧV w׷\ 3 j + fz 5c_WKekMȰUhl`z +u7ee03_`)C?Q.ahg*;Ucp:u};h_0{kOHS +}M}腫"BFҙ*eEg /ۋ3 =Y:WV*+%gOcc}w6N6֑c+<nfa]#;m43ywp@d)Go*}:19/W{7䓂&>C@#F HM ,;8[2;^<*M:=]ȴiQ)vjܩ_[|p'?*huX>_$ 8ۼ[~q# k}L3Aтzދ[zٶebih&ܶkr JY-*#p1gX> _"ٛ]I_|7W_jˇw <ϩ{q/Eʬz!P@9 i9m75i[b^v)p0?_ Gx.g_{{endstream +endobj +1802 0 obj<>/XObject<<>>>>/Annots 1114 0 R>>endobj +1803 0 obj<>stream +xWn8}W R/K +Cb;Ej,(H+Rq{DȢ#\Ϝ:R4QDaz:4w0b1G :×.7yJy*x⍚WIz@.1MGNeo%I'͒ᓡ(֐)(6yҡG;⤁FF$2RYTfV$T6$YMv+U^+ί/3r,s[+Qq4w4Ǻ"Y%1;2J쥵a^3BfޙiUi Qaۆ;k<"-H2 0EhS ^n/hzng4D%J xCΊ%|i#'w")dV0dtY @ m˅T e]S6tVW< "#"W@2rf4I*vaJ>wFuu3j0~a#v15ȲH9s?M3QmCznu \Leck :Sa2fj]^:ffEh'#@)^1 dlj76Dj&@d,2uF 0u'UfW! ίj{OPLY[!tr5BYL<]PNY0sEeL |!m EpX䞭 pVCKļQQ¢ãw˸Ҥ)RLkX_Wt1lO +F:np+C\uF|X $KC#gǖnŽ?h C^8V]ٱctGG: $Wkw9 $̮(UO=D 63催oBeنi (|ڣҳX9^7lDA92uiiz*a{U՛ +gSW񛸻x[8 y&aqm9㩍ug`؎Z]xKzL˛ŗ.a*Q1;ǤOWwW1aoY|o?w.؈1 F*';O:3`-endstream +endobj +1804 0 obj<>/XObject<<>>>>/Annots 1117 0 R>>endobj +1805 0 obj<>stream +xVr6}WDI.NfXv$V,LM$d{e[Zօ$vYݛ -b:SRјfgw-)Xz7'ќ8RI": Wtǎmz)M&8lAԹ&߮.sF!|^-/O6¢_r89E \F׫׫N5eҘvy=뙷3s䍸5RV;yo=TZU]!1mDQPKybPFɱ{hoWItǏf))cfغ$6R2JʤK^mJ ['mHd՝VJnVRmu9I"KUw ZY?5MoԆS_x)KZ{#ZboQ;s . "kQ kmB#=&?#ђLZ$'=ǃ&h-ʝ8JS5Ö`).d@8}*PR7(ԔB-:9\rX6;Юm56HD*ԽDN&I@ssM5:a\Wb۾+ܓɄc@Z^lO-c٢x(<x&l[Un->-q!dsÙ`ŔTQ2ͻ"꡸F0κʓ/qbʪ$vX]SpBx]Ii)(2waRKmѨ %RD)U7ί?F>d@oME$BAeP [l۟}RTjLe#T\ T2`,+>AW81xE)pA҇DqT(u- ) -JZ5(eG sy`T\P^E"Q#g1Ft{}WRF+w~`-[tSi6ڼR<8^$L.~N>afcɮuzy%I5{I*ޑ<@Z+I0}{xz9!9Ib~rj*A x?;nQXZ`&2 ,Ą嘘^|Oz"1_Mҫ SWGa1,P6e!6n8ee?g04۠G-J`2ںJ p|je_,P6O6^qPn%$/s ɰ:^h%x2@0M=:5@ލ87T/;[xnS 拏&sNi6sI(}bNv-.PQY4>/XObject<<>>>>/Annots 1119 0 R>>endobj -1797 0 obj<>stream -xW]o6}KS V,q<-֮@[lb@_hXKFRw.)يbC$2u9^IL3vN%dǧxfZ54W]TdӛE7\o#)ocy6)-ױČwh>Z :Zczw:Z,8<٫ h6$sQ;iVniJtYBÇW/7a87_DTN\.Ɋr+$@rm+V9F&RyKY9:HcsME*H / 5VU;2X%QH.`"]G$Zz&TA 9lbh{s8xW9&qH94^ɔ#UˊduPFW\rDQ9}|110K4B"eWlEa5+`E,U%۞7 -tF[#*8׭$B@gTT:a`%*L4PˁHYs^TTe#Hg^KOgRrk/H]:9(wexyk ,ES<$Txl ;E1FH$f}: ZjN+`Mʢ^Ca)}Wͼmv\bF |\04؊e$Ctv9=+ b>Vvu;7`k>hgGώSP&A_~-X$EG?-S+JG*U6 ܗ7|ZY^ᕃDYC{Ὕu쾗y?NUs -J (=ntĘǩ&™~DSӭ)N`LM4ClJ_T4| -)~s3zbӔVp#h-rsa1CCua:Ͻ{mfsbwm&NHendstream -endobj -1798 0 obj<>/XObject<<>>>>/Annots 1124 0 R>>endobj -1799 0 obj<>stream +JZ5(eG sy`T\P^E"Q#g1F${}WRF+w~`-[tSi6ڼR<8^$L.~N>afcɮuzy%I5{I*ޑ<@Z+I0}{xz9!9Ib~rj*A x?;nQXZ`&2 ,Ą嘘^|Oz"1_Mҫ SWGa1,P6e!6n8ee?g04۠G-J`2ںJ p|je_,P6O6^qPn%$/s ɰ:^h%x2@0M=:5@ލ87T/;[xnS 拏&sNi6sI(}bNv-.PQY4>/XObject<<>>>>/Annots 1126 0 R>>endobj +1807 0 obj<>stream +xW]o6}KS V,q<-֮@[lb@_hXKFRw.)يbC$2u9^IL36j2fIZF3Z.Vъ*Jet=8>fpD-N1Ir;]ķmNl'f|0[FrU9x#<*Z,vzr^gvEcoׅh4"]iJuըRÇW/a8S_TԤ7N\!Ɋj#֤@jAnr2Mer/KTv*]_183.Ӈ"xﯿ<6ZUocF!;ot tvCJkqh3I{%Na]! hv+W'3>T#k^]sG(BrK{cp?-ntjn3?aMF%sl81jm* g?OVAOM >$]fU6͈LAǣn +nsF"*a/)}Nxy1rōΨٹHnCa֎ ˼ Ffp%҄99|tz ?Qp#H#sdqp/V/zF'ρ&݁kXFulgz{Ln~{G ]asokDS +ʱRA+g&Kj*]!18|B#/Z=w^{4sAqo-nJ Ϲ暧N6, $U im[AiA%oN*J}K҈lG灨@Hm7W$rBɦXTJ槕Lp0C pUF#./|ڿX a sO1p.qYx>/XObject<<>>>>/Annots 1131 0 R>>endobj +1809 0 obj<>stream xVM6:@%[vOm6ihQ @@KD"oH:IIX|yo2_F9+*ګY:jɿ5~o%U׿u*P\5tofoVu {ni1q*5v٣]0Ǎew۫em+NfYӶ !h[L&IX -;IO`%L_F3JRdQ;b%6@qXDt',=)GE:XA,-xN?1drB}lM/MhNF)p#"V{Ԝp%{DU۵ie:E6R2,pzlcL(ܙ:O2L.hd-i4]w 9ޛVxUrcTiiˋи.a `G\0p0 -6vzH6$_D%!5WM96;J Uʂ/vP5{+xsȄ)"Ծ!O#t2u' ա3@C*< l!qL `Z28)wt^LE-]֦?L=;M|nydhx0qYP?CT=`nNrx3v!߹wt -OMN Q+LNze;<)z~&N zvq,VtGBg5|{տPHendstream -endobj -1800 0 obj<>/XObject<<>>>>>>endobj -1801 0 obj<>stream -xV[o6~ϯ8kbɗ8 ]0 @Z"]J[b}QFCdthJE}4L4g?ǯSTl"NjK/ϗG'(ѲD씖Px8e1p/ʺNZlixQU01n%10ɧ阃^O{ے(nfMu$hԭmC5%]z%‰Z7*ػoJ^d4F8UE+UQ+~گRxEWk,(\=k+[ZD!AR73Q3(4K魭wu7aayvSvi?Ȗ37IxEȧe[\ ЌŠ(ґO-HਹGo:\&o%m[)gXTew2Lx @G]v*R *@jbnSZɍҵO:PXOwmSi:N?~p&y6e;Lv(ɲkHH$UA [+ -ɄP”zqdl$a[M~_\^ꜗ P˵A r҃_ )VX;D;2  r='=X#k_K+z?ݿ\O(AGqrѷXHk~EC [a8$CX[k>/XObject<<>>>>>>endobj -1803 0 obj<>stream -xWOH_1R81>Q!JN{M^wwMov$DZQ؝y͛σ) 'h@ :??#) QO4CyLӔf0i;D0Nl1KI)G?9=&k*j(km%9MNR!!a)Х%m(3MRk>7Gά8~iBЕ9 -I%ƅ,#goD.e|s2/DKJePVoCVy4|M|t} \L9%}DNDީ;)o/t\rK!d5K !5>hTG?pARÒ -,~mM[Urg⿴ sg'>$X /s+Hnkr 'n, $^q|FA3K,a!D<|L>_myňfr=*}OyD -j{X?z0j l;bW{ꝹZ^#{Ȯ`o[zl6!@Y?Z8jލ0T) @b?cbTl¼c`GaUDe0heK[nJ$]!q: lxP͔ԉwK㼩y0[9"M-;{0G5Ԃ%@(=G T! NY.=.STGs݃;)fT"y-; vSVǶe͟`_h{@p]$BFC4]E)}ךC{et.@ct -[)+V,0UWJajlή7f:]A61rz]μ}ensa{%EHS%yx:nXS%9f 8LA{fn%9ÚMvʆFx?G,e7Z?o&w<!M`_>\ҭяP(>:${;G?i/ 07}MΣ|p!_p"endstream -endobj -1804 0 obj<>/XObject<<>>>>>>endobj -1805 0 obj<>stream -xTM0WL UganTGL6Nm&~ǘt= $f޼Sg0-I%Q y9UxyiՆ EI/5$YQ%oXm+ 0 -%TOT+4lNJyޣ>GQ`w5p"4\; F Ե[%P7lgD|sBd J\Z0}FB\qoƥakNRIV:GcQx\;U)fK <0fpP]v;%/>r) uo >/XObject<<>>>>/Annots 1133 0 R>>endobj -1807 0 obj<>stream +]o(zk :KGK9TʃlLy+e<_JG0Z$|w yDdX!Jc&2u3HRgez2O} XG|UH5䎜 ׬3(7bn煙PV6RXe7@@Ri|4q.%o};;"!lӠ|J&2ul؃j`*B901ޣ=f}Uִ #'D2|+Y1a*u [IM_\SRAKJAM:BYwEaǎXgh h!3݉=KtQQkN=VKo|L~7=fF[ӻ1K!/iJ/Ad(܈A5'\IsvmZ|Mk0 1`0S*'(wS Z8Y#$EMCN^+4Uiڨ"4.AiKG9Q(Aj=0  MGD; QI v׫‚ _%pV*e;LΚm9 +dBVjېا::̊ƆЙN!g8&y0y-N ;:/[P + @ZJ(j'H*&Kgqw2]/Ё$es!$= "\:p:YpL-KjkD,>ʢ 1VD}e`o`D)1ڕсفUkv &э&N>7<} 24G<,y!*rHk7xr;b\N@l'&j(&'d=?~tL'd=8NMZ#~_fendstream +endobj +1810 0 obj<>/XObject<<>>>>>>endobj +1811 0 obj<>stream +xV[o6~ϯ8kbɗ8 ]0 @Z"]J[b}QFCdthJE}4L4g?ǯSTl"NjK/ϗG'(ѲD씖Px8e1p/ʺNZlixQU01n%10ɧ阃^O{ے(nfMu$hԭmC5%]z%‰Z7*ػoJ^d4F8UE+UQ+~گRxEWk,(\=k+[ZD!AR73Q3(g(Rzk띮xMXj|^x}h*uԴ}̍%@qR9FG}74bntd` 8jzfG9IgۡrI[Vن$U] `"7QJgT +F1X㔖@rt-Eœl9T1ӝu۔8lO;e>,_n.IMv$J,Aƚ2R8I-gA`P֪JxB2!0^8mw7) IdVW,:%ry+HAm$N;0 iry(c09`I:R~WDQD!D\-1+G;Ҫ+Zbߞ/yQ8Ǖ>Xe Tv͘D f;l m " \@&j0NeW,B=` OY'C1 {pV"B"*x bn/2s$T{r+%ߋ'xk%@1`Eƶ֩Le ! _G[m9~yPl>#tBJdGa$mAJ} E{xhjg SnaΖ<AB; kqOUPQ˶##s67و,NF9}v .Zآyx$9 +Z 5%%8_G/endstream +endobj +1812 0 obj<>/XObject<<>>>>>>endobj +1813 0 obj<>stream +xWaOHίr8 !>Q!+9U*6,ov$D*;;ޛ7G1 7!&Gh@hH⟑_LFѸwK/h!d,% hhѽƩB-)2߼=b\gËhoVd9$BR! ]Z҆2 #UJy{]ș5O5͵[u5GAR DTո"Rx{(e/w!PȔtI,W=q o[}'C?#StI$QwW@Bx2DI*G:)pL,%"@I 2P`H}r$XQmA2W^Jski܋b.")9A ,^V`vQpiZ(j$VT,HLukPQF2-LQY1-tJ T״R'd$#mThV,I)TYʄ?jiCwQQ@Mﴭ!uen?Ϯ F0yW\ gd*ˤ#y(ܟY_qΩΨy<]>j$FM"ʘTf ^pxtwIeT8c`e'WKɱw6XZ-8\i{fmپ27F9kU;,]م󔼛_@ +\~0ܱt[H较Ap9ȭȒ,e37 uqPuIHK*0H5}oU}˽ߟҲ3N|xIVM3Y$Uk83H{3(>$ҭ$4WY4[Cy|> FmzU*- QxF5` ap-c7ž:W;s3G<}Ƿ߶l +C`pԼaS*A"֛~ĜI y@~1ê`8~sǖ#ݎIB% w6tD_2ԳF*C5Sj['-~Yl4F4X`x8=phIpP jdsZc7P<%;ew\fLaR8)v~dQ `橷0`M[NW_nonw B$R7sU9{PvX~NB +4@`５lB8SP~f3ld*wn̯vN}AX^InFTI$G-6;?s|?TyΣSP란=o/Y[I|@oEӣ%& +֧'4d4~CSq->4Kt=;?"endstream +endobj +1814 0 obj<>/XObject<<>>>>>>endobj +1815 0 obj<>stream +xTM0WL UBv#ϠJ=3Y`;McMЂ@y~LN`,.&qC6_dłSz4frWN $@JEi΢̶{c|3f(|S>Q ך 69 +ӨkdY0Jm\"h (`a;u'̧,L]% <nNdЍUT220MbS(2LṬDU+ϰrπ  C>yoY!l@6ZG9P5=x+~Js?w3ܒ՗J#4L֠eJ G7AGXlۮsQӊ1h|Nc$!g<>~*nfio\ +߾f$ncx4YYR[`vMd:K.q$.eǘbt?iY-^/?-VO-+ .bڎY^< >/XObject<<>>>>/Annots 1140 0 R>>endobj +1817 0 obj<>stream x}W]6|X(z. hI M BK+9JTI|%%O Cɜf7-7דY6Ó6fTrɖO*[ffx9ndhlM*bfX+D]mop-!S9ϗ -QVs}inXˈѴ--f+fK"'կj;Zd[n;q&|P -Cg.6i~(ldbZiC({OuHIJ>a<2<{ҞYwѓ9ʴ:O3z"B_tl -*p^5:W"h? [ ؿSk|X, -<R枑v}2x{Mm -IAW9pi@=Mzd #$)`zNHJ5פy+p9{>/\TX ^wy%ߒCvM)VlZ -Nw|lU3$%ڠM$rB 6p1ٮ%[RtбtoM'^xRMA\3GZ8OJ. O`rk{p?6Z)DS)J*sG -~:3uH/ -gc[v%K1Ȝ^\H2 cr -XNj($ -en6k 6gSGLBDvԶh>ηGnCa!4g-c~{T@HSCxy 6RL[ Ax+}A| ~lee 2s= Cc{-oX{x;TrQb\^AO -F/x!hzJ{j4bY0EFa 馌N?oo%ϊ.[hFˋuV!s֡'Zt pt<﵅k,ٌr lLx~D;:j\1ׁ7USbȲ֡F0a\ߥ^ -XZvbDI5tj&MW0 -B3hP%^-j} ՠ`q?\4s-qXX%Ir#*H%yH^a H~WGˌޱ`6bq@ĕ -l `+GB\ ֱqg G]˅ ѢfG(;# ZqAe*yJ혖QtpĴg" A4J=%>9m`lıMPV;T02[M߯E6oҫlWnMqG+lhxF/ɵR ).0=Ғ_;4md׆Q[y"Fԏ(=Cq!q()p5kg  GeuxRM%Ӏ'Y0=Uicq'|ѿ}!6%}(_\h= ؎pM+xsa}h]Ldx]Gw;8%XեJ*ByivǴU8֢,aZwN=5\]>/XObject<<>>>>>>endobj -1809 0 obj<>stream +QVs}inXˈѴ--f+fK"'կj;Zf[n;q&|P +Cg.6i~&]ĵ҆TQ8Jh}P{xdXy=yU3 'si+u"f + E)`)UjtE~J);AXDxT=#wZRe3. *)Ts!‘9vz0TFIRHT!,(, 8 uf ^|ƶFKNc9( d2/ zgБPf+#I4Ցm:ln|;2# :m}o9܆( BhZ +1ԇ)@@l<H +R3; %eIqȱ +5Wr%<8, |yIP$ e593z@0Zzߒlw"&pNMƋ&J]ҷ'C2'bCO) 1yk HYkؘOKvtCBboC\-eŐeKɭC`'XøƿKc/u-:4k݉t-jԾMt`΅g6dJZ4Ԉ"A"A/2%~Ph(/Ha[<ⰰKFT&J62®8cl+#eOS) iaw$e~+V*4(:4c9.;/ +B m#dG剣EA2VPvFA₴T 1-3i,=D̥Ńi?{J +|sV.5( 9c!WB;ʿٷwbcad_筫lޤWCٮݚLhW42i>_ak'B> )ALS\az%vhVȮ ķEQ{0 2BPR>/XObject<<>>>>>>endobj +1819 0 obj<>stream xWn7+TbYe)Ѓڀ&M@_#.\ݵܵ}( ̼yoɌ39],)O)]^_Liq}7h*b6Ya6>N4ѪD BVV8=9]8|bZk;+GDZ&we8&R8^"wү&R<8o"MZSB7)tTܓ*ZEʴvD]qmD1ɜw|IT)RqO T@7{H*X|Jcu"vNFsA+b-R}(HQ43ɕK[P@Tq(Fܡb {ՁO4@\߹6ZT]LVy(#,gRj|.`_Lg86 -}NVJۦ 7SPII-wi2.-IWń])K:Ɣ,Zi$I/ۇ/7#u +}NVJۦ 7SPII-wi2.-I!ń])K:Ɣ,Zi$I/ۇ/7#u A!t!Ht3 µJo~<nk0BD۽ >S6P˷F+u`bbg_1`qࡴowv"|  Ht)2iwW= b)X @@ -4235,355 +4229,362 @@ B Ȃ>^:=&ߡɸDUCkLECȔ11jûP;@.ފʒ)} Si[X?aG02y%qjDž=E >Qf$믝tm$(ۄ] VFFUtslo ~wapZqAk^RE-oQ ]Wi|{u$Xe|%OG]C0(MrM(tQ=| ab1lN# PAqGsfz€hk[Gzu9;WzW`⯙_q8#qIGnC2yluqm`F ,j-pa&&7Ъtq#ȏ"rCC"fu2Ff+Iw@ay6|mԑeOҳWAn~E\Ԉ+xWK#Wf6Ypޣ;sU񮣑eVH#Ym~,|~+4t=GQBbEt4O?s/j7f&ljQtִ K;mn͖#} `d-_ M3'-ZaSCr# H0Zykm|ӋQYs-H1$8\!֛﮻7%~]_r_axX~醾KQgWӏgby=Y^ŮrΧoW' Pendstream +ݡr[8!19a#mq8 _+{>u9;WzW`⯙_q8#qIGnC2yluqm`F ,j-pa&&7Ъtq#ȏ"rCC"fu2Ff+Iw@ay6|mԑeOҳWAn~E\Ԉ+xWK#Wf6Ypޣ;sU񮣑eVH#Ym~,|~+4t=GQBbEt4O?s/j7f&ljQtִ K;mn͖#} `d-_ M3'-ZaSCr# H0Zykm|ӋQYs-H1$8\!֛﮻7%~]_r_axX~醾KQgWӏgby=Y^ŮrΧoW' (endstream endobj -1810 0 obj<>/XObject<<>>>>>>endobj -1811 0 obj<>stream -xVn6}W Rhac]REeM*Iy3ڪ [̙3hBcLlJSʫq2ErN3=ůT8u0;ON?dG )+윲/N4^Z'$9Qm;?iٟ,^7#tV~Ъm&tzl`픣RiIP#ALI^:`ZEMyCBBxgҐYZ$3u Ok$sӻ,& 5[-+BR$ -^D} SV0w^6M#0Қ4捿kv_Vl>qBjtߦɜδ6T_'rݠ|4hMPLdF۩Jia%84r*P:zjע +1820 0 obj<>/XObject<<>>>>>>endobj +1821 0 obj<>stream +xVn6}W Rhac]REeM*Iy3ڪ [̙3hBcٔfWGdLg}+ q2}`vȎF74SV"9e_򓫝h4'$9Qm;?iٟ,^7#tV~Ъm&tzl`픣RiIP#ALI^:`ZEMyCBBxgҐYZ$3u Ok$sӻ,& 5[-+BR$ +^D} SV0w^6M#0Қ4kv_Vl>qBjtߦɜδ6T_'rݠ|4hMPLdF۩Jia%84r*P:zjע g; Pw6 +MtڛAǾjډ( -F]!p¤Dք /fL$QPYL#ԩG?XaA -w0JC|O$~ZinIBڬiov>-)]}XPy-J7-i@'u͗5]ih*hzz%R@L ? #+o*xixܬ̥zAY7_A=krBmVɭD)u = `;E,ŬE)PJgtXdqIOm|;@ -IҸ0 \xMW: ߰>hGeKQuxospXE\x0*zQN>&N~cÔݖs `Y>fkoRwH(0qCMgH`+DWRS!J 48ָw ԽB?mEZ^!o$`[/x$j'ZR)ckEXxRðk%t?ܨ5֑691ˠ$,Hth\9}Ӿuv(i7yw//ƟZ19evOendstream -endobj -1812 0 obj<>/XObject<<>>>>>>endobj -1813 0 obj<>stream -xW[OH~WeAh>+$eKR%^Lg~sƆ`AngsgJ|MdFGsI:)~ ^Ss9Ǵ(1e~_ -Ʉ4=Jg)-thh4ZjrW}.}-һZF^ˀ˛֚ enUIkpt;O`Te -V͋[iqq{xuKZDȺg^MՑQU_t6OBצj]P3|CZU­Qz@ՏA%X!MAu TtY 9OԦR~/7w/EaġnC4Pnpm dԟ8:SY!IS^+aZdv_'fEk+y &" cVPLyX1e*Ȉ^< mkz2J7rUmMŰGa_6Ykŗ ^J] -W L(TXvr2?} =68#w:DQF9W8xaɰuG"8 TAP/byJv$fK ͇P-RgʓV3 늷Dz@JK?^6H삕u"nktr^y`G) gJ@Ah;1Mol5['K+4Y1$E:L^|&þp70 '2So__g*[ʙo?j1^r}8Yf\8!ظ__-.oK4b0M*O'4Hc|Ekx~PQzID:LZ["mQAA+yRs%Vh&/NUE$g6.:QZT7/˶+H -'L3ꈙ{ҦBؐIG'#g'˵qֈnF3:CS9HOHoc2ol[g{ziTI-JH@ZtS9rT c U n Lj-0 i.bwO }wDZP/^78(3]_OS@&لq&>:CMBDȼ=69w{ʐHX?Ԫ58pj hYrPmjʆ݌Xʹw4RZA1@pl(S!EIR493⑺ž/# Gf{&_OY94uzDgt}q9.>!>&L`pta{x=_;Eendstream -endobj -1814 0 obj<>/XObject<<>>>>>>endobj -1815 0 obj<>stream -xV]OH}W"&_oRfZi%$4ۓΌܙIH]ZTAbߏs9~;Ft>Ɍ` ?s9#_Ld(,?LN?Mi4D҂x84?^UPFJ%C61XR*YHWo6R/d`lW$,݋&үC&(-lwzitCF~@%Փj,-6<ل*?ыL-Td3/\d@ɾT+Hr@%Z;ƥ4uF8b E[Ћt$"kmjAEZ*;dG> dx S#tgF"qHk{X:A别\#sв=.Χ@| :iJKY"F]CU_PկRľp~! #-*ȉ*.h@(`;'dP*4sxpIi w5[q4R&SbBc"76YQe\a{9k,EWㅭ&(]vLeJj D+mNn[ΆiuVUXd^Z$VBA@O\lC搀X/CjJW0XQ w-VBU h'QA;Qw&|T|9stWU1d V"3 .w[^{3n0Rv͞N^)73`p6θ@]h+DMlT]S+ycD}c!Ow J~yV rdxU 8}EamlS -v띵ţNP_,}rzz:4?႟Oh6:9 Z}y[<ƙlC_f~+]dFendstream -endobj -1816 0 obj<>/XObject<<>>>>>>endobj -1817 0 obj<>stream -x}Wo6 ` v$[tmd - -QTIɎ#)Yv%XxɌN;9-(NN'tv>,|ysYI+]+%>d㧧trBw5t;NlN8=jj -I*p"Vinh:>|}9477Ӓ+L[flOJRmMU72XT f,?l20IMwLijZK^îҍ[ieibB׹?'~BBgw}" ozhQ7dFYc?_q.d_ܼ~ED…=\P'({l[UP3 C$$cz.%8a -3f{0v%@gcXPY>HtW??ƖPh(Sf -f-+hp'Sd+ΜdӺ60e5 oՎ4 W LY Y k -*hjX3X3.c4(q>1-h/Cy1:5zdsFӉn !|*(@N=-5$A1]I7 E`HZOUX{_O4:h\yZ[F_Af|*` -'3G=PFB|Ll㺮NHwǓG &n?aWOh(mTڢ^R%M-Yh?̶={9C-fݿt%3%Hygjzd;V?ZΣb$ , ֐>Lw#]Sr[*7xȴJ_;c2a!$l -M!$B Eb*J|;(Ò5a_~qգQqz vC/`Ux c^ _-jǍsĻ(ɂP4v;}O?.{l-.ݾtn^&m+X<><}W'/dq1l`wN:endstream -endobj -1818 0 obj<>/XObject<<>>>>/Annots 1138 0 R>>endobj -1819 0 obj<>stream +F]!p¤Dք /fL$QPYL#ԩG?XaA -w0JC|O$~ZinIBڬiov>-)]}XPy-J7-i@'u͗5]ih*hzz%R@L ? #+o*xixܬ̥zAY7_A=krBmVɭD)u = `;E,ŬE)PJgtXdqIOm|;@ +IҸ0 \xMW: ߰>hGeKQuxospXE\x0*zQN>&N~cÔݖs `Y>fkoRwH(0AE lEhJJy \iS.r@S'mC+LxDD_*zl T +|~mdž:&6z)>N Ó5<'oڷΎ؟[#?E񴛟]C+&3̎~9O_endstream +endobj +1822 0 obj<>/XObject<<>>>>>>endobj +1823 0 obj<>stream +xW[OH~WeA"&h>+$eKR%^Lg~sƆ`AngsgFS|䐎;tJ3<>=C|{MbGӢĔ)~)çSZG(=LiCC{}LY=9:CMBDȼ=69w{ʐHX?Ԫ58pj hYrPmjʆ݌Xʹw4RZA1@r­QxξbKeqL1l w9^xJ X~qt%=24︇AJڄ%C5LZu_Dl*tߞ!>w8#n3mU&%9C /+.tirf#u=?}k_ +' +F@,}-8g$Mfsh'㇟?ֻ+r\} C<&LN0rgi:p{x=_;endstream +endobj +1824 0 obj<>/XObject<<>>>>>>endobj +1825 0 obj<>stream +xV]OF}W[/-lݦ`U8eIgƤ;3 Y/h~{ι߃ oDc̨lِ.sz?o%tb2eo}1;˦ϯOS(|vqNyEH<R^[WRiƴTI25C7:RVYKr~ſ m^vm#XO \pt/B|ȿ i0:~8V7rMQq5 VjP'IRy-_m}r]dD/1BVZiK]bo_boyC-VP%$8!FK(CxƥVxe_R y[ы$k*L"-B(ioVeX A*: kDU +Ues~rUmihˀ_ R >(%.h#.gϨgSPxH8p+Ԥ_*qKŦYfmSQe%(u0El'lM3%^I=3"6[n矯描c:r+銖D<'Tؙ)DF[&܆ר2Q* T `ZV?ba &cPkU0/#ٻ*FB+e(ULق2 +ր)T`"4* ZX XcFn^հ0Q-~]L+&Ҫ5C +:C^ߪ^^ ; ;K ;b];d9?=|E~H?Ⴟl2us$+2hn2y %?3]d1!|=tu?endstream +endobj +1826 0 obj<>/XObject<<>>>>>>endobj +1827 0 obj<>stream +x}Wmo6_q0q@ӵC͚lC|%f#*)s$%N{lJNrFd4l%>g%gWwg㏯hzNw9,O&t|t9;j|qi: K|m4I)Kp"+Wii<>|}9677Ӑۘ؞ʚeF$Y?t>qf㤏=J&45 É@YaWV2SfD׹?'~BBgO}" ozhQ7dZR(ȻHq2~6/:q1cB 6Qx@"ւWtNu~ɉD(TFZ1 + +( # i]ɺ@5NrCRQt6:+ud)ԃTiG[#Fl%`y#hGd Y'w,_Ъ)S>V +@Ȯ*ck߀ȷw' !CBی)|ӏR`d"nt֍-4B`v0TGq*]C Y1*F Uo(jۤL'w4O7QpxMQ)[)Z(Hqbv'b@'F|ek0뗠17_/rpԉJ?ݬ=6NԌ{P 昶{AIf0"NF/ǝŒ!̥] YTl*<= FųO䏱e;Z9ʔY!bYKAJ!Z?M+),J3g<5{4 `YhGf# }UCSC +3֌0  EO@L7@!O .$rf" +^0$ƪS,潯_'4 +|bTj'3G=RFB|Ml㺪NHwϓ' &n?aWOh(Uڠ^R)M Yh?̮=8C-fݿp%3%Hygjzd;V?Σ$ (N5֐ +>L{#]SrQƫp o>#Jn" jcu#S /^^~aL3 1v%aVh* &!Z(UQ-By$v$@v$:ԈK0z*c>BjmFk=n,}%}@9H{q g.紸\ +w;;xA)q'cr?}<_,GYpwd4endstream +endobj +1828 0 obj<>/XObject<<>>>>/Annots 1145 0 R>>endobj +1829 0 obj<>stream xWnF}WLiQ%9:mk3 VRbB\Ҋgf^DY;3gF4ߐCM(.&I0l*MNk/FpL^`~<\ !OYP8Q8 D8bW N&o?DG'Wc -CR2M)JDvs4hm<Ӧ>fnttOoF_ .xǣ01g(8 (Ү3mgxȦz)ELo vq'psxSt{!M\SY٢u"A(*s+[%lpPU2pt¡,*_eYkX;6yQZnR2*gr6W +CR2M)JDvs4hm<Ӧ>fnttOoF_ .xǣ01(8 (Ү3mgxȦz)ELo vq'psxSt{!M\SY٢u"A(*s+[%lpPU2pt¡,*_eYkX;6yQZnR2*gr6W @e&U:_j$l1+IvF|ؾ Qp q֋B眝٣*j ]9Cr+@:[']0pI\WЂARg/`Jm }?uvi Xp*p8YB h3M--'_6pL^g&P^ȺquK9 mP!$k-[agW\V:R{ujzNkgbK= `0JՎ.PV'J &s-^fQkdb+uj/Oo0 Q Ӷ4TLǮG(ȏ΍nq<@;ssFMw Ղΐ~WKV꼥ֽOwoxx-!}ܪ]K\paq;,!HTe6]\E 'H(c)K[uw<_Fo)<!VFەqУ XBvݏò-lO K(\rj`R햂>I,pwi#8K3 7Oj<+ޡ `9jے4sW>ofvEVzZ@M˺.ߟl6 -x>gm24k~*1_ lDW+/mxbtpτdLN,vz7Q;endstream -endobj -1820 0 obj<>endobj -1821 0 obj<>endobj -1822 0 obj<>endobj -1823 0 obj<>endobj -1824 0 obj<>endobj -1825 0 obj<>endobj -1826 0 obj<>endobj -1827 0 obj<>endobj -1828 0 obj<>endobj -1829 0 obj<>endobj -1830 0 obj<>endobj -1831 0 obj<>endobj -1832 0 obj<>endobj -1833 0 obj<>endobj -1834 0 obj<>endobj -1835 0 obj<>endobj -1836 0 obj<>endobj -1837 0 obj<>endobj -1838 0 obj<>endobj -1839 0 obj<>endobj -1840 0 obj<>endobj -1841 0 obj<>endobj -1842 0 obj<>endobj -1843 0 obj<>endobj -1844 0 obj<>endobj -1845 0 obj<>endobj -1846 0 obj<>endobj -1847 0 obj<>endobj -1848 0 obj<>endobj -1849 0 obj<>endobj -1850 0 obj<>endobj -1851 0 obj<>endobj -1852 0 obj<>endobj -1853 0 obj<>endobj -1854 0 obj<>endobj -1855 0 obj<>endobj -1856 0 obj<>endobj -1857 0 obj<>endobj -1858 0 obj<>endobj -1859 0 obj<>endobj -1860 0 obj<>endobj -1861 0 obj<>endobj -1862 0 obj<>endobj -1863 0 obj<>endobj -1864 0 obj<>endobj -1865 0 obj<>endobj -1866 0 obj<>endobj -1867 0 obj<>endobj -1868 0 obj<>endobj -1869 0 obj<>endobj -1870 0 obj<>endobj -1871 0 obj<>endobj -1872 0 obj<>endobj -1873 0 obj<>endobj -1874 0 obj<>endobj -1875 0 obj<>endobj -1876 0 obj<>endobj -1877 0 obj<>endobj -1878 0 obj<>endobj -1879 0 obj<>endobj -1880 0 obj<>endobj -1881 0 obj<>endobj -1882 0 obj<>endobj -1883 0 obj<>endobj -1884 0 obj<>endobj -1885 0 obj<>endobj -1886 0 obj<>endobj -1887 0 obj<>endobj -1888 0 obj<>endobj -1889 0 obj<>endobj -1890 0 obj<>endobj -1891 0 obj<>endobj -1892 0 obj<>endobj -1893 0 obj<>endobj -1894 0 obj<>endobj -1895 0 obj<>endobj -1896 0 obj<>endobj -1897 0 obj<>endobj -1898 0 obj<>endobj -1899 0 obj<>endobj -1900 0 obj<>endobj -1901 0 obj<>endobj -1902 0 obj<>endobj -1903 0 obj<>endobj -1904 0 obj<>endobj -1905 0 obj<>endobj -1906 0 obj<>endobj -1907 0 obj<>endobj -1908 0 obj<>endobj -1909 0 obj<>endobj -1910 0 obj<>endobj -1911 0 obj<>endobj -1912 0 obj<>endobj -1913 0 obj<>endobj -1914 0 obj<>endobj -1915 0 obj<>endobj -1916 0 obj<>endobj -1917 0 obj<>endobj -1918 0 obj<>endobj -1919 0 obj<>endobj -1920 0 obj<>endobj -1921 0 obj<>endobj -1922 0 obj<>endobj -1923 0 obj<>endobj -1924 0 obj<>endobj -1925 0 obj<>endobj -1926 0 obj<>endobj -1927 0 obj<>endobj -1928 0 obj<>endobj -1929 0 obj<>endobj -1930 0 obj<>endobj -1931 0 obj<>endobj -1932 0 obj<>endobj -1933 0 obj<>endobj -1934 0 obj<>endobj -1935 0 obj<>endobj -1936 0 obj<>endobj -1937 0 obj<>endobj -1938 0 obj<>endobj -1939 0 obj<>endobj -1940 0 obj<>endobj -1941 0 obj<>endobj -1942 0 obj<>endobj -1943 0 obj<>endobj -1944 0 obj<>endobj -1945 0 obj<>endobj -1946 0 obj<>endobj -1947 0 obj<>endobj -1948 0 obj<>endobj -1949 0 obj<>endobj -1950 0 obj<>endobj -1951 0 obj<>endobj -1952 0 obj<>endobj -1953 0 obj<>endobj -1954 0 obj<>endobj -1955 0 obj<>endobj -1956 0 obj<>endobj -1957 0 obj<>endobj -1958 0 obj<>endobj -1959 0 obj<>endobj -1960 0 obj<>endobj -1961 0 obj<>endobj -1962 0 obj<>endobj -1963 0 obj<>endobj -1964 0 obj<>endobj -1965 0 obj<>endobj -1966 0 obj<>endobj -1967 0 obj<>endobj -1968 0 obj<>endobj -1969 0 obj<>endobj -1970 0 obj<>endobj -1971 0 obj<>endobj -1972 0 obj<>endobj -1973 0 obj<>endobj -1974 0 obj<>endobj -1975 0 obj<>endobj -1976 0 obj<>endobj -1977 0 obj<>endobj -1978 0 obj<>endobj -1979 0 obj<>endobj -1980 0 obj<>endobj -1981 0 obj<>endobj -1982 0 obj<>endobj -1983 0 obj<>endobj -1984 0 obj<>endobj -1985 0 obj<>endobj -1986 0 obj<>endobj -1987 0 obj<>endobj -1988 0 obj<>endobj -1989 0 obj<>endobj -1990 0 obj<>endobj -1991 0 obj<>endobj -1992 0 obj<>endobj -1993 0 obj<>endobj -1994 0 obj<>endobj -1995 0 obj<>endobj -1996 0 obj<>endobj -1997 0 obj<>endobj -1998 0 obj<>endobj -1999 0 obj<>endobj -2000 0 obj<>endobj -2001 0 obj<>endobj -2002 0 obj<>endobj -2003 0 obj<>endobj -2004 0 obj<>endobj -2005 0 obj<>endobj -2006 0 obj<>endobj -2007 0 obj<>endobj -2008 0 obj<>endobj -2009 0 obj<>endobj -2010 0 obj<>endobj -2011 0 obj<>endobj -2012 0 obj<>endobj -2013 0 obj<>endobj -2014 0 obj<>endobj -2015 0 obj<>endobj -2016 0 obj<>endobj -2017 0 obj<>endobj -2018 0 obj<>endobj -2019 0 obj<>endobj -2020 0 obj<>endobj -2021 0 obj<>endobj -2022 0 obj<>endobj -2023 0 obj<>endobj -2024 0 obj<>endobj -2025 0 obj<>endobj -2026 0 obj<>endobj -2027 0 obj<>endobj -2028 0 obj<>endobj -2029 0 obj<>endobj -2030 0 obj<>endobj -2031 0 obj<>endobj -2032 0 obj<>endobj -2033 0 obj<>endobj -2034 0 obj<>endobj -2035 0 obj<>endobj -2036 0 obj<>endobj -2037 0 obj<>endobj -2038 0 obj<>endobj -2039 0 obj<>endobj -2040 0 obj<>endobj -2041 0 obj<>endobj -2042 0 obj<>endobj -2043 0 obj<>endobj -2044 0 obj<>endobj -2045 0 obj<>endobj -2046 0 obj<>endobj -2047 0 obj<>endobj -2048 0 obj<>endobj -2049 0 obj<>endobj -2050 0 obj<>endobj -2051 0 obj<>endobj -2052 0 obj<>endobj -2053 0 obj<>endobj -2054 0 obj<>endobj -2055 0 obj<>endobj -2056 0 obj<>endobj -2057 0 obj<>endobj -2058 0 obj<>endobj -2059 0 obj<>endobj -2060 0 obj<>endobj -2061 0 obj<>endobj -2062 0 obj<>endobj -2063 0 obj<>endobj -2064 0 obj<>endobj -2065 0 obj<>endobj -2066 0 obj<>endobj -2067 0 obj<>endobj -2068 0 obj<>endobj -2069 0 obj<>endobj -2070 0 obj<>endobj -2071 0 obj<>endobj -2072 0 obj<>endobj -2073 0 obj<>endobj -2074 0 obj<>endobj -2075 0 obj<>endobj -2076 0 obj<>endobj -2077 0 obj<>endobj -2078 0 obj<>endobj -2079 0 obj<>endobj -2080 0 obj<>endobj -2081 0 obj<>endobj -2082 0 obj<>endobj -2083 0 obj<>endobj -2084 0 obj<>endobj -2085 0 obj<>endobj -2086 0 obj<>endobj -2087 0 obj<>endobj -2088 0 obj<>endobj -2089 0 obj<>endobj -2090 0 obj<>endobj -2091 0 obj<>endobj -2092 0 obj<>endobj -2093 0 obj<>endobj -2094 0 obj<>endobj -2095 0 obj<>endobj -2096 0 obj<>endobj -2097 0 obj<>endobj -2098 0 obj<>endobj -2099 0 obj<>endobj -2100 0 obj<>endobj -2101 0 obj<>endobj -2102 0 obj<>endobj -2103 0 obj<>endobj -2104 0 obj<>endobj -2105 0 obj<>endobj -2106 0 obj<>endobj -2107 0 obj<>endobj -2108 0 obj<>endobj -2109 0 obj<>endobj -2110 0 obj<>endobj -2111 0 obj<>endobj -2112 0 obj<>endobj -2113 0 obj<>endobj -2114 0 obj<>1<>8<>9<>13<>14<>16<>20<>25<>37<>38<>40<>42<>46<>57<>60<>62<>64<>65<>68<>76<>81<>82<>85<>96<>113<>126<>133<>142<>144<>147<>149<>150<>152<>156<>159<>163<>168<>170<>]>>>>endobj +x>gm24k~*1_ lDW+/mxbtpτdLN,vz7:endstream +endobj +1830 0 obj<>endobj +1831 0 obj<>endobj +1832 0 obj<>endobj +1833 0 obj<>endobj +1834 0 obj<>endobj +1835 0 obj<>endobj +1836 0 obj<>endobj +1837 0 obj<>endobj +1838 0 obj<>endobj +1839 0 obj<>endobj +1840 0 obj<>endobj +1841 0 obj<>endobj +1842 0 obj<>endobj +1843 0 obj<>endobj +1844 0 obj<>endobj +1845 0 obj<>endobj +1846 0 obj<>endobj +1847 0 obj<>endobj +1848 0 obj<>endobj +1849 0 obj<>endobj +1850 0 obj<>endobj +1851 0 obj<>endobj +1852 0 obj<>endobj +1853 0 obj<>endobj +1854 0 obj<>endobj +1855 0 obj<>endobj +1856 0 obj<>endobj +1857 0 obj<>endobj +1858 0 obj<>endobj +1859 0 obj<>endobj +1860 0 obj<>endobj +1861 0 obj<>endobj +1862 0 obj<>endobj +1863 0 obj<>endobj +1864 0 obj<>endobj +1865 0 obj<>endobj +1866 0 obj<>endobj +1867 0 obj<>endobj +1868 0 obj<>endobj +1869 0 obj<>endobj +1870 0 obj<>endobj +1871 0 obj<>endobj +1872 0 obj<>endobj +1873 0 obj<>endobj +1874 0 obj<>endobj +1875 0 obj<>endobj +1876 0 obj<>endobj +1877 0 obj<>endobj +1878 0 obj<>endobj +1879 0 obj<>endobj +1880 0 obj<>endobj +1881 0 obj<>endobj +1882 0 obj<>endobj +1883 0 obj<>endobj +1884 0 obj<>endobj +1885 0 obj<>endobj +1886 0 obj<>endobj +1887 0 obj<>endobj +1888 0 obj<>endobj +1889 0 obj<>endobj +1890 0 obj<>endobj +1891 0 obj<>endobj +1892 0 obj<>endobj +1893 0 obj<>endobj +1894 0 obj<>endobj +1895 0 obj<>endobj +1896 0 obj<>endobj +1897 0 obj<>endobj +1898 0 obj<>endobj +1899 0 obj<>endobj +1900 0 obj<>endobj +1901 0 obj<>endobj +1902 0 obj<>endobj +1903 0 obj<>endobj +1904 0 obj<>endobj +1905 0 obj<>endobj +1906 0 obj<>endobj +1907 0 obj<>endobj +1908 0 obj<>endobj +1909 0 obj<>endobj +1910 0 obj<>endobj +1911 0 obj<>endobj +1912 0 obj<>endobj +1913 0 obj<>endobj +1914 0 obj<>endobj +1915 0 obj<>endobj +1916 0 obj<>endobj +1917 0 obj<>endobj +1918 0 obj<>endobj +1919 0 obj<>endobj +1920 0 obj<>endobj +1921 0 obj<>endobj +1922 0 obj<>endobj +1923 0 obj<>endobj +1924 0 obj<>endobj +1925 0 obj<>endobj +1926 0 obj<>endobj +1927 0 obj<>endobj +1928 0 obj<>endobj +1929 0 obj<>endobj +1930 0 obj<>endobj +1931 0 obj<>endobj +1932 0 obj<>endobj +1933 0 obj<>endobj +1934 0 obj<>endobj +1935 0 obj<>endobj +1936 0 obj<>endobj +1937 0 obj<>endobj +1938 0 obj<>endobj +1939 0 obj<>endobj +1940 0 obj<>endobj +1941 0 obj<>endobj +1942 0 obj<>endobj +1943 0 obj<>endobj +1944 0 obj<>endobj +1945 0 obj<>endobj +1946 0 obj<>endobj +1947 0 obj<>endobj +1948 0 obj<>endobj +1949 0 obj<>endobj +1950 0 obj<>endobj +1951 0 obj<>endobj +1952 0 obj<>endobj +1953 0 obj<>endobj +1954 0 obj<>endobj +1955 0 obj<>endobj +1956 0 obj<>endobj +1957 0 obj<>endobj +1958 0 obj<>endobj +1959 0 obj<>endobj +1960 0 obj<>endobj +1961 0 obj<>endobj +1962 0 obj<>endobj +1963 0 obj<>endobj +1964 0 obj<>endobj +1965 0 obj<>endobj +1966 0 obj<>endobj +1967 0 obj<>endobj +1968 0 obj<>endobj +1969 0 obj<>endobj +1970 0 obj<>endobj +1971 0 obj<>endobj +1972 0 obj<>endobj +1973 0 obj<>endobj +1974 0 obj<>endobj +1975 0 obj<>endobj +1976 0 obj<>endobj +1977 0 obj<>endobj +1978 0 obj<>endobj +1979 0 obj<>endobj +1980 0 obj<>endobj +1981 0 obj<>endobj +1982 0 obj<>endobj +1983 0 obj<>endobj +1984 0 obj<>endobj +1985 0 obj<>endobj +1986 0 obj<>endobj +1987 0 obj<>endobj +1988 0 obj<>endobj +1989 0 obj<>endobj +1990 0 obj<>endobj +1991 0 obj<>endobj +1992 0 obj<>endobj +1993 0 obj<>endobj +1994 0 obj<>endobj +1995 0 obj<>endobj +1996 0 obj<>endobj +1997 0 obj<>endobj +1998 0 obj<>endobj +1999 0 obj<>endobj +2000 0 obj<>endobj +2001 0 obj<>endobj +2002 0 obj<>endobj +2003 0 obj<>endobj +2004 0 obj<>endobj +2005 0 obj<>endobj +2006 0 obj<>endobj +2007 0 obj<>endobj +2008 0 obj<>endobj +2009 0 obj<>endobj +2010 0 obj<>endobj +2011 0 obj<>endobj +2012 0 obj<>endobj +2013 0 obj<>endobj +2014 0 obj<>endobj +2015 0 obj<>endobj +2016 0 obj<>endobj +2017 0 obj<>endobj +2018 0 obj<>endobj +2019 0 obj<>endobj +2020 0 obj<>endobj +2021 0 obj<>endobj +2022 0 obj<>endobj +2023 0 obj<>endobj +2024 0 obj<>endobj +2025 0 obj<>endobj +2026 0 obj<>endobj +2027 0 obj<>endobj +2028 0 obj<>endobj +2029 0 obj<>endobj +2030 0 obj<>endobj +2031 0 obj<>endobj +2032 0 obj<>endobj +2033 0 obj<>endobj +2034 0 obj<>endobj +2035 0 obj<>endobj +2036 0 obj<>endobj +2037 0 obj<>endobj +2038 0 obj<>endobj +2039 0 obj<>endobj +2040 0 obj<>endobj +2041 0 obj<>endobj +2042 0 obj<>endobj +2043 0 obj<>endobj +2044 0 obj<>endobj +2045 0 obj<>endobj +2046 0 obj<>endobj +2047 0 obj<>endobj +2048 0 obj<>endobj +2049 0 obj<>endobj +2050 0 obj<>endobj +2051 0 obj<>endobj +2052 0 obj<>endobj +2053 0 obj<>endobj +2054 0 obj<>endobj +2055 0 obj<>endobj +2056 0 obj<>endobj +2057 0 obj<>endobj +2058 0 obj<>endobj +2059 0 obj<>endobj +2060 0 obj<>endobj +2061 0 obj<>endobj +2062 0 obj<>endobj +2063 0 obj<>endobj +2064 0 obj<>endobj +2065 0 obj<>endobj +2066 0 obj<>endobj +2067 0 obj<>endobj +2068 0 obj<>endobj +2069 0 obj<>endobj +2070 0 obj<>endobj +2071 0 obj<>endobj +2072 0 obj<>endobj +2073 0 obj<>endobj +2074 0 obj<>endobj +2075 0 obj<>endobj +2076 0 obj<>endobj +2077 0 obj<>endobj +2078 0 obj<>endobj +2079 0 obj<>endobj +2080 0 obj<>endobj +2081 0 obj<>endobj +2082 0 obj<>endobj +2083 0 obj<>endobj +2084 0 obj<>endobj +2085 0 obj<>endobj +2086 0 obj<>endobj +2087 0 obj<>endobj +2088 0 obj<>endobj +2089 0 obj<>endobj +2090 0 obj<>endobj +2091 0 obj<>endobj +2092 0 obj<>endobj +2093 0 obj<>endobj +2094 0 obj<>endobj +2095 0 obj<>endobj +2096 0 obj<>endobj +2097 0 obj<>endobj +2098 0 obj<>endobj +2099 0 obj<>endobj +2100 0 obj<>endobj +2101 0 obj<>endobj +2102 0 obj<>endobj +2103 0 obj<>endobj +2104 0 obj<>endobj +2105 0 obj<>endobj +2106 0 obj<>endobj +2107 0 obj<>endobj +2108 0 obj<>endobj +2109 0 obj<>endobj +2110 0 obj<>endobj +2111 0 obj<>endobj +2112 0 obj<>endobj +2113 0 obj<>endobj +2114 0 obj<>endobj +2115 0 obj<>endobj +2116 0 obj<>endobj +2117 0 obj<>endobj +2118 0 obj<>endobj +2119 0 obj<>endobj +2120 0 obj<>endobj +2121 0 obj<>endobj +2122 0 obj<>endobj +2123 0 obj<>endobj +2124 0 obj<>endobj +2125 0 obj<>endobj +2126 0 obj<>1<>8<>9<>13<>14<>15<>19<>24<>35<>36<>38<>40<>44<>55<>58<>60<>62<>63<>66<>67<>72<>73<>76<>87<>104<>117<>120<>126<>133<>142<>144<>147<>149<>150<>152<>156<>159<>163<>168<>170<>]>>>>endobj xref -0 2115 +0 2127 0000000000 65535 f 0000000015 00000 n 0000000247 00000 n @@ -4652,23 +4653,23 @@ xref 0000009060 00000 n 0000009163 00000 n 0000009266 00000 n -0000009369 00000 n -0000009472 00000 n -0000009575 00000 n -0000009677 00000 n -0000009779 00000 n +0000009368 00000 n +0000009470 00000 n +0000009572 00000 n +0000009675 00000 n +0000009778 00000 n 0000009881 00000 n 0000009984 00000 n -0000010087 00000 n -0000010190 00000 n -0000010293 00000 n +0000010086 00000 n +0000010189 00000 n +0000010292 00000 n 0000010395 00000 n 0000010498 00000 n 0000010601 00000 n 0000010704 00000 n -0000010807 00000 n -0000010910 00000 n -0000011013 00000 n +0000010806 00000 n +0000010909 00000 n +0000011012 00000 n 0000011115 00000 n 0000011218 00000 n 0000011321 00000 n @@ -4678,9 +4679,9 @@ xref 0000011733 00000 n 0000011836 00000 n 0000011939 00000 n -0000012042 00000 n -0000012145 00000 n -0000012248 00000 n +0000012041 00000 n +0000012144 00000 n +0000012247 00000 n 0000012350 00000 n 0000012453 00000 n 0000012556 00000 n @@ -4690,2017 +4691,2029 @@ xref 0000013175 00000 n 0000013278 00000 n 0000013382 00000 n -0000013486 00000 n -0000013590 00000 n -0000013694 00000 n +0000013485 00000 n +0000013589 00000 n +0000013693 00000 n 0000013797 00000 n 0000013901 00000 n 0000014005 00000 n 0000014109 00000 n 0000014213 00000 n -0000014317 00000 n -0000014421 00000 n -0000014525 00000 n -0000014628 00000 n -0000014732 00000 n -0000014836 00000 n -0000014939 00000 n -0000015042 00000 n -0000015145 00000 n -0000015249 00000 n -0000015353 00000 n -0000015457 00000 n -0000015561 00000 n -0000015665 00000 n -0000015769 00000 n -0000015873 00000 n -0000015977 00000 n -0000016081 00000 n -0000016185 00000 n -0000016289 00000 n -0000016393 00000 n -0000016496 00000 n -0000016600 00000 n -0000016704 00000 n -0000016808 00000 n -0000016912 00000 n -0000017016 00000 n -0000017120 00000 n -0000017224 00000 n -0000017327 00000 n -0000017429 00000 n -0000017774 00000 n -0000017877 00000 n -0000017980 00000 n -0000018084 00000 n -0000018188 00000 n -0000018292 00000 n -0000018395 00000 n -0000018499 00000 n -0000018603 00000 n -0000018707 00000 n -0000018811 00000 n -0000018915 00000 n -0000019019 00000 n -0000019123 00000 n -0000019227 00000 n -0000019331 00000 n -0000019435 00000 n -0000019539 00000 n -0000019643 00000 n -0000019747 00000 n -0000019851 00000 n -0000019955 00000 n -0000020059 00000 n -0000020163 00000 n -0000020267 00000 n -0000020371 00000 n -0000020475 00000 n -0000020579 00000 n -0000020683 00000 n -0000020786 00000 n -0000020890 00000 n -0000020994 00000 n -0000021098 00000 n -0000021202 00000 n -0000021306 00000 n -0000021410 00000 n -0000021514 00000 n -0000021618 00000 n -0000021721 00000 n -0000021825 00000 n -0000021929 00000 n -0000022033 00000 n -0000022136 00000 n -0000022238 00000 n -0000022340 00000 n -0000022709 00000 n -0000022812 00000 n -0000022916 00000 n -0000023020 00000 n -0000023124 00000 n -0000023228 00000 n -0000023332 00000 n -0000023436 00000 n -0000023540 00000 n -0000023644 00000 n -0000023748 00000 n -0000023852 00000 n -0000023956 00000 n -0000024059 00000 n -0000024163 00000 n -0000024267 00000 n -0000024371 00000 n -0000024475 00000 n -0000024579 00000 n -0000024683 00000 n -0000024787 00000 n -0000024891 00000 n -0000024995 00000 n -0000025099 00000 n -0000025203 00000 n -0000025306 00000 n -0000025410 00000 n -0000025514 00000 n -0000025618 00000 n -0000025722 00000 n -0000025826 00000 n -0000025930 00000 n -0000026034 00000 n -0000026138 00000 n -0000026242 00000 n -0000026346 00000 n -0000026450 00000 n -0000026554 00000 n -0000026657 00000 n -0000026761 00000 n -0000026865 00000 n -0000026968 00000 n -0000027071 00000 n -0000027173 00000 n -0000027275 00000 n -0000027644 00000 n -0000027747 00000 n -0000027851 00000 n -0000027955 00000 n -0000028059 00000 n -0000028163 00000 n -0000028267 00000 n -0000028370 00000 n -0000028474 00000 n -0000028578 00000 n -0000028682 00000 n -0000028786 00000 n -0000028890 00000 n -0000028994 00000 n -0000029097 00000 n -0000029201 00000 n -0000029305 00000 n -0000029408 00000 n -0000029511 00000 n -0000029615 00000 n -0000029719 00000 n -0000029823 00000 n -0000029927 00000 n -0000030031 00000 n -0000030135 00000 n -0000030239 00000 n -0000030343 00000 n -0000030447 00000 n -0000030551 00000 n -0000030654 00000 n -0000030758 00000 n -0000030862 00000 n -0000030966 00000 n -0000031070 00000 n -0000031174 00000 n -0000031278 00000 n -0000031381 00000 n -0000031485 00000 n -0000031589 00000 n -0000031693 00000 n -0000031796 00000 n -0000031898 00000 n -0000032000 00000 n -0000032353 00000 n -0000032456 00000 n -0000032560 00000 n -0000032664 00000 n -0000032768 00000 n -0000032872 00000 n -0000032976 00000 n -0000033080 00000 n -0000033184 00000 n -0000033288 00000 n -0000033391 00000 n -0000033495 00000 n -0000033599 00000 n -0000033703 00000 n -0000033807 00000 n -0000033911 00000 n -0000034015 00000 n -0000034119 00000 n -0000034223 00000 n -0000034327 00000 n -0000034430 00000 n -0000034534 00000 n -0000034638 00000 n -0000034742 00000 n -0000034846 00000 n -0000034950 00000 n -0000035054 00000 n -0000035157 00000 n -0000035261 00000 n -0000035365 00000 n -0000035469 00000 n -0000035573 00000 n -0000035677 00000 n -0000035781 00000 n -0000035885 00000 n -0000035989 00000 n -0000036093 00000 n -0000036197 00000 n -0000036301 00000 n -0000036405 00000 n -0000036509 00000 n -0000036613 00000 n -0000036717 00000 n -0000037070 00000 n -0000037123 00000 n -0000037210 00000 n -0000037264 00000 n -0000037350 00000 n -0000037405 00000 n -0000037492 00000 n -0000037559 00000 n -0000037645 00000 n -0000037748 00000 n -0000037852 00000 n -0000037956 00000 n -0000038060 00000 n -0000038164 00000 n -0000038268 00000 n -0000038372 00000 n -0000038476 00000 n -0000038580 00000 n -0000038684 00000 n -0000038788 00000 n -0000038892 00000 n -0000038996 00000 n -0000039100 00000 n -0000039204 00000 n -0000039308 00000 n -0000039412 00000 n -0000039516 00000 n -0000039620 00000 n -0000039724 00000 n -0000039828 00000 n -0000039932 00000 n -0000040036 00000 n -0000040140 00000 n -0000040244 00000 n -0000040348 00000 n -0000040451 00000 n -0000040555 00000 n -0000040659 00000 n -0000040763 00000 n -0000040867 00000 n -0000040970 00000 n -0000041072 00000 n -0000041174 00000 n -0000041495 00000 n -0000041599 00000 n -0000041703 00000 n -0000041807 00000 n -0000041911 00000 n -0000042015 00000 n -0000042119 00000 n -0000042223 00000 n -0000042327 00000 n -0000042431 00000 n -0000042535 00000 n -0000042639 00000 n -0000042743 00000 n -0000042847 00000 n -0000042951 00000 n -0000043055 00000 n -0000043159 00000 n -0000043263 00000 n -0000043367 00000 n -0000043471 00000 n -0000043575 00000 n -0000043679 00000 n -0000043783 00000 n -0000043887 00000 n -0000043991 00000 n -0000044095 00000 n -0000044197 00000 n -0000044301 00000 n -0000044405 00000 n -0000044509 00000 n -0000044613 00000 n -0000044717 00000 n -0000044821 00000 n -0000044925 00000 n -0000045029 00000 n -0000045133 00000 n -0000045237 00000 n -0000045341 00000 n -0000045445 00000 n -0000045549 00000 n -0000045653 00000 n -0000045757 00000 n -0000045861 00000 n -0000045965 00000 n -0000046069 00000 n -0000046173 00000 n -0000046277 00000 n -0000046381 00000 n -0000046485 00000 n -0000046589 00000 n -0000046693 00000 n -0000046796 00000 n -0000046898 00000 n -0000047000 00000 n -0000047441 00000 n -0000047545 00000 n -0000047649 00000 n -0000047753 00000 n -0000047857 00000 n -0000047961 00000 n -0000048065 00000 n -0000048169 00000 n -0000048273 00000 n -0000048377 00000 n -0000048481 00000 n -0000048585 00000 n -0000048689 00000 n -0000048793 00000 n -0000048897 00000 n -0000049001 00000 n -0000049105 00000 n -0000049209 00000 n -0000049313 00000 n -0000049417 00000 n -0000049521 00000 n -0000049625 00000 n -0000049729 00000 n -0000049833 00000 n -0000049937 00000 n -0000050041 00000 n -0000050145 00000 n -0000050249 00000 n -0000050353 00000 n -0000050457 00000 n -0000050561 00000 n -0000050665 00000 n -0000050769 00000 n -0000050873 00000 n -0000050977 00000 n -0000051081 00000 n -0000051185 00000 n -0000051289 00000 n -0000051393 00000 n -0000051497 00000 n -0000051601 00000 n -0000051705 00000 n -0000051808 00000 n -0000051912 00000 n -0000052016 00000 n -0000052120 00000 n -0000052224 00000 n -0000052328 00000 n -0000052432 00000 n -0000052535 00000 n -0000052637 00000 n -0000052739 00000 n -0000053164 00000 n -0000053268 00000 n -0000053372 00000 n -0000053476 00000 n -0000053580 00000 n -0000053684 00000 n -0000053788 00000 n -0000053892 00000 n -0000053996 00000 n -0000054100 00000 n -0000054204 00000 n -0000054308 00000 n -0000054412 00000 n -0000054516 00000 n -0000054620 00000 n -0000054724 00000 n -0000054828 00000 n -0000054932 00000 n -0000055036 00000 n -0000055140 00000 n -0000055244 00000 n -0000055348 00000 n -0000055452 00000 n -0000055556 00000 n -0000055660 00000 n -0000055764 00000 n -0000055868 00000 n -0000055972 00000 n -0000056076 00000 n -0000056180 00000 n -0000056284 00000 n -0000056388 00000 n -0000056653 00000 n -0000056756 00000 n -0000056860 00000 n -0000056964 00000 n -0000057068 00000 n -0000057172 00000 n -0000057276 00000 n -0000057380 00000 n -0000057484 00000 n -0000057588 00000 n -0000057692 00000 n -0000057796 00000 n -0000057899 00000 n -0000058003 00000 n -0000058107 00000 n -0000058211 00000 n -0000058315 00000 n -0000058419 00000 n -0000058523 00000 n -0000058627 00000 n -0000058730 00000 n -0000058834 00000 n -0000058938 00000 n -0000059042 00000 n -0000059146 00000 n -0000059250 00000 n -0000059354 00000 n -0000059458 00000 n -0000059562 00000 n -0000059666 00000 n -0000059770 00000 n -0000059874 00000 n -0000059978 00000 n -0000060082 00000 n -0000060186 00000 n -0000060290 00000 n -0000060394 00000 n -0000060498 00000 n -0000060602 00000 n -0000060706 00000 n -0000060810 00000 n -0000060914 00000 n -0000061017 00000 n -0000061119 00000 n -0000061221 00000 n -0000061590 00000 n -0000061694 00000 n -0000061798 00000 n -0000061831 00000 n -0000061880 00000 n -0000061967 00000 n -0000061992 00000 n -0000062048 00000 n -0000062135 00000 n -0000062204 00000 n -0000062291 00000 n -0000062342 00000 n -0000062429 00000 n -0000062514 00000 n -0000062601 00000 n -0000062657 00000 n -0000062744 00000 n -0000062794 00000 n -0000062881 00000 n -0000062933 00000 n -0000063019 00000 n -0000063092 00000 n -0000063148 00000 n -0000063235 00000 n -0000063283 00000 n -0000063369 00000 n -0000063417 00000 n -0000063504 00000 n -0000063545 00000 n -0000063586 00000 n -0000063673 00000 n -0000063717 00000 n -0000063804 00000 n -0000063849 00000 n -0000063936 00000 n -0000063980 00000 n -0000064067 00000 n -0000064111 00000 n -0000064198 00000 n -0000064240 00000 n -0000064327 00000 n -0000064375 00000 n -0000064462 00000 n -0000064535 00000 n -0000064583 00000 n -0000064668 00000 n -0000064693 00000 n -0000064746 00000 n -0000064830 00000 n -0000064855 00000 n -0000064958 00000 n -0000065062 00000 n -0000065166 00000 n -0000065270 00000 n -0000065374 00000 n -0000065477 00000 n -0000065581 00000 n -0000065685 00000 n -0000065789 00000 n -0000065893 00000 n -0000065997 00000 n -0000066101 00000 n -0000066204 00000 n -0000066308 00000 n -0000066412 00000 n -0000066516 00000 n -0000066620 00000 n -0000066724 00000 n -0000066828 00000 n -0000066932 00000 n -0000067036 00000 n -0000067140 00000 n -0000067244 00000 n -0000067348 00000 n -0000067451 00000 n -0000067555 00000 n -0000067659 00000 n -0000067763 00000 n -0000067867 00000 n -0000067971 00000 n -0000068075 00000 n -0000068179 00000 n -0000068283 00000 n -0000068387 00000 n -0000068490 00000 n -0000068594 00000 n -0000068698 00000 n -0000068802 00000 n -0000068906 00000 n -0000069010 00000 n -0000069114 00000 n -0000069218 00000 n -0000069322 00000 n -0000069425 00000 n -0000069526 00000 n -0000069628 00000 n -0000070013 00000 n -0000070117 00000 n -0000070142 00000 n -0000070189 00000 n -0000070275 00000 n -0000070322 00000 n -0000070408 00000 n -0000070441 00000 n -0000070486 00000 n -0000070573 00000 n -0000070618 00000 n -0000070704 00000 n -0000070737 00000 n -0000070785 00000 n -0000070872 00000 n -0000070897 00000 n -0000070945 00000 n -0000071032 00000 n -0000071077 00000 n -0000071163 00000 n -0000071206 00000 n -0000071292 00000 n -0000071333 00000 n -0000071419 00000 n -0000071468 00000 n -0000071554 00000 n -0000071600 00000 n -0000071686 00000 n -0000071731 00000 n -0000071817 00000 n -0000071869 00000 n -0000071955 00000 n -0000072005 00000 n -0000072091 00000 n -0000072137 00000 n -0000072223 00000 n -0000072266 00000 n -0000072352 00000 n -0000072396 00000 n -0000072482 00000 n -0000072525 00000 n -0000072611 00000 n -0000072656 00000 n -0000072742 00000 n -0000072780 00000 n -0000072866 00000 n -0000072908 00000 n -0000072994 00000 n -0000073037 00000 n -0000073123 00000 n -0000073161 00000 n -0000073247 00000 n -0000073289 00000 n -0000073375 00000 n -0000073419 00000 n -0000073505 00000 n -0000073552 00000 n -0000073638 00000 n -0000073686 00000 n -0000073771 00000 n -0000073964 00000 n -0000074013 00000 n -0000074099 00000 n -0000074124 00000 n -0000074171 00000 n -0000074258 00000 n -0000074283 00000 n -0000074338 00000 n -0000074425 00000 n -0000074481 00000 n -0000074568 00000 n -0000074601 00000 n -0000074649 00000 n -0000074736 00000 n -0000074810 00000 n -0000074897 00000 n -0000074965 00000 n -0000075052 00000 n -0000075106 00000 n -0000075193 00000 n -0000075261 00000 n -0000075348 00000 n -0000075422 00000 n -0000075509 00000 n -0000075557 00000 n -0000075644 00000 n -0000075701 00000 n -0000075788 00000 n -0000075869 00000 n -0000075924 00000 n -0000076011 00000 n -0000076092 00000 n -0000076179 00000 n -0000076212 00000 n -0000076265 00000 n -0000076352 00000 n -0000076377 00000 n -0000076425 00000 n -0000076512 00000 n -0000076554 00000 n -0000076641 00000 n -0000076684 00000 n -0000076771 00000 n -0000076821 00000 n -0000076908 00000 n -0000076956 00000 n -0000077043 00000 n -0000077100 00000 n -0000077143 00000 n -0000077230 00000 n -0000077284 00000 n -0000077371 00000 n -0000077416 00000 n -0000077503 00000 n -0000077560 00000 n -0000077646 00000 n -0000077742 00000 n -0000077827 00000 n -0000077884 00000 n -0000077987 00000 n -0000078091 00000 n -0000078195 00000 n -0000078299 00000 n -0000078403 00000 n -0000078507 00000 n -0000078611 00000 n -0000078715 00000 n -0000078819 00000 n -0000078923 00000 n -0000079027 00000 n -0000079131 00000 n -0000079235 00000 n -0000079338 00000 n -0000079442 00000 n -0000079546 00000 n -0000079650 00000 n -0000079754 00000 n -0000079858 00000 n -0000079962 00000 n -0000080066 00000 n -0000080170 00000 n -0000080274 00000 n -0000080377 00000 n -0000080480 00000 n -0000080584 00000 n -0000080688 00000 n -0000080792 00000 n -0000080895 00000 n -0000080999 00000 n -0000081103 00000 n -0000081207 00000 n -0000081311 00000 n -0000081415 00000 n -0000081519 00000 n -0000081623 00000 n -0000081727 00000 n -0000081831 00000 n -0000081935 00000 n -0000082039 00000 n -0000082143 00000 n -0000082246 00000 n -0000082348 00000 n -0000082450 00000 n -0000082819 00000 n -0000082923 00000 n -0000083027 00000 n -0000083131 00000 n -0000083235 00000 n -0000083339 00000 n -0000083443 00000 n -0000083547 00000 n -0000083650 00000 n -0000083754 00000 n -0000083858 00000 n -0000083962 00000 n -0000084066 00000 n -0000084170 00000 n -0000084274 00000 n -0000084378 00000 n -0000084482 00000 n -0000084585 00000 n -0000084689 00000 n -0000084793 00000 n -0000084897 00000 n -0000085001 00000 n -0000085105 00000 n -0000085209 00000 n -0000085313 00000 n -0000085417 00000 n -0000085521 00000 n -0000085625 00000 n -0000085729 00000 n -0000085833 00000 n -0000085937 00000 n -0000086041 00000 n -0000086145 00000 n -0000086249 00000 n -0000086353 00000 n -0000086456 00000 n -0000086560 00000 n -0000086664 00000 n -0000086768 00000 n -0000086872 00000 n -0000086976 00000 n -0000087080 00000 n -0000087184 00000 n -0000087288 00000 n -0000087392 00000 n -0000087496 00000 n -0000087600 00000 n -0000087703 00000 n -0000087807 00000 n -0000087910 00000 n -0000088012 00000 n -0000088114 00000 n -0000088539 00000 n -0000088643 00000 n -0000088747 00000 n -0000088851 00000 n -0000088955 00000 n -0000089059 00000 n -0000089163 00000 n -0000089267 00000 n -0000089371 00000 n -0000089474 00000 n -0000089578 00000 n -0000089682 00000 n -0000089785 00000 n -0000089889 00000 n -0000089993 00000 n -0000090097 00000 n -0000090201 00000 n -0000090305 00000 n -0000090409 00000 n -0000090513 00000 n -0000090617 00000 n -0000090720 00000 n -0000090824 00000 n -0000090928 00000 n -0000091032 00000 n -0000091136 00000 n -0000091240 00000 n -0000091344 00000 n -0000091447 00000 n -0000091551 00000 n -0000091655 00000 n -0000091912 00000 n -0000092027 00000 n -0000092114 00000 n -0000092196 00000 n -0000092281 00000 n -0000092314 00000 n -0000092399 00000 n -0000092486 00000 n -0000092511 00000 n -0000092557 00000 n -0000092643 00000 n -0000092689 00000 n -0000092772 00000 n -0000092805 00000 n -0000092849 00000 n +0000014316 00000 n +0000014420 00000 n +0000014524 00000 n +0000014627 00000 n +0000014730 00000 n +0000014833 00000 n +0000014937 00000 n +0000015040 00000 n +0000015144 00000 n +0000015248 00000 n +0000015352 00000 n +0000015456 00000 n +0000015560 00000 n +0000015664 00000 n +0000015768 00000 n +0000015872 00000 n +0000015976 00000 n +0000016079 00000 n +0000016182 00000 n +0000016286 00000 n +0000016390 00000 n +0000016494 00000 n +0000016597 00000 n +0000016701 00000 n +0000016805 00000 n +0000016909 00000 n +0000017012 00000 n +0000017114 00000 n +0000017216 00000 n +0000017545 00000 n +0000017648 00000 n +0000017752 00000 n +0000017856 00000 n +0000017960 00000 n +0000018064 00000 n +0000018168 00000 n +0000018272 00000 n +0000018376 00000 n +0000018480 00000 n +0000018584 00000 n +0000018688 00000 n +0000018792 00000 n +0000018896 00000 n +0000019000 00000 n +0000019104 00000 n +0000019208 00000 n +0000019312 00000 n +0000019415 00000 n +0000019519 00000 n +0000019623 00000 n +0000019727 00000 n +0000019831 00000 n +0000019935 00000 n +0000020039 00000 n +0000020143 00000 n +0000020247 00000 n +0000020350 00000 n +0000020454 00000 n +0000020558 00000 n +0000020662 00000 n +0000020766 00000 n +0000020870 00000 n +0000020974 00000 n +0000021078 00000 n +0000021182 00000 n +0000021286 00000 n +0000021390 00000 n +0000021494 00000 n +0000021598 00000 n +0000021702 00000 n +0000021806 00000 n +0000021910 00000 n +0000022014 00000 n +0000022117 00000 n +0000022486 00000 n +0000022589 00000 n +0000022693 00000 n +0000022797 00000 n +0000022901 00000 n +0000023005 00000 n +0000023108 00000 n +0000023212 00000 n +0000023316 00000 n +0000023420 00000 n +0000023524 00000 n +0000023628 00000 n +0000023732 00000 n +0000023836 00000 n +0000023940 00000 n +0000024044 00000 n +0000024148 00000 n +0000024251 00000 n +0000024355 00000 n +0000024459 00000 n +0000024563 00000 n +0000024667 00000 n +0000024771 00000 n +0000024875 00000 n +0000024979 00000 n +0000025083 00000 n +0000025187 00000 n +0000025291 00000 n +0000025395 00000 n +0000025498 00000 n +0000025602 00000 n +0000025706 00000 n +0000025810 00000 n +0000025914 00000 n +0000026018 00000 n +0000026122 00000 n +0000026226 00000 n +0000026330 00000 n +0000026434 00000 n +0000026538 00000 n +0000026642 00000 n +0000026746 00000 n +0000026848 00000 n +0000026950 00000 n +0000027052 00000 n +0000027421 00000 n +0000027524 00000 n +0000027628 00000 n +0000027732 00000 n +0000027836 00000 n +0000027940 00000 n +0000028044 00000 n +0000028148 00000 n +0000028252 00000 n +0000028356 00000 n +0000028459 00000 n +0000028563 00000 n +0000028667 00000 n +0000028771 00000 n +0000028875 00000 n +0000028979 00000 n +0000029083 00000 n +0000029186 00000 n +0000029290 00000 n +0000029394 00000 n +0000029497 00000 n +0000029600 00000 n +0000029704 00000 n +0000029808 00000 n +0000029912 00000 n +0000030016 00000 n +0000030120 00000 n +0000030224 00000 n +0000030328 00000 n +0000030432 00000 n +0000030536 00000 n +0000030640 00000 n +0000030743 00000 n +0000030847 00000 n +0000030951 00000 n +0000031055 00000 n +0000031159 00000 n +0000031263 00000 n +0000031367 00000 n +0000031470 00000 n +0000031573 00000 n +0000031675 00000 n +0000031777 00000 n +0000032130 00000 n +0000032233 00000 n +0000032337 00000 n +0000032441 00000 n +0000032545 00000 n +0000032649 00000 n +0000032753 00000 n +0000032857 00000 n +0000032961 00000 n +0000033065 00000 n +0000033169 00000 n +0000033273 00000 n +0000033377 00000 n +0000033480 00000 n +0000033584 00000 n +0000033688 00000 n +0000033792 00000 n +0000033896 00000 n +0000034000 00000 n +0000034104 00000 n +0000034208 00000 n +0000034312 00000 n +0000034416 00000 n +0000034519 00000 n +0000034623 00000 n +0000034727 00000 n +0000034831 00000 n +0000034935 00000 n +0000035039 00000 n +0000035143 00000 n +0000035246 00000 n +0000035350 00000 n +0000035454 00000 n +0000035558 00000 n +0000035662 00000 n +0000035766 00000 n +0000035870 00000 n +0000035974 00000 n +0000036078 00000 n +0000036182 00000 n +0000036286 00000 n +0000036390 00000 n +0000036494 00000 n +0000036597 00000 n +0000036699 00000 n +0000036801 00000 n +0000037178 00000 n +0000037231 00000 n +0000037318 00000 n +0000037372 00000 n +0000037458 00000 n +0000037513 00000 n +0000037600 00000 n +0000037667 00000 n +0000037753 00000 n +0000037856 00000 n +0000037960 00000 n +0000038064 00000 n +0000038168 00000 n +0000038272 00000 n +0000038376 00000 n +0000038480 00000 n +0000038584 00000 n +0000038688 00000 n +0000038792 00000 n +0000038896 00000 n +0000039000 00000 n +0000039104 00000 n +0000039208 00000 n +0000039312 00000 n +0000039416 00000 n +0000039520 00000 n +0000039624 00000 n +0000039728 00000 n +0000039832 00000 n +0000039936 00000 n +0000040040 00000 n +0000040144 00000 n +0000040248 00000 n +0000040352 00000 n +0000040456 00000 n +0000040558 00000 n +0000040662 00000 n +0000040766 00000 n +0000040870 00000 n +0000040974 00000 n +0000041077 00000 n +0000041179 00000 n +0000041281 00000 n +0000041602 00000 n +0000041706 00000 n +0000041810 00000 n +0000041914 00000 n +0000042018 00000 n +0000042122 00000 n +0000042226 00000 n +0000042330 00000 n +0000042434 00000 n +0000042538 00000 n +0000042642 00000 n +0000042746 00000 n +0000042850 00000 n +0000042954 00000 n +0000043058 00000 n +0000043162 00000 n +0000043266 00000 n +0000043370 00000 n +0000043474 00000 n +0000043578 00000 n +0000043682 00000 n +0000043786 00000 n +0000043890 00000 n +0000043994 00000 n +0000044098 00000 n +0000044202 00000 n +0000044304 00000 n +0000044408 00000 n +0000044512 00000 n +0000044616 00000 n +0000044720 00000 n +0000044824 00000 n +0000044928 00000 n +0000045032 00000 n +0000045136 00000 n +0000045240 00000 n +0000045344 00000 n +0000045448 00000 n +0000045552 00000 n +0000045656 00000 n +0000045760 00000 n +0000045864 00000 n +0000045968 00000 n +0000046072 00000 n +0000046176 00000 n +0000046280 00000 n +0000046384 00000 n +0000046488 00000 n +0000046592 00000 n +0000046696 00000 n +0000046800 00000 n +0000046903 00000 n +0000047005 00000 n +0000047107 00000 n +0000047548 00000 n +0000047652 00000 n +0000047756 00000 n +0000047860 00000 n +0000047964 00000 n +0000048068 00000 n +0000048172 00000 n +0000048276 00000 n +0000048380 00000 n +0000048484 00000 n +0000048588 00000 n +0000048692 00000 n +0000048796 00000 n +0000048900 00000 n +0000049004 00000 n +0000049108 00000 n +0000049212 00000 n +0000049316 00000 n +0000049420 00000 n +0000049524 00000 n +0000049628 00000 n +0000049732 00000 n +0000049836 00000 n +0000049940 00000 n +0000050044 00000 n +0000050148 00000 n +0000050252 00000 n +0000050356 00000 n +0000050460 00000 n +0000050564 00000 n +0000050668 00000 n +0000050772 00000 n +0000050876 00000 n +0000050980 00000 n +0000051084 00000 n +0000051188 00000 n +0000051292 00000 n +0000051396 00000 n +0000051500 00000 n +0000051604 00000 n +0000051708 00000 n +0000051812 00000 n +0000051916 00000 n +0000052020 00000 n +0000052124 00000 n +0000052227 00000 n +0000052331 00000 n +0000052435 00000 n +0000052539 00000 n +0000052642 00000 n +0000052744 00000 n +0000052846 00000 n +0000053271 00000 n +0000053375 00000 n +0000053479 00000 n +0000053583 00000 n +0000053687 00000 n +0000053791 00000 n +0000053895 00000 n +0000053999 00000 n +0000054103 00000 n +0000054207 00000 n +0000054311 00000 n +0000054415 00000 n +0000054519 00000 n +0000054623 00000 n +0000054727 00000 n +0000054831 00000 n +0000054935 00000 n +0000055039 00000 n +0000055143 00000 n +0000055247 00000 n +0000055351 00000 n +0000055455 00000 n +0000055559 00000 n +0000055663 00000 n +0000055767 00000 n +0000055871 00000 n +0000055975 00000 n +0000056079 00000 n +0000056183 00000 n +0000056287 00000 n +0000056391 00000 n +0000056495 00000 n +0000056599 00000 n +0000056703 00000 n +0000056807 00000 n +0000057096 00000 n +0000057199 00000 n +0000057303 00000 n +0000057407 00000 n +0000057511 00000 n +0000057615 00000 n +0000057719 00000 n +0000057823 00000 n +0000057927 00000 n +0000058031 00000 n +0000058135 00000 n +0000058239 00000 n +0000058342 00000 n +0000058446 00000 n +0000058550 00000 n +0000058654 00000 n +0000058758 00000 n +0000058862 00000 n +0000058966 00000 n +0000059070 00000 n +0000059173 00000 n +0000059277 00000 n +0000059381 00000 n +0000059485 00000 n +0000059589 00000 n +0000059693 00000 n +0000059797 00000 n +0000059901 00000 n +0000060005 00000 n +0000060109 00000 n +0000060213 00000 n +0000060317 00000 n +0000060421 00000 n +0000060525 00000 n +0000060629 00000 n +0000060733 00000 n +0000060837 00000 n +0000060941 00000 n +0000061045 00000 n +0000061149 00000 n +0000061253 00000 n +0000061357 00000 n +0000061460 00000 n +0000061562 00000 n +0000061923 00000 n +0000061972 00000 n +0000062059 00000 n +0000062084 00000 n +0000062140 00000 n +0000062227 00000 n +0000062296 00000 n +0000062383 00000 n +0000062434 00000 n +0000062521 00000 n +0000062606 00000 n +0000062693 00000 n +0000062749 00000 n +0000062836 00000 n +0000062886 00000 n +0000062973 00000 n +0000063025 00000 n +0000063111 00000 n +0000063184 00000 n +0000063240 00000 n +0000063327 00000 n +0000063375 00000 n +0000063461 00000 n +0000063509 00000 n +0000063596 00000 n +0000063637 00000 n +0000063678 00000 n +0000063765 00000 n +0000063809 00000 n +0000063896 00000 n +0000063941 00000 n +0000064028 00000 n +0000064072 00000 n +0000064159 00000 n +0000064203 00000 n +0000064290 00000 n +0000064332 00000 n +0000064419 00000 n +0000064467 00000 n +0000064554 00000 n +0000064627 00000 n +0000064675 00000 n +0000064760 00000 n +0000064785 00000 n +0000064838 00000 n +0000064922 00000 n +0000064947 00000 n +0000065050 00000 n +0000065154 00000 n +0000065258 00000 n +0000065362 00000 n +0000065466 00000 n +0000065569 00000 n +0000065673 00000 n +0000065777 00000 n +0000065881 00000 n +0000065985 00000 n +0000066089 00000 n +0000066193 00000 n +0000066296 00000 n +0000066400 00000 n +0000066504 00000 n +0000066608 00000 n +0000066712 00000 n +0000066816 00000 n +0000066920 00000 n +0000067024 00000 n +0000067128 00000 n +0000067232 00000 n +0000067336 00000 n +0000067440 00000 n +0000067543 00000 n +0000067647 00000 n +0000067751 00000 n +0000067855 00000 n +0000067959 00000 n +0000068063 00000 n +0000068167 00000 n +0000068271 00000 n +0000068375 00000 n +0000068479 00000 n +0000068582 00000 n +0000068686 00000 n +0000068790 00000 n +0000068894 00000 n +0000068998 00000 n +0000069102 00000 n +0000069206 00000 n +0000069310 00000 n +0000069414 00000 n +0000069517 00000 n +0000069618 00000 n +0000069720 00000 n +0000070105 00000 n +0000070209 00000 n +0000070234 00000 n +0000070281 00000 n +0000070367 00000 n +0000070414 00000 n +0000070500 00000 n +0000070533 00000 n +0000070578 00000 n +0000070665 00000 n +0000070710 00000 n +0000070796 00000 n +0000070829 00000 n +0000070877 00000 n +0000070964 00000 n +0000070989 00000 n +0000071037 00000 n +0000071124 00000 n +0000071169 00000 n +0000071255 00000 n +0000071298 00000 n +0000071384 00000 n +0000071425 00000 n +0000071511 00000 n +0000071560 00000 n +0000071646 00000 n +0000071692 00000 n +0000071778 00000 n +0000071823 00000 n +0000071909 00000 n +0000071961 00000 n +0000072047 00000 n +0000072097 00000 n +0000072183 00000 n +0000072229 00000 n +0000072315 00000 n +0000072358 00000 n +0000072444 00000 n +0000072488 00000 n +0000072574 00000 n +0000072617 00000 n +0000072703 00000 n +0000072748 00000 n +0000072834 00000 n +0000072872 00000 n +0000072958 00000 n +0000073000 00000 n +0000073086 00000 n +0000073129 00000 n +0000073215 00000 n +0000073253 00000 n +0000073339 00000 n +0000073381 00000 n +0000073467 00000 n +0000073511 00000 n +0000073597 00000 n +0000073644 00000 n +0000073730 00000 n +0000073778 00000 n +0000073863 00000 n +0000074056 00000 n +0000074105 00000 n +0000074191 00000 n +0000074216 00000 n +0000074263 00000 n +0000074350 00000 n +0000074375 00000 n +0000074430 00000 n +0000074517 00000 n +0000074573 00000 n +0000074660 00000 n +0000074693 00000 n +0000074741 00000 n +0000074828 00000 n +0000074902 00000 n +0000074989 00000 n +0000075057 00000 n +0000075144 00000 n +0000075198 00000 n +0000075285 00000 n +0000075353 00000 n +0000075440 00000 n +0000075514 00000 n +0000075601 00000 n +0000075649 00000 n +0000075736 00000 n +0000075793 00000 n +0000075880 00000 n +0000075961 00000 n +0000076016 00000 n +0000076103 00000 n +0000076184 00000 n +0000076271 00000 n +0000076304 00000 n +0000076357 00000 n +0000076444 00000 n +0000076469 00000 n +0000076517 00000 n +0000076604 00000 n +0000076646 00000 n +0000076733 00000 n +0000076776 00000 n +0000076863 00000 n +0000076913 00000 n +0000077000 00000 n +0000077048 00000 n +0000077135 00000 n +0000077192 00000 n +0000077235 00000 n +0000077322 00000 n +0000077376 00000 n +0000077463 00000 n +0000077508 00000 n +0000077595 00000 n +0000077652 00000 n +0000077738 00000 n +0000077834 00000 n +0000077919 00000 n +0000077976 00000 n +0000078079 00000 n +0000078183 00000 n +0000078286 00000 n +0000078390 00000 n +0000078494 00000 n +0000078598 00000 n +0000078702 00000 n +0000078806 00000 n +0000078910 00000 n +0000079014 00000 n +0000079118 00000 n +0000079222 00000 n +0000079325 00000 n +0000079428 00000 n +0000079532 00000 n +0000079636 00000 n +0000079740 00000 n +0000079843 00000 n +0000079947 00000 n +0000080051 00000 n +0000080155 00000 n +0000080259 00000 n +0000080363 00000 n +0000080467 00000 n +0000080571 00000 n +0000080675 00000 n +0000080779 00000 n +0000080883 00000 n +0000080987 00000 n +0000081091 00000 n +0000081195 00000 n +0000081299 00000 n +0000081403 00000 n +0000081507 00000 n +0000081611 00000 n +0000081715 00000 n +0000081819 00000 n +0000081923 00000 n +0000082027 00000 n +0000082131 00000 n +0000082234 00000 n +0000082337 00000 n +0000082439 00000 n +0000082541 00000 n +0000082910 00000 n +0000083014 00000 n +0000083118 00000 n +0000083222 00000 n +0000083326 00000 n +0000083430 00000 n +0000083533 00000 n +0000083637 00000 n +0000083741 00000 n +0000083845 00000 n +0000083949 00000 n +0000084053 00000 n +0000084157 00000 n +0000084261 00000 n +0000084365 00000 n +0000084469 00000 n +0000084573 00000 n +0000084677 00000 n +0000084781 00000 n +0000084885 00000 n +0000084989 00000 n +0000085093 00000 n +0000085197 00000 n +0000085301 00000 n +0000085404 00000 n +0000085508 00000 n +0000085612 00000 n +0000085716 00000 n +0000085820 00000 n +0000085923 00000 n +0000086027 00000 n +0000086131 00000 n +0000086235 00000 n +0000086339 00000 n +0000086443 00000 n +0000086547 00000 n +0000086651 00000 n +0000086755 00000 n +0000086859 00000 n +0000086963 00000 n +0000087066 00000 n +0000087170 00000 n +0000087274 00000 n +0000087378 00000 n +0000087482 00000 n +0000087586 00000 n +0000087690 00000 n +0000087794 00000 n +0000087898 00000 n +0000088001 00000 n +0000088103 00000 n +0000088205 00000 n +0000088630 00000 n +0000088733 00000 n +0000088837 00000 n +0000088941 00000 n +0000089045 00000 n +0000089149 00000 n +0000089253 00000 n +0000089357 00000 n +0000089461 00000 n +0000089565 00000 n +0000089669 00000 n +0000089773 00000 n +0000089877 00000 n +0000089981 00000 n +0000090084 00000 n +0000090188 00000 n +0000090292 00000 n +0000090395 00000 n +0000090499 00000 n +0000090603 00000 n +0000090707 00000 n +0000090811 00000 n +0000090915 00000 n +0000091019 00000 n +0000091123 00000 n +0000091227 00000 n +0000091330 00000 n +0000091434 00000 n +0000091538 00000 n +0000091642 00000 n +0000091746 00000 n +0000091850 00000 n +0000091954 00000 n +0000092057 00000 n +0000092161 00000 n +0000092265 00000 n +0000092562 00000 n +0000092644 00000 n +0000092731 00000 n +0000092816 00000 n +0000092903 00000 n 0000092936 00000 n -0000092987 00000 n -0000093074 00000 n -0000093123 00000 n -0000093210 00000 n -0000093258 00000 n -0000093344 00000 n -0000093393 00000 n -0000093446 00000 n -0000093533 00000 n -0000093583 00000 n -0000093670 00000 n -0000093703 00000 n -0000093766 00000 n -0000093853 00000 n -0000093911 00000 n -0000093998 00000 n -0000094092 00000 n -0000094178 00000 n -0000094219 00000 n -0000094262 00000 n -0000094348 00000 n -0000094396 00000 n -0000094483 00000 n -0000094524 00000 n -0000094611 00000 n -0000094655 00000 n -0000094742 00000 n -0000094786 00000 n -0000094872 00000 n -0000094929 00000 n -0000094975 00000 n -0000095062 00000 n -0000095087 00000 n -0000095136 00000 n -0000095223 00000 n -0000095277 00000 n -0000095364 00000 n -0000095415 00000 n -0000095502 00000 n -0000095556 00000 n -0000095643 00000 n -0000095693 00000 n -0000095778 00000 n -0000095835 00000 n -0000095885 00000 n -0000095972 00000 n -0000096036 00000 n -0000096123 00000 n -0000096156 00000 n -0000096233 00000 n -0000096319 00000 n -0000096409 00000 n -0000096495 00000 n -0000096584 00000 n -0000096670 00000 n -0000096711 00000 n -0000096782 00000 n -0000096868 00000 n -0000097000 00000 n -0000097086 00000 n -0000097160 00000 n -0000097246 00000 n -0000097343 00000 n -0000097429 00000 n -0000097478 00000 n -0000097543 00000 n -0000097630 00000 n -0000097655 00000 n -0000097720 00000 n -0000097807 00000 n -0000097832 00000 n -0000097894 00000 n -0000097981 00000 n -0000098006 00000 n +0000092982 00000 n +0000093068 00000 n +0000093114 00000 n +0000093197 00000 n +0000093230 00000 n +0000093274 00000 n +0000093361 00000 n +0000093412 00000 n +0000093499 00000 n +0000093548 00000 n +0000093635 00000 n +0000093683 00000 n +0000093769 00000 n +0000093818 00000 n +0000093871 00000 n +0000093958 00000 n +0000094008 00000 n +0000094095 00000 n +0000094128 00000 n +0000094191 00000 n +0000094278 00000 n +0000094336 00000 n +0000094423 00000 n +0000094517 00000 n +0000094603 00000 n +0000094644 00000 n +0000094687 00000 n +0000094773 00000 n +0000094821 00000 n +0000094908 00000 n +0000094949 00000 n +0000095036 00000 n +0000095080 00000 n +0000095167 00000 n +0000095211 00000 n +0000095297 00000 n +0000095354 00000 n +0000095400 00000 n +0000095487 00000 n +0000095512 00000 n +0000095561 00000 n +0000095648 00000 n +0000095702 00000 n +0000095789 00000 n +0000095840 00000 n +0000095927 00000 n +0000095981 00000 n +0000096068 00000 n +0000096118 00000 n +0000096203 00000 n +0000096260 00000 n +0000096310 00000 n +0000096397 00000 n +0000096461 00000 n +0000096548 00000 n +0000096581 00000 n +0000096658 00000 n +0000096744 00000 n +0000096834 00000 n +0000096920 00000 n +0000097009 00000 n +0000097095 00000 n +0000097136 00000 n +0000097207 00000 n +0000097293 00000 n +0000097425 00000 n +0000097511 00000 n +0000097585 00000 n +0000097671 00000 n +0000097768 00000 n +0000097854 00000 n +0000097903 00000 n +0000097968 00000 n 0000098055 00000 n -0000098142 00000 n -0000098167 00000 n -0000098215 00000 n -0000098302 00000 n -0000098352 00000 n -0000098436 00000 n +0000098080 00000 n +0000098145 00000 n +0000098232 00000 n +0000098257 00000 n +0000098319 00000 n +0000098406 00000 n +0000098431 00000 n 0000098480 00000 n -0000098564 00000 n -0000098605 00000 n -0000098649 00000 n -0000098735 00000 n -0000098785 00000 n -0000098871 00000 n -0000098921 00000 n -0000099007 00000 n -0000099056 00000 n -0000099142 00000 n -0000099189 00000 n -0000099275 00000 n -0000099332 00000 n -0000099451 00000 n -0000099538 00000 n -0000099582 00000 n -0000099671 00000 n -0000099715 00000 n -0000099804 00000 n -0000099849 00000 n -0000099939 00000 n -0000100027 00000 n -0000100091 00000 n -0000100179 00000 n -0000100215 00000 n -0000100277 00000 n -0000100365 00000 n -0000100392 00000 n -0000100448 00000 n -0000100537 00000 n -0000100564 00000 n -0000100668 00000 n -0000100773 00000 n -0000100878 00000 n -0000100983 00000 n -0000101088 00000 n -0000101193 00000 n -0000101298 00000 n -0000101403 00000 n -0000101508 00000 n -0000101613 00000 n -0000101718 00000 n -0000101822 00000 n -0000101927 00000 n -0000102032 00000 n -0000102137 00000 n -0000102242 00000 n -0000102347 00000 n -0000102452 00000 n -0000102556 00000 n -0000102661 00000 n -0000102766 00000 n -0000102871 00000 n -0000102976 00000 n -0000103081 00000 n -0000103186 00000 n -0000103291 00000 n -0000103396 00000 n -0000103501 00000 n -0000103606 00000 n -0000103711 00000 n -0000103816 00000 n -0000103921 00000 n -0000104026 00000 n -0000104130 00000 n -0000104235 00000 n -0000104340 00000 n -0000104445 00000 n -0000104550 00000 n -0000104655 00000 n -0000104760 00000 n -0000104865 00000 n -0000104970 00000 n -0000105075 00000 n -0000105179 00000 n -0000105283 00000 n -0000105386 00000 n -0000105489 00000 n -0000105930 00000 n -0000106035 00000 n -0000106140 00000 n -0000106245 00000 n -0000106349 00000 n -0000106454 00000 n -0000106559 00000 n -0000106664 00000 n -0000106769 00000 n -0000106874 00000 n -0000106979 00000 n -0000107084 00000 n -0000107189 00000 n -0000107294 00000 n -0000107399 00000 n -0000107504 00000 n -0000107609 00000 n -0000107714 00000 n -0000107819 00000 n -0000107924 00000 n -0000108113 00000 n -0000108169 00000 n -0000108257 00000 n -0000108326 00000 n -0000108414 00000 n -0000108490 00000 n -0000108579 00000 n -0000108650 00000 n -0000108738 00000 n -0000108818 00000 n -0000108907 00000 n -0000108970 00000 n -0000109053 00000 n -0000109141 00000 n -0000109217 00000 n -0000109306 00000 n -0000109380 00000 n -0000109469 00000 n -0000109548 00000 n -0000109637 00000 n -0000109691 00000 n -0000109740 00000 n -0000109829 00000 n -0000109856 00000 n -0000109905 00000 n -0000109994 00000 n -0000110021 00000 n -0000110071 00000 n -0000110160 00000 n -0000110224 00000 n -0000110313 00000 n -0000110377 00000 n -0000110466 00000 n -0000110521 00000 n -0000110610 00000 n -0000110664 00000 n -0000110733 00000 n -0000110821 00000 n -0000110877 00000 n -0000110966 00000 n -0000111002 00000 n -0000111051 00000 n -0000111140 00000 n -0000111205 00000 n -0000111294 00000 n -0000111350 00000 n -0000111439 00000 n -0000111487 00000 n -0000111576 00000 n -0000111630 00000 n -0000111685 00000 n -0000111774 00000 n -0000111829 00000 n -0000111918 00000 n -0000111954 00000 n -0000111990 00000 n -0000112026 00000 n -0000117652 00000 n -0000117697 00000 n -0000117742 00000 n -0000117787 00000 n -0000117832 00000 n -0000117877 00000 n -0000117922 00000 n -0000117967 00000 n -0000118012 00000 n -0000118057 00000 n -0000118102 00000 n -0000118147 00000 n -0000118192 00000 n -0000118237 00000 n -0000118282 00000 n -0000118327 00000 n -0000118372 00000 n -0000118417 00000 n -0000118462 00000 n -0000118507 00000 n -0000118552 00000 n -0000118597 00000 n -0000118642 00000 n -0000118687 00000 n -0000118732 00000 n -0000118777 00000 n -0000118822 00000 n -0000118867 00000 n -0000118912 00000 n -0000118957 00000 n -0000119002 00000 n -0000119047 00000 n -0000119092 00000 n -0000119137 00000 n -0000119182 00000 n -0000119227 00000 n -0000119272 00000 n -0000119317 00000 n -0000119362 00000 n -0000119407 00000 n -0000119452 00000 n -0000119497 00000 n -0000119542 00000 n -0000119587 00000 n -0000119632 00000 n -0000119677 00000 n -0000119722 00000 n -0000119767 00000 n -0000119812 00000 n -0000119857 00000 n -0000119902 00000 n -0000119947 00000 n -0000119992 00000 n -0000120037 00000 n -0000120082 00000 n -0000120127 00000 n -0000120172 00000 n -0000120217 00000 n -0000120262 00000 n -0000120307 00000 n -0000120352 00000 n -0000120397 00000 n -0000120442 00000 n -0000120487 00000 n -0000120532 00000 n -0000120577 00000 n -0000120622 00000 n -0000120667 00000 n -0000120712 00000 n -0000120757 00000 n -0000120802 00000 n -0000120847 00000 n -0000120892 00000 n -0000120937 00000 n -0000120982 00000 n -0000121027 00000 n -0000121072 00000 n -0000121117 00000 n -0000121162 00000 n -0000121207 00000 n -0000121252 00000 n -0000121297 00000 n -0000121342 00000 n -0000121387 00000 n -0000121432 00000 n -0000121477 00000 n -0000121522 00000 n -0000121567 00000 n -0000121612 00000 n -0000121657 00000 n -0000121702 00000 n -0000121747 00000 n -0000121792 00000 n -0000121837 00000 n -0000121882 00000 n -0000121927 00000 n -0000121972 00000 n -0000122017 00000 n -0000122062 00000 n -0000122107 00000 n -0000122152 00000 n -0000122197 00000 n -0000122242 00000 n -0000122287 00000 n -0000122332 00000 n -0000122377 00000 n -0000122422 00000 n -0000122467 00000 n -0000122512 00000 n -0000122557 00000 n -0000122602 00000 n -0000122647 00000 n -0000122692 00000 n -0000122737 00000 n -0000122782 00000 n -0000122827 00000 n -0000122872 00000 n -0000122917 00000 n -0000122962 00000 n -0000123007 00000 n -0000123052 00000 n -0000123097 00000 n -0000123142 00000 n -0000123187 00000 n -0000123232 00000 n -0000123277 00000 n -0000123322 00000 n -0000123367 00000 n -0000123412 00000 n -0000123457 00000 n -0000123502 00000 n -0000123547 00000 n -0000123592 00000 n -0000123637 00000 n -0000123682 00000 n -0000123727 00000 n -0000123772 00000 n -0000123817 00000 n -0000123862 00000 n -0000123907 00000 n -0000123952 00000 n -0000123997 00000 n -0000124042 00000 n -0000124087 00000 n -0000124132 00000 n -0000124177 00000 n -0000124222 00000 n -0000124267 00000 n -0000124312 00000 n -0000124357 00000 n -0000124402 00000 n -0000124447 00000 n -0000124492 00000 n -0000124537 00000 n -0000124582 00000 n -0000124627 00000 n -0000124672 00000 n -0000124717 00000 n -0000124762 00000 n -0000124807 00000 n -0000124852 00000 n -0000124897 00000 n -0000124942 00000 n -0000124987 00000 n -0000125032 00000 n -0000125077 00000 n -0000125122 00000 n -0000125167 00000 n -0000125212 00000 n -0000125257 00000 n -0000125302 00000 n -0000125347 00000 n -0000125392 00000 n -0000125437 00000 n -0000125482 00000 n -0000125527 00000 n -0000125572 00000 n -0000125617 00000 n -0000125662 00000 n -0000125707 00000 n -0000125752 00000 n -0000125797 00000 n -0000125842 00000 n -0000125887 00000 n -0000125932 00000 n -0000125977 00000 n -0000126022 00000 n -0000126067 00000 n -0000126112 00000 n -0000126157 00000 n -0000126202 00000 n -0000126247 00000 n -0000126292 00000 n -0000126337 00000 n -0000126382 00000 n -0000126427 00000 n -0000126472 00000 n -0000126517 00000 n -0000126562 00000 n -0000126607 00000 n -0000126652 00000 n -0000126697 00000 n -0000126742 00000 n -0000126787 00000 n -0000126832 00000 n -0000126877 00000 n -0000126922 00000 n -0000126967 00000 n -0000127012 00000 n -0000127057 00000 n -0000127102 00000 n -0000127147 00000 n -0000127192 00000 n -0000127237 00000 n -0000127282 00000 n -0000127327 00000 n -0000127372 00000 n -0000127417 00000 n -0000127462 00000 n -0000127507 00000 n -0000127552 00000 n -0000127597 00000 n -0000127642 00000 n -0000127687 00000 n -0000127732 00000 n -0000127777 00000 n -0000127822 00000 n -0000127867 00000 n -0000127912 00000 n -0000127957 00000 n -0000128002 00000 n -0000128047 00000 n -0000128092 00000 n -0000128137 00000 n -0000128182 00000 n -0000128227 00000 n -0000128272 00000 n -0000128317 00000 n -0000128362 00000 n -0000128407 00000 n -0000128452 00000 n -0000128497 00000 n -0000128542 00000 n -0000128587 00000 n -0000128632 00000 n -0000128677 00000 n -0000128722 00000 n -0000128767 00000 n -0000128812 00000 n -0000128857 00000 n -0000128902 00000 n -0000128947 00000 n -0000128992 00000 n -0000129037 00000 n -0000129082 00000 n -0000129127 00000 n -0000129172 00000 n -0000129217 00000 n -0000129262 00000 n -0000129307 00000 n -0000129352 00000 n -0000129397 00000 n -0000129442 00000 n -0000129487 00000 n -0000129532 00000 n -0000129577 00000 n -0000129622 00000 n -0000129667 00000 n -0000129712 00000 n -0000129757 00000 n -0000129802 00000 n -0000129847 00000 n -0000129892 00000 n -0000129937 00000 n -0000129982 00000 n -0000130027 00000 n -0000130072 00000 n -0000130117 00000 n -0000130162 00000 n -0000130207 00000 n -0000130252 00000 n -0000130297 00000 n -0000130342 00000 n -0000130387 00000 n -0000130432 00000 n -0000130477 00000 n -0000130522 00000 n -0000130567 00000 n -0000130612 00000 n -0000130657 00000 n -0000130702 00000 n -0000130747 00000 n -0000130792 00000 n -0000130837 00000 n -0000130882 00000 n -0000130927 00000 n -0000130972 00000 n -0000131017 00000 n -0000131062 00000 n -0000131107 00000 n -0000131152 00000 n -0000131197 00000 n -0000131242 00000 n -0000131287 00000 n -0000131332 00000 n -0000131377 00000 n -0000131422 00000 n -0000131467 00000 n -0000131512 00000 n -0000131556 00000 n -0000131601 00000 n -0000131646 00000 n -0000131691 00000 n -0000131736 00000 n -0000131781 00000 n -0000131826 00000 n -0000131871 00000 n -0000131916 00000 n -0000131961 00000 n -0000132006 00000 n -0000132051 00000 n -0000132096 00000 n -0000132141 00000 n -0000132186 00000 n -0000132231 00000 n -0000132276 00000 n -0000132321 00000 n -0000132366 00000 n -0000133990 00000 n -0000134151 00000 n -0000134320 00000 n -0000134513 00000 n -0000138558 00000 n -0000138752 00000 n -0000142590 00000 n -0000142784 00000 n -0000147010 00000 n -0000147204 00000 n -0000151186 00000 n -0000151380 00000 n -0000155280 00000 n -0000155474 00000 n -0000159023 00000 n -0000159217 00000 n -0000162507 00000 n -0000162668 00000 n -0000162902 00000 n -0000163105 00000 n -0000165725 00000 n -0000165909 00000 n -0000169136 00000 n -0000169311 00000 n -0000171915 00000 n -0000172090 00000 n -0000173540 00000 n -0000173701 00000 n -0000173889 00000 n -0000174092 00000 n -0000176851 00000 n -0000177026 00000 n -0000177322 00000 n -0000177525 00000 n -0000178959 00000 n -0000179176 00000 n -0000180630 00000 n -0000180827 00000 n -0000182679 00000 n -0000182839 00000 n -0000183334 00000 n -0000183504 00000 n -0000185244 00000 n -0000185423 00000 n -0000187298 00000 n -0000187486 00000 n -0000189329 00000 n -0000189517 00000 n -0000191227 00000 n -0000191396 00000 n -0000192199 00000 n -0000192428 00000 n -0000194297 00000 n -0000194494 00000 n -0000196033 00000 n -0000196230 00000 n -0000197726 00000 n -0000197949 00000 n -0000200118 00000 n -0000200321 00000 n -0000202214 00000 n -0000202428 00000 n -0000203729 00000 n -0000203961 00000 n -0000205635 00000 n -0000205848 00000 n -0000207750 00000 n -0000207958 00000 n -0000209235 00000 n -0000209474 00000 n -0000210994 00000 n -0000211182 00000 n -0000212494 00000 n -0000212682 00000 n -0000213229 00000 n -0000213390 00000 n -0000213580 00000 n -0000213792 00000 n -0000216648 00000 n -0000216823 00000 n -0000217171 00000 n -0000217360 00000 n -0000219001 00000 n -0000219189 00000 n -0000220682 00000 n -0000220861 00000 n -0000222591 00000 n -0000222771 00000 n -0000224735 00000 n -0000224948 00000 n -0000226722 00000 n -0000226944 00000 n -0000227993 00000 n -0000228238 00000 n -0000229658 00000 n -0000229872 00000 n -0000231409 00000 n -0000231607 00000 n -0000233638 00000 n -0000233903 00000 n -0000235659 00000 n -0000235872 00000 n -0000237449 00000 n -0000237656 00000 n -0000239651 00000 n -0000239883 00000 n -0000241912 00000 n -0000242124 00000 n -0000244105 00000 n -0000244318 00000 n -0000246522 00000 n -0000246752 00000 n -0000248939 00000 n -0000249099 00000 n -0000249836 00000 n -0000250030 00000 n -0000251586 00000 n -0000251766 00000 n -0000253507 00000 n -0000253696 00000 n -0000254897 00000 n -0000255094 00000 n -0000256412 00000 n -0000256600 00000 n -0000257468 00000 n -0000257700 00000 n -0000259123 00000 n -0000259358 00000 n -0000261274 00000 n -0000261435 00000 n -0000261628 00000 n -0000261831 00000 n -0000264448 00000 n -0000264632 00000 n -0000267263 00000 n -0000267438 00000 n -0000269039 00000 n -0000269261 00000 n -0000271148 00000 n -0000271394 00000 n -0000273228 00000 n -0000273439 00000 n -0000275172 00000 n -0000275341 00000 n -0000277331 00000 n -0000277510 00000 n -0000279155 00000 n -0000279376 00000 n -0000280992 00000 n -0000281235 00000 n -0000282833 00000 n -0000283003 00000 n -0000283512 00000 n -0000283719 00000 n -0000285467 00000 n -0000285665 00000 n -0000287393 00000 n -0000287606 00000 n -0000289293 00000 n -0000289506 00000 n -0000291055 00000 n -0000291224 00000 n -0000291805 00000 n -0000291993 00000 n -0000293488 00000 n -0000293708 00000 n -0000295314 00000 n -0000295524 00000 n -0000297191 00000 n -0000297394 00000 n -0000298487 00000 n -0000298751 00000 n -0000300475 00000 n -0000300721 00000 n -0000302611 00000 n -0000302834 00000 n -0000304624 00000 n -0000304847 00000 n -0000306722 00000 n -0000306901 00000 n -0000308125 00000 n -0000308357 00000 n -0000310026 00000 n -0000310205 00000 n -0000311785 00000 n -0000311964 00000 n -0000313511 00000 n -0000313690 00000 n -0000315194 00000 n -0000315373 00000 n -0000317039 00000 n -0000317209 00000 n -0000317955 00000 n -0000318153 00000 n -0000319971 00000 n -0000320204 00000 n -0000322260 00000 n -0000322449 00000 n -0000324105 00000 n -0000324275 00000 n -0000325037 00000 n -0000325207 00000 n -0000326313 00000 n -0000326483 00000 n -0000327303 00000 n -0000327473 00000 n -0000328291 00000 n -0000328461 00000 n -0000329623 00000 n -0000329846 00000 n -0000331499 00000 n -0000331725 00000 n -0000333408 00000 n -0000333653 00000 n -0000335544 00000 n -0000335713 00000 n -0000337458 00000 n -0000337642 00000 n -0000339392 00000 n -0000339648 00000 n -0000341625 00000 n -0000341824 00000 n -0000344048 00000 n -0000344259 00000 n -0000346026 00000 n -0000346227 00000 n -0000347245 00000 n -0000347434 00000 n -0000349128 00000 n -0000349307 00000 n -0000351052 00000 n -0000351240 00000 n -0000353076 00000 n -0000353270 00000 n -0000355183 00000 n -0000355414 00000 n -0000357518 00000 n -0000357730 00000 n -0000359167 00000 n -0000359380 00000 n -0000360829 00000 n -0000361036 00000 n -0000362273 00000 n -0000362452 00000 n -0000363440 00000 n -0000363628 00000 n -0000364760 00000 n -0000364948 00000 n -0000366449 00000 n -0000366637 00000 n -0000367720 00000 n -0000367909 00000 n -0000369242 00000 n -0000369483 00000 n -0000371089 00000 n -0000371287 00000 n -0000373136 00000 n -0000373333 00000 n -0000374955 00000 n -0000375134 00000 n -0000377187 00000 n -0000377366 00000 n -0000379204 00000 n -0000379383 00000 n -0000381094 00000 n -0000381273 00000 n -0000381707 00000 n -0000381877 00000 n -0000383551 00000 n -0000383730 00000 n -0000385514 00000 n -0000385693 00000 n -0000387338 00000 n -0000387507 00000 n -0000388822 00000 n -0000389010 00000 n -0000390576 00000 n -0000390764 00000 n -0000392378 00000 n -0000392566 00000 n -0000393954 00000 n -0000394124 00000 n -0000395758 00000 n -0000395928 00000 n -0000396941 00000 n -0000397155 00000 n -0000398641 00000 n -0000398821 00000 n -0000399584 00000 n -0000399781 00000 n -0000400992 00000 n -0000401196 00000 n -0000402543 00000 n -0000402729 00000 n -0000403206 00000 n -0000403385 00000 n -0000404928 00000 n -0000405107 00000 n -0000406344 00000 n -0000406548 00000 n -0000407960 00000 n -0000408155 00000 n -0000410849 00000 n -0000411025 00000 n -0000411800 00000 n -0000411970 00000 n -0000413478 00000 n -0000413648 00000 n -0000415047 00000 n -0000415217 00000 n -0000416767 00000 n -0000416936 00000 n -0000417899 00000 n -0000418078 00000 n -0000419606 00000 n -0000419794 00000 n -0000420762 00000 n -0000420932 00000 n -0000421263 00000 n -0000421459 00000 n -0000423188 00000 n -0000423402 00000 n -0000425086 00000 n -0000425281 00000 n -0000426988 00000 n -0000427201 00000 n -0000428689 00000 n -0000428884 00000 n -0000430466 00000 n -0000430689 00000 n -0000432053 00000 n -0000432241 00000 n -0000433409 00000 n -0000433606 00000 n -0000435156 00000 n -0000435344 00000 n -0000435988 00000 n -0000436192 00000 n -0000437928 00000 n -0000438116 00000 n -0000439859 00000 n -0000440038 00000 n -0000441436 00000 n -0000441615 00000 n -0000443313 00000 n -0000443492 00000 n -0000444973 00000 n -0000445152 00000 n -0000446938 00000 n -0000447142 00000 n -0000448791 00000 n -0000448850 00000 n -0000448953 00000 n -0000449118 00000 n -0000449200 00000 n -0000449308 00000 n -0000449431 00000 n -0000449543 00000 n -0000449721 00000 n -0000449842 00000 n -0000450002 00000 n -0000450120 00000 n -0000450217 00000 n -0000450369 00000 n -0000450509 00000 n -0000450687 00000 n -0000450842 00000 n -0000450944 00000 n -0000451044 00000 n -0000451253 00000 n -0000451354 00000 n -0000451542 00000 n -0000451685 00000 n -0000451831 00000 n -0000451947 00000 n -0000452114 00000 n -0000452226 00000 n -0000452400 00000 n -0000452503 00000 n -0000452676 00000 n -0000452797 00000 n -0000452927 00000 n -0000453053 00000 n -0000453168 00000 n -0000453276 00000 n -0000453423 00000 n -0000453528 00000 n -0000453647 00000 n -0000453776 00000 n -0000453935 00000 n -0000454069 00000 n -0000454206 00000 n -0000454338 00000 n -0000454487 00000 n -0000454619 00000 n -0000454767 00000 n -0000454868 00000 n -0000454996 00000 n -0000455114 00000 n -0000455268 00000 n -0000455399 00000 n -0000455545 00000 n -0000455646 00000 n -0000455744 00000 n -0000455868 00000 n -0000455980 00000 n -0000456157 00000 n -0000456266 00000 n -0000456391 00000 n -0000456537 00000 n -0000456639 00000 n -0000456815 00000 n -0000456959 00000 n -0000457071 00000 n -0000457198 00000 n -0000457326 00000 n -0000457454 00000 n -0000457565 00000 n -0000457764 00000 n -0000457875 00000 n -0000457990 00000 n -0000458134 00000 n -0000458342 00000 n -0000458476 00000 n -0000458630 00000 n -0000458755 00000 n -0000458886 00000 n -0000459017 00000 n -0000459178 00000 n -0000459299 00000 n -0000459502 00000 n -0000459613 00000 n -0000459728 00000 n -0000459921 00000 n -0000460064 00000 n -0000460180 00000 n -0000460338 00000 n -0000460495 00000 n -0000460626 00000 n -0000460747 00000 n -0000460924 00000 n -0000461034 00000 n -0000461164 00000 n -0000461334 00000 n -0000461428 00000 n -0000461555 00000 n -0000461682 00000 n -0000461778 00000 n -0000461964 00000 n -0000462090 00000 n -0000462223 00000 n -0000462350 00000 n -0000462462 00000 n -0000462627 00000 n -0000462781 00000 n -0000462889 00000 n -0000463035 00000 n -0000463153 00000 n -0000463285 00000 n -0000463422 00000 n -0000463554 00000 n -0000463688 00000 n -0000463818 00000 n -0000463986 00000 n -0000464106 00000 n -0000464215 00000 n -0000464421 00000 n -0000464580 00000 n -0000464728 00000 n -0000464856 00000 n -0000465037 00000 n -0000465147 00000 n -0000465262 00000 n -0000465407 00000 n -0000465571 00000 n -0000465721 00000 n -0000465852 00000 n -0000466070 00000 n -0000466175 00000 n -0000466307 00000 n -0000466428 00000 n -0000466594 00000 n -0000466698 00000 n -0000466855 00000 n -0000466966 00000 n -0000467111 00000 n -0000467253 00000 n -0000467403 00000 n -0000467520 00000 n -0000467684 00000 n -0000467795 00000 n -0000467935 00000 n -0000468062 00000 n -0000468179 00000 n -0000468318 00000 n -0000468424 00000 n -0000468558 00000 n -0000468690 00000 n -0000468835 00000 n -0000468962 00000 n -0000469094 00000 n -0000469224 00000 n -0000469349 00000 n -0000469457 00000 n -0000469628 00000 n -0000469732 00000 n -0000469867 00000 n -0000469995 00000 n -0000470169 00000 n -0000470271 00000 n -0000470421 00000 n -0000470571 00000 n -0000470696 00000 n -0000470902 00000 n -0000471002 00000 n -0000471120 00000 n -0000471285 00000 n -0000471376 00000 n -0000471537 00000 n -0000471663 00000 n -0000471806 00000 n -0000471933 00000 n -0000472073 00000 n -0000472209 00000 n -0000472317 00000 n -0000472491 00000 n -0000472597 00000 n -0000472717 00000 n -0000472829 00000 n -0000472946 00000 n -0000473048 00000 n -0000473240 00000 n -0000473412 00000 n -0000473516 00000 n -0000473640 00000 n -0000473762 00000 n -0000473874 00000 n -0000474056 00000 n -0000474172 00000 n -0000474296 00000 n -0000474414 00000 n -0000474532 00000 n -0000474637 00000 n -0000474814 00000 n -0000474926 00000 n -0000475057 00000 n -0000475181 00000 n -0000475348 00000 n -0000475465 00000 n -0000475595 00000 n -0000475735 00000 n -0000475872 00000 n -0000476008 00000 n -0000476144 00000 n -0000476281 00000 n -0000476393 00000 n -0000476600 00000 n -0000476728 00000 n -0000476813 00000 n -0000476984 00000 n -0000477106 00000 n -0000477266 00000 n -0000477365 00000 n -0000477480 00000 n -0000477582 00000 n -0000477743 00000 n -0000477847 00000 n -0000477946 00000 n -0000478110 00000 n -0000478214 00000 n -0000478347 00000 n -0000478479 00000 n -0000478601 00000 n -0000478730 00000 n -0000478837 00000 n -0000479003 00000 n -0000479125 00000 n -0000479235 00000 n -0000479349 00000 n -0000479524 00000 n -0000479627 00000 n -0000479747 00000 n -0000479862 00000 n -0000479976 00000 n -0000480091 00000 n -0000480205 00000 n -0000480320 00000 n -0000480438 00000 n -0000480555 00000 n -0000480661 00000 n -0000480822 00000 n -0000480918 00000 n -0000481032 00000 n -0000481142 00000 n -0000481273 00000 n -0000481406 00000 n -0000481507 00000 n -0000481685 00000 n -0000481795 00000 n -0000481949 00000 n -0000482118 00000 n -0000482306 00000 n -0000482487 00000 n -0000482643 00000 n -0000482809 00000 n -0000482941 00000 n -0000483088 00000 n -0000483227 00000 n -0000483361 00000 n -0000483485 00000 n -0000483606 00000 n -0000483725 00000 n -0000483895 00000 n -0000484057 00000 n -0000484163 00000 n -0000484280 00000 n -0000484431 00000 n -0000484596 00000 n -0000484721 00000 n -0000484877 00000 n -0000484995 00000 n -0000485125 00000 n -0000485289 00000 n -0000485393 00000 n -0000485511 00000 n -0000485629 00000 n -0000485750 00000 n -0000485886 00000 n -0000485985 00000 n +0000098567 00000 n +0000098592 00000 n +0000098640 00000 n +0000098727 00000 n +0000098777 00000 n +0000098861 00000 n +0000098905 00000 n +0000098989 00000 n +0000099030 00000 n +0000099074 00000 n +0000099160 00000 n +0000099210 00000 n +0000099296 00000 n +0000099346 00000 n +0000099432 00000 n +0000099481 00000 n +0000099567 00000 n +0000099614 00000 n +0000099700 00000 n +0000099758 00000 n +0000099874 00000 n +0000099963 00000 n +0000100079 00000 n +0000100166 00000 n +0000100202 00000 n +0000100322 00000 n +0000100410 00000 n +0000100454 00000 n +0000100543 00000 n +0000100587 00000 n +0000100676 00000 n +0000100721 00000 n +0000100811 00000 n +0000100899 00000 n +0000100963 00000 n +0000101051 00000 n +0000101087 00000 n +0000101149 00000 n +0000101237 00000 n +0000101264 00000 n +0000101320 00000 n +0000101409 00000 n +0000101436 00000 n +0000101540 00000 n +0000101645 00000 n +0000101750 00000 n +0000101855 00000 n +0000101960 00000 n +0000102065 00000 n +0000102170 00000 n +0000102275 00000 n +0000102380 00000 n +0000102485 00000 n +0000102590 00000 n +0000102694 00000 n +0000102799 00000 n +0000102904 00000 n +0000103009 00000 n +0000103114 00000 n +0000103219 00000 n +0000103324 00000 n +0000103428 00000 n +0000103533 00000 n +0000103638 00000 n +0000103743 00000 n +0000103848 00000 n +0000103953 00000 n +0000104058 00000 n +0000104163 00000 n +0000104268 00000 n +0000104373 00000 n +0000104478 00000 n +0000104583 00000 n +0000104688 00000 n +0000104793 00000 n +0000104898 00000 n +0000105002 00000 n +0000105107 00000 n +0000105212 00000 n +0000105317 00000 n +0000105422 00000 n +0000105527 00000 n +0000105632 00000 n +0000105737 00000 n +0000105842 00000 n +0000105947 00000 n +0000106051 00000 n +0000106155 00000 n +0000106258 00000 n +0000106361 00000 n +0000106802 00000 n +0000106907 00000 n +0000107012 00000 n +0000107117 00000 n +0000107221 00000 n +0000107326 00000 n +0000107431 00000 n +0000107536 00000 n +0000107641 00000 n +0000107746 00000 n +0000107851 00000 n +0000107956 00000 n +0000108061 00000 n +0000108166 00000 n +0000108271 00000 n +0000108376 00000 n +0000108481 00000 n +0000108586 00000 n +0000108691 00000 n +0000108796 00000 n +0000108985 00000 n +0000109041 00000 n +0000109129 00000 n +0000109198 00000 n +0000109286 00000 n +0000109362 00000 n +0000109451 00000 n +0000109522 00000 n +0000109610 00000 n +0000109690 00000 n +0000109779 00000 n +0000109842 00000 n +0000109925 00000 n +0000110013 00000 n +0000110089 00000 n +0000110178 00000 n +0000110252 00000 n +0000110341 00000 n +0000110420 00000 n +0000110509 00000 n +0000110563 00000 n +0000110612 00000 n +0000110701 00000 n +0000110728 00000 n +0000110777 00000 n +0000110866 00000 n +0000110893 00000 n +0000110943 00000 n +0000111032 00000 n +0000111096 00000 n +0000111185 00000 n +0000111249 00000 n +0000111338 00000 n +0000111393 00000 n +0000111482 00000 n +0000111536 00000 n +0000111605 00000 n +0000111693 00000 n +0000111749 00000 n +0000111838 00000 n +0000111874 00000 n +0000111923 00000 n +0000112012 00000 n +0000112077 00000 n +0000112166 00000 n +0000112222 00000 n +0000112311 00000 n +0000112359 00000 n +0000112448 00000 n +0000112502 00000 n +0000112557 00000 n +0000112646 00000 n +0000112701 00000 n +0000112790 00000 n +0000112826 00000 n +0000112862 00000 n +0000112898 00000 n +0000118585 00000 n +0000118630 00000 n +0000118675 00000 n +0000118720 00000 n +0000118765 00000 n +0000118810 00000 n +0000118855 00000 n +0000118900 00000 n +0000118945 00000 n +0000118990 00000 n +0000119035 00000 n +0000119080 00000 n +0000119125 00000 n +0000119170 00000 n +0000119215 00000 n +0000119260 00000 n +0000119305 00000 n +0000119350 00000 n +0000119395 00000 n +0000119440 00000 n +0000119485 00000 n +0000119530 00000 n +0000119575 00000 n +0000119620 00000 n +0000119665 00000 n +0000119710 00000 n +0000119755 00000 n +0000119800 00000 n +0000119845 00000 n +0000119890 00000 n +0000119935 00000 n +0000119980 00000 n +0000120025 00000 n +0000120070 00000 n +0000120115 00000 n +0000120160 00000 n +0000120205 00000 n +0000120250 00000 n +0000120295 00000 n +0000120340 00000 n +0000120385 00000 n +0000120430 00000 n +0000120475 00000 n +0000120520 00000 n +0000120565 00000 n +0000120610 00000 n +0000120655 00000 n +0000120700 00000 n +0000120745 00000 n +0000120790 00000 n +0000120835 00000 n +0000120880 00000 n +0000120925 00000 n +0000120970 00000 n +0000121015 00000 n +0000121060 00000 n +0000121105 00000 n +0000121150 00000 n +0000121195 00000 n +0000121240 00000 n +0000121285 00000 n +0000121330 00000 n +0000121375 00000 n +0000121420 00000 n +0000121465 00000 n +0000121510 00000 n +0000121555 00000 n +0000121600 00000 n +0000121645 00000 n +0000121690 00000 n +0000121735 00000 n +0000121780 00000 n +0000121825 00000 n +0000121870 00000 n +0000121915 00000 n +0000121960 00000 n +0000122005 00000 n +0000122050 00000 n +0000122095 00000 n +0000122140 00000 n +0000122185 00000 n +0000122230 00000 n +0000122275 00000 n +0000122320 00000 n +0000122365 00000 n +0000122410 00000 n +0000122455 00000 n +0000122500 00000 n +0000122545 00000 n +0000122590 00000 n +0000122635 00000 n +0000122680 00000 n +0000122725 00000 n +0000122770 00000 n +0000122815 00000 n +0000122860 00000 n +0000122905 00000 n +0000122950 00000 n +0000122995 00000 n +0000123040 00000 n +0000123085 00000 n +0000123130 00000 n +0000123175 00000 n +0000123220 00000 n +0000123265 00000 n +0000123310 00000 n +0000123355 00000 n +0000123400 00000 n +0000123445 00000 n +0000123490 00000 n +0000123535 00000 n +0000123580 00000 n +0000123625 00000 n +0000123670 00000 n +0000123715 00000 n +0000123760 00000 n +0000123805 00000 n +0000123850 00000 n +0000123895 00000 n +0000123940 00000 n +0000123985 00000 n +0000124030 00000 n +0000124075 00000 n +0000124120 00000 n +0000124165 00000 n +0000124210 00000 n +0000124255 00000 n +0000124300 00000 n +0000124345 00000 n +0000124390 00000 n +0000124435 00000 n +0000124480 00000 n +0000124525 00000 n +0000124570 00000 n +0000124615 00000 n +0000124660 00000 n +0000124705 00000 n +0000124750 00000 n +0000124795 00000 n +0000124840 00000 n +0000124885 00000 n +0000124930 00000 n +0000124975 00000 n +0000125020 00000 n +0000125065 00000 n +0000125110 00000 n +0000125155 00000 n +0000125200 00000 n +0000125245 00000 n +0000125290 00000 n +0000125335 00000 n +0000125380 00000 n +0000125425 00000 n +0000125470 00000 n +0000125515 00000 n +0000125560 00000 n +0000125605 00000 n +0000125650 00000 n +0000125695 00000 n +0000125740 00000 n +0000125785 00000 n +0000125830 00000 n +0000125875 00000 n +0000125920 00000 n +0000125965 00000 n +0000126010 00000 n +0000126055 00000 n +0000126100 00000 n +0000126145 00000 n +0000126190 00000 n +0000126235 00000 n +0000126280 00000 n +0000126325 00000 n +0000126370 00000 n +0000126415 00000 n +0000126460 00000 n +0000126505 00000 n +0000126550 00000 n +0000126595 00000 n +0000126640 00000 n +0000126685 00000 n +0000126730 00000 n +0000126775 00000 n +0000126820 00000 n +0000126865 00000 n +0000126910 00000 n +0000126955 00000 n +0000127000 00000 n +0000127045 00000 n +0000127090 00000 n +0000127135 00000 n +0000127180 00000 n +0000127225 00000 n +0000127270 00000 n +0000127315 00000 n +0000127360 00000 n +0000127405 00000 n +0000127450 00000 n +0000127495 00000 n +0000127540 00000 n +0000127585 00000 n +0000127630 00000 n +0000127675 00000 n +0000127720 00000 n +0000127765 00000 n +0000127810 00000 n +0000127855 00000 n +0000127900 00000 n +0000127945 00000 n +0000127990 00000 n +0000128035 00000 n +0000128080 00000 n +0000128125 00000 n +0000128170 00000 n +0000128215 00000 n +0000128260 00000 n +0000128305 00000 n +0000128350 00000 n +0000128395 00000 n +0000128440 00000 n +0000128485 00000 n +0000128530 00000 n +0000128575 00000 n +0000128620 00000 n +0000128665 00000 n +0000128710 00000 n +0000128755 00000 n +0000128800 00000 n +0000128845 00000 n +0000128890 00000 n +0000128935 00000 n +0000128980 00000 n +0000129025 00000 n +0000129070 00000 n +0000129115 00000 n +0000129160 00000 n +0000129205 00000 n +0000129250 00000 n +0000129295 00000 n +0000129340 00000 n +0000129385 00000 n +0000129430 00000 n +0000129475 00000 n +0000129520 00000 n +0000129565 00000 n +0000129610 00000 n +0000129655 00000 n +0000129700 00000 n +0000129745 00000 n +0000129790 00000 n +0000129835 00000 n +0000129880 00000 n +0000129925 00000 n +0000129970 00000 n +0000130015 00000 n +0000130060 00000 n +0000130105 00000 n +0000130150 00000 n +0000130195 00000 n +0000130240 00000 n +0000130285 00000 n +0000130330 00000 n +0000130375 00000 n +0000130420 00000 n +0000130465 00000 n +0000130510 00000 n +0000130555 00000 n +0000130600 00000 n +0000130645 00000 n +0000130690 00000 n +0000130735 00000 n +0000130780 00000 n +0000130825 00000 n +0000130870 00000 n +0000130915 00000 n +0000130960 00000 n +0000131005 00000 n +0000131050 00000 n +0000131095 00000 n +0000131140 00000 n +0000131185 00000 n +0000131230 00000 n +0000131275 00000 n +0000131320 00000 n +0000131365 00000 n +0000131410 00000 n +0000131455 00000 n +0000131500 00000 n +0000131545 00000 n +0000131590 00000 n +0000131635 00000 n +0000131680 00000 n +0000131725 00000 n +0000131770 00000 n +0000131815 00000 n +0000131860 00000 n +0000131905 00000 n +0000131950 00000 n +0000131995 00000 n +0000132040 00000 n +0000132085 00000 n +0000132130 00000 n +0000132175 00000 n +0000132220 00000 n +0000132265 00000 n +0000132310 00000 n +0000132355 00000 n +0000132400 00000 n +0000132445 00000 n +0000132490 00000 n +0000132534 00000 n +0000132579 00000 n +0000132624 00000 n +0000132669 00000 n +0000132714 00000 n +0000132759 00000 n +0000132804 00000 n +0000132849 00000 n +0000132894 00000 n +0000132939 00000 n +0000132984 00000 n +0000133029 00000 n +0000133074 00000 n +0000133119 00000 n +0000133164 00000 n +0000133209 00000 n +0000133253 00000 n +0000133298 00000 n +0000133343 00000 n +0000133388 00000 n +0000133433 00000 n +0000135057 00000 n +0000135218 00000 n +0000135387 00000 n +0000135580 00000 n +0000139621 00000 n +0000139815 00000 n +0000143896 00000 n +0000144090 00000 n +0000148180 00000 n +0000148374 00000 n +0000152107 00000 n +0000152301 00000 n +0000156347 00000 n +0000156541 00000 n +0000159649 00000 n +0000159843 00000 n +0000163786 00000 n +0000163947 00000 n +0000164181 00000 n +0000164384 00000 n +0000166981 00000 n +0000167165 00000 n +0000170445 00000 n +0000170620 00000 n +0000173218 00000 n +0000173393 00000 n +0000174928 00000 n +0000175089 00000 n +0000175277 00000 n +0000175480 00000 n +0000178202 00000 n +0000178405 00000 n +0000179839 00000 n +0000180056 00000 n +0000181509 00000 n +0000181706 00000 n +0000183558 00000 n +0000183718 00000 n +0000184213 00000 n +0000184383 00000 n +0000186123 00000 n +0000186302 00000 n +0000188177 00000 n +0000188365 00000 n +0000190207 00000 n +0000190395 00000 n +0000192105 00000 n +0000192274 00000 n +0000193077 00000 n +0000193306 00000 n +0000195175 00000 n +0000195372 00000 n +0000196911 00000 n +0000197108 00000 n +0000198604 00000 n +0000198827 00000 n +0000200996 00000 n +0000201199 00000 n +0000203092 00000 n +0000203306 00000 n +0000204607 00000 n +0000204839 00000 n +0000206512 00000 n +0000206725 00000 n +0000208629 00000 n +0000208837 00000 n +0000210115 00000 n +0000210354 00000 n +0000211950 00000 n +0000212138 00000 n +0000213396 00000 n +0000213557 00000 n +0000213747 00000 n +0000213959 00000 n +0000216815 00000 n +0000216990 00000 n +0000217338 00000 n +0000217527 00000 n +0000219168 00000 n +0000219356 00000 n +0000220849 00000 n +0000221028 00000 n +0000222758 00000 n +0000222938 00000 n +0000224902 00000 n +0000225115 00000 n +0000226889 00000 n +0000227111 00000 n +0000228160 00000 n +0000228405 00000 n +0000229825 00000 n +0000230039 00000 n +0000231576 00000 n +0000231774 00000 n +0000233805 00000 n +0000234070 00000 n +0000235826 00000 n +0000236039 00000 n +0000237616 00000 n +0000237823 00000 n +0000239818 00000 n +0000240050 00000 n +0000242079 00000 n +0000242291 00000 n +0000244272 00000 n +0000244485 00000 n +0000246689 00000 n +0000246919 00000 n +0000249106 00000 n +0000249266 00000 n +0000250003 00000 n +0000250197 00000 n +0000251753 00000 n +0000251933 00000 n +0000253674 00000 n +0000253863 00000 n +0000255064 00000 n +0000255261 00000 n +0000256579 00000 n +0000256767 00000 n +0000257636 00000 n +0000257868 00000 n +0000259291 00000 n +0000259526 00000 n +0000261442 00000 n +0000261603 00000 n +0000261796 00000 n +0000261999 00000 n +0000264638 00000 n +0000264822 00000 n +0000267495 00000 n +0000267670 00000 n +0000269459 00000 n +0000269663 00000 n +0000270360 00000 n +0000270567 00000 n +0000272315 00000 n +0000272513 00000 n +0000274241 00000 n +0000274454 00000 n +0000276141 00000 n +0000276354 00000 n +0000277903 00000 n +0000278072 00000 n +0000278652 00000 n +0000278840 00000 n +0000280334 00000 n +0000280554 00000 n +0000282159 00000 n +0000282369 00000 n +0000284036 00000 n +0000284239 00000 n +0000285331 00000 n +0000285595 00000 n +0000287319 00000 n +0000287565 00000 n +0000289455 00000 n +0000289678 00000 n +0000291468 00000 n +0000291691 00000 n +0000293566 00000 n +0000293745 00000 n +0000294969 00000 n +0000295201 00000 n +0000296872 00000 n +0000297051 00000 n +0000298631 00000 n +0000298810 00000 n +0000300357 00000 n +0000300536 00000 n +0000302040 00000 n +0000302219 00000 n +0000303885 00000 n +0000304055 00000 n +0000304801 00000 n +0000304999 00000 n +0000306817 00000 n +0000307050 00000 n +0000309105 00000 n +0000309294 00000 n +0000310950 00000 n +0000311120 00000 n +0000311882 00000 n +0000312052 00000 n +0000313157 00000 n +0000313327 00000 n +0000314147 00000 n +0000314317 00000 n +0000315134 00000 n +0000315304 00000 n +0000316466 00000 n +0000316689 00000 n +0000318342 00000 n +0000318568 00000 n +0000320251 00000 n +0000320496 00000 n +0000322387 00000 n +0000322556 00000 n +0000324301 00000 n +0000324485 00000 n +0000326235 00000 n +0000326491 00000 n +0000328467 00000 n +0000328666 00000 n +0000330889 00000 n +0000331100 00000 n +0000332867 00000 n +0000333068 00000 n +0000334084 00000 n +0000334273 00000 n +0000335966 00000 n +0000336145 00000 n +0000337890 00000 n +0000338078 00000 n +0000339914 00000 n +0000340108 00000 n +0000342020 00000 n +0000342251 00000 n +0000344355 00000 n +0000344567 00000 n +0000346003 00000 n +0000346217 00000 n +0000347666 00000 n +0000347873 00000 n +0000349110 00000 n +0000349289 00000 n +0000350276 00000 n +0000350464 00000 n +0000351596 00000 n +0000351784 00000 n +0000353285 00000 n +0000353473 00000 n +0000354556 00000 n +0000354745 00000 n +0000356078 00000 n +0000356282 00000 n +0000358271 00000 n +0000358468 00000 n +0000360584 00000 n +0000360805 00000 n +0000362779 00000 n +0000363010 00000 n +0000364482 00000 n +0000364693 00000 n +0000366522 00000 n +0000366701 00000 n +0000368620 00000 n +0000368850 00000 n +0000370591 00000 n +0000370812 00000 n +0000372412 00000 n +0000372634 00000 n +0000373930 00000 n +0000374171 00000 n +0000375777 00000 n +0000375975 00000 n +0000377824 00000 n +0000378021 00000 n +0000379642 00000 n +0000379821 00000 n +0000381874 00000 n +0000382053 00000 n +0000383891 00000 n +0000384070 00000 n +0000385780 00000 n +0000385959 00000 n +0000386393 00000 n +0000386563 00000 n +0000388236 00000 n +0000388415 00000 n +0000390200 00000 n +0000390379 00000 n +0000392025 00000 n +0000392194 00000 n +0000393509 00000 n +0000393697 00000 n +0000395264 00000 n +0000395452 00000 n +0000397067 00000 n +0000397255 00000 n +0000398643 00000 n +0000398813 00000 n +0000400448 00000 n +0000400618 00000 n +0000401631 00000 n +0000401845 00000 n +0000403332 00000 n +0000403512 00000 n +0000404276 00000 n +0000404473 00000 n +0000405686 00000 n +0000405890 00000 n +0000407236 00000 n +0000407422 00000 n +0000407898 00000 n +0000408077 00000 n +0000409622 00000 n +0000409801 00000 n +0000411038 00000 n +0000411242 00000 n +0000412654 00000 n +0000412849 00000 n +0000415544 00000 n +0000415720 00000 n +0000416495 00000 n +0000416665 00000 n +0000418173 00000 n +0000418343 00000 n +0000419742 00000 n +0000419912 00000 n +0000421462 00000 n +0000421631 00000 n +0000422595 00000 n +0000422774 00000 n +0000424302 00000 n +0000424490 00000 n +0000425458 00000 n +0000425628 00000 n +0000425958 00000 n +0000426154 00000 n +0000427884 00000 n +0000428098 00000 n +0000429782 00000 n +0000429977 00000 n +0000431684 00000 n +0000431897 00000 n +0000433384 00000 n +0000433579 00000 n +0000435161 00000 n +0000435384 00000 n +0000436749 00000 n +0000436937 00000 n +0000438108 00000 n +0000438305 00000 n +0000439856 00000 n +0000440044 00000 n +0000440688 00000 n +0000440892 00000 n +0000442630 00000 n +0000442818 00000 n +0000444560 00000 n +0000444739 00000 n +0000446137 00000 n +0000446316 00000 n +0000448014 00000 n +0000448193 00000 n +0000449674 00000 n +0000449853 00000 n +0000451637 00000 n +0000451841 00000 n +0000453490 00000 n +0000453549 00000 n +0000453652 00000 n +0000453817 00000 n +0000453899 00000 n +0000454007 00000 n +0000454130 00000 n +0000454242 00000 n +0000454420 00000 n +0000454541 00000 n +0000454701 00000 n +0000454819 00000 n +0000454916 00000 n +0000455068 00000 n +0000455208 00000 n +0000455386 00000 n +0000455541 00000 n +0000455643 00000 n +0000455743 00000 n +0000455952 00000 n +0000456053 00000 n +0000456241 00000 n +0000456384 00000 n +0000456530 00000 n +0000456646 00000 n +0000456813 00000 n +0000456925 00000 n +0000457099 00000 n +0000457202 00000 n +0000457375 00000 n +0000457496 00000 n +0000457626 00000 n +0000457752 00000 n +0000457867 00000 n +0000457975 00000 n +0000458122 00000 n +0000458227 00000 n +0000458346 00000 n +0000458475 00000 n +0000458634 00000 n +0000458768 00000 n +0000458905 00000 n +0000459037 00000 n +0000459186 00000 n +0000459318 00000 n +0000459466 00000 n +0000459580 00000 n +0000459698 00000 n +0000459852 00000 n +0000459983 00000 n +0000460077 00000 n +0000460201 00000 n +0000460313 00000 n +0000460490 00000 n +0000460599 00000 n +0000460724 00000 n +0000460870 00000 n +0000460972 00000 n +0000461148 00000 n +0000461292 00000 n +0000461404 00000 n +0000461531 00000 n +0000461659 00000 n +0000461787 00000 n +0000461898 00000 n +0000462097 00000 n +0000462208 00000 n +0000462323 00000 n +0000462467 00000 n +0000462675 00000 n +0000462809 00000 n +0000462963 00000 n +0000463088 00000 n +0000463219 00000 n +0000463350 00000 n +0000463511 00000 n +0000463632 00000 n +0000463835 00000 n +0000463946 00000 n +0000464061 00000 n +0000464254 00000 n +0000464397 00000 n +0000464513 00000 n +0000464671 00000 n +0000464828 00000 n +0000464959 00000 n +0000465080 00000 n +0000465257 00000 n +0000465367 00000 n +0000465497 00000 n +0000465667 00000 n +0000465761 00000 n +0000465888 00000 n +0000466015 00000 n +0000466111 00000 n +0000466297 00000 n +0000466423 00000 n +0000466556 00000 n +0000466683 00000 n +0000466795 00000 n +0000466985 00000 n +0000467091 00000 n +0000467297 00000 n +0000467456 00000 n +0000467604 00000 n +0000467732 00000 n +0000467913 00000 n +0000468023 00000 n +0000468138 00000 n +0000468283 00000 n +0000468447 00000 n +0000468597 00000 n +0000468728 00000 n +0000468946 00000 n +0000469051 00000 n +0000469183 00000 n +0000469304 00000 n +0000469470 00000 n +0000469574 00000 n +0000469731 00000 n +0000469842 00000 n +0000469987 00000 n +0000470129 00000 n +0000470279 00000 n +0000470396 00000 n +0000470560 00000 n +0000470671 00000 n +0000470811 00000 n +0000470938 00000 n +0000471055 00000 n +0000471194 00000 n +0000471300 00000 n +0000471434 00000 n +0000471566 00000 n +0000471711 00000 n +0000471838 00000 n +0000471970 00000 n +0000472100 00000 n +0000472225 00000 n +0000472333 00000 n +0000472504 00000 n +0000472608 00000 n +0000472743 00000 n +0000472871 00000 n +0000473045 00000 n +0000473147 00000 n +0000473297 00000 n +0000473447 00000 n +0000473572 00000 n +0000473778 00000 n +0000473878 00000 n +0000473996 00000 n +0000474161 00000 n +0000474252 00000 n +0000474413 00000 n +0000474539 00000 n +0000474682 00000 n +0000474809 00000 n +0000474949 00000 n +0000475085 00000 n +0000475193 00000 n +0000475367 00000 n +0000475473 00000 n +0000475593 00000 n +0000475705 00000 n +0000475822 00000 n +0000475924 00000 n +0000476107 00000 n +0000476238 00000 n +0000476376 00000 n +0000476536 00000 n +0000476676 00000 n +0000476844 00000 n +0000476976 00000 n +0000477094 00000 n +0000477226 00000 n +0000477363 00000 n +0000477495 00000 n +0000477629 00000 n +0000477759 00000 n +0000477927 00000 n +0000478047 00000 n +0000478156 00000 n +0000478348 00000 n +0000478520 00000 n +0000478624 00000 n +0000478748 00000 n +0000478870 00000 n +0000478982 00000 n +0000479164 00000 n +0000479280 00000 n +0000479404 00000 n +0000479522 00000 n +0000479640 00000 n +0000479745 00000 n +0000479922 00000 n +0000480034 00000 n +0000480165 00000 n +0000480289 00000 n +0000480456 00000 n +0000480573 00000 n +0000480703 00000 n +0000480843 00000 n +0000480980 00000 n +0000481116 00000 n +0000481252 00000 n +0000481389 00000 n +0000481501 00000 n +0000481708 00000 n +0000481836 00000 n +0000481921 00000 n +0000482092 00000 n +0000482214 00000 n +0000482374 00000 n +0000482473 00000 n +0000482588 00000 n +0000482690 00000 n +0000482851 00000 n +0000482955 00000 n +0000483054 00000 n +0000483218 00000 n +0000483322 00000 n +0000483455 00000 n +0000483587 00000 n +0000483709 00000 n +0000483838 00000 n +0000483945 00000 n +0000484111 00000 n +0000484233 00000 n +0000484343 00000 n +0000484457 00000 n +0000484632 00000 n +0000484735 00000 n +0000484855 00000 n +0000484970 00000 n +0000485084 00000 n +0000485199 00000 n +0000485313 00000 n +0000485428 00000 n +0000485546 00000 n +0000485663 00000 n +0000485769 00000 n +0000485930 00000 n +0000486026 00000 n 0000486140 00000 n -0000486244 00000 n -0000486361 00000 n -0000486511 00000 n -0000486611 00000 n -0000486725 00000 n -0000486839 00000 n -0000486953 00000 n -0000487067 00000 n -0000487181 00000 n -0000487295 00000 n -0000487409 00000 n -0000487523 00000 n -0000487639 00000 n -0000487741 00000 n -0000487855 00000 n +0000486250 00000 n +0000486381 00000 n +0000486514 00000 n +0000486615 00000 n +0000486793 00000 n +0000486903 00000 n +0000487057 00000 n +0000487226 00000 n +0000487414 00000 n +0000487595 00000 n +0000487751 00000 n +0000487917 00000 n +0000488049 00000 n +0000488196 00000 n +0000488335 00000 n +0000488469 00000 n +0000488593 00000 n +0000488714 00000 n +0000488833 00000 n +0000489003 00000 n +0000489165 00000 n +0000489271 00000 n +0000489388 00000 n +0000489539 00000 n +0000489704 00000 n +0000489829 00000 n +0000489985 00000 n +0000490103 00000 n +0000490233 00000 n +0000490397 00000 n +0000490501 00000 n +0000490619 00000 n +0000490737 00000 n +0000490858 00000 n +0000490994 00000 n +0000491093 00000 n +0000491248 00000 n +0000491352 00000 n +0000491469 00000 n +0000491619 00000 n +0000491719 00000 n +0000491833 00000 n +0000491947 00000 n +0000492061 00000 n +0000492175 00000 n +0000492289 00000 n +0000492403 00000 n +0000492517 00000 n +0000492631 00000 n +0000492747 00000 n +0000492849 00000 n +0000492963 00000 n trailer -<<90de86fcfbc3ee411d8c68aedcf34015>]>> +<]>> startxref -488808 +493959 %%EOF diff --git a/docs/docbook/manpages/smbspool.8.sgml b/docs/docbook/manpages/smbspool.8.sgml index f30539601e..dabdcced01 100644 --- a/docs/docbook/manpages/smbspool.8.sgml +++ b/docs/docbook/manpages/smbspool.8.sgml @@ -15,12 +15,12 @@ smbspool - job - user - title - copies - options - filename + job + user + title + copies + options + filename @@ -95,7 +95,7 @@ VERSION - This man page is correct for version 2.2 of the Samba suite. + This man page is correct for version 3.0 of the Samba suite. diff --git a/docs/docbook/manpages/testprns.1.sgml b/docs/docbook/manpages/testprns.1.sgml index 85cc860c4a..3ff1d85055 100644 --- a/docs/docbook/manpages/testprns.1.sgml +++ b/docs/docbook/manpages/testprns.1.sgml @@ -111,7 +111,7 @@ VERSION - This man page is correct for version 2.2 of + This man page is correct for version 3.0 of the Samba suite. diff --git a/docs/docs-status b/docs/docs-status index 7b1eaa4bfd..8f7b80e5f8 100644 --- a/docs/docs-status +++ b/docs/docs-status @@ -7,7 +7,6 @@ docs/history - needs updating (is current up to 1998 - merge with 10year.html ?) docs/docbook/manpages/net.8.sgml - Still not finished docs/docbook/manpages/rpcclient.1.sgml - Command documentation might be outdated docs/docbook/manpages/samba.7.sgml - Listing of samba programs is not complete -docs/docbook/manpages/smbcontrol.1.sgml - Document -s, samsync, samrepl, pool-usage, dmalloc-mark, dmalloc-log-changed, shutdown, change_id docs/docbook/manpages/smb.conf.5.sgml - 'restrict anonymous' isn't documented properly docs/docbook/projdoc/Integrating-with-Windows.sgml - Should slowly go a way. Contains a little bit information about wins, a little bit about domain membership, a little about winbind, etc docs/docbook/projdoc/PAM-Authentication-And-Samba.sgml @@ -23,18 +22,7 @@ docs/textdocs/CUPS-PrintingInfo.txt - needs to be converted to sgml - Kurt Pfeif docs/textdocs/PROFILES.txt - needs to be converted to sgml docs/textdocs/README.jis - Seems to need updating - possibly obsoleted by a newer japanese howto? docs/textdocs/RoutedNetworks.txt - still valid, but shouldn't this go into Other_clients.sgml ? This text originally comes from microsoft, what about copyright? -docs/docbook/manpages/ntlm_auth.1.sgml - Is very basic at the moment, parameters need better descriptions - -These still need to be checked: -docs/docbook/manpages/smbmnt.8.sgml -docs/docbook/manpages/smbmount.8.sgml -docs/docbook/manpages/smbpasswd.8.sgml -docs/docbook/manpages/smbsh.1.sgml -docs/docbook/manpages/smbspool.8.sgml -docs/docbook/manpages/smbstatus.1.sgml -docs/docbook/manpages/smbtar.1.sgml -docs/docbook/manpages/smbumount.8.sgml -docs/docbook/manpages/testprns.1.sgml +docs/docbook/manpages/ntlm_auth.1.sgml - Is very basic at the moment, parameters need better descriptions - abartlet Stuff that needs to be documented: wrepld @@ -43,8 +31,6 @@ Winbind in a samba controlled domain One Time Migration script from a Windows NT 4.0 PDC to a Samba PDC ldap passwd sync -http://www.unav.es/cti/ldap-smb/smb-ldap-3-howto.html - Not release-critical: docs/docbook/devdoc/* - most of these docs are outdated and need updates... docs/docbook/projdoc/Diagnosis.sgml - Needs extension diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index c902d63bec..73bc3eb60a 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -219,8 +219,8 @@ HREF="#AEN546" >

    3.8. Passdb XML pluginXML
    4.1. Stand Alone Server
    4.2. Domain Member Server
    4.3. Domain Controller
    5.1. User and Share security level
    6.1. Prerequisite Reading
    6.2. Background
    6.3. Configuring the Samba Domain Controller
    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
    6.5. Common Problems and Errors
    6.6. What other help can I get?
    6.7. Domain Control for Windows 9x/ME
    7.1. Prerequisite Reading
    7.2. Background
    7.3. What qualifies a Domain Controller on the network?
    7.4. Can Samba be a Backup Domain Controller to an NT PDC?
    7.5. How do I set up a Samba BDC?
    8.1. Setup your smb.conf
    8.2. Setup your /etc/krb5.conf
    8.3. Create the computer account
    8.4. Test your server setup
    8.5. Testing with smbclient
    8.6. Notes
    9.1. Joining an NT Domain with Samba 3.0
    9.2. Why is this better than security = server?
    10. System PoliciesAdvanced Network Manangement Information
    10.1. Basic System Policy Info
    10.2. Roaming ProfilesRemote Server Administration
    11.1. Viewing and changing UNIX permissions using the NT security dialogs
    11.2. How to view file security on a Samba share
    11.3. Viewing file ownership
    11.4. Viewing file or directory permissions
    11.5. Modifying file or directory permissions
    11.6. Interaction with the standard Samba create mask parameters
    11.7. Interaction with the standard Samba file attribute mapping
    13.1. Samba and PAM
    13.2. Distributed Authentication
    13.3. PAM Configuration in smb.conf
    14.1. Introduction
    14.2. Configuration
    14.3. The Imprints Toolset
    14.4. Diagnosis
    15.1. Introduction
    15.2. CUPS - RAW Print Through Mode
    15.3. The CUPS Filter Chains
    15.4. CUPS Print Drivers and Devices
    15.5. Limiting the number of pages users can print
    15.6. Advanced Postscript Printing from MS Windows
    15.7. Auto-Deletion of CUPS spool files
    16.1. Abstract
    16.2. Introduction
    16.3. What Winbind Provides
    16.4. How Winbind Works
    16.5. Installation and Configuration
    16.6. Limitations
    16.7. Conclusion
    17. Policy Management - Hows and Whys
    17.1. System Policies
    18. Profile Management
    18.1. Roaming Profiles
    19. Integrating MS Windows networks with Samba
    17.1. 19.1. Name Resolution in a pure Unix/Linux world
    17.2. 19.2. Name resolution as used within MS Windows networking
    18. 20. Improved browsing in samba
    18.1. 20.1. Overview of browsing
    18.2. 20.2. Browsing support in samba
    18.3. 20.3. Problem resolution
    18.4. 20.4. Browsing across subnets
    18.5. 20.5. Setting up a WINS server
    18.6. 20.6. Setting up Browsing in a WORKGROUP
    18.7. 20.7. Setting up Browsing in a DOMAIN
    18.8. 20.8. Forcing samba to be the master
    18.9. 20.9. Making samba the domain master
    18.10. 20.10. Note about broadcast addresses
    18.11. 20.11. Multiple interfaces
    19. 21. Hosting a Microsoft Distributed File System tree on Samba
    19.1. 21.1. Instructions
    20. 22. Stackable VFS modules
    20.1. 22.1. Introduction and configuration
    20.2. 22.2. Included modules
    20.3. 22.3. VFS modules available elsewhere
    21. 23. Securing Samba
    21.1. 23.1. Introduction
    21.2. 23.2. Using host based protection
    21.3. 23.3. Using interface protection
    21.4. 23.4. Using a firewall
    21.5. 23.5. Using a IPC$ share deny
    21.6. 23.6. Upgrading Samba
    22. 24. Unicode/Charsets
    22.1. 24.1. What are charsets and unicode?
    22.2. 24.2. Samba and charsets
    23. 25. Samba performance issues
    23.1. 25.1. Comparisons
    23.2. 25.2. Socket options
    23.3. 25.3. Read size
    23.4. 25.4. Max xmit
    23.5. 25.5. Log level
    23.6. 25.6. Read raw
    23.7. 25.7. Write raw
    23.8. 25.8. Slow Clients
    23.9. 25.9. Slow Logins
    23.10. 25.10. Client tuning
    24. 26. Portability
    24.1. 26.1. HPUX
    24.2. 26.2. SCO Unix
    24.3. 26.3. DNIX
    24.4. 26.4. RedHat Linux Rembrandt-II
    24.5. 26.5. AIX
    25. 27. Samba and other CIFS clients
    25.1. 27.1. Macintosh clients?
    25.2. 27.2. OS2 Client
    25.3. 27.3. Windows for Workgroups
    25.4. 27.4. Windows '95/'98
    25.5. 27.5. Windows 2000 Service Pack 2
    26. 28. How to compile SAMBA
    26.1. 28.1. Access Samba source code via CVS
    26.2. 28.2. Accessing the samba sources via rsync and ftp
    26.3. 28.3. Building the Binaries
    26.4. 28.4. Starting the smbd and nmbd
    27. 29. Reporting Bugs
    27.1. 29.1. Introduction
    27.2. 29.2. General info
    27.3. 29.3. Debug levels
    27.4. 29.4. Internal errors
    27.5. 29.5. Attaching to a running process
    27.6. 29.6. Patches
    28. 30. The samba checklist
    28.1. 30.1. Introduction
    28.2. 30.2. Assumptions
    28.3. 30.3. Tests
    28.4. 30.4. Still having troubles?
    3.7.1. Building
    3.7.2. Creating the database
    3.7.3. 3.7.2. Configuring
    3.7.4. 3.7.3. Using plaintext passwords or encrypted password
    3.7.5. 3.7.4. Getting non-column data from the table
    3.8. Passdb XML plugin
    3.8.1. Building
    3.8.2. UsageXML
    3.7.1. Building

    To build the plugin, run make bin/pdb_mysql.so -in the source/ directory of samba distribution.

    Next, copy pdb_mysql.so to any location you want. I -strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/

    3.7.2. Creating the database3.7.1. Creating the database

    You either can set up your own table and specify the field names to pdb_mysql (see below @@ -3492,8 +3475,8 @@ CLASS="SECT2" >

    3.7.3. Configuring3.7.2. Configuring

    This plugin lacks some good documentation, but here is some short info:

    : 
    passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins]
    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    The identifier can be any string you like, as long as it doesn't collide with @@ -3603,8 +3586,8 @@ CLASS="SECT2" >

    3.7.4. Using plaintext passwords or encrypted password3.7.3. Using plaintext passwords or encrypted password

    I strongly discourage the use of plaintext passwords, however, you can use them:

    3.7.5. Getting non-column data from the table3.7.4. Getting non-column data from the table

    It is possible to have not all data in the database and making some 'constant'.

    3.8. Passdb XML plugin3.8. XML

    3.8.1. Building

    This module requires libxml2 to be installed.

    To build pdb_xml, run: make bin/pdb_xml.so in -the directory source/.

    3.8.2. Usage

    The usage of pdb_xml is pretty straightforward. To export data, use: pdbedit -e plugin:/usr/lib/samba/pdb_xml.so:filenamepdbedit -e xml:filename (where filename is the name of the file to put the data in)

    To import data, use: pdbedit -i plugin:/usr/lib/samba/pdb_xml.so:filename -e current-pdbpdbedit -i xml:filename -e current-pdb     Where filename is the name to read the data from and current-pdb to put it in.

    Introduction

    4.1. Stand Alone Server
    4.2. Domain Member Server
    4.3. Domain Controller
    4.3.1. Domain Controller Types
    5.1. User and Share security level
    5.1.1. User Level Security
    5.1.2. Share Level Security
    5.1.3. Server Level Security
    5.1.4. Domain Level Security
    5.1.5. ADS Level Security
    6.1. Prerequisite Reading
    6.2. Background
    6.3. Configuring the Samba Domain Controller
    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain
    6.4.1. Manual Creation of Machine Trust Accounts
    6.4.2. "On-the-Fly" Creation of Machine Trust Accounts
    6.4.3. Joining the Client to the Domain
    6.5. Common Problems and Errors
    6.6. What other help can I get?
    6.7. Domain Control for Windows 9x/ME
    6.7.1. Configuration Instructions: Network Logons
    7.1. Prerequisite Reading
    7.2. Background
    7.3. What qualifies a Domain Controller on the network?
    7.3.1. How does a Workstation find its domain controller?
    7.3.2. When is the PDC needed?
    7.4. Can Samba be a Backup Domain Controller to an NT PDC?
    7.5. How do I set up a Samba BDC?
    7.5.1. How do I replicate the smbpasswd file?
    7.5.2. Can I do this all with LDAP?
    8.1. Setup your smb.conf
    8.2. Setup your /etc/krb5.conf
    8.3. Create the computer account
    8.3.1. Possible errors
    8.4. Test your server setup
    8.5. Testing with smbclient
    8.6. Notes
    9.1. Joining an NT Domain with Samba 3.0
    9.2. Why is this better than security = server?

    4.1. Stand Alone Server

    4.2. Domain Member Server

    4.3. Domain Controller

    4.3.1. Domain Controller Types

    5.1. User and Share security level

    5.1.1. User Level Security

    5.1.2. Share Level Security

    5.1.3. Server Level Security

    5.1.3.1. Configuring Samba for Seemless Windows Network Integration

    5.1.3.2. Use MS Windows NT as an authentication server

    5.1.4. Domain Level Security

    5.1.4.1. Samba as a member of an MS Windows NT security domain

    5.1.5. ADS Level Security

    6.1. Prerequisite Reading

    6.2. Background

    6.3. Configuring the Samba Domain Controller

    6.4. Creating Machine Trust Accounts and Joining Clients to the Domain

    6.4.1. Manual Creation of Machine Trust Accounts

    6.4.2. "On-the-Fly" Creation of Machine Trust Accounts

    6.4.3. Joining the Client to the Domain

    6.5. Common Problems and Errors

    6.6. What other help can I get?

    6.7. Domain Control for Windows 9x/ME

    6.7.1. Configuration Instructions: Network Logons

    7.1. Prerequisite Reading

    7.2. Background

    7.3. What qualifies a Domain Controller on the network?

    7.3.1. How does a Workstation find its domain controller?

    7.3.2. When is the PDC needed?

    7.4. Can Samba be a Backup Domain Controller to an NT PDC?

    7.5. How do I set up a Samba BDC?

    7.5.1. How do I replicate the smbpasswd file?

    7.5.2. Can I do this all with LDAP?

    8.1. Setup your smb.conf

    8.2. Setup your /etc/krb5.conf

    8.3. Create the computer account

    8.3.1. Possible errors

    8.4. Test your server setup

    8.5. Testing with smbclient

    8.6. Notes

    9.1. Joining an NT Domain with Samba 3.0

    9.2. Why is this better than security = server?

    Introduction

    10. System PoliciesAdvanced Network Manangement Information
    10.1. Basic System Policy Info
    10.1.1. Creating Group Prolicy Files
    10.2. Roaming Profiles
    10.2.1. Windows NT Configuration
    10.2.2. Windows 9X Configuration
    10.2.3. Win9X and WinNT Configuration
    10.2.4. Windows 9X Profile Setup
    10.2.5. Windows NT Workstation 4.0
    10.2.6. Windows NT/200x ServerRemote Server Administration
    10.2.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    10.2.8. Windows NT 4
    10.2.9. Windows 2000/XP
    11.1. Viewing and changing UNIX permissions using the NT security dialogs
    11.2. How to view file security on a Samba share
    11.3. Viewing file ownership
    11.4. Viewing file or directory permissions
    11.4.1. File Permissions
    11.4.2. Directory Permissions
    11.5. Modifying file or directory permissions
    11.6. Interaction with the standard Samba create mask parameters
    11.7. Interaction with the standard Samba file attribute mapping
    13.1. Samba and PAM
    13.2. Distributed Authentication
    13.3. PAM Configuration in smb.conf
    14.1. Introduction
    14.2. Configuration
    14.2.1. Creating [print$]
    14.2.2. Setting Drivers for Existing Printers
    14.2.3. Support a large number of printers
    14.2.4. Adding New Printers via the Windows NT APW
    14.2.5. Samba and Printer Ports
    14.3. The Imprints Toolset
    14.3.1. What is Imprints?
    14.3.2. Creating Printer Driver Packages
    14.3.3. The Imprints server
    14.3.4. The Installation Client
    14.4. Diagnosis
    14.4.1. Introduction
    14.4.2. Debugging printer problems
    14.4.3. What printers do I have?
    14.4.4. Setting up printcap and print servers
    14.4.5. Job sent, no output
    14.4.6. Job sent, strange output
    14.4.7. Raw PostScript printed
    14.4.8. Advanced Printing
    14.4.9. Real debugging
    15.1. Introduction
    15.2. CUPS - RAW Print Through Mode
    15.3. The CUPS Filter Chains
    15.4. CUPS Print Drivers and Devices
    15.4.1. Further printing steps
    15.5. Limiting the number of pages users can print
    15.6. Advanced Postscript Printing from MS Windows
    15.7. Auto-Deletion of CUPS spool files
    16.1. Abstract
    16.2. Introduction
    16.3. What Winbind Provides
    16.3.1. Target Uses
    16.4. How Winbind Works
    16.4.1. Microsoft Remote Procedure Calls
    16.4.2. Microsoft Active Directory Services
    16.4.3. Name Service Switch
    16.4.4. Pluggable Authentication Modules
    16.4.5. User and Group ID Allocation
    16.4.6. Result Caching
    16.5. Installation and Configuration
    16.5.1. Introduction
    16.5.2. Requirements
    16.5.3. Testing Things Out
    16.6. Limitations
    16.7. Conclusion
    17. Integrating MS Windows networks with SambaPolicy Management - Hows and Whys
    17.1. Name Resolution in a pure Unix/Linux worldSystem Policies
    17.1.1. /etc/hostsCreating and Managing Windows 9x/Me Policies
    17.1.2. /etc/resolv.confCreating and Managing Windows NT4 Style Policy Files
    17.1.3. Creating and Managing MS Windows 200x Policies
    18. Profile Management
    18.1. Roaming Profiles
    18.1.1. Windows NT Configuration
    18.1.2. Windows 9X Configuration
    18.1.3. Win9X and WinNT Configuration
    18.1.4. Windows 9X Profile Setup
    18.1.5. Windows NT Workstation 4.0
    18.1.6. Windows NT/200x Server
    18.1.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    18.1.8. Windows NT 4
    18.1.9. Windows 2000/XP
    19. Integrating MS Windows networks with Samba
    19.1. Name Resolution in a pure Unix/Linux world
    19.1.1. /etc/hosts
    19.1.2. /etc/resolv.conf
    19.1.3. /etc/host.conf
    17.1.4. 19.1.4. /etc/nsswitch.conf
    17.2. 19.2. Name resolution as used within MS Windows networking
    17.2.1. 19.2.1. The NetBIOS Name Cache
    17.2.2. 19.2.2. The LMHOSTS file
    17.2.3. 19.2.3. HOSTS file
    17.2.4. 19.2.4. DNS Lookup
    17.2.5. 19.2.5. WINS Lookup
    18. 20. Improved browsing in samba
    18.1. 20.1. Overview of browsing
    18.2. 20.2. Browsing support in samba
    18.3. 20.3. Problem resolution
    18.4. 20.4. Browsing across subnets
    18.4.1. 20.4.1. How does cross subnet browsing work ?
    18.5. 20.5. Setting up a WINS server
    18.6. 20.6. Setting up Browsing in a WORKGROUP
    18.7. 20.7. Setting up Browsing in a DOMAIN
    18.8. 20.8. Forcing samba to be the master
    18.9. 20.9. Making samba the domain master
    18.10. 20.10. Note about broadcast addresses
    18.11. 20.11. Multiple interfaces
    19. 21. Hosting a Microsoft Distributed File System tree on Samba
    19.1. 21.1. Instructions
    19.1.1. 21.1.1. Notes
    20. 22. Stackable VFS modules
    20.1. 22.1. Introduction and configuration
    20.2. 22.2. Included modules
    20.2.1. 22.2.1. audit
    20.2.2. 22.2.2. recycle
    20.2.3. 22.2.3. netatalk
    20.3. 22.3. VFS modules available elsewhere
    20.3.1. 22.3.1. DatabaseFS
    20.3.2. 22.3.2. vscan
    21. 23. Securing Samba
    21.1. 23.1. Introduction
    21.2. 23.2. Using host based protection
    21.3. 23.3. Using interface protection
    21.4. 23.4. Using a firewall
    21.5. 23.5. Using a IPC$ share deny
    21.6. 23.6. Upgrading Samba
    22. 24. Unicode/Charsets
    22.1. 24.1. What are charsets and unicode?
    22.2. 24.2. Samba and charsets
    Chapter 10. System PoliciesChapter 10. Advanced Network Manangement Information

    10.1. Basic System Policy Info10.1. Remote Server Administration

    Much of the information necessary to implement System Policies and -Roaming User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft.

    Here are some additional details:

    • What about Windows NT Policy Editor? -

      To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. -

      The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. -

    • Can Win95 do Policies? -

      Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... -

      If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. -

    • How do I get 'User Manager' and 'Server Manager' -

      Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? -

      Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', +the 'Server Manager'?

      Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes -

      Microsoft distributes a version of these tools called nexus for installation on Windows 95 +systems. The tools set includes:

        Click here to download the archived file Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

        The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

      10.1.1. Creating Group Prolicy Files

      Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists

      10.1.1.1. Windows '9x

      You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -tools/reskit/netadmin/poledit. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab.

      Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the My Documents etc. -stuff. You then save these settings in a file called -Config.POL that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on.

      11.1. Viewing and changing UNIX permissions using the NT + security dialogs

      All of this is covered in the Win98 Resource Kit documentation.

      Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions.

      If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings.

      Note that this ability is careful not to compromise + the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba + administrator can set.

      10.2. Roaming Profiles11.2. How to view file security on a Samba share

      From an NT4/2000/XP client, single-click with the right + mouse button on any file or directory in a Samba mounted + drive letter or UNC path. When the menu pops-up, click + on the NOTE!Properties Roaming profiles support is different for Win9X and WinNT.

      entry at the bottom of + the menu. This brings up the file properties dialog + box. Click on the tab Security and you + will see three buttons, Permissions, + Auditing, and Ownership. + The Auditing button will cause either + an error message A requested privilege is not held + by the client to appear if the user is not the + NT Administrator, or a dialog which is intended to allow an + Administrator to add auditing requirements to a file if the + user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only + useful button, the Add button will not currently + allow a list of users to be seen.

      Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features.

      Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory.

      WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT.

      10.2.1. Windows NT Configuration

      11.3. Viewing file ownership

      To support WinNT clients, in the [global] section of smb.conf set the -following (for example):

      Clicking on the "Ownership" button + brings up a dialog box telling you who owns the given file. The + owner name will be of the form :

      logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
      "SERVER\user (Long name)"

      The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable.

      Where SERVER is the NetBIOS name of + the Samba server, user is the user name of + the UNIX user who owns the file, and (Long name) + is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database). Click on the Close + button to remove this dialog.

      If the parameter nt acl support + is set to false then the file owner will + be shown as the NT user "Everyone".

      MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the The Take Ownership button will not allow + you to change the ownership of this file to yourself (clicking on + it will display a dialog box complaining that the user you are + currently logged onto the NT client cannot be found). The reason + for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the homesroot -meta-service name as part of the profile share path.

      10.2.2. Windows 9X Configuration

      To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use /home" now works as well, and it, too, relies -on the "logon home" parameter.

      By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file:

      logon home = \\%L\%U\.profiles

      then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden).

      + user. As clicking on this button causes NT to attempt to change + the ownership of a file to the current user logged into the NT + client this will not work with Samba at this time.

      Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home".

      There is an NT chown command that will work with Samba + and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of + files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib + NT security library written by Jeremy Allison of + the Samba Team, available from the main Samba ftp site.

      10.2.3. Win9X and WinNT Configuration

      11.4. Viewing file or directory permissions

      You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example:

      The third button is the "Permissions" + button. Clicking on this brings up a dialog box that shows both + the permissions and the UNIX owner of the file or directory. + The owner is displayed in the form :

      logon home = \\%L\%U\.profiles
-logon path = \\%L\profiles\%U
      "SERVER\user (Long name)"

      Where SERVER is the NetBIOS name of + the Samba server, user is the user name of + the UNIX user who owns the file, and (Long name) + is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database).

      I have not checked what 'net use /home' does on NT when "logon home" is -set as above.

      If the parameter nt acl support + is set to false then the file owner will + be shown as the NT user "Everyone" and the + permissions will be shown as NT "Full Control".

      The permissions field is displayed differently for files + and directories, so I'll describe the way file permissions + are displayed first.

      10.2.4. Windows 9X Profile Setup11.4.1. File Permissions

      When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.

      The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.

      1. On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

      2. On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. -

      Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me.

      You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.

      Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.

      Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.

      These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.

      If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.

      If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".

      1. instead of logging in under the [user, password, domain] dialog, - press escape. -

      2. run the regedit.exe program, and look in: -

        HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

        you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. -

        [Exit the registry editor]. -

      3. WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). -

        This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

      4. search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

      5. log off the windows 95 client. -

      6. check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

      The standard UNIX user/group/world triple and + the corresponding "read", "write", "execute" permissions + triples are mapped by Samba into a three element NT ACL + with the 'r', 'w', and 'x' bits mapped into the corresponding + NT permissions. The UNIX world permissions are mapped into + the global NT group Everyone, followed + by the list of permissions allowed for UNIX world. The UNIX + owner and group permissions are displayed as an NT + user icon and an NT local + group icon respectively followed by the list + of permissions allowed for the UNIX user and group.

      If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports.

      As many UNIX permission sets don't map into common + NT names such as "read", "change" or "full control" then + usually the permissions will be prefixed by the words "Special Access" in the NT display list.

      If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace.

      But what happens if the file has no permissions allowed + for a particular UNIX user group or world component ? In order + to allow "no permissions" to be seen and modified then Samba + overloads the NT "Take Ownership" ACL attribute + (which has no meaning in UNIX) and reports a component with + no permissions as having the NT "O" bit set. + This was chosen of course to make it look like a zero, meaning + zero permissions. More details on the decision behind this will + be given below.

      10.2.5. Windows NT Workstation 4.011.4.2. Directory Permissions

      When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.

      There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter.

      The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.)

      Directories on an NT NTFS file system have two + different sets of permissions. The first set of permissions + is the ACL set on the directory itself, this is usually displayed + in the first set of parentheses in the normal "RW" + NT style. This first set of permissions is created by Samba in + exactly the same way as normal file permissions are, described + above, and is displayed in the same way.

      In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.

      The second set of directory permissions has no real meaning + in the UNIX permissions world and represents the "inherited" permissions that any file created within + this directory would inherit.

      You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.

      The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN.

      Samba synthesises these inherited permissions for NT by + returning as an NT ACL the UNIX permission mode that a new file + created by Samba on this share would receive.

      10.2.6. Windows NT/200x Server

      There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.

      10.2.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations

      11.5. Modifying file or directory permissions

      Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows.

      Modifying file and directory permissions is as simple + as changing the displayed permissions in the dialog box, and + clicking the OK button. However, there are + limitations that a user needs to be aware of, and also interactions + with the standard Samba permission masks and mapping of DOS + attributes that need to also be taken into account.

      If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon homeIf the parameter nt acl support + is set to false then any attempt to set + security permissions will fail with an "Access Denied" + message.

      The first thing to note is that the "Add" + button will not return a list of users in Samba (it will give + an error message of "The remote procedure call failed + and did not execute"). This means that you can only + manipulate the current user/group/world permissions listed in + the dialog box. This actually works quite well as these are the + only permissions that UNIX actually has.

      If a permission triple (either user, group, or world) + is removed from the list of permissions in the NT dialog box, + then when the "OK" button is pressed it will + be applied as "no permissions" on the UNIX side. If you then + view the permissions again the "no permissions" entry will appear + as the NT "O" flag, as described above. This + allows you to add permissions back to a file or directory once + you have removed them from a triple component.

      As UNIX supports only the "r", "w" and "x" bits of + an NT ACL then if other NT security attributes such as "Delete + access" are selected then they will be ignored when applied on + the Samba server.

      When setting permissions on a directory the second + set of permissions (in the second set of parentheses) is + by default applied to all files within that directory. If this + is not what you want you must uncheck the "Replace + permissions on existing files" checkbox in the NT + dialog before clicking "OK".

      If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.

      If you wish to remove all permissions from a + user/group/world component then you may either highlight the + component and click the "Remove" button, + or set the component to only have the special "Take + Ownership" permission (displayed as "O" + ) highlighted.

      10.2.8. Windows NT 4

      Unfortunately, the Resource Kit info is Win NT4 or 200x specific.

      11.6. Interaction with the standard Samba create mask + parameters

      Here is a quick guide:

      There are four parameters + to control interaction with the standard Samba create mask parameters. + These are :

      security mask

      • On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'.

      • Select a user profile you want to migrate and click on it.

        force security mode

        I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

      • Click the 'Copy To' button.

      • In the box labelled 'Copy Profile to' add your new path, eg: -c:\temp\foobardirectory security mask

      • Click on the button labelled 'Change' in the "Permitted to use" box.

      • force directory security mode

        Click on the group 'Everyone' and then click OK. This closes the -'chose user' box.

      • Once a user clicks "OK" to apply the + permissions Samba maps the given permissions into a user/group/world + r/w/x triple set, and then will check the changed permissions for a + file against the bits set in the + security mask parameter. Any bits that + were changed that are not set to '1' in this parameter are left alone + in the file permissions.

        Now click OK.

      Essentially, zero bits in the security mask + mask may be treated as a set of bits the user is not + allowed to change, and one bits are those the user is allowed to change. +

      Follow the above for every profile you need to migrate.

      10.2.8.1. Side bar Notes

      If not set explicitly this parameter is set to the same value as + the create mask + parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter + to 0777.

      You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

      Next Samba checks the changed permissions for a file against + the bits set in the force security mode parameter. Any bits + that were changed that correspond to bits set to '1' in this parameter + are forced to be set.

      With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users.

      10.2.8.2. Mandatory profiles

      Essentially, bits set in the force security mode + parameter may be treated as a set of bits that, when + modifying security on a file, the user has always set to be 'on'.

      The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN.

      10.2.8.3. moveuser.exe

      If not set explicitly this parameter is set to the same value + as the force + create mode parameter. + To allow a user to modify all the user/group/world permissions on a file + with no restrictions set this parameter to 000.

      The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change.

      The security mask and force + security mode parameters are applied to the change + request in that order.

      For a directory Samba will perform the same operations as + described above for a file except using the parameter directory security mask instead of security + mask, and force directory security mode + parameter instead of force security mode + .

      The directory security mask parameter + by default is set to the same value as the directory mask + parameter and the force directory security + mode parameter by default is set to the same value as + the force directory mode parameter.

      In this way Samba enforces the permission restrictions that + an administrator can set on a Samba share, whilst still allowing users + to modify the permission bits within that restriction.

      If you want to set up a share that allows users full control + in modifying the permission bits on their files and directories and + doesn't force any particular bits to be set 'on', then set the following + parameters in the smb.conf(5) + file in that share specific section :

      security mask = 0777

      force security mode = 0

      directory security mask = 0777

      force directory security mode = 0

      10.2.8.4. Get SID

      11.7. Interaction with the standard Samba file attribute + mapping

      You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit.

      Samba maps some of the DOS attribute bits (such as "read + only") into the UNIX permissions of a file. This means there can + be a conflict between the permission bits set via the security + dialog and the permission bits set by the file attribute mapping. +

      Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

      One way this can show up is if a file has no UNIX read access + for the owner it will show up as "read only" in the standard + file attributes tabbed dialog. Unfortunately this dialog is + the same one that contains the security info in another tab.

      Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath.

      What this can mean is that if the owner changes the permissions + to allow themselves read access using the security dialog, clicks + "OK" to get back to the standard attributes tab + dialog, and then clicks "OK" on that dialog, then + NT will set the file permissions back to read-only (as that is what + the attributes still say in the dialog). This means that after setting + permissions and clicking "OK" to get back to the + attributes dialog you should always hit "Cancel" + rather than "OK" to ensure that your changes + are not overridden.

      10.2.9. Windows 2000/XP

      Chapter 12. Group mapping HOWTO

      You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows:

      +Starting with Samba 3.0 alpha 2, a new group mapping function is available. The +current method (likely to change) to manage the groups is a new command called +smbgroupedit.

      • The first immediate reason to use the group mapping on a PDC, is that +the domain admin group of smb.conf is +now gone. This parameter was used to give the listed users local admin rights +on their workstations. It was some magic stuff that simply worked but didn't +scale very well for complex setups.

        Log on as the LOCAL workstation administrator.

      • Let me explain how it works on NT/W2K, to have this magic fade away. +When installing NT/W2K on a computer, the installer program creates some users +and groups. Notably the 'Administrators' group, and gives to that group some +privileges like the ability to change the date and time or to kill any process +(or close too) running on the local machine. The 'Administrator' user is a +member of the 'Administrators' group, and thus 'inherit' the 'Administrators' +group privileges. If a 'joe' user is created and become a member of the +'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

        Right click on the 'My Computer' Icon, select 'Properties'

      • When a NT/W2K machine is joined to a domain, during that phase, the "Domain +Administrators' group of the PDC is added to the 'Administrators' group of the +workstation. Every members of the 'Domain Administrators' group 'inherit' the +rights of the 'Administrators' group when logging on the workstation.

        Click on the 'User Profiles' tab

      • You are now wondering how to make some of your samba PDC users members of the +'Domain Administrators' ? That's really easy.

        Select the profile you wish to convert (click on it once)

        1. Click on the button 'Copy To'

          create a unix group (usually in /etc/group), let's call it domadm

        2. In the "Permitted to use" box, click on the 'Change' button.

          add to this group the users that must be Administrators. For example if you want joe,john and mary, your entry in /etc/group will look like:

          domadm:x:502:joe,john,mary

        3. Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible.

          Map this domadm group to the domain admins group by running the command:

          smbgroupedit -c "Domain Admins" -u domadm

          You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword.

        To make the profile capable of being used by anyone select 'Everyone'

      • You're set, joe, john and mary are domain administrators !

        Click OK. The Selection box will close.

      • Like the Domain Admins group, you can map any arbitrary Unix group to any NT +group. You can also make any Unix group a domain group. For example, on a domain +member machine (an NT/W2K or a samba server running winbind), you would like to +give access to a certain directory to some users who are member of a group on +your samba PDC. Flag that group as a domain group by running:

        Now click on the 'Ok' button to create the profile in the path you -nominated.

      smbgroupedit -a unixgroup -td

      Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool.

      You can list the various groups in the mapping database like this

      smbgroupedit -v

      Chapter 13. Configuring PAM for distributed but centrally +managed authentication

      13.1. Samba and PAM

      A number of Unix systems (eg: Sun Solaris), as well as the +xxxxBSD family and Linux, now utilize the Pluggable Authentication +Modules (PAM) facility to provide all authentication, +authorization and resource control services. Prior to the +introduction of PAM, a decision to use an alternative to +the system password database (/etc/passwd) +would require the provision of alternatives for all programs that provide +security services. Such a choice would involve provision of +alternatives to such programs as: login, +passwd, chown, etc.

      PAM provides a mechanism that disconnects these security programs +from the underlying authentication/authorization infrastructure. +PAM is configured either through one file /etc/pam.conf (Solaris), +or by editing individual files that are located in /etc/pam.d.

      Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable.

      If the PAM authentication module (loadable link library file) is located in the + default location then it is not necessary to specify the path. In the case of + Linux, the default location is /lib/security. If the module + is located other than default then the path may be specified as: + + 
      	eg: "auth       required      /other_path/pam_strange_module.so"
+
      +

      NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce* -"raw" printing, it only *allows* it.

      Till Kamppeter from MandrakeSoft is doing an excellent job here that too few +people are aware of. (So if you use it often, please send him a note showing +your appreciation).

      The following is an example /etc/pam.d/login configuration file. +This example had all options been uncommented is probably not usable +as it stacks many conditions before allowing successful completion +of the login process. Essentially all conditions can be disabled +by commenting them out except the calls to pam_pwdb.so.

      	#%PAM-1.0
+	# The PAM configuration file for the `login' service
+	#
+	auth 		required	pam_securetty.so
+	auth 		required	pam_nologin.so
+	# auth 		required	pam_dialup.so
+	# auth 		optional	pam_mail.so
+	auth		required	pam_pwdb.so shadow md5
+	# account    	requisite  	pam_time.so
+	account		required	pam_pwdb.so
+	session		required	pam_pwdb.so
+	# session 	optional	pam_lastlog.so
+	# password   	required   	pam_cracklib.so retry=3
+	password	required	pam_pwdb.so shadow md5

      • This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

        "Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"

        ...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this.

        If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy):

      • On the XP workstation log in with an Administrator account.

      • Click: "Start", "Run"

      • Type: "mmc"

      • Click: "OK"

      • PAM allows use of replacable modules. Those available on a +sample system include:

        A Microsoft Management Console should appear.

      • 	$ /bin/ls /lib/security
+	pam_access.so    pam_ftp.so          pam_limits.so     
+	pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
+	pam_cracklib.so  pam_group.so        pam_listfile.so   
+	pam_nologin.so   pam_rootok.so       pam_tally.so      
+	pam_deny.so      pam_issue.so        pam_mail.so       
+	pam_permit.so    pam_securetty.so    pam_time.so       
+	pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
+	pam_pwdb.so      pam_shells.so       pam_unix.so       
+	pam_env.so       pam_ldap.so         pam_motd.so       
+	pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
+	pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
+	pam_userdb.so    pam_warn.so         pam_unix_session.so

        Click: File, "Add/Remove Snap-in...", "Add"

      • Double-Click: "Group Policy"

      • Click: "Finish", "Close"

      • Click: "OK"

      • In the "Console Root" window:

      • Expand: "Local Computer Policy", "Computer Configuration",

      • The following example for the login program replaces the use of +the pam_pwdb.so module which uses the system +password database (/etc/passwd, +/etc/shadow, /etc/group) with +the module pam_smbpass.so which uses the Samba +database which contains the Microsoft MD4 encrypted password +hashes. This database is stored in either +/usr/local/samba/private/smbpasswd, +/etc/samba/smbpasswd, or in +/etc/samba.d/smbpasswd, depending on the +Samba implementation for your Unix/Linux system. The +pam_smbpass.so module is provided by +Samba version 2.2.1 or later. It can be compiled by specifying the +--with-pam_smbpass options when running Samba's +configure script. For more information +on the pam_smbpass module, see the documentation +in the source/pam_smbpass directory of the Samba +source distribution.

        "Administrative Templates", "System", "User Profiles"

      • 	#%PAM-1.0
+	# The PAM configuration file for the `login' service
+	#
+	auth		required	pam_smbpass.so nodelay
+	account		required	pam_smbpass.so nodelay
+	session		required	pam_smbpass.so nodelay
+	password	required	pam_smbpass.so nodelay

        Double-Click: "Do not check for user ownership of Roaming Profile

      • The following is the PAM configuration file for a particular +Linux system. The default condition uses pam_pwdb.so.

        Folders"

      • 	#%PAM-1.0
+	# The PAM configuration file for the `samba' service
+	#
+	auth       required     /lib/security/pam_pwdb.so nullok nodelay shadow audit
+	account    required     /lib/security/pam_pwdb.so audit nodelay
+	session    required     /lib/security/pam_pwdb.so nodelay
+	password   required     /lib/security/pam_pwdb.so shadow md5

        Select: "Enabled"

      • In the following example the decision has been made to use the +smbpasswd database even for basic samba authentication. Such a +decision could also be made for the passwd program and would +thus allow the smbpasswd passwords to be changed using the passwd +program.

        Click: OK"

      • 	#%PAM-1.0
+	# The PAM configuration file for the `samba' service
+	#
+	auth       required     /lib/security/pam_smbpass.so nodelay
+	account    required     /lib/security/pam_pwdb.so audit nodelay
+	session    required     /lib/security/pam_pwdb.so nodelay
+	password   required     /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf

        Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed).

      • Reboot

        PAM allows stacking of authentication mechanisms. It is +also possible to pass information obtained within one PAM module through +to the next module in the PAM stack. Please refer to the documentation for +your particular system implementation for details regarding the specific +capabilities of PAM in this environment. Some Linux implmentations also +provide the pam_stack.so module that allows all +authentication to be configured in a single central file. The +pam_stack.so method has some very devoted followers +on the basis that it allows for easier administration. As with all issues in +life though, every decision makes trade-offs, so you may want examine the +PAM documentation for further helpful information.

        13.2. Distributed Authentication

        The astute administrator will realize from this that the +combination of pam_smbpass.so, +winbindd, and a distributed +passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed +user/password database that can also be used by all +PAM (eg: Linux) aware programs and applications. This arrangement +can have particularly potent advantages compared with the +use of Microsoft Active Directory Service (ADS) in so far as +reduction of wide area network authentication traffic.

        13.3. PAM Configuration in smb.conf

        There is an option in smb.conf called obey pam restrictions. +The following is from the on-line help for this option in SWAT;

        When Samba is configured to enable PAM support (i.e. +--with-pam), this parameter will +control whether or not Samba should obey PAM's account +and session management directives. The default behavior +is to use PAM for clear text authentication only and to +ignore any account or session management. Note that Samba always +ignores PAM for authentication in the case of +encrypt passwords = yes. +The reason is that PAM modules cannot support the challenge/response +authentication mechanism needed in the presence of SMB +password encryption.

        Default: obey pam restrictions = no

        Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists

        Chapter 14. Printing Support

        11.1. Viewing and changing UNIX permissions using the NT - security dialogs14.1. Introduction

        Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions.

        Beginning with the 2.2.0 release, Samba supports +the native Windows NT printing mechanisms implemented via +MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of +Samba only supported LanMan printing calls.

        Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.

        11.2. How to view file security on a Samba share

        From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

        11.3. Viewing file ownership

        Clicking on the "Ownership" button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

        The additional functionality provided by the new +SPOOLSS support includes:

        "SERVER\user (Long name)"

        • Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the Close - button to remove this dialog.

          Support for downloading printer driver + files to Windows 95/98/NT/2000 clients upon demand. +

        • If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

          Uploading of printer drivers via the + Windows NT Add Printer Wizard (APW) or the + Imprints tool set (refer to http://imprints.sourceforge.net). +

        • The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the rootSupport for the native MS-RPC printing + calls such as StartDocPrinter, EnumJobs(), etc... (See + the MSDN documentation at http://msdn.microsoft.com/ - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

        • There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Support for NT Access Control Lists (ACL) + on printer objects

        • Improved support for printer queue manipulation + through the use of an internal databases for spooled job + information

        There has been some initial confusion about what all this means +and whether or not it is a requirement for printer drivers to be +installed on a Samba host in order to support printing from Windows +clients. As a side note, Samba does not use these drivers in any way to process +spooled files. They are utilized entirely by the clients.

        The following MS KB article, may be of some help if you are dealing with +Windows 2000 clients: Seclib - How to Add Printers with No User +Interaction in Windows 2000 NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

        http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP

        11.4. Viewing file or directory permissions14.2. Configuration

        The third button is the "Permissions" - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

        "SERVER\user (Long name)"

        [print$] vs. [printer$]
         

        Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).

        Previous versions of Samba recommended using a share named [printer$]. +This name was taken from the printer$ service created by Windows 9x +clients when a printer was shared. Windows 9x printer servers always have +a printer$ service which provides read-only access via no +password in order to support printer driver downloads.

        If the parameter However, the initial implementation allowed for a +parameter named nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

        The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

        printer driver location +to be used on a per share basis to specify the location of +the driver files associated with that printer. Another +parameter named printer driver provided +a means of defining the printer driver name to be sent to +the client.

        11.4.1. File Permissions14.2.1. Creating [print$]

        The standard UNIX user/group/world triple and - the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list - of permissions allowed for the UNIX user and group.

        In order to support the uploading of printer driver +files, you must first configure a file share named [print$]. +The name of this share is hard coded in Samba's internals so +the name is very important (print$ is the service used by +Windows NT print servers to provide support for printer driver +download).

        As many UNIX permission sets don't map into common - NT names such as "read", "change" or "full control" then - usually the permissions will be prefixed by the words "Special Access" in the NT display list.

        You should modify the server's smb.conf file to add the global +parameters and to create the +following file share (of course, some of the parameter values, +such as 'path' are arbitrary and should be replaced with +appropriate values for your site):

        But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.

        11.4.2. Directory Permissions

        [global]
+    ; members of the ntadmin group should be able
+    ; to add drivers and set printer properties
+    ; root is implicitly a 'printer admin'
+    printer admin = @ntadmin
+
+[print$]
+    path = /usr/local/samba/printers
+    guest ok = yes
+    browseable = yes
+    read only = yes
+    ; since this share is configured as read only, then we need
+    ; a 'write list'.  Check the file system permissions to make
+    ; sure this account can copy files to the share.  If this
+    ; is setup to a non-root account, then it should also exist
+    ; as a 'printer admin'
+    write list = @ntadmin,root

        Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.

        The write list is used to allow administrative +level user accounts to have write access in order to update files +on the share. See the smb.conf(5) +man page for more information on configuring file shares.

        The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the The requirement for "inherited" permissions that any file created within - this directory would inherit.

        Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

        guest +ok = yes depends upon how your +site is configured. If users will be guaranteed to have +an account on the Samba host, then this is a non-issue.

        11.5. Modifying file or directory permissions

        Modifying file and directory permissions is as simple - as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are - limitations that a user needs to be aware of, and also interactions - with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

        Author's Note
         

        If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an The non-issue is that if all your Windows NT users are guaranteed to be +authenticated by the Samba server (such as a domain member server and the NT +user has already been validated by the Domain Controller in +order to logon to the Windows NT console), then guest access +is not necessary. Of course, in a workgroup environment where +you just want to be able to print without worrying about +silly accounts and security, then configure the share for +guest access. You'll probably want to add "Access Denied" - message.

        map to guest = Bad User in the [global] section as well. Make sure +you understand what this parameter does before using it +though. --jerry

        The first thing to note is that the "Add" - button will not return a list of users in Samba (it will give - an error message of "The remote procedure call failed - and did not execute"). This means that you can only - manipulate the current user/group/world permissions listed in - the dialog box. This actually works quite well as these are the - only permissions that UNIX actually has.

        If a permission triple (either user, group, or world) - is removed from the list of permissions in the NT dialog box, - then when the "OK" button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This - allows you to add permissions back to a file or directory once - you have removed them from a triple component.

        As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.

        In order for a Windows NT print server to support +the downloading of driver files by multiple client architectures, +it must create subdirectories within the [print$] service +which correspond to each of the supported client architectures. +Samba follows this model as well.

        When setting permissions on a directory the second - set of permissions (in the second set of parentheses) is - by default applied to all files within that directory. If this - is not what you want you must uncheck the "Replace - permissions on existing files" checkbox in the NT - dialog before clicking "OK".

        Next create the directory tree below the [print$] share +for each architecture you wish to support.

        If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the "Remove" button, - or set the component to only have the special "Take - Ownership" permission (displayed as "O" - ) highlighted.

        [print$]-----
+        |-W32X86           ; "Windows NT x86"
+        |-WIN40            ; "Windows 95/98"
+        |-W32ALPHA         ; "Windows NT Alpha_AXP"
+        |-W32MIPS          ; "Windows NT R4000"
+        |-W32PPC           ; "Windows NT PowerPC"

        11.6. Interaction with the standard Samba create mask - parameters

        There are four parameters - to control interaction with the standard Samba create mask parameters. - These are :

        security mask

        ATTENTION! REQUIRED PERMISSIONS
         

        force security mode

        In order to currently add a new driver to you Samba host, +one of two conditions must hold true:

        directory security mask

        • force directory security mode

          The account used to connect to the Samba host + must have a uid of 0 (i.e. a root account)

        • Once a user clicks "OK" to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a - file against the bits set in the The account used to connect to the Samba host + must be a member of the - security maskprinter + admin parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.

          list.

        Essentially, zero bits in the Of course, the connected account must still possess access +to add files to the subdirectories beneath [print$]. Remember +that all file shares are set to 'read only' by default.

        Once you have created the required [print$] service and +associated subdirectories, simply log onto the Samba server using +a root (or security mask - mask may be treated as a set of bits the user is printer admin) account +from a Windows NT 4.0/2k client. Open "Network Neighbourhood" or +"My Network Places" and browse for the Samba host. Once you have located +the server, navigate to the "Printers..." folder. +You should see an initial listing of printers +that matches the printer shares defined on your Samba host.

        14.2.2. Setting Drivers for Existing Printers

        The initial listing of printers in the Samba host's +Printers folder will have no real printer driver assigned +to them. This defaults to a NULL string to allow the use +of the local Add Printer Wizard on NT/2000 clients. +Attempting to view the printer properties for a printer +which has this default driver assigned will result in +the error message:

        notDevice settings cannot be displayed. The driver +for the specified printer is not installed, only spooler +properties will be displayed. Do you want to install the +driver now? - allowed to change, and one bits are those the user is allowed to change. -

        If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777.

        Next Samba checks the changed permissions for a file against - the bits set in the force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.

        Click "No" in the error dialog and you will be presented with +the printer properties window. The way to assign a driver to a +printer is to either

        Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.

        • If not set explicitly this parameter is set to the same value - as the force - create mode parameter. - To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

          Use the "New Driver..." button to install + a new printer driver, or

        • The security mask and force - security mode parameters are applied to the change - request in that order.

          For a directory Samba will perform the same operations as - described above for a file except using the parameter directory security mask instead of security - mask, and force directory security mode - parameter instead of force security mode - .

          Select a driver from the popup list of + installed drivers. Initially this list will be empty.

        The directory security mask parameter - by default is set to the same value as the directory mask - parameter and the force directory security - mode parameter by default is set to the same value as - the force directory mode parameter.

        If you wish to install printer drivers for client +operating systems other than "Windows NT x86", you will need +to use the "Sharing" tab of the printer properties dialog.

        In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users - to modify the permission bits within that restriction.

        Assuming you have connected with a root account, you +will also be able modify other printer properties such as +ACLs and device settings using this dialog box.

        If you want to set up a share that allows users full control - in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the A few closing comments for this section, it is possible +on a Windows NT print server to have printers +listed in the Printers folder which are not shared. Samba does +not make this distinction. By definition, the only printers of +which Samba is aware are those which are specified as shares in +smb.conf(5) - file in that share specific section :

        security mask = 0777

        force security mode = 0

        directory security mask = 0777

        smb.conf.

        force directory security mode = 0

        Another interesting side note is that Windows NT clients do +not use the SMB printer share, but rather can print directly +to any printer on another Windows NT host using MS-RPC. This +of course assumes that the printing client has the necessary +privileges on the remote host serving the printer. The default +permissions assigned by Windows NT to a printer gives the "Print" +permissions to the "Everyone" well-known group.

        11.7. Interaction with the standard Samba file attribute - mapping

        Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can - be a conflict between the permission bits set via the security - dialog and the permission bits set by the file attribute mapping. -

        One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.

        14.2.3. Support a large number of printers

        What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks - "OK" to get back to the standard attributes tab - dialog, and then clicks "OK" on that dialog, then - NT will set the file permissions back to read-only (as that is what - the attributes still say in the dialog). This means that after setting - permissions and clicking "OK" to get back to the - attributes dialog you should always hit One issue that has arisen during the development +phase of Samba 2.2 is the need to support driver downloads for +100's of printers. Using the Windows NT APW is somewhat +awkward to say the list. If more than one printer are using the +same driver, the "Cancel"rpcclient's +setdriver command can be used to set the driver +associated with an installed driver. The following is example +of how this could be accomplished:

         
-	rather than "OK" to ensure that your changes 
-	are not overridden.
        $ rpcclient pogo -U root%secret -c "enumdrivers" +Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3] + +[Windows NT x86] +Printer Driver Info 1: + Driver Name: [HP LaserJet 4000 Series PS] + +Printer Driver Info 1: + Driver Name: [HP LaserJet 2100 Series PS] + +Printer Driver Info 1: + Driver Name: [HP LaserJet 4Si/4SiMX PS] + +$ rpcclient pogo -U root%secret -c "enumprinters" +Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3] + flags:[0x800000] + name:[\\POGO\hp-print] + description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,] + comment:[] + +$ rpcclient pogo -U root%secret \ +> -c "setdriver hp-print \"HP LaserJet 4000 Series PS\"" +Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3] +Successfully set hp-print to driver HP LaserJet 4000 Series PS.

        Chapter 12. Group mapping HOWTO

        -Starting with Samba 3.0 alpha 2, a new group mapping function is available. The -current method (likely to change) to manage the groups is a new command called -smbgroupedit.

        14.2.4. Adding New Printers via the Windows NT APW

        The first immediate reason to use the group mapping on a PDC, is that -the domain admin group of By default, Samba offers all printer shares defined in smb.conf is -now gone. This parameter was used to give the listed users local admin rights -on their workstations. It was some magic stuff that simply worked but didn't -scale very well for complex setups.

        Let me explain how it works on NT/W2K, to have this magic fade away. -When installing NT/W2K on a computer, the installer program creates some users -and groups. Notably the 'Administrators' group, and gives to that group some -privileges like the ability to change the date and time or to kill any process -(or close too) running on the local machine. The 'Administrator' user is a -member of the 'Administrators' group, and thus 'inherit' the 'Administrators' -group privileges. If a 'joe' user is created and become a member of the -'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

        When a NT/W2K machine is joined to a domain, during that phase, the "Domain -Administrators' group of the PDC is added to the 'Administrators' group of the -workstation. Every members of the 'Domain Administrators' group 'inherit' the -rights of the 'Administrators' group when logging on the workstation.

        You are now wondering how to make some of your samba PDC users members of the -'Domain Administrators' ? That's really easy.

        +in the "Printers..." folder. Also existing in this folder is the Windows NT +Add Printer Wizard icon. The APW will be show only if

          • create a unix group (usually in /etc/group), let's call it domadm

          • add to this group the users that must be Administrators. For example if you want joe,john and mary, your entry in /etc/group will look like:

            domadm:x:502:joe,john,mary

            The connected user is able to successfully + execute an OpenPrinterEx(\\server) with administrative + privileges (i.e. root or printer admin). +

          • Map this domadm group to the domain admins group by running the command:

            smbgroupedit -c "Domain Admins" -u domadm

            show + add printer wizard = yes (the default). +

        You're set, joe, john and mary are domain administrators !

      Like the Domain Admins group, you can map any arbitrary Unix group to any NT -group. You can also make any Unix group a domain group. For example, on a domain -member machine (an NT/W2K or a samba server running winbind), you would like to -give access to a certain directory to some users who are member of a group on -your samba PDC. Flag that group as a domain group by running:

      In order to be able to use the APW to successfully add a printer to a Samba +server, the add +printer command must have a defined value. The program +hook must successfully add the printer to the system (i.e. +/etc/printcap or appropriate files) and +smb.conf if necessary.

      When using the APW from a client, if the named printer share does +not exist, smbgroupedit -a unixgroup -td

      smbd will execute the add printer +command and reparse to the smb.conf +to attempt to locate the new printer share. If the share is still not defined, +an error of "Access Denied" is returned to the client. Note that the +add printer program is executed under the context +of the connected user, not necessarily a root account.

      You can list the various groups in the mapping database like this

      There is a complementary delete +printer command for removing entries from the "Printers..." +folder.

      smbgroupedit -v

      The following is an example add printer command script. It adds the appropriate entries to /etc/printcap.local (change that to what you need) and returns a line of 'Done' which is needed for the whole process to work.

      #!/bin/sh
+
+# Script to insert a new printer entry into printcap.local
+#
+# $1, printer name, used as the descriptive name
+# $2, share name, used as the printer name for Linux
+# $3, port name
+# $4, driver name
+# $5, location, used for the device file of the printer
+# $6, win9x location
+
+#
+# Make sure we use the location that RedHat uses for local printer defs
+PRINTCAP=/etc/printcap.local
+DATE=`date +%Y%m%d-%H%M%S`
+LP=lp
+RESTART="service lpd restart"
+
+# Keep a copy
+cp $PRINTCAP $PRINTCAP.$DATE
+# Add the printer to $PRINTCAP
+echo ""				 			>> $PRINTCAP
+echo "$2|$1:\\" 					>> $PRINTCAP
+echo "  :sd=/var/spool/lpd/$2:\\" 			>> $PRINTCAP
+echo "  :mx=0:ml=0:sh:\\" 				>> $PRINTCAP
+echo "  :lp=/usr/local/samba/var/print/$5.prn:" 	>> $PRINTCAP
+
+touch "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
+chown $LP "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
+
+mkdir /var/spool/lpd/$2
+chmod 700 /var/spool/lpd/$2
+chown $LP /var/spool/lpd/$2
+#echo $1 >> "/usr/local/samba/var/print/$5.prn"
+#echo $2 >> "/usr/local/samba/var/print/$5.prn"
+#echo $3 >> "/usr/local/samba/var/print/$5.prn"
+#echo $4 >> "/usr/local/samba/var/print/$5.prn"
+#echo $5 >> "/usr/local/samba/var/print/$5.prn"
+#echo $6 >> "/usr/local/samba/var/print/$5.prn"
+$RESTART >> "/usr/local/samba/var/print/$5.prn"
+# Not sure if this is needed
+touch /usr/local/samba/lib/smb.conf
+#
+# You need to return a value, but I am not sure what it means.
+#
+echo "Done"
+exit 0

      14.2.5. Samba and Printer Ports

      Windows NT/2000 print servers associate a port with each printer. These normally +take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the +concept of ports associated with a printer. By default, only one printer port, +named "Samba Printer Port", exists on a system. Samba does not really a port in +order to print, rather it is a requirement of Windows clients.

      Note that Samba does not support the concept of "Printer Pooling" internally +either. This is when a logical printer is assigned to multiple ports as +a form of load balancing or fail over.

      If you require that multiple ports be defined for some reason, +smb.conf possesses a enumports +commandChapter 13. Configuring PAM for distributed but centrally -managed authentication which can be used to define an external program +that generates a listing of ports on a system.

      13.1. Samba and PAM14.3. The Imprints Toolset

      A number of Unix systems (eg: Sun Solaris), as well as the -xxxxBSD family and Linux, now utilize the Pluggable Authentication -Modules (PAM) facility to provide all authentication, -authorization and resource control services. Prior to the -introduction of PAM, a decision to use an alternative to -the system password database (/etc/passwd) -would require the provision of alternatives for all programs that provide -security services. Such a choice would involve provision of -alternatives to such programs as: login, -passwd, chown, etc.

      PAM provides a mechanism that disconnects these security programs -from the underlying authentication/authorization infrastructure. -PAM is configured either through one file /etc/pam.conf (Solaris), -or by editing individual files that are located in /etc/pam.d.

      The Imprints tool set provides a UNIX equivalent of the + Windows NT Add Printer Wizard. For complete information, please + refer to the Imprints web site at http://imprints.sourceforge.net/ as well as the documentation + included with the imprints source distribution. This section will + only provide a brief introduction to the features of Imprints.

      14.3.1. What is Imprints?

      Imprints is a collection of tools for supporting the goals + of

      • If the PAM authentication module (loadable link library file) is located in the - default location then it is not necessary to specify the path. In the case of - Linux, the default location is /lib/security. If the module - is located other than default then the path may be specified as: - - 

        	eg: "auth       required      /other_path/pam_strange_module.so"
-
        -

      Providing a central repository information + regarding Windows NT and 95/98 printer driver packages

    • The following is an example /etc/pam.d/login configuration file. -This example had all options been uncommented is probably not usable -as it stacks many conditions before allowing successful completion -of the login process. Essentially all conditions can be disabled -by commenting them out except the calls to pam_pwdb.so.

      Providing the tools necessary for creating + the Imprints printer driver packages.

    • 	#%PAM-1.0
-	# The PAM configuration file for the `login' service
-	#
-	auth 		required	pam_securetty.so
-	auth 		required	pam_nologin.so
-	# auth 		required	pam_dialup.so
-	# auth 		optional	pam_mail.so
-	auth		required	pam_pwdb.so shadow md5
-	# account    	requisite  	pam_time.so
-	account		required	pam_pwdb.so
-	session		required	pam_pwdb.so
-	# session 	optional	pam_lastlog.so
-	# password   	required   	pam_cracklib.so retry=3
-	password	required	pam_pwdb.so shadow md5

      Providing an installation client which + will obtain and install printer drivers on remote Samba + and Windows NT 4 print servers.

      • 14.3.2. Creating Printer Driver Packages

      PAM allows use of replacable modules. Those available on a -sample system include:

      The process of creating printer driver packages is beyond + the scope of this document (refer to Imprints.txt also included + with the Samba distribution for more information). In short, + an Imprints driver package is a gzipped tarball containing the + driver files, related INF files, and a control file needed by the + installation client.

      14.3.3. The Imprints server

      	$ /bin/ls /lib/security
-	pam_access.so    pam_ftp.so          pam_limits.so     
-	pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
-	pam_cracklib.so  pam_group.so        pam_listfile.so   
-	pam_nologin.so   pam_rootok.so       pam_tally.so      
-	pam_deny.so      pam_issue.so        pam_mail.so       
-	pam_permit.so    pam_securetty.so    pam_time.so       
-	pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-	pam_pwdb.so      pam_shells.so       pam_unix.so       
-	pam_env.so       pam_ldap.so         pam_motd.so       
-	pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-	pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-	pam_userdb.so    pam_warn.so         pam_unix_session.so

      The Imprints server is really a database server that + may be queried via standard HTTP mechanisms. Each printer + entry in the database has an associated URL for the actual + downloading of the package. Each package is digitally signed + via GnuPG which can be used to verify that package downloaded + is actually the one referred in the Imprints database. It is + not recommended that this security check + be disabled.

      14.3.4. The Installation Client

      The following example for the login program replaces the use of -the pam_pwdb.so module which uses the system -password database (/etc/passwd, -/etc/shadow, /etc/group) with -the module pam_smbpass.so which uses the Samba -database which contains the Microsoft MD4 encrypted password -hashes. This database is stored in either -/usr/local/samba/private/smbpasswd, -/etc/samba/smbpasswd, or in -/etc/samba.d/smbpasswd, depending on the -Samba implementation for your Unix/Linux system. The -pam_smbpass.so module is provided by -Samba version 2.2.1 or later. It can be compiled by specifying the ---with-pam_smbpass options when running Samba's -configure script. For more information -on the pam_smbpass module, see the documentation -in the More information regarding the Imprints installation client + is available in the source/pam_smbpass directory of the Samba -source distribution.

      Imprints-Client-HOWTO.ps + file included with the imprints source package.

      The Imprints installation client comes in two forms.

      	#%PAM-1.0
-	# The PAM configuration file for the `login' service
-	#
-	auth		required	pam_smbpass.so nodelay
-	account		required	pam_smbpass.so nodelay
-	session		required	pam_smbpass.so nodelay
-	password	required	pam_smbpass.so nodelay

      • The following is the PAM configuration file for a particular -Linux system. The default condition uses pam_pwdb.soa set of command line Perl scripts

      • a GTK+ based graphical interface to + the command line perl scripts

      The installation client (in both forms) provides a means + of querying the Imprints database server for a matching + list of known printer model names as well as a means to + download and install the drivers on remote Samba and Windows + NT print servers.

      The basic installation process is in four steps and + perl code is wrapped around smbclient + and rpcclient.

      	#%PAM-1.0
-	# The PAM configuration file for the `samba' service
-	#
-	auth       required     /lib/security/pam_pwdb.so nullok nodelay shadow audit
-	account    required     /lib/security/pam_pwdb.so audit nodelay
-	session    required     /lib/security/pam_pwdb.so nodelay
-	password   required     /lib/security/pam_pwdb.so shadow md5
      +foreach (supported architecture for a given driver) +{ + 1. rpcclient: Get the appropriate upload directory + on the remote server + 2. smbclient: Upload the driver files + 3. rpcclient: Issues an AddPrinterDriver() MS-RPC +} + +4. rpcclient: Issue an AddPrinterEx() MS-RPC to actually + create the printer

      In the following example the decision has been made to use the -smbpasswd database even for basic samba authentication. Such a -decision could also be made for the passwd program and would -thus allow the smbpasswd passwords to be changed using the passwd -program.

      One of the problems encountered when implementing + the Imprints tool set was the name space issues between + various supported client architectures. For example, Windows + NT includes a driver named "Apple LaserWriter II NTX v51.8" + and Windows 95 calls its version of this driver "Apple + LaserWriter II NTX"

      	#%PAM-1.0
-	# The PAM configuration file for the `samba' service
-	#
-	auth       required     /lib/security/pam_smbpass.so nodelay
-	account    required     /lib/security/pam_pwdb.so audit nodelay
-	session    required     /lib/security/pam_pwdb.so nodelay
-	password   required     /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf

      The problem is how to know what client drivers have + been uploaded for a printer. As astute reader will remember + that the Windows NT Printer Properties dialog only includes + space for one printer driver name. A quick look in the + Windows NT 4.0 system registry at

      HKLM\System\CurrentControlSet\Control\Print\Environment +

      PAM allows stacking of authentication mechanisms. It is -also possible to pass information obtained within one PAM module through -to the next module in the PAM stack. Please refer to the documentation for -your particular system implementation for details regarding the specific -capabilities of PAM in this environment. Some Linux implmentations also -provide the pam_stack.so module that allows all -authentication to be configured in a single central file. The -pam_stack.so method has some very devoted followers -on the basis that it allows for easier administration. As with all issues in -life though, every decision makes trade-offs, so you may want examine the -PAM documentation for further helpful information.

      will reveal that Windows NT always uses the NT driver + name. This is ok as Windows NT always requires that at least + the Windows NT version of the printer driver is present. + However, Samba does not have the requirement internally. + Therefore, how can you use the NT driver name if is has not + already been installed?

      The way of sidestepping this limitation is to require + that all Imprints printer driver packages include both the Intel + Windows NT and 95/98 printer drivers and that NT driver is + installed first.

      13.2. Distributed Authentication14.4. Diagnosis

      The astute administrator will realize from this that the -combination of pam_smbpass.so, -winbindd, and a distributed -passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed -user/password database that can also be used by all -PAM (eg: Linux) aware programs and applications. This arrangement -can have particularly potent advantages compared with the -use of Microsoft Active Directory Service (ADS) in so far as -reduction of wide area network authentication traffic.

      13.3. PAM Configuration in smb.conf

      There is an option in smb.conf called obey pam restrictions. -The following is from the on-line help for this option in SWAT;

      When Samba is configured to enable PAM support (i.e. ---with-pam), this parameter will -control whether or not Samba should obey PAM's account -and session management directives. The default behavior -is to use PAM for clear text authentication only and to -ignore any account or session management. Note that Samba always -ignores PAM for authentication in the case of -encrypt passwords = yes. -The reason is that PAM modules cannot support the challenge/response -authentication mechanism needed in the presence of SMB -password encryption.

      14.4.1. Introduction

      Default: obey pam restrictions = no

      Chapter 14. Printing Support

      14.1. Introduction

      This is a short description of how to debug printing problems with +Samba. This describes how to debug problems with printing from a SMB +client to a Samba server, not the other way around. For the reverse +see the examples/printing directory.

      Beginning with the 2.2.0 release, Samba supports -the native Windows NT printing mechanisms implemented via -MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of -Samba only supported LanMan printing calls.

      Ok, so you want to print to a Samba server from your PC. The first +thing you need to understand is that Samba does not actually do any +printing itself, it just acts as a middleman between your PC client +and your Unix printing subsystem. Samba receives the file from the PC +then passes the file to a external "print command". What print command +you use is up to you.

      The additional functionality provided by the new -SPOOLSS support includes:

      The whole things is controlled using options in smb.conf. The most +relevant options (which you should look up in the smb.conf man page) +are:

            [global]
+        print command     - send a file to a spooler
+        lpq command       - get spool queue status
+        lprm command      - remove a job
+      [printers]
+        path = /var/spool/lpd/samba

      • Support for downloading printer driver - files to Windows 95/98/NT/2000 clients upon demand. -

      • The following are nice to know about:

        Uploading of printer drivers via the - Windows NT Add Printer Wizard (APW) or the - Imprints tool set (refer to http://imprints.sourceforge.net). - 

      •         queuepause command   - stop a printer or print queue
+        queueresume command  - start a printer or print queue

        Support for the native MS-RPC printing - calls such as StartDocPrinter, EnumJobs(), etc... (See - the MSDN documentation at http://msdn.microsoft.com/ - for more information on the Win32 printing API) -

      • Example:

        Support for NT Access Control Lists (ACL) - on printer objects

      •         print command = /usr/bin/lpr -r -P%p %s
+        lpq command   = /usr/bin/lpq    -P%p %s
+        lprm command  = /usr/bin/lprm   -P%p %j
+        queuepause command = /usr/sbin/lpc -P%p stop
+        queuepause command = /usr/sbin/lpc -P%p start

        Improved support for printer queue manipulation - through the use of an internal databases for spooled job - information

      Samba should set reasonable defaults for these depending on your +system type, but it isn't clairvoyant. It is not uncommon that you +have to tweak these for local conditions. The commands should +always have fully specified pathnames, as the smdb may not have +the correct PATH values.

      There has been some initial confusion about what all this means -and whether or not it is a requirement for printer drivers to be -installed on a Samba host in order to support printing from Windows -clients. As a side note, Samba does not use these drivers in any way to process -spooled files. They are utilized entirely by the clients.

      When you send a job to Samba to be printed, it will make a temporary +copy of it in the directory specified in the [printers] section. +and it should be periodically cleaned out. The lpr -r option +requests that the temporary copy be removed after printing; If +printing fails then you might find leftover files in this directory, +and it should be periodically cleaned out. Samba used the lpq +command to determine the "job number" assigned to your print job +by the spooler.

      The following MS KB article, may be of some help if you are dealing with -Windows 2000 clients: How to Add Printers with No User -Interaction in Windows 2000The %>letter< are "macros" that get dynamically replaced with appropriate +values when they are used. The %s gets replaced with the name of the spool +file that Samba creates and the %p gets replaced with the name of the +printer. The %j gets replaced with the "job number" which comes from +the lpq output.

      14.4.2. Debugging printer problems

      One way to debug printing problems is to start by replacing these +command with shell scripts that record the arguments and the contents +of the print file. A simple example of this kind of things might +be:

      	print command = /tmp/saveprint %p %s
+
+    #!/bin/saveprint
+    # we make sure that we are the right user
+    /usr/bin/id -p >/tmp/tmp.print
+    # we run the command and save the error messages
+    # replace the command with the one appropriate for your system
+    /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print

      http://support.microsoft.com/support/kb/articles/Q189/1/05.ASPThen you print a file and try removing it. You may find that the +print queue needs to be stopped in order to see the queue status +and remove the job:

      
h4: {42} % echo hi >/tmp/hi
+h4: {43} % smbclient //localhost/lw4
+added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
+Password: 
+Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
+smb: \> print /tmp/hi
+putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
+smb: \> queue
+1049     3            hi-17534
+smb: \> cancel 1049
+Error cancelling job 1049 : code 0
+smb: \> cancel 1049
+Job 1049 cancelled
+smb: \> queue
+smb: \> exit

      The 'code 0' indicates that the job was removed. The comment +by the smbclient is a bit misleading on this. +You can observe the command output and then and look at the +/tmp/tmp.print file to see what the results are. You can quickly +find out if the problem is with your printing system. Often people +have problems with their /etc/printcap file or permissions on +various print queues.

      14.2. Configuration

      14.4.3. What printers do I have?

      You can use the 'testprns' program to check to see if the printer +name you are using is recognized by Samba. For example, you can +use:

          testprns printer /etc/printcap

      [print$] vs. [printer$]
       

      Previous versions of Samba recommended using a share named [printer$]. -This name was taken from the printer$ service created by Windows 9x -clients when a printer was shared. Windows 9x printer servers always have -a printer$ service which provides read-only access via no -password in order to support printer driver downloads.

      Samba can get its printcap information from a file or from a program. +You can try the following to see the format of the extracted +information:

      However, the initial implementation allowed for a -parameter named printer driver location -to be used on a per share basis to specify the location of -the driver files associated with that printer. Another -parameter named printer driver provided -a means of defining the printer driver name to be sent to -the client.

          testprns -a printer /etc/printcap
+
+    testprns -a printer '|/bin/cat printcap'

      14.2.1. Creating [print$]14.4.4. Setting up printcap and print servers

      In order to support the uploading of printer driver -files, you must first configure a file share named [print$]. -The name of this share is hard coded in Samba's internals so -the name is very important (print$ is the service used by -Windows NT print servers to provide support for printer driver -download).

      You may need to set up some printcaps for your Samba system to use. +It is strongly recommended that you use the facilities provided by +the print spooler to set up queues and printcap information.

      You should modify the server's smb.conf file to add the global -parameters and to create the -following file share (of course, some of the parameter values, -such as 'path' are arbitrary and should be replaced with -appropriate values for your site):

      Samba requires either a printcap or program to deliver printcap +information. This printcap information has the format:

      [global]
-    ; members of the ntadmin group should be able
-    ; to add drivers and set printer properties
-    ; root is implicitly a 'printer admin'
-    printer admin = @ntadmin
-
-[print$]
-    path = /usr/local/samba/printers
-    guest ok = yes
-    browseable = yes
-    read only = yes
-    ; since this share is configured as read only, then we need
-    ; a 'write list'.  Check the file system permissions to make
-    ; sure this account can copy files to the share.  If this
-    ; is setup to a non-root account, then it should also exist
-    ; as a 'printer admin'
-    write list = @ntadmin,root
      name|alias1|alias2...:option=value:...

      The write list is used to allow administrative -level user accounts to have write access in order to update files -on the share. See the smb.conf(5) -man page for more information on configuring file shares.

      For almost all printing systems, the printer 'name' must be composed +only of alphanumeric or underscore '_' characters. Some systems also +allow hyphens ('-') as well. An alias is an alternative name for the +printer, and an alias with a space in it is used as a 'comment' +about the printer. The printcap format optionally uses a \ at the end of lines +to extend the printcap to multiple lines.

      Here are some examples of printcap files:

      The requirement for guest -ok = yes depends upon how your -site is configured. If users will be guaranteed to have -an account on the Samba host, then this is a non-issue.

      Author's Note
       

      1. The non-issue is that if all your Windows NT users are guaranteed to be -authenticated by the Samba server (such as a domain member server and the NT -user has already been validated by the Domain Controller in -order to logon to the Windows NT console), then guest access -is not necessary. Of course, in a workgroup environment where -you just want to be able to print without worrying about -silly accounts and security, then configure the share for -guest access. You'll probably want to add map to guest = Bad User in the [global] section as well. Make sure -you understand what this parameter does before using it -though. --jerry

      pr just printer name

    • In order for a Windows NT print server to support -the downloading of driver files by multiple client architectures, -it must create subdirectories within the [print$] service -which correspond to each of the supported client architectures. -Samba follows this model as well.

      pr|alias printer name and alias

    • Next create the directory tree below the [print$] share -for each architecture you wish to support.

      pr|My Printer printer name, alias used as comment

    • [print$]-----
-        |-W32X86           ; "Windows NT x86"
-        |-WIN40            ; "Windows 95/98"
-        |-W32ALPHA         ; "Windows NT Alpha_AXP"
-        |-W32MIPS          ; "Windows NT R4000"
-        |-W32PPC           ; "Windows NT PowerPC"

      pr:sh:\ Same as pr:sh:cm= testing + :cm= \ + testing

    • pr:sh Same as pr:sh:cm= testing + :cm= testing

      • ATTENTION! REQUIRED PERMISSIONS
       

      In order to currently add a new driver to you Samba host, -one of two conditions must hold true:

      Samba reads the printcap information when first started. If you make +changes in the printcap information, then you must do the following:

        1. The account used to connect to the Samba host - must have a uid of 0 (i.e. a root account)

          make sure that the print spooler is aware of these changes. +The LPRng system uses the 'lpc reread' command to do this.

        2. The account used to connect to the Samba host - must be a member of the printer - admin list.

          make sure that the spool queues, etc., exist and have the +correct permissions. The LPRng system uses the 'checkpc -f' +command to do this.

      Of course, the connected account must still possess access -to add files to the subdirectories beneath [print$]. Remember -that all file shares are set to 'read only' by default.

    • Once you have created the required [print$] service and -associated subdirectories, simply log onto the Samba server using -a root (or printer admin) account -from a Windows NT 4.0/2k client. Open "Network Neighbourhood" or -"My Network Places" and browse for the Samba host. Once you have located -the server, navigate to the "Printers..." folder. -You should see an initial listing of printers -that matches the printer shares defined on your Samba host.

      You now should send a SIGHUP signal to the smbd server to have +it reread the printcap information.

      • 14.2.2. Setting Drivers for Existing Printers14.4.5. Job sent, no output

      The initial listing of printers in the Samba host's -Printers folder will have no real printer driver assigned -to them. This defaults to a NULL string to allow the use -of the local Add Printer Wizard on NT/2000 clients. -Attempting to view the printer properties for a printer -which has this default driver assigned will result in -the error message:

      This is the most frustrating part of printing. You may have sent the +job, verified that the job was forwarded, set up a wrapper around +the command to send the file, but there was no output from the printer.

      Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler -properties will be displayed. Do you want to install the -driver now?First, check to make sure that the job REALLY is getting to the +right print queue. If you are using a BSD or LPRng print spooler, +you can temporarily stop the printing of jobs. Jobs can still be +submitted, but they will not be printed. Use:

        lpc -Pprinter stop

      Click "No" in the error dialog and you will be presented with -the printer properties window. The way to assign a driver to a -printer is to either

      Now submit a print job and then use 'lpq -Pprinter' to see if the +job is in the print queue. If it is not in the print queue then +you will have to find out why it is not being accepted for printing.

      Next, you may want to check to see what the format of the job really +was. With the assistance of the system administrator you can view +the submitted jobs files. You may be surprised to find that these +are not in what you would expect to call a printable format. +You can use the UNIX 'file' utitily to determine what the job +format actually is:

          cd /var/spool/lpd/printer   # spool directory of print jobs
+    ls                          # find job files
+    file dfA001myhost

      • Use the "New Driver..." button to install - a new printer driver, or

      • You should make sure that your printer supports this format OR that +your system administrator has installed a 'print filter' that will +convert the file to a format appropriate for your printer.

      14.4.6. Job sent, strange output

      Select a driver from the popup list of - installed drivers. Initially this list will be empty.

      Once you have the job printing, you can then start worrying about +making it print nicely.

      If you wish to install printer drivers for client -operating systems other than "Windows NT x86", you will need -to use the "Sharing" tab of the printer properties dialog.

      The most common problem is extra pages of output: banner pages +OR blank pages at the end.

      Assuming you have connected with a root account, you -will also be able modify other printer properties such as -ACLs and device settings using this dialog box.

      If you are getting banner pages, check and make sure that the +printcap option or printer option is configured for no banners. +If you have a printcap, this is the :sh (suppress header or banner +page) option. You should have the following in your printer.

      A few closing comments for this section, it is possible -on a Windows NT print server to have printers -listed in the Printers folder which are not shared. Samba does -not make this distinction. By definition, the only printers of -which Samba is aware are those which are specified as shares in -smb.conf.

         printer: ... :sh

      Another interesting side note is that Windows NT clients do -not use the SMB printer share, but rather can print directly -to any printer on another Windows NT host using MS-RPC. This -of course assumes that the printing client has the necessary -privileges on the remote host serving the printer. The default -permissions assigned by Windows NT to a printer gives the "Print" -permissions to the "Everyone" well-known group.

      If you have this option and are still getting banner pages, there +is a strong chance that your printer is generating them for you +automatically. You should make sure that banner printing is disabled +for the printer. This usually requires using the printer setup software +or procedures supplied by the printer manufacturer.

      If you get an extra page of output, this could be due to problems +with your job format, or if you are generating PostScript jobs, +incorrect setting on your printer driver on the MicroSoft client. +For example, under Win95 there is a option:

        Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|

      that allows you to choose if a Ctrl-D is appended to all jobs. +This is a very bad thing to do, as most spooling systems will +automatically add a ^D to the end of the job if it is detected as +PostScript. The multiple ^D may cause an additional page of output.

      14.2.3. Support a large number of printers14.4.7. Raw PostScript printed

      One issue that has arisen during the development -phase of Samba 2.2 is the need to support driver downloads for -100's of printers. Using the Windows NT APW is somewhat -awkward to say the list. If more than one printer are using the -same driver, the rpcclient's -setdriver command can be used to set the driver -associated with an installed driver. The following is example -of how this could be accomplished:

       
-$ rpcclient pogo -U root%secret -c "enumdrivers"
-Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
- 
-[Windows NT x86]
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 4000 Series PS]
- 
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 2100 Series PS]
- 
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 4Si/4SiMX PS]
-				  
-$ rpcclient pogo -U root%secret -c "enumprinters"
-Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
-     flags:[0x800000]
-     name:[\\POGO\hp-print]
-     description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
-     comment:[]
-				  
-$ rpcclient pogo -U root%secret \
->  -c "setdriver hp-print \"HP LaserJet 4000 Series PS\""
-Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
-Successfully set hp-print to driver HP LaserJet 4000 Series PS.

      This is a problem that is usually caused by either the print spooling +system putting information at the start of the print job that makes +the printer think the job is a text file, or your printer simply +does not support PostScript. You may need to enable 'Automatic +Format Detection' on your printer.

      14.2.4. Adding New Printers via the Windows NT APW14.4.8. Advanced Printing

      By default, Samba offers all printer shares defined in smb.conf -in the "Printers..." folder. Also existing in this folder is the Windows NT -Add Printer Wizard icon. The APW will be show only if

      • The connected user is able to successfully - execute an OpenPrinterEx(\\server) with administrative - privileges (i.e. root or printer admin). -

      • show - add printer wizard = yes (the default). -

      In order to be able to use the APW to successfully add a printer to a Samba -server, the add -printer command must have a defined value. The program -hook must successfully add the printer to the system (i.e. -/etc/printcap or appropriate files) and -smb.conf if necessary.

      When using the APW from a client, if the named printer share does -not exist, smbd will execute the add printer -command and reparse to the smb.conf -to attempt to locate the new printer share. If the share is still not defined, -an error of "Access Denied" is returned to the client. Note that the -add printer program is executed under the context -of the connected user, not necessarily a root account.

      There is a complementary delete -printer command for removing entries from the "Printers..." -folder.

      The following is an example add printer command script. It adds the appropriate entries to /etc/printcap.local (change that to what you need) and returns a line of 'Done' which is needed for the whole process to work.

      #!/bin/sh
-
-# Script to insert a new printer entry into printcap.local
-#
-# $1, printer name, used as the descriptive name
-# $2, share name, used as the printer name for Linux
-# $3, port name
-# $4, driver name
-# $5, location, used for the device file of the printer
-# $6, win9x location
-
-#
-# Make sure we use the location that RedHat uses for local printer defs
-PRINTCAP=/etc/printcap.local
-DATE=`date +%Y%m%d-%H%M%S`
-LP=lp
-RESTART="service lpd restart"
-
-# Keep a copy
-cp $PRINTCAP $PRINTCAP.$DATE
-# Add the printer to $PRINTCAP
-echo ""				 			>> $PRINTCAP
-echo "$2|$1:\\" 					>> $PRINTCAP
-echo "  :sd=/var/spool/lpd/$2:\\" 			>> $PRINTCAP
-echo "  :mx=0:ml=0:sh:\\" 				>> $PRINTCAP
-echo "  :lp=/usr/local/samba/var/print/$5.prn:" 	>> $PRINTCAP
-
-touch "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
-chown $LP "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
-
-mkdir /var/spool/lpd/$2
-chmod 700 /var/spool/lpd/$2
-chown $LP /var/spool/lpd/$2
-#echo $1 >> "/usr/local/samba/var/print/$5.prn"
-#echo $2 >> "/usr/local/samba/var/print/$5.prn"
-#echo $3 >> "/usr/local/samba/var/print/$5.prn"
-#echo $4 >> "/usr/local/samba/var/print/$5.prn"
-#echo $5 >> "/usr/local/samba/var/print/$5.prn"
-#echo $6 >> "/usr/local/samba/var/print/$5.prn"
-$RESTART >> "/usr/local/samba/var/print/$5.prn"
-# Not sure if this is needed
-touch /usr/local/samba/lib/smb.conf
-#
-# You need to return a value, but I am not sure what it means.
-#
-echo "Done"
-exit 0
      Note that you can do some pretty magic things by using your +imagination with the "print command" option and some shell scripts. +Doing print accounting is easy by passing the %U option to a print +command shell script. You could even make the print command detect +the type of output and its size and send it to an appropriate +printer.

      14.2.5. Samba and Printer Ports14.4.9. Real debugging

      Windows NT/2000 print servers associate a port with each printer. These normally -take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the -concept of ports associated with a printer. By default, only one printer port, -named "Samba Printer Port", exists on a system. Samba does not really a port in -order to print, rather it is a requirement of Windows clients.

      Note that Samba does not support the concept of "Printer Pooling" internally -either. This is when a logical printer is assigned to multiple ports as -a form of load balancing or fail over.

      If you require that multiple ports be defined for some reason, -smb.conf possesses a enumports -command which can be used to define an external program -that generates a listing of ports on a system.

      If the above debug tips don't help, then maybe you need to bring in +the bug guns, system tracing. See Tracing.txt in this directory.

      Chapter 15. CUPS Printing Support

      14.3. The Imprints Toolset15.1. Introduction

      The Imprints tool set provides a UNIX equivalent of the - Windows NT Add Printer Wizard. For complete information, please - refer to the Imprints web site at http://imprints.sourceforge.net/ as well as the documentation - included with the imprints source distribution. This section will - only provide a brief introduction to the features of Imprints.

      14.3.1. What is Imprints?

      The Common Unix Print System (CUPS) has become very popular, but to many it is +a very mystical tool. There is a great deal of uncertainty regarding CUPS and how +it works. The result is seen in a large number of posting on the samba mailing lists +expressing frustration when MS Windows printers appear not to work with a CUPS +backr-end. +/para>

      Imprints is a collection of tools for supporting the goals - of

      This is a good time to point out how CUPS can be used and what it does. CUPS is more +than just a print spooling system - it is a complete printer management system that +complies with HTTP and IPP protocols. It can be managed remotely via a web browser +and it can print using http and ipp protocols.

      CUPS allows to creation of RAW printers (ie: NO file format translation) as well as +SMART printers (ie: CUPS does file format conversion as required for the printer). In +many ways this gives CUPS similar capabilities to the MS Windows print monitoring +system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better! +In any case, let us now move on to explore how one may configure CUPS for interfacing +with MS Windows print clients via Samba.

      15.2. CUPS - RAW Print Through Mode

      When CUPS printers are configured for RAW print-through mode operation it is the +responsibility of the Samba client to fully render the print job (file) in a format +that is suitable for direct delivery to the printer. In this case CUPS will NOT +do any print file format conversion work.

      The CUPS files that need to be correctly set for RAW mode printers to work are: + +

      • Providing a central repository information - regarding Windows NT and 95/98 printer driver packages

      • /etc/cups/mime.types

        Providing the tools necessary for creating - the Imprints printer driver packages.

      • Providing an installation client which - will obtain and install printer drivers on remote Samba - and Windows NT 4 print servers.

        /etc/cups/mime.convs

      14.3.2. Creating Printer Driver Packages

      The process of creating printer driver packages is beyond - the scope of this document (refer to Imprints.txt also included - with the Samba distribution for more information). In short, - an Imprints driver package is a gzipped tarball containing the - driver files, related INF files, and a control file needed by the - installation client.

      14.3.3. The Imprints server

      The Imprints server is really a database server that - may be queried via standard HTTP mechanisms. Each printer - entry in the database has an associated URL for the actual - downloading of the package. Each package is digitally signed - via GnuPG which can be used to verify that package downloaded - is actually the one referred in the Imprints database. It is - + +Both contain entries that must be uncommented to allow notRAW recommended that this security check - be disabled.

      14.3.4. The Installation Client

      More information regarding the Imprints installation client - is available in the Imprints-Client-HOWTO.ps - file included with the imprints source package.

      The Imprints installation client comes in two forms.

      mode +operation.

      Firstly, to enable CUPS based printing from Samba the following options must be +enabled in your smb.conf file [globals] section: + +

      • a set of command line Perl scripts

        printing = CUPS

      • a GTK+ based graphical interface to - the command line perl scripts

        printcap = CUPS

      The installation client (in both forms) provides a means - of querying the Imprints database server for a matching - list of known printer model names as well as a means to - download and install the drivers on remote Samba and Windows - NT print servers.

      The basic installation process is in four steps and - perl code is wrapped around smbclient + +When these parameters are specified the print directives in smb.conf (as well as in +samba itself) will be ignored because samba will directly interface with CUPS through +it's application program interface (API) - so long as Samba has been compiled with +CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then +printing will use the System V AT&T command set with the -oraw - and rpcclient.

      Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) +on the Samba/CUPS server does *not* add any features if a file is really +printed "raw". However, if you have loaded the driver for the Windows client from +the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using +a "Foomatic" PPD, the PJL header in question is already added on the Windows client, +at the time when the driver initially generated the PostScript data and CUPS in true +"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its +printer communication backend.

      	
-foreach (supported architecture for a given driver)
-{
-     1.  rpcclient: Get the appropriate upload directory 
-         on the remote server
-     2.  smbclient: Upload the driver files
-     3.  rpcclient: Issues an AddPrinterDriver() MS-RPC
-}
-	
-4.  rpcclient: Issue an AddPrinterEx() MS-RPC to actually
-    create the printer

      One of the problems encountered when implementing - the Imprints tool set was the name space issues between - various supported client architectures. For example, Windows - NT includes a driver named "Apple LaserWriter II NTX v51.8" - and Windows 95 calls its version of this driver "Apple - LaserWriter II NTX"

      NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce* +"raw" printing, it only *allows* it.

      The problem is how to know what client drivers have - been uploaded for a printer. As astute reader will remember - that the Windows NT Printer Properties dialog only includes - space for one printer driver name. A quick look in the - Windows NT 4.0 system registry at

      Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids +the process of determining proper treatment while in the print queue system. + +

      • Files generated by PCL drivers and directed at PCK printers get auto-typed as + HKLM\System\CurrentControlSet\Control\Print\Environment - application/octet-stream. Unknown file format types also + get auto-typed with this tag. +

      • Files generated by a Postscript driver and directed at a Postscript printer + are auto-typed depending on the auto-detected most suitable MIME type as: + +

        • will reveal that Windows NT always uses the NT driver - name. This is ok as Windows NT always requires that at least - the Windows NT version of the printer driver is present. - However, Samba does not have the requirement internally. - Therefore, how can you use the NT driver name if is has not - already been installed?

          * application/postscript

        • The way of sidestepping this limitation is to require - that all Imprints printer driver packages include both the Intel - Windows NT and 95/98 printer drivers and that NT driver is - installed first.

      14.4. Diagnosis

      14.4.1. Introduction

      * application/vnd.cups-postscript

      +

      This is a short description of how to debug printing problems with -Samba. This describes how to debug problems with printing from a SMB -client to a Samba server, not the other way around. For the reverse -see the examples/printing directory.

      "application/postscript" first goes thru the "pstops" filter (where the page counting +and accounting takes place). The outcome will be of MIME type +"application/vnd.cups-postscript". The pstopsfilter reads and uses information from +the PPD and inserts user-provided options into the PostScript file. As a consequence, +the filtered file could possibly have an unwanted PJL header.

      Ok, so you want to print to a Samba server from your PC. The first -thing you need to understand is that Samba does not actually do any -printing itself, it just acts as a middleman between your PC client -and your Unix printing subsystem. Samba receives the file from the PC -then passes the file to a external "print command". What print command -you use is up to you.

      "application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which +have as their first character string one of "%!" or "<04>%".

      The whole things is controlled using options in smb.conf. The most -relevant options (which you should look up in the smb.conf man page) -are:

      "application/vnd.cups-postscript" will files which contain the string +"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the +first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes +("<1B>%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS +or other PPD, will have to be auto-typed as "vnd.cups-postscript". A file produced +with a "Generic PostScript driver" will just be tagged "application/postscript".

      Once the file is in "application/vnd.cups-postscript" format, either "pstoraster" +or "cupsomatic" will take over (depending on the printer configuration, as +determined by the PPD in use).

            [global]
-        print command     - send a file to a spooler
-        lpq command       - get spool queue status
-        lprm command      - remove a job
-      [printers]
-        path = /var/spool/lpd/samba

      The following are nice to know about:

      A printer queue with *no* PPD associated to it is a "raw" printer and all files +will go directly there as received by the spooler. The exeptions are file types +"application/octet-stream" which need "passthrough feature" enabled. +"Raw" queues don't do any filtering at all, they hand the file directly to the +CUPS backend. This backend is responsible for the sending of the data to the device +(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://, +parallel:/, serial:/, usb:/ etc.)

              queuepause command   - stop a printer or print queue
-        queueresume command  - start a printer or print queue

      Example:

      "cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS. +They are a Third Party add-on, developed at Linuxprinting.org. As such, they are +a brilliant hack to make all models (driven by Ghostscript drivers/filters in +traditional spoolers) also work via CUPS, with the same (good or bad!) quality +as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript +commandline at that stage in the CUPS filtering chain, where "normally" the native +CUPS "pstoraster" filter would kick in. cupsomatic by-passes pstoraster, "kidnaps" +the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this, +because the associated CUPS-O-Matic-/Foomatic-PPD specifies:

              print command = /usr/bin/lpr -r -P%p %s
-        lpq command   = /usr/bin/lpq    -P%p %s
-        lprm command  = /usr/bin/lprm   -P%p %j
-        queuepause command = /usr/sbin/lpc -P%p stop
-        queuepause command = /usr/sbin/lpc -P%p start

      Samba should set reasonable defaults for these depending on your -system type, but it isn't clairvoyant. It is not uncommon that you -have to tweak these for local conditions. The commands should -always have fully specified pathnames, as the smdb may not have -the correct PATH values.

      When you send a job to Samba to be printed, it will make a temporary -copy of it in the directory specified in the [printers] section. -and it should be periodically cleaned out. The lpr -r option -requests that the temporary copy be removed after printing; If -printing fails then you might find leftover files in this directory, -and it should be periodically cleaned out. Samba used the lpq -command to determine the "job number" assigned to your print job -by the spooler.

      *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic"

      The %>letter< are "macros" that get dynamically replaced with appropriate -values when they are used. The %s gets replaced with the name of the spool -file that Samba creates and the %p gets replaced with the name of the -printer. The %j gets replaced with the "job number" which comes from -the lpq output.

      This line persuades CUPS to hand the file to cupsomatic, once it has successfully +converted it to the MIME type "application/vnd.cups-postscript". This conversion will not +happen for Jobs arriving from Windows which are auto-typed "application/octet-stream", +with the according changes in "/etc/cups/mime.types" in place.

      14.4.2. Debugging printer problems

      One way to debug printing problems is to start by replacing these -command with shell scripts that record the arguments and the contents -of the print file. A simple example of this kind of things might -be:

      CUPS is widely configurable and flexible, even regarding its filtering mechanism. +Another workaround in some situations would be to have +in "/etc/cups/mime.types" entries as follows:

      	print command = /tmp/saveprint %p %s
-
-    #!/bin/saveprint
-    # we make sure that we are the right user
-    /usr/bin/id -p >/tmp/tmp.print
-    # we run the command and save the error messages
-    # replace the command with the one appropriate for your system
-    /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print

      Then you print a file and try removing it. You may find that the -print queue needs to be stopped in order to see the queue status -and remove the job:

      application/postscript application/vnd.cups-raw 0 - + application/vnd.cups-postscript application/vnd.cups-raw 0 -

      This would prevent all Postscript files from being filtered (rather, they will go +thru the virtual "nullfilter" denoted with "-"). This could only be useful for +PS printers. If you want to print PS code on non-PS printers an entry as follows +could be useful:

      
h4: {42} % echo hi >/tmp/hi
-h4: {43} % smbclient //localhost/lw4
-added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
-Password: 
-Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
-smb: \> print /tmp/hi
-putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
-smb: \> queue
-1049     3            hi-17534
-smb: \> cancel 1049
-Error cancelling job 1049 : code 0
-smb: \> cancel 1049
-Job 1049 cancelled
-smb: \> queue
-smb: \> exit

      The 'code 0' indicates that the job was removed. The comment -by the smbclient is a bit misleading on this. -You can observe the command output and then and look at the -/tmp/tmp.print file to see what the results are. You can quickly -find out if the problem is with your printing system. Often people -have problems with their /etc/printcap file or permissions on -various print queues.

      14.4.3. What printers do I have?

      */* application/vnd.cups-raw 0 -

      You can use the 'testprns' program to check to see if the printer -name you are using is recognized by Samba. For example, you can -use:

      and would effectively send *all* files to the backend without further processing.

      Lastly, you could have the following entry:

          testprns printer /etc/printcap

      application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter

      Samba can get its printcap information from a file or from a program. -You can try the following to see the format of the extracted -information:

      You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that +parses the PostScript and removes the unwanted PJL. This would need to conform to +CUPS filter design (mainly, receive and pass the parameters printername, job-id, +username, jobtitle, copies, print options and possibly the filename). It would +be installed as world executable into "/usr/lib/cups/filters/" and will be called +by CUPS if it encounters a MIME type "application/vnd.cups-postscript".

          testprns -a printer /etc/printcap
-
-    testprns -a printer '|/bin/cat printcap'

      CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue +"on hold". It will only be printed upon manual release by the printer operator. +This is a requirement in many "central reproduction departments", where a few +operators manage the jobs of hundreds of users on some big machine, where no +user is allowed to have direct access. (The operators often need to load the +proper paper type before running the 10.000 page job requested by marketing +for the mailing, etc.).

      14.4.4. Setting up printcap and print servers

      You may need to set up some printcaps for your Samba system to use. -It is strongly recommended that you use the facilities provided by -the print spooler to set up queues and printcap information.

      Samba requires either a printcap or program to deliver printcap -information. This printcap information has the format:

      15.3. The CUPS Filter Chains

      The following diagrams reveal how CUPS handles print jobs.

        name|alias1|alias2...:option=value:...

      For almost all printing systems, the printer 'name' must be composed -only of alphanumeric or underscore '_' characters. Some systems also -allow hyphens ('-') as well. An alias is an alternative name for the -printer, and an alias with a space in it is used as a 'comment' -about the printer. The printcap format optionally uses a \ at the end of lines -to extend the printcap to multiple lines.

      Here are some examples of printcap files:

      1. pr just printer name

      2. pr|alias printer name and alias

      3. pr|My Printer printer name, alias used as comment

      4. pr:sh:\ Same as pr:sh:cm= testing - :cm= \ - testing

      5. pr:sh Same as pr:sh:cm= testing - :cm= testing

      Samba reads the printcap information when first started. If you make -changes in the printcap information, then you must do the following:

      1. make sure that the print spooler is aware of these changes. -The LPRng system uses the 'lpc reread' command to do this.

      2. make sure that the spool queues, etc., exist and have the -correct permissions. The LPRng system uses the 'checkpc -f' -command to do this.

      3. You now should send a SIGHUP signal to the smbd server to have -it reread the printcap information.

      14.4.5. Job sent, no output

      This is the most frustrating part of printing. You may have sent the -job, verified that the job was forwarded, set up a wrapper around -the command to send the file, but there was no output from the printer.

      First, check to make sure that the job REALLY is getting to the -right print queue. If you are using a BSD or LPRng print spooler, -you can temporarily stop the printing of jobs. Jobs can still be -submitted, but they will not be printed. Use:

      ######################################################################### +# +# CUPS in and of itself has this (general) filter chain (CAPITAL +# letters are FILE-FORMATS or MIME types, other are filters (this is +# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro): +# +# SOMETHNG-FILEFORMAT +# | +# | +# V +# somethingtops +# | +# | +# V +# APPLICATION/POSTSCRIPT +# | +# | +# V +# pstops +# | +# | +# V +# APPLICATION/VND.CUPS-POSTSCRIPT +# | +# | +# V +# pstoraster # as shipped with CUPS, independent from any Ghostscipt +# | # installation on the system +# | (= "postscipt interpreter") +# | +# V +# APPLICATION/VND.CUPS-RASTER +# | +# | +# V +# rastertosomething (f.e. Gimp-Print filters may be plugged in here) +# | (= "raster driver") +# | +# V +# SOMETHING-DEVICE-SPECIFIC +# | +# | +# V +# backend +# +# +# ESP PrintPro has some enhanced "rastertosomething" filters as compared to +# CUPS, and also a somewhat improved "pstoraster" filter. +# +# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# +#########################################################################

        lpc -Pprinter stop

      Now submit a print job and then use 'lpq -Pprinter' to see if the -job is in the print queue. If it is not in the print queue then -you will have to find out why it is not being accepted for printing.

      Next, you may want to check to see what the format of the job really -was. With the assistance of the system administrator you can view -the submitted jobs files. You may be surprised to find that these -are not in what you would expect to call a printable format. -You can use the UNIX 'file' utitily to determine what the job -format actually is:

      ######################################################################### +# +# This is how "cupsomatic" comes into play: +# ========================================= +# +# SOMETHNG-FILEFORMAT +# | +# | +# V +# somethingtops +# | +# | +# V +# APPLICATION/POSTSCRIPT +# | +# | +# V +# pstops +# | +# | +# V +# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ +# | | +# | V +# V cupsomatic +# pstoraster (constructs complicated +# | (= "postscipt interpreter") Ghostscript commandline +# | to let the file be +# V processed by a +# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." +# | call...) +# | | +# V | +# rastertosomething V +# | (= "raster driver") +-------------------------+ +# | | Ghostscript at work.... | +# V | | +# SOMETHING-DEVICE-SPECIFIC *-------------------------+ +# | | +# | | +# V | +# backend >------------------------------------+ +# | +# | +# V +# THE PRINTER +# +# +# Note, that cupsomatic "kidnaps" the printfile after the +# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through +# the CUPS-external, systemwide Ghostscript installation, bypassing the +# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers +# "rastertosomething", and hands the rasterized file directly to the CUPS +# backend... +# +# cupsomatic is not made by the CUPS developers. It is an independent +# contribution to printing development, made by people from +# Linuxprinting.org. (see also http://www.cups.org/cups-help.html) +# +# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# +#########################################################################

          cd /var/spool/lpd/printer   # spool directory of print jobs
-    ls                          # find job files
-    file dfA001myhost

      You should make sure that your printer supports this format OR that -your system administrator has installed a 'print filter' that will -convert the file to a format appropriate for your printer.

      14.4.6. Job sent, strange output

      Once you have the job printing, you can then start worrying about -making it print nicely.

      The most common problem is extra pages of output: banner pages -OR blank pages at the end.

      If you are getting banner pages, check and make sure that the -printcap option or printer option is configured for no banners. -If you have a printcap, this is the :sh (suppress header or banner -page) option. You should have the following in your printer.

      ######################################################################### +# +# And this is how it works for ESP PrintPro from 4.3: +# =================================================== +# +# SOMETHNG-FILEFORMAT +# | +# | +# V +# somethingtops +# | +# | +# V +# APPLICATION/POSTSCRIPT +# | +# | +# V +# pstops +# | +# | +# V +# APPLICATION/VND.CUPS-POSTSCRIPT +# | +# | +# V +# gsrip +# | (= "postscipt interpreter") +# | +# V +# APPLICATION/VND.CUPS-RASTER +# | +# | +# V +# rastertosomething (f.e. Gimp-Print filters may be plugged in here) +# | (= "raster driver") +# | +# V +# SOMETHING-DEVICE-SPECIFIC +# | +# | +# V +# backend +# +# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# +#########################################################################

         printer: ... :sh

      If you have this option and are still getting banner pages, there -is a strong chance that your printer is generating them for you -automatically. You should make sure that banner printing is disabled -for the printer. This usually requires using the printer setup software -or procedures supplied by the printer manufacturer.

      If you get an extra page of output, this could be due to problems -with your job format, or if you are generating PostScript jobs, -incorrect setting on your printer driver on the MicroSoft client. -For example, under Win95 there is a option:

      ######################################################################### +# +# This is how "cupsomatic" would come into play with ESP PrintPro: +# ================================================================ +# +# +# SOMETHNG-FILEFORMAT +# | +# | +# V +# somethingtops +# | +# | +# V +# APPLICATION/POSTSCRIPT +# | +# | +# V +# pstops +# | +# | +# V +# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ +# | | +# | V +# V cupsomatic +# gsrip (constructs complicated +# | (= "postscipt interpreter") Ghostscript commandline +# | to let the file be +# V processed by a +# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." +# | call...) +# | | +# V | +# rastertosomething V +# | (= "raster driver") +-------------------------+ +# | | Ghostscript at work.... | +# V | | +# SOMETHING-DEVICE-SPECIFIC *-------------------------+ +# | | +# | | +# V | +# backend >------------------------------------+ +# | +# | +# V +# THE PRINTER +# +# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# +#########################################################################

        Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|

      that allows you to choose if a Ctrl-D is appended to all jobs. -This is a very bad thing to do, as most spooling systems will -automatically add a ^D to the end of the job if it is detected as -PostScript. The multiple ^D may cause an additional page of output.

      14.4.7. Raw PostScript printed

      This is a problem that is usually caused by either the print spooling -system putting information at the start of the print job that makes -the printer think the job is a text file, or your printer simply -does not support PostScript. You may need to enable 'Automatic -Format Detection' on your printer.

      14.4.8. Advanced Printing

      Note that you can do some pretty magic things by using your -imagination with the "print command" option and some shell scripts. -Doing print accounting is easy by passing the %U option to a print -command shell script. You could even make the print command detect -the type of output and its size and send it to an appropriate -printer.

      14.4.9. Real debugging

      If the above debug tips don't help, then maybe you need to bring in -the bug guns, system tracing. See Tracing.txt in this directory.

      Chapter 15. CUPS Printing Support

      15.1. Introduction

      The Common Unix Print System (CUPS) has become very popular, but to many it is -a very mystical tool. There is a great deal of uncertainty regarding CUPS and how -it works. The result is seen in a large number of posting on the samba mailing lists -expressing frustration when MS Windows printers appear not to work with a CUPS -backr-end. -/para>

      This is a good time to point out how CUPS can be used and what it does. CUPS is more -than just a print spooling system - it is a complete printer management system that -complies with HTTP and IPP protocols. It can be managed remotely via a web browser -and it can print using http and ipp protocols.

      CUPS allows to creation of RAW printers (ie: NO file format translation) as well as -SMART printers (ie: CUPS does file format conversion as required for the printer). In -many ways this gives CUPS similar capabilities to the MS Windows print monitoring -system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better! -In any case, let us now move on to explore how one may configure CUPS for interfacing -with MS Windows print clients via Samba.

      15.2. CUPS - RAW Print Through Mode######################################################################### +# +# And this is how it works for CUPS from 1.1.15: +# ============================================== +# +# SOMETHNG-FILEFORMAT +# | +# | +# V +# somethingtops +# | +# | +# V +# APPLICATION/POSTSCRIPT +# | +# | +# V +# pstops +# | +# | +# V +# APPLICATION/VND.CUPS-POSTSCRIPT-----+ +# | +# +------------------v------------------------------+ +# | Ghostscript | +# | at work... | +# | (with | +# | "-sDEVICE=cups") | +# | | +# | (= "postscipt interpreter") | +# | | +# +------------------v------------------------------+ +# | +# | +# APPLICATION/VND.CUPS-RASTER >-------+ +# | +# | +# V +# rastertosomething +# | (= "raster driver") +# | +# V +# SOMETHING-DEVICE-SPECIFIC +# | +# | +# V +# backend +# +# +# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to +# Ghostscript. GNU Ghostscript needs to be patched to handle the +# CUPS requirement; ESP Ghostscript has this builtin. In any case, +# "gs -h" needs to show up a "cups" device. pstoraster is now a +# calling an appropriate "gs -sDEVICE=cups..." commandline to do +# the job. It will output "application/vnd.cup-raster", which will +# be finally processed by a CUPS raster driver "rastertosomething" +# Note the difference to "cupsomatic", which will *not* output +# CUPS-raster, but a final version of the printfile, ready to be +# sent to the printer. cupsomatic also doesn't use the "cups" +# devicemode in Ghostscript, but one of the classical devicemodes.... +# +# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# +#########################################################################
      #########################################################################
+#
+# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
+# ========================================================================
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      |
+#      V
+#     somethingtops
+#      |
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      |
+#      V
+#     pstops
+#      |
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                                     |
+#                  +------------------v------------------------------+
+#                  | Ghostscript        . Ghostscript at work....    |
+#                  | at work...         . (with "-sDEVICE=           |
+#                  | (with              .            s.th."        |
+#                  | "-sDEVICE=cups")   .                            |
+#                  |                    .                            |
+#                  | (CUPS standard)    .      (cupsomatic)          |
+#                  |                    .                            |
+#                  |          (= "postscript interpreter")           |
+#                  |                    .                            |
+#                  +------------------v--------------v---------------+
+#                                     |              |
+#                                     |              |
+# APPLICATION/VND.CUPS-RASTER >-------+              |
+#      |                                             |
+#      |                                             |
+#      V                                             |
+#     rastertosomething                            |
+#      |   (= "raster driver")                       |
+#      |                                             |
+#      V                                             |
+# SOMETHING-DEVICE-SPECIFIC >------------------------+
+#      |
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+##########################################################################

      15.4. CUPS Print Drivers and Devices

      When CUPS printers are configured for RAW print-through mode operation it is the -responsibility of the Samba client to fully render the print job (file) in a format -that is suitable for direct delivery to the printer. In this case CUPS will NOT -do any print file format conversion work.

      The CUPS files that need to be correctly set for RAW mode printers to work are: +>CUPS ships with good support for HP LaserJet type printers. You can install +the driver as follows:

      • lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd +

      + +(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository +for not-yet-installed-PPDs, which CUPS typically stores in +/etc/cups/mime.types

      /usr/share/cups/model      . Alternatively, you may use +"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").

      15.4.1. Further printing steps

    • Always also consult the database on linuxprinting.org for all recommendations +about which driver is best used for each printer:

      /etc/cups/mime.convshttp://www.linuxprinting.org/printer_list.cgi

      • - -Both contain entries that must be uncommented to allow There select your model and click on "Show". You'll arrive at a page listing +all drivers working with your model. There will always be *one* +RAWrecommended mode -operation.

      one. Try this one first. In your case +("HP LaserJet 4 Plus"), you'll arrive here:

      Firstly, to enable CUPS based printing from Samba the following options must be -enabled in your smb.conf file [globals] section: - -

      http://www.linuxprinting.org/show_printer.cgi?recnum=75104

      • printing = CUPS

      • The recommended driver is "ljet4". It has a link to the page for the ljet4 +driver too:

        printcap = CUPS

      - -When these parameters are specified the print directives in smb.conf (as well as in -samba itself) will be ignored because samba will directly interface with CUPS through -it's application program interface (API) - so long as Samba has been compiled with -CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then -printing will use the System V AT&T command set with the -oraw -option automatically passing through.

      http://www.linuxprinting.org/show_driver.cgi?driver=ljet4

      Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) -on the Samba/CUPS server does *not* add any features if a file is really -printed "raw". However, if you have loaded the driver for the Windows client from -the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using -a "Foomatic" PPD, the PJL header in question is already added on the Windows client, -at the time when the driver initially generated the PostScript data and CUPS in true -"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its -printer communication backend.

      On the driver's page, you'll find important and detailed info about how to use +that driver within the various available spoolers. You can generate a PPD for +CUPS. The PPD contains all the info about how to use your model and the driver; +this is, once installed, working transparently for the user -- you'll only +need to choose resolution, paper size etc. from the web-based menu or from +the print dialog GUI or from the commandline...

      On the driver's page, choose to use the "PPD-O-Matic" online PPD generator +program. Select your model and click "Generate PPD file". When you safe the +appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt +line endings and tabs), but use "Save as..." in your browser's menu. Save it +at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"

      Then install the printer:

          "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"

      Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need +a special "CUPS filter" named "cupsomatic". Get the latest version of +"cupsomatic" from:

      http://www.linuxprinting.org/cupsomatic

      This needs to be copied to /usr/lib/cups/filter/cupsomatic +and be made world executable. This filter is needed to read and act upon the +specially encoded Foomatic comments, embedded in the printfile, which in turn +are used to construct (transparently for you, the user) the complicated +ghostscript command line needed for your printer/driver combo.

      You can have a look at all the options for the Ghostscript commandline supported +by your printer and the ljet4 driver by going to the section "Execution details", +selecting your model (Laserjet 4 Plus) and clicking on "Show execution details". +This will bring up this web page:

      http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details

      The ingenious thing is that the database is kept current. If there +is a bug fix and an improvement somewhere in the database, you will +always get the most current and stable and feature-rich driver by following +the steps described above.

      Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids -the process of determining proper treatment while in the print queue system. - -

      • The latest and greatest improvement now is support for "custom page sizes" +for all those printers which support it.

        Files generated by PCL drivers and directed at PCK printers get auto-typed as - application/octet-stream. Unknown file format types also - get auto-typed with this tag. -

      • "cupsomatic" is documented here:

        Files generated by a Postscript driver and directed at a Postscript printer - are auto-typed depending on the auto-detected most suitable MIME type as: - -

        http://www.linuxprinting.org/cups-doc.html

        • * application/postscript

        • More printing tutorial info may be found here:

          * application/vnd.cups-postscript

        -

      http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/

      "application/postscript" first goes thru the "pstops" filter (where the page counting -and accounting takes place). The outcome will be of MIME type -"application/vnd.cups-postscript". The pstopsfilter reads and uses information from -the PPD and inserts user-provided options into the PostScript file. As a consequence, -the filtered file could possibly have an unwanted PJL header.

      "application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which -have as their first character string one of "%!" or "<04>%".

      Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now +approaching the "all-time high" number of 1.000 for the supported models) +are using a special filtering chain involving Ghostscript, as described +in this document.

      "application/vnd.cups-postscript" will files which contain the string -"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the -first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes -("<1B>%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS -or other PPD, will have to be auto-typed as "vnd.cups-postscript". A file produced -with a "Generic PostScript driver" will just be tagged "application/postscript".

      Summary - You need:

      Once the file is in "application/vnd.cups-postscript" format, either "pstoraster" -or "cupsomatic" will take over (depending on the printer configuration, as -determined by the PPD in use).

      A "foomatic+something" PPD is not enough to print with CUPS (but it is *one* important component)

      A printer queue with *no* PPD associated to it is a "raw" printer and all files -will go directly there as received by the spooler. The exeptions are file types -"application/octet-stream" which need "passthrough feature" enabled. -"Raw" queues don't do any filtering at all, they hand the file directly to the -CUPS backend. This backend is responsible for the sending of the data to the device -(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://, -parallel:/, serial:/, usb:/ etc.)

      The "cupsomatic" filter script (Perl) in /usr/lib/cups/filters/
      Perl to make cupsomatic run
      Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.
      Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")

      In the case of the "hpijs" driver, you need a Ghostscript version, which +has "ijs" amongst its supported devices in "gs -h". In the case of +"hpijs+foomatic", a valid ghostscript commandline would be reading like this:

             gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
+             -sIjsServer=hpijsPageSize -dDuplex=Duplex Model        \
+             -rResolution,PS:MediaPosition=InputSlot -dIjsUseOutputFD \
+             -sOutputFile=- -

      "cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS. -They are a Third Party add-on, developed at Linuxprinting.org. As such, they are -a brilliant hack to make all models (driven by Ghostscript drivers/filters in -traditional spoolers) also work via CUPS, with the same (good or bad!) quality -as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript -commandline at that stage in the CUPS filtering chain, where "normally" the native -CUPS "pstoraster" filter would kick in. cupsomatic by-passes pstoraster, "kidnaps" -the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies:

         *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"

      This line persuades CUPS to hand the file to cupsomatic, once it has successfully -converted it to the MIME type "application/vnd.cups-postscript". This conversion will not -happen for Jobs arriving from Windows which are auto-typed "application/octet-stream", -with the according changes in "/etc/cups/mime.types" in place.

      Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic) +you don't need to remember this. You can choose the available print options +thru a GUI print command (like "glp" from ESP's commercially supported +PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent +"xpp") or the CUPS web interface via human-readable drop-down selection +menus.

      CUPS is widely configurable and flexible, even regarding its filtering mechanism. -Another workaround in some situations would be to have -in "/etc/cups/mime.types" entries as follows:

         application/postscript           application/vnd.cups-raw  0  -
-   application/vnd.cups-postscript  application/vnd.cups-raw  0  -

      This would prevent all Postscript files from being filtered (rather, they will go -thru the virtual "nullfilter" denoted with "-"). This could only be useful for -PS printers. If you want to print PS code on non-PS printers an entry as follows -could be useful:

         */*           application/vnd.cups-raw  0  -
      If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software +Products, the makers of CUPS, downloadable from +http://www.cups.org/software.html, +co-maintained by the developers of linuxprinting.org), you are guaranteed to +have in use the most uptodate, bug-fixed, enhanced and stable version of a Free +Ghostscript. It contains support for ~300 devices, whereas plain vanilla +GNU Ghostscript 7.05 only has ~200.

      and would effectively send *all* files to the backend without further processing.

      If you print only one CUPS test page, from the web interface and when you try to +print a windows test page, it acts like the job was never sent: + +

      Can you print "standard" jobs from the CUPS machine?
      Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?
      Most important: What kind of printer driver are you using on the Windows clients?

      Lastly, you could have the following entry:

         application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter

      + +You can try to get a more detailed debugging info by setting "LogLevel debug" in +/etc/cups/cupsd.conf, re-start cupsd and investigate /var/log/cups/error_log +for the whereabouts of your Windows-originating printjobs:

      You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that -parses the PostScript and removes the unwanted PJL. This would need to conform to -CUPS filter design (mainly, receive and pass the parameters printername, job-id, -username, jobtitle, copies, print options and possibly the filename). It would -be installed as world executable into "/usr/lib/cups/filters/" and will be called -by CUPS if it encounters a MIME type "application/vnd.cups-postscript".

      what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?
      are there "filter" available for this MIME type?
      are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?

      CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue -"on hold". It will only be printed upon manual release by the printer operator. -This is a requirement in many "central reproduction departments", where a few -operators manage the jobs of hundreds of users on some big machine, where no -user is allowed to have direct access. (The operators often need to load the -proper paper type before running the 10.000 page job requested by marketing -for the mailing, etc.).

      15.3. The CUPS Filter Chains15.5. Limiting the number of pages users can print

      The following diagrams reveal how CUPS handles print jobs.

      The feature you want is dependent on the real print subsystem you're using. +Samba's part is always to receive the job files from the clients (filtered +*or* unfiltered) and hand it over to this printing subsystem.

      Of course one could "hack" things with one's own scripts.

      But there is CUPS (Common Unix Printing System). CUPS supports "quotas". +Quotas can be based on sizes of jobs or on the number of pages or both, +and are spanning any time period you want.

      This is an example command how root would set a print quota in CUPS, +assuming an existing printer named "quotaprinter":

      #########################################################################
-#
-# CUPS in and of itself has this (general) filter chain (CAPITAL
-# letters are FILE-FORMATS or MIME types, other are filters (this is
-# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
-#      |           # installation on the system
-#      |  (= "postscipt interpreter")
-#      |
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      |
-#      V
-#     rastertosomething  (f.e. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      |
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      |
-#      V
-#     backend
-#
-#
-# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
-# CUPS, and also a somewhat improved "pstoraster" filter.
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
      lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100

      This would limit every single user to print 100 pages or 1024 KB of +data (whichever comes first) within the last 604.800 seconds ( = 1 week).

      For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, +otherwise it uses a "dummy" count of "1". Some printfiles don't pass it +(eg: image files) but then those are mostly 1 page jobs anyway. This also means, +proprietary drivers for the target printer running on the client computers and +CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not +filtering them), will be counted as "1-pagers" too!

      You need to send PostScript from the clients (i.e. run a PostScript driver there) +for having the chance to get accounting done. If the printer is a non-PostScript model, +you need to let CUPS do the job to convert the file to a print-ready format for the +target printer. This will be working for currently ~1.000 different printer models, see

      #########################################################################
-#
-# This is how "cupsomatic" comes into play:
-# =========================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#    somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#    pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          |
-#      |                                          V
-#      V                                         cupsomatic
-#    pstoraster                                  (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      |                                          |
-#      V                                          |
-#    rastertosomething                          V
-#      |    (= "raster driver")     +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      |                                          |
-#      V                                          |
-#    backend >------------------------------------+
-#      |
-#      |
-#      V
-#    THE PRINTER
-#
-#
-# Note, that cupsomatic "kidnaps" the printfile after the
-# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through
-# the CUPS-external, systemwide Ghostscript installation, bypassing the
-# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers
-# "rastertosomething", and hands the rasterized file directly to the CUPS
-# backend...
-#
-# cupsomatic is not made by the CUPS developers. It is an independent
-# contribution to printing development, made by people from
-# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
      #########################################################################
-#
-# And this is how it works for ESP PrintPro from 4.3:
-# ===================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      |
-#      V
-#     gsrip
-#      |  (= "postscipt interpreter")
-#      |
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      |
-#      V
-#     rastertosomething  (f.e. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      |
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      |
-#      V
-#     backend
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
      http://www.linuxprinting.org/printer_list.cgi

      Before CUPS-1.1.16 your only option was to use the Adobe PostScript +Driver on the Windows clients. The output of this driver was not always +passed thru the "pstops" filter on the CUPS/Samba side, and therefor was +not counted correctly (the reason is that it often --- depending on the +"PPD" being used --- did write a "PJL"-header in front of the real +PostScript which made CUPS to skip the pstops and go directy to +the "pstoraster" stage).

      From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver +for Windows NT/2K/XP clients" (it is tagged in the download area of +http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). +It is *not* working for Win9x/ME clients. But it:

      >it guarantees to not write an PJL-header
      it guarantees to still read and support all PJL-options named in the driver PPD with its own means
      it guarantees the file going thru the "pstops" filter on the CUPS/Samba server
      it guarantees to page-count correctly the printfile

      You can read more about the setup of this combination in the +manpage for "cupsaddsmb" (only present with CUPS installed, only +current with CUPS 1.1.16).

      These are the items CUPS logs in the "page_log" for every single *page* of a job:

      #########################################################################
-#
-# This is how "cupsomatic" would come into play with ESP PrintPro:
-# ================================================================
-#
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#    somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#    pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          |
-#      |                                          V
-#      V                                         cupsomatic
-#    gsrip                                       (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      |                                          |
-#      V                                          |
-#    rastertosomething                          V
-#      |   (= "raster driver")      +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      |                                          |
-#      V                                          |
-#    backend >------------------------------------+
-#      |
-#      |
-#      V
-#    THE PRINTER
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
      * Printer name + * User name + * Job ID + * Time of printing + * the page number + * the number of copies + * a billing info string (optional)

      Here is an extract of my CUPS server's page_log file to illustrate +the format and included items:

      #########################################################################
-#
-# And this is how it works for CUPS from 1.1.15:
-# ==============================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                                     |
-#                  +------------------v------------------------------+
-#                  | Ghostscript                                     |
-#                  | at work...                                      |
-#                  | (with                                           |
-#                  | "-sDEVICE=cups")                                |
-#                  |                                                 |
-#                  |         (= "postscipt interpreter")             |
-#                  |                                                 |
-#                  +------------------v------------------------------+
-#                                     |
-#                                     |
-# APPLICATION/VND.CUPS-RASTER >-------+
-#      |
-#      |
-#      V
-#     rastertosomething
-#      |   (= "raster driver")
-#      |
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
-#       Ghostscript. GNU Ghostscript needs to be patched to handle the
-#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
-#       "gs -h" needs to show up a "cups" device. pstoraster is now a
-#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
-#       the job. It will output "application/vnd.cup-raster", which will
-#       be finally processed by a CUPS raster driver "rastertosomething"
-#       Note the difference to "cupsomatic", which will *not* output
-#       CUPS-raster, but a final version of the printfile, ready to be
-#       sent to the printer. cupsomatic also doesn't use the "cups"
-#       devicemode in Ghostscript, but one of the classical devicemodes....
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
      infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2 #marketing + infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2 #marketing + infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2 #marketing + infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2 #marketing + infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2 #marketing + infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2 #marketing

      This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job +printed in 2 copies and billed to "#marketing"...

      What flaws or shortcomings are there?

      the ones named above
      CUPS really counts the job pages being *processsed in software* + (going thru the "RIP") rather than the physical sheets successfully + leaving the printing device -- if there is a jam while printing + the 5th sheet out of 1000 and the job is aborted by the printer, + the "page count" will still show the figure of 1000 for that job +
      all quotas are the same for all users (no flexibility to give the + boss a higher quota than the clerk) no support for groups +
      no means to read out the current balance or "used-up" number of current quota +
      a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job +
      a user being denied a job because of a filled-up quota doesn't get a meaningful + error message from CUPS other than "client-error-not-possible". +

      But this is the best system out there currently. And there are +huge improvements under development:

      page counting will go into the "backends" (these talk + directly to the printer and will increase the count in sync with the + actual printing process -- a jam at the 5th sheet will lead to a stop in the counting)
      quotas will be handled more flexibly
      probably there will be support for users to inquire their "accounts" in advance
      probably there will be support for some other tools around this topic

      Other than the current stage of the CUPS development, I don't +know any other ready-to-use tool which you could consider.

      You can download the driver files from +http://www.cups.org/software.html. +It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16 +Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to +download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal +the files:

      #########################################################################
-#
-# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
-# ========================================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                                     |
-#                  +------------------v------------------------------+
-#                  | Ghostscript        . Ghostscript at work....    |
-#                  | at work...         . (with "-sDEVICE=           |
-#                  | (with              .            s.th."        |
-#                  | "-sDEVICE=cups")   .                            |
-#                  |                    .                            |
-#                  | (CUPS standard)    .      (cupsomatic)          |
-#                  |                    .                            |
-#                  |          (= "postscript interpreter")           |
-#                  |                    .                            |
-#                  +------------------v--------------v---------------+
-#                                     |              |
-#                                     |              |
-# APPLICATION/VND.CUPS-RASTER >-------+              |
-#      |                                             |
-#      |                                             |
-#      V                                             |
-#     rasterto   cups-samba.install
+   cups-samba.license
+   cups-samba.readme
+   cups-samba.remove
+   cups-samba.ss

      These have been packaged with the ESP meta packager software "EPM". The +*.install and *.remove files are simple shell script, which untars the +*.ss (which is nothing else than a tar-archive) and puts its contents +into /usr/share/cups/drivers/. Its contents are 3 files:

         cupsdrvr.dll
+   cupsui.dll
+   cups.hlp

      ATTENTION: due to a bug one CUPS release puts the cups.hlp +into /usr/share/drivers/ instead of +/usr/share/cups/drivers/. To work around this, copy/move +the file after running the "./cups-samba.install" script manually to the right place:

            cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/

      This new CUPS PostScript driver is currently binary-only, but free +no source code is provided (yet). The reason is this: it has +been developed with the help of the Microsoft Driver Developer Kit (DDK) +and compiled with Microsoft Visual Studio 6. It is not clear to the driver +developers if they are allowed to distribute the whole of the source code +as Free Software. However, they will likely release the "diff" in source +code under the GPL, so anybody with a license of Visual Studio and a DDK +will be able to compile for him/herself.

      Once you have run the install script (and possibly manually moved the +"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be +put into Samba's [print$] share (which often maps to "/etc/samba/drivers/" +and contains a subdir tree with WIN40 and W32X86 branches), by running +"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to +put root into the smbpasswd file by running "smbpasswd" should you run +this whole procedure for the first time.] Once the driver files are in the +[print$] share, they are ready to be downloaded and installed by the +Win NT/2k/XP clients.

      NOTE 1: Win 9x/ME clients won't work with this driver. For these you'd +still need to use the ADOBE*.* drivers as previously.

      NOTE 2: It is not harming if you've still the ADOBE*.* driver files from +previous installations in the "/usr/share/cups/drivers/" directory. +The new cupsaddsmb (from 1.1.16) will automatically use the +"newest" installed driver (which here then is the CUPS drivers).

      NOTE 3: Should your Win clients have had the old ADOBE*.* files and the +Adobe PostScript drivers installed, the download and installation +of the new CUPS PostScript driver for Windows NT/2k/XP will fail +at first.

      It is not enough to "delete" the printer (as the driver files +will still be kept by the clients and re-used if you try to +re-install the printer). To really get rid of the Adobe driver +files on the clients, open the "Printers" folder (possibly via +"Start --> Settings --> Control Panel --> Printers"), right-click +onto the folder background and select "Server Properties". A +new dialog opens; select the "Drivers" tab; on the list select +the driver you want to delete and click on the "Delete" button. +(This will only work if there is no single printer left which +uses that particular driver -- you need to "delete" all printers +using this driver in the "Printers" folder first.)

      Once you have successfully downloaded the CUPS PostScript driver +to a client, you can easily switch all printers to this one +by proceeding as described elsewhere in the "Samba HOWTO +Collection" to change a driver for an existing printer.

      What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP" +as compared to the Adobe drivers?

      • no hassle with the Adobe EULA +

      • no hassle with the question "where do I get the ADOBE*.* driver files from?" +

      • the Adobe drivers (depending on the printer PPD associated with them) + often put a PJL header in front of the core PostScript part of the print + file (thus the file starts with "something | -# | (= "raster driver") | -# | | -# V | -# SOMETHING-DEVICE-SPECIFIC >------------------------+ -# | -# | -# V -# backend -# -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rasterto1B%-12345X" or "something is noted. -# -##########################################################################escape%-12345X" + instead of "%!PS"). This leads to the CUPS daemon autotyping the + arriving file as a print-ready file, not requiring a pass thru the + "pstops" filter (to speak more technical, it is not regarded as the + generic MIME type "application/postscript", but as the more special + MIME type "application/cups.vnd-postscript"), which therefore also + leads to the page accounting in "/var/log/cups/page_log" not receiving + the exact mumber of pages; instead the dummy page number of "1" is + logged in a standard setup) +

      • the Adobe driver has more options to "mis-configure" the PostScript + generated by it (like setting it inadvertedly to "Optimize for Speed", + instead of "Optimize for Portability", which could lead to CUPS being + unable to process it) +

      • the CUPS PostScript driver output sent by Windows clients to the CUPS + server will be guaranteed to be auto-typed as generic MIME type + "application/postscript", thusly passing thru the CUPS "pstops" filter + and logging the correct number of pages in the page_log for accounting + and quota purposes +

      • the CUPS PostScript driver supports the sending of additional print + options by the Win NT/2k/XP clients, such as naming the CUPS standard + banner pages (or the custom ones, should they be installed at the time + of driver download), using the CUPS "page-label" option, setting a + job-priority and setting the scheduled time of printing (with the option + to support additional useful IPP job attributes in the future). +

      • the CUPS PostScript driver supports the inclusion of the new + "*cupsJobTicket" comments at the beginnig of the PostScript file (which + could be used in the future for all sort of beneficial extensions on + the CUPS side, but which will not disturb any other application as those + will regard it as a comment and simply ignore it). +

      • the CUPS PostScript driver will be the heart of the fully fledged CUPS + IPP client for Windows NT/2k/XP to be released soon (probably alongside + the first Beta release for CUPS 1.2). +

      15.4. CUPS Print Drivers and Devices15.6. Advanced Postscript Printing from MS Windows

      CUPS ships with good support for HP LaserJet type printers. You can install -the driver as follows: - -

      • Let the Windows Clients use a PostScript driver to deliver poistscript to +the samba print server (just like any Linux or Unix Client would also use +PostScript to send to the server)

        lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd -

      - -(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository -for not-yet-installed-PPDs, which CUPS typically stores in -/usr/share/cups/model. Alternatively, you may use -"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").

      15.4.1. Further printing steps

      Make the Unix printing subsystem to which Samba sends the job convert the +incoming PostScript files to the native print format of the target printers +(would be PCL if you have an HP printer)

      Always also consult the database on linuxprinting.org for all recommendations -about which driver is best used for each printer:

      Now if you are afraid that this would just mean using a *Generic* PostScript +driver for the clients that has no Simplex/Duplex selection, and no paper tray +choice, but you need them to be able to set up print jobs, with all the bells +and whistles of your printers:-

      http://www.linuxprinting.org/printer_list.cgi

      Not possible with traditional spooling systems
      But perfectly supported by CUPS (which uses "PPD" files to + describe how to control the print options for PostScript and + non-PostScript devices alike... +

      There select your model and click on "Show". You'll arrive at a page listing -all drivers working with your model. There will always be *one* -recommended one. Try this one first. In your case -("HP LaserJet 4 Plus"), you'll arrive here:

      CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript +drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use +them to setup the job to their liking and CUPS will use the received job options +to make the (PCL-, ESC/P- or PostScript-) printer behave as required.

      If you want to have the additional benefit of page count logging and accounting +then the CUPS PostScript driver is the best choice (better than the Adobe one).

      If you want to make the drivers downloadable for the clients then "cupsaddsmb" is +your friend. It will setup the [print$] share on the Samba host to be ready to serve +the clients for a "point and print" driver installation.

      http://www.linuxprinting.org/show_printer.cgi?recnum=75104

      The recommended driver is "ljet4". It has a link to the page for the ljet4 -driver too:

      What strings are attached?

      http://www.linuxprinting.org/show_driver.cgi?driver=ljet4

      There are some. But, given the sheer CPU power you can buy nowadays, +these can be overcome easily. The strings:

      On the driver's page, you'll find important and detailed info about how to use -that driver within the various available spoolers. You can generate a PPD for -CUPS. The PPD contains all the info about how to use your model and the driver; -this is, once installed, working transparently for the user -- you'll only -need to choose resolution, paper size etc. from the web-based menu or from -the print dialog GUI or from the commandline...

      Well, if the CUPS/Samba side will have to print to many printers serving many users, +you probably will need to set up a second server (which can do automatic load balancing +with the first one, plus a degree of fail-over mechanism). Converting the incoming +PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work +of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM +than for the mere "raw spooling" task your current setup is solving. It all depends +on the avarage and peak printing load the server should be able to handle.

      15.7. Auto-Deletion of CUPS spool files

      On the driver's page, choose to use the "PPD-O-Matic" online PPD generator -program. Select your model and click "Generate PPD file". When you safe the -appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt -line endings and tabs), but use "Save as..." in your browser's menu. Save it -at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"

      Samba print files pass thru two "spool" directories. One the incoming directory +managed by Samba, (set eg: in the "path = /var/spool/samba" directive in the [printers] +section of "smb.conf"). Second is the spool directory of your UNIX print subsystem. +For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive +"RequestRoot /var/spool/cups".

      Then install the printer:

      I am not sure, which one of your directories keeps the files. From what you say, +it is most likely the Samba part.

      For the CUPS part, you may want to consult:

          "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"

      http://localhost:631/sam.html#PreserveJobFiles and + http://localhost:631/sam.html#PreserveJobHistory and + http://localhost:631/sam.html#MaxJobs

      Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need -a special "CUPS filter" named "cupsomatic". Get the latest version of -"cupsomatic" from:

      There are the settings described for your CUPS daemon, which could lead to completed +job files not being deleted.

      http://www.linuxprinting.org/cupsomatic

      "PreserveJobHistory Yes" -- keeps some details of jobs in +cupsd's mind (well it keeps the "c12345", "c12346" etc. files +in the CUPS spool directory, which do a similar job as the +old-fashioned BSD-LPD control files). This is set to "Yes" +as a default.

      This needs to be copied to /usr/lib/cups/filter/cupsomatic -and be made world executable. This filter is needed to read and act upon the -specially encoded Foomatic comments, embedded in the printfile, which in turn -are used to construct (transparently for you, the user) the complicated -ghostscript command line needed for your printer/driver combo.

      "PreserveJobFiles Yes" -- keeps the job files themselves in +cupsd's mind (well it keeps the "d12345", "d12346" etc. files +in the CUPS spool directory...). This is set to "No" as the +CUPS default.

      You can have a look at all the options for the Ghostscript commandline supported -by your printer and the ljet4 driver by going to the section "Execution details", -selecting your model (Laserjet 4 Plus) and clicking on "Show execution details". -This will bring up this web page:

      "MaxJobs 500" -- this directive controls the maximum number +of jobs that are kept in memory. Once the number of jobs +reaches the limit, the oldest completed job is automatically +purged from the system to make room for the new one. If all +of the known jobs are still pending or active then the new +job will be rejected. Setting the maximum to 0 disables this +functionality. The default setting is 0.

      (There are also additional settings for "MaxJobsPerUser" and +"MaxJobsPerPrinter"...)

      For everything to work as announced, you need to have three things:

      http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details

      a Samba-smbd which is compiled against "libcups" (Check on Linux by running "ldd `which smbd`") +
      a Samba-smb.conf setting of "printing = cups" +
      another Samba-smb.conf setting of "printcap = cups" +

      The ingenious thing is that the database is kept current. If there -is a bug fix and an improvement somewhere in the database, you will -always get the most current and stable and feature-rich driver by following -the steps described above.

      Till Kamppeter from MandrakeSoft is doing an excellent job here that too few -people are aware of. (So if you use it often, please send him a note showing -your appreciation).

      Note, that in this case all other manually set printing-related +commands (like "print command", "lpq command", "lprm command", +"lppause command" or "lpresume command") are ignored and they +should normally have no influence what-so-ever on your printing.

      The latest and greatest improvement now is support for "custom page sizes" -for all those printers which support it.

      If you want to do things manually, replace the "printing = cups" +by "printing = bsd". Then your manually set commands may work +(haven't tested this), and a "print command = lp -d %P %s; rm %s" +may do what you need.

      "cupsomatic" is documented here:

      You forgot to mention the CUPS version you're using. If you did +set things up as described in the man pages, then the Samba +spool files should be deleted. Otherwise it may be a bug. On +the CUPS side, you can control the behaviour as described +above.

      If you have more problems, post the output of these commands:

         grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"

      (adapt paths as needed). These commands sanitize the files +and cut out the empty lines and lines with comments, providing +the "naked settings" in a compact way.

      http://www.linuxprinting.org/cups-doc.htmlChapter 16. Unified Logons between Windows NT and UNIX using Winbind

      16.1. Abstract

      Integration of UNIX and Microsoft Windows NT through + a unified logon has been considered a "holy grail" in heterogeneous + computing environments for a long time. We present + winbind, a component of the Samba suite + of programs as a solution to the unified logon problem. Winbind + uses a UNIX implementation + of Microsoft RPC calls, Pluggable Authentication Modules, and the Name + Service Switch to allow Windows NT domain users to appear and operate + as UNIX users on a UNIX machine. This paper describes the winbind + system, explaining the functionality it provides, how it is configured, + and how it works internally.

      16.2. Introduction

      It is well known that UNIX and Microsoft Windows NT have + different models for representing user and group information and + use different technologies for implementing them. This fact has + made it difficult to integrate the two systems in a satisfactory + manner.

      One common solution in use today has been to create + identically named user accounts on both the UNIX and Windows systems + and use the Samba suite of programs to provide file and print services + between the two. This solution is far from perfect however, as + adding and deleting users on both sets of machines becomes a chore + and two sets of passwords are required both of which + can lead to synchronization problems between the UNIX and Windows + systems and confusion for users.

      We divide the unified logon problem for UNIX machines into + three smaller problems:

      • More printing tutorial info may be found here:

        Obtaining Windows NT user and group information +

      • Authenticating Windows NT users +

      • Password changing for Windows NT users +

      Ideally, a prospective solution to the unified logon problem + would satisfy all the above components without duplication of + information on the UNIX machines and without creating additional + tasks for the system administrator when maintaining users and + groups on either system. The winbind system provides a simple + and elegant solution to all three components of the unified logon + problem.

      16.3. What Winbind Provides

      Winbind unifies UNIX and Windows NT account management by + allowing a UNIX box to become a full member of a NT domain. Once + this is done the UNIX box will see NT users and groups as if + they were native UNIX users and groups, allowing the NT domain + to be used in much the same manner that NIS+ is used within + UNIX-only environments.

      The end result is that whenever any + program on the UNIX machine asks the operating system to lookup + a user or group name, the query will be resolved by asking the + NT domain controller for the specified domain to do the lookup. + Because Winbind hooks into the operating system at a low level + (via the NSS name resolution modules in the C library) this + redirection to the NT domain controller is completely + transparent.

      Users on the UNIX machine can then use NT user and group + names as they would use "native" UNIX names. They can chown files + so that they are owned by NT domain users or even login to the + UNIX machine and run a UNIX X-Window session as a domain user.

      The only obvious indication that Winbind is being used is + that user and group names take the form DOMAIN\user and + DOMAIN\group. This is necessary as it allows Winbind to determine + that redirection to a domain controller is wanted for a particular + lookup and which trusted domain is being referenced.

      Additionally, Winbind provides an authentication service + that hooks into the Pluggable Authentication Modules (PAM) system + to provide authentication via a NT domain to any PAM enabled + applications. This capability solves the problem of synchronizing + passwords between systems since all passwords are stored in a single + location (on the domain controller).

      16.3.1. Target Uses

      Winbind is targeted at organizations that have an + existing NT based domain infrastructure into which they wish + to put UNIX workstations or servers. Winbind will allow these + organizations to deploy UNIX workstations without having to + maintain a separate account infrastructure. This greatly + simplifies the administrative overhead of deploying UNIX + workstations into a NT based organization.

      Another interesting way in which we expect Winbind to + be used is as a central part of UNIX based appliances. Appliances + that provide file and print services to Microsoft based networks + will be able to use Winbind to provide seamless integration of + the appliance into the domain.

      16.4. How Winbind Works

      The winbind system is designed around a client/server + architecture. A long running winbindd daemon + listens on a UNIX domain socket waiting for requests + to arrive. These requests are generated by the NSS and PAM + clients and processed sequentially.

      The technologies used to implement winbind are described + in detail below.

      16.4.1. Microsoft Remote Procedure Calls

      Over the last few years, efforts have been underway + by various Samba Team members to decode various aspects of + the Microsoft Remote Procedure Call (MSRPC) system. This + system is used for most network related operations between + Windows NT machines including remote management, user authentication + and print spooling. Although initially this work was done + to aid the implementation of Primary Domain Controller (PDC) + functionality in Samba, it has also yielded a body of code which + can be used for other purposes.

      Winbind uses various MSRPC calls to enumerate domain users + and groups and to obtain detailed information about individual + users or groups. Other MSRPC calls can be used to authenticate + NT domain users and to change user passwords. By directly querying + a Windows PDC for user and group information, winbind maps the + NT account information onto UNIX user and group names.

      http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/

      16.4.2. Microsoft Active Directory Services

      Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now -approaching the "all-time high" number of 1.000 for the supported models) -are using a special filtering chain involving Ghostscript, as described -in this document.

      Since late 2001, Samba has gained the ability to + interact with Microsoft Windows 2000 using its 'Native + Mode' protocols, rather than the NT4 RPC services. + Using LDAP and Kerberos, a domain member running + winbind can enumerate users and groups in exactly the + same way as a Win2k client would, and in so doing + provide a much more efficient and + effective winbind implementation. +

      16.4.3. Name Service Switch

      Summary - You need:

      The Name Service Switch, or NSS, is a feature that is + present in many UNIX operating systems. It allows system + information such as hostnames, mail aliases and user information + to be resolved from different sources. For example, a standalone + UNIX workstation may resolve system information from a series of + flat files stored on the local filesystem. A networked workstation + may first attempt to resolve system information from local files, + and then consult a NIS database for user information or a DNS server + for hostname information.

      The NSS application programming interface allows winbind + to present itself as a source of system information when + resolving UNIX usernames and groups. Winbind uses this interface, + and information obtained from a Windows NT server using MSRPC + calls to provide a new source of account enumeration. Using standard + UNIX library calls, one can enumerate the users and groups on + a UNIX machine running winbind and see all users and groups in + a NT domain plus any trusted domain as though they were local + users and groups.

      A "foomatic+something" PPD is not enough to print with CUPS (but it is *one* important component)
      The "cupsomatic" filter script (Perl) in The primary control file for NSS is + /usr/lib/cups/filters/
      Perl to make cupsomatic run
      Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.
      Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")

      In the case of the "hpijs" driver, you need a Ghostscript version, which -has "ijs" amongst its supported devices in "gs -h". In the case of -"hpijs+foomatic", a valid ghostscript commandline would be reading like this:

      /etc/nsswitch.conf      . + When a UNIX application makes a request to do a lookup + the C library looks in /etc/nsswitch.conf + for a line which matches the service type being requested, for + example the "passwd" service type is used when user or group names + are looked up. This config line species which implementations + of that service should be tried and in what order. If the passwd + config line is:

             gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
-             -sIjsServer=hpijsPageSize -dDuplex=Duplex Model        \
-             -rResolution,PS:MediaPosition=InputSlot -dIjsUseOutputFD \
-             -sOutputFile=- -
      passwd: files example

      then the C library will first load a module called + /lib/libnss_files.so followed by + the module /lib/libnss_example.so. The + C library will dynamically load each of these modules in turn + and call resolver functions within the modules to try to resolve + the request. Once the request is resolved the C library returns the + result to the application.

      Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic) -you don't need to remember this. You can choose the available print options -thru a GUI print command (like "glp" from ESP's commercially supported -PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent -"xpp") or the CUPS web interface via human-readable drop-down selection -menus.

      This NSS interface provides a very easy way for Winbind + to hook into the operating system. All that needs to be done + is to put libnss_winbind.so in /lib/ + then add "winbind" into /etc/nsswitch.conf at + the appropriate place. The C library will then call Winbind to + resolve user and group names.

      16.4.4. Pluggable Authentication Modules

      If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software -Products, the makers of CUPS, downloadable from -http://www.cups.org/software.html, -co-maintained by the developers of linuxprinting.org), you are guaranteed to -have in use the most uptodate, bug-fixed, enhanced and stable version of a Free -Ghostscript. It contains support for ~300 devices, whereas plain vanilla -GNU Ghostscript 7.05 only has ~200.

      Pluggable Authentication Modules, also known as PAM, + is a system for abstracting authentication and authorization + technologies. With a PAM module it is possible to specify different + authentication methods for different system applications without + having to recompile these applications. PAM is also useful + for implementing a particular policy for authorization. For example, + a system administrator may only allow console logins from users + stored in the local password file but only allow users resolved from + a NIS database to log in over the network.

      If you print only one CUPS test page, from the web interface and when you try to -print a windows test page, it acts like the job was never sent: - -

      Can you print "standard" jobs from the CUPS machine?
      Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?
      Most important: What kind of printer driver are you using on the Windows clients?
      Winbind uses the authentication management and password + management PAM interface to integrate Windows NT users into a + UNIX system. This allows Windows NT users to log in to a UNIX + machine and be authenticated against a suitable Primary Domain + Controller. These users can also change their passwords and have + this change take effect directly on the Primary Domain Controller. +

      - -You can try to get a more detailed debugging info by setting "LogLevel debug" in -PAM is configured by providing control files in the directory + /etc/pam.d/ for each of the services that + require authentication. When an authentication request is made + by an application the PAM code in the C library looks up this + control file to determine what modules to load to do the + authentication check and in what order. This interface makes adding + a new authentication service for Winbind very easy, all that needs + to be done is that the /etc/cups/cupsd.conf, re-start cupsd and investigate pam_winbind.so module + is copied to /var/log/cups/error_log -for the whereabouts of your Windows-originating printjobs:

      /lib/security/       and the PAM + control files for relevant services are updated to allow + authentication via winbind. See the PAM documentation + for more details.

      16.4.5. User and Group ID Allocation

      what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?
      are there "filter" available for this MIME type?
      are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?
      When a user or group is created under Windows NT + is it allocated a numerical relative identifier (RID). This is + slightly different to UNIX which has a range of numbers that are + used to identify users, and the same range in which to identify + groups. It is winbind's job to convert RIDs to UNIX id numbers and + vice versa. When winbind is configured it is given part of the UNIX + user id space and a part of the UNIX group id space in which to + store Windows NT users and groups. If a Windows NT user is + resolved for the first time, it is allocated the next UNIX id from + the range. The same process applies for Windows NT groups. Over + time, winbind will have mapped all Windows NT users and groups + to UNIX user ids and group ids.

      The results of this mapping are stored persistently in + an ID mapping database held in a tdb database). This ensures that + RIDs are mapped to UNIX IDs in a consistent way.

      16.4.6. Result Caching

      An active system can generate a lot of user and group + name lookups. To reduce the network cost of these lookups winbind + uses a caching scheme based on the SAM sequence number supplied + by NT domain controllers. User or group information returned + by a PDC is cached by winbind along with a sequence number also + returned by the PDC. This sequence number is incremented by + Windows NT whenever any user or group information is modified. If + a cached entry has expired, the sequence number is requested from + the PDC and compared against the sequence number of the cached entry. + If the sequence numbers do not match, then the cached information + is discarded and up to date information is requested directly + from the PDC.

      15.5. Limiting the number of pages users can print16.5. Installation and Configuration

      The feature you want is dependent on the real print subsystem you're using. -Samba's part is always to receive the job files from the clients (filtered -*or* unfiltered) and hand it over to this printing subsystem.

      Many thanks to John Trostel jtrostel@snapserver.com +for providing the HOWTO for this section.

      Of course one could "hack" things with one's own scripts.

      This HOWTO describes how to get winbind services up and running +to control access and authenticate users on your Linux box using +the winbind services which come with SAMBA 2.2.2.

      16.5.1. Introduction

      But there is CUPS (Common Unix Printing System). CUPS supports "quotas". -Quotas can be based on sizes of jobs or on the number of pages or both, -and are spanning any time period you want.

      This HOWTO describes the procedures used to get winbind up and +running on my RedHat 7.1 system. Winbind is capable of providing access +and authentication control for Windows Domain users through an NT +or Win2K PDC for 'regular' services, such as telnet a nd ftp, as +well for SAMBA services.

      This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter":

        lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
      This HOWTO has been written from a 'RedHat-centric' perspective, so if +you are using another distribution, you may have to modify the instructions +somewhat to fit the way your distribution works.

      This would limit every single user to print 100 pages or 1024 KB of -data (whichever comes first) within the last 604.800 seconds ( = 1 week).

      • For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, -otherwise it uses a "dummy" count of "1". Some printfiles don't pass it -(eg: image files) but then those are mostly 1 page jobs anyway. This also means, -proprietary drivers for the target printer running on the client computers and -CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too!

        Why should I to this? +

        You need to send PostScript from the clients (i.e. run a PostScript driver there) -for having the chance to get accounting done. If the printer is a non-PostScript model, -you need to let CUPS do the job to convert the file to a print-ready format for the -target printer. This will be working for currently ~1.000 different printer models, see

             http://www.linuxprinting.org/printer_list.cgi
        This allows the SAMBA administrator to rely on the + authentication mechanisms on the NT/Win2K PDC for the authentication + of domain members. NT/Win2K users no longer need to have separate + accounts on the SAMBA server. +

      • Before CUPS-1.1.16 your only option was to use the Adobe PostScript -Driver on the Windows clients. The output of this driver was not always -passed thru the "pstops" filter on the CUPS/Samba side, and therefor was -not counted correctly (the reason is that it often --- depending on the -"PPD" being used --- did write a "PJL"-header in front of the real -PostScript which made CUPS to skip the pstops and go directy to -the "pstoraster" stage).

        Who should be reading this document? +

        From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver -for Windows NT/2K/XP clients" (it is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). -It is *not* working for Win9x/ME clients. But it:

        This HOWTO is designed for system administrators. If you are + implementing SAMBA on a file server and wish to (fairly easily) + integrate existing NT/Win2K users from your PDC onto the + SAMBA server, this HOWTO is for you. That said, I am no NT or PAM + expert, so you may find a better or easier way to accomplish + these tasks. +

      16.5.2. Requirements

      If you have a samba configuration file that you are currently +using... BACK IT UP! If your system already uses PAM, +back up the /etc/pam.d directory +contents! If you haven't already made a boot disk, +MAKE ONE NOW!

      >it guarantees to not write an PJL-header
      it guarantees to still read and support all PJL-options named in the driver PPD with its own means
      it guarantees the file going thru the "pstops" filter on the CUPS/Samba server
      it guarantees to page-count correctly the printfile

      Messing with the pam configuration files can make it nearly impossible +to log in to yourmachine. That's why you want to be able to boot back +into your machine in single user mode and restore your +/etc/pam.d back to the original state they were in if +you get frustrated with the way things are going. ;-)

      You can read more about the setup of this combination in the -manpage for "cupsaddsmb" (only present with CUPS installed, only -current with CUPS 1.1.16).

      The latest version of SAMBA (version 3.0 as of this writing), now +includes a functioning winbindd daemon. Please refer to the +main SAMBA web page or, +better yet, your closest SAMBA mirror site for instructions on +downloading the source code.

      These are the items CUPS logs in the "page_log" for every single *page* of a job:

      To allow Domain users the ability to access SAMBA shares and +files, as well as potentially other services provided by your +SAMBA machine, PAM (pluggable authentication modules) must +be setup properly on your machine. In order to compile the +winbind modules, you should have at least the pam libraries resident +on your system. For recent RedHat systems (7.1, for instance), that +means pam-0.74-22. For best results, it is helpful to also +install the development packages in pam-devel-0.74-22.

      16.5.3. Testing Things Out

      	* Printer name
-	* User name
-	* Job ID
-	* Time of printing
-	* the page number
-	* the number of copies
-	* a billing info string (optional)

      Before starting, it is probably best to kill off all the SAMBA +related daemons running on your server. Kill off all smbd, +nmbd, and winbindd processes that may +be running. To use PAM, you will want to make sure that you have the +standard PAM package (for RedHat) which supplies the /etc/pam.d +directory structure, including the pam modules are used by pam-aware +services, several pam libraries, and the /usr/doc +and /usr/man entries for pam. Winbind built better +in SAMBA if the pam-devel package was also installed. This package includes +the header files needed to compile pam-aware applications. For instance, +my RedHat system has both pam-0.74-22 and +pam-devel-0.74-22 RPMs installed.

      16.5.3.1. Configure and compile SAMBA

      Here is an extract of my CUPS server's page_log file to illustrate -the format and included items:

      The configuration and compilation of SAMBA is pretty straightforward. +The first three steps may not be necessary depending upon +whether or not you have previously built the Samba binaries.

      	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2  #marketing
-	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2  #marketing
-	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2  #marketing
-	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2  #marketing
-	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2  #marketing
-	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2  #marketing
      root# autoconf +root# make clean +root# rm config.cache +root# ./configure +root# make +root# make install

      This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job -printed in 2 copies and billed to "#marketing"...

      What flaws or shortcomings are there?

      This will, by default, install SAMBA in /usr/local/samba. +See the main SAMBA documentation if you want to install SAMBA somewhere else. +It will also build the winbindd executable and libraries.

      16.5.3.2. Configure nsswitch.conf and the +winbind libraries

      the ones named above
      CUPS really counts the job pages being *processsed in software* - (going thru the "RIP") rather than the physical sheets successfully - leaving the printing device -- if there is a jam while printing - the 5th sheet out of 1000 and the job is aborted by the printer, - the "page count" will still show the figure of 1000 for that job -
      all quotas are the same for all users (no flexibility to give the - boss a higher quota than the clerk) no support for groups -
      no means to read out the current balance or "used-up" number of current quota -
      a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job -
      a user being denied a job because of a filled-up quota doesn't get a meaningful - error message from CUPS other than "client-error-not-possible". -
      The libraries needed to run the winbindd daemon +through nsswitch need to be copied to their proper locations, so

      root# cp ../samba/source/nsswitch/libnss_winbind.so /lib

      But this is the best system out there currently. And there are -huge improvements under development:

      page counting will go into the "backends" (these talk - directly to the printer and will increase the count in sync with the - actual printing process -- a jam at the 5th sheet will lead to a stop in the counting)
      quotas will be handled more flexibly
      probably there will be support for users to inquire their "accounts" in advance
      probably there will be support for some other tools around this topic
      I also found it necessary to make the following symbolic link:

      root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2

      Other than the current stage of the CUPS development, I don't -know any other ready-to-use tool which you could consider.

      You can download the driver files from -http://www.cups.org/software.html. -It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16 -Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to -download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal -the files:

         cups-samba.install
-   cups-samba.license
-   cups-samba.readme
-   cups-samba.remove
-   cups-samba.ss
      And, in the case of Sun solaris:

      root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 +root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 +root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2

      These have been packaged with the ESP meta packager software "EPM". The -*.install and *.remove files are simple shell script, which untars the -*.ss (which is nothing else than a tar-archive) and puts its contents -into Now, as root you need to edit /usr/share/cups/drivers/. Its contents are 3 files:

      /etc/nsswitch.conf to +allow user and group entries to be visible from the winbindd +daemon. My /etc/nsswitch.conf file look like +this after editing:

         cupsdrvr.dll
-   cupsui.dll
-   cups.hlp
      passwd: files winbind + shadow: files + group: files winbind

      +The libraries needed by the winbind daemon will be automatically +entered into the ldconfig cache the next time +your system reboots, but it +is faster (and you don't need to reboot) if you do it manually:

      root# /sbin/ldconfig -v | grep winbind

      ATTENTION: due to a bug one CUPS release puts the This makes cups.hlp -into libnss_winbind available to winbindd +and echos back a check to you.

      16.5.3.3. Configure smb.conf

      Several parameters are needed in the smb.conf file to control +the behavior of winbindd. Configure +/usr/share/drivers/ instead of +>smb.conf These are described in more detail in +the winbindd(8) man page. My /usr/share/cups/drivers/. To work around this, copy/move -the file after running the "./cups-samba.install" script manually to the right place:

      smb.conf file was modified to +include the following entries in the [global] section:

            cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
      [global] + <...> + # separate domain and username with '+', like DOMAIN+username + winbind separator = + + # use uids from 10000 to 20000 for domain users + winbind uid = 10000-20000 + # use gids from 10000 to 20000 for domain groups + winbind gid = 10000-20000 + # allow enumeration of winbind users and groups + winbind enum users = yes + winbind enum groups = yes + # give winbind users a real shell (only needed if they have telnet access) + template homedir = /home/winnt/%D/%U + template shell = /bin/bash

      This new CUPS PostScript driver is currently binary-only, but free -no source code is provided (yet). The reason is this: it has -been developed with the help of the Microsoft Driver Developer Kit (DDK) -and compiled with Microsoft Visual Studio 6. It is not clear to the driver -developers if they are allowed to distribute the whole of the source code -as Free Software. However, they will likely release the "diff" in source -code under the GPL, so anybody with a license of Visual Studio and a DDK -will be able to compile for him/herself.

      16.5.3.4. Join the SAMBA server to the PDC domain

      Once you have run the install script (and possibly manually moved the -"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be -put into Samba's [print$] share (which often maps to "/etc/samba/drivers/" -and contains a subdir tree with WIN40 and W32X86 branches), by running -"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to -put root into the smbpasswd file by running "smbpasswd" should you run -this whole procedure for the first time.] Once the driver files are in the -[print$] share, they are ready to be downloaded and installed by the -Win NT/2k/XP clients.

      Enter the following command to make the SAMBA server join the +PDC domain, where DOMAIN is the name of +your Windows domain and Administrator is +a domain user who has administrative privileges in the domain.

      root# /usr/local/samba/bin/net join -S PDC -U Administrator

      NOTE 1: Win 9x/ME clients won't work with this driver. For these you'd -still need to use the ADOBE*.* drivers as previously.

      The proper response to the command should be: "Joined the domain +DOMAIN" where DOMAIN +is your DOMAIN name.

      16.5.3.5. Start up the winbindd daemon and test it!

      Eventually, you will want to modify your smb startup script to +automatically invoke the winbindd daemon when the other parts of +SAMBA start, but it is possible to test out just the winbind +portion first. To start up winbind services, enter the following +command as root:

      root# /usr/local/samba/bin/winbindd

      NOTE 2: It is not harming if you've still the ADOBE*.* driver files from -previous installations in the "/usr/share/cups/drivers/" directory. -The new cupsaddsmb (from 1.1.16) will automatically use the -"newest" installed driver (which here then is the CUPS drivers).

      Winbindd can now also run in 'dual daemon mode'. This will make it +run as 2 processes. The first will answer all requests from the cache, +thus making responses to clients faster. The other will +update the cache for the query that the first has just responded. +Advantage of this is that responses stay accurate and are faster. +You can enable dual daemon mode by adding '-B' to the commandline:

      root# /usr/local/samba/bin/winbindd -B

      NOTE 3: Should your Win clients have had the old ADOBE*.* files and the -Adobe PostScript drivers installed, the download and installation -of the new CUPS PostScript driver for Windows NT/2k/XP will fail -at first.

      It is not enough to "delete" the printer (as the driver files -will still be kept by the clients and re-used if you try to -re-install the printer). To really get rid of the Adobe driver -files on the clients, open the "Printers" folder (possibly via -"Start --> Settings --> Control Panel --> Printers"), right-click -onto the folder background and select "Server Properties". A -new dialog opens; select the "Drivers" tab; on the list select -the driver you want to delete and click on the "Delete" button. -(This will only work if there is no single printer left which -uses that particular driver -- you need to "delete" all printers -using this driver in the "Printers" folder first.)

      I'm always paranoid and like to make sure the daemon +is really running...

      root# ps -ae | grep winbindd

      Once you have successfully downloaded the CUPS PostScript driver -to a client, you can easily switch all printers to this one -by proceeding as described elsewhere in the "Samba HOWTO -Collection" to change a driver for an existing printer.

      This command should produce output like this, if the daemon is running

      What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP" -as compared to the Adobe drivers?

      3025 ? 00:00:00 winbindd

      Now... for the real test, try to get some information about the +users on your PDC

      root# /usr/local/samba/bin/wbinfo -u

      • no hassle with the Adobe EULA -

      • +This should echo back a list of users on your Windows users on +your PDC. For example, I get the following response:

        no hassle with the question "where do I get the ADOBE*.* driver files from?" - 

      • CEO+Administrator
+CEO+burdell
+CEO+Guest
+CEO+jt-ad
+CEO+krbtgt
+CEO+TsInternetUser

        the Adobe drivers (depending on the printer PPD associated with them) - often put a PJL header in front of the core PostScript part of the print - file (thus the file starts with "1B%-12345X" or "escape%-12345X" - instead of "%!PS"). This leads to the CUPS daemon autotyping the - arriving file as a print-ready file, not requiring a pass thru the - "pstops" filter (to speak more technical, it is not regarded as the - generic MIME type "application/postscript", but as the more special - MIME type "application/cups.vnd-postscript"), which therefore also - leads to the page accounting in "/var/log/cups/page_log" not receiving - the exact mumber of pages; instead the dummy page number of "1" is - logged in a standard setup) -

      • Obviously, I have named my domain 'CEO' and my winbind +separator is '+'.

        the Adobe driver has more options to "mis-configure" the PostScript - generated by it (like setting it inadvertedly to "Optimize for Speed", - instead of "Optimize for Portability", which could lead to CUPS being - unable to process it) -

      • You can do the same sort of thing to get group information from +the PDC:

        the CUPS PostScript driver output sent by Windows clients to the CUPS - server will be guaranteed to be auto-typed as generic MIME type - "application/postscript", thusly passing thru the CUPS "pstops" filter - and logging the correct number of pages in the page_log for accounting - and quota purposes - 

      • root# /usr/local/samba/bin/wbinfo -g
+CEO+Domain Admins
+CEO+Domain Users
+CEO+Domain Guests
+CEO+Domain Computers
+CEO+Domain Controllers
+CEO+Cert Publishers
+CEO+Schema Admins
+CEO+Enterprise Admins
+CEO+Group Policy Creator Owners

        the CUPS PostScript driver supports the sending of additional print - options by the Win NT/2k/XP clients, such as naming the CUPS standard - banner pages (or the custom ones, should they be installed at the time - of driver download), using the CUPS "page-label" option, setting a - job-priority and setting the scheduled time of printing (with the option - to support additional useful IPP job attributes in the future). -

      • The function 'getent' can now be used to get unified +lists of both local and PDC users and groups. +Try the following command:

        the CUPS PostScript driver supports the inclusion of the new - "*cupsJobTicket" comments at the beginnig of the PostScript file (which - could be used in the future for all sort of beneficial extensions on - the CUPS side, but which will not disturb any other application as those - will regard it as a comment and simply ignore it). -

      • root# getent passwd

        You should get a list that looks like your /etc/passwd +list followed by the domain users with their new uids, gids, home +directories and default shells.

        the CUPS PostScript driver will be the heart of the fully fledged CUPS - IPP client for Windows NT/2k/XP to be released soon (probably alongside - the first Beta release for CUPS 1.2). -

      The same thing can be done for groups with the command

      root# getent group

      15.6. Advanced Postscript Printing from MS Windows

      Let the Windows Clients use a PostScript driver to deliver poistscript to -the samba print server (just like any Linux or Unix Client would also use -PostScript to send to the server)

      Make the Unix printing subsystem to which Samba sends the job convert the -incoming PostScript files to the native print format of the target printers -(would be PCL if you have an HP printer)

      Now if you are afraid that this would just mean using a *Generic* PostScript -driver for the clients that has no Simplex/Duplex selection, and no paper tray -choice, but you need them to be able to set up print jobs, with all the bells -and whistles of your printers:-

      16.5.3.6. Fix the init.d startup scripts
      16.5.3.6.1. Linux

      Not possible with traditional spooling systems
      But perfectly supported by CUPS (which uses "PPD" files to - describe how to control the print options for PostScript and - non-PostScript devices alike... -
      The winbindd daemon needs to start up after the +smbd and nmbd daemons are running. +To accomplish this task, you need to modify the startup scripts of your system. They are located at /etc/init.d/smb in RedHat and +/etc/init.d/samba in Debian. +script to add commands to invoke this daemon in the proper sequence. My +startup script starts up smbd, +nmbd, and winbindd from the +/usr/local/samba/bin directory directly. The 'start' +function in the script looks like this:

      start() {
+        KIND="SMB"
+        echo -n $"Starting $KIND services: "
+        daemon /usr/local/samba/bin/smbd $SMBDOPTIONS
+        RETVAL=$?
+        echo
+        KIND="NMB"
+        echo -n $"Starting $KIND services: "
+        daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS
+        RETVAL2=$?
+        echo
+        KIND="Winbind"
+        echo -n $"Starting $KIND services: "
+        daemon /usr/local/samba/bin/winbindd
+        RETVAL3=$?
+        echo
+        [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && touch /var/lock/subsys/smb || \
+           RETVAL=1
+        return $RETVAL
+}

      CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript -drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use -them to setup the job to their liking and CUPS will use the received job options -to make the (PCL-, ESC/P- or PostScript-) printer behave as required.

      If you want to have the additional benefit of page count logging and accounting -then the CUPS PostScript driver is the best choice (better than the Adobe one).

      If you would like to run winbindd in dual daemon mode, replace +the line +
              daemon /usr/local/samba/bin/winbindd
      + +in the example above with: + +
              daemon /usr/local/samba/bin/winbindd -B
      .

      If you want to make the drivers downloadable for the clients then "cupsaddsmb" is -your friend. It will setup the [print$] share on the Samba host to be ready to serve -the clients for a "point and print" driver installation.

      The 'stop' function has a corresponding entry to shut down the +services and looks like this:

      stop() {
+        KIND="SMB"
+        echo -n $"Shutting down $KIND services: "
+        killproc smbd
+        RETVAL=$?
+        echo
+        KIND="NMB"
+        echo -n $"Shutting down $KIND services: "
+        killproc nmbd
+        RETVAL2=$?
+        echo
+        KIND="Winbind"
+        echo -n $"Shutting down $KIND services: "
+        killproc winbindd
+        RETVAL3=$?
+        [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && rm -f /var/lock/subsys/smb
+        echo ""
+        return $RETVAL
+}

      What strings are attached?

      16.5.3.6.2. Solaris

      There are some. But, given the sheer CPU power you can buy nowadays, -these can be overcome easily. The strings:

      On solaris, you need to modify the +/etc/init.d/samba.server startup script. It usually +only starts smbd and nmbd but should now start winbindd too. If you +have samba installed in /usr/local/samba/bin, +the file could contains something like this:

      ##
+## samba.server
+##
+
+if [ ! -d /usr/bin ]
+then                    # /usr not mounted
+        exit
+fi
+
+killproc() {            # kill the named process(es)
+        pid=`/usr/bin/ps -e |
+             /usr/bin/grep -w $1 |
+             /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
+        [ "$pid" != "" ] && kill $pid
+}
+ 
+# Start/stop processes required for samba server
+
+case "$1" in
+
+'start')
+#
+# Edit these lines to suit your installation (paths, workgroup, host)
+#
+echo Starting SMBD
+   /usr/local/samba/bin/smbd -D -s \
+	/usr/local/samba/smb.conf
+
+echo Starting NMBD
+   /usr/local/samba/bin/nmbd -D -l \
+	/usr/local/samba/var/log -s /usr/local/samba/smb.conf
+
+echo Starting Winbind Daemon
+   /usr/local/samba/bin/winbindd
+   ;;
+
+'stop')
+   killproc nmbd
+   killproc smbd
+   killproc winbindd
+   ;;
+
+*)
+   echo "Usage: /etc/init.d/samba.server { start | stop }"
+   ;;
+esac

      Well, if the CUPS/Samba side will have to print to many printers serving many users, -you probably will need to set up a second server (which can do automatic load balancing -with the first one, plus a degree of fail-over mechanism). Converting the incoming -PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work -of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM -than for the mere "raw spooling" task your current setup is solving. It all depends -on the avarage and peak printing load the server should be able to handle.

      Again, if you would like to run samba in dual daemon mode, replace +
         /usr/local/samba/bin/winbindd
      + +in the script above with: + +
         /usr/local/samba/bin/winbindd -B

      15.7. Auto-Deletion of CUPS spool files
      16.5.3.6.3. Restarting

      Samba print files pass thru two "spool" directories. One the incoming directory -managed by Samba, (set eg: in the "path = /var/spool/samba" directive in the [printers] -section of "smb.conf"). Second is the spool directory of your UNIX print subsystem. -For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive -"RequestRoot /var/spool/cups".

      If you restart the smbd, nmbd, +and winbindd daemons at this point, you +should be able to connect to the samba server as a domain member just as +if you were a local user.

      16.5.3.7. Configure Winbind and PAM

      I am not sure, which one of your directories keeps the files. From what you say, -it is most likely the Samba part.

      If you have made it this far, you know that winbindd and samba are working +together. If you want to use winbind to provide authentication for other +services, keep reading. The pam configuration files need to be altered in +this step. (Did you remember to make backups of your original +/etc/pam.d files? If not, do it now.)

      For the CUPS part, you may want to consult:

         http://localhost:631/sam.html#PreserveJobFiles and
-   http://localhost:631/sam.html#PreserveJobHistory and
-   http://localhost:631/sam.html#MaxJobs
      You will need a pam module to use winbindd with these other services. This +module will be compiled in the ../source/nsswitch directory +by invoking the command

      There are the settings described for your CUPS daemon, which could lead to completed -job files not being deleted.

      root# make nsswitch/pam_winbind.so

      "PreserveJobHistory Yes" -- keeps some details of jobs in -cupsd's mind (well it keeps the "c12345", "c12346" etc. files -in the CUPS spool directory, which do a similar job as the -old-fashioned BSD-LPD control files). This is set to "Yes" -as a default.

      from the ../source directory. The +pam_winbind.so file should be copied to the location of +your other pam security modules. On my RedHat system, this was the +/lib/security directory. On Solaris, the pam security +modules reside in /usr/lib/security.

      "PreserveJobFiles Yes" -- keeps the job files themselves in -cupsd's mind (well it keeps the "d12345", "d12346" etc. files -in the CUPS spool directory...). This is set to "No" as the -CUPS default.

      root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security

      16.5.3.7.1. Linux/FreeBSD-specific PAM configuration

      "MaxJobs 500" -- this directive controls the maximum number -of jobs that are kept in memory. Once the number of jobs -reaches the limit, the oldest completed job is automatically -purged from the system to make room for the new one. If all -of the known jobs are still pending or active then the new -job will be rejected. Setting the maximum to 0 disables this -functionality. The default setting is 0.

      The /etc/pam.d/samba file does not need to be changed. I +just left this fileas it was:

      (There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...)

      auth    required        /lib/security/pam_stack.so service=system-auth
+account required        /lib/security/pam_stack.so service=system-auth

      For everything to work as announced, you need to have three things:

      The other services that I modified to allow the use of winbind +as an authentication service were the normal login on the console (or a terminal +session), telnet logins, and ftp service. In order to enable these +services, you may first need to change the entries in +/etc/xinetd.d (or /etc/inetd.conf). +RedHat 7.1 uses the new xinetd.d structure, in this case you need +to change the lines in /etc/xinetd.d/telnet +and /etc/xinetd.d/wu-ftp from 

      enable = no

      a Samba-smbd which is compiled against "libcups" (Check on Linux by running "ldd `which smbd`") -
      a Samba-smb.conf setting of "printing = cups" -
      another Samba-smb.conf setting of "printcap = cups" -

      to

      enable = yes

      Note, that in this case all other manually set printing-related -commands (like "print command", "lpq command", "lprm command", -"lppause command" or "lpresume command") are ignored and they -should normally have no influence what-so-ever on your printing.

      If you want to do things manually, replace the "printing = cups" -by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" -may do what you need.

      +For ftp services to work properly, you will also need to either +have individual directories for the domain users already present on +the server, or change the home directory template to a general +directory for all domain users. These can be easily set using +the smb.conf global entry +template homedir.

      You forgot to mention the CUPS version you're using. If you did -set things up as described in the man pages, then the Samba -spool files should be deleted. Otherwise it may be a bug. On -the CUPS side, you can control the behaviour as described -above.

      The /etc/pam.d/ftp file can be changed +to allow winbind ftp access in a manner similar to the +samba file. My /etc/pam.d/ftp file was +changed to look like this:

      If you have more problems, post the output of these commands:

      auth       required     /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
+auth       sufficient   /lib/security/pam_winbind.so
+auth       required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_shells.so
+account    sufficient   /lib/security/pam_winbind.so
+account    required     /lib/security/pam_stack.so service=system-auth
+session    required     /lib/security/pam_stack.so service=system-auth

      The /etc/pam.d/login file can be changed nearly the +same way. It now looks like this:

         grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
-   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
      auth required /lib/security/pam_securetty.so +auth sufficient /lib/security/pam_winbind.so +auth sufficient /lib/security/pam_unix.so use_first_pass +auth required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_nologin.so +account sufficient /lib/security/pam_winbind.so +account required /lib/security/pam_stack.so service=system-auth +password required /lib/security/pam_stack.so service=system-auth +session required /lib/security/pam_stack.so service=system-auth +session optional /lib/security/pam_console.so

      (adapt paths as needed). These commands sanitize the files -and cut out the empty lines and lines with comments, providing -the "naked settings" in a compact way.

      In this case, I added the auth sufficient /lib/security/pam_winbind.so +lines as before, but also added the required pam_securetty.so +above it, to disallow root logins over the network. I also added a +sufficient /lib/security/pam_unix.so use_first_pass +line after the winbind.so line to get rid of annoying +double prompts for passwords.

      Chapter 16. Unified Logons between Windows NT and UNIX using Winbind

      16.1. Abstract
      16.5.3.7.2. Solaris-specific configuration

      Integration of UNIX and Microsoft Windows NT through - a unified logon has been considered a "holy grail" in heterogeneous - computing environments for a long time. We present - winbind, a component of the Samba suite - of programs as a solution to the unified logon problem. Winbind - uses a UNIX implementation - of Microsoft RPC calls, Pluggable Authentication Modules, and the Name - Service Switch to allow Windows NT domain users to appear and operate - as UNIX users on a UNIX machine. This paper describes the winbind - system, explaining the functionality it provides, how it is configured, - and how it works internally.

      The /etc/pam.conf needs to be changed. I changed this file so that my Domain +users can logon both locally as well as telnet.The following are the changes +that I made.You can customize the pam.conf file as per your requirements,but +be sure of those changes because in the worst case it will leave your system +nearly impossible to boot.

      #
+#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
+#
+# Copyright (c) 1996-1999, Sun Microsystems, Inc.
+# All Rights Reserved.
+#
+# PAM configuration
+#
+# Authentication management
+#
+login   auth required   /usr/lib/security/pam_winbind.so
+login	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 
+login	auth required 	/usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 
+#
+rlogin  auth sufficient /usr/lib/security/pam_winbind.so
+rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
+rlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+#
+dtlogin auth sufficient /usr/lib/security/pam_winbind.so
+dtlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+#
+rsh	auth required	/usr/lib/security/$ISA/pam_rhosts_auth.so.1
+other   auth sufficient /usr/lib/security/pam_winbind.so
+other	auth required	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+#
+# Account management
+#
+login   account sufficient      /usr/lib/security/pam_winbind.so
+login	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
+login	account required	/usr/lib/security/$ISA/pam_unix.so.1 
+#
+dtlogin account sufficient      /usr/lib/security/pam_winbind.so
+dtlogin	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
+dtlogin	account required	/usr/lib/security/$ISA/pam_unix.so.1 
+#
+other   account sufficient      /usr/lib/security/pam_winbind.so
+other	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
+other	account required	/usr/lib/security/$ISA/pam_unix.so.1 
+#
+# Session management
+#
+other	session required	/usr/lib/security/$ISA/pam_unix.so.1 
+#
+# Password management
+#
+#other   password sufficient     /usr/lib/security/pam_winbind.so
+other	password required	/usr/lib/security/$ISA/pam_unix.so.1 
+dtsession auth required	/usr/lib/security/$ISA/pam_unix.so.1
+#
+# Support for Kerberos V5 authentication (uncomment to use Kerberos)
+#
+#rlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#login	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#dtlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#other	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#dtlogin	account optional /usr/lib/security/$ISA/pam_krb5.so.1
+#other	account optional /usr/lib/security/$ISA/pam_krb5.so.1
+#other	session optional /usr/lib/security/$ISA/pam_krb5.so.1
+#other	password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass

      I also added a try_first_pass line after the winbind.so line to get rid of +annoying double prompts for passwords.

      Now restart your Samba and try connecting through your application that you +configured in the pam.conf.

      16.2. Introduction16.6. Limitations

      It is well known that UNIX and Microsoft Windows NT have - different models for representing user and group information and - use different technologies for implementing them. This fact has - made it difficult to integrate the two systems in a satisfactory - manner.

      One common solution in use today has been to create - identically named user accounts on both the UNIX and Windows systems - and use the Samba suite of programs to provide file and print services - between the two. This solution is far from perfect however, as - adding and deleting users on both sets of machines becomes a chore - and two sets of passwords are required both of which - can lead to synchronization problems between the UNIX and Windows - systems and confusion for users.

      We divide the unified logon problem for UNIX machines into - three smaller problems:

      Winbind has a number of limitations in its current + released version that we hope to overcome in future + releases:

      • Obtaining Windows NT user and group information -

        Winbind is currently only available for + the Linux, Solaris and IRIX operating systems, although ports to other operating + systems are certainly possible. For such ports to be feasible, + we require the C library of the target operating system to + support the Name Service Switch and Pluggable Authentication + Modules systems. This is becoming more common as NSS and + PAM gain support among UNIX vendors.

      • Authenticating Windows NT users -

        The mappings of Windows NT RIDs to UNIX ids + is not made algorithmically and depends on the order in which + unmapped users or groups are seen by winbind. It may be difficult + to recover the mappings of rid to UNIX id mapping if the file + containing this information is corrupted or destroyed.

      • Password changing for Windows NT users -

      Ideally, a prospective solution to the unified logon problem - would satisfy all the above components without duplication of - information on the UNIX machines and without creating additional - tasks for the system administrator when maintaining users and - groups on either system. The winbind system provides a simple - and elegant solution to all three components of the unified logon - problem.

      16.3. What Winbind Provides

      Winbind unifies UNIX and Windows NT account management by - allowing a UNIX box to become a full member of a NT domain. Once - this is done the UNIX box will see NT users and groups as if - they were native UNIX users and groups, allowing the NT domain - to be used in much the same manner that NIS+ is used within - UNIX-only environments.

      The end result is that whenever any - program on the UNIX machine asks the operating system to lookup - a user or group name, the query will be resolved by asking the - NT domain controller for the specified domain to do the lookup. - Because Winbind hooks into the operating system at a low level - (via the NSS name resolution modules in the C library) this - redirection to the NT domain controller is completely - transparent.

      Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files - so that they are owned by NT domain users or even login to the - UNIX machine and run a UNIX X-Window session as a domain user.

      The only obvious indication that Winbind is being used is - that user and group names take the form DOMAIN\user and - DOMAIN\group. This is necessary as it allows Winbind to determine - that redirection to a domain controller is wanted for a particular - lookup and which trusted domain is being referenced.

      Additionally, Winbind provides an authentication service - that hooks into the Pluggable Authentication Modules (PAM) system - to provide authentication via a NT domain to any PAM enabled - applications. This capability solves the problem of synchronizing - passwords between systems since all passwords are stored in a single - location (on the domain controller).

      Currently the winbind PAM module does not take + into account possible workstation and logon time restrictions + that may be been set for Windows NT users, this is + instead up to the PDC to enforce.

      16.3.1. Target Uses

      Winbind is targeted at organizations that have an - existing NT based domain infrastructure into which they wish - to put UNIX workstations or servers. Winbind will allow these - organizations to deploy UNIX workstations without having to - maintain a separate account infrastructure. This greatly - simplifies the administrative overhead of deploying UNIX - workstations into a NT based organization.

      16.7. Conclusion

      Another interesting way in which we expect Winbind to - be used is as a central part of UNIX based appliances. Appliances - that provide file and print services to Microsoft based networks - will be able to use Winbind to provide seamless integration of - the appliance into the domain.

      The winbind system, through the use of the Name Service + Switch, Pluggable Authentication Modules, and appropriate + Microsoft RPC calls have allowed us to provide seamless + integration of Microsoft Windows NT domain users on a + UNIX system. The result is a great reduction in the administrative + cost of running a mixed UNIX and NT network.

      Chapter 17. Policy Management - Hows and Whys

      16.4. How Winbind Works17.1. System Policies

      The winbind system is designed around a client/server - architecture. A long running winbindd daemon - listens on a UNIX domain socket waiting for requests - to arrive. These requests are generated by the NSS and PAM - clients and processed sequentially.

      Under MS Windows platforms, particularly those following the release of MS Windows +NT4 and MS Windows 95) it is possible to create a type of file that would be placed +in the NETLOGON share of a domain controller. As the client logs onto the network +this file is read and the contents initiate changes to the registry of the client +machine. This file allows changes to be made to those parts of the registry that +affect users, groups of users, or machines.

      The technologies used to implement winbind are described - in detail below.

      16.4.1. Microsoft Remote Procedure Calls

      For MS Windows 9x/Me this file must be called Config.POL and may +be generated using a tool called poledit.exe, better known as the +Policy Editor. The policy editor was provided on the Windows 98 installation CD, but +dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +comments from MS Windows network administrators it would appear that this tool became +a part of the MS Windows Me Resource Kit.

      MS Windows NT4 Server products include the System Policy Editor +under the Start->Programs->Administrative Tools menu item. +For MS Windows NT4 and later clients this file must be called NTConfig.POL.

      Over the last few years, efforts have been underway - by various Samba Team members to decode various aspects of - the Microsoft Remote Procedure Call (MSRPC) system. This - system is used for most network related operations between - Windows NT machines including remote management, user authentication - and print spooling. Although initially this work was done - to aid the implementation of Primary Domain Controller (PDC) - functionality in Samba, it has also yielded a body of code which - can be used for other purposes.

      New with the introduction of MS Windows 2000 was the Microsoft Management Console +or MMC. This tool is the new wave in the ever changing landscape of Microsoft +methods for management of network access and security. Every new Microsoft product +or technology seems to obsolete the old rules and to introduce newer and more +complex tools and methods. To Microsoft's credit though, the MMC does appear to +be a step forward, but improved functionality comes at a great price.

      Winbind uses various MSRPC calls to enumerate domain users - and groups and to obtain detailed information about individual - users or groups. Other MSRPC calls can be used to authenticate - NT domain users and to change user passwords. By directly querying - a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

      16.4.2. Microsoft Active Directory Services

      Before embarking on the configuration of network and system policies it is highly +advisable to read the documentation available from Microsoft's web site from +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. +There are a large number of documents in addition to this old one that should also +be read and understood. Try searching on the Microsoft web site for "Group Policies".

      Since late 2001, Samba has gained the ability to - interact with Microsoft Windows 2000 using its 'Native - Mode' protocols, rather than the NT4 RPC services. - Using LDAP and Kerberos, a domain member running - winbind can enumerate users and groups in exactly the - same way as a Win2k client would, and in so doing - provide a much more efficient and - effective winbind implementation. -

      What follows is a very discussion with some helpful notes. The information provided +here is incomplete - you are warned.

      16.4.3. Name Service Switch17.1.1. Creating and Managing Windows 9x/Me Policies

      The Name Service Switch, or NSS, is a feature that is - present in many UNIX operating systems. It allows system - information such as hostnames, mail aliases and user information - to be resolved from different sources. For example, a standalone - UNIX workstation may resolve system information from a series of - flat files stored on the local filesystem. A networked workstation - may first attempt to resolve system information from local files, - and then consult a NIS database for user information or a DNS server - for hostname information.

      The NSS application programming interface allows winbind - to present itself as a source of system information when - resolving UNIX usernames and groups. Winbind uses this interface, - and information obtained from a Windows NT server using MSRPC - calls to provide a new source of account enumeration. Using standard - UNIX library calls, one can enumerate the users and groups on - a UNIX machine running winbind and see all users and groups in - a NT domain plus any trusted domain as though they were local - users and groups.

      You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. +It can be found on the Original full product Win98 installation CD under +tools/reskit/netadmin/poledit. You install this using the +Add/Remove Programs facility and then click on the 'Have Disk' tab.

      The primary control file for NSS is - Use the Group Policy Editor to create a policy file that specifies the location of +user profiles and/or the /etc/nsswitch.conf. - When a UNIX application makes a request to do a lookup - the C library looks in My Documents etc. stuff. You then +save these settings in a file called /etc/nsswitch.conf - for a line which matches the service type being requested, for - example the "passwd" service type is used when user or group names - are looked up. This config line species which implementations - of that service should be tried and in what order. If the passwd - config line is:

      Config.POL that needs to +be placed in the root of the [NETLOGON] share. If your Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the Win9x/Me registry +of the machine that is logging on.

      passwd: files example

      Further details are covered in the Win98 Resource Kit documentation.

      then the C library will first load a module called - /lib/libnss_files.so followed by - the module /lib/libnss_example.so. The - C library will dynamically load each of these modules in turn - and call resolver functions within the modules to try to resolve - the request. Once the request is resolved the C library returns the - result to the application.

      If you do not do it this way, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings.

      This NSS interface provides a very easy way for Winbind - to hook into the operating system. All that needs to be done - is to put libnss_winbind.so in Install the group policy handler for Win9x to pick up group policies. Look on the +Win98 CD in /lib/ - then add "winbind" into \tools\reskit\netadmin\poledit. +Install group policies on a Win9x client by double-clicking +/etc/nsswitch.conf at - the appropriate place. The C library will then call Winbind to - resolve user and group names.

      grouppol.inf. Log off and on again a couple of times and see +if Win98 picks up group policies. Unfortunately this needs to be done on every +Win9x/Me machine that uses group policies.

      16.4.4. Pluggable Authentication Modules17.1.2. Creating and Managing Windows NT4 Style Policy Files

      Pluggable Authentication Modules, also known as PAM, - is a system for abstracting authentication and authorization - technologies. With a PAM module it is possible to specify different - authentication methods for different system applications without - having to recompile these applications. PAM is also useful - for implementing a particular policy for authorization. For example, - a system administrator may only allow console logins from users - stored in the local password file but only allow users resolved from - a NIS database to log in over the network.

      Winbind uses the authentication management and password - management PAM interface to integrate Windows NT users into a - UNIX system. This allows Windows NT users to log in to a UNIX - machine and be authenticated against a suitable Primary Domain - Controller. These users can also change their passwords and have - this change take effect directly on the Primary Domain Controller. -

      To create or edit ntconfig.pol you must use the NT Server +Policy Editor, poledit.exe which is included with NT4 Server +but not NT Workstation. There is a Policy Editor on a NT4 +Workstation but it is not suitable for creating Domain Policies. +Further, although the Windows 95 Policy Editor can be installed on an NT4 +Workstation/Server, it will not work with NT clients. However, the files from +the NT Server will run happily enough on an NT4 Workstation.

      PAM is configured by providing control files in the directory - You need /etc/pam.d/ for each of the services that - require authentication. When an authentication request is made - by an application the PAM code in the C library looks up this - control file to determine what modules to load to do the - authentication check and in what order. This interface makes adding - a new authentication service for Winbind very easy, all that needs - to be done is that the poledit.exe, common.adm and pam_winbind.so module - is copied to winnt.adm. +It is convenient to put the two *.adm files in the /lib/security/ and the PAM - control files for relevant services are updated to allow - authentication via winbind. See the PAM documentation - for more details.

      c:\winnt\inf +directory which is where the binary will look for them unless told otherwise. Note also that that +directory is normally 'hidden'.

      The Windows NT policy editor is also included with the Service Pack 3 (and +later) for Windows NT 4.0. Extract the files using servicepackname /x, +i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, +poledit.exe and the associated template files (*.adm) should +be extracted as well. It is also possible to downloaded the policy template +files for Office97 and get a copy of the policy editor. Another possible +location is with the Zero Administration Kit available for download from Microsoft.

      16.4.5. User and Group ID Allocation

      When a user or group is created under Windows NT - is it allocated a numerical relative identifier (RID). This is - slightly different to UNIX which has a range of numbers that are - used to identify users, and the same range in which to identify - groups. It is winbind's job to convert RIDs to UNIX id numbers and - vice versa. When winbind is configured it is given part of the UNIX - user id space and a part of the UNIX group id space in which to - store Windows NT users and groups. If a Windows NT user is - resolved for the first time, it is allocated the next UNIX id from - the range. The same process applies for Windows NT groups. Over - time, winbind will have mapped all Windows NT users and groups - to UNIX user ids and group ids.

      17.1.2.1. Registry Tattoos

      The results of this mapping are stored persistently in - an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

      With NT4 style registry based policy changes, a large number of settings are not +automatically reversed as the user logs off. Since the settings that were in the +NTConfig.POL file were applied to the client machine registry and that apply to the +hive key HKEY_LOCAL_MACHINE are permanent until explicitly reveresd. This is known +as tattooing. It can have serious consequences down-stream and the administrator must +be extreemly careful not to lock out the ability to manage the machine at a later date.

      16.4.6. Result Caching17.1.3. Creating and Managing MS Windows 200x Policies

      An active system can generate a lot of user and group - name lookups. To reduce the network cost of these lookups winbind - uses a caching scheme based on the SAM sequence number supplied - by NT domain controllers. User or group information returned - by a PDC is cached by winbind along with a sequence number also - returned by the PDC. This sequence number is incremented by - Windows NT whenever any user or group information is modified. If - a cached entry has expired, the sequence number is requested from - the PDC and compared against the sequence number of the cached entry. - If the sequence numbers do not match, then the cached information - is discarded and up to date information is requested directly - from the PDC.

      16.5. Installation and Configuration

      Windows NT4 System policies allows setting of registry parameters specific to +users, groups and computers (client workstations) that are members of the NT4 +style domain. Such policy file will work with MS Windows 2000 / XP clients also.

      Many thanks to John Trostel jtrostel@snapserver.comNew to MS Windows 2000 Microsoft introduced a new style of group policy that confers +a superset of capabilities compared with NT4 style policies. Obviously, the tool used +to create them is different, and the mechanism for implementing them is much changed.

      The older NT4 style registry based policies are known as Administrative Templates -for providing the HOWTO for this section.

      My Documents files (directory), as +well as intrinsics of where menu items will appear in the Start menu). An additional new +feature is the ability to make available particular software Windows applications to particular +users and/or groups.

      This HOWTO describes how to get winbind services up and running -to control access and authenticate users on your Linux box using -the winbind services which come with SAMBA 2.2.2.

      Remember: NT4 policy files are named NTConfig.POL and are stored in the root +of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password +and selects the domain name to which the logon will attempt to take place. During the logon +process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating +server, modifies the local registry values according to the settings in this file.

      Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of +a Windows 200x policy file is stored in the Active Directory itself and the other part is stored +in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active +Directory domain controllers. The part that is stored in the Active Directory itself is called the +group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is +known as the group policy template (GPT).

      With NT4 clients the policy file is read and executed upon only aas each user log onto the network. +MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine +startup (machine specific part) and when the user logs onto the network the user specific part +is applied. In MS Windows 200x style policy management each machine and/or user may be subject +to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows +the administrator to also set filters over the policy settings. No such equivalent capability +exists with NT4 style policy files.

      16.5.1. Introduction

      This HOWTO describes the procedures used to get winbind up and -running on my RedHat 7.1 system. Winbind is capable of providing access -and authentication control for Windows Domain users through an NT -or Win2K PDC for 'regular' services, such as telnet a nd ftp, as -well for SAMBA services.

      17.1.3.1. Administration of Win2K Policies

      This HOWTO has been written from a 'RedHat-centric' perspective, so if -you are using another distribution, you may have to modify the instructions -somewhat to fit the way your distribution works.

      Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the +executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console +(MMC) snap-in as follows:

      • Why should I to this? Go to the Windows 200x / XP menu Start->Programs->Adminsitrative Tools + and select the MMC snap-in called "Active Directory Users and Computers"

        This allows the SAMBA administrator to rely on the - authentication mechanisms on the NT/Win2K PDC for the authentication - of domain members. NT/Win2K users no longer need to have separate - accounts on the SAMBA server. +>

      • Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item.

      • Who should be reading this document? +> Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create.

      • This HOWTO is designed for system administrators. If you are - implementing SAMBA on a file server and wish to (fairly easily) - integrate existing NT/Win2K users from your PDC onto the - SAMBA server, this HOWTO is for you. That said, I am no NT or PAM - expert, so you may find a better or easier way to accomplish - these tasks. +> Now left click on the Edit tab to commence the steps needed to create the GPO.

      All policy configuration options are controlled through the use of policy administrative +templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. +Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. +The later introduces many new features as well as extended definition capabilities. It is +well beyond the scope of this documentation to explain how to program .adm files, for that +the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular +version of MS Windows.

      The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used +to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you +use this powerful tool. Please refer to the resource kit manuals for specific usage information.

      16.5.2. Requirements

      Chapter 18. Profile Management

      18.1. Roaming Profiles

      If you have a samba configuration file that you are currently -using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory -contents! If you haven't already made a boot disk, -

      MAKE ONE NOW!NOTE! Roaming profiles support is different for Win9X and WinNT.

      Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features.

      Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory.

      WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT.

      18.1.1. Windows NT Configuration

      To support WinNT clients, in the [global] section of smb.conf set the +following (for example):

      logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

      Messing with the pam configuration files can make it nearly impossible -to log in to yourmachine. That's why you want to be able to boot back -into your machine in single user mode and restore your -/etc/pam.d back to the original state they were in if -you get frustrated with the way things are going. ;-)

      The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable.

      The latest version of SAMBA (version 3.0 as of this writing), now -includes a functioning winbindd daemon. Please refer to the -main SAMBA web page or, -better yet, your closest SAMBA mirror site for instructions on -downloading the source code.

      To allow Domain users the ability to access SAMBA shares and -files, as well as potentially other services provided by your -SAMBA machine, PAM (pluggable authentication modules) must -be setup properly on your machine. In order to compile the -winbind modules, you should have at least the pam libraries resident -on your system. For recent RedHat systems (7.1, for instance), that -means pam-0.74-22. For best results, it is helpful to also -install the development packages in pam-devel-0.74-22.

      MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path.

      16.5.3. Testing Things Out18.1.2. Windows 9X Configuration

      Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may -be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the /etc/pam.d -directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the /usr/doc -and /usr/man entries for pam. Winbind built better -in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. For instance, -my RedHat system has both pam-0.74-22 and -pam-devel-0.74-22 RPMs installed.

      To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter.

      By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file:

      logon home = \\%L\%U\.profiles

      then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden).

      Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home".

      16.5.3.1. Configure and compile SAMBA

      18.1.3. Win9X and WinNT Configuration

      The configuration and compilation of SAMBA is pretty straightforward. -The first three steps may not be necessary depending upon -whether or not you have previously built the Samba binaries.

      You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example:

      root# autoconf
-root# make clean
-root# rm config.cache
-root# ./configure
-root# make
-root# make install
      logon home = \\%L\%U\.profiles +logon path = \\%L\profiles\%U

      This will, by default, install SAMBA in /usr/local/samba. -See the main SAMBA documentation if you want to install SAMBA somewhere else. -It will also build the winbindd executable and libraries.

      I have not checked what 'net use /home' does on NT when "logon home" is +set as above.

      16.5.3.2. Configure nsswitch.conf and the -winbind libraries

      18.1.4. Windows 9X Profile Setup

      The libraries needed to run the winbindd daemon -through nsswitch need to be copied to their proper locations, so

      When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders.

      The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file.

      root# cp ../samba/source/nsswitch/libnss_winbind.so /lib

      1. On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. +

      2. On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. +

      Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me.

      You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password.

      Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'.

      Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created.

      These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set.

      If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server.

      I also found it necessary to make the following symbolic link:

      If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time".

      root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2

      1. And, in the case of Sun solaris:

        instead of logging in under the [user, password, domain] dialog, + press escape. +

      2. root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2

        run the regedit.exe program, and look in: +

        Now, as root you need to edit /etc/nsswitch.conf to -allow user and group entries to be visible from the winbindd -daemon. My /etc/nsswitch.conf file look like -this after editing:

        HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + 

        	passwd:     files winbind
-	shadow:     files 
-	group:      files winbind

        you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. +

        -The libraries needed by the winbind daemon will be automatically -entered into the ldconfig cache the next time -your system reboots, but it -is faster (and you don't need to reboot) if you do it manually:

        [Exit the registry editor]. +

      3. root# /sbin/ldconfig -v | grep winbind

        WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). +

        This makes libnss_winbind available to winbindd -and echos back a check to you.

      16.5.3.3. Configure smb.conf

      This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. +

    • Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in -the winbindd(8) man page. My -smb.conf file was modified to -include the following entries in the [global] section:

      search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + 

    • [global]
-     <...>
-     # separate domain and username with '+', like DOMAIN+username
-     winbind separator = +
-     # use uids from 10000 to 20000 for domain users
-     winbind uid = 10000-20000
-     # use gids from 10000 to 20000 for domain groups
-     winbind gid = 10000-20000
-     # allow enumeration of winbind users and groups
-     winbind enum users = yes
-     winbind enum groups = yes
-     # give winbind users a real shell (only needed if they have telnet access)
-     template homedir = /home/winnt/%D/%U
-     template shell = /bin/bash

      • 16.5.3.4. Join the SAMBA server to the PDC domain

      log off the windows 95 client. +

    • Enter the following command to make the SAMBA server join the -PDC domain, where DOMAIN is the name of -your Windows domain and Administrator is -a domain user who has administrative privileges in the domain.

      check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. +

      • root# /usr/local/samba/bin/net join -S PDC -U Administrator

      If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports.

      The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN -is your DOMAIN name.

      If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace.

      16.5.3.5. Start up the winbindd daemon and test it!

      Eventually, you will want to modify your smb startup script to -automatically invoke the winbindd daemon when the other parts of -SAMBA start, but it is possible to test out just the winbind -portion first. To start up winbind services, enter the following -command as root:

      root# /usr/local/samba/bin/winbindd

      Winbindd can now also run in 'dual daemon mode'. This will make it -run as 2 processes. The first will answer all requests from the cache, -thus making responses to clients faster. The other will -update the cache for the query that the first has just responded. -Advantage of this is that responses stay accurate and are faster. -You can enable dual daemon mode by adding '-B' to the commandline:

      root# /usr/local/samba/bin/winbindd -B

      18.1.5. Windows NT Workstation 4.0

      I'm always paranoid and like to make sure the daemon -is really running...

      When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter.

      root# ps -ae | grep winbindd

      There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter.

      This command should produce output like this, if the daemon is running

      The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.)

      3025 ? 00:00:00 winbindd

      In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown.

      Now... for the real test, try to get some information about the -users on your PDC

      You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one.

      root# /usr/local/samba/bin/wbinfo -u

      The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN.

      18.1.6. Windows NT/200x Server

      -This should echo back a list of users on your Windows users on -your PDC. For example, I get the following response:

      There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords.

      18.1.7. Sharing Profiles between W9x/Me and NT4/200x/XP workstations

      CEO+Administrator
-CEO+burdell
-CEO+Guest
-CEO+jt-ad
-CEO+krbtgt
-CEO+TsInternetUser

      Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows.

      Obviously, I have named my domain 'CEO' and my winbind -separator is '+'.

      If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home.

      You can do the same sort of thing to get group information from -the PDC:

      If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory.

      18.1.8. Windows NT 4

      root# /usr/local/samba/bin/wbinfo -g
-CEO+Domain Admins
-CEO+Domain Users
-CEO+Domain Guests
-CEO+Domain Computers
-CEO+Domain Controllers
-CEO+Cert Publishers
-CEO+Schema Admins
-CEO+Enterprise Admins
-CEO+Group Policy Creator Owners

      Unfortunately, the Resource Kit info is Win NT4 or 200x specific.

      The function 'getent' can now be used to get unified -lists of both local and PDC users and groups. -Try the following command:

      Here is a quick guide:

      root# getent passwd

      • You should get a list that looks like your /etc/passwd -list followed by the domain users with their new uids, gids, home -directories and default shells.

        The same thing can be done for groups with the command

        On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'.

      • root# getent group

      16.5.3.6. Fix the init.d startup scripts

      Select a user profile you want to migrate and click on it.

      16.5.3.6.1. Linux

      The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. -To accomplish this task, you need to modify the startup scripts of your system. They are located at /etc/init.d/smb in RedHat and -/etc/init.d/samba in Debian. -script to add commands to invoke this daemon in the proper sequence. My -startup script starts up smbd, -nmbd, and winbindd from the -/usr/local/samba/bin directory directly. The 'start' -function in the script looks like this:

      start() {
-        KIND="SMB"
-        echo -n $"Starting $KIND services: "
-        daemon /usr/local/samba/bin/smbd $SMBDOPTIONS
-        RETVAL=$?
-        echo
-        KIND="NMB"
-        echo -n $"Starting $KIND services: "
-        daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS
-        RETVAL2=$?
-        echo
-        KIND="Winbind"
-        echo -n $"Starting $KIND services: "
-        daemon /usr/local/samba/bin/winbindd
-        RETVAL3=$?
-        echo
-        [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && touch /var/lock/subsys/smb || \
-           RETVAL=1
-        return $RETVAL
-}
      I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC.

    • Click the 'Copy To' button.

    • In the box labelled 'Copy Profile to' add your new path, eg: +c:\temp\foobar

    • If you would like to run winbindd in dual daemon mode, replace -the line -

              daemon /usr/local/samba/bin/winbindd
      - -in the example above with: - -
              daemon /usr/local/samba/bin/winbindd -B
      .

      Click on the button labelled 'Change' in the "Permitted to use" box.

    • The 'stop' function has a corresponding entry to shut down the -services and looks like this:

      Click on the group 'Everyone' and then click OK. This closes the +'chose user' box.

    • stop() {
-        KIND="SMB"
-        echo -n $"Shutting down $KIND services: "
-        killproc smbd
-        RETVAL=$?
-        echo
-        KIND="NMB"
-        echo -n $"Shutting down $KIND services: "
-        killproc nmbd
-        RETVAL2=$?
-        echo
-        KIND="Winbind"
-        echo -n $"Shutting down $KIND services: "
-        killproc winbindd
-        RETVAL3=$?
-        [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && rm -f /var/lock/subsys/smb
-        echo ""
-        return $RETVAL
-}

      • Now click OK.

      Follow the above for every profile you need to migrate.

      16.5.3.6.2. Solaris

      On solaris, you need to modify the -/etc/init.d/samba.server startup script. It usually -only starts smbd and nmbd but should now start winbindd too. If you -have samba installed in /usr/local/samba/bin, -the file could contains something like this:

      18.1.8.1. Side bar Notes

      ##
-## samba.server
-##
-
-if [ ! -d /usr/bin ]
-then                    # /usr not mounted
-        exit
-fi
-
-killproc() {            # kill the named process(es)
-        pid=`/usr/bin/ps -e |
-             /usr/bin/grep -w $1 |
-             /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
-        [ "$pid" != "" ] && kill $pid
-}
- 
-# Start/stop processes required for samba server
-
-case "$1" in
-
-'start')
-#
-# Edit these lines to suit your installation (paths, workgroup, host)
-#
-echo Starting SMBD
-   /usr/local/samba/bin/smbd -D -s \
-	/usr/local/samba/smb.conf
-
-echo Starting NMBD
-   /usr/local/samba/bin/nmbd -D -l \
-	/usr/local/samba/var/log -s /usr/local/samba/smb.conf
-
-echo Starting Winbind Daemon
-   /usr/local/samba/bin/winbindd
-   ;;
-
-'stop')
-   killproc nmbd
-   killproc smbd
-   killproc winbindd
-   ;;
-
-*)
-   echo "Usage: /etc/init.d/samba.server { start | stop }"
-   ;;
-esac

      You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page.

      Again, if you would like to run samba in dual daemon mode, replace -

         /usr/local/samba/bin/winbindd
      - -in the script above with: - -
         /usr/local/samba/bin/winbindd -B

      With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users.

      16.5.3.6.3. Restarting

      18.1.8.2. Mandatory profiles

      If you restart the smbd, nmbd, -and winbindd daemons at this point, you -should be able to connect to the samba server as a domain member just as -if you were a local user.

      The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN.

      16.5.3.7. Configure Winbind and PAM18.1.8.3. moveuser.exe

      If you have made it this far, you know that winbindd and samba are working -together. If you want to use winbind to provide authentication for other -services, keep reading. The pam configuration files need to be altered in -this step. (Did you remember to make backups of your original -/etc/pam.d files? If not, do it now.)

      You will need a pam module to use winbindd with these other services. This -module will be compiled in the ../source/nsswitch directory -by invoking the command

      The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change.

      18.1.8.4. Get SID

      root# make nsswitch/pam_winbind.so

      You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit.

      from the ../source directory. The -pam_winbind.so file should be copied to the location of -your other pam security modules. On my RedHat system, this was the -/lib/security directory. On Solaris, the pam security -modules reside in /usr/lib/security.

      Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

      root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security

      Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath.

      16.5.3.7.1. Linux/FreeBSD-specific PAM configuration

      18.1.9. Windows 2000/XP

      The /etc/pam.d/samba file does not need to be changed. I -just left this fileas it was:

      You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows:

      auth    required        /lib/security/pam_stack.so service=system-auth
-account required        /lib/security/pam_stack.so service=system-auth

      • The other services that I modified to allow the use of winbind -as an authentication service were the normal login on the console (or a terminal -session), telnet logins, and ftp service. In order to enable these -services, you may first need to change the entries in -/etc/xinetd.d (or /etc/inetd.conf). -RedHat 7.1 uses the new xinetd.d structure, in this case you need -to change the lines in /etc/xinetd.d/telnet -and /etc/xinetd.d/wu-ftp from 

        enable = no

        Log on as the LOCAL workstation administrator.

      • to

        Right click on the 'My Computer' Icon, select 'Properties'

      • enable = yes

        Click on the 'User Profiles' tab

      • -For ftp services to work properly, you will also need to either -have individual directories for the domain users already present on -the server, or change the home directory template to a general -directory for all domain users. These can be easily set using -the smb.conf global entry -template homedir.

        Select the profile you wish to convert (click on it once)

      • The /etc/pam.d/ftp file can be changed -to allow winbind ftp access in a manner similar to the -samba file. My /etc/pam.d/ftp file was -changed to look like this:

        Click on the button 'Copy To'

      • auth       required     /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
-auth       sufficient   /lib/security/pam_winbind.so
-auth       required     /lib/security/pam_stack.so service=system-auth
-auth       required     /lib/security/pam_shells.so
-account    sufficient   /lib/security/pam_winbind.so
-account    required     /lib/security/pam_stack.so service=system-auth
-session    required     /lib/security/pam_stack.so service=system-auth

        In the "Permitted to use" box, click on the 'Change' button.

      • The /etc/pam.d/login file can be changed nearly the -same way. It now looks like this:

        Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible.

        auth       required     /lib/security/pam_securetty.so
-auth       sufficient   /lib/security/pam_winbind.so
-auth       sufficient   /lib/security/pam_unix.so use_first_pass
-auth       required     /lib/security/pam_stack.so service=system-auth
-auth       required     /lib/security/pam_nologin.so
-account    sufficient   /lib/security/pam_winbind.so
-account    required     /lib/security/pam_stack.so service=system-auth
-password   required     /lib/security/pam_stack.so service=system-auth
-session    required     /lib/security/pam_stack.so service=system-auth
-session    optional     /lib/security/pam_console.so

        In this case, I added the auth sufficient /lib/security/pam_winbind.so -lines as before, but also added the required pam_securetty.so -above it, to disallow root logins over the network. I also added a -sufficient /lib/security/pam_unix.so use_first_pass -line after the winbind.so line to get rid of annoying -double prompts for passwords.

        You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword.

      • The /etc/pam.conf needs to be changed. I changed this file so that my Domain -users can logon both locally as well as telnet.The following are the changes -that I made.You can customize the pam.conf file as per your requirements,but -be sure of those changes because in the worst case it will leave your system -nearly impossible to boot.

        To make the profile capable of being used by anyone select 'Everyone'

      • #
-#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
-#
-# Copyright (c) 1996-1999, Sun Microsystems, Inc.
-# All Rights Reserved.
-#
-# PAM configuration
-#
-# Authentication management
-#
-login   auth required   /usr/lib/security/pam_winbind.so
-login	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 
-login	auth required 	/usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 
-#
-rlogin  auth sufficient /usr/lib/security/pam_winbind.so
-rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
-rlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-#
-dtlogin auth sufficient /usr/lib/security/pam_winbind.so
-dtlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-#
-rsh	auth required	/usr/lib/security/$ISA/pam_rhosts_auth.so.1
-other   auth sufficient /usr/lib/security/pam_winbind.so
-other	auth required	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-#
-# Account management
-#
-login   account sufficient      /usr/lib/security/pam_winbind.so
-login	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-login	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-#
-dtlogin account sufficient      /usr/lib/security/pam_winbind.so
-dtlogin	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-dtlogin	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-#
-other   account sufficient      /usr/lib/security/pam_winbind.so
-other	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-other	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-#
-# Session management
-#
-other	session required	/usr/lib/security/$ISA/pam_unix.so.1 
-#
-# Password management
-#
-#other   password sufficient     /usr/lib/security/pam_winbind.so
-other	password required	/usr/lib/security/$ISA/pam_unix.so.1 
-dtsession auth required	/usr/lib/security/$ISA/pam_unix.so.1
-#
-# Support for Kerberos V5 authentication (uncomment to use Kerberos)
-#
-#rlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-#login	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-#dtlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-#other	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-#dtlogin	account optional /usr/lib/security/$ISA/pam_krb5.so.1
-#other	account optional /usr/lib/security/$ISA/pam_krb5.so.1
-#other	session optional /usr/lib/security/$ISA/pam_krb5.so.1
-#other	password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass

        Click OK. The Selection box will close.

      • I also added a try_first_pass line after the winbind.so line to get rid of -annoying double prompts for passwords.

        Now click on the 'Ok' button to create the profile in the path you +nominated.

      Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool.

      Now restart your Samba and try connecting through your application that you -configured in the pam.conf.

      Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable.

      16.6. Limitations

      Winbind has a number of limitations in its current - released version that we hope to overcome in future - releases:

      • Winbind is currently only available for - the Linux, Solaris and IRIX operating systems, although ports to other operating - systems are certainly possible. For such ports to be feasible, - we require the C library of the target operating system to - support the Name Service Switch and Pluggable Authentication - Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.

        This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is:

        "Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders"

        ...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this.

        If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy):

      • The mappings of Windows NT RIDs to UNIX ids - is not made algorithmically and depends on the order in which - unmapped users or groups are seen by winbind. It may be difficult - to recover the mappings of rid to UNIX id mapping if the file - containing this information is corrupted or destroyed.

        On the XP workstation log in with an Administrator account.

      • Currently the winbind PAM module does not take - into account possible workstation and logon time restrictions - that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

        Click: "Start", "Run"

      • Type: "mmc"

      • Click: "OK"

      • A Microsoft Management Console should appear.

      • Click: File, "Add/Remove Snap-in...", "Add"

      • Double-Click: "Group Policy"

      • Click: "Finish", "Close"

      • Click: "OK"

      • In the "Console Root" window:

      • Expand: "Local Computer Policy", "Computer Configuration",

      • "Administrative Templates", "System", "User Profiles"

      • Double-Click: "Do not check for user ownership of Roaming Profile

      • Folders"

      • Select: "Enabled"

      • Click: OK"

      • Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed).

      • Reboot

      16.7. Conclusion

      The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

      Chapter 17. Integrating MS Windows networks with SambaChapter 19. Integrating MS Windows networks with Samba

      This section deals with NetBIOS over TCP/IP name to IP address resolution. If you your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this @@ -14743,8 +14914,8 @@ CLASS="SECT1" >

      17.1. Name Resolution in a pure Unix/Linux world19.1. Name Resolution in a pure Unix/Linux world

      The key configuration files covered in this section are:

      17.1.1. 19.1.1. /etc/hosts

      17.1.2. 19.1.2. /etc/resolv.conf

      17.1.3. 19.1.3. /etc/host.conf

      17.1.4. 19.1.4. /etc/nsswitch.conf

      17.2. Name resolution as used within MS Windows networking19.2. Name resolution as used within MS Windows networking

      MS Windows networking is predicated about the name each machine @@ -15087,8 +15258,8 @@ CLASS="SECT2" >

      17.2.1. The NetBIOS Name Cache19.2.1. The NetBIOS Name Cache

      All MS Windows machines employ an in memory buffer in which is @@ -15114,8 +15285,8 @@ CLASS="SECT2" >

      17.2.2. The LMHOSTS file19.2.2. The LMHOSTS file

      This file is usually located in MS Windows NT 4.0 or @@ -15217,8 +15388,8 @@ CLASS="SECT2" >

      17.2.3. HOSTS file19.2.3. HOSTS file

      This file is usually located in MS Windows NT 4.0 or 2000 in @@ -15239,8 +15410,8 @@ CLASS="SECT2" >

      17.2.4. DNS Lookup19.2.4. DNS Lookup

      This capability is configured in the TCP/IP setup area in the network @@ -15259,8 +15430,8 @@ CLASS="SECT2" >

      17.2.5. WINS Lookup19.2.5. WINS Lookup

      A WINS (Windows Internet Name Server) service is the equivaent of the @@ -15302,14 +15473,14 @@ CLASS="CHAPTER" >Chapter 18. Improved browsing in samba

      Chapter 20. Improved browsing in samba

      18.1. Overview of browsing20.1. Overview of browsing

      SMB networking provides a mechanism by which clients can access a list @@ -15337,8 +15508,8 @@ CLASS="SECT1" >

      18.2. Browsing support in samba20.2. Browsing support in samba

      Samba facilitates browsing. The browsing is supported by nmbd @@ -15380,8 +15551,8 @@ CLASS="SECT1" >

      18.3. Problem resolution20.3. Problem resolution

      If something doesn't work then hopefully the log.nmb file will help @@ -15427,8 +15598,8 @@ CLASS="SECT1" >

      18.4. Browsing across subnets20.4. Browsing across subnets

      Since the release of Samba 1.9.17(alpha1) Samba has been @@ -15458,8 +15629,8 @@ CLASS="SECT2" >

      18.4.1. How does cross subnet browsing work ?20.4.1. How does cross subnet browsing work ?

      Cross subnet browsing is a complicated dance, containing multiple @@ -15669,8 +15840,8 @@ CLASS="SECT1" >

      18.5. Setting up a WINS server20.5. Setting up a WINS server

      Either a Samba machine or a Windows NT Server machine may be set up @@ -15752,8 +15923,8 @@ CLASS="SECT1" >

      18.6. Setting up Browsing in a WORKGROUP20.6. Setting up Browsing in a WORKGROUP

      To set up cross subnet browsing on a network containing machines @@ -15837,8 +16008,8 @@ CLASS="SECT1" >

      18.7. Setting up Browsing in a DOMAIN20.7. Setting up Browsing in a DOMAIN

      If you are adding Samba servers to a Windows NT Domain then @@ -15888,8 +16059,8 @@ CLASS="SECT1" >

      18.8. Forcing samba to be the master20.8. Forcing samba to be the master

      Who becomes the "master browser" is determined by an election process @@ -15936,8 +16107,8 @@ CLASS="SECT1" >

      18.9. Making samba the domain master20.9. Making samba the domain master

      The domain master is responsible for collating the browse lists of @@ -16009,8 +16180,8 @@ CLASS="SECT1" >

      18.10. Note about broadcast addresses20.10. Note about broadcast addresses

      If your network uses a "0" based broadcast address (for example if it @@ -16023,8 +16194,8 @@ CLASS="SECT1" >

      18.11. Multiple interfaces20.11. Multiple interfaces

      Samba now supports machines with multiple network interfaces. If you @@ -16038,14 +16209,14 @@ CLASS="CHAPTER" >Chapter 19. Hosting a Microsoft Distributed File System tree on Samba

      Chapter 21. Hosting a Microsoft Distributed File System tree on Samba

      19.1. Instructions21.1. Instructions

      The Distributed File System (or Dfs) provides a means of @@ -16176,8 +16347,8 @@ CLASS="SECT2" >

      19.1.1. Notes21.1.1. Notes

      Chapter 20. Stackable VFS modulesChapter 22. Stackable VFS modules

      20.1. Introduction and configuration22.1. Introduction and configuration

      Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. @@ -16258,16 +16429,16 @@ CLASS="SECT1" >

      20.2. Included modules22.2. Included modules

      20.2.1. audit22.2.1. audit

      A simple module to audit file access to the syslog @@ -16304,8 +16475,8 @@ CLASS="SECT2" >

      20.2.2. recycle22.2.2. recycle

      A recycle-bin like modules. When used any unlink call @@ -16375,8 +16546,8 @@ CLASS="SECT2" >

      20.2.3. netatalk22.2.3. netatalk

      A netatalk module, that will ease co-existence of samba and @@ -16408,8 +16579,8 @@ CLASS="SECT1" >

      20.3. VFS modules available elsewhere22.3. VFS modules available elsewhere

      This section contains a listing of various other VFS modules that @@ -16424,8 +16595,8 @@ CLASS="SECT2" >

      20.3.1. DatabaseFS22.3.1. DatabaseFS

      URL:

      20.3.2. vscan22.3.2. vscan

      URL: Chapter 21. Securing SambaChapter 23. Securing Samba

      21.1. Introduction23.1. Introduction

      This note was attached to the Samba 2.2.8 release notes as it contained an @@ -16501,8 +16672,8 @@ CLASS="SECT1" >

      21.2. Using host based protection23.2. Using host based protection

      In many installations of Samba the greatest threat comes for outside @@ -16533,8 +16704,8 @@ CLASS="SECT1" >

      21.3. Using interface protection23.3. Using interface protection

      By default Samba will accept connections on any network interface that @@ -16569,8 +16740,8 @@ CLASS="SECT1" >

      21.4. Using a firewall23.4. Using a firewall

      Many people use a firewall to deny access to services that they don't @@ -16599,8 +16770,8 @@ CLASS="SECT1" >

      21.5. Using a IPC$ share deny23.5. Using a IPC$ share deny

      If the above methods are not suitable, then you could also place a @@ -16638,8 +16809,8 @@ CLASS="SECT1" >

      21.6. Upgrading Samba23.6. Upgrading Samba

      Please check regularly on http://www.samba.org/ for updates and @@ -16654,14 +16825,14 @@ CLASS="CHAPTER" >Chapter 22. Unicode/CharsetsChapter 24. Unicode/Charsets

      22.1. What are charsets and unicode?24.1. What are charsets and unicode?

      Computers communicate in numbers. In texts, each number will be @@ -16710,8 +16881,8 @@ CLASS="SECT1" >

      22.2. Samba and charsets24.2. Samba and charsets

      As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, @@ -16786,101 +16957,101 @@ CLASS="TOC" >Table of Contents

      23. 25. Samba performance issues
      23.1. 25.1. Comparisons
      23.2. 25.2. Socket options
      23.3. 25.3. Read size
      23.4. 25.4. Max xmit
      23.5. 25.5. Log level
      23.6. 25.6. Read raw
      23.7. 25.7. Write raw
      23.8. 25.8. Slow Clients
      23.9. 25.9. Slow Logins
      23.10. 25.10. Client tuning
      24. 26. Portability
      24.1. 26.1. HPUX
      24.2. 26.2. SCO Unix
      24.3. 26.3. DNIX
      24.4. 26.4. RedHat Linux Rembrandt-II
      24.5. 26.5. AIX
      24.5.1. 26.5.1. Sequential Read Ahead
      25. 27. Samba and other CIFS clients
      25.1. 27.1. Macintosh clients?
      25.2. 27.2. OS2 Client
      25.2.1. 27.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?
      25.2.2. 27.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?
      25.2.3. 27.2.3. Are there any other issues when OS/2 (any version) is used as a client?
      25.2.4. 27.2.4. How do I get printer driver download working for OS/2 clients?
      25.3. 27.3. Windows for Workgroups
      25.3.1. 27.3.1. Use latest TCP/IP stack from Microsoft
      25.3.2. 27.3.2. Delete .pwl files after password change
      25.3.3. 27.3.3. Configure WfW password handling
      25.3.4. 27.3.4. Case handling of passwords
      25.3.5. 27.3.5. Use TCP/IP as default protocol
      25.4. 27.4. Windows '95/'98
      25.5. 27.5. Windows 2000 Service Pack 2
      26. 28. How to compile SAMBA
      26.1. 28.1. Access Samba source code via CVS
      26.1.1. 28.1.1. Introduction
      26.1.2. 28.1.2. CVS Access to samba.org
      26.2. 28.2. Accessing the samba sources via rsync and ftp
      26.3. 28.3. Building the Binaries
      26.3.1. 28.3.1. Compiling samba with Active Directory support
      26.4. 28.4. Starting the smbd and nmbd
      26.4.1. 28.4.1. Starting from inetd.conf
      26.4.2. 28.4.2. Alternative: starting it as a daemon
      27. 29. Reporting Bugs
      27.1. 29.1. Introduction
      27.2. 29.2. General info
      27.3. 29.3. Debug levels
      27.4. 29.4. Internal errors
      27.5. 29.5. Attaching to a running process
      27.6. 29.6. Patches
      28. 30. The samba checklist
      28.1. 30.1. Introduction
      28.2. 30.2. Assumptions
      28.3. 30.3. Tests
      28.3.1. 30.3.1. Test 1
      28.3.2. 30.3.2. Test 2
      28.3.3. 30.3.3. Test 3
      28.3.4. 30.3.4. Test 4
      28.3.5. 30.3.5. Test 5
      28.3.6. 30.3.6. Test 6
      28.3.7. 30.3.7. Test 7
      28.3.8. 30.3.8. Test 8
      28.3.9. 30.3.9. Test 9
      28.3.10. 30.3.10. Test 10
      28.3.11. 30.3.11. Test 11
      28.4. 30.4. Still having troubles?
      Chapter 23. Samba performance issuesChapter 25. Samba performance issues

      23.1. Comparisons25.1. Comparisons

      The Samba server uses TCP to talk to the client. Thus if you are @@ -17217,8 +17388,8 @@ CLASS="SECT1" >

      23.2. Socket options25.2. Socket options

      There are a number of socket options that can greatly affect the @@ -17245,8 +17416,8 @@ CLASS="SECT1" >

      23.3. Read size25.3. Read size

      The option "read size" affects the overlap of disk reads/writes with @@ -17271,8 +17442,8 @@ CLASS="SECT1" >

      23.4. Max xmit25.4. Max xmit

      At startup the client and server negotiate a "maximum transmit" size, @@ -17294,8 +17465,8 @@ CLASS="SECT1" >

      23.5. Log level25.5. Log level

      If you set the log level (also known as "debug level") higher than 2 @@ -17308,8 +17479,8 @@ CLASS="SECT1" >

      23.6. Read raw25.6. Read raw

      The "read raw" operation is designed to be an optimised, low-latency @@ -17330,8 +17501,8 @@ CLASS="SECT1" >

      23.7. Write raw25.7. Write raw

      The "write raw" operation is designed to be an optimised, low-latency @@ -17347,8 +17518,8 @@ CLASS="SECT1" >

      23.8. Slow Clients25.8. Slow Clients

      One person has reported that setting the protocol to COREPLUS rather @@ -17364,8 +17535,8 @@ CLASS="SECT1" >

      23.9. Slow Logins25.9. Slow Logins

      Slow logins are almost always due to the password checking time. Using @@ -17377,8 +17548,8 @@ CLASS="SECT1" >

      23.10. Client tuning25.10. Client tuning

      Often a speed problem can be traced to the client. The client (for @@ -17485,7 +17656,7 @@ CLASS="CHAPTER" >Chapter 24. PortabilityChapter 26. Portability

      Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains @@ -17495,8 +17666,8 @@ CLASS="SECT1" >

      24.1. HPUX26.1. HPUX

      HP's implementation of supplementary groups is, er, non-standard (for @@ -17525,8 +17696,8 @@ CLASS="SECT1" >

      24.2. SCO Unix26.2. SCO Unix

      @@ -17542,8 +17713,8 @@ CLASS="SECT1" >

      24.3. DNIX26.3. DNIX

      DNIX has a problem with seteuid() and setegid(). These routines are @@ -17649,8 +17820,8 @@ CLASS="SECT1" >

      24.4. RedHat Linux Rembrandt-II26.4. RedHat Linux Rembrandt-II

      By default RedHat Rembrandt-II during installation adds an @@ -17673,16 +17844,16 @@ CLASS="SECT1" >

      24.5. AIX26.5. AIX

      24.5.1. Sequential Read Ahead26.5.1. Sequential Read Ahead

      Disabling Sequential Read Ahead using "vmtune -r 0" improves @@ -17696,7 +17867,7 @@ CLASS="CHAPTER" >Chapter 25. Samba and other CIFS clientsChapter 27. Samba and other CIFS clients

      This chapter contains client-specific information.

      25.1. Macintosh clients?27.1. Macintosh clients?

      Yes.

      25.2. OS2 Client27.2. OS2 Client

      25.2.1. How can I configure OS/2 Warp Connect or +NAME="AEN3644" +>27.2.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?

      25.2.2. How can I configure OS/2 Warp 3 (not Connect), +NAME="AEN3659" +>27.2.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?

      25.2.3. Are there any other issues when OS/2 (any version) +NAME="AEN3668" +>27.2.3. Are there any other issues when OS/2 (any version) is used as a client?

      25.2.4. How do I get printer driver download working +NAME="AEN3672" +>27.2.4. How do I get printer driver download working for OS/2 clients?

      25.3. Windows for Workgroups27.3. Windows for Workgroups

      25.3.1. Use latest TCP/IP stack from Microsoft27.3.1. Use latest TCP/IP stack from Microsoft

      Use the latest TCP/IP stack from microsoft if you use Windows @@ -17960,8 +18131,8 @@ CLASS="SECT2" >

      25.3.2. Delete .pwl files after password change27.3.2. Delete .pwl files after password change

      WfWg does a lousy job with passwords. I find that if I change my @@ -17980,8 +18151,8 @@ CLASS="SECT2" >

      25.3.3. Configure WfW password handling27.3.3. Configure WfW password handling

      There is a program call admincfg.exe @@ -17999,8 +18170,8 @@ CLASS="SECT2" >

      25.3.4. Case handling of passwords27.3.4. Case handling of passwords

      Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the

      25.3.5. Use TCP/IP as default protocol27.3.5. Use TCP/IP as default protocol

      To support print queue reporting you may find @@ -18033,8 +18204,8 @@ CLASS="SECT1" >

      25.4. Windows '95/'9827.4. Windows '95/'98

      When using Windows 95 OEM SR2 the following updates are recommended where Samba @@ -18081,8 +18252,8 @@ CLASS="SECT1" >

      25.5. Windows 2000 Service Pack 227.5. Windows 2000 Service Pack 2

      @@ -18165,7 +18336,7 @@ CLASS="CHAPTER" >Chapter 26. How to compile SAMBAChapter 28. How to compile SAMBA

      You can obtain the samba source from the

      26.1. Access Samba source code via CVS28.1. Access Samba source code via CVS

      26.1.1. Introduction28.1.1. Introduction

      Samba is developed in an open environment. Developers use CVS @@ -18208,8 +18379,8 @@ CLASS="SECT2" >

      26.1.2. CVS Access to samba.org28.1.2. CVS Access to samba.org

      The machine samba.org runs a publicly accessible CVS @@ -18221,8 +18392,8 @@ CLASS="SECT3" >

      26.1.2.1. Access via CVSweb28.1.2.1. Access via CVSweb

      You can access the source code via your @@ -18242,8 +18413,8 @@ CLASS="SECT3" >

      26.1.2.2. Access via cvs28.1.2.2. Access via cvs

      You can also access the source code via a @@ -18347,8 +18518,8 @@ CLASS="SECT1" >

      26.2. Accessing the samba sources via rsync and ftp28.2. Accessing the samba sources via rsync and ftp

      pserver.samba.org also exports unpacked copies of most parts of the CVS tree at

      26.3. Building the Binaries28.3. Building the Binaries

      To do this, first run the program

      26.3.1. Compiling samba with Active Directory support28.3.1. Compiling samba with Active Directory support

      In order to compile samba with ADS support, you need to have installed @@ -18511,8 +18682,8 @@ CLASS="SECT3" >

      26.3.1.1. Installing the required packages for Debian28.3.1.1. Installing the required packages for Debian

      On Debian you need to install the following packages:

      26.3.1.2. Installing the required packages for RedHat28.3.1.2. Installing the required packages for RedHat

      On RedHat this means you should have at least:

      26.4. Starting the smbd and nmbd28.4. Starting the smbd and nmbd

      You must choose to start smbd and nmbd either @@ -18624,8 +18795,8 @@ CLASS="SECT2" >

      26.4.1. Starting from inetd.conf28.4.1. Starting from inetd.conf

      NOTE; The following will be different if @@ -18724,8 +18895,8 @@ CLASS="SECT2" >

      26.4.2. Alternative: starting it as a daemon28.4.2. Alternative: starting it as a daemon

      To start the server as a daemon you should create @@ -18783,14 +18954,14 @@ CLASS="CHAPTER" >Chapter 27. Reporting BugsChapter 29. Reporting Bugs

      27.1. Introduction29.1. Introduction

      The email address for bug reports for stable releases is

      27.2. General info29.2. General info

      Before submitting a bug report check your config for silly @@ -18859,8 +19030,8 @@ CLASS="SECT1" >

      27.3. Debug levels29.3. Debug levels

      If the bug has anything to do with Samba behaving incorrectly as a @@ -18929,8 +19100,8 @@ CLASS="SECT1" >

      27.4. Internal errors29.4. Internal errors

      If you get a "INTERNAL ERROR" message in your log files it means that @@ -18973,8 +19144,8 @@ CLASS="SECT1" >

      27.5. Attaching to a running process29.5. Attaching to a running process

      Unfortunately some unixes (in particular some recent linux kernels) @@ -18990,8 +19161,8 @@ CLASS="SECT1" >

      27.6. Patches29.6. Patches

      The best sort of bug report is one that includes a fix! If you send us @@ -19013,14 +19184,14 @@ CLASS="CHAPTER" >Chapter 28. The samba checklistChapter 30. The samba checklist

      28.1. Introduction30.1. Introduction

      This file contains a list of tests you can perform to validate your @@ -19041,8 +19212,8 @@ CLASS="SECT1" >

      28.2. Assumptions30.2. Assumptions

      In all of the tests it is assumed you have a Samba server called @@ -19079,16 +19250,16 @@ CLASS="SECT1" >

      28.3. Tests30.3. Tests

      28.3.1. Test 130.3.1. Test 1

      In the directory in which you store your smb.conf file, run the command @@ -19109,8 +19280,8 @@ CLASS="SECT2" >

      28.3.2. Test 230.3.2. Test 2

      Run the command "ping BIGSERVER" from the PC and "ping ACLIENT" from @@ -19135,8 +19306,8 @@ CLASS="SECT2" >

      28.3.3. Test 330.3.3. Test 3

      Run the command "smbclient -L BIGSERVER" on the unix box. You @@ -19206,8 +19377,8 @@ CLASS="SECT2" >

      28.3.4. Test 430.3.4. Test 4

      Run the command "nmblookup -B BIGSERVER __SAMBA__". You should get the @@ -19227,8 +19398,8 @@ CLASS="SECT2" >

      28.3.5. Test 530.3.5. Test 5

      run the command

      28.3.6. Test 630.3.6. Test 6

      Run the command

      28.3.7. Test 730.3.7. Test 7

      Run the command

      28.3.8. Test 830.3.8. Test 8

      On the PC type the command

      28.3.9. Test 930.3.9. Test 9

      Run the command

      28.3.10. Test 1030.3.10. Test 10

      Run the command

      28.3.11. Test 1130.3.11. Test 11

      From file manager try to browse the server. Your samba server should @@ -19519,8 +19690,8 @@ CLASS="SECT1" >

      28.4. Still having troubles?30.4. Still having troubles?

      Try the mailing list or newsgroup, or use the ethereal utility to diff --git a/docs/manpages/findsmb.1 b/docs/manpages/findsmb.1 index d45c3ab8fe..e61eacc597 100644 --- a/docs/manpages/findsmb.1 +++ b/docs/manpages/findsmb.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "FINDSMB" "1" "24 March 2003" "" "" +.TH "FINDSMB" "1" "03 april 2003" "" "" .SH NAME findsmb \- list info about machines that respond to SMB name queries on a subnet diff --git a/docs/manpages/lmhosts.5 b/docs/manpages/lmhosts.5 index 76d48f8e1e..3042a9c522 100644 --- a/docs/manpages/lmhosts.5 +++ b/docs/manpages/lmhosts.5 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "LMHOSTS" "5" "24 March 2003" "" "" +.TH "LMHOSTS" "5" "03 april 2003" "" "" .SH NAME lmhosts \- The Samba NetBIOS hosts file diff --git a/docs/manpages/net.8 b/docs/manpages/net.8 index 8ade7f5c4a..71e0087d40 100644 --- a/docs/manpages/net.8 +++ b/docs/manpages/net.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "NET" "8" "24 March 2003" "" "" +.TH "NET" "8" "03 april 2003" "" "" .SH NAME net \- Tool for administration of Samba and remote CIFS servers. diff --git a/docs/manpages/nmbd.8 b/docs/manpages/nmbd.8 index 6906231177..bd263fcf15 100644 --- a/docs/manpages/nmbd.8 +++ b/docs/manpages/nmbd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "NMBD" "8" "30 March 2003" "" "" +.TH "NMBD" "8" "03 april 2003" "" "" .SH NAME nmbd \- NetBIOS name server to provide NetBIOS over IP naming services to clients diff --git a/docs/manpages/nmblookup.1 b/docs/manpages/nmblookup.1 index 653aa6f663..08ddd1c133 100644 --- a/docs/manpages/nmblookup.1 +++ b/docs/manpages/nmblookup.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "NMBLOOKUP" "1" "24 March 2003" "" "" +.TH "NMBLOOKUP" "1" "03 april 2003" "" "" .SH NAME nmblookup \- NetBIOS over TCP/IP client used to lookup NetBIOS names diff --git a/docs/manpages/pdbedit.8 b/docs/manpages/pdbedit.8 index 0f48988600..fe32547e92 100644 --- a/docs/manpages/pdbedit.8 +++ b/docs/manpages/pdbedit.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "PDBEDIT" "8" "30 March 2003" "" "" +.TH "PDBEDIT" "8" "03 april 2003" "" "" .SH NAME pdbedit \- manage the SAM database diff --git a/docs/manpages/rpcclient.1 b/docs/manpages/rpcclient.1 index a359d6772f..76e606240f 100644 --- a/docs/manpages/rpcclient.1 +++ b/docs/manpages/rpcclient.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "RPCCLIENT" "1" "24 March 2003" "" "" +.TH "RPCCLIENT" "1" "03 april 2003" "" "" .SH NAME rpcclient \- tool for executing client side MS-RPC functions @@ -116,10 +116,10 @@ domain = Make certain that the permissions on the file restrict access from unwanted users. .TP -\fB-U|--user=username[&%;password]\fR +\fB-U|--user=username[%password]\fR Sets the SMB username or username and password. -If &%;password is not specified, the user will be prompted. The +If %password is not specified, the user will be prompted. The client will first check the \fBUSER\fR environment variable, then the \fBLOGNAME\fR variable and if either exists, the string is uppercased. If these environmental variables are not diff --git a/docs/manpages/samba.7 b/docs/manpages/samba.7 index 6703cb95ce..e2a6132d18 100644 --- a/docs/manpages/samba.7 +++ b/docs/manpages/samba.7 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SAMBA" "7" "24 March 2003" "" "" +.TH "SAMBA" "7" "03 april 2003" "" "" .SH NAME Samba \- A Windows SMB/CIFS fileserver for UNIX diff --git a/docs/manpages/smb.conf.5 b/docs/manpages/smb.conf.5 index ddcc2d24e5..719bd64512 100644 --- a/docs/manpages/smb.conf.5 +++ b/docs/manpages/smb.conf.5 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMB.CONF" "5" "30 March 2003" "" "" +.TH "SMB.CONF" "5" "03 april 2003" "" "" .SH NAME smb.conf \- The configuration file for the Samba suite @@ -256,12 +256,15 @@ An alias, by the way, is defined as any component of the first entry of a printcap record. Records are separated by newlines, components (if there are more than one) are separated by vertical bar symbols ('|'). -.PP -NOTE: On SYSV systems which use lpstat to determine what +.sp +.RS +.B "Note:" +On SYSV systems which use lpstat to determine what printers are defined on the system you may be able to use "printcap name = lpstat" to automatically obtain a list of printers. See the "printcap name" option for more details. +.RE .SH "PARAMETERS" .PP parameters define the specific attributes of sections. @@ -664,9 +667,6 @@ each parameter for details. Note that some are synonyms. \fIldap delete dn\fR .TP 0.2i \(bu -\fIldap del only sam attr\fR -.TP 0.2i -\(bu \fIldap filter\fR .TP 0.2i \(bu @@ -928,6 +928,9 @@ each parameter for details. Note that some are synonyms. \fIserver string\fR .TP 0.2i \(bu +\fIset primary group script\fR +.TP 0.2i +\(bu \fIshow add printer wizard\fR .TP 0.2i \(bu @@ -3027,9 +3030,12 @@ and the program will extract the servername from before the first ':'. There should probably be a better parsing system that copes with different map formats and also Amd (another automounter) maps. - -\fBNOTE :\fRA working NIS client is required on +.sp +.RS +.B "Note:" +A working NIS client is required on the system for this option to work. +.RE See also \fInis homedir\fR , \fIdomain logons\fR @@ -3139,8 +3145,10 @@ and users who will be allowed access without specifying a password. This is not be confused with \fIhosts allow\fR which is about hosts access to services and is more useful for guest services. \fI hosts equiv\fR may be useful for NT clients which will not supply passwords to Samba. - -\fBNOTE :\fR The use of \fIhosts equiv +.sp +.RS +.B "Note:" +The use of \fIhosts equiv \fR can be a major security hole. This is because you are trusting the PC to supply the correct username. It is very easy to get a PC to supply a false username. I recommend that the @@ -3148,6 +3156,7 @@ get a PC to supply a false username. I recommend that the know what you are doing, or perhaps on a home network where you trust your spouse and kids. And only if you \fBreally\fR trust them :-). +.RE Default: \fBno host equivalences\fR @@ -3354,16 +3363,13 @@ stored in the \fIprivate/secrets.tdb\fR file. See the \fBsmbpasswd\fR(8) man page for more information on how to accmplish this. .TP -\fB>ldap del only sam attr (G)\fR +\fB>ldap delete dn (G)\fR This parameter specifies whether a delete operation in the ldapsam deletes the complete entry or only the attributes specific to Samba. Default : \fBldap delete dn = no\fR .TP -\fB>ldap del only sam attr (G)\fR -Inverted synonym for \fI ldap delete dn\fR. -.TP \fB>ldap filter (G)\fR This parameter specifies the RFC 2254 compliant LDAP search filter. The default is to match the login name with the uid @@ -4667,10 +4673,13 @@ the storage of passwords for users who don't exist in /etc/passwd. This is most often used for machine account creation. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise. - -NOTE: These userids never appear on the system and Samba will never +.sp +.RS +.B "Note:" +These userids never appear on the system and Samba will never \&'become' these users. They are used only to ensure that the algorithmic RID mapping does not conflict with normal users. +.RE Default: \fBnon unix account range = \fR @@ -5139,11 +5148,14 @@ by any method and order described in that parameter. The password server must be a machine capable of using the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode. - -\fBNOTE:\fR Using a password server +.sp +.RS +.B "Note:" +Using a password server means your UNIX box (running Samba) is only as secure as your password server. \fBDO NOT CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST\fR. +.RE Never point a Samba server at itself for password serving. This will cause a loop and could lock up your Samba @@ -5500,11 +5512,14 @@ print5|My Printer 5 where the '|' separates aliases of a printer. The fact that the second alias has a space in it gives a hint to Samba that it's a comment. - -\fBNOTE\fR: Under AIX the default printcap +.sp +.RS +.B "Note:" +Under AIX the default printcap name is \fI/etc/qconfig\fR. Samba will assume the file is in AIX \fIqconfig\fR format if the string \fIqconfig\fR appears in the printcap filename. +.RE Default: \fBprintcap name = /etc/printcap\fR @@ -6110,6 +6125,22 @@ Default: \fBserver string = Samba %v\fR Example: \fBserver string = University of GNUs Samba Server\fR .TP +\fB>set primary group script (G)\fR +Thanks to the Posix subsystem in NT a +Windows User has a primary group in addition to the +auxiliary groups. This script sets the primary group +in the unix userdatase when an administrator sets the +primary group from the windows user manager or when +fetching a SAM with \fBnet rpc +vampire\fR. \fI%u\fR will be +replaced with the user whose primary group is to be +set. \fI%g\fR will be replaced with +the group to set. + +Default: \fBNo default value\fR + +Example: \fBset primary group script = /usr/sbin/usermod -g '%g' '%u'\fR +.TP \fB>set directory (S)\fR If \fBset directory = no\fR, then users of the service may not use the setdir command to change @@ -7163,16 +7194,29 @@ your network then you should set this to the WINS server's IP. You should point this at your WINS server if you have a multi-subnetted network. -\fBNOTE\fR. You need to set up Samba to point +If you want to work in multiple namespaces, you can +give every wins server a 'tag'. For each tag, only one +(working) server will be queried for a name. The tag should be +seperated from the ip address by a colon. +.sp +.RS +.B "Note:" +You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet browsing to work correctly. +.RE -See the documentation file BROWSING -in the docs/ directory of your Samba source distribution. +See the documentation file Browsing in the samba howto collection. Default: \fBnot enabled\fR -Example: \fBwins server = 192.9.200.1\fR +Example: \fBwins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61\fR + +For this example when querying a certain name, 192.19.200.1 will +be asked first and if that doesn't respond 192.168.2.61. If either +of those doesn't know the name 192.168.3.199 will be queried. + +Example: \fBwins server = 192.9.200.1 192.168.2.61\fR .TP \fB>wins support (G)\fR This boolean controls if the \fBnmbd\fR(8) process in Samba will act as a WINS server. You should diff --git a/docs/manpages/smbcacls.1 b/docs/manpages/smbcacls.1 index b38c2adf8a..69d9cd9f1a 100644 --- a/docs/manpages/smbcacls.1 +++ b/docs/manpages/smbcacls.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBCACLS" "1" "24 March 2003" "" "" +.TH "SMBCACLS" "1" "03 april 2003" "" "" .SH NAME smbcacls \- Set or get ACLs on an NT file or directory names diff --git a/docs/manpages/smbclient.1 b/docs/manpages/smbclient.1 index 6ba48185a3..72747a74c2 100644 --- a/docs/manpages/smbclient.1 +++ b/docs/manpages/smbclient.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBCLIENT" "1" "24 March 2003" "" "" +.TH "SMBCLIENT" "1" "03 april 2003" "" "" .SH NAME smbclient \- ftp-like client to access SMB/CIFS resources on servers @@ -290,10 +290,10 @@ domain = Make certain that the permissions on the file restrict access from unwanted users. .TP -\fB-U|--user=username[&%;password]\fR +\fB-U|--user=username[%password]\fR Sets the SMB username or username and password. -If &%;password is not specified, the user will be prompted. The +If %password is not specified, the user will be prompted. The client will first check the \fBUSER\fR environment variable, then the \fBLOGNAME\fR variable and if either exists, the string is uppercased. If these environmental variables are not diff --git a/docs/manpages/smbcontrol.1 b/docs/manpages/smbcontrol.1 index a4fe043f3c..5b612b1b13 100644 --- a/docs/manpages/smbcontrol.1 +++ b/docs/manpages/smbcontrol.1 @@ -3,13 +3,13 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBCONTROL" "1" "24 March 2003" "" "" +.TH "SMBCONTROL" "1" "03 april 2003" "" "" .SH NAME smbcontrol \- send messages to smbd, nmbd or winbindd processes .SH SYNOPSIS -\fBsmbcontrol\fR [ \fB-i\fR ] +\fBsmbcontrol\fR [ \fB-i\fR ] [ \fB-s\fR ] \fBsmbcontrol\fR [ \fBdestination\fR ] [ \fBmessage-type\fR ] [ \fBparameter\fR ] @@ -22,6 +22,19 @@ This tool is part of the \fBSamba\fR(7) suite. sends messages to a \fBsmbd\fR(8), a \fBnmbd\fR(8), or a \fBwinbindd\fR(8) daemon running on the system. .SH "OPTIONS" .TP +\fB-h|--help\fR +Print a summary of command line options. +.TP +\fB-s \fR +The file specified contains the +configuration details required by the server. The +information in this file includes server-specific +information such as what printcap file to use, as well +as descriptions of all the services that the server is +to provide. See \fIsmb.conf(5)\fR for more information. +The default configuration file name is determined at +compile time. +.TP \fB-i\fR Run interactively. Individual commands of the form destination message-type parameters can be entered @@ -42,57 +55,56 @@ If a single process ID is given, the message is sent to only that process. .TP \fBmessage-type\fR -One of: close-share, -debug, -force-election, ping -, profile, debuglevel, profilelevel, -or printnotify. - -The close-share message-type sends a -message to smbd which will then close the client connections to -the named share. Note that this doesn't affect client connections -to any other shares. This message-type takes an argument of the +Type of message to send. See +the section MESSAGE-TYPES for details. +.TP +\fBparameters\fR +any parameters required for the message-type +.SH "MESSAGE-TYPES" +.PP +Available message types are: +.TP +\fBclose-share\fR +Order smbd to close the client +connections to the named share. Note that this doesn't affect client +connections to any other shares. This message-type takes an argument of the share name for which client connections will be closed, or the "*" character which will close all currently open shares. This may be useful if you made changes to the access controls on the share. This message can only be sent to smbd. - -The debug message-type allows -the debug level to be set to the value specified by the +.TP +\fBdebug\fR +Set debug level to the value specified by the parameter. This can be sent to any of the destinations. - -The force-election message-type can only be -sent to the nmbd destination. This message -causes the \fBnmbd\fR daemon to force a new browse -master election. - -The ping message-type sends the -number of "ping" messages specified by the parameter and waits -for the same number of reply "pong" messages. This can be sent to +.TP +\fBforce-election\fR +This message causes the \fBnmbd\fR daemon to +force a new browse master election. +.TP +\fBping\fR +Send specified number of "ping" messages and +wait for the same number of reply "pong" messages. This can be sent to any of the destinations. - -The profile message-type sends a -message to an smbd to change the profile settings based on the +.TP +\fBprofile\fR +Change profile settings of a daemon, based on the parameter. The parameter can be "on" to turn on profile stats collection, "off" to turn off profile stats collection, "count" to enable only collection of count stats (time stats are disabled), and "flush" to zero the current profile stats. This can be sent to any smbd or nmbd destinations. - -The debuglevel message-type sends -a "request debug level" message. The current debug level setting -is returned by a "debuglevel" message. This can be -sent to any of the destinations. - -The profilelevel message-type sends -a "request profile level" message. The current profile level -setting is returned by a "profilelevel" message. This can be sent -to any smbd or nmbd destinations. - -The printnotify message-type sends a -message to smbd which in turn sends a printer notify message to -any Windows NT clients connected to a printer. This message-type -takes the following arguments: +.TP +\fBdebuglevel\fR +Request debuglevel of a certain daemon and write it to stdout. This +can be sent to any of the destinations. +.TP +\fBprofilelevel\fR +Request profilelevel of a certain daemon and write it to stdout. +This can be sent to any smbd or nmbd destinations. +.TP +\fBprintnotify\fR +Order smbd to send a printer notify message to any Windows NT clients +connected to a printer. This message-type takes the following arguments: .RS .TP \fBqueuepause printername\fR @@ -118,16 +130,46 @@ Send a job delete change notify message for the printer and unix jobid specified. .RE + Note that this message only sends notification that an event has occured. It doesn't actually cause the event to happen. + This message can only be sent to smbd. .TP -\fBparameters\fR -any parameters required for the message-type +\fBsamsync\fR +Order smbd to synchronise sam database from PDC (being BDC). Can only be sent to smbd. +.sp +.RS +.B "Note:" +Not working at the moment +.RE +.TP +\fBsamrepl\fR +Send sam replication message, with specified serial. Can only be sent to smbd. Should not be used manually. +.TP +\fBdmalloc-mark\fR +Set a mark for dmalloc. Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support. +.TP +\fBdmalloc-log-changed\fR +Dump the pointers that have changed since the mark set by dmalloc-mark. +Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support. +.TP +\fBshutdown\fR +Shut down specified daemon. Can be sent to both smbd and nmbd. +.TP +\fBtallocdump and pool-usage\fR +Print a human-readable description of all +talloc(pool) memory usage by the specified daemon/process. Available +for both smbd and nmbd. +.TP +\fBdrvupgrade\fR +Force clients of printers using specified driver +to update their local version of the driver. Can only be +sent to smbd. .SH "VERSION" .PP -This man page is correct for version 2.2 of +This man page is correct for version 3.0 of the Samba suite. .SH "SEE ALSO" .PP diff --git a/docs/manpages/smbd.8 b/docs/manpages/smbd.8 index ef498cbf64..4f99c18f52 100644 --- a/docs/manpages/smbd.8 +++ b/docs/manpages/smbd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBD" "8" "24 March 2003" "" "" +.TH "SMBD" "8" "03 april 2003" "" "" .SH NAME smbd \- server to provide SMB/CIFS services to clients diff --git a/docs/manpages/smbgroupedit.8 b/docs/manpages/smbgroupedit.8 index df8b4e30db..6b9bd7e37d 100644 --- a/docs/manpages/smbgroupedit.8 +++ b/docs/manpages/smbgroupedit.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBGROUPEDIT" "8" "24 March 2003" "" "" +.TH "SMBGROUPEDIT" "8" "03 april 2003" "" "" .SH NAME smbgroupedit \- Query/set/change UNIX - Windows NT group mapping diff --git a/docs/manpages/smbmnt.8 b/docs/manpages/smbmnt.8 index 9d88e28655..c17d15261a 100644 --- a/docs/manpages/smbmnt.8 +++ b/docs/manpages/smbmnt.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBMNT" "8" "24 March 2003" "" "" +.TH "SMBMNT" "8" "03 april 2003" "" "" .SH NAME smbmnt \- helper utility for mounting SMB filesystems diff --git a/docs/manpages/smbmount.8 b/docs/manpages/smbmount.8 index f34ec152af..344fc5e0cd 100644 --- a/docs/manpages/smbmount.8 +++ b/docs/manpages/smbmount.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBMOUNT" "8" "24 March 2003" "" "" +.TH "SMBMOUNT" "8" "03 april 2003" "" "" .SH NAME smbmount \- mount an smbfs filesystem diff --git a/docs/manpages/smbpasswd.5 b/docs/manpages/smbpasswd.5 index 0556c8d4dd..1eb8d3f204 100644 --- a/docs/manpages/smbpasswd.5 +++ b/docs/manpages/smbpasswd.5 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBPASSWD" "5" "24 March 2003" "" "" +.TH "SMBPASSWD" "5" "03 april 2003" "" "" .SH NAME smbpasswd \- The Samba encrypted password file diff --git a/docs/manpages/smbpasswd.8 b/docs/manpages/smbpasswd.8 index 3ebaa4f8c9..8d4598895f 100644 --- a/docs/manpages/smbpasswd.8 +++ b/docs/manpages/smbpasswd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBPASSWD" "8" "24 March 2003" "" "" +.TH "SMBPASSWD" "8" "03 april 2003" "" "" .SH NAME smbpasswd \- change a user's SMB password diff --git a/docs/manpages/smbsh.1 b/docs/manpages/smbsh.1 index 0f7ed1d290..d2770d410a 100644 --- a/docs/manpages/smbsh.1 +++ b/docs/manpages/smbsh.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBSH" "1" "30 March 2003" "" "" +.TH "SMBSH" "1" "03 april 2003" "" "" .SH NAME smbsh \- Allows access to Windows NT filesystem using UNIX commands diff --git a/docs/manpages/smbspool.8 b/docs/manpages/smbspool.8 index 2417a1ee2e..7ee3a465b3 100644 --- a/docs/manpages/smbspool.8 +++ b/docs/manpages/smbspool.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBSPOOL" "8" "24 March 2003" "" "" +.TH "SMBSPOOL" "8" "03 april 2003" "" "" .SH NAME smbspool \- send a print file to an SMB printer diff --git a/docs/manpages/smbstatus.1 b/docs/manpages/smbstatus.1 index 5cc6811188..133de67ab6 100644 --- a/docs/manpages/smbstatus.1 +++ b/docs/manpages/smbstatus.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBSTATUS" "1" "24 March 2003" "" "" +.TH "SMBSTATUS" "1" "03 april 2003" "" "" .SH NAME smbstatus \- report on current Samba connections diff --git a/docs/manpages/smbtar.1 b/docs/manpages/smbtar.1 index 20a261a2b3..bef59c21ac 100644 --- a/docs/manpages/smbtar.1 +++ b/docs/manpages/smbtar.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBTAR" "1" "24 March 2003" "" "" +.TH "SMBTAR" "1" "03 april 2003" "" "" .SH NAME smbtar \- shell script for backing up SMB/CIFS shares directly to UNIX tape drives diff --git a/docs/manpages/smbumount.8 b/docs/manpages/smbumount.8 index 21f5545cea..6a2f04cfd5 100644 --- a/docs/manpages/smbumount.8 +++ b/docs/manpages/smbumount.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBUMOUNT" "8" "24 March 2003" "" "" +.TH "SMBUMOUNT" "8" "03 april 2003" "" "" .SH NAME smbumount \- smbfs umount for normal users diff --git a/docs/manpages/swat.8 b/docs/manpages/swat.8 index a76db24100..47ad346fd7 100644 --- a/docs/manpages/swat.8 +++ b/docs/manpages/swat.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SWAT" "8" "24 March 2003" "" "" +.TH "SWAT" "8" "03 april 2003" "" "" .SH NAME swat \- Samba Web Administration Tool diff --git a/docs/manpages/testparm.1 b/docs/manpages/testparm.1 index cf91b23295..e9ecd565c9 100644 --- a/docs/manpages/testparm.1 +++ b/docs/manpages/testparm.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "TESTPARM" "1" "24 March 2003" "" "" +.TH "TESTPARM" "1" "03 april 2003" "" "" .SH NAME testparm \- check an smb.conf configuration file for internal correctness diff --git a/docs/manpages/testprns.1 b/docs/manpages/testprns.1 index 66f4a08f56..49ec423986 100644 --- a/docs/manpages/testprns.1 +++ b/docs/manpages/testprns.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "TESTPRNS" "1" "24 March 2003" "" "" +.TH "TESTPRNS" "1" "03 april 2003" "" "" .SH NAME testprns \- check printer name for validity with smbd diff --git a/docs/manpages/vfstest.1 b/docs/manpages/vfstest.1 index f123fcc9f3..71e07c58e6 100644 --- a/docs/manpages/vfstest.1 +++ b/docs/manpages/vfstest.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "VFSTEST" "1" "24 March 2003" "" "" +.TH "VFSTEST" "1" "03 april 2003" "" "" .SH NAME vfstest \- tool for testing samba VFS modules diff --git a/docs/manpages/wbinfo.1 b/docs/manpages/wbinfo.1 index d3ed336b47..5c4392e80e 100644 --- a/docs/manpages/wbinfo.1 +++ b/docs/manpages/wbinfo.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "WBINFO" "1" "24 March 2003" "" "" +.TH "WBINFO" "1" "03 april 2003" "" "" .SH NAME wbinfo \- Query information from winbind daemon diff --git a/docs/manpages/winbindd.8 b/docs/manpages/winbindd.8 index 0a35a9264d..bccc5e04cd 100644 --- a/docs/manpages/winbindd.8 +++ b/docs/manpages/winbindd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "WINBINDD" "8" "30 March 2003" "" "" +.TH "WINBINDD" "8" "03 april 2003" "" "" .SH NAME winbindd \- Name Service Switch daemon for resolving names from NT servers @@ -241,7 +241,7 @@ Now replace the account lines with this: \fR .PP The next step is to join the domain. To do that use the -\fBsmbpasswd\fR program like this: +\fBnet\fR program like this: .PP \fBnet join -S PDC -U Administrator\fR .PP @@ -290,11 +290,6 @@ the list of trusted domains for the Windows NT server on startup and when a SIGHUP is received. Thus, for a running \fB winbindd\fR to become aware of new trust relationships between servers, it must be sent a SIGHUP signal. .PP -Client processes resolving names through the \fBwinbindd\fR -nsswitch module read an environment variable named \fB $WINBINDD_DOMAIN\fR. If this variable contains a comma separated -list of Windows NT domain names, then winbindd will only resolve users -and groups within those Windows NT domains. -.PP PAM is really easy to misconfigure. Make sure you know what you are doing when modifying PAM configuration files. It is possible to set up PAM such that you can no longer log into your system. @@ -338,6 +333,19 @@ if both the \fI/tmp/.winbindd\fR directory and \fI/tmp/.winbindd/pipe\fR file are owned by root. .TP +\fB$LOCKDIR/winbindd_privilaged/pipe\fR +The UNIX pipe over which 'privilaged' clients +communicate with the \fBwinbindd\fR program. For security +reasons, access to some winbindd functions - like those needed by +the \fBntlm_auth\fR utility - is restricted. By default, +only users in the 'root' group will get this access, however the administrator +may change the group permissions on $LOCKDIR/winbindd_privilaged to allow +programs like 'squid' to use ntlm_auth. +Note that the winbind client will only attempt to connect to the winbindd daemon +if both the \fI$LOCKDIR/winbindd_privilaged\fR directory +and \fI$LOCKDIR/winbindd_privilaged/pipe\fR file are owned by +root. +.TP \fB/lib/libnss_winbind.so.X\fR Implementation of name service switch library. .TP -- cgit From 0b0c74a3aaddfe0d1445d214fd8be1e6cb7af54e Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 18:07:29 +0000 Subject: - Use entities in smbsh.1 - First update of commands in rpcclient.1 (This used to be commit 82664c099d5478bab1f6f6e032e09b539f06631f) --- docs/docbook/manpages/rpcclient.1.sgml | 96 +++++++++++++++++++++++++++++----- docs/docbook/manpages/smbsh.1.sgml | 4 +- 2 files changed, 85 insertions(+), 15 deletions(-) diff --git a/docs/docbook/manpages/rpcclient.1.sgml b/docs/docbook/manpages/rpcclient.1.sgml index 225bb064ff..3e81711d5d 100644 --- a/docs/docbook/manpages/rpcclient.1.sgml +++ b/docs/docbook/manpages/rpcclient.1.sgml @@ -99,7 +99,7 @@ LSARPC - lsaquery + lsaquery - Query info policy lookupsids - Resolve a list of SIDs to usernames. @@ -109,22 +109,90 @@ of usernames to SIDs. - enumtrusts + enumtrusts - Enumerate trusted domains + + enumprivs - Enumerate privileges + + getdispname - Get the privilege name + + lsaenumsid - Enumerate the LSA SIDS + + lsaenumprivsaccount - Enumerate the privileges of an SID + + lsaenumacctrights - Enumerate the rights of an SID + + lsaenumacctwithright - Enumerate accounts with a right + + lsaaddacctrights - Add rights to an account + + lsaremoveacctrights - Remove rights from an account + + lsalookupprivvalue - Get a privilege value given its name + + lsaquerysecobj - Query LSA security object + - + + + LSARPC-DS + + dsroledominfo - Get Primary Domain Information + + + + DFS + + dfsexist - Query DFS support + dfsadd - Add a DFS share + dfsremove - Remove a DFS share + dfsgetinfo - Query DFS share info + dfsenum - Enumerate dfs shares + + + + + REG + + shutdown - Remote Shutdown + abortshutdown - Abort Shutdown + + + + + SRVSVC + + srvinfo - Server query info + + netshareenum - Enumerate shares + + netfileenum - Enumerate open files + + netremotetod - Fetch remote time of day + + + + SAMR - queryuser - querygroup - queryusergroups - querygroupmem - queryaliasmem - querydispinfo - querydominfo - enumdomgroups + queryuser - Query user info + querygroup - Query group info + queryusergroups - Query user groups + querygroupmem - Query group membership + queryaliasmem - Query alias membership + querydispinfo - Query display info + querydominfo - Query domain info + enumdomusers - Enumerate domain users + enumdomgroups - Enumerate domain groups + enumalsgroups - Enumerate alias groups + createdomuser - Create domain user + samlookupnames - Look up names + samlookuprids - Look up names + deletedomuser - Delete domain user + samquerysecobj - Query SAMR security object + getdompwinfo - Retrieve domain password info @@ -189,7 +257,7 @@ Comma Separated list of Files enumjobs <printer> - List the jobs and status of a given printer. This command corresponds to the MS Platform SDK EnumJobs() - function (* This command is currently unimplemented). + function @@ -218,11 +286,11 @@ Comma Separated list of Files - getdata <printername> + getdata <printername> <valuename;> - Retrieve the data for a given printer setting. See the enumdata command for more information. This command corresponds to the GetPrinterData() MS Platform - SDK function (* This command is currently unimplemented). + SDK function. diff --git a/docs/docbook/manpages/smbsh.1.sgml b/docs/docbook/manpages/smbsh.1.sgml index 78b4f0ad16..f51b5eb34f 100644 --- a/docs/docbook/manpages/smbsh.1.sgml +++ b/docs/docbook/manpages/smbsh.1.sgml @@ -1,4 +1,6 @@ - + %globalentities; +]> -- cgit From accd7c75a0eda57a9a1b928ebcc10519612d73a1 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 18:17:49 +0000 Subject: Fix formatting of rpcclient manpage (This used to be commit 13d79e38a6eaecbf6ce8369aaa5f2eeea7109667) --- docs/docbook/manpages/rpcclient.1.sgml | 262 ++++++++++++++++++--------------- 1 file changed, 140 insertions(+), 122 deletions(-) diff --git a/docs/docbook/manpages/rpcclient.1.sgml b/docs/docbook/manpages/rpcclient.1.sgml index 3e81711d5d..de4d8d72fc 100644 --- a/docs/docbook/manpages/rpcclient.1.sgml +++ b/docs/docbook/manpages/rpcclient.1.sgml @@ -58,7 +58,7 @@ resolved using the name resolve order line from smb.conf 5. - + @@ -97,110 +97,121 @@ COMMANDS - LSARPC - - lsaquery - Query info policy + + LSARPC + + + lsaqueryQuery info policy - lookupsids - Resolve a list + lookupsidsResolve a list of SIDs to usernames. - + - lookupnames - Resolve a list + lookupnamesResolve a list of usernames to SIDs. - + - enumtrusts - Enumerate trusted domains + enumtrustsEnumerate trusted domains - enumprivs - Enumerate privileges + enumprivsEnumerate privileges - getdispname - Get the privilege name + getdispnameGet the privilege name - lsaenumsid - Enumerate the LSA SIDS + lsaenumsidEnumerate the LSA SIDS - lsaenumprivsaccount - Enumerate the privileges of an SID + lsaenumprivsaccountEnumerate the privileges of an SID - lsaenumacctrights - Enumerate the rights of an SID + lsaenumacctrightsEnumerate the rights of an SID - lsaenumacctwithright - Enumerate accounts with a right + lsaenumacctwithrightEnumerate accounts with a right - lsaaddacctrights - Add rights to an account + lsaaddacctrightsAdd rights to an account - lsaremoveacctrights - Remove rights from an account + lsaremoveacctrightsRemove rights from an account - lsalookupprivvalue - Get a privilege value given its name + lsalookupprivvalueGet a privilege value given its name - lsaquerysecobj - Query LSA security object + lsaquerysecobjQuery LSA security object - + + - - - LSARPC-DS - - dsroledominfo - Get Primary Domain Information - + + LSARPC-DS + + + dsroledominfoGet Primary Domain Information + DFS - - dfsexist - Query DFS support - dfsadd - Add a DFS share - dfsremove - Remove a DFS share - dfsgetinfo - Query DFS share info - dfsenum - Enumerate dfs shares - + + dfsexistQuery DFS support + dfsaddAdd a DFS share + dfsremoveRemove a DFS share + dfsgetinfoQuery DFS share info + dfsenumEnumerate dfs shares + - + - REG - - shutdown - Remote Shutdown - abortshutdown - Abort Shutdown - + + REG + + shutdownRemote Shutdown + abortshutdownAbort Shutdown + - + - SRVSVC - - srvinfo - Server query info + + SRVSVC + + + srvinfoServer query info - netshareenum - Enumerate shares + netshareenumEnumerate shares - netfileenum - Enumerate open files + netfileenumEnumerate open files - netremotetod - Fetch remote time of day + netremotetodFetch remote time of day - + - + - SAMR - - queryuser - Query user info - querygroup - Query group info - queryusergroups - Query user groups - querygroupmem - Query group membership - queryaliasmem - Query alias membership - querydispinfo - Query display info - querydominfo - Query domain info - enumdomusers - Enumerate domain users - enumdomgroups - Enumerate domain groups - enumalsgroups - Enumerate alias groups - createdomuser - Create domain user - samlookupnames - Look up names - samlookuprids - Look up names - deletedomuser - Delete domain user - samquerysecobj - Query SAMR security object - getdompwinfo - Retrieve domain password info - - + + SAMR + + + queryuserQuery user info + querygroupQuery group info + queryusergroupsQuery user groups + querygroupmemQuery group membership + queryaliasmemQuery alias membership + querydispinfoQuery display info + querydominfoQuery domain info + enumdomusersEnumerate domain users + enumdomgroupsEnumerate domain groups + enumalsgroupsEnumerate alias groups + createdomuserCreate domain user + samlookupnamesLook up names + samlookupridsLook up names + deletedomuserDelete domain user + samquerysecobjQuery SAMR security object + getdompwinfoRetrieve domain password info + + + - SPOOLSS + + SPOOLSS - - adddriver <arch> <config> - - Execute an AddPrinterDriver() RPC to install the printer driver + + adddriver <arch> <config> + + Execute an AddPrinterDriver() RPC to install the printer driver information on the server. Note that the driver files should already exist in the directory returned by getdriverdir. Possible values for @@ -227,130 +238,137 @@ Comma Separated list of Files use of a bi-directional link for communication. This field should be "NULL". On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or - else the RPC will fail. + else the RPC will fail. - addprinter <printername> - <sharename> <drivername> <port> - - Add a printer on the remote server. This printer + addprinter <printername> + <sharename> <drivername> <port> + + Add a printer on the remote server. This printer will be automatically shared. Be aware that the printer driver must already be installed on the server (see adddriver) and the portmust be a valid port name (see enumports. - + - deldriver - Delete the + deldriverDelete the specified printer driver for all architectures. This does not delete the actual driver files from the server, only the entry from the server's list of drivers. - + - enumdata - Enumerate all + enumdataEnumerate all printer setting data stored on the server. On Windows NT clients, these values are stored in the registry, while Samba servers store them in the printers TDB. This command corresponds to the MS Platform SDK GetPrinterData() function (* This - command is currently unimplemented). + command is currently unimplemented). - enumjobs <printer> - - List the jobs and status of a given printer. + enumjobs <printer> + List the jobs and status of a given printer. This command corresponds to the MS Platform SDK EnumJobs() - function + function - enumports [level] - - Executes an EnumPorts() call using the specified + enumports [level] + + Executes an EnumPorts() call using the specified info level. Currently only info levels 1 and 2 are supported. - + - enumdrivers [level] - - Execute an EnumPrinterDrivers() call. This lists the various installed + enumdrivers [level] + + Execute an EnumPrinterDrivers() call. This lists the various installed printer drivers for all architectures. Refer to the MS Platform SDK documentation for more details of the various flags and calling - options. Currently supported info levels are 1, 2, and 3. + options. Currently supported info levels are 1, 2, and 3. - enumprinters [level] - - Execute an EnumPrinters() call. This lists the various installed + enumprinters [level] + Execute an EnumPrinters() call. This lists the various installed and share printers. Refer to the MS Platform SDK documentation for more details of the various flags and calling options. Currently - supported info levels are 0, 1, and 2. + supported info levels are 0, 1, and 2. - getdata <printername> <valuename;> - - Retrieve the data for a given printer setting. See + getdata <printername> <valuename;> + Retrieve the data for a given printer setting. See the enumdata command for more information. This command corresponds to the GetPrinterData() MS Platform - SDK function. + SDK function. - getdriver <printername> - - Retrieve the printer driver information (such as driver file, + getdriver <printername> + + Retrieve the printer driver information (such as driver file, config file, dependent files, etc...) for the given printer. This command corresponds to the GetPrinterDriver() MS Platform SDK function. Currently info level 1, 2, and 3 are supported. - + - getdriverdir <arch> - - Execute a GetPrinterDriverDirectory() + getdriverdir <arch> + + Execute a GetPrinterDriverDirectory() RPC to retrieve the SMB share name and subdirectory for storing printer driver files for a given architecture. Possible values for arch are "Windows 4.0" (for Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows - Alpha_AXP", and "Windows NT R4000". + Alpha_AXP", and "Windows NT R4000". - getprinter <printername> - - Retrieve the current printer information. This command + getprinter <printername> + Retrieve the current printer information. This command corresponds to the GetPrinter() MS Platform SDK function. - + - openprinter <printername> - - Execute an OpenPrinterEx() and ClosePrinter() RPC + openprinter <printername> + Execute an OpenPrinterEx() and ClosePrinter() RPC against a given printer. - setdriver <printername> - <drivername> - - Execute a SetPrinter() command to update the printer driver + setdriver <printername> + <drivername> + Execute a SetPrinter() command to update the printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server. See also the enumprinters and enumdrivers commands for obtaining a list of - of installed printers and drivers. + of installed printers and drivers. - + + - GENERAL OPTIONS + + GENERAL COMMANDS - - debuglevel - Set the current - debug level used to log information. + + debuglevelSet the current + debug level used to log information. - help (?) - Print a listing of all + help (?)Print a listing of all known commands or extended help on a particular command. - + - quit (exit) - Exit rpcclient - . - - + quit (exit)Exit rpcclient + . + + -- cgit From 3cc17a25fd46abc2b080c9135534d851849e7120 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 18:29:34 +0000 Subject: Document remaining commands (This used to be commit 0428827ab1141bb3ce97afe78c0c62d4ce96fa18) --- docs/docbook/manpages/rpcclient.1.sgml | 47 ++++++++++++++++++++++++++++++---- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/docs/docbook/manpages/rpcclient.1.sgml b/docs/docbook/manpages/rpcclient.1.sgml index de4d8d72fc..39a1e512c0 100644 --- a/docs/docbook/manpages/rpcclient.1.sgml +++ b/docs/docbook/manpages/rpcclient.1.sgml @@ -264,15 +264,14 @@ Comma Separated list of Files to the MS Platform SDK GetPrinterData() function (* This command is currently unimplemented). - + enumdataexEnumerate printer data for a key enumjobs <printer> List the jobs and status of a given printer. This command corresponds to the MS Platform SDK EnumJobs() function - - + enumkeyEnumerate printer keys enumports [level] @@ -306,6 +305,7 @@ Comma Separated list of Files This command corresponds to the GetPrinterData() MS Platform SDK function. + getdataexGet printer driver data with keyname getdriver <printername> @@ -333,13 +333,12 @@ Comma Separated list of Files corresponds to the GetPrinter() MS Platform SDK function. - + getprintprocdirGet print processor directory openprinter <printername> Execute an OpenPrinterEx() and ClosePrinter() RPC against a given printer. - setdriver <printername> <drivername> Execute a SetPrinter() command to update the printer driver @@ -350,10 +349,48 @@ Comma Separated list of Files enumdrivers commands for obtaining a list of of installed printers and drivers. + addformAdd form + setformSet form + getformGet form + deleteformDelete form + enumformsEnumerate form + setprinterSet printer comment + setprinterdataSet REG_SZ printer data + rffpcnexRffpcnex test + + + + NETLOGON + + + + logonctrl2 + Logon Control 2 + + + logonctrl + Logon Control + + + samsync + Sam Synchronisation + + + samdeltas + Query Sam Deltas + + + samlogon + Sam Logon + + + + + GENERAL COMMANDS -- cgit From fdb11bb6551a014db6acc7335e6b35172f39f9cd Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 18:41:28 +0000 Subject: Update docs status. We have only 1 program left to document (wrepld), and 3 manpages to finished (net, smb.conf, ntlm_auth) (This used to be commit abfd78c7e37c6868585d1007bdf010b0eddae624) --- docs/docs-status | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs-status b/docs/docs-status index 8f7b80e5f8..2620aa849d 100644 --- a/docs/docs-status +++ b/docs/docs-status @@ -5,7 +5,6 @@ Manifest docs/announce - out of date (announces 2.2.0) - should it go away? docs/history - needs updating (is current up to 1998 - merge with 10year.html ?) docs/docbook/manpages/net.8.sgml - Still not finished -docs/docbook/manpages/rpcclient.1.sgml - Command documentation might be outdated docs/docbook/manpages/samba.7.sgml - Listing of samba programs is not complete docs/docbook/manpages/smb.conf.5.sgml - 'restrict anonymous' isn't documented properly docs/docbook/projdoc/Integrating-with-Windows.sgml - Should slowly go a way. Contains a little bit information about wins, a little bit about domain membership, a little about winbind, etc @@ -34,6 +33,7 @@ ldap passwd sync Not release-critical: docs/docbook/devdoc/* - most of these docs are outdated and need updates... docs/docbook/projdoc/Diagnosis.sgml - Needs extension +docs/docbook/manpages/rpcclient.1.sgml - Some commands could be documented more extensively Documentation for following smb.conf.5 parameters does not exist: acl compatibility // protocol -- cgit From 754d895cea006ac4f06676d5c03e71576759bf7a Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Thu, 3 Apr 2003 18:54:40 +0000 Subject: Convert RoutedNetworks to SGML (This used to be commit c38bdb2aa0a96006094d1455b23183e97b2e7b2a) --- docs/docbook/projdoc/Other-Clients.sgml | 10 + docs/docs-status | 2 - docs/manpages/rpcclient.1 | 330 ++++++++++++++++++++++---------- docs/manpages/smbmnt.8 | 5 +- docs/manpages/smbmount.8 | 17 +- docs/manpages/smbsh.1 | 84 ++++++++ docs/manpages/smbspool.8 | 4 +- docs/manpages/smbtar.1 | 6 +- docs/manpages/testprns.1 | 2 +- docs/textdocs/RoutedNetworks.txt | 63 ------ 10 files changed, 345 insertions(+), 178 deletions(-) delete mode 100644 docs/textdocs/RoutedNetworks.txt diff --git a/docs/docbook/projdoc/Other-Clients.sgml b/docs/docbook/projdoc/Other-Clients.sgml index 6ba04b01d3..e4d7e34185 100644 --- a/docs/docbook/projdoc/Other-Clients.sgml +++ b/docs/docbook/projdoc/Other-Clients.sgml @@ -339,4 +339,14 @@ create accounts on the Samba host for Domain users. + +Windows NT 3.1 + +If you have problems communicating across routers with Windows +NT 3.1 workstations, read this Microsoft Knowledge Base article. + + + + + diff --git a/docs/docs-status b/docs/docs-status index 2620aa849d..7ccaa9b9b2 100644 --- a/docs/docs-status +++ b/docs/docs-status @@ -20,7 +20,6 @@ docs/docbook/projdoc/winbind.sgml - needs documentation for ADS docs/textdocs/CUPS-PrintingInfo.txt - needs to be converted to sgml - Kurt Pfeifle docs/textdocs/PROFILES.txt - needs to be converted to sgml docs/textdocs/README.jis - Seems to need updating - possibly obsoleted by a newer japanese howto? -docs/textdocs/RoutedNetworks.txt - still valid, but shouldn't this go into Other_clients.sgml ? This text originally comes from microsoft, what about copyright? docs/docbook/manpages/ntlm_auth.1.sgml - Is very basic at the moment, parameters need better descriptions - abartlet Stuff that needs to be documented: @@ -43,7 +42,6 @@ profile acls // protocol client lanman auth // security client NTLMv2 auth // security idmap backend // security -sam backend // security kernel change notify // tuning lpq cache time // tuning -valid // misc diff --git a/docs/manpages/rpcclient.1 b/docs/manpages/rpcclient.1 index 76e606240f..8f880afcd3 100644 --- a/docs/manpages/rpcclient.1 +++ b/docs/manpages/rpcclient.1 @@ -172,56 +172,146 @@ options. \fB-h|--help\fR Print a summary of command line options. .SH "COMMANDS" -.PP -\fBLSARPC\fR -.TP 0.2i -\(bu +.SS "LSARPC" +.TP \fBlsaquery\fR -.TP 0.2i -\(bu -\fBlookupsids\fR - Resolve a list +Query info policy +.TP +\fBlookupsids\fR +Resolve a list of SIDs to usernames. -.TP 0.2i -\(bu -\fBlookupnames\fR - Resolve a list +.TP +\fBlookupnames\fR +Resolve a list of usernames to SIDs. -.TP 0.2i -\(bu +.TP \fBenumtrusts\fR +Enumerate trusted domains +.TP +\fBenumprivs\fR +Enumerate privileges +.TP +\fBgetdispname\fR +Get the privilege name +.TP +\fBlsaenumsid\fR +Enumerate the LSA SIDS +.TP +\fBlsaenumprivsaccount\fR +Enumerate the privileges of an SID +.TP +\fBlsaenumacctrights\fR +Enumerate the rights of an SID +.TP +\fBlsaenumacctwithright\fR +Enumerate accounts with a right +.TP +\fBlsaaddacctrights\fR +Add rights to an account +.TP +\fBlsaremoveacctrights\fR +Remove rights from an account +.TP +\fBlsalookupprivvalue\fR +Get a privilege value given its name +.TP +\fBlsaquerysecobj\fR +Query LSA security object +.SS "LSARPC-DS" +.TP +\fBdsroledominfo\fR +Get Primary Domain Information .PP .PP -\fBSAMR\fR -.TP 0.2i -\(bu +\fBDFS\fR +.TP +\fBdfsexist\fR +Query DFS support +.TP +\fBdfsadd\fR +Add a DFS share +.TP +\fBdfsremove\fR +Remove a DFS share +.TP +\fBdfsgetinfo\fR +Query DFS share info +.TP +\fBdfsenum\fR +Enumerate dfs shares +.SS "REG" +.TP +\fBshutdown\fR +Remote Shutdown +.TP +\fBabortshutdown\fR +Abort Shutdown +.SS "SRVSVC" +.TP +\fBsrvinfo\fR +Server query info +.TP +\fBnetshareenum\fR +Enumerate shares +.TP +\fBnetfileenum\fR +Enumerate open files +.TP +\fBnetremotetod\fR +Fetch remote time of day +.SS "SAMR" +.TP \fBqueryuser\fR -.TP 0.2i -\(bu +Query user info +.TP \fBquerygroup\fR -.TP 0.2i -\(bu +Query group info +.TP \fBqueryusergroups\fR -.TP 0.2i -\(bu +Query user groups +.TP \fBquerygroupmem\fR -.TP 0.2i -\(bu +Query group membership +.TP \fBqueryaliasmem\fR -.TP 0.2i -\(bu +Query alias membership +.TP \fBquerydispinfo\fR -.TP 0.2i -\(bu +Query display info +.TP \fBquerydominfo\fR -.TP 0.2i -\(bu +Query domain info +.TP +\fBenumdomusers\fR +Enumerate domain users +.TP \fBenumdomgroups\fR -.PP -.PP -\fBSPOOLSS\fR -.TP 0.2i -\(bu -\fBadddriver \fR -- Execute an AddPrinterDriver() RPC to install the printer driver +Enumerate domain groups +.TP +\fBenumalsgroups\fR +Enumerate alias groups +.TP +\fBcreatedomuser\fR +Create domain user +.TP +\fBsamlookupnames\fR +Look up names +.TP +\fBsamlookuprids\fR +Look up names +.TP +\fBdeletedomuser\fR +Delete domain user +.TP +\fBsamquerysecobj\fR +Query SAMR security object +.TP +\fBgetdompwinfo\fR +Retrieve domain password info +.SS "SPOOLSS" +.TP +\fBadddriver \fR +Execute an AddPrinterDriver() RPC to install the printer driver information on the server. Note that the driver files should already exist in the directory returned by \fBgetdriverdir\fR. Possible values for @@ -250,111 +340,149 @@ use of a bi-directional link for communication. This field should be "NULL". On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will fail. -.TP 0.2i -\(bu -\fBaddprinter - \fR -- Add a printer on the remote server. This printer +.TP +\fBaddprinter \fR +Add a printer on the remote server. This printer will be automatically shared. Be aware that the printer driver must already be installed on the server (see \fBadddriver\fR) and the \fIport\fRmust be a valid port name (see \fBenumports\fR. -.TP 0.2i -\(bu -\fBdeldriver\fR - Delete the +.TP +\fBdeldriver\fR +Delete the specified printer driver for all architectures. This does not delete the actual driver files from the server, only the entry from the server's list of drivers. -.TP 0.2i -\(bu -\fBenumdata\fR - Enumerate all +.TP +\fBenumdata\fR +Enumerate all printer setting data stored on the server. On Windows NT clients, these values are stored in the registry, while Samba servers store them in the printers TDB. This command corresponds to the MS Platform SDK GetPrinterData() function (* This command is currently unimplemented). -.TP 0.2i -\(bu -\fBenumjobs \fR -- List the jobs and status of a given printer. +.TP +\fBenumdataex\fR +Enumerate printer data for a key +.TP +\fBenumjobs \fR +List the jobs and status of a given printer. This command corresponds to the MS Platform SDK EnumJobs() -function (* This command is currently unimplemented). -.TP 0.2i -\(bu -\fBenumports [level]\fR -- Executes an EnumPorts() call using the specified +function +.TP +\fBenumkey\fR +Enumerate printer keys +.TP +\fBenumports [level]\fR +Executes an EnumPorts() call using the specified info level. Currently only info levels 1 and 2 are supported. -.TP 0.2i -\(bu -\fBenumdrivers [level]\fR -- Execute an EnumPrinterDrivers() call. This lists the various installed +.TP +\fBenumdrivers [level]\fR +Execute an EnumPrinterDrivers() call. This lists the various installed printer drivers for all architectures. Refer to the MS Platform SDK documentation for more details of the various flags and calling options. Currently supported info levels are 1, 2, and 3. -.TP 0.2i -\(bu -\fBenumprinters [level]\fR -- Execute an EnumPrinters() call. This lists the various installed +.TP +\fBenumprinters [level]\fR +Execute an EnumPrinters() call. This lists the various installed and share printers. Refer to the MS Platform SDK documentation for more details of the various flags and calling options. Currently supported info levels are 0, 1, and 2. -.TP 0.2i -\(bu -\fBgetdata \fR -- Retrieve the data for a given printer setting. See +.TP +\fBgetdata \fR +Retrieve the data for a given printer setting. See the \fBenumdata\fR command for more information. This command corresponds to the GetPrinterData() MS Platform -SDK function (* This command is currently unimplemented). -.TP 0.2i -\(bu -\fBgetdriver \fR -- Retrieve the printer driver information (such as driver file, +SDK function. +.TP +\fBgetdataex\fR +Get printer driver data with keyname +.TP +\fBgetdriver \fR +Retrieve the printer driver information (such as driver file, config file, dependent files, etc...) for the given printer. This command corresponds to the GetPrinterDriver() MS Platform SDK function. Currently info level 1, 2, and 3 are supported. -.TP 0.2i -\(bu -\fBgetdriverdir \fR -- Execute a GetPrinterDriverDirectory() +.TP +\fBgetdriverdir \fR +Execute a GetPrinterDriverDirectory() RPC to retrieve the SMB share name and subdirectory for storing printer driver files for a given architecture. Possible values for \fIarch\fR are "Windows 4.0" (for Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows Alpha_AXP", and "Windows NT R4000". -.TP 0.2i -\(bu -\fBgetprinter \fR -- Retrieve the current printer information. This command +.TP +\fBgetprinter \fR +Retrieve the current printer information. This command corresponds to the GetPrinter() MS Platform SDK function. -.TP 0.2i -\(bu -\fBopenprinter \fR -- Execute an OpenPrinterEx() and ClosePrinter() RPC +.TP +\fBgetprintprocdir\fR +Get print processor directory +.TP +\fBopenprinter \fR +Execute an OpenPrinterEx() and ClosePrinter() RPC against a given printer. -.TP 0.2i -\(bu -\fBsetdriver -\fR -- Execute a SetPrinter() command to update the printer driver +.TP +\fBsetdriver \fR +Execute a SetPrinter() command to update the printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server. See also the \fBenumprinters\fR and \fBenumdrivers\fR commands for obtaining a list of of installed printers and drivers. -.PP -\fBGENERAL OPTIONS\fR -.TP 0.2i -\(bu -\fBdebuglevel\fR - Set the current +.TP +\fBaddform\fR +Add form +.TP +\fBsetform\fR +Set form +.TP +\fBgetform\fR +Get form +.TP +\fBdeleteform\fR +Delete form +.TP +\fBenumforms\fR +Enumerate form +.TP +\fBsetprinter\fR +Set printer comment +.TP +\fBsetprinterdata\fR +Set REG_SZ printer data +.TP +\fBrffpcnex\fR +Rffpcnex test +.SS "NETLOGON" +.TP +\fBlogonctrl2\fR +Logon Control 2 +.TP +\fBlogonctrl\fR +Logon Control +.TP +\fBsamsync\fR +Sam Synchronisation +.TP +\fBsamdeltas\fR +Query Sam Deltas +.TP +\fBsamlogon\fR +Sam Logon +.SS "GENERAL COMMANDS" +.TP +\fBdebuglevel\fR +Set the current debug level used to log information. -.TP 0.2i -\(bu -\fBhelp (?)\fR - Print a listing of all +.TP +\fBhelp (?)\fR +Print a listing of all known commands or extended help on a particular command. -.TP 0.2i -\(bu -\fBquit (exit)\fR - Exit \fBrpcclient +.TP +\fBquit (exit)\fR +Exit \fBrpcclient \fR. .SH "BUGS" .PP diff --git a/docs/manpages/smbmnt.8 b/docs/manpages/smbmnt.8 index c17d15261a..5c9a662863 100644 --- a/docs/manpages/smbmnt.8 +++ b/docs/manpages/smbmnt.8 @@ -9,7 +9,7 @@ smbmnt \- helper utility for mounting SMB filesystems .SH SYNOPSIS -\fBsmbmnt\fR \fBmount-point\fR [ \fB-s \fR ] [ \fB-r\fR ] [ \fB-u \fR ] [ \fB-g \fR ] [ \fB-f \fR ] [ \fB-d \fR ] [ \fB-o \fR ] +\fBsmbmnt\fR \fBmount-point\fR [ \fB-s \fR ] [ \fB-r\fR ] [ \fB-u \fR ] [ \fB-g \fR ] [ \fB-f \fR ] [ \fB-d \fR ] [ \fB-o \fR ] [ \fB-h\fR ] .SH "DESCRIPTION" .PP @@ -49,6 +49,9 @@ applied \fB-o options\fR list of options that are passed as-is to smbfs, if this command is run on a 2.4 or higher Linux kernel. +.TP +\fB-h|--help\fR +Print a summary of command line options. .SH "AUTHOR" .PP Volker Lendecke, Andrew Tridgell, Michael H. Warfield diff --git a/docs/manpages/smbmount.8 b/docs/manpages/smbmount.8 index 344fc5e0cd..207ec836d6 100644 --- a/docs/manpages/smbmount.8 +++ b/docs/manpages/smbmount.8 @@ -70,6 +70,9 @@ This is preferred over having passwords in plaintext in a shared file, such as \fI/etc/fstab\fR. Be sure to protect any credentials file properly. .TP +\fBkrb\fR +Use kerberos (Active Directory). +.TP \fBnetbiosname=\fR sets the source NetBIOS name. It defaults to the local hostname. @@ -95,30 +98,30 @@ permissions that remote files have in the local filesystem. The default is based on the current umask. .TP \fBdmask=\fR -sets the directory mask. This determines the +Sets the directory mask. This determines the permissions that remote directories have in the local filesystem. The default is based on the current umask. .TP \fBdebug=\fR -sets the debug level. This is useful for +Sets the debug level. This is useful for tracking down SMB connection problems. A suggested value to start with is 4. If set too high there will be a lot of output, possibly hiding the useful output. .TP \fBip=\fR -sets the destination host or IP address. +Sets the destination host or IP address. .TP \fBworkgroup=\fR -sets the workgroup on the destination +Sets the workgroup on the destination .TP \fBsockopt=\fR -sets the TCP socket options. See the \fBsmb.conf\fR(5) \fIsocket options\fR option. +Sets the TCP socket options. See the \fBsmb.conf\fR(5) \fIsocket options\fR option. .TP \fBscope=\fR -sets the NetBIOS scope +Sets the NetBIOS scope .TP \fBguest\fR -don't prompt for a password +Don't prompt for a password .TP \fBro\fR mount read-only diff --git a/docs/manpages/smbsh.1 b/docs/manpages/smbsh.1 index d2770d410a..f7ee47949b 100644 --- a/docs/manpages/smbsh.1 +++ b/docs/manpages/smbsh.1 @@ -39,6 +39,90 @@ the user to set the directory prefix for SMB access. The default value if this option is not specified is \fBsmb\fR. .TP +\fB-s \fR +The file specified contains the +configuration details required by the server. The +information in this file includes server-specific +information such as what printcap file to use, as well +as descriptions of all the services that the server is +to provide. See \fIsmb.conf(5)\fR for more information. +The default configuration file name is determined at +compile time. +.TP +\fB-d|--debug=debuglevel\fR +\fIdebuglevel\fR is an integer +from 0 to 10. The default value if this parameter is +not specified is zero. + +The higher this value, the more detail will be +logged to the log files about the activities of the +server. At level 0, only critical errors and serious +warnings will be logged. Level 1 is a reasonable level for +day to day running - it generates a small amount of +information about operations carried out. + +Levels above 1 will generate considerable +amounts of log data, and should only be used when +investigating a problem. Levels above 3 are designed for +use only by developers and generate HUGE amounts of log +data, most of which is extremely cryptic. + +Note that specifying this parameter here will +override the log +level file. +.TP +\fB-R \fR +This option is used to determine what naming +services and in what order to resolve +host names to IP addresses. The option takes a space-separated +string of different name resolution options. + +The options are: "lmhosts", "host", "wins" and "bcast". +They cause names to be resolved as follows : +.RS +.TP 0.2i +\(bu +lmhosts: +Lookup an IP address in the Samba lmhosts file. If the +line in lmhosts has no name type attached to the +NetBIOS name +(see the \fBlmhosts\fR(5) for details) +then any name type matches for lookup. +.TP 0.2i +\(bu +host: +Do a standard host name to IP address resolution, using +the system \fI/etc/hosts\fR, NIS, or DNS +lookups. This method of name resolution is operating +system dependent, for instance on IRIX or Solaris this +may be controlled by the \fI/etc/nsswitch.conf\fR file). Note that this method is only used +if the NetBIOS name type being queried is the 0x20 +(server) name type, otherwise it is ignored. +.TP 0.2i +\(bu +wins: +Query a name with the IP address listed in the +\fIwins server\fR parameter. If no +WINS server has been specified this method will be +ignored. +.TP 0.2i +\(bu +bcast: +Do a broadcast on each of the known local interfaces +listed in the \fIinterfaces\fR +parameter. This is the least reliable of the name +resolution methods as it depends on the target host +being on a locally connected subnet. +.RE + +If this parameter is not set then the name resolve order +defined in the \fBsmb.conf\fR(5) file parameter +(\fIname resolve order\fR) will be used. + +The default order is lmhosts, host, wins, bcast. Without +this parameter or any entry in the \fIname resolve order\fR parameter of the \fBsmb.conf\fR(5) file, the name resolution methods +will be attempted in this order. +.TP \fB-L libdir\fR This parameter specifies the location of the shared libraries used by \fBsmbsh\fR. The default diff --git a/docs/manpages/smbspool.8 b/docs/manpages/smbspool.8 index 7ee3a465b3..8cfa1b2671 100644 --- a/docs/manpages/smbspool.8 +++ b/docs/manpages/smbspool.8 @@ -9,7 +9,7 @@ smbspool \- send a print file to an SMB printer .SH SYNOPSIS -\fBsmbspool\fR [ \fBjob\fR ] [ \fBuser\fR ] [ \fBtitle\fR ] [ \fBcopies\fR ] [ \fBoptions\fR ] [ \fBfilename\fR ] +\fBsmbspool\fR \fBjob\fR \fBuser\fR \fBtitle\fR \fBcopies\fR \fBoptions\fR [ \fBfilename\fR ] .SH "DESCRIPTION" .PP @@ -78,7 +78,7 @@ name of the file to print. If this argument is not specified then the print file is read from the standard input. .SH "VERSION" .PP -This man page is correct for version 2.2 of the Samba suite. +This man page is correct for version 3.0 of the Samba suite. .SH "SEE ALSO" .PP \fBsmbd\fR(8) and \fBSamba\fR(7). diff --git a/docs/manpages/smbtar.1 b/docs/manpages/smbtar.1 index bef59c21ac..e15af72b65 100644 --- a/docs/manpages/smbtar.1 +++ b/docs/manpages/smbtar.1 @@ -9,7 +9,7 @@ smbtar \- shell script for backing up SMB/CIFS shares directly to UNIX tape drives .SH SYNOPSIS -\fBsmbtar\fR \fB-s server\fR [ \fB-p password\fR ] [ \fB-x services\fR ] [ \fB-X\fR ] [ \fB-d directory\fR ] [ \fB-u user\fR ] [ \fB-t tape\fR ] [ \fB-t tape\fR ] [ \fB-b blocksize\fR ] [ \fB-N filename\fR ] [ \fB-i\fR ] [ \fB-r\fR ] [ \fB-l loglevel\fR ] [ \fB-v\fR ] \fBfilenames\fR +\fBsmbtar\fR [ \fB-r\fR ] [ \fB-i\fR ] [ \fB-a\fR ] [ \fB-v\fR ] \fB-s server\fR [ \fB-p password\fR ] [ \fB-x services\fR ] [ \fB-X\fR ] [ \fB-N filename\fR ] [ \fB-b blocksize\fR ] [ \fB-d directory\fR ] [ \fB-l loglevel\fR ] [ \fB-u user\fR ] [ \fB-t tape\fR ] \fBfilenames\fR .SH "DESCRIPTION" .PP @@ -46,6 +46,10 @@ Default: none The user id to connect as. Default: UNIX login name. .TP +\fB-a\fR +Reset DOS archive bit mode to +indicate file has been archived. +.TP \fB-t tape\fR Tape device. May be regular file or tape device. Default: \fI$TAPE\fR environmental diff --git a/docs/manpages/testprns.1 b/docs/manpages/testprns.1 index 49ec423986..5779d71b19 100644 --- a/docs/manpages/testprns.1 +++ b/docs/manpages/testprns.1 @@ -69,7 +69,7 @@ for errors and warnings. Other messages are self-explanatory. .SH "VERSION" .PP -This man page is correct for version 2.2 of +This man page is correct for version 3.0 of the Samba suite. .SH "SEE ALSO" .PP diff --git a/docs/textdocs/RoutedNetworks.txt b/docs/textdocs/RoutedNetworks.txt deleted file mode 100644 index fb55f9f9bf..0000000000 --- a/docs/textdocs/RoutedNetworks.txt +++ /dev/null @@ -1,63 +0,0 @@ -#NOFNR Flag in LMHosts to Communicate Across Routers - - Last reviewed: May 5, 1997 - Article ID: Q103765 - The information in this article applies to: - - Microsoft Windows NT operating system version 3.1 - Microsoft Windows NT Advanced Server version 3.1 - - SUMMARY - - Some of the LAN Manager for UNIX and Pathworks servers may have -problems in communicating across routers with - Windows NT workstations. The use of #NOFNR flag in the LMHosts -file solves the problem. - - MORE INFORMATION - - When you are communicating with a server across a router in a IP -routed environment, the LMHosts file is used to - resolve Workstation name-to-IP address mapping. The LMHosts -entry for a remote machine name provides the IP - address for the remote machine. In Lan Manager 2.x, providing -the LMHosts entry eliminates the need to do a Name - Query broadcast to the local domain and instead a TCP session is -established with the remote machine. Windows NT - performs the same function in a different way. - - When an LMHosts entry exists for a remote server, Windows NT -will not send a Name Query broadcast to the local - subnet and instead send a directed Name Query to the remote -server. If the remote server does not respond to the Name - Query, further communications (TCP SYN, and so on) will not take -place. This was done to eliminate the performance - issues when trying to connect to a remote machine when it was -not available (down). - - Some of the older LAN Manager for UNIX and DEC Pathworks servers -do not respond to directed Name Queries sent - by Windows NT. In that case, the users will see an error 53 -(Path not found), even though they have specified the - LMHosts entries correctly. A new LMHosts flag #NOFNR was added -to solve this problem. By specifying the - #NOFNR flag on the same line where the name resolution -information for the server is provided, the directed Name - Query can be avoided. For example: - - 130.20.1.1 mylmxserver #PRE #NOFNR - - - Note that this will only apply to mylmxserver and not to any -other entries in the LMHosts file. To set - a global flag, an entry could be added in the registry. To -completely remove any directed Name - Queries sent from a Windows NT machine, create the following -value in - -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nbt\Parameters: - - NoDirectedFNR REG_DWORD 1 - - - This will cause the directed Name Queries to not go out for any -- cgit From c98b4b9958e6847d97396c3d3259015e1929f6b9 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 4 Apr 2003 00:00:47 +0000 Subject: Abort configure if --with-ads and --without-ldap. (This used to be commit 3ac60d2ceb1495a5ee691810678d29dea2667a7a) --- source3/configure.in | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/configure.in b/source3/configure.in index 5d880caef3..87626db666 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -2288,6 +2288,11 @@ LIBS="" LDAP_LIBS="$LIBS"; LIBS="$ac_save_LIBS"; +else + # Can't have ADS support without LDAP + if test x"$with_ads_support" = x"yes"; then + AC_MSG_ERROR(Active directory support requires LDAP) + fi fi if test x"$with_ads_support" = x"yes"; then -- cgit From e9681cf3b2c1be7afcd78fe1dccdf4b21fac5ebd Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 4 Apr 2003 00:14:02 +0000 Subject: better method of locating autoconf and autoheader; patch by Willi Mann (This used to be commit 4475d471796e505c4b56814615edf58536b1b7cb) --- source3/autogen.sh | 56 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 16 deletions(-) diff --git a/source3/autogen.sh b/source3/autogen.sh index a2228a6fd9..869f1d2f5e 100755 --- a/source3/autogen.sh +++ b/source3/autogen.sh @@ -2,30 +2,53 @@ # Run this script to build samba from CVS. -## first try the default names -AUTOHEADER="autoheader" -AUTOCONF="autoconf" - -if which $AUTOCONF > /dev/null -then - : -else - echo "$0: need autoconf 2.53 or later to build samba from CVS" >&2 - exit 1 -fi +## insert all possible names (only works with +## autoconf 2.x +TESTAUTOHEADER="autoheader autoheader-2.53" +TESTAUTOCONF="autoconf autoconf-2.53" + +AUTOHEADERFOUND="0" +AUTOCONFFOUND="0" + +## +## Look for autoheader ## -## what version do we need? +for i in $TESTAUTOHEADER; do + if which $i >& /dev/null; then + if [ `$i --version | head -1 | cut -d. -f 2` -ge 53 ]; then + AUTOHEADER=$i + AUTOHEADERFOUND="1" + break + fi + fi +done + +## +## Look for autoconf ## -if [ `$AUTOCONF --version | head -1 | cut -d. -f 2` -lt 53 ]; then - ## maybe it's installed under a different name (e.g. RedHat 7.3) +for i in $TESTAUTOCONF; do + if which $i >& /dev/null; then + if [ `$i --version | head -1 | cut -d. -f 2` -ge 53 ]; then + AUTOCONF=$i + AUTOCONFFOUND="1" + break + fi + fi +done - AUTOCONF="autoconf-2.53" - AUTOHEADER="autoheader-2.53" +## +## do we have it? +## +if [ "$AUTOCONFFOUND" == "0" -o "$AUTOHEADERFOUND" == "0" ]; then + echo "$0: need autoconf 2.53 or later to build samba from CVS" >&2 + exit 1 fi + + echo "$0: running $AUTOHEADER" $AUTOHEADER || exit 1 @@ -34,3 +57,4 @@ $AUTOCONF || exit 1 echo "Now run ./configure and then make." exit 0 + -- cgit From 4af8e4a6a37e366194a111f5568540a6c9b7f1a7 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 4 Apr 2003 00:28:38 +0000 Subject: Fixed compiler warning. (This used to be commit 9c706be7b4417a1dc36866c3bad7a156f30b8af6) --- source3/sam/idmap_tdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/sam/idmap_tdb.c b/source3/sam/idmap_tdb.c index 72c602664c..ec365b603d 100644 --- a/source3/sam/idmap_tdb.c +++ b/source3/sam/idmap_tdb.c @@ -264,7 +264,7 @@ static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) } /* Get an id from a sid */ -static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, DOM_SID *sid) +static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) { TDB_DATA data, key; fstring keystr; -- cgit From 118712249fe85523bcaed6803484e21ee56c53e3 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 4 Apr 2003 00:30:50 +0000 Subject: Removed unused variables. (This used to be commit 32d1dd19bb0b6abc6508ce65d5129acea79225bf) --- source3/nsswitch/winbindd_cache.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/source3/nsswitch/winbindd_cache.c b/source3/nsswitch/winbindd_cache.c index 5fb59e7467..5eabcfca20 100644 --- a/source3/nsswitch/winbindd_cache.c +++ b/source3/nsswitch/winbindd_cache.c @@ -392,7 +392,6 @@ static void centry_put_string(struct cache_entry *centry, const char *s) static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid) { - int len; fstring sid_string; centry_put_string(centry, sid_to_string(sid_string, sid)); } @@ -446,7 +445,6 @@ static void wcache_save_name_to_sid(struct winbindd_domain *domain, enum SID_NAME_USE type) { struct cache_entry *centry; - uint32 len; fstring uname; fstring sid_string; -- cgit From 41ef3e1c2d0aee53109c5efb41b39344885cd7a4 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 4 Apr 2003 00:36:11 +0000 Subject: Updated warning messages for when configure.in is updated. (This used to be commit 516e6c2e00d17d73bcfacb8dd4eadfb831fef22a) --- source3/Makefile.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 9b2cffe86c..5143c6fc11 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1321,10 +1321,10 @@ finddead: # when configure.in is updated, reconfigure $(srcdir)/configure: $(srcdir)/configure.in - @echo "WARNING: you need to rerun autoconf" + @echo "WARNING: you need to rerun ./autogen.sh" config.status: $(srcdir)/configure - @echo "WARNING: you need to run configure" + @echo "WARNING: you need to run ./configure" Makefile: $(srcdir)/Makefile.in config.status @echo "WARNING: you need to run ./config.status" -- cgit From e23cfba7f946d33cd9391e84ac8f6447e36335d0 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 4 Apr 2003 00:41:07 +0000 Subject: Fix compiler warning - cli_lsa_query_info_policy actually returns the domain name. We were passing in an already initialised string which was causing the warning. (This used to be commit 18685d137e2db6e4e93c655f1c4a97116a36c02c) --- source3/utils/net_rpc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c index 922fc027e6..69cf28f995 100644 --- a/source3/utils/net_rpc.c +++ b/source3/utils/net_rpc.c @@ -1880,7 +1880,7 @@ static int rpc_trustdom_list(int argc, const char **argv) int num_domains, i, pad_len, col_len = 20; DOM_SID *domain_sids; char **trusted_dom_names; - fstring pdc_name; + fstring pdc_name, dummy; /* trusting domains listing variables */ POLICY_HND domain_hnd; @@ -1927,8 +1927,10 @@ static int rpc_trustdom_list(int argc, const char **argv) }; /* query info level 5 to obtain sid of a domain being queried */ - nt_status = cli_lsa_query_info_policy(cli, mem_ctx, &connect_hnd, - 5 /* info level */, domain_name, &queried_dom_sid); + nt_status = cli_lsa_query_info_policy( + cli, mem_ctx, &connect_hnd, 5 /* info level */, + dummy, &queried_dom_sid); + if (NT_STATUS_IS_ERR(nt_status)) { DEBUG(0, ("LSA Query Info failed. Returned error was %s\n", nt_errstr(nt_status))); -- cgit From 0bcc0c343f9ca1616026fb3ee7dae8bd9615ccf9 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 4 Apr 2003 00:52:42 +0000 Subject: SAMR lookupdomain rpc client patches from amber palekar (This used to be commit 67bc6bccc22e22e2a6e5cae7c57a1b2b53f49dfd) --- source3/rpc_client/cli_samr.c | 46 +++++++++++++++++++++++++++++++++++++++++++ source3/rpcclient/cmd_samr.c | 44 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+) diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c index c451ee2e42..9d0b48796c 100644 --- a/source3/rpc_client/cli_samr.c +++ b/source3/rpc_client/cli_samr.c @@ -1464,3 +1464,49 @@ NTSTATUS cli_samr_get_dom_pwinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, return result; } + +/* Lookup Domain Name */ + +NTSTATUS cli_samr_lookup_domain(struct cli_state *cli, TALLOC_CTX *mem_ctx, + POLICY_HND *user_pol, char *domain_name, + DOM_SID *sid) +{ + prs_struct qbuf, rbuf; + SAMR_Q_LOOKUP_DOMAIN q; + SAMR_R_LOOKUP_DOMAIN r; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + + ZERO_STRUCT(q); + ZERO_STRUCT(r); + + /* Initialise parse structures */ + + prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); + prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); + + /* Marshall data and send request */ + + init_samr_q_lookup_domain(&q, user_pol, domain_name); + + if (!samr_io_q_lookup_domain("", &q, &qbuf, 0) || + !rpc_api_pipe_req(cli, SAMR_LOOKUP_DOMAIN, &qbuf, &rbuf)) + goto done; + + /* Unmarshall response */ + + if (!samr_io_r_lookup_domain("", &r, &rbuf, 0)) + goto done; + + /* Return output parameters */ + + result = r.status; + + if (NT_STATUS_IS_OK(result)) + sid_copy(sid, &r.dom_sid.sid); + + done: + prs_mem_free(&qbuf); + prs_mem_free(&rbuf); + + return result; +} diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c index 866381456b..e2232f0da7 100644 --- a/source3/rpcclient/cmd_samr.c +++ b/source3/rpcclient/cmd_samr.c @@ -1487,6 +1487,49 @@ static NTSTATUS cmd_samr_get_dom_pwinfo(struct cli_state *cli, return result; } +/* Look up domain name */ + +static NTSTATUS cmd_samr_lookup_domain(struct cli_state *cli, + TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + POLICY_HND connect_pol, domain_pol; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + uint32 access_mask = MAXIMUM_ALLOWED_ACCESS; + fstring domain_name,sid_string; + DOM_SID sid; + + if (argc != 2) { + printf("Usage: %s domain_name\n", argv[0]); + return NT_STATUS_OK; + } + + sscanf(argv[1], "%s", domain_name); + + result = try_samr_connects(cli, mem_ctx, access_mask, &connect_pol); + + if (!NT_STATUS_IS_OK(result)) + goto done; + + result = cli_samr_open_domain(cli, mem_ctx, &connect_pol, + access_mask, &domain_sid, &domain_pol); + + if (!NT_STATUS_IS_OK(result)) + goto done; + + result = cli_samr_lookup_domain( + cli, mem_ctx, &connect_pol, domain_name, &sid); + + sid_to_string(sid_string,&sid); + + if (NT_STATUS_IS_OK(result)) + printf("SAMR_LOOKUP_DOMAIN: Domain Name: %s Domain SID: %s\n", + domain_name,sid_string); + +done: + return result; +} + /* List of commands exported by this module */ @@ -1513,5 +1556,6 @@ struct cmd_set samr_commands[] = { { "samquerysecobj", RPC_RTYPE_NTSTATUS, cmd_samr_query_sec_obj, NULL, PI_SAMR, "Query SAMR security object", "" }, { "getdompwinfo", RPC_RTYPE_NTSTATUS, cmd_samr_get_dom_pwinfo, NULL, PI_SAMR, "Retrieve domain password info", "" }, + { "lookupdomain", RPC_RTYPE_NTSTATUS, cmd_samr_lookup_domain, NULL, PI_SAMR, "Lookup Domain Name", "" }, { NULL } }; -- cgit From b1b9adebb07f43988f467406a3de43cac2ab5d41 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Fri, 4 Apr 2003 01:02:50 +0000 Subject: Fix the new storage code to correctly convert from system queue info to pjob info. Ensure we retrieve more than one job from the storage code. Jeremy. (This used to be commit 5dc3150ff3fc05e71faad76e83079c60f62bac4f) --- source3/printing/printing.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/source3/printing/printing.c b/source3/printing/printing.c index 06941c67dd..79cab3d9fa 100644 --- a/source3/printing/printing.c +++ b/source3/printing/printing.c @@ -713,9 +713,20 @@ static int traverse_fn_delete(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data, void pjob_delete(ts->snum, jobid); } else ts->total_jobs++; + return 0; } - else - ts->total_jobs++; + + /* Save the pjob attributes we will store. */ + ts->queue[i].job = jobid; + ts->queue[i].size = pjob.size; + ts->queue[i].page_count = pjob.page_count; + ts->queue[i].status = pjob.status; + ts->queue[i].priority = 1; + ts->queue[i].time = pjob.starttime; + fstrcpy(ts->queue[i].fs_user, pjob.user); + fstrcpy(ts->queue[i].fs_file, pjob.jobname); + + ts->total_jobs++; return 0; } @@ -2088,6 +2099,7 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun uint32 qcount = 0; uint32 extra_count = 0; int total_count = 0; + size_t len = 0; uint32 i; int max_reported_jobs = lp_max_reported_jobs(snum); BOOL ret = False; @@ -2130,8 +2142,8 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun goto out; /* Retrieve the linearised queue data. */ + len = 0; for( i = 0; i < qcount; i++) { - size_t len = 0; uint32 qjob, qsize, qpage_count, qstatus, qpriority, qtime; len += tdb_unpack(data.dptr + 4 + len, data.dsize - len, NULL, "ddddddff", &qjob, -- cgit From 31c8c7156fa880c71c7199af58e9e0ba6fbed24d Mon Sep 17 00:00:00 2001 From: Martin Pool Date: Fri, 4 Apr 2003 03:07:07 +0000 Subject: Test harness that exercises check_dos_char() (This used to be commit 346c763fd1f5d7ef51ca3f748a276d9982275bfe) --- source3/torture/t_doschar.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 source3/torture/t_doschar.c diff --git a/source3/torture/t_doschar.c b/source3/torture/t_doschar.c new file mode 100644 index 0000000000..41698350d6 --- /dev/null +++ b/source3/torture/t_doschar.c @@ -0,0 +1,42 @@ +/* + Samba - Unix SMB/CIFS implementation + Test harness for check_dos_char + Copyright (C) Martin Pool 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + + +/* + * Just print out DOS validity or not for every character. + * + * DOS validity for a Unicode character set means that it can be + * represented in DOS codepage, and that the DOS character maps back + * to the same Unicode character. + * + * This depends on which DOS codepage is configured. + */ + int main(void) +{ + smb_ucs2_t i; + + for (i = 0; i < 0xffff; i++) { + printf("%d %d\n", (int) i, (int) check_dos_char(i)); + } + + return 0; +} -- cgit From 0ac3eeaff5debaeeeb2d0332bb9acb69057cfd55 Mon Sep 17 00:00:00 2001 From: Martin Pool Date: Fri, 4 Apr 2003 03:09:42 +0000 Subject: t_doschar: Test harness that exercises check_dos_char() (This used to be commit 54f4df0301f21c91218abf6f17cae097e755fd7f) --- source3/Makefile.in | 3 +++ 1 file changed, 3 insertions(+) diff --git a/source3/Makefile.in b/source3/Makefile.in index 5143c6fc11..fa94c582e0 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1090,6 +1090,9 @@ bin/t_strcmp@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_strcmp.o bin/t_stringoverflow@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_stringoverflow.o $(CC) $(FLAGS) -o $@ torture/t_stringoverflow.o -L./bin -lbigballofmud +bin/t_doschar@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_doschar.o + $(CC) $(FLAGS) -o $@ $(LIBS) torture/t_doschar.o -L ./bin -lbigballofmud + install: installbin installman installscripts installdat installswat installmodules installclientlib # DESTDIR is used here to prevent packagers wasting their time -- cgit From 03ccc4ac13651b369a83d003ee4ee50225f74e32 Mon Sep 17 00:00:00 2001 From: Martin Pool Date: Fri, 4 Apr 2003 03:14:48 +0000 Subject: Merge from Subversion: Add example of a test that fails. (This used to be commit 1b1bb8ac37464339a7bffc84eb6d96ee1ae7d33d) --- source3/stf/example.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/source3/stf/example.py b/source3/stf/example.py index 1f121fd9af..96e34bf3d3 100755 --- a/source3/stf/example.py +++ b/source3/stf/example.py @@ -26,8 +26,13 @@ class OnePlusOne(comfychair.TestCase): def runtest(self): self.assert_(1 + 1 == 2) +class FailTest(comfychair.TestCase): + def runtest(self): + self.assert_(1 + 1 == 3) + tests = [OnePlusOne] +extra_tests = [FailTest] if __name__ == '__main__': - comfychair.main(tests) + comfychair.main(tests, extra_tests=extra_tests) -- cgit From 94e5719dac45baffc5f5dad6e045ac99999c76e9 Mon Sep 17 00:00:00 2001 From: Martin Pool Date: Fri, 4 Apr 2003 03:16:27 +0000 Subject: Merge from Subversion r50. (This used to be commit 480487355929ec5ec066b33630c06c3a30bcca49) --- source3/stf/comfychair.py | 248 +++++++++++++++++++++++++++++++++------------- 1 file changed, 180 insertions(+), 68 deletions(-) diff --git a/source3/stf/comfychair.py b/source3/stf/comfychair.py index 8ff7726955..522f9bedeb 100644 --- a/source3/stf/comfychair.py +++ b/source3/stf/comfychair.py @@ -31,14 +31,9 @@ For more information, see the file README.comfychair. To run a test suite based on ComfyChair, just run it as a program. """ -# TODO: Put everything into a temporary directory? - -# TODO: Have a means for tests to customize the display of their -# failure messages. In particular, if a shell command failed, then -# give its stderr. - import sys, re + class TestCase: """A base class for tests. This class defines required functions which can optionally be overridden by subclasses. It also provides some @@ -47,6 +42,43 @@ class TestCase: def __init__(self): self.test_log = "" self.background_pids = [] + self._cleanups = [] + self._enter_rundir() + self._save_environment() + self.add_cleanup(self.teardown) + + + # -------------------------------------------------- + # Save and restore directory + def _enter_rundir(self): + import os + self.basedir = os.getcwd() + self.add_cleanup(self._restore_directory) + self.rundir = os.path.join(self.basedir, + 'testtmp', + self.__class__.__name__) + self.tmpdir = os.path.join(self.rundir, 'tmp') + os.system("rm -fr %s" % self.rundir) + os.makedirs(self.tmpdir) + os.system("mkdir -p %s" % self.rundir) + os.chdir(self.rundir) + + def _restore_directory(self): + import os + os.chdir(self.basedir) + + # -------------------------------------------------- + # Save and restore environment + def _save_environment(self): + import os + self._saved_environ = os.environ.copy() + self.add_cleanup(self._restore_environment) + + def _restore_environment(self): + import os + os.environ.clear() + os.environ.update(self._saved_environ) + def setup(self): """Set up test fixture.""" @@ -60,6 +92,12 @@ class TestCase: """Run the test.""" pass + + def add_cleanup(self, c): + """Queue a cleanup to be run when the test is complete.""" + self._cleanups.append(c) + + def fail(self, reason = ""): """Say the test failed.""" raise AssertionError(reason) @@ -138,9 +176,14 @@ why.""" def runcmd_background(self, cmd): import os - name = cmd[0] self.test_log = self.test_log + "Run in background:\n" + `cmd` + "\n" - pid = os.spawnvp(os.P_NOWAIT, name, cmd) + pid = os.fork() + if pid == 0: + # child + try: + os.execvp("/bin/sh", ["/bin/sh", "-c", cmd]) + finally: + os._exit(127) self.test_log = self.test_log + "pid: %d\n" % pid return pid @@ -148,44 +191,78 @@ why.""" def runcmd(self, cmd, expectedResult = 0): """Run a command, fail if the command returns an unexpected exit code. Return the output produced.""" - rc, output = self.runcmd_unchecked(cmd) + rc, output, stderr = self.runcmd_unchecked(cmd) if rc != expectedResult: - raise AssertionError("command returned %d; expected %s: \"%s\"" % - (rc, expectedResult, cmd)) + raise AssertionError("""command returned %d; expected %s: \"%s\" +stdout: +%s +stderr: +%s""" % (rc, expectedResult, cmd, output, stderr)) + + return output, stderr + + + def run_captured(self, cmd): + """Run a command, capturing stdout and stderr. + + Based in part on popen2.py + + Returns (waitstatus, stdout, stderr).""" + import os, types + pid = os.fork() + if pid == 0: + # child + try: + pid = os.getpid() + openmode = os.O_WRONLY|os.O_CREAT|os.O_TRUNC + + outfd = os.open('%d.out' % pid, openmode, 0666) + os.dup2(outfd, 1) + os.close(outfd) + + errfd = os.open('%d.err' % pid, openmode, 0666) + os.dup2(errfd, 2) + os.close(errfd) + + if isinstance(cmd, types.StringType): + cmd = ['/bin/sh', '-c', cmd] + + os.execvp(cmd[0], cmd) + finally: + os._exit(127) + else: + # parent + exited_pid, waitstatus = os.waitpid(pid, 0) + stdout = open('%d.out' % pid).read() + stderr = open('%d.err' % pid).read() + return waitstatus, stdout, stderr - return output def runcmd_unchecked(self, cmd, skip_on_noexec = 0): - """Invoke a command; return (exitcode, stdout)""" - import os, popen2 - pobj = popen2.Popen4(cmd) - output = pobj.fromchild.read() - waitstatus = pobj.wait() + """Invoke a command; return (exitcode, stdout, stderr)""" + import os + waitstatus, stdout, stderr = self.run_captured(cmd) assert not os.WIFSIGNALED(waitstatus), \ - ("%s terminated with signal %d", cmd, os.WTERMSIG(waitstatus)) + ("%s terminated with signal %d" % (`cmd`, os.WTERMSIG(waitstatus))) rc = os.WEXITSTATUS(waitstatus) self.test_log = self.test_log + ("""Run command: %s Wait status: %#x (exit code %d, signal %d) -Output: +stdout: +%s +stderr: %s""" % (cmd, waitstatus, os.WEXITSTATUS(waitstatus), os.WTERMSIG(waitstatus), - output)) + stdout, stderr)) if skip_on_noexec and rc == 127: # Either we could not execute the command or the command # returned exit code 127. According to system(3) we can't # tell the difference. raise NotRunError, "could not execute %s" % `cmd` - return rc, output + return rc, stdout, stderr + def explain_failure(self, exc_info = None): - import traceback - # Move along, nothing to see here - if not exc_info and self.test_log == "": - return - print "-----------------------------------------------------------------" - if exc_info: - traceback.print_exc(file=sys.stdout) + print "test_log:" print self.test_log - print "-----------------------------------------------------------------" def log(self, msg): @@ -201,14 +278,34 @@ class NotRunError(Exception): self.value = value -def runtests(test_list, verbose = 0): - """Run a series of tests. +def _report_error(case, debugger): + """Ask the test case to explain failure, and optionally run a debugger - Eventually, this routine will also examine sys.argv[] to handle - extra options. + Input: + case TestCase instance + debugger if true, a debugger function to be applied to the traceback +""" + import sys + ex = sys.exc_info() + print "-----------------------------------------------------------------" + if ex: + import traceback + traceback.print_exc(file=sys.stdout) + case.explain_failure() + print "-----------------------------------------------------------------" + + if debugger: + tb = ex[2] + debugger(tb) + + +def runtests(test_list, verbose = 0, debugger = None): + """Run a series of tests. Inputs: - test_list sequence of callable test objects + test_list sequence of TestCase classes + verbose print more information as testing proceeds + debugger debugger object to be applied to errors Returns: unix return code: 0 for success, 1 for failures, 2 for test failure @@ -220,37 +317,37 @@ def runtests(test_list, verbose = 0): # flush now so that long running tests are easier to follow sys.stdout.flush() + obj = None try: try: # run test and show result obj = test_class() - if hasattr(obj, "setup"): - obj.setup() + obj.setup() obj.runtest() print "OK" except KeyboardInterrupt: print "INTERRUPT" - obj.explain_failure(sys.exc_info()) + _report_error(obj, debugger) ret = 2 break except NotRunError, msg: print "NOTRUN, %s" % msg.value except: print "FAIL" - obj.explain_failure(sys.exc_info()) + _report_error(obj, debugger) ret = 1 finally: - try: - if hasattr(obj, "teardown"): - obj.teardown() - except KeyboardInterrupt: - print "interrupted during teardown" - obj.explain_failure(sys.exc_info()) - ret = 2 - break - except: - print "error during teardown" - obj.explain_failure(sys.exc_info()) - ret = 1 + while obj and obj._cleanups: + try: + apply(obj._cleanups.pop()) + except KeyboardInterrupt: + print "interrupted during teardown" + _report_error(obj, debugger) + ret = 2 + break + except: + print "error during teardown" + _report_error(obj, debugger) + ret = 1 # Display log file if we're verbose if ret == 0 and verbose: obj.explain_failure() @@ -277,9 +374,10 @@ usage: list them on the command line. options: - --help show usage message - --list list available tests - --verbose show more information while running tests + --help show usage message + --list list available tests + --verbose, -v show more information while running tests + --post-mortem, -p enter Python debugger on error """ % sys.argv[0] @@ -289,9 +387,14 @@ def print_list(test_list): print " %s" % _test_name(test_class) -def main(tests): +def main(tests, extra_tests=[]): """Main entry point for test suites based on ComfyChair. + inputs: + tests Sequence of TestCase subclasses to be run by default. + extra_tests Sequence of TestCase subclasses that are available but + not run by default. + Test suites should contain this boilerplate: if __name__ == '__main__': @@ -305,28 +408,37 @@ Calls sys.exit() on completion. from sys import argv import getopt, sys - verbose = 0 - - opts, args = getopt.getopt(argv[1:], '', ['help', 'list', 'verbose']) - if ('--help', '') in opts: - print_help() - return - elif ('--list', '') in opts: - print_list(tests) - return + opt_verbose = 0 + debugger = None - if ('--verbose', '') in opts: - verbose = 1 + opts, args = getopt.getopt(argv[1:], 'pv', + ['help', 'list', 'verbose', 'post-mortem']) + for opt, opt_arg in opts: + if opt == '--help': + print_help() + return + elif opt == '--list': + print_list(tests + extra_tests) + return + elif opt == '--verbose' or opt == '-v': + opt_verbose = 1 + elif opt == '--post-mortem' or opt == '-p': + import pdb + debugger = pdb.post_mortem if args: + all_tests = tests + extra_tests by_name = {} - for t in tests: + for t in all_tests: by_name[_test_name(t)] = t - which_tests = [by_name[name] for name in args] + which_tests = [] + for name in args: + which_tests.append(by_name[name]) else: which_tests = tests - sys.exit(runtests(which_tests, verbose)) + sys.exit(runtests(which_tests, verbose=opt_verbose, + debugger=debugger)) if __name__ == '__main__': -- cgit