From mirageos-devel-bounces@lists.xenproject.org Thu Mar 27 17:52:36 2025 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 27 Mar 2025 17:52:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.929530.1332659 (Exim 4.92) (envelope-from ) id 1txrP0-0000C8-Ep; Thu, 27 Mar 2025 17:52:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 929530.1332659; Thu, 27 Mar 2025 17:52:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1txrP0-0000C1-BW; Thu, 27 Mar 2025 17:52:26 +0000 Received: by outflank-mailman (input) for mailman id 929530; Thu, 27 Mar 2025 15:03:47 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1txoln-0002KG-0m for mirageos-devel@lists.xenproject.org; Thu, 27 Mar 2025 15:03:47 +0000 Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id ac49410a-0b1c-11f0-9ea3-5ba50f476ded; Thu, 27 Mar 2025 16:03:45 +0100 (CET) Received: from zcs2-store3.inria.fr ([128.93.142.8]) by mail2-relais-roc.national.inria.fr with ESMTP; 27 Mar 2025 16:03:42 +0100 X-BeenThere: mirageos-devel@lists.xenproject.org List-Id: Developer list for MirageOS List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: mirageos-devel-bounces@lists.xenproject.org Precedence: list Sender: "MirageOS-devel" X-Inumbo-ID: ac49410a-0b1c-11f0-9ea3-5ba50f476ded Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=Pass smtp.mailfrom=lucas.aubard@irisa.fr; spf=None smtp.helo=postmaster@zcs2-store3.inria.fr Received-SPF: Pass (mail2-relais-roc.national.inria.fr: domain of lucas.aubard@irisa.fr designates 128.93.142.8 as permitted sender) identity=mailfrom; client-ip=128.93.142.8; receiver=mail2-relais-roc.national.inria.fr; envelope-from="lucas.aubard@irisa.fr"; x-sender="lucas.aubard@irisa.fr"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:128.93.142.0/24 ip4:192.134.164.0/24 ip4:128.93.162.160 ip4:89.107.174.7 mx ~all" Received-SPF: None (mail2-relais-roc.national.inria.fr: no sender authenticity information available from domain of postmaster@zcs2-store3.inria.fr) identity=helo; client-ip=128.93.142.8; receiver=mail2-relais-roc.national.inria.fr; envelope-from="lucas.aubard@irisa.fr"; x-sender="postmaster@zcs2-store3.inria.fr"; x-conformance=spf_only X-IronPort-AV: E=Sophos;i="6.14,280,1736809200"; d="pdf'?pcap'?zip'48?scan'48,208,217,48";a="215104684" X-MGA-submission: =?us-ascii?q?MDGrISf989dGn/9+6ETcDS1kHe+0S0eZFOAIfW?= =?us-ascii?q?9f/RFE52wvo2ocOcgqcymM86Xaw2i7AJF4K0k+EegnwLTSnciE5YlgsZ?= =?us-ascii?q?uuazqYK1GZLPQzbBhpKURU3GSidPdt6T4rpz4fzud/NgcTuOuH1f0mMV?= =?us-ascii?q?eisTTzcc7vTEypSjGwL2ERxw=3D=3D?= Date: Thu, 27 Mar 2025 16:03:41 +0100 (CET) From: Lucas Aubard To: mirageos-devel@lists.xenproject.org Cc: Johan Mazel , gilles guette , Pierre Chifflier Message-ID: <530642224.595613.1743087821949.JavaMail.zimbra@irisa.fr> Subject: Failed TCP connection reset when processing overlapping data segments MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_595607_390145407.1743087821945" X-Originating-IP: [131.254.15.46] X-Mailer: Zimbra 10.1.6_GA_4744 (ZimbraWebClient - FF136 (Linux)/10.1.6_GA_4744) Thread-Index: Z2YjqALWB4m26K9zhbZ4uQPQK9BVVg== Thread-Topic: Failed TCP connection reset when processing overlapping data segments ------=_Part_595607_390145407.1743087821945 Content-Type: multipart/alternative; boundary="=_8a862cf6-e316-4e51-9185-0e76b4239c5f" --=_8a862cf6-e316-4e51-9185-0e76b4239c5f Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Dear mirage-tcpip development team, I am Lucas Aubard. I am a PhD student in an Inria lab in Rennes, France. This PhD is supervised by Gilles Guette (IMT Atlantique), Pierre Chifflier (ANSSI) and Johan Mazel (ANSSI). During our research work, we analyzed mirage-tcpip 9.0.0 reassembly when processing overlapping TCP data segments. We noticed something weird for some of our test cases. The testing scenario for every test case is as follow: * a handshake is initiated from 192.168.56.200 host to 192.168.57.203 mirage-tcpip host, targetting its TCP Echo port 7. * the overlapping data chunks are sent from the initiator. * the initiator resets the TCP connection with a RST+ACK packet. Every packet that mirage-tcpip host echoes back is acknowledged by the initiator. In the impacted test cases, mirage-tcpip echoes some data but not the maximum possible amount of data. In fact, from what we observe across mirage test case reassemblies, it does not echo back overlapping data segments. This may be related to this part of mirage-tcpip code [ https://github.com/mirage/mirage-tcpip/blob/6766a3f0b34695e19797a1264697d3dd1343c73e/src/tcp/segment.ml#L151 | https://github.com/mirage/mirage-tcpip/blob/6766a3f0b34695e19797a1264697d3dd1343c73e/src/tcp/segment.ml#L151 ] . The following termination of the TCP connections with a RST+ACK packet fails. We believe that mirage-tcpip considers that the RST+ACK packet sequence number is invalid because it is located after all sent data (including the overlapping segments). Since mirage-tcpip does not echo the maximum possible amount of data, we hypothesize that the initiator SND.NXT internal variable is not the same as the RCV.NXT value in mirage-tcpip. Attached are the pcap files and plots for some (random) overlap test cases illustrating the problem. You can see in the pcap files that mirage-tcpip sends an ACK after the RST+ACK packets whose acknowledgment is not related to the last data sent by the initiator. This means that mirage does not consider the sequence number of the RST+ACK packet as valid, ignores this RST+ACK packet, and does not close the TCP connection. Mirage here expects data that follows the last valid data it observed. Can you confirm that our understanding of the mirage-tcpip TCP stack behavior is correct, in particular in term of data overlap and sequence number processing? Best regards, Lucas Aubard. --=_8a862cf6-e316-4e51-9185-0e76b4239c5f Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Dear mirage-tcpip development team,

I am Lucas Auba= rd. I am a PhD student in an Inria lab in Rennes, France.
This PhD is s= upervised by Gilles Guette (IMT Atlantique), Pierre Chifflier (ANSSI) and J= ohan Mazel (ANSSI).

During our research work, we analyzed mirage-tcp= ip 9.0.0 reassembly when processing overlapping TCP data segments. We notic= ed something weird for some of our test cases.

The testing scenario = for every test case is as follow:
  • a handshake is initiated fro= m 192.168.56.200 host to 192.168.57.203 mirage-tcpip host, targetting its T= CP Echo port 7.
  • the overlapping data chunks are sent from the initi= ator.
  • the initiator resets the TCP connection with a RST+ACK packet= .
Every packet that mirage-tcpip host echoes back is acknowle= dged by the initiator.

In the impacted test cases, mirage-tcpip echo= es some data but not the maximum possible amount of data. In fact, from wha= t we observe across mirage test case reassemblies, it does not echo back ov= erlapping data segments. This may be related to this part of mirage-tcpip c= ode https://g= ithub.com/mirage/mirage-tcpip/blob/6766a3f0b34695e19797a1264697d3dd1343c73e= /src/tcp/segment.ml#L151. The following termination of the TCP c= onnections with a RST+ACK packet fails.
We believe that mirage-tc= pip considers that the RST+ACK packet sequence number is invalid because it= is located after all sent data (including the overlapping segments). Since= mirage-tcpip does not echo the maximum possible amount of data, we hypothe= size that the initiator SND.NXT internal variable is not the same as the RC= V.NXT value in mirage-tcpip.

Attached are the pcap files and = plots for some (random) overlap test cases illustrating the problem.
<= div>You can see in the pcap files that mirage-tcpip sends an ACK after the = RST+ACK packets whose acknowledgment is not related to the last data sent b= y the initiator.
This means that mirage does not consider the seq= uence number of the RST+ACK packet as valid, ignores this RST+ACK packet, a= nd does not close the TCP connection. Mirage here expects data that follows= the last valid data it observed.

Can you confirm that ou= r understanding of the mirage-tcpip TCP stack behavior is correct, in parti= cular in term of data overlap and sequence number processing?

Best regards,
Lucas Aubard.
<= /html> --=_8a862cf6-e316-4e51-9185-0e76b4239c5f-- ------=_Part_595607_390145407.1743087821945 Content-Type: application/zip; name=pcaps.zip Content-Disposition: attachment; filename=pcaps.zip Content-Transfer-Encoding: base64 UEsDBBQAAAAAAEhGe1oAAAAAAAAAAAAAAAAGACAAcGNhcHMvdXgLAAEEqzMKAAQBlgQAVVQNAAc5 A+VngQLlZzkD5WdQSwMEFAAIAAgA855qWgAAAAAAAAAAAAAAABMAIABwY2Fwcy90ZXN0XzE0OC5w Y2FwdXgLAAEEqzMKAAQBlgQAVVQNAAeqNc9n0wLlZ9MC5WetkjFIAmEUx/8enoZyoNVgtBxEKNRw KicGYRdU0BKHaDQaDTroOdTaatTY0FYQOThHewctQYMRLoFRQVCmBI1NF++7i+Q8g8QP3r3j4H78 /u99javzUw5u/B43XABScj2/v8EjAbCiw7nYEyNYBiL0rngqHb2WvNZrczfhKrwAfPRd5UTsrJqU xRyPeYCV+b/JYpRZQMG0Z/ONCESCN1xtF9KXAPy5UcNIZQDOzV+YrDNB+L+Rv11I62pARCIILMj1 vFoUkKKMThTJorzYKFOMEhIhtwCJTrxcJFprW+ifL2Ll69jy6eSlBgxjPfgzd0Wu5w+bPFYAVj1m Scus6ZiPzL7ILCpJklZmPappRM082qjdhknLsOlgOKmGDCPbcqZOPP2x1365bxk1YBjZz+7cd68D 3LQZ4tFe5WeTsvU+PKO9IwFrAKseI8UyatiMxpgRbeKeZhaTpGhJYz1WKrEeLxWJvns8wJ1xMF2S 6/mPim/Q2Y2LkB9MysmBbyhG31BLBwi4aMdzfwEAAFAEAABQSwMEFAAIAAgA855qWgAAAAAAAAAA AAAAABIAIABwY2Fwcy90ZXN0XzEwLnBjYXB1eAsAAQSrMwoABAGWBABVVA0AB6o1z2cSA+VnEgPl Z7tyeNNCJgYWBgRgYWBkYGBwMz2fHi/MzmDGwADGIMDECCYZOBhcGRg0QGwHtrY3B1ZYnDiwwvK0 uhQDOwMDAxdIPIBJgaHkMsSU/yLsDDYMDGAM0Q8xC2yKDgODA4MqW+ILkAkgkxjY1aUmr955lYGB gTtB6P9//VYGBiYW1i0Qsz7v5yPdRdyTV++8FiCgwKDuxMDgbno+vU6An8EN5EdsplhATbmD1RQJ BQZ1LQYGAzDIzwdThvl5IFPzhdBMRfanBdSfd9D8eY2BgUE6QOL/f3cp7KbaC/PjDj0NqKlv0Ex9 BjZV4P9/dyVYrILMei/FT3roSYPMA4eeEgODh+n59HUl7KSHnjDYFFDoCYH8aWhgYJiXB6aN8nJB pipX4EklJPjTx/R8umgRA+n+VAa7UESBQV0MYkpONQNVXAQAUEsHCHcoswFAAQAAYgMAAFBLAwQU AAgACADznmpaAAAAAAAAAAAAAAAAEgAgAHBjYXBzL3Rlc3RfMTIucGNhcHV4CwABBKszCgAEAZYE AFVUDQAHqjXPZzkD5Wc5A+VnrdGxS8NAFAbwLyGmwXYo1qFgoVmkAStcAymJFGmHFhyEtFuWolNw SRZn7WL/D7eCTtXRoeCiOATBUXHJ4FBnx5O7i6hpHSp98JJwcD/e9/J0Oz6XoeC7FEgAtqzIv+gA dYhmJUv8CQ1twGDfTXU4nYzsu8nIeaiUkAGwys5dWcfxo1Duu0ADosV9YXGlCjSxqR6+MYFJyFRK /XJsA8gerFG6cwnIysq1sAxVW3yibL8cO25eh3kEVK3IvznRsAvwnlFIosRzlaIO0wMIrzBkWjRI aT/zkSRfnMrnACi4RUp73d/ay0D7e1tGok1TWotreUp73tdfZNbZ8B/bKjCPb8sDtq3If21I6AC8 ZxQ7UZ7nbKvFt7XH8tUIIUHI37UgYOpVW1pKTmJFfv09t3jODT7hug5zXyinH7mlTPQJUEsHCGRU RsA+AQAAUgMAAFBLAQIUAxQAAAAAAEhGe1oAAAAAAAAAAAAAAAAGABgAAAAAAAAAAADtQQAAAABw Y2Fwcy91eAsAAQSrMwoABAGWBABVVAUAATkD5WdQSwECFAMUAAgACADznmpauGjHc38BAABQBAAA EwAYAAAAAAAAAAAApIFEAAAAcGNhcHMvdGVzdF8xNDgucGNhcHV4CwABBKszCgAEAZYEAFVUBQAB qjXPZ1BLAQIUAxQACAAIAPOealp3KLMBQAEAAGIDAAASABgAAAAAAAAAAACkgSQCAABwY2Fwcy90 ZXN0XzEwLnBjYXB1eAsAAQSrMwoABAGWBABVVAUAAao1z2dQSwECFAMUAAgACADznmpaZFRGwD4B AABSAwAAEgAYAAAAAAAAAAAApIHEAwAAcGNhcHMvdGVzdF8xMi5wY2FwdXgLAAEEqzMKAAQBlgQA VVQFAAGqNc9nUEsFBgAAAAAEAAQAVQEAAGIFAAAAAA== ------=_Part_595607_390145407.1743087821945 Content-Type: application/zip; name=plots.zip Content-Disposition: attachment; filename=plots.zip Content-Transfer-Encoding: base64 UEsDBBQAAAAAAEFGe1oAAAAAAAAAAAAAAAAGACAAcGxvdHMvdXgLAAEEqzMKAAQBlgQAVVQNAAcq A+VngQLlZyoD5WdQSwMEFAAIAAgAMZF6WgAAAAAAAAAAAAAAABkAIABwbG90cy90ZXN0XzE0OF9w ZXAtYXAucGRmdXgLAAEEqzMKAAQBlgQAVVQNAAfPNORn9gLlZ/YC5Wetegk4VO/3eGSdbAlliWvP krl37txZbGVfshulRLaxxQwzI7RbskaWEAqhjXYiRVlSJPERqVQU0marRAn/Z4b69sn8/t+e3/Pz PMf73vMu57znnHvOmXteZTtj0/WQFhalfP45UHYDBQEgQPUMQOnqAmhSRDAZQBt5MDwCqb4A2s7D l0wHMAAIOAD6+igyxZs5kfDbAlMqhQHArAloZ1vPALIXA8AvPJqEM8wcGR4MMoBdQNh5MBhkGgVA mI8otKOfh7c/xRfALY7SqF6OZAbgAqDtjE0BNIkczgDQFkEevmTDxdZosbUAXH9jB1p6ACbfzP80 MoWxyD7agUynhtK8yHSAsEDfmuzt72FIDQdcABAAATyM08IQcQQ8AkA4jBYGC+ERwBVAG1EpDDKF QQeIC/sYUChUBh2AwD+kQvyNCysyxZfhB0CLpE39AxlkGoA2DfRgkI3JXlRvMnMhnUEjewShwo9f cLamy6iK1H7WIGzjvXbj25s1Q0ZON57edCKW0BJqNp8XtWxJGbhdkOsRJmHXHo/R1ro084+O7lve Lbdl5mb2hk0H09cfeJlQ9vnSzUtRg9FABNpe3/xon3KLtMUnt8Ia45yYHiESo7733ZTXt7zjnORm l2/rLn+frBIpuNNtqzR22/Io3vAJn4oqkUvuWtWqa4kH2956ES0fc8qqtQsMvQ1RyFS9kY2d5ef7 NIMdwSroGipVGHc/aC2cLExZlbTT4NPNcAml4Xmbzndex3Y9sxjhqM0Ms9g+1tRNVcpMn7HlVL4/ azYRtzdu9Sfb6tvit0eb9kBb5JvDNyoV33/aHp1XnlEvE3tXaub7lzdDXyz9685WaJ3ZIEyxudTc 5qG+zUvntPCDLxAn9wXG+TcbjlBWiwSmrLDR+bybo8Rtc2Et95Bgjt1mu8OUzYVrhwhjmT1rxa9n i6/ZVHjC5EMrKvGfNtThr8SH3Kj3kyixYoMy3TU7i+lk7qa3PtxZjJTylYqhpLrmjpM8O5+N7DhM 2SLyWm108qmkuLZcvf9Y9DmfDUcoBRwPZQdAz721nK7nLh+ld/U3P9obszJczjxo5YhQe5+QbRjv ty/rZ0OnG85/oCnsXn7/e815CU+4Wd1l/fCVQyLRbnOrLHX3jczeK7ocNu/WPBvNJ1JRbpmnNuAQ 3fitda1RS1ROdIiQT5KyUqF7XkB7ce+QKbdBdZVWNu6+E0c8w2UUc8NVy56L2ubSU4Z773rDy4n6 D5y9+4wD+kxRd9fw6csHRWrV7w/FVN9Olap/TziR+Kh6epSuTSrKtroZphWV8c9BjMF+YnPfUEZX +YuNwXeLBQ38Nez3X/cXSESEDgtrvbd8+zDqRJ6f2pe1+PwYQZ7zucI/VHI5SjPOCQ0fVDru4O7K ePK4gcOCYOQ+PNdrfFvGtoHIZUYv9iuSLNTuzg3mMW9oWvawzfSsUAE5UWztd3eGW6aI/PvqoGyX Y+DGB/tKnjXqyFpEHY07ll1u3Z/aqXVtQiCVi8h7LLsieThVaZ3VnoEhtYqBNCUxqbqa89acSUdT ypJ9Dyodtd8Y4d8bLmRhSOS8n9SrEmwuqg7YuU3hIo3U2x8zH3M51w161ytY+I0YqNlIaKbHVAod JXvXc2QO7xwgKvHrnXCyoj9LCNj5nJTkgE369Cj7hec9xckiLL+MA9oyo05+sqiLX3Oh212EnRCw Q1uuapdnTUiPkRfM/ZRyfpWzEn+xuB9MbVHJ51BX7LtLNxe9q/i2riXKJB2Uj5JnkW1aZkq/6p72 Xr1DJdhcXYeWVydPLqcMSBYG9ATpxpEEb1q4p5WSq/hlHHAjuHyO0soXd+nm3dd7uYTObQvLGHfT 36RM/Rz98IdE57Ta6PrYA245t8LnW9s+SlOyw9bk7vAYLSt7riCMEisJE1n/bBSfmf5O6fgPAqaB kU66NSgMZo4GHySv7B+8GHcspVP3Vj8DfIeczvD7DBvzPtqw0yopd/gDg/fRAOpRS8qbHnlDwfo4 ue82SfZttjJGpKRDJ7hfGpnsJKmG5Ynrk7pbpn0ShO0zs6bv+T80jZCIEO5+JNX9j5Gc00ujayoP m1rIOcKz9U0DbdpyRdue9/0Q0Cs617Q6hZrbBKVQc8uzZV5ik9o+9mF33tgm4zd/emumX7FGskhH bcJF07NSrqF2F24HPb4hdba0u5vPqbhMqNTNNdTulA1zwLLi+meBvWc+W6+Tu6tIurep8x0o29FF OyDVhx3O6x4/TeyrjsW30aQ/9GF35m4b9Z/N88ksrXyr2Fc68daIdM1C7tvHoeTgwqK7p4Xtu/Vr 40ofnT3CdzLkvR4p0+kAeo53a/GudqabXnS4P+MGZtFjQzAB8wsJLiJdANdfOPxS1w5jCP/dryPp Ohe9IT5j+qXXgYXKn/Efqm2L+Xd/LUgJnkoqFcCRPDqjrFXQUFEubchss7OdznTY1tE3tTVJXQ2O Fn3Xce/ays9HH27obCY90J/WvHDL6kKzCEOuM8a3xdtbUfLOt6L2vFYVx5SCjc8mjuurx8YVXQnZ GTjjNKG56d4p01PitwSp9e9Fco9JtyeKBfZcO1e94bpZK3jF2tjO5GO07fNhice0e157duzN8tl+ enc4QsvtcZKl77iocfUK/5uuXS837VJUiJd7lpZx3MX6hCjjbm7VpjfOiTXDo/8MVr6bCxAVrxHl n3Wf8Va37w3nkeINM/pgZco9En2i7m4C9+mqsCa92h6rhppL2homSuN6oUdel3Ml9Ejy5Y2n6h+n Z7trvmkZu5cl9X53VcuXaDkzfGfe1buIWvlOy7NbL2hZJvZN7nncNzm84fC6/YpsNEdYqhA8+N/1 AcNYEmjXgTiAdiCMtQfxV0nm0GAnwllOq3b3JLpn5STkGAplXzmnJtq6UT6utblLwMbIm5EsIhA/ J3ARu8xhp1gdG27YRH4M9i/YMUnbRFkOCRhN6XOjReq+P9M+kqSQ1DJbxY1Y3FCAUltUrbe5F3EJ Q3fynYkTio1TUVqNZSe21mfXBzTovboREtsa69tQWRdW98ClvePESFeZKmly1vS+jkklQz1Tz7ci b8Xx1Pj9ilePvTnk5O5nWVXSL/D49EGxMqkPsqrrlu8+VD2+deiwb3a4tptRab8J1uhtTKyCprSb yEnQwtjG+fnu2LLKz5l8MJfw5RZR+1oA7Wd/IUz1xEdum9QjVIwULM/j8+lr4Mn8ejdtmm5RfcyI Uned4Mu43u+3eu8g7zV+HNpyYD5s+3ep9okZ3k1zrjxLBYcB2QgOg/3vgltvfzOIGxL4oMe9Ovyg /lHN9gHAPO1jH0+nq8mzVLX0FBE+hXF73jIRtelOpEv0QKN545in1Br+7zywgVOwzugn1GWufE6J Vw/rbwYOg3QOuPDMRo3np3LGiztErhcYSF/zSH/LL/hQuvtFgNZZ2U0lbVkVbgWYYZT34Qsvekbo chUjiqtsTukh8L7laztWcZb2r8pomrCP5D0jVsU7hnkGvuBHzopfnfwaGcBI2Lbc9jBf+DPCuG8u MvHVlOAxWDGiFR0WoTs70/zRQvQk9aj7wXfxF+dn82/ufzy1wUaetJKNoCB2Fob574LSSzWgGEN8 RlPHG1avUeNZ1Rzh4FR+7OUBF+UdI/dtGxqOtdzZqOImMMgYlJkuWvsFmfhsp61vemHD/WU9y5IK ZfRFB+twR0yRmkPv+FyfSnTzGt87nhojWnlO5Vmal4eyA5fkk13N0nI6q1D3VqfKXIIf+9VIFL3O X3vlIuXzoHJltBBPwbQsMNvl/Tm+XR9KaDZc3yz9JSr3yV1Lb67tNfN8R8p6PbuVh0Ks/JCuD/m6 hR/CjMXnZK+PBKmbXR+4RzIWO6kZvxxlKFWVUVgt8jlQrCE0NK/HSPZI4xHH9hNRNi+OT0k+UPWd V93/Majv9lzcNgU2osOw8d0E+C9E53DzwpoFG+Nzfz8WocXXWTPbu/GTq7popbF9QUedqdh++1f2 5qt+vHGQ6OLcsCm90ViwFPWU/8Uh3yu4ErHDMU+qr9ceUKgHtKNEMxqtdcucMB1FHm/VPcKzYpEr bXOIWvCKfPJooZLmQz7cS9HGj4WKz2JaIoKeZkGlr7x+7BzaeiB7fGPZePkxfj3u3HrnwsBjyvmh nFmRNAKxP9E3U9E8WKdhVYWxzMM1KDUhqOBdaO1d33dPG7dVKZ5/mDdww6zpRPGz8FaBD6v1vBrf XULryJx543tcmr773dY12FW3+EPjNhkMlUoOBuM05l4/uCTZ3S9xVrAP9ShnOtLI9qHJOvTX11pe 2jKk6leh2jPd39FzmzVsQkbbbXivGXy1Jr92MbsUeyq43M26fG3/FclIq0cXNPSsEHNtq9FZ7FeO kRkaQ2E3AX/vcLHnfifettNOh7ZcGtY6STccey32ap+h9MSLdzIBWyiPbbSLal8c36XD67Bl8sOZ PTOfheG3RUFs9Agv1SPxL9RokmwgVAfwcY3VeBYUFgLz/rmyX+Z7TDc1JvAvv6meGPVm3dviuich TqLSHSrOpKf1tR75rp2VGbLpD4f97WE9rPC+bB3MOak4a/W0qXYwvy6g16R9tGaH14yiLhsmsWzi 0t/YWlK9YB0gsHw+p0GRa1DFW440cXD2tpNUQrbt1+qZgwp8JtIxeZ44/tcnB8x3WcyoNmVdt5+1 fODSYqEsfaFmxbX1ERuUeyVa2DCELGUI+xeJC4ypsgPtLmPtQTuwArQH8bCdOTR4NebyQpyUiK+M cRSZYIbEal9BVTZ0cewcFvFvQqIOhQsSMNpTEGXWMU/P548Sy5upisSWP02M8c4T9jkT2SFg6NQY Pd5075C7yrQehVMj0qwxZ6VxMHm76tFXNvFna7MelPW0NIciqxSP8h/3cTx3+XrxYYZTKL4bqLH5 aub0aeRqGj1uRY4AnCez2hnrEChZ7Bn65Ht+x3G+cG2rtT0hGmskt6+VomlMBnbhn34sxtff+LjP g+/wZ/mOi8od1z+TvsmnfgrFRKwUeRV3sDfrYFK2eyj/XWvafFLvYPuPAU2uS4p3Lu+K5zq9PiRu Z+DVBtfCvVWF+bboZ1XwqaCHNf0zM5s5fKMe/QBevZgP3f9wSk5Wzec7GwmyyTkh3F+4fJNUHcry jXzGe2wgs374cnB+ssLqh7O9fj0h2wunuETjzwFiXnZKvFsT0RnFKxMLdiaeATcI7KC6LL9q4FKI b66TCIgOPS1Yqfi6af1LetujOvXrvGsS1uP41T2C4j+tDn1YMuKWf0CpffbR/JrWCbEtvHHBO8yl w7UGX4y5NmNjPuzDXEVXjV9qDFASP3dGwAXzY1RP0m7VGKlSd3BmtRxK+yubo7LJ5jAQ9BevjV11 8nJw0UXPftUVEurxnscVHi8RFbTfe7zoWHydkcDKQ80JZwTy+Hek9HQ4J5NUdZdfFb94CFZaW4lT Unmw2Xb9QKyfhJKgKP9TzrRDMAn3OMZUXpxh0SQp8XLswvMbD4Vf7Lt28Eyle3slgNFIrRepqb6y rqGwy3ucmgnP3ZSQvhW7njooy0efzpfbfPvjXOzQiZ4M8yxkx53vKjqHeY0NrOcUXQntdhdM061F MvfYdXOu3ILezzPi3M3RfCst3MbxPvSlikdjtpZjSNXxCRvZsMkt/yZ6WR+uFqwDBZbvsa5f+WXr lSn+KLGvc0EAd4S67EbZRk6BlTzF1V6PIl3Nu/4RTKqoitkqggPV7tXPdYwHUEPTQ2fsz32b4Txz ZsfmkM4QDk5DKZ+lrMHssjf4L5yLtb0F5Q4ocHNG/EfdsseGLhG2iZ5COfM7Vqj7/5PhZ66gtpsb Mng9RI/O6c+dvuqxdXzt9HM/yhPMGv6yqKd3ic/j99W9c4495jgkk9Y99p6yTXcgp5w//WmMa9jZ RuM7HNZ3oD2qtXecjC9yh/hcMSG1yzvJ53TEBL7QwahLSK7+MKY2HF7lQNRXjDavhgkrhy6r6fG4 GT+JzObe2+dUZao4EDlcpCydl6yTrVUlmtAf2fa1JEGTXBxqupFhuY2zdDi1JFUm9WXWmk3vjkXq h7i4nXC5uJfmRdlefGBUeNLX7cUcb2tI8tT0HMd9aVc3NmJjk8tByF+IzSQVYuZyrBf7siRPY4SM icuP57eTPybjBMf4Rfg8bQS+8EOqR5fveJRiKrpBYsA5Wk8kqV/9jmWgl4qn+DqFgIMfW4PcQtuK x8TCzMZJPrxPVpSrnA2JuFG1Vjr8/AY7TV38PDVt/3npf6L2bNTvR8VH4HmVeGf3oRyze6/PYcoA xDmiOtna/BD9XMVLaurlDTvCP5L7bltF4T+wOSa7vOtvXmrEofWCDCRw8yYKJ7LxwNZJq/Fxoadz lziQJxlvJRNPG2ev5lo/XZwSaBb36pJsmIF5P/3jY4VNh/pWlMcMN9EZPJTVu1d4B032F+ipNdsV jNhL6sap6226tIyqhgvnNWgep05ny57SEFmr0fzd7Ur8Y8serj1uLmIn7QM6p8OODv/IrzAsGyg/ +2BirGTd/VX/fBGLJ5FQmZr2LRPcmctVFd+1Ts56Kq+jHhOn7c32bF7jJ/1aqkJr78tT2AaB04nx Bw8Bm9ven+gwqbpXW3mrXMRkkpbha62rKmn2wccUf37MJ/7oczEBF1S1tEYjcAe/k3Jokihx7a2g wPvk1jGvDr9bgivIE8ml3P9E+3trYAWHdGLEtkntIsulVQXtS7Fdj3LENpaUDsf6+d2FVwelUHUP vx/eQHq3N46N/NnkS9DfRH5chR14sFHM6CJ22do3yx3Y7MwmyYEwfxPbj9wUNIIWfVLE1ZIIGS61 47O9G23ctk8s4+TttKzvWNZoquA8IZJekTxmvZ9bInTf28TTFGGLT9ZvUjX5hNeteN+gJG6E6hJ9 1bFmLb234cAzCUZ5hk7Tqk7TQ+Iq12iE+0CRTjp0blReivcWvVXoy7nJ21VvTdqFSzggfjYnYZMd wfBf/HBHHDalKEN8vcNitzZuOiioNHzusZ+E3lRfinmt29PIZW8cNdfcGB8y9jkpPv1VWWNcZD4r vV+FIXB+4+5IrK6GeHw51XmQV+9uBne2/LsnUbs2JvgmRN7Yenp7xY69m5vdkoL2VtebpY5rZveP Q66Z0NOb/S+nt1Ji8hotPi6/1PA1QVva+g5JJ/7Z8nap7tC60W8qOsE3SwfHCXaU8KGmqiOtDqnx T6RpUT3wKvkVR6O141+sLhCXyJ7drvLs8oCcaX7rE27Bgg3EkETBybtnLcpWNx259ZzHpDjQU0a8 qljCclj93F6nrjYJ8qVDKbm1T2p8d7rxIl7komMEaXFHn9g3+l7kosZXQW8JfIq55SlrhH1Lxk7e iQg5+oScGJ0Sk3sWbjWXs04eNKje8eB4VHbbUxOjfakq61RNywuAEkHJiT3J7d9vzv3gXTty8C4b lbBNHPF/8UkgTSclBuKLnjn+WscwPOPzj7JusfIp6hbv0/GBBuCaznRrybzLJdu/pSmb+Q9Qrc8n TynnTd3YgH5+udmUlCpWItBtPDKuqSfdm5Ljnn8Mn1Vffh5/a1iNIr36nhfmYkJPfVv8iFxX/oPL VtuFQqR0LEtTtvEQv1e2EPyGm3z976gWWcbKvyiRbk8P7hRLU1A+p5Ly+XzAp+nJ7q7wpEJSmv7R EXun4vOSk0+zKnfszWqqDvTRRHRPfJwQn0l1i1ELueX3aPzqyJ1Q2Riu0eHHhIuJVV6+A6+crZL7 gmx2eTk4K28L43QkrbhQHf9Zb6Dc7cOU3A53l3g28mOXNuL/Im20TrUIMIZEjKZCUa6F9erd/Qdk 4zqS+qb6eHROqGjoiXSNW0ZG5oTbNYtc5bnlB7/SrMF5Yyle86rDkyqbo2GD2/2K9fKadFtGI2zP cTvgHsYksEPsu2EqwJt1SAuMN490VHWtzevaM1I9arR86t0c7S7PSqKI4ivu0AGrLVa6oq/H8l7u o+XAQldQ3OoiCWSZO12VDQRaZSLZdlUEV60+o/fRrQPLrinq9rE5NNsE8m/eY7tNFO7F9/iUSJ3S cE7p+zcvDrjkMDY7128wVFUx35ujuLPI81VvbC+P5PThpoCKxxyz7tZmo9G+zuKdwocT3L8wYnFW mrWk+q/dxzYprtZrxnaoiRKObHzQiftxymwUF38V11Wz0hAlbqRcUn3Nu6ho5FtsxZuq9s5DBa+G sSipANlBK1C0vflJs94M3rN8uE1sm4dIY9G2ctc07JNI3ckjlO7Pkq3laZlJ7vqX3LdIp46YzfGm nrhetiJ+n4bFxfTWp6f6YEZnu1yBGSmLzbdJZEltlFWxRRt60MmLPWt7e+PNGsbkAI/NoY4eFDpT bjQ6w8jPgwaAANrKY7GPQRAUa7Uxme5F8w9mUGkAtFjadQz1ZLB2Z9KAAbSNRxCZzdYL6w0Xiq7r IRADAeuxOBiA8EQsAGFgmFlwZU6x9mDQ/FmVWS0QhFj12f/0XFFoJkPMgjEdgHAL1VwTiheVVU7+ z0l/olBoY38fHzKNTGFWf10AGAOg6cEeXmTWb+HdZBoVQFMpZADNCKMCaIYfjUwG0D7UUBqAYAE0 3T8cQHAAmuzv68dgJd+OAJoEEAkotCeA9gIgEALQZAACEQDtD0AgAUAHAuggAE0B0FQAgmAAHQKg aQAE4QA0A0CHAq4ofX0Ueou/N8OPDkDwH3VkCMtWZb8JnfX8P0iYZey+dADG/JWsDehezBI5kRm/ mRSYD+sxMI55ByDYfOHIIArt/LMLoC0YHoH+XgYU30Ay89GRQQ7azOxYe4SzTgRAMBbz+3HgXwUV HAj+XwDqf7sWhggAFoQALA4ECDABwME4FBEBATwBBDB4BICJIAsQcGGcOR/GQQstjGfO//8B6mef OZcJzD1+AgJDAAQyGSFgARwBB+CIBACPBwEcjAEQPALgmYBgAAwRQWGICIBDcACC4AECDgbwWAKA J+ABHAgvtMxxGAFwEATgYQxrTyKBCOAICzhmyzoMjEcxWxYD4MLBcBDMWosg4OIeCAAjmIU+jAUw eAILEDyR1RLxWBYeB2FQC3MQAAtBAIKBAJiIYY0hRAxAgAislgUY5JcgmC1L2EzaTAEtKALFpIlA hAWhIL8By35YVJgPIH5Rf8yj/aZHJiALgEIWdfZrq4UOBlrcAgOzlrG4gqBfZvCnCpnSQn7fAYuH mMdesAUc9G9WmUiWMYHQglx/7gKxZI1ijS1uQMQRfwHTEBZsYCmwZE0ksGziN2DZw+/AspVFm/gT mHyx+jDmX8CyCxBB4eBFG2ADRAJmwS4g5F/w0yZ+AvNMOBiLYrV/AEvXC+P/AoS4oFVm+5/K6u/p niMALd4cIgGsCp8DgPYEoMVrN14AZuHGDZoMsOohDj9dMusTvwNqwWNjFu8i+QOYxdAUCLC+gjow fTJm8a4RBcAskqICmEVSzAjA+tzigEKHAPAiMRoALxJjxgF48ULPQvSAF2kxAHiR1kLsgBcvODHD CbxIMRSAFymy4g1M+MPr//5zzRQCIOSP8d+DggH0e5D7dcsKbWTAdMReHgDEXIg2wPyP06Bf034j 8Vuq8B8kjh0Szw6JWRK2Fm6PoTf5ezOjLrQgR9aNqlAKY4HJn6f//TOXEY3swQxz66w9GMGBVEag vyewC9YiamE1AT8GI5iujUYH/RrSotJ81VDM22PeoV7kf68K9vYBPD28dpIp3os7qKEWtvenUoyZ wlhnrI0BMQgIY3AQASTCiAaIUQVBVbXfmAunkX1QIIAFUeCvPwCHIDAC+AC/cExTZo1QfuKIBKYW /8DhmLb7Jw6Bl+CYoWAJDs9mHhH7Jw4EcUvogjB2yVqIsJQXEAMSls4DwT9xBBhcwh8BJC6hi8fh lqwlwsiSeRABu4QXDLPE+ScOJiw5LwZHxC/BEZfKBYZB4hIcfqmsYCK8hGcsiF8yDwstPS8WgZbw gmWjSwSEl9gLAhGXyABBlsoZwcNLdImDltLFYcClOOxSGeAI0BIaeAheioPxS/YjEn6XC4Pm4R9I pi14c//dZIB5C8KBSmW+7CzfZ0HxoQIw8advozM8aAzW6wWBIIxBKSub2Jqi/h9QSwcIMYlo0mod AACgKgAAUEsDBBQACAAIADqReloAAAAAAAAAAAAAAAAYACAAcGxvdHMvdGVzdF8xMF9wZXAtYXAu cGRmdXgLAAEEqzMKAAQBlgQAVVQNAAfgNORnIAPlZyAD5Wetegk8VO/3f2UflGRXuiVkycydO3eW LNmX7FspUWOMLWaYGUVpsWQnS6EIoUVaKUuWbEVJJGsIUdqEyvJJ+L9mqG+fzO//7fV7/bxex/Pc 82znvJ9zzzl3nkfOUs9gG6iKQchd7wXy7yNAAAVQnT0R6uoA0jbAhwwgdYkMohfVDUBaEt3IdAAN oABrQFMTQaa4MDvifxtgQKUwAIjVAWlv4exJJjEA3OKjvj/D0IZBZJABzCLDkshgkGkUAGY+IpA2 7kQXD4obgF1qpVFJNmQG4AAgLfUMAKQt2Z8BII29iW5knaVSd6k0Bhx/EwdcrgBTbuZ/GpnCWBIf aU2mU/1oJDIdwC+ub0Z28SDqUP0BBwAFoAAcDKqiIBANAyAOp4oDUTDgCCB1qRQGmcKgA4TFWbQp FCqDDoCoPzAh/CaDKZnixnAHwKWFDTy8GGQagDTwIjLIemQS1YXMHEhn0MhEb4R/+g37RkqfgUDf V+WSu+KXjZ8d3TNNrFKrF3+X3XD5WZO3QOOppMvzczqJck1GdLuVUbs7BteOuIfV1lfMv5kZS6kf Cu+R/vHPyptXrtRTgRnOYAWXQJ1HOJFy/ep1KDRWKF1I2io8prk7KVRLu2sQ8pkfF69yK5k3Hv8m KEldGSw3+oo3oy3/4LG9uneqMiDTVUkfL8SOuXbNrnqJ9NHxINvUFR8qFQuKb7htvGnYxDzV+l1K qLRQYMhuIZdyZ5FvkcH8Nde0OfZadJQlz3ZVNa28eWIdJia8ua9jvWb1Rv/qlJm1aw6Pf1z5+WLS ytfrz7mQvnV/J5Rs1rqe4y4bLUH9Ic/lmqcVGx+rmhv4gu6jH3TNEg0qOrj1yXMdz6vyAcQDB/Zp r76paJRgb9M2fL3nMmAnoqf7igeJ3R0fpIyIKR4OjqzU4CwzDnpnHeznjde/Ip8UH6IsfJ385VVY i0F2t3z1Njn8i0c2BQYQH6Fkc3XklYH008JyH7B8vorV0ZYFXtddhGk+ZjrWUR1ldZFJXolZ1glC Q0c7noiYdu3VGU9I5OvJtvSuZMg8194q0fN9rW7Rwlh5ZvjQx+mhxqG1+ytxJ2QeqD5wM41+nBCx M60/VWelXUhUf390WLDEjmOrZaf7A2bOGN+fGRFeYwHs9LJx+Ujy8Scr5tVF5rf6lg512EZZRW2W TyE452/XP3Xd/cdFnTflLRefDOtceQIhvGGne56w1c4+5+dJh5XyJ3xL9GpFMJHUhVVOgR5x+g0D 2fZHMhtIBbnY152y83FI9/ubm4a9D4jnnC/Cnih5mHdd16Gje3UpBbEO/CEzuSdd3XYg2/lsr9yr k3oyBXuNnV4Lbj0qbOebt2X3eLbX2WG5Vye373ApSiyvk265muvcVS8ZECl+Lx/YPc4d83xTGauD r6+72c4vwkiEPXO4vfm9WqcaQXtSfrhjdbTwrsQUfw7s/Q/E3ePc6T6Tt3scxuwTR4RuvM/W6P9H pdrFIf1Kavi1i10/JCuctxadMLgl8YVja7doOT5Yssx562qiwS2JKFLqc+Ww18DOI02WDBHoyMOW k1/RvbclK5zdq/Qf4N9nOIEiFfrGtySlxuXbdLNc3auO3gjXaoovloSmhKlARF54lUZl9mvHHdl+ heaEGju362/eca5xuHLn87O+2K9nGS/a81Jtw760TjcoWsc8ue9n+0TD7KFbeNIdJb+QFzIWuo8/ qI1tyLh8pKPoVpl67MOb0k+m/KWUiP1t1PFv0wQL0jkvx9EJjCutRzBQrZJi+mWu/Hb9i9SFssxV U/5SO2s/RyeKft5g/sizYDK7gWChe7E70OoZV5VtSJHTmRTvi1seJUVn7wCSD5UqhXhE59PTNKMv a1z7ouoSnoLOmArsUckqKtkuzlMY8XLI84P//d4yt1uPKFctKsv2xV6wTjk27TXbpT/6ACKF31t4 ZtrX+VYtZ2Sf4IXuKTW6qsSXotGFCkxpytGZNbff38Qw3dKSg/npJdFLHgoEQdQvJmqJ6QA4/uLh lrsyCI3/734MTlS76QLy6tFvvfbKkvuK+1hqkcN3ZCozzmc6+poA1pbYGmwmjwSzz9PeGO6yt1Sb Obzn89uK8ui2Ghvj/hLs+6bC6yExNa0Ntk81Z1RuVJreaBBibGwNdXvs4iIrWfdPdnNao7xNXKbW y4l0TaWw8Ow7vge9Zu0mVEzqLxlcEq0UpFZ/EDqfKt0cJeLVeS+vdEeJYSPqjpmepf6nEIveEbEO Wj3p6P7AZNd9l4/4w7TznXYy9P03lQvu8L1tO/TK5JDs5oiNLxOS0h3MLggzHp0vNnlrH1U+8vn5 cNH7eU9h0XJhvrkDsy5KVj3+3FI8h3U/mhpwjYZcqHoUyXW5+PBDjYpO05ryW9uV9beMa/idfl3I GdkpyZs2Hq+ZTk85oPL28Vh9stSHI8WPv4VsNMS1phU8ghULD+68uueG6s6o/smjHf2TIztith6X ZbNz+OUbgkP99/2AIIwtyrIFtkZZoiCMFQpXYGsEDrfCqwpppQecCQeSz0We01mdcidPUbhRa1N4 Y0ObgLmuCyNWSCBiXuAmZoX1QZEqNtKwiXRozF+Io59gQuEABXSnNbmQQlXfX24/Hb05+vFcMRds fH8zGP9YwWzvgWzONWBdhj1hQrZ2Oli1Nv/CnuqUas8ajcH7vmGNYW41RVWHq546NLdcGG3LV7Cd nDN4oqZfxFA6q+F2N40/PT7iuGxB6ttTdgfcdxbnDgh0XD4pki/1UUZhK8eRU6Xje97EuKX4b3fS vTagj9F9Fxq2WUXaSegiyljP3L73SFh+0dezvBDnmtuPha0qAKS71Y3DChc+cZnHn6aipaBN3K5f prwuZlQ7baepZ1eHjm5prxJ8Fd7zvbKnDv6g/OPU7hMLh/d9l2qemOUxmXfkXg4cGsUGODTmvwO3 zarMmwsU+KjBJe5/UvOMSvMQYJTwqZ+71VH/ZbxiYpwQ7+ZxK558IcWZVrhN+EStUe2Ys5QE33du SNvOR+3zF8RtzoxVYoPPqsu8RlD0lVDWFS3l3kvnxnNahEoytaXvERPf8Qk+k27v81S9KmOS25R8 1ykTPYJwibnR1zlK33h3VHad+SUNGDrGsaFl3aprA+uSHk5YBfFcESnmGUO/RPXxwVdFCyangjwZ kXs5LGJ4/V/ix93OwxNTBnji8N1R1ZDDAepzsw2fjIUvUs8cOPk+4ubCXEbZ8Y7pHeabbNeyAQpk Z2Ho/w6URrw2RQ/k1Z1OrxGXUORe1xBgbVeY+uqEg9z+0ScWNTWpj+u05J0EhhnD62eyN3yDJ75a btc0uLHjyYrOFdFZ6zWFh6uwpw3g8lPveR27xdp59OrT40OFi/LkXyaQiHLWnJJdhxqkN6qtQ9SL x6+/BXW4l4tlv87YcOcm5euwXFHIau7MGRlgrs3la0SzJhjZoLOtQfpb8PmuRztdOPeVL/Cezu9x bpd742vqDrd9zFDP+nhYT3RepmTUW8mwZKjeVk/kokoEB0JHqjgpq1Toq5dIjZ9fWqeuzOna0zbN F4LN+9KnJZ8quC0oHP/k3f9gPnzvZjbQodn4bjz0F9BZl92QWLQx3gMfxgJUeVvL53q0vjgqCRfp WWW2VBmIHLcatDJa9+OttVjbqh0mibV6gtcQ3Xx9p9zuYHNFYkK7SksqTmyuBrYHCyfVmqnn26Fb sonvlIj+yWHwnaZ5WNGHP4P8OWuLyjNe7Cvh2k9Zsi9DHwd4dyeD1wZJPw6+2XMiZVwrf7wwlU+D 63y1fZZXqlyG36rkIBqeMBDldlbWyEetZt1dvfXPJBCKq8HM934Vj9zed9fuLZa9/ixt6L7hwws5 L/0bBT6Ka5Bq399Cqq2/8tYtXZp+5P0eCcy6Sj6/cBPtN9ckh32wyvOvn96SbB8QuyrYj3hxbiZI 1+KZ/lbk1GtV0vb1tqWDfttn278j53cpm/t+bjbnuac9ZUZ+7WB4K+yST6GTWeGGgTuSQaYvbihr mMJG200/z2GmVo7O0hibj+Bx9TE5zsfteJou253afWtE9SJdZ+y1yOAxHemJvvfrPXdTOsy3Z1f0 pR9S47HePfnxytHZr2ugd9nebPYRYvMKwH/hZM0STDzJoIDeyF5974EgubOaTqfT4qub5q9oV3Ie YSAav59tXcdvN3NVtsSqaMJCf/f+f2R7fdvpduiJiM/zFiD/6VQpe+7CVcpE29tShiqrPnHlcxVV n08xVB9SeslNCrHL4o4L5Srv2PB48hJBoUYwVkviDt8uQMTQPTKsvizqTaW686uxxvMNwbsGkvDZ jECRa1Hree76uFw9fOdsy72sjHdhrjmdLqMTvG/Dem9fr16L2zj4taka9rui1gfGSvC/RPZr3JRS 6B18lDZU/XFnbVrq+cp++VrZoffHrGoO65QNzsadPURvqy+u6m2my8+UDcv2f5nkb/qxL50NhJjl EBL+4k3Qj9VeXQXwco6VO2dmZQELHudlvi10GpjURvJxlClFBb/d+i6nqsvXTli6Rd7etru6gpjh 2FqUJJP4bMTDCtLArDmWoobOkwo3U0qYbkZlVHn26Dd/Lt9PmpVVZyMkzCa0/83rGl0tWAUIcCyc q5HlHJZ32Wg7cXLugZ1UZIrFVOnsyc28+tKhac5YvtcXh4wOGc8qPEwusZrb+dThsbGc9I1y/nvb AnbI9Yg9ZiMQlp3vJfxNdFejcIICukczgw1bFugZfMEiabPFQZjC7qhQl7Q1rleCWgR07GpDxh/W nzogP6NBWaUcZFh7bq2eD3mfwplB84irFclP8zsfN/jB62TP8KW72uTdLsmJYdj54dqBcvMpQ7sv owUJ9HD+cwJQ2npxe4y1l2SOs1/X94yWdF7/7aYbOn2VJST3bZCiKU96teG6P+Xgqu9/Okbkjfm6 qeWmXEvJV9t/NsV/8UMHrBUaDD/Zk3wyOuWAH98jM9pCdM9w848hFc5bsnW3D0VwXt7mG37Qq6DG MSuwOCvDAvmyGLrk/ax8YHZ210q34Bc/gMG+Bb/jz6Y3yii6fmeDIJv0GcT+RfTSj1ejcGjx6h01 Bw0HoNs+GbGbxZ/N9bh3+u7LmuYUjsgDREiWW3j2RCGTctZGZR6MuoLaIbCf6sBRoO2QhWuoEvMM 8bssWCT7+uG2V/SmF1VKJTwSkduwfEpE74gv4n7PckedMk5saZ57sSDROCGymyfcZ7+RtL/qcN+Y YwMm9OMxdAGyePxWrecW0bwrAg7oH581JC3XjdkWqQ/Pim9EbJ9ioyqbxBQC/yKjga1M4jZo8/Z0 KgYGJcxIIJ69yNka/XSueO23tLPbEPse5Spwvp+xNnR53Tp+w9AuKygzxWig30rh5cXnW3WUffib QdF9IQGAdDJ6fD1u9YTJ3ZPWqf+MxHNXcF2uNkLxzwcolmxxDxUdvHB7tzJShXf65ESNvlgmKbkR c/Bou/DNuJEYrd7umO86zQoEBzGl+F2WB4cv3Heqbw8r9eYkuYwTXhXErC1pPYBLDBrh3GBVcOcO 7Tm9LUySf5Arll/MqpDvBhFxurdqW+nM+q/HlbeLBu0aUq7v6n2UdXztzL43hBPNEukxJ+LCVb4i SnBXEf2978RfCYadbBPHhRGr6xh67c9ynxEM5UaENzUMcyeUnbm0DSrrIX5Ry8Ht0n+xy298zk1S 9AVo7vp2Eqs0dMi2c84ts3u0+cR+yaMubLaAXTYOgn/hQSxLYzlQSwF/bkp99epOlwVsVnqusKBV YHp2akSVrsDaUw2RVwTS+PbHdbbYx9oqqHMUiN48BW3ZUITdIv90l8W2oTB3sS2CwnzdqxJOQbbY jlCDTaIM44eSYq/GbvTef7am79i9k1eKDjQXAWjl+Gqh8tI7W2uy2lzGqWeh+TIx6cqwbdRhGV76 TMbGXQ8+zYe9udCZZJQM76/7Lq8Ww6OnbTYv64hvtrxhkGgmdPaoZfuqtbuRx7lH7dtXNlQm+Jvb PAG/FXMrz1WsfKNg07UcG4hNwv03uZBZTKlgFUqA46hZ9dpve+5M8wWLTM17A1wBSjJaMrWrBNZy 55SSXgQ5GrU9F4y+Wxy6RwiLUqyvnm8Z96T6JfrNWuX9M7vqypX9u3xbfVeu0pFyZSMauxQX+otv bDMrY0odSqBsVvRH1YoOHYcAiyjn1ecW9vMreTxPcjfarHiEC9R+/YYecm7g/EwBcc/4hpled0oX WoIvP7j7EaE34ljVe/uwVJs36xPaxz5Q9qoPnSvkS+wOdTx8tVavbqVZHXhUoaLOTu8ml6/rHX3b 5k12m861hHr1qaGVxCTFP44pjvgXWxM0ZUOMSiH82je3FTW4nfS6glK4Avvtig1kh4JGsuWk02LV UlSLhSMHgpqmciNVyDl+BlqMnXtXXRuJz41fH/8qWcLkfWqQpq+D0wWHm4E0EmVfzonPaybdnPrm eRp9Y6dn5lc+kXZ0YgMbm/QWhP8CNv14kPllwPKttyW5awPW6zv86H0Q+ykWKzjGJ8TrbC7wjQ9U OMOx/0WcgfAOsSH7EA2h6AGlup1eJHln0a2bPU9+avR28mvKGRM5bDhu68rTxV8of9U34H7xBmn/ 6zssVdRxC9SE49elnwcf1dIcQEQE4Hi28MwdQ9ik9JTMo/MB2D6gNNbM6BQ97+4ravztHfv9P5H7 H5gG4z6yUZNN9gf9zUsNWzfeWA8KlJUhsEJaJ/ZMmo6Pr+6ev7US7kp6Jxl1WS9FnHPbTE6cl2H4 4C2Zw9pGA/RPHZtNTvXzF4aOPKQzuCniR/hdvCcHMjUUGywzR60k1cOVNExuraAqYv15tBvGqTMp MpeUhTYoN3x3uhPRsbOT86iTg8hFK8/WmcNnRn5k3NXJHyq8+nRiLHfrk3XPv4lE2NoizqpYPZ7g OsuhIPu+cXLOWW4rNVWUFpji3CDhLv1a6q5q4KtLmBqBy1ERJ08Bu5o+XGjRL66vKKosFNKfpCW5 makrSBp+dDXAXR9zjTjTKyLggCiVVq4F6nAHKacmCWL33gkKfIhtHCO1uFcK8pMnYq9xPQ/xcFHG CL5RCxXZK3WIvDGh2PtYnMU2hA2mNvfaSJi7+yNI3DuOqh7zYWSH7fvAcDb4s0kdwb+wMgh71xJ1 slZE9yZmxYa3HNZsZmaT74Hov0mvTpcJ6oJLPimgIDdgPadi+lyPlrnTvokVq3had1a3rKg12Gw/ IZR4N3bM7DiXmN+xd1GXKWuMv5i9jVfhXbOV/0PNFlFdRJvwYIvEBnpPzYmXYozCJLWH61oNTonK 36PhnwDZaolg3udNUjyV9MbV3/ImHxS/029ek7sS5GOjCZtEEYL+4gsFtjaJkwN5e0ZEKrVMTgpu GcnrcBfTmO6PM6pw6g5a8dZGReL++Bs914uiM1NyyuNCC8mJA/IMgetaR4Iw6sqiEYVU+2EejUdJ XCmb3ncFH9KKdIsMur/n8r67+wN3NThFeweWVhvGj6ukDIyDjmfB7rKBVzN7KKFptcafOG7VTEVu lzars1WLeMnRLNXuV/X5H3k1n7Jrw+N4S4r/m4fFpxut4yO6pGnBndC6TfxnQrZH9IlnioqlzO2T f3l7aKNBRmMXl2DmDoJvlODko6vG+eIPT1f2cuvneDmvFy3OEds5opQXaNfWJEa+dSrufEVXudtB Jx6YRM5OxUuL2riGvdUkkbNrB73f4XllzxfGSaxxyx27WBfge6aLHBUSF3r+KtRotNEsdli7dP/T 9OCUpm593WPx8lsVDAozgVxByYmjsc3fy+Z/8GwYPfmIzZawyTzRGNxf/MCUoBYXCvKGzKa/VtPx T/r6I79dpHCautvlcoSXNkqiNdFMMu127r5/EuQMPYaoZtdjp+XSpu/vQPbebjCwjRfJFWjXGx1X 0ZDuiTt3ICMVl1xdeB1XOaJIkRavJ6FvRnZWN0WMbmzLeHrbdN9qXym1ndfi9nITvhc9xruPPHTz qFPI3hm2qS9XujnRp1UkYbNcnnzc1+ueX2Ym29v8o7NsEzTPjFrZ5VyXnOxOLtofmPyw1MtVBVa/ 8GlCdDbeKVTRt9L9xXjBaJ2fTCjn55EO/M2oYpLb0KC9aWy/t/khkrW93N7Dq2xs+W+URnzVGCp0 +ji9cf8Bhwg2+LFJZ0HcX2TuZvHGnnqgkO60H8Ixq1qpfeCETHhLdP90P7faBXllDaG28Z1BQef8 LRuECrgr3aFBlXKsC4ZCWlAYmZTfFQJpPxiQrd6kQrdg1EJWKx941qP1vVpEvuvEAzzJp1RREUZB NgqOFWltR0dLP+tyTL+fpz3iXksQkh3k8hsy3W2qLvx6LO3VMdo5aPUdBJeSUCR5fV1bUQ2eVhRF tlgXwFmhyeh5UXlixT1Z9X42SrNNIP/mPbY0oXAtvceXhKq2jJy79uFt3wmHc4xd9tU7dBTkjQLP yR7Mdh7sCevhlpyJeeh5t2Pl3AEzw88hbvairWtiIg98Y4RhTVUqbKun2lNNZMU1GjAtisL401pP W7E/Lhl+xkYUYNvK1+ogRHXlckvvuWRnj/4TdvdtcXPrqczBEQxCylNm2BQl3NzQ1aAxi3MuHGkS 2UsUqs3eW+iYgOkKUp88TWn/KtlYmHA2+oDmrQO7peNHDed54i+U5PNHHFM2vpnY2H2pH2K0Nm/M NLRNZvNLN7zsXJl12o3UIdLJSzUzKyu9Xcp6ZE/iLj8bIoXOxI1GZ+i6E2kACkCaEpfqaBhGsEbr kekkmocPg0oDwKVjcRs/ZwZrduYaEIA0J3qT2Uy9OF5n8cB6G4hCg8A2DBYCQBwBA4BoCGIeVzO7 mBEZNA/WqbYqCgWyzrb/U3NEIJkCMQ/b6QCIXTwJ16eQqKyj+P9o+pOFQOp5uLqSaWQK8+TcAYDQ AJLuQySRAQweQB4h06gAkkohA0jGYSqAZLjTyGQA6Ur1owFIV49DZABJ9/AHYCyAJHu4uTMAJMWD QgbwEAJpAyBtAQIeQDoDSBIAokAASQaYh+5IDwBEEQCkN4CkAEgqAIIQgPQFkDQABLEAkgEg/QBH hKYmArnbw4XhTgdA6I+zeBDDduN+g571/D/gzDJ5NzoAof8KcW06iXnJgMCM4swVmA/b0BCWeYvC x2hRaxQCaf+zCiCNGUQvD5I2xc2LzHy0YZC9dzErZkR/lkYACGHQv6sD/Tqkw6JQ/xeE+N+OhUA8 gEGBAAaLAvAQHsBCWAQBRgE4PApA42AAIqBYBKMW25n9ISy4WEI4Zv//HyF+1pl9mcSc4yfBEAiA KKYgeAyAxWMBLAEP4HAoAAuhARgHAzgmwWgATYARaAIMYGEsAMM4AI+FABwGD+DwOACLghZLZjsE A1gQBHAQmjUnAU8AsPhFHrNkKQPhEMySJQBqUTEsCLHGwjBqaQ4YgGD0Yh3CAGgcnkUwjsAqCTgM i48F0YjFPjCAAUEARoMARECz2mACGsCDeFbJIjT8CwhmyQKbuTYToMWNQDDXhEH8Iijwb8SyH9Yq zAcUbmn/mKr9to9MghcJAS/t2a+pFitocGkKNMQaxpIKBH+ZwZ9byEQL/n0GDA5kqr1oC1jw36Iy mSxjQoGLuP6cBWRhjWC1LU1AwBJ+EdMQFm1gObGwJuBZNvEbsezhd2LZypJN/ElMuVh1CP0vYtkF CkZgoSUbYEMEPHrRLkD4X/TTJn4SUycshEGwyj+ItdeL7f8imLC4q8zyP6f1v+fhNgC4dPfKFmCd Glsz3Su4dHWJBKAXby0hyQDrjM36p1dmHRtZIxY9NnrpNhfLiaOXYpQHwPqp2prpltFLF7YoAHpp NZZTRy9dq6IC6KUFmXEBWlrSF4CWlqQB0NLFKGZogJZWW4wprC8vawSSAUBLyy1GFGhpSWaQgZYW 9QOgJRVZUQgi/BEFfv+INgABEP6j/fcgoQ3+Hvp+3VtD6mozHTOJCIDMgUht9P/YDfzV7bclfksg /sPEsmPi2DHRy8LY4n08pImHCzMWg4uIsm6p+VEYi0L+1O73H790aWQiM+xtNSMyfLyoDC8PZ+AQ pEpQxagA7gyGD307Eun9q0mVSnNTRDDv47n4kcj/HuXj4go4E0kHyRSXpRkUEYvTe1Apekwwtupt R6PQMApCY0E8igCjlVFoBRRKQfE34fxpZFcECsCACNSvPwALwxAMuAK/eEzTZrVQlnggCoShP3go AgEmLOcRwGVjUQTU8vnA5f1Apnn+ez4UCgsv40GYP8eiQBiDW9YPjcIv74f+UzcUHst81/7gYcBl 8+EIuGVjCVjcsn4gjF3OI2CXyYIGwT9xQaEx6GU4o3HoZf0gFLQMFwizDHsUhAeX6QYRcMv2DQMu xwCDwSzTF4PFL1sDRi3XDWaGyD95MGoZLjAz9P7Bw6Iwy+TDYqBluGDh5VhhcehluOBA9LI1cBjM ch6W8Od8zMzzNx6DRvTwItMWPb7HETKAAQGkNZXKdAAsf2hMcaUCmF83VOkMIo3BeuVAFIRDIeTk 9C0MEP8PUEsHCOj5XjCdHgAABiwAAFBLAwQUAAgACAA7kXpaAAAAAAAAAAAAAAAAGAAgAHBsb3Rz L3Rlc3RfMTJfcGVwLWFwLnBkZnV4CwABBKszCgAEAZYEAFVUDQAH4jTkZyoD5WcqA+VnrXoJOJTt 13jZTUSWsqU7QpbMs8wzS5bsO1lLiQzGFjPMjDftZYtKKaUUEm3SSlmKslVK4RVtFFKp7JV4E/7X DPXzNvP9f13f9bmu476fcy9nfc655zm3hrOF1TJYn4DTuNgG8m/iYAABhl8oztAQ4N03RdAA3pzK poYxggDemRpEYwEEQMAVGBvjaPQAzkTyjAVWDDoboNwJeM+VfqE0fzYgTT1aRrOt3dhUNg0QphDO VDabxqQDjPOIw7sFUwNC6EGAOD3KZPi70djAC+CdLawA3p0WzQZ423BqEM1sujWfbm2B9wx2YF4B OHxz/jNpdPY0+3hXGosRxfSnsQB5ir4jLSCEasaIBl4AAhAgYbA+hMIIBmASSZ8EQxjwBnhzBp1N o7NZgDK1iymdzmCzAAz9phPKDB4caPQgdjCApwlbhYSxaUyAtwqjsmkWNH9GAI2zkMVm0qjhuOiM S6sdGW+JEuU9qwePqVSlNC+ICvs+DxT3SjSaXzsaGHROuUa7oDV8YvtigyGbonvQp8famifzgj66 HGCN13W246V2SxWTBr/UrzuZpXpbMcG6OkIoxhpECyd4+ZKVBGLqLRps0u4KVroN1cB+AZ8HA85v Ha071vD+u1ZCFwmUYJrLD08kKzjHjK57sqZZ55t7DVnm+6nno/R5W7xMEoT3V6QTdcrev2PWXJXd F6YdfC1QUW5fdc77e1DZ8QXVJhGWFRVP1XZXPCgoiJnzIaahY3d9W+/jYYZEmu9kaXvmuNYX0XW1 GlvjxjP/iWL0OzbUiOnqvJDzr8yW0Iek7ZYaI0kWSfkKJSKxb51T3SQ1YtVKakyM1p6rCYuVzFeI owgqi6d+P/YwFR87RyLMl70qNeVL/RW/bJZIveVpBbUjEg87BAS15qXafU6vWC7iwML5FGT4+a52 Xho7R86QcjoYe+sW0bOUcP2D29PUzdc04tVKLEzFKSUKhXJ9y3GScMIx4SMZR2LMFNdlS281GTIO 7rdeY33K1V+7t1bhUuHfgl7s6h3dPb1z8e1SDVKi0ROvxzeNLp+8PLTZTjU9/kuLlUK+s9u6r9+y Xm7Vin/SLS199lHoZF42e6hBo3eR5JxD9nb6wV8j3kHiPeK6bf5594s8C+TdA72aVPz3Gq5RWLh3 wjlna9aHsfD1MkaUChsCq+xhmAbVbtxPCYrutNzWi6+UsbJV+bw+bi/+1alDEo8cdOPiZh8yj8St lxo0MIzte3wIKrHx8Qj7VitVHFGwOrXviErCqdaViHbbeemHl+UHJHSpKsdviDR0Halz77AqQ98I fmqMxaJVr7TlijR0ZV5bBVEK9m+IUPcpNZPMum/QtbQ8GcgT5zTJnjNxyeyTymn7bjZ2V/Xop3ZM tqV/ZUeyxY1JrOzIeSdfAcaSC+ixCuWkT3Kh0boumdVCr20Oa7nkKg893Kj1wSoHdTIqEBsjxJNk jpx5OrgqBzWG7OwFLlm8S5ONVv873Vf9ZZrQ2qSHYlqDVjnowWUv04T6O4WF+hMotxcl9lDuUBIb ujcUehkUjHhvJM3tbDvQcT/0+HZGBTXOds8Fs4II0hPFHuPhwBVHGXlfXxdVOxSeasrLHbPdZn9m JHBRQsayI/e2ZJ98RXJXuiJmdzja8cydBg8lxoHtx9udQ3K0imaXF/yYZRqu46Eb6qjto5W37KLm 8ZfuF+a3pLnKelzSHi5zWrXBLvOJx0fPyclWKy3l7ShdB7u57vU5x0NKCyO2NGS0RbIa9tWXlgc5 Xb55M6jeNpTdNmzkduQmaXL2s4HX45xwMP1i/4xOyHRkoJAIv3DQNM4LeP/CkXgjCIqQ/3v4wA4Z XA6AxSxYV96EZWt8IfWUrswV3/zt5P6Ikb0XJIju1KYYR008nHOc+c56laezwejGNf3vy8v2Nle5 2baXED8+LrwYu6+qqdb9kfGo3qXbDpdqpdmLmuKCHgQEqCvW/JPTcKJO023/SZOXQxnGOgm7c65F bggb8xjSs79/xuqM/G1JRuUn6ePHlBv2yIU9u5FXuqLEug665mjhbNkbu7Kte/5T5n3/Leu3pgWu O7s5GmMef+ahylp/Wbfgmvj75r9e2/+lrpa46OXB1Awvx0wZ9r3jxfbvPfeUdff//bbo40SojHyZ jPi471iAjktrtIiS6EbzHgcr4b7YzIp7ScJnizfeNSp/5lBVdmW5ruWSQaOoA28KhZKeKYqdGEwx zmAd9dV7/2DgfprSp83FD77GLrImNZ0ouIdpF26wO7/mkr7dnvbhLU/bh7tX7Fu6XZ2P4ci8BiFB /90eKEpwh5wbMVfIGUIJLhCpwN0GftuECRQyS339KL5p6UnpZnOPXsvTlqkzWby7rrZZwsk8gJ0s LZE4IXGZMMt1g1wFH274JBiE8AfsWB60pwvCEuYjxsJ46YrvL5cf2Ku298F4sTBme1MNTnmg5bjW N0dICq7J8qQMqVePxOhX52euqTxaGVpl1HkzMqEuIaiqqGJjxSOvhsbMvuZ8LffhcauHBpZFbJ0j RkHXT8zJSEncrl5w7H28h2+wXfHpDomnZ3fK5Sv1qGotFdwcXzq45t2+oKPRy33ML3RYEsw/xCWo 6Sn7SJ+CbC2cPNs2J+QXfTkihgpJXX0g41IO8MEulzZqZfYKO6UcYCBK6GKRwM/fwk5lVfosZxrm VMb1LWmpkHy9u/X77dYa7JPuj/jVOyY3rvuu1DA0Jmo/4S3CqzgE4qM4hPDfFbfM5Va4MCzRYyS8 IHqn8WG9hi5gc7C3XaTJ2/Jlivah/dJiaoMuovnS2qNNWLPMjmqb6gE/JQXx7yKoqUeEQf9n3FWh LIH5nfWVt8K6IdZsNPuciW7bmfTB3EbpkpOmyjeohz6IS9Yrt7wK1T+van/6cdp1n5NINy5g36VX z/pYi673qcs6nTHC0G2CCxtlBS50yKbeHXLZJXpOrlh0AHkJvRLHzssXDH/bFcpOWiu4cp9Y9Evy YNBxbOibFZn69nqffuzGTYbjY7W9tjKnGId9d35MvDw5nnVr+9ORFU6L3efxURTMz8OQ/64ooxRT ugUsZj6SUbVAQVtEtnaTq0fhsdc7vDTW9z1cWVV17EGNiaaPxFv2W5XRnIVfsaEvzsuNrS6teDjr 2ay92SrGMm8riAessLL4j2LeL+a3iFrcz0iJkynK03x50J+q4Sqk+PyvWuVFBrK4+wtSVK6gT4PL 5ue8yVp47TL9y1uNoti5IidHVcF4c8CXxAZjOKnWbFmt8teY48/v2QUIrSubFDuQ3+rXovEu0iEY a+7JMszu2WghP6Fa0heuY13Sdd/dQu6UXqIgzkypODW7VPpLmFxVVNSJZ+aqB6oPuDVkxji9yhhR fKQVNKm1vTe8/c7E7rVqfFSH8IndZPQPVOd665LClI+J+X4a2KQv1lQ23mry2VtHpsjC5WRjhZXc dpdOFxvZH+9d5zcLrLA/VG0heQH3QvxVfNA14mm5fXHPS0vKd6hVguUxMqnVjob5HkhjDvWDDjU6 LQG79ngC046Yk0Xrz16iVy9GfC1T3Zut/jLuwabwF2nwhU7/HxverdlxdNAkf7DwmLiR8PFKz+yw YxpZUQJpu5hkSseeoCPqNhEGVbLXLVTqFXDac+GTH6PK7wV9fFG9tlj9Yv2JrpvWdzNzX0bXSfQs MPKv/ngFb6By7n1QhjJr88c1CgTZ2+JRu+1N311QfBtB1J148+iKYkvH/POS7bgn6aO7zFfWWy7F f3uj779cxb20M2r5WMt3/MQqXafI/gYn0Rum3xxpb7ysrySciSj0cSxc2HFNcZfDk0u6Rg6YzXKH /nHCt9l9Y0y22mYy6f6+XL/tHqKPz3rEr77SrX+KZTbwRq5zm5ny0KuPKqGr6U+dlueUv8r4y0DU dfVwz7ktY1+k0A854XzsiPLakfIHZrRMNp1bAcSEBsr8TmZng8mQ46pfJ59Z2VcniQve0tkT837p h9yK55EeMsqNmp7uLyrLqVneTUWpqofqu0NcUCOC1LajBkie0m5HnYMjDVBWRWirZUN/2Xr/MXVD PkwS+OSlP/G1vZWSFUBCcDK9Sl3orWbAIvehneN3PJSSjq78Vjq2U03MUjnuhB9R/M2pLpu/bMe0 7qaVuIzbPfJ6YKuhfKlszo1lm1ZotM5/wIchjF/goPxJajKgC8ES5ltOxlg3TrKyxGPkTowV7yIU vtgTF3BCKvDcrkYJM4/q2MG79+N9NUeN6AK6u6yr0+dZRNDWaR3udEo8X572KP/Zg9ooTFb9sHhG oFve1ZLcfWyPKFILKHP6Zu3xua/gIGv3nHQJ9ITKAk+Ca5hirl/U8+9ZjRli0csdFj6L1FVQXLdQ iak7HNZMetGbS6q82buNKrbvy+LGyxqNJV/c/1mc8jkK2TRPunP3zta0nXuP+kaJ33NkTu5tfdvw o0tP6Ip6zdW/EoXOLovcvSGsoMo7e2txdtZK/Mti9Ex4fVnH2Niq2UExT36AzleTUdvrRxapagd+ 56NBIp9fj8Q/CL2WKQZ0QRMxiy1OsHUHejUiK1ltQf14a/CzyHXZI0IyiXlAzt95ieiaPfjU3Hl7 Tm7Ycw5aIbGe4SVYYOqVTaqtmB8aG3VWskj9zd1lr1mPn1TolIgqJC0jiutQwxM/L4iqP93nk7Vj ScP4k0mFuiG51aK7I9bbKEfrv3014F1LiOvZhhTgiwevVIcukc87J+GF/Og3UnSWHXAvMnw7tmAR bvk3PqLyOeYiMPwH7utcmiwITYfK8W+Gc+c+C5gkZmeclpF02ZqRcyyxwlxiXnxt0jmJE+Lr9z9r 9Ex21zIULJC/HI8uWVhEXKL5aNXKZV0JwfOXSMqIvxA4GI+6E5/GWS2WZ9veVZz/euBS2816qVfb buw8V+TbUAQQ3ZRK6bLSa0urspsDBhlH0Ilb85VvJyxjvFUVY41mLVp1p3ci4V3ms1SbNGx9zXdN g32iFqaOE+re5AbnS1aHHKWPbHFuEZi3Gr9dpM+zZXbt7YPRTm4P4a/FIrrj5bPfabk956MbPifO P8kijvtKJSsgCcEtjpXzvq65NiIeI/dtIhwIb9JRNVGtFpCYJ5Jb6v9kl7dN89+Se68Xx62RJkLa 9ysnGgdDGVGHosZc8v4ZEzh3bv2qyKbI2QJmSoF8WON3/ET/4NeJo4stvQaSuDUm/6Ni1lMzr00r 9/jNTZ9cP0cn5O/UYBs17c3CsOmbd6zY9I7jowXUNYMLR9uC6c8RBfH8mBf3KG2J2yo+eiYcc3un crBl4BN9rWFXeqH4oRdx3hvPV1vUzHasgbdoldd4WFwWjgy8ZunesNhjcXpjXNgrA0RnvuKCngHt 7uhiV4qxeqxNKUqe9+6qtpGIj8XzXUeFt7Z7FFupd+3qztFQPpFscFS/WCapY9fjb6eT9Gi5UVYm bLu1Ahe6U06nqKS8TlOw/3hsl3Gkl0+m1+WtTH/6utwd/VLDQT6vJkTrIpNHRidmP1T29uFVG8rn 8Aljf6A2yxSYc6bivthXFUWqN6lYev1ou5Pcm0yUHBCXFvNzkvgqDmsdFlz/ZL+VzIr5XZ6xRtJ7 O3Rq7ML8Nf3kl6qF7uytC/eJepw7ILfRetA9UPT5nELN85GbbhYvVI6+uMJZz5A0yTi4/aLy3zFb TIw7cImbSKJLRMe34dyOtpZMIPkA89xUmuxoE8/Ku/6akXJ1xfroXlr7HYcYUg8fMfkcHdE/eakx 17pLKrDErVs4orTJjjXDDoODc19MXJmNPU/9oLjnrMXRBULLRnP3h1nv7ryiutHUpoPV+1TNPr59 TmFc910WW4S+YPOcgPDhjpNG2rXOJ/tcFA136xjZX5nF0CZGi5rWDjJGj6qe0ZVeqFv73eda4lO7 Z0JbfLzkTrmENo1uPNz9I+u6WX5X4flHQwOnlz6U/furXKK7O+6InsuDIeEjglrqH+uGx/00ljKO yTO3HvWrVQhWfqN0XX/r6zOEKomzexJ3xoNVjz9lNloW3y8vul0obTnMTA1yNNRStO4JtCJdHAhM PNwmJ+GFK1XWrQY1pA30+GHK/BsfJCU+JdcN+DcG35acQxtKviD8d2xIgC5B8p1BnNxapb9oiw4W h2/bv3IZzo1QffpCd0Jw8D10Qfh+huG+T90r3D9u3c1H/3zOn/AfeBlKvO4M7ayWM79MmLXwvaAr n535nIhg5E9y+4FbkubwdEzaVHB6k4qQdsZ4q4mTz7qhWQKiTXaVjbOqrdQ8h6QPXU8ecNwuPD9q 24c9Z+lStp8d36foiUktnfOpaom8Oa5ZprNRYSGrtWrHy/nswlSDu7JNVvHymjeY5Icgx+AQnNe/ WEn0Nqtu7te84TvFHywbpE7PhsX5SMLn2IQQSH/wO/Cgwf44WCx2LOONgVl06pcf+S1yhSOM1QFn E8NMIYWmQ46KJ66eXvfPQQ3rkC6G48XkEY0TIzdX4Nuu1lq5p8idlmix6BvUM1Ju3Z/um3WMlFZZ eJF0u1ubrrzgvj9yOelZ5ePEvkXNWY+uOqybG6lkYHdh/1oRyveiB+Tg7rtBITVaOXYJi1+dVm44 FNEkd1BNI09z/5eLoZ9Hh1uao/dmux80Ptzn4pF7UXH4RVrR+q1pd0vDAvUww8zeIfmxFJ847cjb wU8GC/pqolTjhPq7n5Iv7yn2D+rq9HRIbg93+svf1VNj7UYBN/c5l0oTvxh1Ffr0jCxa7+uVyEd/ fE55MOkPziiOKbahFrC0+UgUzju7UqelY4fq7sa97SPtIgaZmrpG0s2Ddrt2pUc710oXiNwORjv1 yogBBLr/pFb3sOaqWNT0Tod65WI91kp2Neoy+07ofcQyrFHuu1kKEE2L14cSbXa5aXmXn2je0lfa by448nGCeU9kHkVavVM4qsthtYOhzJuBE6+3MdPRuddwwjrSSTSVmuaiKjKzaA9tpewmoXJjduuT 2ztm3VA3bOcjNJ+DGQL/wVcXzNmeLgyLtXbL3TY5I12xpDv9wqf3r3Z4pbNXeVauMNPStNmarr4h x6+zNaFVRHF0393Q609nj/s6WvfHBnnKN0ntS/L9yk4gOuiVu1d+azlmr77AqJbQqC1DPmDyqIn4 44x1PzGxgNhcNs8MJ2+ucbr0RkBOTt8/CdffFzc0xZ/s7CbglEJV3zpAMg21z2uNxkh+hd2P5dZS patz1hZ6HyQ832U4fIDe8kWxrvDgkb2+xld8Vyun9FlPiKZkluTPSdyma3v5UN2LM+0ou6lh0Ulr 9zQ+H6QwnqoLtxaEN6OyaNM9RxcXi1W6FrRQ6qooNyqdxdEbk8U2D6YyAQTwDtTpPoJhOO5qCxrL nxkSwWYwATxdNHKL8mNzd+fQQAHeiRpO47P11HqzqXLOMhhCYLCMQEQBTKIQAIygKKeYw5niSGUz Q7g1H30IgrmVn//0vHF4DkOcUhQLwMSpOpEl3Z/BLVT9R9KfKBzeIiQwkMak0Tl1JS+AIgDPiqD6 0wCBDPCbaUwGwDPoNIBnb2QADAH4QEYUE2AEgGeFRAOMCPC0kKBgNveU5wbw7oBCBng/HN4fwBAM 8DTAqULhQwAMUQA+HODpAM8AMIwCfCTAMwEMEwGeDfBRwBtnbIzDrw4JYAezAIz+VpyCCXxtNUPb 3Of/QbVcLw9iART5IyWbsvw5VTcKJ0twKHAeliEokVNWjLCZkhfC4T1/dgHelk0NC/E3pQeF0TiP bmxa+CpOx5EazZUIwCgBmSkO+uvzORGC/i8A979di8JkQIBgQCBCgIySAREl4igYBEhkCCAkDKAU iAsYNDXOmY8S4akWJXHm//8A97PPmcsBzh4/AUNhAEMcRsgEQCQTAZFCBiQSBIgoAjASBkgcwBCA UDAcQsEAESMCDCMBMhEFJAIZkMgkQITQqZYzjmKACMOAhCLcPSlkCiCSp3CclisMSsJxWi4D0JRg RBjlrsUwaHoPDKAYMtVHCQAhkbmAkSjclkIicPFEGMFNzcEAAYYBhsAApSDcMYyCADJM5rZcQLBf iuC0XGVzaHMUNGUIHIcmBpOnlILNAK7/cKlwHiDStP04os2wIwewKcBh0zb7tdVUB4Gnt0BQ7jIu VzD8yw1+NyFHW9jMHQgkmCP2lC8Q4X+zykFynQmCp/T6cxeYq2scd2x6AwqR8gs4jjDlA7zA1TWF zPWJGcD1h5nA9ZVpn/gdOHxx+yjyL+D6BYThiOi0D/ABChmZ8gsY+xf89ImfwJGJiBJw3PY34Np6 avxfgFGmrMpp/1NHm5my3QA8fRnBHXDrOa4A7wfg6Vq+P0Cmyvh4GuB+/Xb9GY+5H3RdcVPhGpm+ 3hACkOmcFA6437xcOQEZmb6+wADINClOwEemiUUC7i9nVxyeCdBpYpzQj06Tm0oW6PRNATZAp2lx 8gU6TS0KoNM3JrgJBSX+Ft1nHtGtYABjv43PDP6m8Mws9uuCBt7clBNw/akA5izEmyL/4zT417QZ JGacBf6DJPJDkvghEZ70NHXxBG8fEsBJq/CUtrjXMaLo7Ckmf0o/84OSOZNG5aSzpY5UdkQYgx0W 4gf+QvUp+gQ9EMxmR7CW4/Hhv4b0GcwgbRzn4klAlD/t36siAgKBH9V/A40eML2DNm5q+xAG3YKj jKUWyxEIwSAUIcJkiIIRdCFEC4K0tGcwF82kBeIggJJx0K8/QMQwFAOB4BeO47LcEfpPHJmMQTw4 TvjmwZHJPDjOq8qzH8Q7j8xxzX/jIIiI8eBQAvw7DibAPPxBCC8NmJMqfsOROHHvdxyMEX7HEUkI r7wEmGceTEB5aMBklJdnCgn9HYcgZB4aCEbmnUem8MiGorw8oxjMo1OUSOSdR+GlS0AQHp4JGMRj DwKRyCMvgULiWYshEMKDw3jpYkQSL45M4pGXCPPqgEgg8OiKTJnpG2wmNSSMxpyKxiGbaYDz0dCV weC8xNzoZksPZACU9DNmsdhUJpv72lAgIgmnoWG50gr3/wBQSwcIegjcEDYaAACyJgAAUEsBAhQD FAAAAAAAQUZ7WgAAAAAAAAAAAAAAAAYAGAAAAAAAAAAAAO1BAAAAAHBsb3RzL3V4CwABBKszCgAE AZYEAFVUBQABKgPlZ1BLAQIUAxQACAAIADGReloxiWjSah0AAKAqAAAZABgAAAAAAAAAAACkgUQA AABwbG90cy90ZXN0XzE0OF9wZXAtYXAucGRmdXgLAAEEqzMKAAQBlgQAVVQFAAHPNORnUEsBAhQD FAAIAAgAOpF6Wuj5XjCdHgAABiwAABgAGAAAAAAAAAAAAKSBFR4AAHBsb3RzL3Rlc3RfMTBfcGVw LWFwLnBkZnV4CwABBKszCgAEAZYEAFVUBQAB4DTkZ1BLAQIUAxQACAAIADuRelp6CNwQNhoAALIm AAAYABgAAAAAAAAAAACkgRg9AABwbG90cy90ZXN0XzEyX3BlcC1hcC5wZGZ1eAsAAQSrMwoABAGW BABVVAUAAeI05GdQSwUGAAAAAAQABABnAQAAtFcAAAAA ------=_Part_595607_390145407.1743087821945-- From mirageos-devel-bounces@lists.xenproject.org Mon Mar 31 16:38:13 2025 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 31 Mar 2025 16:38:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.932862.1334918 (Exim 4.92) (envelope-from ) id 1tzI9B-0000ee-90; Mon, 31 Mar 2025 16:38:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 932862.1334918; Mon, 31 Mar 2025 16:38:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tzI9B-0000eX-68; Mon, 31 Mar 2025 16:38:01 +0000 Received: by outflank-mailman (input) for mailman id 932862; Mon, 31 Mar 2025 16:38:00 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tzI99-0000eJ-LL for mirageos-devel@lists.xenproject.org; Mon, 31 Mar 2025 16:38:00 +0000 Received: from smtp-2.srv.uis.cam.ac.uk (smtp-2.srv.uis.cam.ac.uk [128.232.132.148]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 7d39b7e8-0e4e-11f0-9ffb-bf95429c2676; Mon, 31 Mar 2025 18:37:53 +0200 (CEST) Received: from svr-postfix-1.cl.cam.ac.uk ([128.232.119.160]:47293) by smtp-2.srv.uis.cam.ac.uk with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1tzI91-00000001ZYA-5Q9Y; Mon, 31 Mar 2025 17:37:51 +0100 Received: from fauth-a1-smtp.messagingengine.com (fauth-a1-smtp.messagingengine.com [103.168.172.200]) (Authenticated sender: avsm2+fm) by svr-postfix-1.cl.cam.ac.uk (Postfix) with ESMTPSA id EA27840246; Mon, 31 Mar 2025 16:37:32 +0000 (UTC) Received: from phl-compute-02.internal (phl-compute-02.phl.internal [10.202.2.42]) by mailfauth.phl.internal (Postfix) with ESMTP id E5F46120007D; Mon, 31 Mar 2025 12:37:31 -0400 (EDT) Received: from phl-mailfrontend-02 ([10.202.2.163]) by phl-compute-02.internal (MEProxy); Mon, 31 Mar 2025 12:37:31 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 31 Mar 2025 12:37:31 -0400 (EDT) X-BeenThere: mirageos-devel@lists.xenproject.org List-Id: Developer list for MirageOS List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: mirageos-devel-bounces@lists.xenproject.org Precedence: list Sender: "MirageOS-devel" X-Inumbo-ID: 7d39b7e8-0e4e-11f0-9ffb-bf95429c2676 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=cam.ac.uk; s=20230918.smtp; h=To:References:Message-Id:Content-Transfer-Encoding:Cc:Date :In-Reply-To:From:Subject:Mime-Version:Content-Type:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gSbpSz9wVhf/rjWKZf/uCafL6kzq0Br6/Ug40YiTVc4=; b=Ezigk0/Cwr6S42IW7Ox2QOqwsh bhsyNCP9+7VX+0hkAk29FTgqxtUNcqLqKWRGxjF37TRh+stVKKof+lvIjArBh2GvxsHs+WPbov2Gs wmq09B/c+8vmAGE/lpbr7KOfiBk+ArVgKRhf2tYtZB3uu3s7fh2tGgoBj+vPIwGHIP1z+6SyljOLc tMHcBPo3TPeDgM2b7AErMPrR2weZvVZLvu+Ws/q10ZQAxmnfTcq11yGFory45LCxU+gjWmjZi6v9j HVZ1rbMxImLYhAkjsiOdafVGZn+N+z3Qy3ClsL4iGCR6v/AGr+DH6Ql+nmTVXO7+cPcjC1tGLH2go tTzhsUlA==; X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: https://help.uis.cam.ac.uk/email-scanner-virus X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddukedtgedvucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpih gvnhhtshculddquddttddmnecujfgurheptggguffhjgffvefgkfhfvffosehtqhhmtdhh tdejnecuhfhrohhmpeetnhhilhcuofgrughhrghvrghpvgguugihuceorghvshhmvdestg hlrdgtrghmrdgrtgdruhhkqeenucggtffrrghtthgvrhhnpeefkeejhfelvddtleelleeh lefhhfejgfefteefiedvvddtteeihfelvedtkeefjeenucffohhmrghinhepihhnshgvtg hurhgvrdhorhhgpdhgihhthhhusgdrtghomhdpshgvghhmvghnthdrmhhlnecuvehluhhs thgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheprghvshhmvddomhgvsh hmthhprghuthhhphgvrhhsohhnrghlihhthidquddvhedvkeefudejfedqvdekudeljeeg ieelqdgrvhhsmhdvpeeptghlrdgtrghmrdgrtgdruhhksehfmhdrtghlrdgtrghmrdgrtg druhhkpdhnsggprhgtphhtthhopeehpdhmohguvgepshhmthhpohhuthdprhgtphhtthho pehluhgtrghsrdgruhgsrghrugesihhrihhsrgdrfhhrpdhrtghpthhtohepmhhirhgrgh gvohhsqdguvghvvghlsehlihhsthhsrdigvghnphhrohhjvggtthdrohhrghdprhgtphht thhopehjohhhrghnrdhmrgiivghlsehsshhirdhgohhuvhdrfhhrpdhrtghpthhtohepgh hilhhlvghsrdhguhgvthhtvgesihhmthdqrghtlhgrnhhtihhquhgvrdhfrhdprhgtphht thhopehpihgvrhhrvgdrtghhihhffhhlihgvrhesshhsihdrghhouhhvrdhfrh X-ME-Proxy: Feedback-ID: i9ebc46d9:Fastmail Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.400.131.1.6\)) Subject: Re: Failed TCP connection reset when processing overlapping data segments From: Anil Madhavapeddy In-Reply-To: <530642224.595613.1743087821949.JavaMail.zimbra@irisa.fr> Date: Mon, 31 Mar 2025 17:37:20 +0100 Cc: mirageos-devel@lists.xenproject.org, Johan Mazel , gilles guette , Pierre Chifflier Content-Transfer-Encoding: quoted-printable Message-Id: References: <530642224.595613.1743087821949.JavaMail.zimbra@irisa.fr> To: Lucas Aubard X-Mailer: Apple Mail (2.3826.400.131.1.6) Dear Lucas, You've really taken me down memory lane now; I wrote this part of the = stack about 15 years ago! If I remember correctly, TCP's behaviour is = undefined when there are multiple overlapping segments, and so the = implementation can define its own behaviour here.=20 I remember referring to Section 4.3.2 of the classic paper by Ptacek on = this. https://insecure.org/stf/secnet_ids/secnet_ids.html This defines all the different OS behaviours for overlapping segments, = and they're all different. So from a high level perspective, I remember picking the most = conservative option, but I don't remember all the details without diving = into git (actually, svn) history. What behaviour are you expecting to = happen below? Is the "weird" behaviour you are seeing simply a deviance = from Linux TCP/IP reassembly semantics, or is there some reassembly = property not being maintained that you would expect to be? best, Anil > On 27 Mar 2025, at 15:03, Lucas Aubard wrote: >=20 > Dear mirage-tcpip development team,=20 >=20 > I am Lucas Aubard. I am a PhD student in an Inria lab in Rennes, = France.=20 > This PhD is supervised by Gilles Guette (IMT Atlantique), Pierre = Chifflier (ANSSI) and Johan Mazel (ANSSI). >=20 > During our research work, we analyzed mirage-tcpip 9.0.0 reassembly = when processing overlapping TCP data segments. We noticed something = weird for some of our test cases. >=20 > The testing scenario for every test case is as follow: > =E2=80=A2 a handshake is initiated from 192.168.56.200 host to = 192.168.57.203 mirage-tcpip host, targetting its TCP Echo port 7. > =E2=80=A2 the overlapping data chunks are sent from the initiator. > =E2=80=A2 the initiator resets the TCP connection with a RST+ACK = packet. > Every packet that mirage-tcpip host echoes back is acknowledged by the = initiator. >=20 > In the impacted test cases, mirage-tcpip echoes some data but not the = maximum possible amount of data. In fact, from what we observe across = mirage test case reassemblies, it does not echo back overlapping data = segments. This may be related to this part of mirage-tcpip code = https://github.com/mirage/mirage-tcpip/blob/6766a3f0b34695e19797a1264697d3= dd1343c73e/src/tcp/segment.ml#L151. The following termination of the TCP = connections with a RST+ACK packet fails. > We believe that mirage-tcpip considers that the RST+ACK packet = sequence number is invalid because it is located after all sent data = (including the overlapping segments). Since mirage-tcpip does not echo = the maximum possible amount of data, we hypothesize that the initiator = SND.NXT internal variable is not the same as the RCV.NXT value in = mirage-tcpip. >=20 > Attached are the pcap files and plots for some (random) overlap test = cases illustrating the problem. > You can see in the pcap files that mirage-tcpip sends an ACK after the = RST+ACK packets whose acknowledgment is not related to the last data = sent by the initiator. > This means that mirage does not consider the sequence number of the = RST+ACK packet as valid, ignores this RST+ACK packet, and does not close = the TCP connection. Mirage here expects data that follows the last valid = data it observed. >=20 > Can you confirm that our understanding of the mirage-tcpip TCP stack = behavior is correct, in particular in term of data overlap and sequence = number processing? >=20 > Best regards, > Lucas Aubard.