From 0da30d61e624fa6fbd4d6b2057244e0c9e0c213b Mon Sep 17 00:00:00 2001 From: Doug Barton Date: Fri, 9 Jan 2009 09:58:33 +0000 Subject: Vendor import of BIND 9.3.6-P1 --- CHANGES | 464 ++- FAQ | 105 +- FAQ.xml | 154 +- README | 34 +- bin/dig/dig.1 | 18 +- bin/dig/dig.c | 67 +- bin/dig/dig.docbook | 22 +- bin/dig/dig.html | 34 +- bin/dig/dighost.c | 2 +- bin/dig/host.1 | 8 +- bin/dig/host.docbook | 7 +- bin/dig/host.html | 12 +- bin/dnssec/dnssec-keygen.8 | 10 +- bin/dnssec/dnssec-keygen.docbook | 9 +- bin/dnssec/dnssec-keygen.html | 20 +- bin/dnssec/dnssec-signzone.8 | 8 +- bin/dnssec/dnssec-signzone.c | 21 +- bin/dnssec/dnssec-signzone.docbook | 7 +- bin/dnssec/dnssec-signzone.html | 16 +- bin/named/client.c | 2 +- bin/named/config.c | 2 +- bin/named/controlconf.c | 2 +- bin/named/include/named/globals.h | 7 +- bin/named/interfacemgr.c | 2 +- bin/named/lwresd.8 | 14 +- bin/named/lwresd.c | 2 +- bin/named/lwresd.docbook | 9 +- bin/named/lwresd.html | 18 +- bin/named/main.c | 61 +- bin/named/named.8 | 23 +- bin/named/named.conf.5 | 7 +- bin/named/named.conf.docbook | 2 +- bin/named/named.conf.html | 33 +- bin/named/named.docbook | 33 +- bin/named/named.html | 45 +- bin/named/query.c | 30 +- bin/named/server.c | 219 +- bin/named/unix/include/named/os.h | 8 +- bin/named/unix/os.c | 44 +- bin/named/update.c | 31 +- bin/nsupdate/Makefile.in | 10 +- bin/nsupdate/nsupdate.1 | 348 +++ bin/nsupdate/nsupdate.8 | 348 --- bin/nsupdate/nsupdate.docbook | 7 +- bin/nsupdate/nsupdate.html | 16 +- bin/rndc/rndc-confgen.c | 12 +- bin/rndc/rndc.c | 20 +- configure.in | 118 +- doc/arm/Bv9ARM-book.xml | 254 +- doc/arm/Bv9ARM.ch02.html | 8 +- doc/arm/Bv9ARM.ch04.html | 10 +- doc/arm/Bv9ARM.ch06.html | 346 ++- doc/arm/Bv9ARM.ch07.html | 14 +- doc/arm/Bv9ARM.ch08.html | 18 +- doc/arm/Bv9ARM.ch09.html | 94 +- doc/arm/Bv9ARM.html | 72 +- doc/arm/Bv9ARM.pdf | 5853 ++++++++++++++++++------------------ doc/misc/options | 38 +- doc/rfc/index | 13 +- doc/rfc/rfc4648.txt | 1011 +++++++ doc/rfc/rfc4701.txt | 675 +++++ doc/rfc/rfc5155.txt | 2915 ++++++++++++++++++ lib/bind/api | 6 +- lib/bind/bsd/Makefile.in | 8 +- lib/bind/bsd/strerror.c | 6 +- lib/bind/bsd/strtoul.c | 10 +- lib/bind/configure.in | 63 +- lib/bind/dst/Makefile.in | 8 +- lib/bind/dst/dst_api.c | 2 +- lib/bind/dst/hmac_link.c | 2 +- lib/bind/dst/support.c | 2 +- lib/bind/include/arpa/nameser.h | 5 +- lib/bind/include/isc/assertions.h | 7 +- lib/bind/include/isc/misc.h | 3 +- lib/bind/include/resolv.h | 6 +- lib/bind/inet/Makefile.in | 8 +- lib/bind/inet/inet_net_pton.c | 6 +- lib/bind/irs/Makefile.in | 8 +- lib/bind/irs/dns_ho.c | 11 +- lib/bind/irs/irp.c | 10 +- lib/bind/isc/Makefile.in | 8 +- lib/bind/isc/assertions.c | 3 +- lib/bind/isc/bitncmp.c | 4 +- lib/bind/isc/ctl_clnt.c | 5 +- lib/bind/isc/ctl_srvr.c | 5 +- lib/bind/nameser/Makefile.in | 8 +- lib/bind/port_after.h.in | 81 +- lib/bind/resolv/Makefile.in | 8 +- lib/bind/resolv/res_debug.c | 55 +- lib/bind/resolv/res_mkquery.c | 69 +- lib/bind/resolv/res_query.c | 14 +- lib/bind9/api | 2 +- lib/bind9/check.c | 111 +- lib/dns/adb.c | 58 +- lib/dns/api | 4 +- lib/dns/cache.c | 27 +- lib/dns/dispatch.c | 1314 ++++++-- lib/dns/include/dns/dispatch.h | 54 +- lib/dns/journal.c | 28 +- lib/dns/masterdump.c | 27 +- lib/dns/message.c | 2 +- lib/dns/openssldsa_link.c | 4 +- lib/dns/opensslrsa_link.c | 4 +- lib/dns/rbt.c | 17 +- lib/dns/rdata/generic/nsec_47.c | 10 +- lib/dns/rdata/generic/nsec_47.h | 9 +- lib/dns/rdata/generic/txt_16.c | 6 +- lib/dns/rdata/in_1/naptr_35.c | 14 +- lib/dns/request.c | 84 +- lib/dns/resolver.c | 253 +- lib/dns/validator.c | 8 +- lib/dns/view.c | 21 +- lib/dns/xfrin.c | 6 +- lib/isc/Makefile.in | 10 +- lib/isc/api | 4 +- lib/isc/assertions.c | 8 +- lib/isc/include/isc/assertions.h | 11 +- lib/isc/include/isc/mem.h | 76 +- lib/isc/include/isc/msgs.h | 10 +- lib/isc/include/isc/platform.h.in | 19 +- lib/isc/include/isc/portset.h | 141 + lib/isc/include/isc/resource.h | 15 +- lib/isc/include/isc/socket.h | 75 +- lib/isc/include/isc/timer.h | 2 +- lib/isc/include/isc/types.h | 7 +- lib/isc/mem.c | 25 +- lib/isc/portset.c | 143 + lib/isc/print.c | 95 +- lib/isc/pthreads/mutex.c | 74 +- lib/isc/timer.c | 2 +- lib/isc/unix/app.c | 19 +- lib/isc/unix/include/isc/net.h | 25 +- lib/isc/unix/net.c | 161 +- lib/isc/unix/resource.c | 8 +- lib/isc/unix/socket.c | 1682 +++++++++-- lib/isc/unix/socket_p.h | 15 +- lib/isc/unix/time.c | 10 +- lib/isccfg/api | 2 +- lib/isccfg/namedconf.c | 96 +- version | 6 +- 140 files changed, 13924 insertions(+), 5123 deletions(-) create mode 100644 bin/nsupdate/nsupdate.1 delete mode 100644 bin/nsupdate/nsupdate.8 create mode 100644 doc/rfc/rfc4648.txt create mode 100644 doc/rfc/rfc4701.txt create mode 100644 doc/rfc/rfc5155.txt create mode 100644 lib/isc/include/isc/portset.h create mode 100644 lib/isc/portset.c diff --git a/CHANGES b/CHANGES index df9ebf1c5eede..c390df909ad2e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,14 +1,154 @@ - --- 9.3.5-P2 released --- - -2406. [bug] Some operating systems have FD_SETSIZE set to a - low value by default, which can cause resource - exhaustion when many simultaneous connections are - open. Linux in particular makes it difficult to - increase this value. To use more sockets with - select(), set ISC_SOCKET_FDSETSIZE. Example: - STD_CDEFINES="-DISC_SOCKET_FDSETSIZE=4096" ./configure - (This should not be necessary in most cases, and - never for an authoritative-only server.) [RT #18328] + --- 9.3.6-P1 released --- + +2522. [security] Handle -1 from DSA_do_verify(). + +2498. [bug] Removed a bogus function argument used with + ISC_SOCKET_USE_POLLWATCH: it could cause compiler + warning or crash named with the debug 1 level + of logging. [RT #18917] + + --- 9.3.6 released --- + +2490. [port] aix: work around a kernel bug where IPV6_RECVPKTINFO + is cleared when IPV6_V6ONLY is set. [RT #18785] + +2489. [port] solaris: Workaround Solaris's kernel bug about + /dev/poll: + http://bugs.opensolaris.org/view_bug.do?bug_id=6724237 + Define ISC_SOCKET_USE_POLLWATCH at build time to enable + this workaround. [RT #18870] + + --- 9.3.6rc1 released --- + +2473. [port] linux: raise the limit on open files to the possible + maximum value before spawning threads; 'files' + specified in named.conf doesn't seem to work with + threads as expected. [RT #18784] + +2472. [port] linux: check the number of available cpu's before + calling chroot as it depends on "/proc". [RT #16923] + +2469. [port] solaris: Work around Solaris's select() limitations. + [RT #18769] + +2468. [bug] Resolver could try unreachable servers multiple times. + [RT #18739] + +2467. [bug] Failure of fcntl(F_DUPFD) wasn't logged. [RT #18740] + +2465. [bug] Adb's handling of lame addresses was different + for IPv4 and IPv6. [RT #18738] + +2463. [port] linux: POSIX doesn't include the IPv6 Advanced Socket + API and glibc hides parts of the IPv6 Advanced Socket + API as a result. This is stupid as it breaks how the + two halves (Basic and Advanced) of the IPv6 Socket API were designed to be used but we have to live with it. + Define _GNU_SOURCE to pull in the IPv6 Advanced Socket + API. [RT #18388] + +2462. [doc] Document -m (enable memory usage debugging) + option for dig. [RT #18757] + +2461. [port] sunos: Change #2363 was not complete. [RT #17513] + +2458. [doc] ARM: update and correction for max-cache-size. + [RT #18294] + +2455. [bug] Stop metadata being transfered via axfr/ixfr. + [RT #18639] + +2453. [bug] Remove NULL pointer dereference in dns_journal_print(). + [RT #18316] + +2449. [bug] libbind: Out of bounds reference in dns_ho.c:addrsort. + [RT #18044] + +2444. [port] Linux, FreeBSD, AIX: Turn off path mtu discovery + (clear DF) for UDP responses and requests. + + --- 9.3.6b1 released --- + +2443. [bug] win32: UDP connect() would not generate an event, + and so connected UDP sockets would never clean up. + Fix this by doing an immediate WSAConnect() rather + than an io completion port type for UDP. + +2438. [bug] Timeouts could be logged incorrectly under win32. + [RT #18617] + +2437. [bug] Sockets could be closed too early, leading to + inconsistent states in the socket module. [RT #18298] + +2436. [security] win32: UDP client handler can be shutdown. [RT #18576] + +2432. [bug] More Windows socket handling improvements. Stop + using I/O events and use IO Completion Ports + throughout. Rewrite the receive path logic to make + it easier to support multiple simultaneous + requestrs in the future. Add stricter consistency + checking as a compile-time option (define + ISC_SOCKET_CONSISTENCY_CHECKS; defaults to off). + +2430. [bug] win32: isc_interval_set() could round down to + zero if the input was less than NS_INTERVAL + nanoseconds. Round up instead. [RT #18549] + +2429. [doc] nsupdate should be in section 1 of the man pages. + [RT #18283] + +2426. [bug] libbind: inet_net_pton() can sometimes return the + wrong value if excessively large netmasks are + supplied. [RT #18512] + +2425. [bug] named didn't detect unavailable query source addresses + at load time. [RT #18536] + +2424. [port] configure now probes for a working epoll + implementation. Allow the use of kqueue, + epoll and /dev/poll to be selected at compile + time. [RT #18277] + +2422. [bug] Handle the special return value of a empty node as + if it was a NXRRSET in the validator. [RT #18447] + +2421. [func] Add new command line option '-S' for named to specify + the max number of sockets. [RT #18493] + Use caution: this option may not work for some + operating systems without rebuilding named. + +2420. [bug] Windows socket handling cleanup. Let the io + completion event send out cancelled read/write + done events, which keeps us from writing to memeory + we no longer have ownership of. Add debugging + socket_log() function. Rework TCP socket handling + to not leak sockets. + +2417. [bug] Connecting UDP sockets for outgoing queries could + unexpectedly fail with an 'address already in use' + error. [RT #18411] + +2416. [func] Log file descriptors that cause exceeding the + internal maximum. [RT #18460] + +2414. [bug] A masterdump context held the database lock too long, + causing various troubles such as dead lock and + recursive lock acquisition. [RT #18311, #18456] + +2413. [bug] Fixed an unreachable code path in socket.c. [RT #18442] + +2412. [bug] win32: address a resourse leak. [RT #18374] + +2411. [bug] Allow using a larger number of sockets than FD_SETSIZE + for select(). To enable this, set ISC_SOCKET_MAXSOCKETS + at compilation time. [RT #18433] + +2410. [bug] Correctly delete m_versionInfo. [RT #18432] + +2408. [bug] A duplicate TCP dispatch event could be sent, which + could then trigger an assertion failure in + resquery_response(). [RT #18275] + +2407. [port] hpux: test for sys/dyntune.h. [RT #18421] 2404. [port] hpux: files unlimited support. @@ -22,7 +162,7 @@ 2399. [bug] Abort timeout queries to reduce the number of open UDP sockets. [RT #18367] -2398. [bug] Improve file descriptor management. New, +2398. [bug] Improve file descriptor management. New, temporary, named.conf option reserved-sockets, default 512. [RT #18344] @@ -39,11 +179,111 @@ 2392. [bug] remove 'grep -q' from acl test script, some platforms don't support it. [RT #18253] - --- 9.3.5-P1 released --- +2391 [port] hpux: cover additional recvmsg() error codes. + [RT #18301] + +2390 [bug] dispatch.c could make a false warning on 'odd socket'. + [RT #18301]. + +2389 [bug] Move the "working directory writable" check to after + the ns_os_changeuser() call. [RT #18326] + +2386. [func] Add warning about too small 'open files' limit. + [RT #18269] + +2385. [bug] A condition variable in socket.c could leak in + rare error handling [RT #17968]. + +2384. [security] Additional support for query port randomization (change + #2375) including performance improvement and port range + specification. [RT #17949, #18098] + +2383. [bug] named could double queries when they resulted in + SERVFAIL due to overkilling EDNS0 failure detection. + [RT #18182] + +2382. [doc] Add a description SSHFP to ARM. + +2380. [bug] dns_view_find() was not returning NXDOMAIN/NXRRSET + proofs which, in turn, caused validation failures + for insecure zones immediately below a secure zone + the server was authoritative for. [RT #18112] -2375. [security] Fully randomize UDP query ports to improve +2379. [contrib] queryperf/gen-data-queryperf.py: removed redundant + TLDs and supported RRs with TTLs [RT #17972] + +2377. [bug] Address race condition in dnssec-signzone. [RT #18142] + +2376. [bug] Change #2144 was not complete. + +2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949] +2369. [bug] libbind: Array bounds overrun on read in bitncmp(). + [RT #18054] + +2364. [bug] named could trigger an assertion when serving a + malformed signed zone. [RT #17828] + +2363. [port] sunos: pre-set "lt_cv_sys_max_cmd_len=4096;". + [RT #17513] + +2361. [bug] "recursion" statistics counter could be counted + multiple times for a single query. [RT #17990] + +2358. [doc] Update host's default query description. [RT #17934] + +2356. [bug] Built in mutex profiler was not scalable enough. + [RT #17436] + +2353. [func] libbind: nsid support. [RT #17091] + +2350. [port] win32: IPv6 support. [RT #17797] + +2347. [bug] Delete now traverses the RB tree in the canonical + order. [RT #17451] + +2345. [bug] named-checkconf failed to detect when forwarders + were set at both the options/view level and in + a root zone. [RT #17671] + +2344. [bug] Improve "logging{ file ...; };" documentation. + [RT #17888] + +2343. [bug] (Seemingly) duplicate IPv6 entries could be + created in ADB. [RT #17837] + +2341. [bug] libbind: add missing -I../include for off source + tree builds. [RT #17606] + +2340. [port] openbsd: interface configuration. [RT #17700] + +2335. [port] sunos: libbind and *printf() support for long long. + [RT #17513] + +2334. [bug] Bad REQUIRES in fromstruct_in_naptr(), off by one + bug in fromstruct_txt(). [RT #17609] + +2333. [bug] Fix off by one error in isc_time_nowplusinterval(). + [RT #17608] + +2332. [contrib] query-loc-0.4.0. [RT #17602] + +2331. [bug] Failure to regenerate any signatures was not being + reported nor being past back to the UPDATE client. + [RT #17570] + +2330. [bug] Remove potential race condition when handling + over memory events. [RT #17572] + + WARNING: API CHANGE: over memory callback + function now needs to call isc_mem_waterack(). + See for details. + +2329. [bug] Clearer help text for dig's '-x' and '-i' options. + +2325. [port] Linux: use capset() function if available. [RT #17557] + --- 9.3.5 released --- --- 9.3.5rc2 released --- @@ -65,11 +305,11 @@ 2322. [port] MacOS: work around the limitation of setrlimit() for RLIMIT_NOFILE. [RT #17526] -2321. [bug] Silence Coverity warnings in lib/dns/master.c, +2321. [bug] Silence Coverity warnings in lib/dns/master.c, lib/dns/rbtdb.c, lib/isccfg/namedconf.c, lib/dns/tsig.c and bin/dnssec/dnssec-signzone.c. -2319. [bug] Silence Coverity warnings in +2319. [bug] Silence Coverity warnings in lib/dns/rdata/in_1/apl_42.c. [RT #17469] 2318. [port] sunos fixes for libbind. [RT #17514] @@ -83,7 +323,7 @@ 2312. [cleanup] Silence Coverity warning in lib/isc/unix/socket.c. [RT #17458] -2311. [func] Update ACL regression test. [RT #17462] +2311. [func] Update ACL regression test. [RT #17462] 2310. [bug] dig, host, nslookup: flush stdout before emitting debug/fatal messages. [RT #17501] @@ -106,7 +346,7 @@ 2301. [bug] Remove resource leak and fix error messages in bin/tests/system/lwresd/lwtest.c. [RT #17474] -2300. [bug] Fixed failure to close open file in +2300. [bug] Fixed failure to close open file in bin/tests/names/t_names.c. [RT #17473] 2299. [bug] Remove unnecessary NULL check in @@ -129,7 +369,7 @@ 2292. [bug] Log if the working directory is not writable. [RT #17312] -2291. [bug] PR_SET_DUMPABLE may be set too late. Also report +2291. [bug] PR_SET_DUMPABLE may be set too late. Also report failure to set PR_SET_DUMPABLE. [RT #17312] 2290. [bug] Let AD in the query signal that the client wants AD @@ -148,7 +388,7 @@ memory context rather than the clients memory context. [RT #17377] -2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available, +2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available, to protect applications from receiving spurious SIGPIPE signals when using the resolver. @@ -157,7 +397,7 @@ --- 9.3.5b1 released --- -2273. [bug] Adjust log level to WARNING when saving inconsistant +2273. [bug] Adjust log level to WARNING when saving inconsistent stub/slave master and journal files. [RT# 17279] 2272. [bug] Handle illegal dnssec-lookaside trust-anchor names. @@ -194,10 +434,10 @@ reality. Note there is behaviour change for BIND 9.5. [RT #17113] -2249. [bug] Only set Authentic Data bit if client requested +2249. [bug] Only set Authentic Data bit if client requested DNSSEC, per RFC 3655 [RT #17175] -2248. [cleanup] Fix several errors reported by Coverity. [RT #17160] +2248. [cleanup] Fix several errors reported by Coverity. [RT #17160] 2247. [doc] Sort doc/misc/options. [RT #17067] @@ -208,18 +448,18 @@ working. [RT #17151] 2238. [bug] It was possible to trigger a REQUIRE when a - validation was cancelled. [RT #17106] + validation was canceled. [RT #17106] 2237. [bug] libbind: res_init() was not thread aware. [RT #17123] 2236. [bug] dnssec-signzone failed to preserve the case of of wildcard owner names. [RT #17085] -2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134] - +2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134] + 2229. [bug] Null pointer dereference on query pool creation - failure. [RT #17133] - + failure. [RT #17133] + 2232. [bug] dns_adb_findaddrinfo() could fail and return ISC_R_SUCCESS. [RT #17137] @@ -230,10 +470,10 @@ 2227. [cleanup] Tidied up the FAQ. [RT #17121] -2226. [bug] Fix build error. [RT #17124] +2226. [bug] Fix build error. [RT #17124] 2225. [bug] More support for systems with no IPv4 addresses. - [RT #17111] + [RT #17111] 2224. [bug] Defer journal compaction if a xfrin is in progress. [RT #17119] @@ -247,12 +487,12 @@ 2220. [bug] win32: Address a race condition in final shutdown of the Windows socket code. [RT #17028] - + 2218. [bug] Remove unnecessary REQUIRE from dns_validator_create(). [RT #16976] 2216. [cleanup] Fix a number of errors reported by Coverity. - [RT #17094] + [RT #17094] 2214. [bug] Deregister OpenSSL lock callback when cleaning up. [RT #17098] @@ -297,7 +537,7 @@ 2187. [bug] query_addds(), query_addwildcardproof() and query_addnxrrsetnsec() should take a version - arguement. [RT #16368] + argument. [RT #16368] 2186. [port] cygwin: libbind: check for struct sockaddr_storage independently of IPv6. [RT #16482] @@ -324,7 +564,7 @@ debug level 10+. [RT #16798] 2176. [contrib] dbus update to handle race condition during - initialisation (Bugzilla 235809). [RT #16842] + initialization (Bugzilla 235809). [RT #16842] 2175. [bug] win32: windows broadcast condition variable support was broken. [RT #16592] @@ -444,7 +684,7 @@ 2111. [bug] Fix a number of errors reported by Coverity. [RT #16507] -2110. [bug] "minimal-response yes;" interacted badly with BIND 8 +2110. [bug] "minimal-responses yes;" interacted badly with BIND 8 priming queries. [RT #16491] 2109. [port] libbind: silence aix 5.3 compiler warnings. [RT #16502] @@ -453,7 +693,7 @@ 2203. [security] Query id generation was cryptographically weak. [RT # 16915] - + 2193. [port] win32: BINDInstall.exe is now linked statically. [RT #16906] @@ -463,7 +703,7 @@ --- 9.3.4 released --- -2126. [security] Serialise validation of type ANY responses. [RT #16555] +2126. [security] Serialize validation of type ANY responses. [RT #16555] 2124. [security] It was possible to dereference a freed fetch context. [RT #16584] @@ -477,14 +717,14 @@ 2103. [port] Add /usr/sfw to list of locations for OpenSSL under Solaris. -2102. [port] Silence solaris 10 warnings. +2102. [port] Silence Solaris 10 warnings. 2101. [bug] OpenSSL version checks were not quite right. [RT #16476] 2100. [port] win32: copy libeay32.dll to Build\Debug. -2099. [port] win32: more manifiest issues. +2099. [port] win32: more manifest issues. --- 9.3.3rc3 released --- @@ -493,12 +733,12 @@ 2095. [port] libbind: alway prototype inet_cidr_ntop_ipv6() and net_cidr_ntop_ipv6(). [RT #16388] - + 2094. [contrib] Update named-bootconf. [RT# 16404] 2092. [bug] win32: dig, host, nslookup. Use registry config if resolv.conf does not exist or no nameservers - listed. [RT #15877] + listed. [RT #15877] 2091. [port] dighost.c: race condition on cleanup. [RT #16417] @@ -588,7 +828,7 @@ [RT #16287] 2049. [bug] Restore SOA before AXFR when falling back from - a attempted IXFR when transfering in a zone. + a attempted IXFR when transferring in a zone. Allow a initial SOA query before attempting a AXFR to be requested. [RT #16156] @@ -597,7 +837,7 @@ the OS always returned the same local port. [RT #16182] -2047. [bug] Failed to initialise the interface flags to zero. +2047. [bug] Failed to initialize the interface flags to zero. [RT #16245] 2043. [port] nsupdate/nslookup: Force the flushing of the prompt @@ -626,7 +866,7 @@ 2029. [bug] host printed out the server multiple times when specified on the command line. [RT #15992] -2028. [port] linux: socket.c compatability for old systems. +2028. [port] linux: socket.c compatibility for old systems. [RT #16015] 2027. [port] libbind: Solaris x86 support. [RT #16020] @@ -634,7 +874,7 @@ 2026. [bug] Rate limit the two recursive client exceeded messages. [RT #16044] -2024. [bug] named emited spurious "zone serial unchanged" +2024. [bug] named emitted spurious "zone serial unchanged" messages on reload. [RT #16027] 2023. [bug] "make install" should create ${localstatedir}/run and @@ -647,7 +887,7 @@ 2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully. [RT #15941] -2009. [bug] libbind: coverity fixes. [RT #15808] +2009. [bug] libbind: Coverity fixes. [RT #15808] 2005. [bug] libbind: Retransmission timeouts should be based on which attempt it is to the nameserver @@ -679,16 +919,16 @@ 1994. [port] OpenSSL 0.9.8 support. [RT #15694] -1993. [bug] Log messsage, via syslog, were missing the space +1993. [bug] Log messages, via syslog, were missing the space after the timestamp if "print-time yes" was specified. [RT #15844] 1991. [cleanup] The configuration data, once read, should be treated - as readonly. Expand the use of const to enforce this + as read only. Expand the use of const to enforce this at compile time. [RT #15813] 1990. [bug] libbind: isc's override of broken gettimeofday() - implementions was not always effective. + implementations was not always effective. [RT #15709] 1989. [bug] win32: don't check the service password when @@ -703,7 +943,7 @@ server for the zone. Also any zones that contain DLV records should be removed when upgrading a slave zone. You do not however have to upgrade all - servers for a zone with DLV records simultaniously. + servers for a zone with DLV records simultaneously. 1982. [bug] DNSKEY was being accepted on the parent side of a delegation. KEY is still accepted there for @@ -728,7 +968,7 @@ 1974. [doc] List each of the zone types and associated zone options separately in the ARM. -1972. [contrib] DBUS dynamic forwarders integation from +1972. [contrib] DBUS dynamic forwarders integration from Jason Vas Dias . 1971. [port] linux: make detection of missing IF_NAMESIZE more @@ -745,7 +985,7 @@ 1966. [bug] Don't set CD when we have fallen back to plain DNS. [RT #15727] -1963. [port] Tru64 4.0E doesn't support send() and recv(). +1963. [port] Tru64 4.0E doesn't support send() and recv(). [RT #15586] 1962. [bug] Named failed to clear old update-policy when it @@ -767,7 +1007,7 @@ by native compiler. See README for additional cross compile support information. [RT #15148] -1955. [bug] Pre-allocate the cache cleaning interator. [RT #14998] +1955. [bug] Pre-allocate the cache cleaning iterator. [RT #14998] 1952. [port] hpux: tell the linker to build a runtime link path "-Wl,+b:". [RT #14816]. @@ -775,7 +1015,7 @@ 1951. [security] Drop queries from particular well known ports. Don't return FORMERR to queries from particular well known ports. [RT #15636] - + 1950. [port] Solaris 2.5.1 and earlier cannot bind() then connect() a TCP socket. This prevents the source address being set for TCP connections. [RT #15628] @@ -803,7 +1043,7 @@ 1940. [bug] Fixed a number of error conditions reported by Coverity. -1939. [bug] The resolver could dereference a null pointer after +1939. [bug] The resolver could dereference a null pointer after validation if all the queries have timed out. [RT #15528] @@ -848,7 +1088,7 @@ 1914. [protocol] DS is required to accept mnemonic algorithms (RFC 4034). Still emit numeric algorithms for - compatability with RFC 3658. [RT #15354] + compatibility with RFC 3658. [RT #15354] 1911. [bug] Update windows socket code. [RT #14965] @@ -892,7 +1132,7 @@ 1881. [func] Add a system test for named-checkconf. [RT #14931] 1877. [bug] Fix unreasonably low quantum on call to - dns_rbt_destroy2(). Remove unnecessay unhash_node() + dns_rbt_destroy2(). Remove unnecessary unhash_node() call. [RT #14919] 1875. [bug] process_dhtkey() was using the wrong memory context @@ -951,24 +1191,24 @@ 1850. [bug] Memory leak in lwres_getipnodebyaddr(). [RT #14591] 1849. [doc] All forms of the man pages (docbook, man, html) should - have consistant copyright dates. + have consistent copyright dates. 1848. [bug] Improve SMF integration. [RT #13238] 1847. [bug] isc_ondestroy_init() is called too late in - dns_rbtdb_create()/dns_rbtdb64_create(). + dns_rbtdb_create()/dns_rbtdb64_create(). [RT #13661] - + 1846. [contrib] query-loc-0.3.0 from Stephane Bortzmeyer . -1845. [bug] Improve error reporting to distingish between +1845. [bug] Improve error reporting to distinguish between accept()/fcntl() and socket()/fcntl() errors. [RT #13745] 1844. [bug] inet_pton() accepted more that 4 hexadecimal digits for each 16 bit piece of the IPv6 address. The text - representation of a IPv6 address has been tighted + representation of a IPv6 address has been tightened to disallow this (draft-ietf-ipv6-addr-arch-v4-02.txt). [RT #5662] @@ -1026,7 +1266,7 @@ 1822. [bug] check-names test for RT was reversed. [RT #13382] -1821. [doc] acls definitions are no longer required to be +1821. [doc] acls definitions are no longer required to be in named.conf prior to reference. They can be defined after being referenced. @@ -1052,7 +1292,7 @@ 1807. [bug] When forwarding (forward only) set the active domain from the forward zone name. [RT #13526] - + 1804. [bug] Ensure that if we are queried for glue that it fits in the additional section or TC is set to tell the client to retry using TCP. [RT #10114] @@ -1165,7 +1405,7 @@ 1765. [bug] configure --with-openssl=auto failed. [RT #12937] 1764. [bug] dns_zone_replacedb failed to emit a error message - if there was no SOA record in the replacment db. + if there was no SOA record in the replacement db. [RT #13016] 1762. [bug] isc_interfaceiter_create() could return ISC_R_SUCCESS @@ -1180,7 +1420,7 @@ 1759. [bug] Named failed to startup if the OS supported IPv6 but had no IPv6 interfaces configured. [RT #12942] -1754. [bug] We wern't always attempting to query the parent +1754. [bug] We weren't always attempting to query the parent server for the DS records at the zone cut. [RT #12774] @@ -1199,7 +1439,7 @@ 1749. [bug] 'check-names response ignore;' failed to ignore. [RT #12866] -1747. [bug] BIND 8 compatability: named/named-checkconf failed +1747. [bug] BIND 8 compatibility: named/named-checkconf failed to parse "host-statistics-max" in named.conf. 1745. [bug] Dig/host/nslookup accept replies from link locals @@ -1213,7 +1453,7 @@ requested number of worker threads then destruction of the manager would trigger an INSIST() failure. [RT #12790] - + 1742. [bug] Deleting all records at a node then adding a previously existing record, in a single UPDATE transaction, failed to leave / regenerate the @@ -1224,7 +1464,7 @@ 1740. [bug] Replace rbt's hash algorithm as it performed badly with certain zones. [RT #12729] - + NOTE: a hash context now needs to be established via isc_hash_create() if the application was not already doing this. @@ -1239,7 +1479,7 @@ 1736. [bug] dst_key_fromnamedfile() could fail to read a public key. [RT #12687] - + 1735. [bug] 'dig +sigtrace' could die with a REQUIRE failure. [RE #12688] @@ -1277,7 +1517,7 @@ [RT #12519] 1721. [bug] Error message from the journal processing were not - always identifing the relevent journal. [RT #12519] + always identifying the relevant journal. [RT #12519] 1720. [bug] 'dig +chase' did not terminate on a RFC 2308 Type 1 negative response. [RT #12506] @@ -1330,7 +1570,7 @@ 1703. [bug] named would loop sending NOTIFY messages when it failed to receive a response. [RT #12322] -1702. [bug] also-notify should not be applied to builtin zones. +1702. [bug] also-notify should not be applied to built in zones. [RT #12323] 1701. [doc] A minimal named.conf man page. @@ -1402,7 +1642,7 @@ 1675. [bug] named would sometimes add extra NSEC records to the authority section. - + 1674. [port] linux: increase buffer size used to scan /proc/net/if_inet6. @@ -1473,7 +1713,7 @@ 1648. [func] Update dnssec-lookaside named.conf syntax to support multiple dnssec-lookaside namespaces (not yet - implemented). + implemented). 1647. [bug] It was possible trigger a INSIST when chasing a DS record that required walking back over a empty node. @@ -1486,7 +1726,7 @@ masters with keys are specified. 1644. [bug] Update the journal modification time after a - sucessfull refresh query. [RT #11436] + successful refresh query. [RT #11436] 1643. [bug] dns_db_closeversion() could leak memory / node references. [RT #11163] @@ -1505,11 +1745,11 @@ 1638. [bug] "ixfr-from-differences" could generate a REQUIRE failure if the journal open failed. [RT #11347] - + 1637. [bug] Node reference leak on error in addnoqname(). 1636. [bug] The dump done callback could get ISC_R_SUCCESS even if - a error had occured. The database version no longer + a error had occurred. The database version no longer matched the version of the database that was dumped. 1635. [bug] Memory leak on error in query_addds(). @@ -1542,7 +1782,7 @@ 1625. [bug] named failed to load/transfer RFC2535 signed zones which contained CNAMES. [RT# 11237] -1606. [bug] DLV insecurity proof was failing. +1606. [bug] DLV insecurity proof was failing. 1605. [func] New dns_db_find() option DNS_DBFIND_COVERINGNSEC. @@ -1618,14 +1858,14 @@ 1604. [bug] A xfrout_ctx_create() failure would result in xfrout_ctx_destroy() being called with a partially initialized structure. - + 1603. [bug] nsupdate: set interactive based on isatty(). [RT# 10929] 1602. [bug] Logging to a file failed unless a size was specified. [RT# 10925] -1601. [bug] Silence spurious warning 'both "recursion no;" and +1601. [bug] Silence spurious warning 'both "recursion no;" and "allow-recursion" active' warning from view "_bind". [RT# 10920] @@ -1860,7 +2100,7 @@ type, class and responding nameserver. 1511. [bug] delegation-only was generating false positives - on negative answers from subzones. + on negative answers from sub-zones. 1510. [func] New view option "root-delegation-only". Apply delegation-only check to all TLDs and root. @@ -3568,7 +3808,7 @@ 954. [bug] When requesting AXFRs or IXFRs using dig, host, or nslookup, the RD bit should not be set as zone - transfers are inherently nonrecursive. [RT #1575] + transfers are inherently non-recursive. [RT #1575] 953. [func] The /var/run/named.key file from change #843 has been replaced by /etc/rndc.key. Both @@ -3841,7 +4081,7 @@ 860. [func] Drop cross class glue in zone transfers. 859. [bug] Cache cleaning now won't swamp the CPU if there - is a persistent overlimit condition. + is a persistent over limit condition. 858. [func] isc_mem_setwater() no longer requires that when the callback function is non-NULL then its hi_water @@ -4017,7 +4257,7 @@ 811. [bug] Parentheses were not quoted in zone dumps. [RT #1194] 810. [bug] The signer name in SIG records was not properly - downcased when signing/verifying records. [RT #1186] + down-cased when signing/verifying records. [RT #1186] 809. [bug] Configuring a non-local address as a transfer-source could cause an assertion failure during load. @@ -4029,9 +4269,9 @@ ignored like it should be. 806. [bug] DNS_R_SEENINCLUDE was failing to propagate back up - the calling stack to the zone maintence level, causing - zones to not reload when an included file was touched - but the top-level zone file was not. + the calling stack to the zone maintenance level, + causing zones to not reload when an included file was + touched but the top-level zone file was not. 805. [bug] When using "forward only", missing root hints should not cause queries to fail. [RT #1143] @@ -4071,7 +4311,7 @@ in rndc.conf. 793. [cleanup] The DNSSEC tools could create filenames that were - illegal or contained shell metacharacters. They + illegal or contained shell meta-characters. They now use a different text encoding of names that doesn't have these problems. [RT #1101] @@ -4095,7 +4335,7 @@ names when mapping them into file names. 786. [bug] When DNSSEC signing/verifying data, owner names were - not properly downcased. + not properly down-cased. 785. [bug] A race condition in the resolver could cause an assertion failure. [RT #673, #872, #1048] @@ -4114,7 +4354,7 @@ 780. [bug] Error handling code dealing with out of memory or other rare errors could lead to assertion failures - by calling functions on unitialized names. [RT #1065] + by calling functions on uninitialized names. [RT #1065] 779. [func] Added the "minimal-responses" option. @@ -4257,7 +4497,7 @@ 735. [doc] Add BIND 4 migration notes. 734. [bug] An attempt to re-lock the zone lock could occur if - the server was shutdown during a zone tranfer. + the server was shutdown during a zone transfer. [RT #830] 733. [bug] Reference counts of dns_acl_t objects need to be @@ -4397,7 +4637,7 @@ 688. [func] "make tags" now works on systems with the "Exuberant Ctags" etags. - 687. [bug] Only say we have IPv6, with sufficent functionality, + 687. [bug] Only say we have IPv6, with sufficient functionality, if it has actually been tested. [RT #586] 686. [bug] dig and nslookup can now be properly aborted during @@ -4713,7 +4953,7 @@ --- 9.1.0b1 released --- 591. [bug] Work around non-reentrancy in openssl by disabling - precomputation in keys. + pre-computation in keys. 590. [doc] There are now man pages for the lwres library in doc/man/lwres. @@ -4762,7 +5002,7 @@ source address for notify messages. 577. [func] Log illegal RDATA combinations. e.g. multiple - singlton types, cname and other data. + singleton types, cname and other data. 576. [doc] isc_log_create() description did not match reality. @@ -4773,7 +5013,7 @@ have their responses validated and would leak memory. 573. [bug] The journal files of IXFRed slave zones were - inadvertantly discarded on server reload, causing + inadvertently discarded on server reload, causing "journal out of sync with zone" errors on subsequent reloads. [RT #482] @@ -4938,7 +5178,7 @@ others). 519. [bug] dns_name_split() would improperly split some bitstring - labels, zeroing a few of the least signficant bits in + labels, zeroing a few of the least significant bits in the prefix part. When such an improperly created prefix was returned to the RBT database, the bogus label was dutifully stored, corrupting the tree. @@ -4966,7 +5206,7 @@ 513. [func] New functionality added to rdnc and server to allow individual zones to be refreshed or reloaded. - 512. [bug] The zone transfer code could throw an execption with + 512. [bug] The zone transfer code could throw an exception with an invalid IXFR stream. 511. [bug] The message code could throw an assertion on an @@ -5157,7 +5397,7 @@ 452. [bug] Warn if the unimplemented option "statistics-file" is specified in named.conf. [RT #301] - 451. [func] Update forwarding implememted. + 451. [func] Update forwarding implemented. 450. [func] New function ns_client_sendraw(). @@ -5258,7 +5498,7 @@ e.g. due to corrupt zones with multiple SOA records. [RT #279] - 423. [bug] When responding to a recusive query, errors that occur + 423. [bug] When responding to a recursive query, errors that occur after following a CNAME should cause the query to fail. [RT #274] @@ -5303,7 +5543,7 @@ 409. [bug] If named was shut down early in the startup process, ns_omapi_shutdown() would attempt to lock - an unintialized mutex. [RT #262] + an uninitialized mutex. [RT #262] 408. [bug] stub zones could leak memory and reference counts if all the masters were unreachable. @@ -5370,7 +5610,7 @@ making the functions dns_zone_adddbarg() and dns_zone_cleardbargs() unnecessary. - 389. [bug] Attempting to send a reqeust over IPv6 using + 389. [bug] Attempting to send a request over IPv6 using dns_request_create() on a system without IPv6 support caused an assertion failure [RT #235]. @@ -5427,7 +5667,7 @@ of a very large RRset could cause an assertion failure during logging. - 370. [bug] The error messages for rollforward failures were + 370. [bug] The error messages for roll-forward failures were overly terse. 369. [func] Support new named.conf options, view and zone @@ -5569,7 +5809,7 @@ 328. [func] Added isc_base64_decodestring(). - 327. [bug] rndc.conf parser wasn't correctly recognising an IP + 327. [bug] rndc.conf parser wasn't correctly recognizing an IP address where a host specification was required. 326. [func] 'keys' in an 'inet' control statement is now @@ -5599,7 +5839,7 @@ where they previously didn't. 321. [bug] When synthesizing a CNAME RR for a DNAME - response, query_addcname() failed to intitialize + response, query_addcname() failed to initialize the type and class of the CNAME dns_rdata_t, causing random failures. @@ -5875,7 +6115,7 @@ --- 9.0.0b4 released --- - 253. [func] resolv.conf parser now recognises ';' and '#' as + 253. [func] resolv.conf parser now recognizes ';' and '#' as comments (anywhere in line, not just as the beginning). 252. [bug] resolv.conf parser mishandled masks on sortlists. @@ -5945,7 +6185,7 @@ requiring a quoted string. 233. [cleanup] Convert all config structure integer values to unsigned - integer (isc_uint32_t) to match grammer. + integer (isc_uint32_t) to match grammar. 232. [bug] Allow slave zones to not have a file. @@ -5982,7 +6222,7 @@ from confparser.c, because of yacc's code, are unfortunately to be expected.) - 223. [func] Several functions were reprototyped to qualify one + 223. [func] Several functions were re-prototyped to qualify one or more of their arguments with "const". Similarly, several functions that return pointers now have those pointers qualified with const. @@ -6148,7 +6388,7 @@ 183. [func] ISC_LOG_PRINTTAG option for log channels. Useful for logging the program name or other identifier. - 182. [cleanup] New commandline parameters for dnssec tools + 182. [cleanup] New command-line parameters for dnssec tools 181. [func] Added dst_key_buildfilename and dst_key_parsefilename @@ -6193,7 +6433,7 @@ --with-mit-pthreads option is no longer needed and has been removed. - 170. [cleanup] Remove inter server consistancy checks from zone, + 170. [cleanup] Remove inter server consistency checks from zone, these should return as a separate module in 9.1. dns_zone_checkservers(), dns_zone_checkparents(), dns_zone_checkchildren(), dns_zone_checkglue(). @@ -6286,7 +6526,7 @@ than continuing to itemize every header which changed, this changelog entry just notes that if a header file did not need another header file that it was including - in order to provide its advertized functionality, the + in order to provide its advertised functionality, the inclusion of the other header file was removed. See util/check-includes for how this was tested. @@ -6678,7 +6918,7 @@ 31. [bug] Use ${LIBTOOL} to compile bin/named/main.@O@. - 30. [func] config file grammer change to support optional + 30. [func] config file grammar change to support optional class type for a view. 29. [func] support new config file view options: @@ -6742,7 +6982,7 @@ 13. [bug] lib/dns/master.c and lib/dns/xfrin.c didn't ignore out-of-zone data. - 12. [bug] Fixed possible unitialized variable error. + 12. [bug] Fixed possible uninitialized variable error. 11. [bug] axfr_rrstream_first() didn't check the result code of db_rr_iterator_first(), possibly causing an assertion diff --git a/FAQ b/FAQ index e6b2ff27cefa3..2c333bef3b241 100644 --- a/FAQ +++ b/FAQ @@ -205,6 +205,8 @@ A: These indicate a malformed master zone. You can identify the exact Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is the last line of named.conf. +A: There are unbalanced quotes in named.conf. + A: Some text editors (notepad and wordpad) fail to put a line title indication (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a blank line to the end of the file. Named expects to @@ -375,7 +377,60 @@ A: When reloading a zone named my have multiple copies of the zone in other errors in the master file as it still has an in-core copy of the old contents. -3. General Questions +Q: I want to use IPv6 locally but I don't have a external IPv6 connection. + External lookups are slow. + +A: You can use server clauses to stop named making external lookups over + IPv6. + + server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix + server ::/0 { bogus yes; }; + +3. Operations Questions + +Q: How to change the nameservers for a zone? + +A: Step 1: Ensure all nameservers, new and old, are serving the same zone + content. + + Step 2: Work out the maximum TTL of the NS RRset in the parent and + child zones. This is the time it will take caches to be clear of a + particular version of the NS RRset. If you are just removing + nameservers you can skip to Step 6. + + Step 3: Add new nameservers to the NS RRset for the zone and wait until + all the servers for the zone are answering with this new NS RRset. + + Step 4: Inform the parent zone of the new NS RRset then wait for all + the parent servers to be answering with the new NS RRset. + + Step 5: Wait for cache to be clear of the old NS RRset. See Step 2 for + how long. If you are just adding nameservers you are done. + + Step 6: Remove any old nameservers from the zones NS RRset and wait for + all the servers for the zone to be serving the new NS RRset. + + Step 7: Inform the parent zone of the new NS RRset then wait for all + the parent servers to be answering with the new NS RRset. + + Step 8: Wait for cache to be clear of the old NS RRset. See Step 2 for + how long. + + Step 9: Turn off the old nameservers or remove the zone entry from the + configuration of the old nameservers. + + Step 10: Increment the serial number and wait for the change to be + visible in all nameservers for the zone. This ensures that zone + transfers are still working after the old servers are decommissioned. + + Note: the above procedure is designed to be transparent to dns clients. + Decommissioning the old servers too early will result in some clients + not being able to look up answers in the zone. + + Note: while it is possible to run the addition and removal stages + together it is not recommended. + +4. General Questions Q: I keep getting log messages like the following. Why? @@ -396,8 +451,8 @@ A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update protocol. Windows 2000 machines have a habit of sending dynamic update requests to DNS servers without being specifically configured to do so. If the update requests are coming from a Windows 2000 machine, - see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for - information about how to turn them off. + see + for information about how to turn them off. Q: When I do a "dig . ns", many of the A records for the root servers are missing. Why? @@ -468,7 +523,7 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are using then you have failed to follow RFC 1918 usage rules and are leaking queries to the Internet. You should establish your own zones for these addresses to prevent you querying the Internet's name servers - for these addresses. Please see http://as112.net/ for details of the + for these addresses. Please see for details of the problems you are causing and the counter measures that have had to be deployed. @@ -541,9 +596,16 @@ A: No. The BIND 9 bug database is kept closed for a number of reasons. that have been fixed post release. That is as close as we can get to providing a bug database. -4. Operating-System Specific Questions +Q: Why do queries for NSEC3 records fail to return the NSEC3 record? -4.1. HPUX +A: NSEC3 records are strictly meta data and can only be returned in the + authority section. This is done so that signing the zone using NSEC3 + records does not bring names into existance that do not exist in the + unsigned version of the zone. + +5. Operating-System Specific Questions + +5.1. HPUX Q: I get the following error trying to configure BIND: @@ -559,7 +621,7 @@ A: You have attempted to configure BIND with the bundled C compiler. This ./configure CC= ... -4.2. Linux +5.2. Linux Q: Why do I get the following errors: @@ -569,7 +631,20 @@ Q: Why do I get the following errors: A: This is the result of a Linux kernel bug. - See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2 + See: + +Q: Why does named lock up when it attempts to connect over IPSEC tunnels? + +A: This is due to a kernel bug where the fact that a socket is marked + non-blocking is ignored. It is reported that setting xfrm_larval_drop + to 1 helps but this may have negative side effects. See: and . + + xfrm_larval_drop can be set to 1 by the following procedure: + + echo "1" > proc/sys/net/core/xfrm_larval_drop Q: Why do I see 5 (or more) copies of named on Linux? @@ -613,7 +688,7 @@ Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core - A: Red Hat Security Enhanced Linux (SELinux) policy security protections : Red Hat have adopted the National Security Agency's SELinux security - policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND + policy (see ) and recommendations for BIND security , which are more secure than running named in a chroot and make use of the bind-chroot environment unnecessary . @@ -716,7 +791,7 @@ A: This is usually due to "/proc/net/if_inet6" not being available in the proc /proc proc defaults 0 0 proc /var/named/proc proc defaults 0 0 -4.3. Windows +5.3. Windows Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why? @@ -742,7 +817,7 @@ A: This is the service manager saying that named exited. You need to Directory "C:\windows\dns\etc"; }; -4.4. FreeBSD +5.4. FreeBSD Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there. @@ -753,17 +828,17 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to /etc/rc.conf rand_irqs="3 14 15" - See also http://people.freebsd.org/~dougb/randomness.html + See also . -4.5. Solaris +5.5. Solaris Q: How do I integrate BIND 9 and Solaris SMF A: Sun has a blog entry describing how to do this. - http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + -4.6. Apple Mac OS X +5.6. Apple Mac OS X Q: How do I run BIND 9 on Apple Mac OS X? diff --git a/FAQ.xml b/FAQ.xml index 818390b5a8014..5c36f3b5e0ca2 100644 --- a/FAQ.xml +++ b/FAQ.xml @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - +
Frequently Asked Questions about BIND 9 @@ -391,6 +391,11 @@ named-checkzone example.com tmp of input where 99 is the last line of named.conf. + + + There are unbalanced quotes in named.conf. + + Some text editors (notepad and wordpad) fail to put a line @@ -661,9 +666,98 @@ zone "list.dsbl.org" { + + + + + I want to use IPv6 locally but I don't have a external IPv6 + connection. External lookups are slow. + + + + + You can use server clauses to stop named making external lookups + over IPv6. + + +server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix +server ::/0 { bogus yes; }; + + + + Operations Questions + + + + + How to change the nameservers for a zone? + + + + + Step 1: Ensure all nameservers, new and old, are serving the + same zone content. + + + Step 2: Work out the maximum TTL of the NS RRset in the parent and child + zones. This is the time it will take caches to be clear of a + particular version of the NS RRset. + If you are just removing nameservers you can skip to Step 6. + + + Step 3: Add new nameservers to the NS RRset for the zone and + wait until all the servers for the zone are answering with this + new NS RRset. + + + Step 4: Inform the parent zone of the new NS RRset then wait for all the + parent servers to be answering with the new NS RRset. + + + Step 5: Wait for cache to be clear of the old NS RRset. + See Step 2 for how long. + If you are just adding nameservers you are done. + + + Step 6: Remove any old nameservers from the zones NS RRset and + wait for all the servers for the zone to be serving the new NS RRset. + + + Step 7: Inform the parent zone of the new NS RRset then wait for all the + parent servers to be answering with the new NS RRset. + + + Step 8: Wait for cache to be clear of the old NS RRset. + See Step 2 for how long. + + + Step 9: Turn off the old nameservers or remove the zone entry from + the configuration of the old nameservers. + + + Step 10: Increment the serial number and wait for the change to + be visible in all nameservers for the zone. This ensures that + zone transfers are still working after the old servers are + decommissioned. + + + Note: the above procedure is designed to be transparent + to dns clients. Decommissioning the old servers too early + will result in some clients not being able to look up + answers in the zone. + + + Note: while it is possible to run the addition and removal + stages together it is not recommended. + + + + + + General Questions @@ -706,8 +800,7 @@ zone "list.dsbl.org" { requests are coming from a Windows 2000 machine, see - http://support.microsoft.com/support/kb/articles/q246/8/04.asp - + <http://support.microsoft.com/support/kb/articles/q246/8/04.asp> for information about how to turn them off. @@ -857,7 +950,7 @@ serial-query-rate 5; // default 20 usage rules and are leaking queries to the Internet. You should establish your own zones for these addresses to prevent you querying the Internet's name servers for these addresses. - Please see http://as112.net/ + Please see <http://as112.net/> for details of the problems you are causing and the counter measures that have had to be deployed. @@ -963,6 +1056,23 @@ empty: + + + + Why do queries for NSEC3 records fail to return the NSEC3 record? + + + + + NSEC3 records are strictly meta data and can only be + returned in the authority section. This is done so that + signing the zone using NSEC3 records does not bring names + into existance that do not exist in the unsigned version + of the zone. + + + + Operating-System Specific Questions @@ -1010,7 +1120,31 @@ client: UDP client handler shutting down due to fatal receive error: unexpected See: - http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2 + <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2> + + + + + + + + Why does named lock up when it attempts to connect over IPSEC tunnels? + + + + + This is due to a kernel bug where the fact that a socket is marked + non-blocking is ignored. It is reported that setting + xfrm_larval_drop to 1 helps but this may have negative side effects. + See: +<https://bugzilla.redhat.com/show_bug.cgi?id=427629> + and +<http://lkml.org/lkml/2007/12/4/260>. + + + xfrm_larval_drop can be set to 1 by the following procedure: + +echo "1" > proc/sys/net/core/xfrm_larval_drop @@ -1101,8 +1235,9 @@ modprobe capability Red Hat have adopted the National Security Agency's - SELinux security policy ( see http://www.nsa.gov/selinux - ) and recommendations for BIND security , which are more + SELinux security policy (see <http://www.nsa.gov/selinux>) + and recommendations for BIND security , which are more secure than running named in a chroot and make use of the bind-chroot environment unnecessary . @@ -1341,8 +1476,7 @@ rand_irqs="3 14 15" See also - http://people.freebsd.org/~dougb/randomness.html - + <http://people.freebsd.org/~dougb/randomness.html>. @@ -1364,7 +1498,7 @@ rand_irqs="3 14 15" - http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris> diff --git a/README b/README index 709df1267ae46..c30934f8f8cd7 100644 --- a/README +++ b/README @@ -43,6 +43,14 @@ BIND 9 Nominum, Inc. +BIND 9.3.6 + + BIND 9.3.6 is a maintenance release, containing fixes for + a number of bugs in previous releases. + + The major change since 9.3.5 is query port randomization, + to improve resilience against cache poisoning attacks. + BIND 9.3.2 BIND 9.3.2 is a maintenance release, containing fixes for @@ -145,7 +153,7 @@ BIND 9.2.0 This does not apply to the use of TSIG, which does not require OpenSSL. - - The source distribution now builds on Windows NT/2000. + - The source distribution now builds on Windows. See win32utils/readme1.txt and win32utils/win32-build.txt for details. @@ -194,11 +202,8 @@ BIND 9.2.0 --with-libtool does not work on AIX. - --with-libtool does not work on SunOS 4. configure - requires "printf" which is not available. - - A bug in the Windows 2000 DNS server can cause zone transfers - from a BIND 9 server to a W2K server to fail. For details, + A bug in some versions of the Microsoft DNS server can cause zone + transfers from a BIND 9 server to a W2K server to fail. For details, see the "Zone Transfers" section in doc/misc/migration. For a detailed list of user-visible changes from @@ -218,7 +223,11 @@ Building NetBSD 1.5 Slackware Linux 8.1 Solaris 8, 9, 9 (x86) - Windows NT/2000/XP/2003 + Windows XP/2003/2008 + + NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of + Windows, including Windows NT and Windows 2000, are no longer + supported. Additionally, we have unverified reports of success building previous versions of BIND 9 from users of the following systems: @@ -270,6 +279,10 @@ Building -DDIG_SIGCHASE_BU=1) Disable dropping queries from particular well known ports. -DNS_CLIENT_DROPPORT=0 + Enable workaround for Solaris kernel bug about /dev/poll + -DISC_SOCKET_USE_POLLWATCH=1 + The watch timeout is also configurable, e.g., + -DISC_SOCKET_POLLWATCH_TIMEOUT=20 LDFLAGS Linker flags. Defaults to empty string. @@ -298,6 +311,10 @@ Building To build libbind (the BIND 8 resolver library), specify "--enable-libbind" on the configure command line. + On some platforms it is necessary to explictly request large + file support to handle files bigger than 2GB. This can be + done by "--enable-largefile" on the configure command line. + On some platforms, BIND 9 can be built with multithreading support, allowing it to take advantage of multiple CPUs. You can specify whether to build a multithreaded BIND 9 @@ -347,6 +364,9 @@ Building on your system, and some require Perl; see bin/tests/system/README for details. + SunOS 4 requires "printf" to be installed to make the shared + libraries. sh-utils-1.16 provides a "printf" which compiles + on SunOS 4. Documentation diff --git a/bin/dig/dig.1 b/bin/dig/dig.1 index a5f5ff3c04a38..346e45d80362f 100644 --- a/bin/dig/dig.1 +++ b/bin/dig/dig.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dig.1,v 1.14.2.4.2.18 2007/05/16 06:10:54 marka Exp $ +.\" $Id: dig.1,v 1.14.2.4.2.20 2008/10/14 01:20:30 tbox Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ dig \- DNS lookup utility .SH "SYNOPSIS" .HP 4 -\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...] +\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...] .HP 4 \fBdig\fR [\fB\-h\fR] .HP 4 @@ -59,7 +59,9 @@ Unless it is told to query a specific name server, will try each of the servers listed in \fI/etc/resolv.conf\fR. .PP -When no command line arguments or options are given, will perform an NS query for "." (the root). +When no command line arguments or options are given, +\fBdig\fR +will perform an NS query for "." (the root). .PP It is possible to set per\-user defaults for \fBdig\fR @@ -70,7 +72,7 @@ The IN and CH class names overlap with the IN and CH top level domains names. Ei \fB\-t\fR and \fB\-c\fR -options to specify the type and class or use "IN." and "CH." when looking up these top level domains. +options to specify the type and class, or use "IN." and "CH." when looking up these top level domains. .SH "SIMPLE USAGE" .PP A typical invocation of @@ -137,6 +139,10 @@ operate in batch mode by reading a list of lookup requests to process from the f \fBdig\fR using the command\-line interface. .PP +The +\fB\-m\fR +option enables memory usage debugging. +.PP If a non\-standard port number is to be queried, the \fB\-p\fR option is used. @@ -517,7 +523,7 @@ RFC1035. .PP There are probably too many query options. .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 763613dfca79b..34f0e90a3d81f 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.c,v 1.157.2.13.2.35 2007/08/28 07:19:07 tbox Exp $ */ +/* $Id: dig.c,v 1.157.2.13.2.39 2008/10/15 02:20:32 marka Exp $ */ #include #include @@ -47,7 +47,7 @@ #define ADD_STRING(b, s) { \ if (strlen(s) >= isc_buffer_availablelength(b)) \ - return (ISC_R_NOSPACE); \ + return (ISC_R_NOSPACE); \ else \ isc_buffer_putstr(b, s); \ } @@ -67,7 +67,7 @@ static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE, ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE, multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE; -static const char *opcodetext[] = { +static const char * const opcodetext[] = { "QUERY", "IQUERY", "STATUS", @@ -86,7 +86,7 @@ static const char *opcodetext[] = { "RESERVED15" }; -static const char *rcodetext[] = { +static const char * const rcodetext[] = { "NOERROR", "FORMERR", "SERVFAIL", @@ -136,8 +136,8 @@ help(void) { " q-type is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n" " (Use ixfr=version for type ixfr)\n" " q-opt is one of:\n" -" -x dot-notation (shortcut for in-addr lookups)\n" -" -i (IP6.INT reverse IPv6 lookups)\n" +" -x dot-notation (shortcut for reverse lookups)\n" +" -i (use IP6.INT for IPv6 reverse lookups)\n" " -f filename (batch mode)\n" " -b address[#port] (bind to source address/port)\n" " -p port (specify port number)\n" @@ -147,6 +147,7 @@ help(void) { " -y name:key (specify named base64 tsig key)\n" " -4 (use IPv4 query transport only)\n" " -6 (use IPv6 query transport only)\n" +" -m (enable memory usage debugging)\n" " d-opt is of the form +keyword[=value], where keyword is:\n" " +[no]vc (TCP mode)\n" " +[no]tcp (TCP mode, alternate syntax)\n" @@ -367,7 +368,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, else if (nottl || noclass) result = dns_master_stylecreate(&style, styleflags, 24, 24, 32, 40, 80, 8, mctx); - else + else result = dns_master_stylecreate(&style, styleflags, 24, 32, 40, 48, 80, 8, mctx); check_result(result, "dns_master_stylecreate"); @@ -376,7 +377,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, if (style != NULL) dns_master_styledestroy(&style, mctx); - + return(result); } #endif @@ -413,7 +414,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { else if (nottl || noclass) result = dns_master_stylecreate(&style, styleflags, 24, 24, 32, 40, 80, 8, mctx); - else + else result = dns_master_stylecreate(&style, styleflags, 24, 32, 40, 48, 80, 8, mctx); check_result(result, "dns_master_stylecreate"); @@ -613,7 +614,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) { strncat(lookup->cmdline, append, remaining); } if (first) { - snprintf(append, sizeof(append), + snprintf(append, sizeof(append), ";; global options: %s %s\n", short_form ? "short_form" : "", printcmd ? "printcmd" : ""); @@ -691,7 +692,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, FULLCHECK2("aaonly", "aaflag"); lookup->aaonly = state; break; - case 'd': + case 'd': switch (cmd[2]) { case 'd': /* additional */ FULLCHECK("additional"); @@ -776,11 +777,11 @@ plus_option(char *option, isc_boolean_t is_batchfile, FULLCHECK("defname"); usesearch = state; break; - case 'n': /* dnssec */ + case 'n': /* dnssec */ FULLCHECK("dnssec"); lookup->dnssec = state; break; - case 'o': /* domain */ + case 'o': /* domain */ FULLCHECK("domain"); if (value == NULL) goto need_value; @@ -844,7 +845,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, goto invalid_option; } break; - case 'q': + case 'q': switch (cmd[1]) { case 'r': /* qr */ FULLCHECK("qr"); @@ -907,11 +908,11 @@ plus_option(char *option, isc_boolean_t is_batchfile, break; #ifdef DIG_SIGCHASE case 'i': /* sigchase */ - FULLCHECK("sigchase"); + FULLCHECK("sigchase"); lookup->sigchase = state; if (lookup->sigchase) lookup->dnssec = ISC_TRUE; - break; + break; #endif case 't': /* stats */ FULLCHECK("stats"); @@ -939,7 +940,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, timeout = 1; break; #if DIG_SIGCHASE_TD - case 'o': /* topdown */ + case 'o': /* topdown */ FULLCHECK("topdown"); lookup->do_topdown = state; break; @@ -974,7 +975,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, #ifdef DIG_SIGCHASE case 'u': /* trusted-key */ FULLCHECK("trusted-key"); - if (value == NULL) + if (value == NULL) goto need_value; if (!state) goto invalid_option; @@ -1018,8 +1019,8 @@ static const char *single_dash_opts = "46dhimnv"; static const char *dash_opts = "46bcdfhikmnptvyx"; static isc_boolean_t dash_option(char *option, char *next, dig_lookup_t **lookup, - isc_boolean_t *open_type_class, isc_boolean_t *need_clone, - int argc, char **argv, isc_boolean_t *firstarg) + isc_boolean_t *open_type_class, isc_boolean_t *need_clone, + int argc, char **argv, isc_boolean_t *firstarg) { char opt, *value, *ptr; isc_result_t result; @@ -1107,7 +1108,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, hash = strchr(value, '#'); if (hash != NULL) { srcport = (in_port_t) - parse_uint(hash + 1, + parse_uint(hash + 1, "port number", MAXPORT); *hash = '\0'; } else @@ -1179,7 +1180,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, (*lookup)->rdtypeset = ISC_TRUE; (*lookup)->ixfr_serial = parse_uint(&value[5], "serial number", - MAXSERIAL); + MAXSERIAL); (*lookup)->section_question = plusquest; (*lookup)->comments = pluscomm; } else { @@ -1286,7 +1287,7 @@ getaddresses(dig_lookup_t *lookup, const char *host) { char tmp[ISC_NETADDR_FORMATSIZE]; result = bind9_getaddresses(host, 0, sockaddrs, - DIG_MAX_ADDRESSES, &count); + DIG_MAX_ADDRESSES, &count); if (result != ISC_R_SUCCESS) fatal("couldn't get address for '%s': %s", host, isc_result_totext(result)); @@ -1348,7 +1349,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (homedir != NULL) { unsigned int n; n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc", - homedir); + homedir); if (n < sizeof(rcfile)) batchfp = fopen(rcfile, "r"); } @@ -1402,16 +1403,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rc <= 1) { if (dash_option(&rv[0][1], NULL, &lookup, &open_type_class, - &need_clone, argc, argv, - &firstarg)) { + &need_clone, argc, argv, + &firstarg)) { rc--; rv++; } } else { if (dash_option(&rv[0][1], rv[1], &lookup, &open_type_class, - &need_clone, argc, argv, - &firstarg)) { + &need_clone, argc, argv, + &firstarg)) { rc--; rv++; } @@ -1428,7 +1429,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, tr.base = rv[0]; tr.length = strlen(rv[0]); result = dns_rdatatype_fromtext(&rdtype, - (isc_textregion_t *)&tr); + (isc_textregion_t *)&tr); if (result == ISC_R_SUCCESS && rdtype == dns_rdatatype_ixfr) { result = DNS_R_UNKNOWN; @@ -1449,8 +1450,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, lookup->rdtypeset = ISC_TRUE; lookup->ixfr_serial = parse_uint(&rv[0][5], - "serial number", - MAXSERIAL); + "serial number", + MAXSERIAL); lookup->section_question = plusquest; lookup->comments = pluscomm; @@ -1485,7 +1486,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, lookup = clone_lookup(default_lookup, ISC_TRUE); need_clone = ISC_TRUE; - strncpy(lookup->textname, rv[0], + strncpy(lookup->textname, rv[0], sizeof(lookup->textname)); lookup->textname[sizeof(lookup->textname)-1]=0; lookup->trace_root = ISC_TF(lookup->trace || diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook index 82b2516cbbe6f..8a072d191d3ab 100644 --- a/bin/dig/dig.docbook +++ b/bin/dig/dig.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -38,6 +38,7 @@ 2005 2006 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") @@ -62,6 +63,7 @@ + @@ -114,10 +116,10 @@ Unless it is told to query a specific name server, /etc/resolv.conf. - -When no command line arguments or options are given, will perform an -NS query for "." (the root). - + + When no command line arguments or options are given, + dig will perform an NS query for "." (the root). + It is possible to set per-user defaults for dig via @@ -128,7 +130,7 @@ are applied before the command line arguments. The IN and CH class names overlap with the IN and CH top level domains names. Either use the and - options to specify the type and class or + options to specify the type and class, or use "IN." and "CH." when looking up these top level domains. @@ -200,6 +202,12 @@ the same way they would be presented as queries to dig using the command-line interface. + + The option enables memory usage debugging. + + + If a non-standard port number is to be queried, the option is used. port# is diff --git a/bin/dig/dig.html b/bin/dig/dig.html index 054c1974656bd..1c18ec309aa12 100644 --- a/bin/dig/dig.html +++ b/bin/dig/dig.html @@ -1,5 +1,5 @@ - + @@ -29,12 +29,12 @@

Synopsis

-

dig [@server] [-b address] [-c class] [-f filename] [-k filename] [-p port#] [-t type] [-x addr] [-y name:key] [-4] [-6] [name] [type] [class] [queryopt...]

+

dig [@server] [-b address] [-c class] [-f filename] [-k filename] [-m] [-p port#] [-t type] [-x addr] [-y name:key] [-4] [-6] [name] [type] [class] [queryopt...]

dig [-h]

dig [global-queryopt...] [query...]

-

DESCRIPTION

+

DESCRIPTION

dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -59,9 +59,9 @@ Unless it is told to query a specific name server, /etc/resolv.conf.

-When no command line arguments or options are given, will perform an -NS query for "." (the root). -

+ When no command line arguments or options are given, + dig will perform an NS query for "." (the root). +

It is possible to set per-user defaults for dig via ${HOME}/.digrc. This file is read and any options in it @@ -70,12 +70,12 @@ are applied before the command line arguments.

The IN and CH class names overlap with the IN and CH top level domains names. Either use the -t and - -c options to specify the type and class or + -c options to specify the type and class, or use "IN." and "CH." when looking up these top level domains.

-

SIMPLE USAGE

+

SIMPLE USAGE

A typical invocation of dig looks like:

@@ -113,7 +113,7 @@ ANY, A, MX, SIG, etc.

-

OPTIONS

+

OPTIONS

The -b option sets the source IP address of the query to address. This must be a valid address on @@ -133,6 +133,10 @@ queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to dig using the command-line interface.

+

+ The -m option enables memory usage debugging. + +

If a non-standard port number is to be queried, the -p option is used. port# is @@ -194,7 +198,7 @@ being used. In BIND, this is done by providing appropriate

-

QUERY OPTIONS

+

QUERY OPTIONS

dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -452,7 +456,7 @@ Requires dig be compiled with -DDIG_SIGCHASE.

-

MULTIPLE QUERIES

+

MULTIPLE QUERIES

The BIND 9 implementation of dig supports specifying multiple queries on the command line (in addition to @@ -493,7 +497,7 @@ will not print the initial query when it looks up the NS records for

-

FILES

+

FILES

/etc/resolv.conf

@@ -502,7 +506,7 @@ will not print the initial query when it looks up the NS records for

-

SEE ALSO

+

SEE ALSO

host(1), named(8), @@ -511,7 +515,7 @@ will not print the initial query when it looks up the NS records for

-

BUGS

+

BUGS

There are probably too many query options.

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index efd24030b17fe..2c81fd433c8cb 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dighost.c,v 1.221.2.19.2.46.4.2 2008/07/23 23:16:25 marka Exp $ */ +/* $Id: dighost.c,v 1.221.2.19.2.48 2008/07/23 23:36:21 marka Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to diff --git a/bin/dig/host.1 b/bin/dig/host.1 index 2d1687a687c33..1d09af9145de7 100644 --- a/bin/dig/host.1 +++ b/bin/dig/host.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: host.1,v 1.11.2.1.4.12 2007/05/09 03:32:36 marka Exp $ +.\" $Id: host.1,v 1.11.2.1.4.13 2008/04/29 01:21:29 tbox Exp $ .\" .hy 0 .ad l @@ -154,7 +154,7 @@ option is used to select the query type. \fItype\fR can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, \fBhost\fR -automatically selects an appropriate query type. By default it looks for A records, but if the +automatically selects an appropriate query type. By default it looks for A, AAAA, and MX records, but if the \fB\-C\fR option was given, queries will be made for SOA records, and if \fIname\fR @@ -187,7 +187,7 @@ will effectively wait forever for a reply. The time to wait for a response will \fBdig\fR(1), \fBnamed\fR(8). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook index a399043403ba9..29ca7ea658f16 100644 --- a/bin/dig/host.docbook +++ b/bin/dig/host.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -37,6 +37,7 @@ 2004 2005 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") @@ -185,7 +186,7 @@ The option is used to select the query type. type can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, host automatically selects an appropriate query -type. By default it looks for A records, but if the +type. By default it looks for A, AAAA, and MX records, but if the option was given, queries will be made for SOA records, and if name is a dotted-decimal IPv4 address or colon-delimited IPv6 address, host will diff --git a/bin/dig/host.html b/bin/dig/host.html index 07c930550f454..a1786bb1c578d 100644 --- a/bin/dig/host.html +++ b/bin/dig/host.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

host [-aCdlnrTwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait] [-4] [-6] {name} [server]

-

DESCRIPTION

+

DESCRIPTION

host is a simple utility for performing DNS lookups. @@ -134,7 +134,7 @@ The -t option is used to select the query type. type can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, host automatically selects an appropriate query -type. By default it looks for A records, but if the +type. By default it looks for A, AAAA, and MX records, but if the -C option was given, queries will be made for SOA records, and if name is a dotted-decimal IPv4 address or colon-delimited IPv6 address, host will @@ -155,13 +155,13 @@ value for an integer quantity.

-

FILES

+

FILES

/etc/resolv.conf

-

SEE ALSO

+

SEE ALSO

dig(1), named(8). diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 877ac07829094..2d3215366724c 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.19.12.13 2007/05/09 03:32:36 marka Exp $ +.\" $Id: dnssec-keygen.8,v 1.19.12.14 2008/10/16 01:19:52 tbox Exp $ .\" .hy 0 .ad l @@ -187,14 +187,14 @@ and .PP \fBdnssec\-signzone\fR(8), BIND 9 Administrator Reference Manual, -RFC 2535, +RFC 2539, RFC 2845, -RFC 2539. +RFC 4033. .SH "AUTHOR" .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook index 6ef1f090e628f..6690f542c25ec 100644 --- a/bin/dnssec/dnssec-keygen.docbook +++ b/bin/dnssec/dnssec-keygen.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -36,6 +36,7 @@ 2004 2005 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") @@ -337,9 +338,9 @@ 8 , BIND 9 Administrator Reference Manual, - RFC 2535, + RFC 2539, RFC 2845, - RFC 2539. + RFC 4033. diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html index 6d3cc83f5ddf4..f855d1f433de2 100644 --- a/bin/dnssec/dnssec-keygen.html +++ b/bin/dnssec/dnssec-keygen.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

dnssec-keygen {-a algorithm} {-b keysize} {-n nametype} [-c class] [-e] [-f flag] [-g generator] [-h] [-k] [-p protocol] [-r randomdev] [-s strength] [-t type] [-v level] {name}

-

DESCRIPTION

+

DESCRIPTION

dnssec-keygen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate @@ -41,7 +41,7 @@

-

OPTIONS

+

OPTIONS

-a algorithm
@@ -144,7 +144,7 @@
-

GENERATED KEYS

+

GENERATED KEYS

When dnssec-keygen completes successfully, it prints a string of the form Knnnn.+aaa+iiiii @@ -187,7 +187,7 @@

-

EXAMPLE

+

EXAMPLE

To generate a 768-bit DSA key for the domain example.com, the following command would be @@ -209,17 +209,17 @@

-

SEE ALSO

+

SEE ALSO

dnssec-signzone(8), BIND 9 Administrator Reference Manual, - RFC 2535, + RFC 2539, RFC 2845, - RFC 2539. + RFC 4033.

-

AUTHOR

+

AUTHOR

Internet Systems Consortium

diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index e1e88c8466cef..f1d55adf451e5 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.23.2.1.4.14 2007/05/09 03:32:36 marka Exp $ +.\" $Id: dnssec-signzone.8,v 1.23.2.1.4.15 2008/10/16 01:19:52 tbox Exp $ .\" .hy 0 .ad l @@ -209,12 +209,12 @@ db.example.com.signed .PP \fBdnssec\-keygen\fR(8), BIND 9 Administrator Reference Manual, -RFC 2535. +RFC 4033. .SH "AUTHOR" .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c index 10e1133660c41..4d35f98f8ff2f 100644 --- a/bin/dnssec/dnssec-signzone.c +++ b/bin/dnssec/dnssec-signzone.c @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signzone.c,v 1.139.2.2.4.29 2008/01/30 01:51:54 marka Exp $ */ +/* $Id: dnssec-signzone.c,v 1.139.2.2.4.30 2008/06/02 00:26:20 marka Exp $ */ #include @@ -117,7 +117,6 @@ static dns_name_t *gorigin; /* The database origin */ static isc_task_t *master = NULL; static unsigned int ntasks = 0; static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE; -static unsigned int assigned = 0, completed = 0; static isc_boolean_t nokeys = ISC_FALSE; static isc_boolean_t removefile = ISC_FALSE; static isc_boolean_t generateds = ISC_FALSE; @@ -1094,16 +1093,19 @@ assignwork(isc_task_t *task, isc_task_t *worker) { dns_rdataset_t nsec; isc_boolean_t found; isc_result_t result; + static unsigned int ended = 0; /* Protected by namelock. */ if (shuttingdown) return; + LOCK(&namelock); if (finished) { - if (assigned == completed) { + ended++; + if (ended == ntasks) { isc_task_detach(&task); isc_app_shutdown(); } - return; + goto unlock; } fname = isc_mem_get(mctx, sizeof(dns_fixedname_t)); @@ -1113,7 +1115,6 @@ assignwork(isc_task_t *task, isc_task_t *worker) { name = dns_fixedname_name(fname); node = NULL; found = ISC_FALSE; - LOCK(&namelock); while (!found) { result = dns_dbiterator_current(gdbiter, &node, name); if (result != ISC_R_SUCCESS) @@ -1140,14 +1141,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) { fatal("failure iterating database: %s", isc_result_totext(result)); } - UNLOCK(&namelock); if (!found) { - if (assigned == completed) { + ended++; + if (ended == ntasks) { isc_task_detach(&task); isc_app_shutdown(); } isc_mem_put(mctx, fname, sizeof(dns_fixedname_t)); - return; + goto unlock; } sevent = (sevent_t *) isc_event_allocate(mctx, task, SIGNER_EVENT_WORK, @@ -1158,7 +1159,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) { sevent->node = node; sevent->fname = fname; isc_task_send(worker, ISC_EVENT_PTR(&sevent)); - assigned++; + unlock: + UNLOCK(&namelock); } /* @@ -1181,7 +1183,6 @@ writenode(isc_task_t *task, isc_event_t *event) { isc_task_t *worker; sevent_t *sevent = (sevent_t *)event; - completed++; worker = (isc_task_t *)event->ev_sender; dumpnode(dns_fixedname_name(sevent->fname), sevent->node); cleannode(gdb, gversion, sevent->node); diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook index d3f9fc5c5b838..b5587d2153fd8 100644 --- a/bin/dnssec/dnssec-signzone.docbook +++ b/bin/dnssec/dnssec-signzone.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -36,6 +36,7 @@ 2004 2005 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") @@ -366,7 +367,7 @@ db.example.com.signed 8 , BIND 9 Administrator Reference Manual, - RFC 2535. + RFC 4033. diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index b3d00ce0f0563..85ec6d61dea3b 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

dnssec-signzone [-a] [-c class] [-d directory] [-e end-time] [-f output-file] [-g] [-h] [-k key] [-l domain] [-i interval] [-n nthreads] [-o origin] [-p] [-r randomdev] [-s start-time] [-t] [-v level] [-z] {zonefile} [key...]

-

DESCRIPTION

+

DESCRIPTION

dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -43,7 +43,7 @@

-

OPTIONS

+

OPTIONS

-a

@@ -181,7 +181,7 @@

-

EXAMPLE

+

EXAMPLE

The following command signs the example.com zone with the DSA key generated by dnssec-keygen @@ -210,15 +210,15 @@ db.example.com.signed %

-

SEE ALSO

+

SEE ALSO

dnssec-keygen(8), BIND 9 Administrator Reference Manual, - RFC 2535. + RFC 4033.

-

AUTHOR

+

AUTHOR

Internet Systems Consortium

diff --git a/bin/named/client.c b/bin/named/client.c index fbc3bad18de75..9c22b1fe56064 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.176.2.13.4.38.4.2 2008/07/23 07:28:11 tbox Exp $ */ +/* $Id: client.c,v 1.176.2.13.4.40 2008/05/22 23:45:34 tbox Exp $ */ #include diff --git a/bin/named/config.c b/bin/named/config.c index dc4d928d4f6e2..b57b24a0f722b 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.11.2.4.8.36.4.3 2008/07/23 23:47:49 tbox Exp $ */ +/* $Id: config.c,v 1.11.2.4.8.39 2008/09/04 08:11:24 marka Exp $ */ #include diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c index e9c53ec8dd806..ffebec8048b46 100644 --- a/bin/named/controlconf.c +++ b/bin/named/controlconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: controlconf.c,v 1.28.2.9.2.13.4.2 2008/07/23 23:16:25 marka Exp $ */ +/* $Id: controlconf.c,v 1.28.2.9.2.15 2008/07/23 23:36:22 marka Exp $ */ #include diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h index b8137e8d33215..b7aaf5a90323a 100644 --- a/bin/named/include/named/globals.h +++ b/bin/named/include/named/globals.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: globals.h,v 1.59.68.7 2006/03/02 00:37:20 marka Exp $ */ +/* $Id: globals.h,v 1.59.68.9 2008/10/24 01:42:46 tbox Exp $ */ #ifndef NAMED_GLOBALS_H #define NAMED_GLOBALS_H 1 @@ -46,6 +46,7 @@ EXTERN isc_taskmgr_t * ns_g_taskmgr INIT(NULL); EXTERN dns_dispatchmgr_t * ns_g_dispatchmgr INIT(NULL); EXTERN isc_entropy_t * ns_g_entropy INIT(NULL); EXTERN isc_entropy_t * ns_g_fallbackentropy INIT(NULL); +EXTERN unsigned int ns_g_cpus_detected INIT(1); /* * XXXRTH We're going to want multiple timer managers eventually. One diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c index 524f47b3387f2..e56bd9c3876e2 100644 --- a/bin/named/interfacemgr.c +++ b/bin/named/interfacemgr.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: interfacemgr.c,v 1.59.2.5.8.21.4.3 2008/07/23 23:16:25 marka Exp $ */ +/* $Id: interfacemgr.c,v 1.59.2.5.8.24 2008/07/23 23:36:22 marka Exp $ */ #include diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8 index 91d0e8a791670..77e90907c77f3 100644 --- a/bin/named/lwresd.8 +++ b/bin/named/lwresd.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.13.208.10 2007/05/16 06:10:54 marka Exp $ +.\" $Id: lwresd.8,v 1.13.208.11 2008/10/17 01:19:58 tbox Exp $ .\" .hy 0 .ad l @@ -85,9 +85,9 @@ Use \fIconfig\-file\fR as the configuration file instead of the default, \fI/etc/lwresd.conf\fR. -\-c +\fB\-c\fR can not be used with -\-C. +\fB\-C\fR. .RE .PP \-C \fIconfig\-file\fR @@ -96,9 +96,9 @@ Use \fIconfig\-file\fR as the configuration file instead of the default, \fI/etc/resolv.conf\fR. -\-C +\fB\-C\fR can not be used with -\-c. +\fB\-c\fR. .RE .PP \-d \fIdebug\-level\fR @@ -217,7 +217,7 @@ The default process\-id file. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/bin/named/lwresd.c b/bin/named/lwresd.c index 7dcdad4d47bb1..77dce1e4ff41a 100644 --- a/bin/named/lwresd.c +++ b/bin/named/lwresd.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lwresd.c,v 1.37.2.2.2.8.14.3 2008/07/23 23:16:26 marka Exp $ */ +/* $Id: lwresd.c,v 1.37.2.2.2.11 2008/07/23 23:36:22 marka Exp $ */ /* * Main program for the Lightweight Resolver Daemon. diff --git a/bin/named/lwresd.docbook b/bin/named/lwresd.docbook index 354a4ab85d58a..b4cd22bc66e08 100644 --- a/bin/named/lwresd.docbook +++ b/bin/named/lwresd.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -36,6 +36,7 @@ 2004 2005 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") @@ -143,7 +144,7 @@ Use config-file as the configuration file instead of the default, /etc/lwresd.conf. - -c can not be used with -C. + can not be used with . @@ -155,7 +156,7 @@ Use config-file as the configuration file instead of the default, /etc/resolv.conf. - -C can not be used with -c. + can not be used with . diff --git a/bin/named/lwresd.html b/bin/named/lwresd.html index 45837e8ed4a19..bb794583a5709 100644 --- a/bin/named/lwresd.html +++ b/bin/named/lwresd.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

lwresd [-c config-file] [-C config-file] [-d debug-level] [-f] [-g] [-i pid-file] [-m flag] [-n #cpus] [-P port] [-p port] [-s] [-t directory] [-u user] [-v] [-4] [-6]

-

DESCRIPTION

+

DESCRIPTION

lwresd is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver @@ -67,7 +67,7 @@

-

OPTIONS

+

OPTIONS

-4

@@ -86,14 +86,14 @@ Use config-file as the configuration file instead of the default, /etc/lwresd.conf. - <term>-c</term> can not be used with <term>-C</term>. + -c can not be used with -C.

-C config-file

Use config-file as the configuration file instead of the default, /etc/resolv.conf. - <term>-C</term> can not be used with <term>-c</term>. + -C can not be used with -c.

-d debug-level

@@ -194,7 +194,7 @@

-

FILES

+

FILES

/etc/resolv.conf

@@ -207,7 +207,7 @@

-

SEE ALSO

+

SEE ALSO

named(8), lwres(3), @@ -215,7 +215,7 @@

-

AUTHOR

+

AUTHOR

Internet Systems Consortium

diff --git a/bin/named/main.c b/bin/named/main.c index 960de2a34bb11..11a56c9ba88a3 100644 --- a/bin/named/main.c +++ b/bin/named/main.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: main.c,v 1.119.2.3.2.25 2006/11/10 18:51:06 marka Exp $ */ +/* $Id: main.c,v 1.119.2.3.2.29 2008/10/24 01:28:55 marka Exp $ */ #include @@ -31,6 +31,7 @@ #include #include #include +#include #include #include #include @@ -76,6 +77,7 @@ static char program_name[ISC_DIR_NAMEMAX] = "named"; static char absolute_conffile[ISC_DIR_PATHMAX]; static char saved_command_line[512]; static char version[512]; +static unsigned int maxsocks = 0; void ns_main_earlywarning(const char *format, ...) { @@ -345,7 +347,8 @@ parse_command_line(int argc, char *argv[]) { isc_commandline_errprint = ISC_FALSE; while ((ch = isc_commandline_parse(argc, argv, - "46c:C:d:fgi:lm:n:N:p:P:st:u:vx:")) != -1) { + "46c:C:d:fgi:lm:n:N:p:P:" + "sS:t:u:vx:")) != -1) { switch (ch) { case '4': if (disable4) @@ -424,6 +427,10 @@ parse_command_line(int argc, char *argv[]) { /* XXXRTH temporary syntax */ want_stats = ISC_TRUE; break; + case 'S': + maxsocks = parse_int(isc_commandline_argument, + "max number of sockets"); + break; case 't': /* XXXJAB should we make a copy? */ ns_g_chrootdir = isc_commandline_argument; @@ -455,17 +462,14 @@ parse_command_line(int argc, char *argv[]) { static isc_result_t create_managers(void) { isc_result_t result; -#ifdef ISC_PLATFORM_USETHREADS - unsigned int cpus_detected; -#endif + unsigned int socks; #ifdef ISC_PLATFORM_USETHREADS - cpus_detected = isc_os_ncpus(); if (ns_g_cpus == 0) - ns_g_cpus = cpus_detected; + ns_g_cpus = ns_g_cpus_detected; isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s", - cpus_detected, cpus_detected == 1 ? "" : "s", + ns_g_cpus_detected, ns_g_cpus_detected == 1 ? "" : "s", ns_g_cpus, ns_g_cpus == 1 ? "" : "s"); #else ns_g_cpus = 1; @@ -486,13 +490,19 @@ create_managers(void) { return (ISC_R_UNEXPECTED); } - result = isc_socketmgr_create(ns_g_mctx, &ns_g_socketmgr); + result = isc_socketmgr_create2(ns_g_mctx, &ns_g_socketmgr, maxsocks); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_socketmgr_create() failed: %s", isc_result_totext(result)); return (ISC_R_UNEXPECTED); } + result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &socks); + if (result == ISC_R_SUCCESS) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, + ISC_LOG_INFO, "using up to %u sockets", socks); + } result = isc_entropy_create(ns_g_mctx, &ns_g_entropy); if (result != ISC_R_SUCCESS) { @@ -539,6 +549,7 @@ destroy_managers(void) { static void setup(void) { isc_result_t result; + isc_resourcevalue_t old_openfiles; #ifdef HAVE_LIBSCF char *instance = NULL; #endif @@ -592,6 +603,13 @@ setup(void) { } #endif +#ifdef ISC_PLATFORM_USETHREADS + /* + * Check for the number of cpu's before ns_os_chroot(). + */ + ns_g_cpus_detected = isc_os_ncpus(); +#endif + ns_os_chroot(ns_g_chrootdir); /* @@ -644,6 +662,23 @@ setup(void) { (void)isc_resource_getlimit(isc_resource_openfiles, &ns_g_initopenfiles); + /* + * System resources cannot effectively be tuned on some systems. + * Raise the limit in such cases for safety. + */ + old_openfiles = ns_g_initopenfiles; + ns_os_adjustnofile(); + (void)isc_resource_getlimit(isc_resource_openfiles, + &ns_g_initopenfiles); + if (old_openfiles != ns_g_initopenfiles) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_MAIN, ISC_LOG_NOTICE, + "adjusted limit on open files from " + "%" ISC_PRINT_QUADFORMAT "u to " + "%" ISC_PRINT_QUADFORMAT "u", + old_openfiles, ns_g_initopenfiles); + } + /* * If the named configuration filename is relative, prepend the current * directory's name before possibly changing to another directory. @@ -654,7 +689,7 @@ setup(void) { sizeof(absolute_conffile)); if (result != ISC_R_SUCCESS) ns_main_earlyfatal("could not construct absolute path of " - "configuration file: %s", + "configuration file: %s", isc_result_totext(result)); ns_g_conffile = absolute_conffile; } @@ -727,7 +762,7 @@ ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) { if (debug) UNEXPECTED_ERROR(__FILE__, __LINE__, "scf_handle_create() failed: %s", - scf_strerror(scf_error())); + scf_strerror(scf_error())); return (ISC_R_FAILURE); } diff --git a/bin/named/named.8 b/bin/named/named.8 index a8d49747fe685..ab554211a1522 100644 --- a/bin/named/named.8 +++ b/bin/named/named.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.8,v 1.17.208.14 2007/06/20 02:26:23 marka Exp $ +.\" $Id: named.8,v 1.17.208.16 2008/08/22 01:21:36 tbox Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ named \- Internet domain name server .SH "SYNOPSIS" .HP 6 -\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] +\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] .SH "DESCRIPTION" .PP \fBnamed\fR @@ -129,6 +129,21 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .RE .RE .PP +\-S \fI#max\-socks\fR +.RS 4 +Allow +\fBnamed\fR +to use up to +\fI#max\-socks\fR +sockets. +.RS +.B "Warning:" +This option should be unnecessary for the vast majority of users. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because +\fBnamed\fR +reserves some file descriptors for its internal use. +.RE +.RE +.PP \-t \fIdirectory\fR .RS 4 \fBChroot\fR @@ -230,7 +245,7 @@ BIND 9 Administrator Reference Manual. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 15a8cf723c45c..790745511cf95 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.conf.5,v 1.1.4.14 2007/06/20 02:26:23 marka Exp $ +.\" $Id: named.conf.5,v 1.1.4.15 2008/09/05 01:21:40 tbox Exp $ .\" .hy 0 .ad l @@ -173,6 +173,7 @@ options { port \fIinteger\fR; querylog \fIboolean\fR; recursing\-file \fIquoted_string\fR; + reserved\-sockets \fIinteger\fR; random\-device \fIquoted_string\fR; recursive\-clients \fIinteger\fR; serial\-query\-rate \fIinteger\fR; @@ -464,5 +465,5 @@ zone \fIstring\fR \fIoptional_class\fR { \fBrndc\fR(8), BIND 9 Administrator Reference Manual .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index 0f5676cfdd613..6a9c384d1fb7a 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index 54f20fbf731cd..e2e965a3585cc 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -1,5 +1,5 @@ - + @@ -31,7 +31,7 @@

named.conf

-

DESCRIPTION

+

DESCRIPTION

named.conf is the configuration file for named. Statements are enclosed @@ -50,14 +50,14 @@

-

ACL

+

ACL


acl string { address_match_element; ... };

-

KEY

+

KEY


key domain_name {
algorithm string;
@@ -66,7 +66,7 @@ key

-

MASTERS

+

MASTERS


masters string [ port integer ] {
( masters | ipv4_address [port integer] |
@@ -75,7 +75,7 @@ masters

-

SERVER

+

SERVER


server ( ipv4_address | ipv6_address ) {
bogus boolean;
@@ -95,7 +95,7 @@ server

-

TRUSTED-KEYS

+

TRUSTED-KEYS


trusted-keys {
domain_name flags protocol algorithm key; ... 
@@ -103,7 +103,7 @@ trusted-keys

-

CONTROLS

+

CONTROLS


controls {
inet ( ipv4_address | ipv6_address | * )
@@ -115,7 +115,7 @@ controls

-

LOGGING

+

LOGGING


logging {
channel string {
@@ -133,7 +133,7 @@ logging

-

LWRES

+

LWRES


lwres {
listen-on [ port integer ] {
@@ -146,7 +146,7 @@ lwres

-

OPTIONS

+

OPTIONS


options {
avoid-v4-udp-ports { port; ... };
@@ -171,6 +171,7 @@ options port integer;
querylog boolean;
recursing-file quoted_string;
+ reserved-sockets integer;
random-device quoted_string;
recursive-clients integer;
serial-query-rate integer;
@@ -290,7 +291,7 @@ options

-

VIEW

+

VIEW


view string optional_class {
match-clients { address_match_element; ... };
@@ -408,7 +409,7 @@ view

-

ZONE

+

ZONE


zone string optional_class {
type ( master | slave | stub | hint |
@@ -484,13 +485,13 @@ zone

-

FILES

+

FILES

/etc/named.conf

-

SEE ALSO

+

SEE ALSO

named(8), named-checkconf(8), diff --git a/bin/named/named.docbook b/bin/named/named.docbook index 43401d0274474..c6073c34dd364 100644 --- a/bin/named/named.docbook +++ b/bin/named/named.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -37,6 +37,7 @@ 2005 2006 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") @@ -65,6 +66,7 @@ + @@ -217,6 +219,33 @@ + + -S #max-socks + + + Allow named to use up to + #max-socks sockets. + + + + This option should be unnecessary for the vast majority + of users. + The use of this option could even be harmful because the + specified value may exceed the limitation of the + underlying system API. + It is therefore set only when the default configuration + causes exhaustion of file descriptors and the + operational environment is known to support the + specified number of sockets. + Note also that the actual maximum number is normally a little + fewer than the specified value because + named reserves some file descriptors + for its internal use. + + + + + -t directory diff --git a/bin/named/named.html b/bin/named/named.html index f90b087b25c32..101c3b4ee3345 100644 --- a/bin/named/named.html +++ b/bin/named/named.html @@ -1,5 +1,5 @@ - + @@ -29,10 +29,10 @@

Synopsis

-

named [-4] [-6] [-c config-file] [-d debug-level] [-f] [-g] [-m flag] [-n #cpus] [-p port] [-s] [-t directory] [-u user] [-v] [-x cache-file]

+

named [-4] [-6] [-c config-file] [-d debug-level] [-f] [-g] [-m flag] [-n #cpus] [-p port] [-s] [-S #max-socks] [-t directory] [-u user] [-v] [-x cache-file]

-

DESCRIPTION

+

DESCRIPTION

named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -46,7 +46,7 @@

-

OPTIONS

+

OPTIONS

-4

@@ -123,6 +123,31 @@

+
-S #max-socks
+
+

+ Allow named to use up to + #max-socks sockets. +

+
+

Warning

+

+ This option should be unnecessary for the vast majority + of users. + The use of this option could even be harmful because the + specified value may exceed the limitation of the + underlying system API. + It is therefore set only when the default configuration + causes exhaustion of file descriptors and the + operational environment is known to support the + specified number of sockets. + Note also that the actual maximum number is normally a little + fewer than the specified value because + named reserves some file descriptors + for its internal use. +

+
+
-t directory

@@ -186,7 +211,7 @@

-

SIGNALS

+

SIGNALS

In routine operation, signals should not be used to control the nameserver; rndc should be used @@ -207,7 +232,7 @@

-

CONFIGURATION

+

CONFIGURATION

The named configuration file is too complex to describe in detail here. A complete description is @@ -216,7 +241,7 @@

-

FILES

+

FILES

/etc/named.conf

@@ -229,7 +254,7 @@

-

SEE ALSO

+

SEE ALSO

RFC 1033, RFC 1034, @@ -243,7 +268,7 @@

-

AUTHOR

+

AUTHOR

Internet Systems Consortium

diff --git a/bin/named/query.c b/bin/named/query.c index 858df8cd975b6..2b2705fd363ff 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.198.2.13.4.53 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: query.c,v 1.198.2.13.4.56 2008/10/15 22:30:47 marka Exp $ */ #include @@ -1900,6 +1900,13 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, &olabels); (void)dns_name_fullcompare(name, &nsec.next, &order, &nlabels); + /* + * Check for a pathological condition created when + * serving some malformed signed zones and bail out. + */ + if (dns_name_countlabels(name) == nlabels) + goto cleanup; + if (olabels > nlabels) dns_name_split(name, olabels, NULL, wname); else @@ -2067,12 +2074,13 @@ query_resume(isc_task_t *task, isc_event_t *event) { static isc_result_t query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain, - dns_rdataset_t *nameservers) + dns_rdataset_t *nameservers, isc_boolean_t resuming) { isc_result_t result; dns_rdataset_t *rdataset, *sigrdataset; - inc_stats(client, dns_statscounter_recursion); + if (!resuming) + inc_stats(client, dns_statscounter_recursion); /* * We are about to recurse, which means that this client will @@ -2367,6 +2375,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) unsigned int options; isc_boolean_t empty_wild; dns_rdataset_t *noqname; + isc_boolean_t resuming; CTRACE("query_find"); @@ -2392,6 +2401,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) need_wildcardproof = ISC_FALSE; empty_wild = ISC_FALSE; options = 0; + resuming = ISC_FALSE; + is_zone = ISC_FALSE; if (event != NULL) { /* @@ -2401,7 +2412,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) want_restart = ISC_FALSE; authoritative = ISC_FALSE; - is_zone = ISC_FALSE; qtype = event->qtype; if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig) @@ -2434,6 +2444,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) } result = event->result; + resuming = ISC_TRUE; goto resume; } @@ -2624,7 +2635,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ if (RECURSIONOK(client)) { result = query_recurse(client, qtype, - NULL, NULL); + NULL, NULL, resuming); if (result == ISC_R_SUCCESS) client->query.attributes |= NS_QUERYATTR_RECURSING; @@ -2791,10 +2802,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ if (dns_rdatatype_atparent(type)) result = query_recurse(client, qtype, - NULL, NULL); + NULL, NULL, + resuming); else result = query_recurse(client, qtype, - fname, rdataset); + fname, rdataset, + resuming); if (result == ISC_R_SUCCESS) client->query.attributes |= NS_QUERYATTR_RECURSING; @@ -3223,7 +3236,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) result = query_recurse(client, qtype, NULL, - NULL); + NULL, + resuming); if (result == ISC_R_SUCCESS) client->query.attributes |= NS_QUERYATTR_RECURSING; diff --git a/bin/named/server.c b/bin/named/server.c index afbecb8487efc..8acb00875210b 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.339.2.15.2.78.4.3 2008/07/23 23:47:49 tbox Exp $ */ +/* $Id: server.c,v 1.339.2.15.2.84 2008/09/04 23:45:32 tbox Exp $ */ #include @@ -30,8 +30,10 @@ #include #include #include +#include #include #include +#include #include #include #include @@ -427,13 +429,15 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver) */ static isc_result_t get_view_querysource_dispatch(const cfg_obj_t **maps, - int af, dns_dispatch_t **dispatchp) + int af, dns_dispatch_t **dispatchp, + isc_boolean_t is_firstview) { isc_result_t result; dns_dispatch_t *disp; isc_sockaddr_t sa; unsigned int attrs, attrmask; const cfg_obj_t *obj = NULL; + unsigned int maxdispatchbuffers; /* * Make compiler happy. @@ -485,12 +489,18 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, attrs |= DNS_DISPATCHATTR_IPV6; break; } - - if (isc_sockaddr_getport(&sa) != 0) { + if (isc_sockaddr_getport(&sa) == 0) { + attrs |= DNS_DISPATCHATTR_EXCLUSIVE; + maxdispatchbuffers = 4096; + } else { INSIST(obj != NULL); - cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO, - "using specific query-source port suppresses port " - "randomization and can be insecure."); + if (is_firstview) { + cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO, + "using specific query-source port " + "suppresses port randomization and can be " + "insecure."); + } + maxdispatchbuffers = 1000; } attrmask = 0; @@ -502,7 +512,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, disp = NULL; result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr, ns_g_taskmgr, &sa, 4096, - 1024, 32768, 16411, 16433, + maxdispatchbuffers, 32768, 16411, 16433, attrs, attrmask, &disp); if (result != ISC_R_SUCCESS) { isc_sockaddr_t any; @@ -912,8 +922,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, * * XXXRTH Hardwired number of tasks. */ - CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4)); - CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6)); + CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4, + ISC_TF(ISC_LIST_PREV(view, link) + == NULL))); + CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6, + ISC_TF(ISC_LIST_PREV(view, link) + == NULL))); if (dispatch4 == NULL && dispatch6 == NULL) { UNEXPECTED_ERROR(__FILE__, __LINE__, "unable to obtain neither an IPv4 nor" @@ -2129,24 +2143,41 @@ set_limits(const cfg_obj_t **maps) { SETLIMIT("files", openfiles, "open files"); } -static isc_result_t -portlist_fromconf(dns_portlist_t *portlist, unsigned int family, - const cfg_obj_t *ports) +static void +portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports, + isc_boolean_t positive) { const cfg_listelt_t *element; - isc_result_t result = ISC_R_SUCCESS; for (element = cfg_list_first(ports); element != NULL; element = cfg_list_next(element)) { const cfg_obj_t *obj = cfg_listelt_value(element); - in_port_t port = (in_port_t)cfg_obj_asuint32(obj); - result = dns_portlist_add(portlist, family, port); - if (result != ISC_R_SUCCESS) - break; + if (cfg_obj_isuint32(obj)) { + in_port_t port = (in_port_t)cfg_obj_asuint32(obj); + + if (positive) + isc_portset_add(portset, port); + else + isc_portset_remove(portset, port); + } else { + const cfg_obj_t *obj_loport, *obj_hiport; + in_port_t loport, hiport; + + obj_loport = cfg_tuple_get(obj, "loport"); + loport = (in_port_t)cfg_obj_asuint32(obj_loport); + obj_hiport = cfg_tuple_get(obj, "hiport"); + hiport = (in_port_t)cfg_obj_asuint32(obj_hiport); + + if (positive) + isc_portset_addrange(portset, loport, hiport); + else { + isc_portset_removerange(portset, loport, + hiport); + } + } } - return (result); } static isc_result_t @@ -2160,21 +2191,24 @@ load_configuration(const char *filename, ns_server_t *server, const cfg_obj_t *maps[3]; const cfg_obj_t *obj; const cfg_obj_t *options; - const cfg_obj_t *v4ports, *v6ports; + const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports; const cfg_obj_t *views; dns_view_t *view = NULL; dns_view_t *view_next; dns_viewlist_t tmpviewlist; dns_viewlist_t viewlist; - in_port_t listen_port; + in_port_t listen_port, udpport_low, udpport_high; int i; - isc_resourcevalue_t files; + isc_portset_t *v4portset = NULL; + isc_portset_t *v6portset = NULL; + isc_resourcevalue_t nfiles; isc_result_t result; isc_uint32_t heartbeat_interval; isc_uint32_t interface_interval; isc_uint32_t reserved; isc_uint32_t udpsize; ns_aclconfctx_t aclconfctx; + unsigned int maxsocks; ns_aclconfctx_init(&aclconfctx); ISC_LIST_INIT(viewlist); @@ -2233,15 +2267,6 @@ load_configuration(const char *filename, ns_server_t *server, } CHECK(result); - /* - * Check that the working directory is writable. - */ - if (access(".", W_OK) != 0) { - isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, - NS_LOGMODULE_SERVER, ISC_LOG_ERROR, - "the working directory is not writable"); - } - /* * Check the validity of the configuration. */ @@ -2264,20 +2289,22 @@ load_configuration(const char *filename, ns_server_t *server, set_limits(maps); /* - * Sanity check on "files" limit. + * Check if max number of open sockets that the system allows is + * sufficiently large. Failing this condition is not necessarily fatal, + * but may cause subsequent runtime failures for a busy recursive + * server. */ - result = isc_resource_curlimit(isc_resource_openfiles, &files); - if (result == ISC_R_SUCCESS && files < FD_SETSIZE) { + result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &maxsocks); + if (result != ISC_R_SUCCESS) + maxsocks = 0; + result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles); + if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_WARNING, - "the 'files' limit (%" ISC_PRINT_QUADFORMAT "u) " - "is less than FD_SETSIZE (%d), increase " - "'files' in named.conf or recompile with a " - "smaller FD_SETSIZE.", files, FD_SETSIZE); - if (files > FD_SETSIZE) - files = FD_SETSIZE; - } else - files = FD_SETSIZE; + "max open files (%" ISC_PRINT_QUADFORMAT "u)" + " is smaller than max sockets (%u)", + nfiles, maxsocks); + } /* * Set the number of socket reserved for TCP, stdio etc. @@ -2286,17 +2313,20 @@ load_configuration(const char *filename, ns_server_t *server, result = ns_config_get(maps, "reserved-sockets", &obj); INSIST(result == ISC_R_SUCCESS); reserved = cfg_obj_asuint32(obj); - if (files < 128U) /* Prevent underflow. */ - reserved = 0; - else if (reserved > files - 128U) /* Mimimum UDP space. */ - reserved = files - 128; - if (reserved < 128U) /* Mimimum TCP/stdio space. */ + if (maxsocks != 0) { + if (maxsocks < 128U) /* Prevent underflow. */ + reserved = 0; + else if (reserved > maxsocks - 128U) /* Minimum UDP space. */ + reserved = maxsocks - 128; + } + /* Minimum TCP/stdio space. */ + if (reserved < 128U) reserved = 128; - if (reserved + 128U > files) { + if (reserved + 128U > maxsocks && maxsocks != 0) { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_WARNING, "less than 128 UDP sockets available after " - "applying 'reserved-sockets' and 'files'"); + "applying 'reserved-sockets' and 'maxsockets'"); } isc__socketmgr_setreserved(ns_g_socketmgr, reserved); @@ -2324,24 +2354,64 @@ load_configuration(const char *filename, ns_server_t *server, INSIST(result == ISC_R_SUCCESS); server->aclenv.match_mapped = cfg_obj_asboolean(obj); - v4ports = NULL; - v6ports = NULL; - (void)ns_config_get(maps, "avoid-v4-udp-ports", &v4ports); - (void)ns_config_get(maps, "avoid-v6-udp-ports", &v6ports); - if (v4ports != NULL || v6ports != NULL) { - dns_portlist_t *portlist = NULL; - result = dns_portlist_create(ns_g_mctx, &portlist); - if (result == ISC_R_SUCCESS && v4ports != NULL) - result = portlist_fromconf(portlist, AF_INET, v4ports); - if (result == ISC_R_SUCCESS && v6ports != NULL) - portlist_fromconf(portlist, AF_INET6, v6ports); - if (result == ISC_R_SUCCESS) - dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, portlist); - if (portlist != NULL) - dns_portlist_detach(&portlist); - CHECK(result); - } else - dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, NULL); + /* + * Configure sets of UDP query source ports. + */ + CHECKM(isc_portset_create(ns_g_mctx, &v4portset), + "creating UDP port set"); + CHECKM(isc_portset_create(ns_g_mctx, &v6portset), + "creating UDP port set"); + + usev4ports = NULL; + usev6ports = NULL; + avoidv4ports = NULL; + avoidv6ports = NULL; + + (void)ns_config_get(maps, "use-v4-udp-ports", &usev4ports); + if (usev4ports != NULL) + portset_fromconf(v4portset, usev4ports, ISC_TRUE); + else { + CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low, + &udpport_high), + "get the default UDP/IPv4 port range"); + if (udpport_low == udpport_high) + isc_portset_add(v4portset, udpport_low); + else { + isc_portset_addrange(v4portset, udpport_low, + udpport_high); + } + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_INFO, + "using default UDP/IPv4 port range: [%d, %d]", + udpport_low, udpport_high); + } + (void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports); + if (avoidv4ports != NULL) + portset_fromconf(v4portset, avoidv4ports, ISC_FALSE); + + (void)ns_config_get(maps, "use-v6-udp-ports", &usev6ports); + if (usev6ports != NULL) + portset_fromconf(v6portset, usev6ports, ISC_TRUE); + else { + CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low, + &udpport_high), + "get the default UDP/IPv6 port range"); + if (udpport_low == udpport_high) + isc_portset_add(v6portset, udpport_low); + else { + isc_portset_addrange(v6portset, udpport_low, + udpport_high); + } + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_INFO, + "using default UDP/IPv6 port range: [%d, %d]", + udpport_low, udpport_high); + } + (void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports); + if (avoidv6ports != NULL) + portset_fromconf(v6portset, avoidv6ports, ISC_FALSE); + + dns_dispatchmgr_setavailports(ns_g_dispatchmgr, v4portset, v6portset); /* * Set the EDNS UDP size when we don't match a view. @@ -2647,6 +2717,15 @@ load_configuration(const char *filename, ns_server_t *server, if (first_time) ns_os_changeuser(); + /* + * Check that the working directory is writable. + */ + if (access(".", W_OK) != 0) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_ERROR, + "the working directory is not writable"); + } + /* * Configure the logging system. * @@ -2807,6 +2886,12 @@ load_configuration(const char *filename, ns_server_t *server, result = ISC_R_SUCCESS; cleanup: + if (v4portset != NULL) + isc_portset_destroy(ns_g_mctx, &v4portset); + + if (v6portset != NULL) + isc_portset_destroy(ns_g_mctx, &v6portset); + ns_aclconfctx_destroy(&aclconfctx); if (parser != NULL) { diff --git a/bin/named/unix/include/named/os.h b/bin/named/unix/include/named/os.h index 1c4bec0707272..96604e54acd4b 100644 --- a/bin/named/unix/include/named/os.h +++ b/bin/named/unix/include/named/os.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.h,v 1.14.2.2.8.12 2007/08/28 07:19:08 tbox Exp $ */ +/* $Id: os.h,v 1.14.2.2.8.14 2008/10/24 01:42:46 tbox Exp $ */ #ifndef NS_OS_H #define NS_OS_H 1 @@ -43,12 +43,14 @@ ns_os_inituserinfo(const char *username); void ns_os_changeuser(void); +void +ns_os_adjustnofile(void); + void ns_os_minprivs(void); void ns_os_writepidfile(const char *filename, isc_boolean_t first_time); - void ns_os_shutdown(void); diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c index f8026660391ea..3fe15cb1a0070 100644 --- a/bin/named/unix/os.c +++ b/bin/named/unix/os.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.46.2.4.8.30 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: os.c,v 1.46.2.4.8.33 2008/10/24 01:42:46 tbox Exp $ */ #include #include @@ -40,6 +40,7 @@ #include #include #include +#include #include #include #include @@ -114,6 +115,16 @@ static int dfd[2] = { -1, -1 }; static isc_boolean_t non_root = ISC_FALSE; static isc_boolean_t non_root_caps = ISC_FALSE; +#if defined(HAVE_CAPSET) +#undef _POSIX_SOURCE +#ifdef HAVE_SYS_CAPABILITY_H +#include +#else +#include +int capset(cap_user_header_t hdrp, const cap_user_data_t datap); +#endif +#include +#else /* * We define _LINUX_FS_H to prevent it from being included. We don't need * anything from it, and the files it includes cause warnings with 2.2 @@ -146,6 +157,7 @@ static isc_boolean_t non_root_caps = ISC_FALSE; #endif #define SYS_capset __NR_capset #endif +#endif static void linux_setcaps(unsigned int caps) { @@ -163,13 +175,23 @@ linux_setcaps(unsigned int caps) { cap.effective = caps; cap.permitted = caps; cap.inheritable = 0; - if (syscall(SYS_capset, &caphead, &cap) < 0) { +#ifdef HAVE_CAPSET + if (capset(&caphead, &cap) < 0 ) { isc__strerror(errno, strbuf, sizeof(strbuf)); ns_main_earlyfatal("capset failed: %s:" " please ensure that the capset kernel" " module is loaded. see insmod(8)", strbuf); } +#else + if (syscall(SYS_capset, &caphead, &cap) < 0) { + isc__strerror(errno, strbuf, sizeof(strbuf)); + ns_main_earlyfatal("syscall(capset) failed: %s:" + " please ensure that the capset kernel" + " module is loaded. see insmod(8)", + strbuf); + } +#endif } static void @@ -510,6 +532,24 @@ ns_os_changeuser(void) { #endif } +void +ns_os_adjustnofile() { +#ifdef HAVE_LINUXTHREADS + isc_result_t result; + isc_resourcevalue_t newvalue; + + /* + * Linux: max number of open files specified by one thread doesn't seem + * to apply to other threads on Linux. + */ + newvalue = ISC_RESOURCE_UNLIMITED; + + result = isc_resource_setlimit(isc_resource_openfiles, newvalue); + if (result != ISC_R_SUCCESS) + ns_main_earlywarning("couldn't adjust limit on open files"); +#endif +} + void ns_os_minprivs(void) { #ifdef HAVE_SYS_PRCTL_H diff --git a/bin/named/update.c b/bin/named/update.c index 6733d76902b1c..b556935a7bcad 100644 --- a/bin/named/update.c +++ b/bin/named/update.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: update.c,v 1.88.2.5.2.35 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: update.c,v 1.88.2.5.2.36 2008/04/28 03:28:10 marka Exp $ */ #include @@ -1612,10 +1612,10 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, * Add RRSIG records for an RRset, recording the change in "diff". */ static isc_result_t -add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, - dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys, - unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception, - isc_stdtime_t expire) +add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type, + dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, + isc_mem_t *mctx, isc_stdtime_t inception, isc_stdtime_t expire) { isc_result_t result; dns_dbnode_t *node = NULL; @@ -1624,6 +1624,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, isc_buffer_t buffer; unsigned char data[1024]; /* XXX */ unsigned int i; + isc_boolean_t added_sig = ISC_FALSE; dns_rdataset_init(&rdataset); isc_buffer_init(&buffer, data, sizeof(data)); @@ -1648,6 +1649,13 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name, rdataset.ttl, &sig_rdata)); dns_rdata_reset(&sig_rdata); + added_sig = ISC_TRUE; + } + if (!added_sig) { + update_log(client, zone, ISC_LOG_ERROR, + "found no private keys, " + "unable to generate any signatures"); + result = ISC_R_NOTFOUND; } failure: @@ -1767,9 +1775,9 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, */ CHECK(rrset_exists(db, newver, name, type, 0, &flag)); if (flag) { - CHECK(add_sigs(db, newver, name, type, - &sig_diff, zone_keys, nkeys, - client->mctx, inception, + CHECK(add_sigs(client, zone, db, newver, name, + type, &sig_diff, zone_keys, + nkeys, client->mctx, inception, expire)); } skip: @@ -1953,9 +1961,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, dns_rdatatype_rrsig, dns_rdatatype_nsec, NULL, &sig_diff)); } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec, - &sig_diff, zone_keys, nkeys, - client->mctx, inception, expire)); + CHECK(add_sigs(client, zone, db, newver, &t->name, + dns_rdatatype_nsec, &sig_diff, + zone_keys, nkeys, client->mctx, + inception, expire)); } else { INSIST(0); } diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in index 3474f7cfa06c0..a09760353e0c0 100644 --- a/bin/nsupdate/Makefile.in +++ b/bin/nsupdate/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.15.12.13 2007/08/28 07:19:08 tbox Exp $ +# $Id: Makefile.in,v 1.15.12.15 2008/08/29 23:45:33 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -55,7 +55,7 @@ UOBJS = SRCS = nsupdate.c -MANPAGES = nsupdate.8 +MANPAGES = nsupdate.1 HTMLPAGES = nsupdate.html @@ -76,8 +76,8 @@ clean distclean:: installdirs: $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir} - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8 + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1 install:: nsupdate@EXEEXT@ installdirs ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} nsupdate@EXEEXT@ ${DESTDIR}${bindir} - ${INSTALL_DATA} ${srcdir}/nsupdate.8 ${DESTDIR}${mandir}/man8 + ${INSTALL_DATA} ${srcdir}/nsupdate.1 ${DESTDIR}${mandir}/man1 diff --git a/bin/nsupdate/nsupdate.1 b/bin/nsupdate/nsupdate.1 new file mode 100644 index 0000000000000..14b9eeb53a610 --- /dev/null +++ b/bin/nsupdate/nsupdate.1 @@ -0,0 +1,348 @@ +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2000-2003 Internet Software Consortium. +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +.\" PERFORMANCE OF THIS SOFTWARE. +.\" +.\" $Id: nsupdate.1,v 1.1.6.2 2008/09/01 01:53:43 tbox Exp $ +.\" +.hy 0 +.ad l +.\" Title: nsupdate +.\" Author: +.\" Generator: DocBook XSL Stylesheets v1.71.1 +.\" Date: Jun 30, 2000 +.\" Manual: BIND9 +.\" Source: BIND9 +.\" +.TH "NSUPDATE" "1" "Jun 30, 2000" "BIND9" "BIND9" +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.SH "NAME" +nsupdate \- Dynamic DNS update utility +.SH "SYNOPSIS" +.HP 9 +\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename] +.SH "DESCRIPTION" +.PP +\fBnsupdate\fR +is used to submit Dynamic DNS Update requests as defined in RFC2136 to a name server. This allows resource records to be added or removed from a zone without manually editing the zone file. A single update request can contain requests to add or remove more than one resource record. +.PP +Zones that are under dynamic control via +\fBnsupdate\fR +or a DHCP server should not be edited by hand. Manual edits could conflict with dynamic updates and cause data to be lost. +.PP +The resource records that are dynamically added or removed with +\fBnsupdate\fR +have to be in the same zone. Requests are sent to the zone's master server. This is identified by the MNAME field of the zone's SOA record. +.PP +The +\fB\-d\fR +option makes +\fBnsupdate\fR +operate in debug mode. This provides tracing information about the update requests that are made and the replies received from the name server. +.PP +Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC2845 or the SIG(0) record described in RFC3535 and RFC2931. TSIG relies on a shared secret that should only be known to +\fBnsupdate\fR +and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable +\fBkey\fR +and +\fBserver\fR +statements would be added to +\fI/etc/named.conf\fR +so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using TSIG authentication. SIG(0) uses public key cryptography. To use a SIG(0) key, the public key must be stored in a KEY record in a zone served by the name server. +\fBnsupdate\fR +does not read +\fI/etc/named.conf\fR. +.PP +\fBnsupdate\fR +uses the +\fB\-y\fR +or +\fB\-k\fR +option (with an HMAC\-MD5 key) to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests. These options are mutually exclusive. With the +\fB\-k\fR +option, +\fBnsupdate\fR +reads the shared secret from the file +\fIkeyfile\fR, whose name is of the form +\fIK{name}.+157.+{random}.private\fR. For historical reasons, the file +\fIK{name}.+157.+{random}.key\fR +must also be present. When the +\fB\-y\fR +option is used, a signature is generated from +\fIkeyname:secret.\fR +\fIkeyname\fR +is the name of the key, and +\fIsecret\fR +is the base64 encoded shared secret. Use of the +\fB\-y\fR +option is discouraged because the shared secret is supplied as a command line argument in clear text. This may be visible in the output from +\fBps\fR(1 ) +or in a history file maintained by the user's shell. +.PP +The +\fB\-k\fR +may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC\-MD5 key. +.PP +By default +\fBnsupdate\fR +uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. The +\fB\-v\fR +option makes +\fBnsupdate\fR +use a TCP connection. This may be preferable when a batch of update requests is made. +.PP +The +\fB\-t\fR +option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. +.PP +The +\fB\-u\fR +option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. +.PP +The +\fB\-r\fR +option sets the number of UDP retries. The default is 3. If zero, only one update request will be made. +.SH "INPUT FORMAT" +.PP +\fBnsupdate\fR +reads input from +\fIfilename\fR +or standard input. Each command is supplied on exactly one line of input. Some commands are for administrative purposes. The others are either update instructions or prerequisite checks on the contents of the zone. These checks set conditions that some name or set of resource records (RRset) either exists or is absent from the zone. These conditions must be met if the entire update request is to succeed. Updates will be rejected if the tests for the prerequisite conditions fail. +.PP +Every update request consists of zero or more prerequisites and zero or more updates. This allows a suitably authenticated update request to proceed if some specified resource records are present or missing from the zone. A blank input line (or the +\fBsend\fR +command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server. +.PP +The command formats and their meaning are as follows: +.PP +\fBserver\fR {servername} [port] +.RS 4 +Sends all dynamic update requests to the name server +\fIservername\fR. When no server statement is provided, +\fBnsupdate\fR +will send updates to the master server of the correct zone. The MNAME field of that zone's SOA record will identify the master server for that zone. +\fIport\fR +is the port number on +\fIservername\fR +where the dynamic update requests get sent. If no port number is specified, the default DNS port number of 53 is used. +.RE +.PP +\fBlocal\fR {address} [port] +.RS 4 +Sends all dynamic update requests using the local +\fIaddress\fR. When no local statement is provided, +\fBnsupdate\fR +will send updates using an address and port chosen by the system. +\fIport\fR +can additionally be used to make requests come from a specific port. If no port number is specified, the system will assign one. +.RE +.PP +\fBzone\fR {zonename} +.RS 4 +Specifies that all updates are to be made to the zone +\fIzonename\fR. If no +\fIzone\fR +statement is provided, +\fBnsupdate\fR +will attempt determine the correct zone to update based on the rest of the input. +.RE +.PP +\fBclass\fR {classname} +.RS 4 +Specify the default class. If no +\fIclass\fR +is specified, the default class is +\fIIN\fR. +.RE +.PP +\fBkey\fR {name} {secret} +.RS 4 +Specifies that all updates are to be TSIG\-signed using the +\fIkeyname\fR +\fIkeysecret\fR +pair. The +\fBkey\fR +command overrides any key specified on the command line via +\fB\-y\fR +or +\fB\-k\fR. +.RE +.PP +\fBprereq nxdomain\fR {domain\-name} +.RS 4 +Requires that no resource record of any type exists with name +\fIdomain\-name\fR. +.RE +.PP +\fBprereq yxdomain\fR {domain\-name} +.RS 4 +Requires that +\fIdomain\-name\fR +exists (has as at least one resource record, of any type). +.RE +.PP +\fBprereq nxrrset\fR {domain\-name} [class] {type} +.RS 4 +Requires that no resource record exists of the specified +\fItype\fR, +\fIclass\fR +and +\fIdomain\-name\fR. If +\fIclass\fR +is omitted, IN (internet) is assumed. +.RE +.PP +\fBprereq yxrrset\fR {domain\-name} [class] {type} +.RS 4 +This requires that a resource record of the specified +\fItype\fR, +\fIclass\fR +and +\fIdomain\-name\fR +must exist. If +\fIclass\fR +is omitted, IN (internet) is assumed. +.RE +.PP +\fBprereq yxrrset\fR {domain\-name} [class] {type} {data...} +.RS 4 +The +\fIdata\fR +from each set of prerequisites of this form sharing a common +\fItype\fR, +\fIclass\fR, and +\fIdomain\-name\fR +are combined to form a set of RRs. This set of RRs must exactly match the set of RRs existing in the zone at the given +\fItype\fR, +\fIclass\fR, and +\fIdomain\-name\fR. The +\fIdata\fR +are written in the standard text representation of the resource record's RDATA. +.RE +.PP +\fBupdate delete\fR {domain\-name} [ttl] [class] [type\ [data...]] +.RS 4 +Deletes any resource records named +\fIdomain\-name\fR. If +\fItype\fR +and +\fIdata\fR +is provided, only matching resource records will be removed. The internet class is assumed if +\fIclass\fR +is not supplied. The +\fIttl\fR +is ignored, and is only allowed for compatibility. +.RE +.PP +\fBupdate add\fR {domain\-name} {ttl} [class] {type} {data...} +.RS 4 +Adds a new resource record with the specified +\fIttl\fR, +\fIclass\fR +and +\fIdata\fR. +.RE +.PP +\fBshow\fR +.RS 4 +Displays the current message, containing all of the prerequisites and updates specified since the last send. +.RE +.PP +\fBsend\fR +.RS 4 +Sends the current message. This is equivalent to entering a blank line. +.RE +.PP +\fBanswer\fR +.RS 4 +Displays the answer. +.RE +.PP +Lines beginning with a semicolon are comments and are ignored. +.SH "EXAMPLES" +.PP +The examples below show how +\fBnsupdate\fR +could be used to insert and delete resource records from the +\fBexample.com\fR +zone. Notice that the input in each example contains a trailing blank line so that a group of commands are sent as one dynamic update request to the master name server for +\fBexample.com\fR. +.sp +.RS 4 +.nf +# nsupdate +> update delete oldhost.example.com A +> update add newhost.example.com 86400 A 172.16.1.1 +> send +.fi +.RE +.sp +.PP +Any A records for +\fBoldhost.example.com\fR +are deleted. And an A record for +\fBnewhost.example.com\fR +with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds). +.sp +.RS 4 +.nf +# nsupdate +> prereq nxdomain nickname.example.com +> update add nickname.example.com 86400 CNAME somehost.example.com +> send +.fi +.RE +.sp +.PP +The prerequisite condition gets the name server to check that there are no resource records of any type for +\fBnickname.example.com\fR. If there are, the update request fails. If this name does not exist, a CNAME for it is added. This ensures that when the CNAME is added, it cannot conflict with the long\-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.) +.SH "FILES" +.PP +\fB/etc/resolv.conf\fR +.RS 4 +used to identify default name server +.RE +.PP +\fBK{name}.+157.+{random}.key\fR +.RS 4 +base\-64 encoding of HMAC\-MD5 key created by +\fBdnssec\-keygen\fR(8). +.RE +.PP +\fBK{name}.+157.+{random}.private\fR +.RS 4 +base\-64 encoding of HMAC\-MD5 key created by +\fBdnssec\-keygen\fR(8). +.RE +.SH "SEE ALSO" +.PP +\fBRFC2136\fR(), +\fBRFC3007\fR(), +\fBRFC2104\fR(), +\fBRFC2845\fR(), +\fBRFC1034\fR(), +\fBRFC2535\fR(), +\fBRFC2931\fR(), +\fBnamed\fR(8), +\fBdnssec\-keygen\fR(8). +.SH "BUGS" +.PP +The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases. +.SH "COPYRIGHT" +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000\-2003 Internet Software Consortium. +.br diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.8 deleted file mode 100644 index 5d608e3565afd..0000000000000 --- a/bin/nsupdate/nsupdate.8 +++ /dev/null @@ -1,348 +0,0 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") -.\" Copyright (C) 2000-2003 Internet Software Consortium. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -.\" PERFORMANCE OF THIS SOFTWARE. -.\" -.\" $Id: nsupdate.8,v 1.24.2.2.2.13 2007/05/09 03:32:36 marka Exp $ -.\" -.hy 0 -.ad l -.\" Title: nsupdate -.\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: Jun 30, 2000 -.\" Manual: BIND9 -.\" Source: BIND9 -.\" -.TH "NSUPDATE" "8" "Jun 30, 2000" "BIND9" "BIND9" -.\" disable hyphenation -.nh -.\" disable justification (adjust text to left margin only) -.ad l -.SH "NAME" -nsupdate \- Dynamic DNS update utility -.SH "SYNOPSIS" -.HP 9 -\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename] -.SH "DESCRIPTION" -.PP -\fBnsupdate\fR -is used to submit Dynamic DNS Update requests as defined in RFC2136 to a name server. This allows resource records to be added or removed from a zone without manually editing the zone file. A single update request can contain requests to add or remove more than one resource record. -.PP -Zones that are under dynamic control via -\fBnsupdate\fR -or a DHCP server should not be edited by hand. Manual edits could conflict with dynamic updates and cause data to be lost. -.PP -The resource records that are dynamically added or removed with -\fBnsupdate\fR -have to be in the same zone. Requests are sent to the zone's master server. This is identified by the MNAME field of the zone's SOA record. -.PP -The -\fB\-d\fR -option makes -\fBnsupdate\fR -operate in debug mode. This provides tracing information about the update requests that are made and the replies received from the name server. -.PP -Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC2845 or the SIG(0) record described in RFC3535 and RFC2931. TSIG relies on a shared secret that should only be known to -\fBnsupdate\fR -and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable -\fBkey\fR -and -\fBserver\fR -statements would be added to -\fI/etc/named.conf\fR -so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using TSIG authentication. SIG(0) uses public key cryptography. To use a SIG(0) key, the public key must be stored in a KEY record in a zone served by the name server. -\fBnsupdate\fR -does not read -\fI/etc/named.conf\fR. -.PP -\fBnsupdate\fR -uses the -\fB\-y\fR -or -\fB\-k\fR -option (with an HMAC\-MD5 key) to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests. These options are mutually exclusive. With the -\fB\-k\fR -option, -\fBnsupdate\fR -reads the shared secret from the file -\fIkeyfile\fR, whose name is of the form -\fIK{name}.+157.+{random}.private\fR. For historical reasons, the file -\fIK{name}.+157.+{random}.key\fR -must also be present. When the -\fB\-y\fR -option is used, a signature is generated from -\fIkeyname:secret.\fR -\fIkeyname\fR -is the name of the key, and -\fIsecret\fR -is the base64 encoded shared secret. Use of the -\fB\-y\fR -option is discouraged because the shared secret is supplied as a command line argument in clear text. This may be visible in the output from -\fBps\fR(1 ) -or in a history file maintained by the user's shell. -.PP -The -\fB\-k\fR -may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC\-MD5 key. -.PP -By default -\fBnsupdate\fR -uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. The -\fB\-v\fR -option makes -\fBnsupdate\fR -use a TCP connection. This may be preferable when a batch of update requests is made. -.PP -The -\fB\-t\fR -option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. -.PP -The -\fB\-u\fR -option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. -.PP -The -\fB\-r\fR -option sets the number of UDP retries. The default is 3. If zero, only one update request will be made. -.SH "INPUT FORMAT" -.PP -\fBnsupdate\fR -reads input from -\fIfilename\fR -or standard input. Each command is supplied on exactly one line of input. Some commands are for administrative purposes. The others are either update instructions or prerequisite checks on the contents of the zone. These checks set conditions that some name or set of resource records (RRset) either exists or is absent from the zone. These conditions must be met if the entire update request is to succeed. Updates will be rejected if the tests for the prerequisite conditions fail. -.PP -Every update request consists of zero or more prerequisites and zero or more updates. This allows a suitably authenticated update request to proceed if some specified resource records are present or missing from the zone. A blank input line (or the -\fBsend\fR -command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server. -.PP -The command formats and their meaning are as follows: -.PP -\fBserver\fR {servername} [port] -.RS 4 -Sends all dynamic update requests to the name server -\fIservername\fR. When no server statement is provided, -\fBnsupdate\fR -will send updates to the master server of the correct zone. The MNAME field of that zone's SOA record will identify the master server for that zone. -\fIport\fR -is the port number on -\fIservername\fR -where the dynamic update requests get sent. If no port number is specified, the default DNS port number of 53 is used. -.RE -.PP -\fBlocal\fR {address} [port] -.RS 4 -Sends all dynamic update requests using the local -\fIaddress\fR. When no local statement is provided, -\fBnsupdate\fR -will send updates using an address and port chosen by the system. -\fIport\fR -can additionally be used to make requests come from a specific port. If no port number is specified, the system will assign one. -.RE -.PP -\fBzone\fR {zonename} -.RS 4 -Specifies that all updates are to be made to the zone -\fIzonename\fR. If no -\fIzone\fR -statement is provided, -\fBnsupdate\fR -will attempt determine the correct zone to update based on the rest of the input. -.RE -.PP -\fBclass\fR {classname} -.RS 4 -Specify the default class. If no -\fIclass\fR -is specified, the default class is -\fIIN\fR. -.RE -.PP -\fBkey\fR {name} {secret} -.RS 4 -Specifies that all updates are to be TSIG\-signed using the -\fIkeyname\fR -\fIkeysecret\fR -pair. The -\fBkey\fR -command overrides any key specified on the command line via -\fB\-y\fR -or -\fB\-k\fR. -.RE -.PP -\fBprereq nxdomain\fR {domain\-name} -.RS 4 -Requires that no resource record of any type exists with name -\fIdomain\-name\fR. -.RE -.PP -\fBprereq yxdomain\fR {domain\-name} -.RS 4 -Requires that -\fIdomain\-name\fR -exists (has as at least one resource record, of any type). -.RE -.PP -\fBprereq nxrrset\fR {domain\-name} [class] {type} -.RS 4 -Requires that no resource record exists of the specified -\fItype\fR, -\fIclass\fR -and -\fIdomain\-name\fR. If -\fIclass\fR -is omitted, IN (internet) is assumed. -.RE -.PP -\fBprereq yxrrset\fR {domain\-name} [class] {type} -.RS 4 -This requires that a resource record of the specified -\fItype\fR, -\fIclass\fR -and -\fIdomain\-name\fR -must exist. If -\fIclass\fR -is omitted, IN (internet) is assumed. -.RE -.PP -\fBprereq yxrrset\fR {domain\-name} [class] {type} {data...} -.RS 4 -The -\fIdata\fR -from each set of prerequisites of this form sharing a common -\fItype\fR, -\fIclass\fR, and -\fIdomain\-name\fR -are combined to form a set of RRs. This set of RRs must exactly match the set of RRs existing in the zone at the given -\fItype\fR, -\fIclass\fR, and -\fIdomain\-name\fR. The -\fIdata\fR -are written in the standard text representation of the resource record's RDATA. -.RE -.PP -\fBupdate delete\fR {domain\-name} [ttl] [class] [type\ [data...]] -.RS 4 -Deletes any resource records named -\fIdomain\-name\fR. If -\fItype\fR -and -\fIdata\fR -is provided, only matching resource records will be removed. The internet class is assumed if -\fIclass\fR -is not supplied. The -\fIttl\fR -is ignored, and is only allowed for compatibility. -.RE -.PP -\fBupdate add\fR {domain\-name} {ttl} [class] {type} {data...} -.RS 4 -Adds a new resource record with the specified -\fIttl\fR, -\fIclass\fR -and -\fIdata\fR. -.RE -.PP -\fBshow\fR -.RS 4 -Displays the current message, containing all of the prerequisites and updates specified since the last send. -.RE -.PP -\fBsend\fR -.RS 4 -Sends the current message. This is equivalent to entering a blank line. -.RE -.PP -\fBanswer\fR -.RS 4 -Displays the answer. -.RE -.PP -Lines beginning with a semicolon are comments and are ignored. -.SH "EXAMPLES" -.PP -The examples below show how -\fBnsupdate\fR -could be used to insert and delete resource records from the -\fBexample.com\fR -zone. Notice that the input in each example contains a trailing blank line so that a group of commands are sent as one dynamic update request to the master name server for -\fBexample.com\fR. -.sp -.RS 4 -.nf -# nsupdate -> update delete oldhost.example.com A -> update add newhost.example.com 86400 A 172.16.1.1 -> send -.fi -.RE -.sp -.PP -Any A records for -\fBoldhost.example.com\fR -are deleted. And an A record for -\fBnewhost.example.com\fR -with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds). -.sp -.RS 4 -.nf -# nsupdate -> prereq nxdomain nickname.example.com -> update add nickname.example.com 86400 CNAME somehost.example.com -> send -.fi -.RE -.sp -.PP -The prerequisite condition gets the name server to check that there are no resource records of any type for -\fBnickname.example.com\fR. If there are, the update request fails. If this name does not exist, a CNAME for it is added. This ensures that when the CNAME is added, it cannot conflict with the long\-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.) -.SH "FILES" -.PP -\fB/etc/resolv.conf\fR -.RS 4 -used to identify default name server -.RE -.PP -\fBK{name}.+157.+{random}.key\fR -.RS 4 -base\-64 encoding of HMAC\-MD5 key created by -\fBdnssec\-keygen\fR(8). -.RE -.PP -\fBK{name}.+157.+{random}.private\fR -.RS 4 -base\-64 encoding of HMAC\-MD5 key created by -\fBdnssec\-keygen\fR(8). -.RE -.SH "SEE ALSO" -.PP -\fBRFC2136\fR(), -\fBRFC3007\fR(), -\fBRFC2104\fR(), -\fBRFC2845\fR(), -\fBRFC1034\fR(), -\fBRFC2535\fR(), -\fBRFC2931\fR(), -\fBnamed\fR(8), -\fBdnssec\-keygen\fR(8). -.SH "BUGS" -.PP -The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases. -.SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") -.br -Copyright \(co 2000\-2003 Internet Software Consortium. -.br diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index f45ec143bbd55..7e4ba9666a2b1 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + @@ -26,7 +26,7 @@ nsupdate -8 +1 BIND9 @@ -36,6 +36,7 @@ 2005 2006 2007 + 2008 Internet Systems Consortium, Inc. ("ISC") diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html index 009942d11b4e2..f64368a715c97 100644 --- a/bin/nsupdate/nsupdate.html +++ b/bin/nsupdate/nsupdate.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

nsupdate [-d] [[-y keyname:secret] | [-k keyfile]] [-t timeout] [-u udptimeout] [-r udpretries] [-v] [filename]

-

DESCRIPTION

+

DESCRIPTION

nsupdate is used to submit Dynamic DNS Update requests as defined in RFC2136 @@ -160,7 +160,7 @@ and number of UDP retries.

-

INPUT FORMAT

+

INPUT FORMAT

nsupdate reads input from @@ -399,7 +399,7 @@ Lines beginning with a semicolon are comments and are ignored.

-

EXAMPLES

+

EXAMPLES

The examples below show how nsupdate @@ -452,7 +452,7 @@ RRSIG, DNSKEY and NSEC records.)

-

FILES

+

FILES

/etc/resolv.conf

@@ -471,7 +471,7 @@ base-64 encoding of HMAC-MD5 key created by

-

SEE ALSO

+

SEE ALSO

RFC2136, RFC3007, @@ -485,7 +485,7 @@ base-64 encoding of HMAC-MD5 key created by

-

BUGS

+

BUGS

The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/bin/rndc/rndc-confgen.c b/bin/rndc/rndc-confgen.c index f6e578ed98783..f0cd0cbd367b8 100644 --- a/bin/rndc/rndc-confgen.c +++ b/bin/rndc/rndc-confgen.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rndc-confgen.c,v 1.9.2.6.2.5 2004/09/28 07:14:57 marka Exp $ */ +/* $Id: rndc-confgen.c,v 1.9.2.6.2.7 2008/10/15 23:45:34 tbox Exp $ */ #include @@ -51,7 +51,7 @@ #define DEFAULT_PORT 953 static char program[256]; -char *progname; +const char *progname; isc_boolean_t verbose = ISC_FALSE; @@ -137,7 +137,7 @@ main(int argc, char **argv) { isc_boolean_t keyonly = ISC_FALSE; int len; - keydef = keyfile = RNDC_KEYFILE; + keydef = keyfile = RNDC_KEYFILE; result = isc_file_progname(*argv, program, sizeof(program)); if (result != ISC_R_SUCCESS) @@ -275,7 +275,7 @@ main(int argc, char **argv) { fatal("isc_mem_get(%d) failed\n", len); snprintf(buf, len, "%s%s%s", chrootdir, (*keyfile != '/') ? "/" : "", keyfile); - + write_key_file(buf, user, keyname, &key_txtbuffer); isc_mem_put(mctx, buf, len); } diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index a5e912ddfd42e..977a8ba605411 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rndc.c,v 1.77.2.5.2.19 2006/08/04 03:03:08 marka Exp $ */ +/* $Id: rndc.c,v 1.77.2.5.2.21 2008/10/15 23:45:34 tbox Exp $ */ /* * Principal Author: DCL @@ -56,7 +56,7 @@ #define SERVERADDRS 10 -char *progname; +const char *progname; isc_boolean_t verbose; static const char *admin_conffile; @@ -86,7 +86,7 @@ static void usage(int status) { fprintf(stderr, "\ Usage: %s [-c config] [-s server] [-p port]\n\ - [-k key-file ] [-y key] [-V] command\n\ + [-k key-file ] [-y key] [-V] command\n\ \n\ command is one of the following:\n\ \n\ @@ -98,9 +98,9 @@ command is one of the following:\n\ retransfer zone [class [view]]\n\ Retransfer a single zone without checking serial number.\n\ freeze zone [class [view]]\n\ - Suspend updates to a dynamic zone.\n\ + Suspend updates to a dynamic zone.\n\ thaw zone [class [view]]\n\ - Enable updates to a frozen dynamic zone and reload it.\n\ + Enable updates to a frozen dynamic zone and reload it.\n\ reconfig Reload configuration file and new zones only.\n\ stats Write server statistics to the statistics file.\n\ querylog Toggle query logging.\n\ @@ -443,7 +443,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname, (void)cfg_map_get(config, "server", &servers); if (servers != NULL) { for (elt = cfg_list_first(servers); - elt != NULL; + elt != NULL; elt = cfg_list_next(elt)) { const char *name; @@ -479,7 +479,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname, else { DO("get config key list", cfg_map_get(config, "key", &keys)); for (elt = cfg_list_first(keys); - elt != NULL; + elt != NULL; elt = cfg_list_next(elt)) { key = cfg_listelt_value(elt); @@ -624,7 +624,7 @@ main(int argc, char **argv) { logdest.file.maximum_size = 0; DO("creating log channel", isc_log_createchannel(logconfig, "stderr", - ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest, + ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest, ISC_LOG_PRINTTAG|ISC_LOG_PRINTLEVEL)); DO("enabling log channel", isc_log_usechannel(logconfig, "stderr", NULL, NULL)); diff --git a/configure.in b/configure.in index 67ebe68e9a93d..d24630be4a37a 100644 --- a/configure.in +++ b/configure.in @@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl esyscmd([sed "s/^/# /" COPYRIGHT])dnl AC_DIVERT_POP()dnl -AC_REVISION($Revision: 1.294.2.23.2.82.2.1 $) +AC_REVISION($Revision: 1.294.2.23.2.92 $) AC_INIT(lib/dns/name.c) AC_PREREQ(2.13) @@ -224,6 +224,15 @@ case "$host" in STD_CDEFINES="$STD_CDEFINES -D_XPG4_2 -D__EXTENSIONS__" CPPFLAGS="$CPPFLAGS -D_XPG4_2 -D__EXTENSIONS__" ;; + # POSIX doesn't include the IPv6 Advanced Socket API and glibc hides + # parts of the IPv6 Advanced Socket API as a result. This is stupid + # as it breaks how the two halves (Basic and Advanced) of the IPv6 + # Socket API were designed to be used but we have to live with it. + # Define _GNU_SOURCE to pull in the IPv6 Advanced Socket API. + *-linux*) + STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE" + CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" + ;; esac AC_HEADER_STDC @@ -309,6 +318,78 @@ lifconf.lifc_len = 0; ISC_PLATFORM_HAVELIFCONF="#undef ISC_PLATFORM_HAVELIFCONF"]) AC_SUBST(ISC_PLATFORM_HAVELIFCONF) +# +# check if we have kqueue +# +AC_ARG_ENABLE(kqueue, + [ --enable-kqueue use BSD kqueue when available [[default=yes]]], + want_kqueue="$enableval", want_kqueue="yes") +case $want_kqueue in +yes) + AC_CHECK_FUNC(kqueue, ac_cv_have_kqueue=yes, ac_cv_have_kqueue=no) + case $ac_cv_have_kqueue in + yes) + ISC_PLATFORM_HAVEKQUEUE="#define ISC_PLATFORM_HAVEKQUEUE 1" + ;; + *) + ISC_PLATFORM_HAVEKQUEUE="#undef ISC_PLATFORM_HAVEKQUEUE" + ;; + esac + ;; +*) + ISC_PLATFORM_HAVEKQUEUE="#undef ISC_PLATFORM_HAVEKQUEUE" + ;; +esac +AC_SUBST(ISC_PLATFORM_HAVEKQUEUE) + +# +# check if we have epoll. Linux kernel 2.4 has epoll_create() which fails, +# so we need to try running the code, not just test its existence. +# +AC_ARG_ENABLE(epoll, + [ --enable-epoll use Linux epoll when available [[default=yes]]], + want_epoll="$enableval", want_epoll="yes") +case $want_epoll in +yes) + AC_MSG_CHECKING(epoll support) + AC_TRY_RUN([ +#include +int main() { + if (epoll_create(1) < 0) + return (1); + return (0); +} +], + [AC_MSG_RESULT(yes) + ISC_PLATFORM_HAVEEPOLL="#define ISC_PLATFORM_HAVEEPOLL 1"], + [AC_MSG_RESULT(no) + ISC_PLATFORM_HAVEEPOLL="#undef ISC_PLATFORM_HAVEEPOLL"]) + ;; +*) + ISC_PLATFORM_HAVEEPOLL="#undef ISC_PLATFORM_HAVEEPOLL" + ;; +esac +AC_SUBST(ISC_PLATFORM_HAVEEPOLL) + +# +# check if we support /dev/poll +# +AC_ARG_ENABLE(devpoll, + [ --enable-devpoll use /dev/poll when available [[default=yes]]], + want_devpoll="$enableval", want_devpoll="yes") +case $want_devpoll in +yes) + AC_CHECK_HEADERS(sys/devpoll.h, + ISC_PLATFORM_HAVEDEVPOLL="#define ISC_PLATFORM_HAVEDEVPOLL 1" + , + ISC_PLATFORM_HAVEDEVPOLL="#undef ISC_PLATFORM_HAVEDEVPOLL" + ) + ;; +*) + ISC_PLATFORM_HAVEDEVPOLL="#undef ISC_PLATFORM_HAVEDEVPOLL" + ;; +esac +AC_SUBST(ISC_PLATFORM_HAVEDEVPOLL) # # check if we need to #include sys/select.h explicitly @@ -890,6 +971,16 @@ case "$host" in ;; esac +# +# Work around Solaris's select() limitations. +# +case "$host" in + *-solaris2.[[89]]|*-solaris2.1?) + AC_DEFINE(FD_SETSIZE, 65536, + [Solaris hack to get select_large_fdset.]) + ;; +esac + # # Purify support # @@ -935,6 +1026,14 @@ AC_SUBST(PURIFY) # # GNU libtool support # +case $build_os in +sunos*) + # Just set the maximum command line length for sunos as it otherwise + # takes a exceptionally long time to work it out. Required for libtool. + lt_cv_sys_max_cmd_len=4096; + ;; +esac + AC_ARG_WITH(libtool, [ --with-libtool use GNU libtool (following indented options supported)], use_libtool="$withval", use_libtool="no") @@ -1686,7 +1785,8 @@ AC_ARG_ENABLE(linux-caps, [ --disable-linux-caps disable linux capabilities]) case "$enable_linux_caps" in yes|'') - AC_CHECK_HEADERS(linux/capability.h) + AC_CHECK_HEADERS(linux/capability.h sys/capability.h) + AC_CHECK_FUNCS(capset) ;; no) ;; @@ -1754,6 +1854,18 @@ AC_MSG_RESULT(cannot determine type of rlim_cur when cross compiling - assuming ]) AC_SUBST(ISC_PLATFORM_RLIMITTYPE) +# +# Older HP-UX doesn't have gettune +# +case "$host" in + *-hp-hpux*) + AC_CHECK_HEADERS(sys/dyntune.h) + ;; + *) + ;; +esac + + # # Compaq TruCluster requires more code for handling cluster IP aliases # @@ -1812,7 +1924,7 @@ case "$host" in [*-solaris2.[89]]) hack_shutup_pthreadonceinit=yes ;; - *-solaris2.1[0-9]) + *-solaris2.1[[0-9]]) hack_shutup_pthreadonceinit=yes ;; esac diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 41837c6a9a1c1..4ce75d7fcabd7 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -436,9 +436,11 @@ as none of the name servers share their cached data. Supported Operating Systems ISC BIND 9 compiles and runs on a large number -of Unix-like operating system and on Windows NT / 2000. For an up-to-date +of Unix-like operating systems, and on some versions of Microsoft Windows +including Windows XP, Windows 2003, and Windows 2008. For an up-to-date list of supported systems, see the README file in the top level directory -of the BIND 9 source distribution. +of the BIND 9 source distribution. + @@ -1905,6 +1907,33 @@ be limited by the context in which it is used. A quoted string which will be used as a pathname, such as zones/master/my.test.domain. + + + + port_list + + + + + A list of an ip_port or a port + range. + A port range is specified in the form of + range followed by + two ip_ports, + port_low and + port_high, which represents + port numbers from port_low through + port_high, inclusive. + port_low must not be larger than + port_high. + For example, + range 1024 65535 represents + ports from 1024 through 65535. + In either case an asterisk (`*') character is not + allowed as a valid ip_port. + + + size_spec A number, the word unlimited, @@ -2867,7 +2896,9 @@ statement in the named.conf file: allow-update-forwarding { address_match_list }; allow-v6-synthesis { address_match_list }; blackhole { address_match_list }; + use-v4-udp-ports { port_list }; avoid-v4-udp-ports { port_list }; + use-v6-udp-ports { port_list }; avoid-v6-udp-ports { port_list }; listen-on port ip_port { address_match_list }; listen-on-v6 port ip_port { address_match_list }; @@ -3725,28 +3756,100 @@ and on port 1234 of IPv6 addresses that is not in the prefix If no listen-on-v6 option is specified, the server will not listen on any IPv6 address. -Query Address +Query Address If the server doesn't know the answer to a question, it will query other name servers. query-source specifies the address and port used for such queries. For queries sent over IPv6, there is a separate query-source-v6 option. If address is * (asterisk) or is omitted, a wildcard IP address (INADDR_ANY) will be used. -If port is * or is omitted, -a random unprivileged port number is picked up and will be -used for each query. -It is generally strongly discouraged to -specify a particular port for the -query-source or -query-source-v6 options; -it implicitly disables the use of randomized port numbers -and leads to insecure operation. -The avoid-v4-udp-ports -and avoid-v6-udp-ports options can be used to prevent named -from selecting certain ports. The defaults are: + + + If port is * or is omitted, + a random port number from a pre-configured + range is picked up and will be used for each query. + The port range(s) is that specified in + the use-v4-udp-ports (for IPv4) + and use-v6-udp-ports (for IPv6) + options, excluding the ranges specified in + the avoid-v4-udp-ports + and avoid-v6-udp-ports options, respectively. + + + + The defaults of the query-source and + query-source-v6 options + are: + + query-source address * port *; query-source-v6 address * port *; + + + If use-v4-udp-ports or + use-v6-udp-ports is unspecified, + named will check if the operating + system provides a programming interface to retrieve the + system's default range for ephemeral ports. + If such an interface is available, + named will use the corresponding system + default range; otherwise, it will use its own defaults: + + +use-v4-udp-ports { range 1024 65535; }; +use-v6-udp-ports { range 1024 65535; }; + + + + Note: make sure the ranges be sufficiently large for + security. A desirable size depends on various parameters, + but we generally recommend it contain at least 16384 ports + (14 bits of entropy). + Note also that the system's default range when used may be + too small for this purpose, and that the range may even be + changed while named is running; the new + range will automatically be applied when named + is reloaded. + It is encouraged to + configure use-v4-udp-ports and + use-v6-udp-ports explicitly so that the + ranges are sufficiently large and are reasonably + independent from the ranges used by other applications. + + + + Note: the operational configuration + where named runs may prohibit the use + of some ports. For example, UNIX systems will not allow + named running without a root privilege + to use ports less than 1024. + If such ports are included in the specified (or detected) + set of query ports, the corresponding query attempts will + fail, resulting in resolution failures or delay. + It is therefore important to configure the set of ports + that can be safely used in the expected operational environment. + + + + The defaults of the avoid-v4-udp-ports and + avoid-v6-udp-ports options + are: + + +avoid-v4-udp-ports {}; +avoid-v6-udp-ports {}; + + + + Note: it is generally strongly discouraged to + specify a particular port for the + query-source or + query-source-v6 options; + it implicitly disables the use of randomized port numbers + and can be insecure. + + The address specified in the query-source option is used for both UDP and TCP queries, but the port applies only to @@ -3957,16 +4060,48 @@ but applies to notify messages sent to IPv6 addresses. -Bad UDP Port Lists - -avoid-v4-udp-ports and avoid-v6-udp-ports -specify a list of IPv4 and IPv6 UDP ports that will not be used as system -assigned source ports for UDP sockets. These lists prevent named -from choosing as its random source port a port that is blocked by -your firewall. If a query went out with such a source port, the -answer would not get by the firewall and the name server would have -to query again. - +UDP Port Lists + + use-v4-udp-ports, + avoid-v4-udp-ports, + use-v6-udp-ports, and + avoid-v6-udp-ports + specify a list of IPv4 and IPv6 UDP ports that will be + used or not used as source ports for UDP messages. + See about how the + available ports are determined. + For example, with the following configuration + + + +use-v6-udp-ports { range 32768 65535; }; +avoid-v6-udp-ports { 40000; range 50000 60000; }; + + + + UDP ports of IPv6 messages sent + from named will be in one + of the following ranges: 32768 to 39999, 40001 to 49999, + and 60001 to 65535. + + + + avoid-v4-udp-ports and + avoid-v6-udp-ports can be used + to prevent named from choosing as its random source port a + port that is blocked by your firewall or a port that is + used by other applications; + if a query went out with a source port blocked by a + firewall, the + answer would not get by the firewall and the name server would + have to query again. + Note: the desired range can also be represented only with + use-v4-udp-ports and + use-v6-udp-ports, and the + avoid- options are redundant in that + sense; they are provided for backward compatibility and + to possibly simplify the port specification. + @@ -4073,31 +4208,45 @@ connections that the server will accept. The default is 100. - - reserved-sockets - - - The number of file descriptors reserved for TCP, stdio, - etc. This needs to be big enough to cover the number of - interfaces named listens on, tcp-clients as well as - to provide room for outgoing TCP queries and incoming zone - transfers. The default is 512. - The minimum value is 128 and the - maximum value is 128 less than - 'files' or FD_SETSIZE (whichever is smaller). This - option may be removed in the future. - - - + + reserved-sockets + + + The number of file descriptors reserved for TCP, stdio, + etc. This needs to be big enough to cover the number of + interfaces named listens on, tcp-clients as well as + to provide room for outgoing TCP queries and incoming zone + transfers. The default is 512. + The minimum value is 128 and the + maximum value is 128 less than + maxsockets (-S). This option may be removed in the future. + + + This option has little effect on Windows. + + + max-cache-size -The maximum amount of memory to use for the -server's cache, in bytes. When the amount of data in the cache + +The maximum amount of memory to use for the +server's cache, in bytes. +When the amount of data in the cache reaches this limit, the server will cause records to expire -prematurely so that the limit is not exceeded. In a server with -multiple views, the limit applies separately to the cache of each -view. The default is unlimited, meaning that -records are purged from the cache only when their TTLs expire. +prematurely so that the limit is not exceeded. +A value of 0 is special, meaning that +records are purged from the cache only when their +TTLs expire. +Another special keyword unlimited +means the maximum value of 32-bit unsigned integers +(0xffffffff), which may not have the same effect as +0 on machines that support more than 32 bits of +memory space. +Any positive values less than 2MB will be ignored reset +to 2MB. +In a server with multiple views, the limit applies +separately to the cache of each view. +The default is 0. @@ -4725,7 +4874,7 @@ a client request will be resolved in the context of the first view that it matches. Zones defined within a view statement will -be only be accessible to clients that match the view. +only be accessible to clients that match the view. By defining a zone of the same name in multiple views, different zone data can be given to different clients, for example, "internal" and "external" clients in a split DNS setup. @@ -5545,6 +5694,11 @@ Described in RFC 1035. information about well known network services (replaces WKS). Described in RFC 2782. + +SSHFP +Provides a way to securly publish a secure shell +key's fingerprint. Described in RFC 4255. + TXT text records. Described in RFC 1035. @@ -5899,7 +6053,7 @@ delegation. $GENERATE 1-2 0 NS SERVER$.EXAMPLE. $GENERATE 1-127 $ CNAME $.0 is equivalent to -0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE. +0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE. 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE. 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA. 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA. diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index 34220264a27ce..0dcb9b5510556 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -104,9 +104,11 @@ as none of the name servers share their cached data.

Supported Operating Systems

ISC BIND 9 compiles and runs on a large number -of Unix-like operating system and on Windows NT / 2000. For an up-to-date +of Unix-like operating systems, and on some versions of Microsoft Windows +including Windows XP, Windows 2003, and Windows 2008. For an up-to-date list of supported systems, see the README file in the top level directory -of the BIND 9 source distribution.

+of the BIND 9 source distribution. +

diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 12f30fe38325d..5f2ae11bce04c 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -64,11 +64,11 @@
SIG(0)
DNSSEC
-
Generating Keys
+
Generating Keys
Signing the Zone
Configuring Servers
-
IPv6 Support in BIND 9
+
IPv6 Support in BIND 9
Address Lookups Using AAAA Records
Address to Name Lookups Using Nibble Format
@@ -571,7 +571,7 @@ allow-update { key host1-host2. ;}; zone key of another zone above this one in the DNS tree.

-Generating Keys

+Generating Keys

The dnssec-keygen program is used to generate keys.

A secure zone must contain one or more zone keys. The @@ -717,7 +717,7 @@ options {

-IPv6 Support in BIND 9

+IPv6 Support in BIND 9

BIND 9 fully supports all currently defined forms of IPv6 name to address and address to name lookups. It will also use IPv6 addresses to make queries when running on an IPv6 capable diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index d59d9d198b61c..75d49e3f93338 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -48,46 +48,46 @@

Configuration File Elements
Address Match Lists
-
Comment Syntax
+
Comment Syntax
Configuration File Grammar
-
acl Statement Grammar
+
acl Statement Grammar
acl Statement Definition and Usage
-
controls Statement Grammar
+
controls Statement Grammar
controls Statement Definition and Usage
-
include Statement Grammar
-
include Statement Definition and Usage
-
key Statement Grammar
-
key Statement Definition and Usage
-
logging Statement Grammar
-
logging Statement Definition and Usage
-
lwres Statement Grammar
-
lwres Statement Definition and Usage
-
masters Statement Grammar
-
masters Statement Definition and Usage
-
options Statement Grammar
+
include Statement Grammar
+
include Statement Definition and Usage
+
key Statement Grammar
+
key Statement Definition and Usage
+
logging Statement Grammar
+
logging Statement Definition and Usage
+
lwres Statement Grammar
+
lwres Statement Definition and Usage
+
masters Statement Grammar
+
masters Statement Definition and Usage
+
options Statement Grammar
options Statement Definition and Usage
server Statement Grammar
server Statement Definition and Usage
-
trusted-keys Statement Grammar
-
trusted-keys Statement Definition +
trusted-keys Statement Grammar
+
trusted-keys Statement Definition and Usage
view Statement Grammar
-
view Statement Definition and Usage
+
view Statement Definition and Usage
zone Statement Grammar
-
zone Statement Definition and Usage
+
zone Statement Definition and Usage
-
Zone File
+
Zone File
Types of Resource Records and When to Use Them
-
Discussion of MX Records
+
Discussion of MX Records
Setting TTLs
-
Inverse Mapping in IPv4
-
Other Zone File Directives
-
BIND Master File Extension: the $GENERATE Directive
+
Inverse Mapping in IPv4
+
Other Zone File Directives
+
BIND Master File Extension: the $GENERATE Directive
@@ -202,6 +202,33 @@ be limited by the context in which it is used.

a pathname, such as zones/master/my.test.domain.

+ +

+ port_list +

+ + +

+ A list of an ip_port or a port + range. + A port range is specified in the form of + range followed by + two ip_ports, + port_low and + port_high, which represents + port numbers from port_low through + port_high, inclusive. + port_low must not be larger than + port_high. + For example, + range 1024 65535 represents + ports from 1024 through 65535. + In either case an asterisk (`*') character is not + allowed as a valid ip_port. +

+ + +

size_spec

A number, the word unlimited, @@ -244,7 +271,7 @@ are restricted to slave and stub zones.

Address Match Lists

-Syntax

+Syntax
address_match_list = address_match_list_element ;
   [ address_match_list_element; ... ]
 address_match_list_element = [ ! ] (ip_address [/length] |
@@ -253,7 +280,7 @@ are restricted to slave and stub zones.

 
 

 

-Definition and Usage

+Definition and Usage

 
Address match lists are primarily used to determine access
 control for various server operations. They are also used in
 the listen-on and sortlist
@@ -303,14 +330,14 @@ other 1.2.3.* hosts fall through.

 
 

 

-Comment Syntax

+Comment Syntax

 
The BIND 9 comment syntax allows for comments to appear
 anywhere that whitespace may appear in a BIND configuration
 file. To appeal to programmers of all kinds, they can be written
 in the C, C++, or shell/perl style.

 

 

-Syntax

+Syntax

 
/* This is a BIND comment as in C */

 

 

@@ -323,7 +350,7 @@ in the C, C++, or shell/perl style.

 
 

 

-Definition and Usage

+Definition and Usage

 
Comments may appear anywhere that whitespace may appear in
 a BIND configuration file.

 
C-style comments start with the two characters /* (slash,
@@ -444,7 +471,7 @@ a per-server basis.

     configuration.

 

 

-acl Statement Grammar

+acl Statement Grammar

 
acl acl-name { 
     address_match_list 
 };
@@ -495,7 +522,7 @@ IPv6 addresses, just like localhost
 

 

-controls Statement Grammar

+controls Statement Grammar

 
controls {
    inet ( ip_addr | * ) [ port ip_port ] allow {  address_match_list  }
                 keys {  key_list  };
@@ -600,12 +627,12 @@ statement: controls { };.
 
 

 

-include Statement Grammar

+include Statement Grammar

 
include filename;

 
 

 

-include Statement Definition and Usage

+include Statement Definition and Usage

 
The include statement inserts the
       specified file at the point where the include
       statement is encountered. The include
@@ -616,7 +643,7 @@ statement: controls { };.
 
 

 

-key Statement Grammar

+key Statement Grammar

 
key key_id {
     algorithm string;
     secret string;
@@ -625,7 +652,7 @@ statement: controls { };.
 
 

 

-key Statement Definition and Usage

+key Statement Definition and Usage

 
The key statement defines a shared
 secret key for use with TSIG (see the section called “TSIG”)
 or the command channel
@@ -657,7 +684,7 @@ string.

 
 

 

-logging Statement Grammar

+logging Statement Grammar

 
logging {
    [ channel channel_name {
      ( file path name
@@ -681,7 +708,7 @@ string.

 
 

 

-logging Statement Definition and Usage

+logging Statement Definition and Usage

 
The logging statement configures a wide
 variety of logging options for the name server. Its channel phrase
 associates output methods, format options and severity levels with
@@ -704,7 +731,7 @@ channels, or to standard error if the "-g" option
 was specified.

 

 

-The channel Phrase

+The channel Phrase

 
All log output goes to one or more channels;
 you can make as many of them as you want.

 
Every channel definition must include a destination clause that
@@ -1019,7 +1046,7 @@ a delegation-only in a hint or stu
 
 

 

-lwres Statement Grammar

+lwres Statement Grammar

 
 This is the grammar of the lwres
 statement in the named.conf file:

 
lwres {
@@ -1032,7 +1059,7 @@ statement in the named.conf file:

 
 

 

-lwres Statement Definition and Usage

+lwres Statement Definition and Usage

 
The lwres statement configures the name
 server to also act as a lightweight resolver server. (See
 the section called “Running a Resolver Daemon”.)  There may be multiple
@@ -1060,20 +1087,20 @@ exact match lookup before search path elements are appended.

 
 

 

-masters Statement Grammar

+masters Statement Grammar

 
 masters name [port ip_port] { ( masters_list | ip_addr [port ip_port] [key key] ) ; [...] } ; 
 

 
 

 

-masters Statement Definition and Usage 

+masters Statement Definition and Usage 

 
masters lists allow for a common set of masters
 to be easily used by multiple stub and slave zones.

 
 

 

-options Statement Grammar

+options Statement Grammar

 
This is the grammar of the options
 statement in the named.conf file:

 
options {
@@ -1122,7 +1149,9 @@ statement in the named.conf file:

     [ allow-update-forwarding { address_match_list }; ]
     [ allow-v6-synthesis { address_match_list }; ]
     [ blackhole { address_match_list }; ]
+    [ use-v4-udp-ports { port_list }; ]
     [ avoid-v4-udp-ports { port_list }; ]
+    [ use-v6-udp-ports { port_list }; ]
     [ avoid-v6-udp-ports { port_list }; ]
     [ listen-on [ port ip_port ] { address_match_list }; ]
     [ listen-on-v6 [ port ip_port ] { address_match_list }; ]
@@ -1133,6 +1162,7 @@ statement in the named.conf file:

     [ max-transfer-idle-in number; ]
     [ max-transfer-idle-out number; ]
     [ tcp-clients number; ]
+    [ reserved-sockets number; ]
     [ recursive-clients number; ]
     [ serial-query-rate number; ]
     [ serial-queries number; ]
@@ -1721,7 +1751,7 @@ IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
 
 

 

-Forwarding

+Forwarding

 
The forwarding facility can be used to create a large site-wide
 cache on a few servers, reducing traffic over links to external
 name servers. It can also be used to allow queries by servers that
@@ -1753,7 +1783,7 @@ Statement Grammar”.

 
 

 

-Dual-stack Servers

+Dual-stack Servers

 
Dual-stack servers are used as servers of last resort to work around
 problems in reachability due the lack of support for either IPv4 or IPv6
 on the host machine.

@@ -1834,7 +1864,7 @@ from these addresses will not be responded to. The default is 
 

-Interfaces

+Interfaces
 
The interfaces and ports that the server will answer queries
 from may be specified using the listen-on option. listen-on takes
 an optional port, and an address_match_list.
@@ -1884,28 +1914,90 @@ the server will not listen on any IPv6 address.

 
 

 

-Query Address

+Query Address

 
If the server doesn't know the answer to a question, it will
 query other name servers. query-source specifies
 the address and port used for such queries. For queries sent over
 IPv6, there is a separate query-source-v6 option.
 If address is * (asterisk) or is omitted,
 a wildcard IP address (INADDR_ANY) will be used.
-If port is * or is omitted,
-a random unprivileged port number is picked up and will be
-used for each query.
-It is generally strongly discouraged to
-specify a particular port for the
-query-source or
-query-source-v6 options;
-it implicitly disables the use of randomized port numbers
-and leads to insecure operation.
-The avoid-v4-udp-ports
-and avoid-v6-udp-ports options can be used to prevent named
-from selecting certain ports. The defaults are:

+

+

+            If port is * or is omitted,
+	    a random port number from a pre-configured
+	    range is picked up and will be used for each query.
+	    The port range(s) is that specified in
+	    the use-v4-udp-ports (for IPv4)
+            and use-v6-udp-ports (for IPv6)
+	    options, excluding the ranges specified in
+	    the avoid-v4-udp-ports
+            and avoid-v6-udp-ports options, respectively.
+	  

+

+	    The defaults of the query-source and
+	    query-source-v6 options
+	    are:
+          

 
query-source address * port *;
 query-source-v6 address * port *;
 

+

+	    If use-v4-udp-ports or
+            use-v6-udp-ports is unspecified,
+	    named will check if the operating
+	    system provides a programming interface to retrieve the
+	    system's default range for ephemeral ports.
+	    If such an interface is available,
+	    named will use the corresponding system
+	    default range; otherwise, it will use its own defaults:
+         

+
use-v4-udp-ports { range 1024 65535; };
+use-v6-udp-ports { range 1024 65535; };
+

+

+	    Note: make sure the ranges be sufficiently large for
+	    security.  A desirable size depends on various parameters,
+	    but we generally recommend it contain at least 16384 ports
+	    (14 bits of entropy).
+	    Note also that the system's default range when used may be
+	    too small for this purpose, and that the range may even be
+	    changed while named is running; the new
+	    range will automatically be applied when named
+	    is reloaded.
+	    It is encouraged to
+	    configure use-v4-udp-ports and
+            use-v6-udp-ports explicitly so that the
+            ranges are sufficiently large and are reasonably
+            independent from the ranges used by other applications.
+          

+

+	    Note: the operational configuration
+	    where named runs may prohibit the use
+	    of some ports.  For example, UNIX systems will not allow
+	    named running without a root privilege
+	    to use ports less than 1024.
+	    If such ports are included in the specified (or detected)
+	    set of query ports, the corresponding query attempts will
+	    fail, resulting in resolution failures or delay.
+	    It is therefore important to configure the set of ports
+	    that can be safely used in the expected operational environment.
+	  

+

+	    The defaults of the avoid-v4-udp-ports and
+	    avoid-v6-udp-ports options
+	    are:
+          

+
avoid-v4-udp-ports {};
+avoid-v6-udp-ports {};
+

+

+	    Note: it is generally strongly discouraged to
+            specify a particular port for the
+	    query-source or
+	    query-source-v6 options;
+	    it implicitly disables the use of randomized port numbers
+	    and can be insecure.
+          

 

 
Note

 
The address specified in the query-source option
@@ -2083,20 +2175,49 @@ but applies to notify messages sent to IPv6 addresses.

 

 

 

-Bad UDP Port Lists

+UDP Port Lists

 

-avoid-v4-udp-ports and avoid-v6-udp-ports
-specify a list of IPv4 and IPv6 UDP ports that will not be used as system
-assigned source ports for UDP sockets.  These lists prevent named
-from choosing as its random source port a port that is blocked by
-your firewall.  If a query went out with such a source port, the
-answer would not get by the firewall and the name server would have
-to query again.
-

+	    use-v4-udp-ports,
+	    avoid-v4-udp-ports,
+	    use-v6-udp-ports, and
+	    avoid-v6-udp-ports
+	    specify a list of IPv4 and IPv6 UDP ports that will be
+	    used or not used as source ports for UDP messages.
+	    See the section called “Query Address” about how the
+	    available ports are determined.
+	    For example, with the following configuration
+          

+
+use-v6-udp-ports { range 32768 65535; };
+avoid-v6-udp-ports { 40000; range 50000 60000; };
+

+

+	     UDP ports of IPv6 messages sent
+	     from named will be in one
+	     of the following ranges: 32768 to 39999, 40001 to 49999,
+	     and 60001 to 65535.
+	   

+

+	     avoid-v4-udp-ports and
+	     avoid-v6-udp-ports can be used
+             to prevent named from choosing as its random source port a
+             port that is blocked by your firewall or a port that is
+             used by other applications;
+	     if a query went out with a source port blocked by a
+             firewall, the
+	     answer would not get by the firewall and the name server would
+             have to query again.
+	     Note: the desired range can also be represented only with
+	     use-v4-udp-ports and
+	     use-v6-udp-ports, and the
+	     avoid- options are redundant in that
+	     sense; they are provided for backward compatibility and
+	     to possibly simplify the port specification.
+	   

 
 

 

-Operating System Resource Limits

+Operating System Resource Limits

 
The server's usage of many system resources can be limited.
 Scaled values are allowed when specifying resource limits.  For
 example, 1G can be used instead of
@@ -2140,7 +2261,7 @@ may use. The default is default.

 
 

 

-Server  Resource Limits

+Server  Resource Limits

 
The following options set limits on the server's
 resource consumption that are enforced internally by the
 server rather than the operating system.

@@ -2174,14 +2295,42 @@ on hosts with limited memory.
 
The maximum number of simultaneous client TCP
 connections that the server will accept.
 The default is 100.

+
reserved-sockets

+

+

+		  The number of file descriptors reserved for TCP, stdio,
+		  etc.  This needs to be big enough to cover the number of
+		  interfaces named listens on, tcp-clients as well as
+		  to provide room for outgoing TCP queries and incoming zone
+		  transfers.  The default is 512.
+		  The minimum value is 128 and the
+		  maximum value is 128 less than
+		  maxsockets (-S).  This option may be removed in the future.
+		  

+

+		  This option has little effect on Windows.
+		  

+

 
max-cache-size

-
The maximum amount of memory to use for the
-server's cache, in bytes.  When the amount of data in the cache
+

+The maximum amount of memory to use for the
+server's cache, in bytes.
+When the amount of data in the cache
 reaches this limit, the server will cause records to expire
-prematurely so that the limit is not exceeded.  In a server with
-multiple views, the limit applies separately to the cache of each
-view.  The default is unlimited, meaning that 
-records are purged from the cache only when their TTLs expire.
+prematurely so that the limit is not exceeded.
+A value of 0 is special, meaning that
+records are purged from the cache only when their
+TTLs expire.
+Another special keyword unlimited
+means the maximum value of 32-bit unsigned integers
+(0xffffffff), which may not have the same effect as
+0 on machines that support more than 32 bits of
+memory space.
+Any positive values less than 2MB will be ignored reset
+to 2MB.
+In a server with multiple views, the limit applies
+separately to the cache of each view.
+The default is 0.
 

 
tcp-listen-queue

 
The listen queue depth.  The default and minimum is 3.
@@ -2194,7 +2343,7 @@ silently raised.
 
 

 

-Periodic Task Intervals

+Periodic Task Intervals

 

 
cleaning-interval

 
The server will remove expired resource records
@@ -2689,7 +2838,7 @@ For more details, see the description of
 

 

 

-trusted-keys Statement Grammar

+trusted-keys Statement Grammar

 
trusted-keys {
     string number number number string ;
     [ string number number number string ; [...]]
@@ -2698,7 +2847,7 @@ For more details, see the description of
 
 

 

-trusted-keys Statement Definition
+trusted-keys Statement Definition
 	    and Usage

 

 	    The trusted-keys statement defines
@@ -2741,7 +2890,7 @@ For more details, see the description of
 

 

 

-view Statement Definition and Usage

+view Statement Definition and Usage

 
The view statement is a powerful new feature
 of BIND 9 that lets a name server answer a DNS query differently
 depending on who is asking. It is particularly useful for implementing
@@ -2764,7 +2913,7 @@ The order of the view statements i
 a client request will be resolved in the context of the first
 view that it matches.

 
Zones defined within a view statement will
-be only be accessible to clients that match the view.
+only be accessible to clients that match the view.
  By defining a zone of the same name in multiple views, different
 zone data can be given to different clients, for example, "internal"
 and "external" clients in a split DNS setup.

@@ -2943,10 +3092,10 @@ zone zone_name [
 

 

-zone Statement Definition and Usage

+zone Statement Definition and Usage

 

 

-Zone Types

+Zone Types

 
@@ -3059,7 +3208,7 @@ from forwarders.

 

-Class

+Class
The zone's name may optionally be followed by a class. If
 a class is not specified, class IN (for Internet),
 is assumed. This is correct for the vast majority of cases.

@@ -3074,7 +3223,7 @@ in the mid-1970s. Zone data for it can be specified with the 
 

-Zone Options

+Zone Options
 

 
allow-notify

 
See the description of
@@ -3322,7 +3471,7 @@ name, the rules are checked for each existing record type.
 

 

 

-Zone File

+Zone File

 

 

 Types of Resource Records and When to Use Them

@@ -3332,7 +3481,7 @@ Since the publication of RFC 1034, several new RRs have been identified
 and implemented in the DNS. These are also included.

 

 

-Resource Records

+Resource Records

 
A domain name identifies a node.  Each node has a set of
         resource information, which may be empty.  The set of resource
         information associated with a particular name is composed of
@@ -3520,6 +3669,11 @@ Described in RFC 1035.

 services (replaces WKS).  Described in RFC 2782.

 
 
+
+
+
+
@@ -3591,7 +3745,7 @@ used as "pointers" to other data in the DNS.

 
 

 

-Textual expression of RRs

+Textual expression of RRs

 
RRs are represented in binary form in the packets of the DNS
 protocol, and are usually represented in highly encoded form when
 stored in a name server or resolver.  In the examples provided in
@@ -3681,7 +3835,7 @@ each of a different class.

 
 

 

-Discussion of MX Records

+Discussion of MX Records

 
As described above, domain servers store information as a
 series of resource records, each of which contains a particular
 piece of information about a given domain name (which is usually,
@@ -3798,7 +3952,7 @@ can be explicitly specified, for example, 1h30m. 
 

 

-Inverse Mapping in IPv4

+Inverse Mapping in IPv4

 
Reverse name resolution (that is, translation from IP address
 to name) is achieved by means of the in-addr.arpa domain
 and PTR records. Entries in the in-addr.arpa domain are made in
@@ -3836,7 +3990,7 @@ that the example is relative to the listed origin.

 
 

 

-Other Zone File Directives

+Other Zone File Directives

 
The Master File Format was initially defined in RFC 1035 and
 has subsequently been extended. While the Master File Format itself
 is class independent all records in a Master File must be of the same
@@ -3845,7 +3999,7 @@ class.

 and $TTL.

 

 

-The $ORIGIN Directive

+The $ORIGIN Directive

 
Syntax: $ORIGIN
 domain-name [ comment]

 
$ORIGIN sets the domain name that will
@@ -3860,7 +4014,7 @@ WWW     CNAME   MAIN-SERVER
 
 

 

-The $INCLUDE Directive

+The $INCLUDE Directive

 
Syntax: $INCLUDE
 filename [
 origin ] [ comment ]

@@ -3884,7 +4038,7 @@ This could be construed as a deviation from RFC 1035, a feature, or both.
 
 

 

-The $TTL Directive

+The $TTL Directive

 
Syntax: $TTL
 default-ttl [
 comment ]

@@ -3895,7 +4049,7 @@ with undefined TTLs. Valid TTLs are of the range 0-2147483647 seconds.

 
 

 

-BIND Master File Extension: the  $GENERATE Directive

+BIND Master File Extension: the  $GENERATE Directive

 
Syntax: $GENERATE range lhs [ttl] [class] type rhs [ comment ]

 
$GENERATE is used to create a series of
 resource records that only differ from each other by an iterator. $GENERATE can
@@ -3906,7 +4060,7 @@ delegation.

 $GENERATE 1-2 0 NS SERVER$.EXAMPLE.
 $GENERATE 1-127 $ CNAME $.0
 
is equivalent to

-
0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE.
+
0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE.
 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index cfb405482e982..535956fbe18ef 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -46,11 +46,11 @@
 
Table of Contents

 

 
Access Control Lists

-
Chroot and Setuid (for
+
Chroot and Setuid (for
 UNIX servers)

 

-
The chroot Environment

-
Using the setuid Function

+
The chroot Environment

+
Using the setuid Function

 

 
Dynamic Update Security

 

@@ -102,7 +102,7 @@ see the AUSCERT advisory at
 
 

 

-Chroot and Setuid (for
+Chroot and Setuid (for
 UNIX servers)

 
On UNIX servers, it is possible to run BIND in a chrooted environment
 (using the chroot() function) by specifying the "-t"
@@ -117,7 +117,7 @@ user 202:

 
/usr/local/bin/named -u 202 -t /var/named

 

 

-The chroot Environment

+The chroot Environment

 
In order for a chroot environment to
 work properly in a particular directory
 (for example, /var/named),
@@ -142,7 +142,7 @@ to set up things like
 
 

 

-Using the setuid Function

+Using the setuid Function

 
Prior to running the named daemon, use
 the touch utility (to change file access and
 modification times) or the chown utility (to
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index 1bb97711b5b56..b4577ba1ae26e 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -45,18 +45,18 @@
 

 
Table of Contents

 

-
Common Problems

-
It's not working; how can I figure out what's wrong?

-
Incrementing and Changing the Serial Number

-
Where Can I Get Help?

+
Common Problems

+
It's not working; how can I figure out what's wrong?

+
Incrementing and Changing the Serial Number

+
Where Can I Get Help?

 

 

 

 

-Common Problems

+Common Problems

 

 

-It's not working; how can I figure out what's wrong?

+It's not working; how can I figure out what's wrong?

 
The best solution to solving installation and
       configuration issues is to take preventative measures by setting
       up logging files beforehand. The log files provide a
@@ -66,7 +66,7 @@
 
 

 

-Incrementing and Changing the Serial Number

+Incrementing and Changing the Serial Number

 

 	  Zone serial numbers are just numbers — they aren't
 	  date related.  A lot of people set them to a number that
@@ -89,7 +89,7 @@
 
 

 

-Where Can I Get Help?

+Where Can I Get Help?

 
The Internet Software Consortium (ISC) offers a wide range
     of support and service agreements for BIND and DHCP servers. Four
     levels of premium support are available and each level includes
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 4d07ae9a1cb63..907b23cbeeea7 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -43,24 +43,24 @@
 

 
Table of Contents

 

-
Acknowledgments

-
A Brief History of the DNS and BIND

+
Acknowledgments

+
A Brief History of the DNS and BIND

 
General DNS Reference Information

 
IPv6 addresses (AAAA)

 
Bibliography (and Suggested Reading)

 

 
Request for Comments (RFCs)

 
Internet Drafts

-
Other Documents About BIND

+
Other Documents About BIND

 

 

 

 

 

-Acknowledgments

+Acknowledgments

 

 

-A Brief History of the DNS and BIND
+A Brief History of the DNS and BIND
 

 
Although the "official" beginning of the Domain Name
       System occurred in 1984 with the publication of RFC 920, the
@@ -277,17 +277,17 @@ the number of the RFC). RFCs are also available via the Web at
 

 

 

-Bibliography

+Bibliography

 

 
Standards

 

-
[RFC974] C. Partridge. Mail Routing and the Domain System. January 1986. 

+
[RFC974] C. Partridge. Mail Routing and the Domain System. January 1986. 

 

 

-
[RFC1034] P.V. Mockapetris. Domain Names — Concepts and Facilities. November 1987. 

+
[RFC1034] P.V. Mockapetris. Domain Names — Concepts and Facilities. November 1987. 

 

 

-
[RFC1035] P. V. Mockapetris. Domain Names — Implementation and
+
[RFC1035] P. V. Mockapetris. Domain Names — Implementation and
 Specification. November 1987. 

 

 

@@ -295,22 +295,22 @@ Specification. November 1987. 

 

 Proposed Standards

 

-
[RFC2181] R., R. Bush Elz. Clarifications to the DNS Specification. July 1997. 

+
[RFC2181] R., R. Bush Elz. Clarifications to the DNS Specification. July 1997. 

 

 

-
[RFC2308] M. Andrews. Negative Caching of DNS Queries. March 1998. 

+
[RFC2308] M. Andrews. Negative Caching of DNS Queries. March 1998. 

 

 

-
[RFC1995] M. Ohta. Incremental Zone Transfer in DNS. August 1996. 

+
[RFC1995] M. Ohta. Incremental Zone Transfer in DNS. August 1996. 

 

 

-
[RFC1996] P. Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996. 

+
[RFC1996] P. Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996. 

 

 

-
[RFC2136] P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. Dynamic Updates in the Domain Name System. April 1997. 

+
[RFC2136] P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. Dynamic Updates in the Domain Name System. April 1997. 

 

 

-
[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000. 

+
[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000. 

 

 
 

@@ -321,85 +321,85 @@ Specification. November 1987. 

 RFCs are undergoing major revision by the IETF.

 

 

-
[RFC1886] S. Thomson and C. Huitema. DNS Extensions to support IP version 6. December 1995. 

+
[RFC1886] S. Thomson and C. Huitema. DNS Extensions to support IP version 6. December 1995. 

 

 

-
[RFC2065] D. Eastlake, 3rd and C. Kaufman. Domain Name System Security Extensions. January 1997. 

+
[RFC2065] D. Eastlake, 3rd and C. Kaufman. Domain Name System Security Extensions. January 1997. 

 

 

-
[RFC2137] D. Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997. 

+
[RFC2137] D. Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997. 

 

 
 

 
Other Important RFCs About DNS Implementation

 

-
[RFC1535] E. Gavron. A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993. 

+
[RFC1535] E. Gavron. A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993. 

 

 

-
[RFC1536] A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. Common DNS Implementation Errors and Suggested Fixes. October 1993. 

+
[RFC1536] A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. Common DNS Implementation Errors and Suggested Fixes. October 1993. 

 

 

-
[RFC1982] R. Elz and R. Bush. Serial Number Arithmetic. August 1996. 

+
[RFC1982] R. Elz and R. Bush. Serial Number Arithmetic. August 1996. 

 

 

 

 
Resource Record Types

 

-
[RFC1183] C.F. Everhart, L. A. Mamakos, R. Ullmann, and P. Mockapetris. New DNS RR Definitions. October 1990. 

+
[RFC1183] C.F. Everhart, L. A. Mamakos, R. Ullmann, and P. Mockapetris. New DNS RR Definitions. October 1990. 

 

 

-
[RFC1706] B. Manning and R. Colella. DNS NSAP Resource Records. October 1994. 

+
[RFC1706] B. Manning and R. Colella. DNS NSAP Resource Records. October 1994. 

 

 

-
[RFC2168] R. Daniel and M. Mealling. Resolution of Uniform Resource Identifiers using
+
[RFC2168] R. Daniel and M. Mealling. Resolution of Uniform Resource Identifiers using
 the Domain Name System. June 1997. 

 

 

-
[RFC1876] C. Davis, P. Vixie, T., and I. Dickinson. A Means for Expressing Location Information in the Domain
+
[RFC1876] C. Davis, P. Vixie, T., and I. Dickinson. A Means for Expressing Location Information in the Domain
 Name System. January 1996. 

 

 

-
[RFC2052] A. Gulbrandsen and P. Vixie. A DNS RR for Specifying the Location of
+
[RFC2052] A. Gulbrandsen and P. Vixie. A DNS RR for Specifying the Location of
 Services.. October 1996. 

 

 

-
[RFC2163] A. Allocchio. Using the Internet DNS to Distribute MIXER
+
[RFC2163] A. Allocchio. Using the Internet DNS to Distribute MIXER
 Conformant Global Address Mapping. January 1998. 

 

 

-
[RFC2230] R. Atkinson. Key Exchange Delegation Record for the DNS. October 1997. 

+
[RFC2230] R. Atkinson. Key Exchange Delegation Record for the DNS. October 1997. 

 

 

 

 

 DNS and the Internet

 

-
[RFC1101] P. V. Mockapetris. DNS Encoding of Network Names and Other Types. April 1989. 

+
[RFC1101] P. V. Mockapetris. DNS Encoding of Network Names and Other Types. April 1989. 

 

 

-
[RFC1123] Braden. Requirements for Internet Hosts - Application and Support. October 1989. 

+
[RFC1123] Braden. Requirements for Internet Hosts - Application and Support. October 1989. 

 

 

-
[RFC1591] J. Postel. Domain Name System Structure and Delegation. March 1994. 

+
[RFC1591] J. Postel. Domain Name System Structure and Delegation. March 1994. 

 

 

-
[RFC2317] H. Eidnes, G. de Groot, and P. Vixie. Classless IN-ADDR.ARPA Delegation. March 1998. 

+
[RFC2317] H. Eidnes, G. de Groot, and P. Vixie. Classless IN-ADDR.ARPA Delegation. March 1998. 

 

 

 

 

 DNS Operations

 

-
[RFC1537] P. Beertema. Common DNS Data File Configuration Errors. October 1993. 

+
[RFC1537] P. Beertema. Common DNS Data File Configuration Errors. October 1993. 

 

 

-
[RFC1912] D. Barr. Common DNS Operational and Configuration Errors. February 1996. 

+
[RFC1912] D. Barr. Common DNS Operational and Configuration Errors. February 1996. 

 

 

-
[RFC2010] B. Manning and P. Vixie. Operational Criteria for Root Name Servers.. October 1996. 

+
[RFC2010] B. Manning and P. Vixie. Operational Criteria for Root Name Servers.. October 1996. 

 

 

-
[RFC2219] M. Hamilton and R. Wright. Use of DNS Aliases for Network Services.. October 1997. 

+
[RFC2219] M. Hamilton and R. Wright. Use of DNS Aliases for Network Services.. October 1997. 

 

 

 

@@ -410,28 +410,28 @@ Conformant Global Address Mapping. January 1998
 DNS-related, are not concerned with implementing software.

 

 

-
[RFC1464] R. Rosenbaum. Using the Domain Name System To Store Arbitrary String Attributes. May 1993. 

+
[RFC1464] R. Rosenbaum. Using the Domain Name System To Store Arbitrary String Attributes. May 1993. 

 

 

-
[RFC1713] A. Romao. Tools for DNS Debugging. November 1994. 

+
[RFC1713] A. Romao. Tools for DNS Debugging. November 1994. 

 

 

-
[RFC1794] T. Brisco. DNS Support for Load Balancing. April 1995. 

+
[RFC1794] T. Brisco. DNS Support for Load Balancing. April 1995. 

 

 

-
[RFC2240] O. Vaughan. A Legal Basis for Domain Name Allocation. November 1997. 

+
[RFC2240] O. Vaughan. A Legal Basis for Domain Name Allocation. November 1997. 

 

 

-
[RFC2345] J. Klensin, T. Wolf, and G. Oglesby. Domain Names and Company Name Retrieval. May 1998. 

+
[RFC2345] J. Klensin, T. Wolf, and G. Oglesby. Domain Names and Company Name Retrieval. May 1998. 

 

 

-
[RFC2352] O. Vaughan. A Convention For Using Legal Names as Domain Names. May 1998. 

+
[RFC2352] O. Vaughan. A Convention For Using Legal Names as Domain Names. May 1998. 

 

 
 

 
Obsolete and Unimplemented Experimental RRs

 

-
[RFC1712] C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. DNS Encoding of Geographical
+
[RFC1712] C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. DNS Encoding of Geographical
 Location. November 1994. 

 

 

@@ -451,14 +451,14 @@ after which they are deleted unless updated by their authors.
 
 

 

-Other Documents About BIND
+Other Documents About BIND
 

 

 

 

-Bibliography

+Bibliography

 

-
Paul Albitz and Cricket Liu. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. 

+
Paul Albitz and Cricket Liu. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. 

 

 
 
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 41b763c3e35eb..02c0f1a987794 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -107,11 +107,11 @@
 
SIG(0)

 
DNSSEC

 

-
Generating Keys

+
Generating Keys

 
Signing the Zone

 
Configuring Servers

 

-
IPv6 Support in BIND 9

+
IPv6 Support in BIND 9

 

 
Address Lookups Using AAAA Records

 
Address to Name Lookups Using Nibble Format

@@ -127,77 +127,77 @@
 
Configuration File Elements

 

 
Address Match Lists

-
Comment Syntax

+
Comment Syntax

 

 
Configuration File Grammar

 

-
acl Statement Grammar

+
acl Statement Grammar

 
acl Statement Definition and
 Usage

-
controls Statement Grammar

+
controls Statement Grammar

 
controls Statement Definition and Usage

-
include Statement Grammar

-
include Statement Definition and Usage

-
key Statement Grammar

-
key Statement Definition and Usage

-
logging Statement Grammar

-
logging Statement Definition and Usage

-
lwres Statement Grammar

-
lwres Statement Definition and Usage

-
masters Statement Grammar

-
masters Statement Definition and Usage 

-
options Statement Grammar

+
include Statement Grammar

+
include Statement Definition and Usage

+
key Statement Grammar

+
key Statement Definition and Usage

+
logging Statement Grammar

+
logging Statement Definition and Usage

+
lwres Statement Grammar

+
lwres Statement Definition and Usage

+
masters Statement Grammar

+
masters Statement Definition and Usage 

+
options Statement Grammar

 
options Statement Definition and Usage

 
server Statement Grammar

 
server Statement Definition and Usage

-
trusted-keys Statement Grammar

-
trusted-keys Statement Definition
+
trusted-keys Statement Grammar

+
trusted-keys Statement Definition
 	    and Usage

 
view Statement Grammar

-
view Statement Definition and Usage

+
view Statement Definition and Usage

 
zone
 Statement Grammar

-
zone Statement Definition and Usage

+
zone Statement Definition and Usage

 

-
Zone File

+
Zone File

 

 
Types of Resource Records and When to Use Them

-
Discussion of MX Records

+
Discussion of MX Records

 
Setting TTLs

-
Inverse Mapping in IPv4

-
Other Zone File Directives

-
BIND Master File Extension: the  $GENERATE Directive

+
Inverse Mapping in IPv4

+
Other Zone File Directives

+
BIND Master File Extension: the  $GENERATE Directive

 

 

 
7. BIND 9 Security Considerations

 

 
Access Control Lists

-
Chroot and Setuid (for
+
Chroot and Setuid (for
 UNIX servers)

 

-
The chroot Environment

-
Using the setuid Function

+
The chroot Environment

+
Using the setuid Function

 

 
Dynamic Update Security

 

 
8. Troubleshooting

 

-
Common Problems

-
It's not working; how can I figure out what's wrong?

-
Incrementing and Changing the Serial Number

-
Where Can I Get Help?

+
Common Problems

+
It's not working; how can I figure out what's wrong?

+
Incrementing and Changing the Serial Number

+
Where Can I Get Help?

 

 
A. Appendices

 

-
Acknowledgments

-
A Brief History of the DNS and BIND

+
Acknowledgments

+
A Brief History of the DNS and BIND

 
General DNS Reference Information

 
IPv6 addresses (AAAA)

 
Bibliography (and Suggested Reading)

 

 
Request for Comments (RFCs)

 
Internet Drafts

-
Other Documents About BIND

+
Other Documents About BIND

 

 

 
diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
index 7b599bab06e60..324b8cb028d12 100644
--- a/doc/arm/Bv9ARM.pdf
+++ b/doc/arm/Bv9ARM.pdf
@@ -561,7 +561,7 @@ endobj
 << /S /GoTo /D (subsubsection.6.2.16.8) >>
 endobj
 380 0 obj
-(6.2.16.8 Bad UDP Port Lists)
+(6.2.16.8 UDP Port Lists)
 endobj
 381 0 obj
 << /S /GoTo /D (subsubsection.6.2.16.9) >>
@@ -885,12 +885,11 @@ endobj
 << /S /GoTo /D [594 0 R  /FitH ] >>
 endobj
 596 0 obj <<
-/Length 220       
+/Length 222       
 /Filter /FlateDecode
 >>
 stream
-xÚ=O1†÷û[‰3þl’±©(êpj¯¨R{HGø÷äz¥B‚eHl?öë¼TCt$M!:±ÃúP¼–Ú}ÅgÆ\ÑMµTkMŠÑ4B-1¢ûL~b¿p6à1Aíä˜Êð_äêúÎ8 °ä-°%B
-.o^&‹‡§›i-N“4^óÍa×íÞ}s|ëÇÔs»mû¶[·c¸lºf?]åÇ"¡ÀŒÉ]N0P(«GÃY?I,›Ï±QÂÕùA‡þê6_>òíœ:ÞüÛ·/kP»endstream
+xÚOOÃ0Åïý>n1ql¯Î‘‰?	PnˆCé24‰uR)ߟt-±ãŸÞK/E`Šž£@Õ“B»¯<¼•ÝME3#ʨÂ\†?¶Ž#£	¸`†ª«ðû…“ÖlœzÅXÄG|ªók	@5R´’ˆuð'.mžëۇ˥êq:.6û]·ûúf8ôÓÕSÞæ>wmžÆû¦ûlÞ—/é®X0aT
G*6À™àÊ‚-Ûáðšg­ gsã½ÕU:}æ;=Vóùwv_þÜRXendstream
 endobj
 594 0 obj <<
 /Type /Page
@@ -1241,12 +1240,16 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 679 0 obj <<
-/Length 561       
+/Length 606       
 /Filter /FlateDecode
 >>
 stream
-xÚ¥T]o›0}çWø¤áúƒý˜¦´K¥¤)MSׇ4¸ÆÇÚþûl¢tOŠÌ=çúúÜÃu0@êÁ€ùÐD€@x!ÌÀî`!°WÜ…MŽ;&¹Ó¬ëĺºõ	PøÄÉ뤇ˆs’ôÉ&AGU@v¼Y¯"‡vÞ8.aÈ~X‡ÑÌ	<;Y¬î4“p;.¶ç_gë$Œ4EL¡ëÅÊìÂøaÍÃ1zÜ,¢p®’ØyNî­09ö0í#Ú7ðÛzzF UíÞ[RÁxS‚X–Ç(d¥#’[±õx,8a‡­Ÿú†$TytiœGö õ9uŽ	Hx@Fç#¤<骪¬[™×*YoÛ¬ØÇ>šVš¾cU—N>.áÐ
-.â¹ÚáñÑ@/°…vå¡ÊrÙèh[¤ú¥v¸ÝN-Ãê%ßÖæö^j¶è/²ÖTùª×M‘½»yöˤ”ÙŠmÙg'žùæ0fgEZ¾M«D¯W}›}cCÁ˜qJ™¤fƒ*þ¶ìEøD•ìWjw•Û–nºm¥Æó¬i53ÈTH3qWÁZWó¥˜ÝH©áö§)…³›e¨Á‘ÜàYq–¨^ÊÊ)ÿÈ\ci6¸&wmYhVËÐûÎzÓ÷ç4ìB/MÙ
5vRÇ©j¨Î^º6+ø¯±§ö³úɪŸqò¿¯Äé 圜¦}:•„#(zÕwÉ/„WçRù_`éendstream
+xÚ¥T[o›0~çWðh¤âù‚Á~ì…v©”6¢mêú§C#8ãÒ®ÿ~›„-éÓ„Ïýœï3ì"ý`—…0D¸‘ C˜¹ë­ƒÜí»q°ñÇ u‘9Ÿ®Câ
+(BºÙfR‹CÄ9v³üÈ §+ .‹ûÄ£Èâ+Ï'ûEœœ{Q²ÙÝ1¥ßÒ,ž§žOE€ÁåçóE'ÆEl¡‹ÙÍOâô~™\Æ£ö°œ%ñ<¾ËRï)»uâlaŠ#Úøå<>!7×po©àÌ}Ó
+‚Xân€QÈJGKé¤ÎþàÄ;¤žä
#H¨æ蘸€¸8€4ÐÎ)sL@Â#22çù!ÍI·Û©º•¹em'ëU[T/–±÷¦•Û¦G¬ëÒÉ… ×'†‘ CÁYz©34ÿ–@-	s¬ÕvW”²1ÚªêÑÔ]e­ª²^s”«ÚüH£VÝöYÖ6rcÎeUüöËâ§
Q“±uñÆŒ}¦µ=mµµy¯²n
+U
{HCÁ˜áhh…)˜ëaÕ¨MkL_<Æ@Qåê­1†¢Z—]núûðuáa"ÀÙé!ÚûÈ8ì©:ˆë¯”ˆ\«Ú­*ãëv~ëa ü|ÕJc*‹¦ý>À
+8h&ß«Êh¤4æö‡’øüjù;B¤´ö¢ú'°U;#”òU–FÌ‹A¹nUýnLãû<ûáèæÂN¤º!k-Ç"M[Ï]«/~´ƒ”Á~qNlŒ~íåþ÷~~ZA)çä°zÓ!AÑýP=ûühðq'ÿ®yD
+endstream
 endobj
 678 0 obj <<
 /Type /Page
@@ -2231,24 +2234,27 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 839 0 obj <<
-/Length 3530      
+/Length 3946      
 /Filter /FlateDecode
 >>
 stream
-xÚÍ[[sÛ6~÷¯Ð>UîD0î—vö!mnºmÚMÝÙ‡¶“Òíp"QIÅqw÷¿ïÁU$ÑîÚÙÉ$„@ð8—ï\€†?d&$’†š™2	LÄl¹9Á³kx÷õ		cqТ?ê‹‹“³’Î2’ÊÙÅU–FXk2»Xý<—ˆ S €ç_~ÿêÅ˯zýüTñùÅËï_.¨Àó/¿=÷­óoÏ¿;uñ#üÂÌÌ¿üÛó.Î_ûw2ùâ嫯|ñ#T_Ÿ¿8}þêËóÓ_/¾99¿H›éo˜`fwòþäç_ñlûþæ#f´˜ÝÂŒˆ1t¶9á‚!Á‹=ë“Oþ‘öÞºOsäœ I›-´DTIq|Z?†iCS¤”УYR#I°•	ÖˆÒ½H„ê‰Dqd´š) "eN"Õ͘'Z!ÁŒÙ{S(Ö:Ï’E$¸èS<\ÁHÐñònšòªúh—xö‚³ÞhB¡­˜ÄŽ{^Ÿ.Ãó—?À“šy]v·ÛæïloÊeõÆ´\ù·Eë_µ§ÉC‰R
RÒâ°)‰*$±ŒÝw~ÇÛMÕuå
-Ø&›¿Ø6¾»üXlnÖå³@ˆŽŒ‡p€O‰Pu¦sóI$Ž&VF[q9¡\"bñ-ïpV:KŒÚOŠ°ý“™F¦My[uo-Ž'ÉЖp‘D	S!¦iGÒVy3ì1ì?-QÄ>£9q
-©LEa‹È#2£j¨ºGDAãÃysr1ýI#{ð4{„á²Çžô—çf
-^¨¨hl/Ü€AYQöÜÍã˜?b&Çl=œdüâ˜O”š#F¸štŠÒS…änÃïÊ»ñ–
øu¢Ä~Üc"\ô)f¼"Ø µùÁúªUÖ#@Å¢G̹6Œ¸¢Q±WÛMQÕX²çL©§Ûi¢xÏV©‚åQ)†{­‹M™Ç&p€ÑVœ'(oü£-ëÎúŒ8tÎÅ6hqç‰lOáíÛ·ò¿­ð	!ÖcRÎlë»/ê)ˆPdz»Ö}ílã]SÔm±ìªmí;Úr¹kªÎ?nR}m}œŒmŠ?¥MIælÚ¦”@€:ä^›ŠãžÎ¦z'lª¿¾uÕv±*ˆ–¸ìZV™óm]†ŽÆ?7[¯U3´¢Æ,¢q†1ŒIpRÂ<gÅ{Xì{èò&7Á¡ù]´.À å7ESt>¼ä!¼´Ý›j¹]oëÖ÷ÇVÄbàiþ±¬WÞ€Álöî­ˆvHMØPO;ŸÊ† >ÓRüW¿8jCòg´'mHP„¼qXèãéŒ,¸Í禧¥6ÙÖ‹º¼.ºêƒUNH˜]@üíßVuW^Ûèܾ°a}…Jd¥¨•ËÄ>~·#.!®+m„o_`ߥˆ‡hLãF*j„%Ç%Lµ\ïZX…Mlî	ýK›0
-s-—åMW\®í©œ(Ö»Ò¿ÚT×o;ß{µkÊß°x”¬+„#[Ås0ìðË-ì÷cçT“oßVË ]U|Õú§…ô	
ëÉîqêð§F>#Iõt9@‰ˆÂž‡7E÷ö¦!6 Ú4ðÑ0.ú×G0E\C¬>Xá‘x€0Ñ=zþ~·õHí¶k¦0©¢Øm÷mµ^ûÖeéŸÞ—Û–+اXÞØÙ­R5ow‘Œ;ù‘Mü¢=ƒð¼+›³ÍêʶCûl¼	¨h¸º7ïKø©ÎB2øÇ?¢Ûé“cšÈ%dœ”LÇàÂPÈIŒÏÛê÷ò˜&¦O¦‰}Šš8\áM¹|ˆ&ºÔÌ#)DŸÏF¸tëã„àa!3êÅ	I“<쮎w8§`HÝ«õXÊ)}ÀT–Q¦b8½*¯ŠÝ:q‚4OU7´/øx€Æϳµ5`H…ýŽ\ЬÄC€Ôu&4sýøH(R\ôIf"!@xÆ5ÝÏx]MyÕ”þÞÆA€*,Ì8NÈc#÷Wp¨[ܸ° oÍÿéò#!y( ÙVz
-ÿ°5°Ü^ˆMŸiºØðÜðH#ˆ0D»ã|îÉâ!QÇÀ|´Iz7Á&‹)FŒá™bÃன–¾`Ã9#¼k×ŇÒw¹ÀÚõu»KßreÄ	èëÊS•¥÷7Ùî½ß(¬FWãþ·¯Òq4ìH+püPÐxÞ¿RwpµŽ*muÔ^©²’Pû‚§ÉÚ{·§"y“n'PgŒñüùjªâwE	¾­lQçð†¶U»Rº'•ˆýx™ÉÇ|‘¸ÿUá'}³±ó½ñ‡Œ¶DóWÿ8|ý¦\—H{üûϧ¸8ÐüãŸ~î¿EÅk_ƒÏÉ=Ÿ§
-Ï¿„§;NºySD&Ú1gë²¾¶gyöÇ¿/Õž‡º1ÐxS­âxÏåú?Èïuþëw|ÿüÃÝX;”Û~¿\þ/æÅGƒø¾*íåÁºÚŸå{Ë„ÆOmq3þ‘`­6y›oým‚MÐ(h®FA“ö@úošjS4•KÅàg¸b`¯4„	«²+›MU—áãå2‘·‡]þvÜÚwøk	Ðø$·»0_*`Á‹íMÙv‡/ÖzlÈ{—Ëá{‹¤!д­Ý)™‡%R_CS©¦9â¹ÖÀé÷vÿe½È
܆ë)¢?z[K¨ä¶ÚmÓ9ÊgQ¦#±¶+:§Á~¿Â‡øvÑA³â¡"–«mWu».n>ì²J—ézsÒ›
-Ž*czî*y>cªrowM¥€ûš^U_vì3aÀ-ùô½íþ(„÷#OH¢˜ìÑò…¢Æ“* G4ž4:œtèÑ	øTð•ƒI#gì^Ç™›…G™—?|àÃãè‘ÑسL‚4SLîaRoÔ“â¨{™45éžIãIóLêO:fR¨…YÀú¸çR¬iÿvöIHæ¶3öIFÙS/ÁÔ=Œêš`Tu/£¦&Ý3j$©I‹lI]ËÌnŽFÞÝÿ¾çàÆî&HÉ+¦jkÊn>Îõ; ›PøÇ&Jí¸›'‰¢LMæ«:¹ƒwß\°8f–Íú£þp}ñææGœæzr}Û£e	µ–M®›jÂÈ%P Ó¯¿ÿðîý7?ýðöÒÈéõûï?\θ¢Ów�
+­«o¯¾»úpý#üE…›~ý§·½¾ú!¼Ó‘ÈÞøcèqáq„êWï®~¸úðõÕå?®ÿ|qu7Óß0£wòóÅßþA'Ø÷Ÿ/(ΪÉ#üA	sŽOVR	¢¤©gyñãÅd‚½·þÓ¥dDs%&3«	7ZŸ6LAaÚØTŽ£ìhÖ™¶D3Š2¡–p¾‰2=‘Iœ5D´àÂK¤yóÄ¢„sûa/`
+ÂÖ–Y2Kg}Š‡«s”(>^Þö¾m¾àß¼“¢7šqh“ืëË™túþ¯ðänº®»ÇÍöSèlêyówJy½o«6¼¨Öò`LXb¥T‘ò!ƒ„aÄâ>ÏÆ¡Lñ	 E[ð¨Z,¶qAêtØÆoaÇ`	·›årsɦžÀ‚›§ÈŠÀ™vYµ÷Hl2cTÉi
-FœRÜÓù;UôŸoþ
ìr&‘—k $Bw_¯C´Bc½[ÝÔÛðzsúnš®
­f?ŒÃënUµŸÀ¸­´ÓëKG§ÛªY6ë;¿":\É/@™Ùéei˜§†Ïª RiˆN•(·”8'¯BÙ{µD3ÅYŸä¡D¹)Yô@iØ)‰¢©N]UOaÇ›UÓuõئ˜¾ÛlCwý¥Z=,ëßFB|dM”¡ÉÄšÈh—W.5±Tð$–àâ“åÎ*@g™3ûI	Å…‰a¤ÖÅ‘Mw~<+H¶æàY’0Wê4íD•·ÀGÀþóB	'‚Ð7¼Ä"ÉÁ ë±(®s–x$AfÜU÷ƒ8¨r8oI.®?ib=Íå¤î±'ÿ'K3h/LÒ2¶éÀ P”½póºæOÀàXt[/'™¾8µ•D0iNE퀩JK¿áOõÓxËâ:3j?îµ"œõ)¢"Ø Úü`}Í¢ b)"–B%Òð¤Ø‹ÍªjÖ¾d/…1çÛi¦øÌV¹åq­†{]W«ºì› &[ñ‘ ~¶^w3fÜ¡.Øðt %}$ž*<Úû*|·£ðc1¹`¶	Ý7Ñëˆ2lèôv­ÿÚØmhtÛjÝVó®Ù¬CG[ÏwۦěT_[_gc›’ç´)
²¢Rœ¶)£xö¬M¥q糩Å6Õ_ß²i»—X %û*“jºY×±cž«MЪ‚¢¨©HÞ¸À!4)åÎÇ™LñÖàú‡¼)û›ÐÂ.Z0hùCµ­º/e„—ؽjæ›åf݆þxÁŠ#"Í >ÖëE0`0›}x«’ER'l¨§ç²!ÀgV«_êÒGmˆCþ,€öIRœPo¼/xº ©@ó¥ëi)ÂÍz¶®ïª®ùŒÊ		³à3Àßám³îê;Dçøa}Cj‚R´ÆgjßqÄ
àº>¾ ¡/I‘½!0M:m¸SHNj˜j¾Üµ°
+L0w‡„þ=¦‚Ã\óyýÐU7K\#×ÓÏÕrW‡W«æî¾½·»-¸òmè¾x”,ÂÉ£ây7ìý?4æØï—.üÑDŸüxßÌ£v5éUžèÒOhXOv¯S‡)ò¡”hnO—4Ó„xøPu÷nà°Ñæ¯vÓ‘à¬Oñp}Œr"-`õÁ
+àÆ,¡Ìö@ÛéÏ»MðDÐn»­÷)B›$vì~l–Ëк©Ã3Ärlù2>Ãyƒ³£R;3mw‰Œ;tò#›øDûàyWo߬žHW·Ù#°ñn4xE'ͳ¼/ásy:§ˆ–ì×èaúâ˜*êUŸÔCå8d$.dÀ›mwLóÀ³éaŸâ	=¬ð^ë!(@„J…*ö+O˜¥ÑQe
+à³ÒçÛ¤÷Ìö¹³DI RÐaj
+‹H%ÄB~·áá¿ñll|WC `œ‰À$šß²ð64›6Âj0':üA]â}¨(Á3T” h|ZÀøÀp;WcóJh1<W_B{LSbœñS>n
+5ŽpËÜQ‰Je‰àÒbÒ£Ò¾Z¦™â¬OòPª=3û‰O	5¦én’³W~H1·{½@õ¬€!¾I%R”Œ¦×XÁË
&‹#RLÆÊA8úÛP®]•	Јu‚‘X°Â#•ÆÈx†ªD¢8ë“,U%,NóýÌ'•F*šxwv¼K< Å'}Jy ‹ñÕþ³í9S|fÏBÞvÃ=ŸTžÞ9ƒòž8"~RØ:¸(ÃOÚ4ŒPNõù¶ž)>³u	h|‰|‰¸!O±ÍÈé­ví¥«ØÄbK)ÅtJM>íÂþî¾|ÅÀ™ËO)R½rHI¤p¯Gå™â¬O²¤XkGåHÃ^ìYðd²KDÛQB³QDhíÆ‘=#Ài9„×€Ñä%æ;SH±„*•´€Q®ê[åY›Ù_ù¿ÂØ꛵ïð3ÂÖÓÓ÷ë°Ê0Û¯ÔMHa¹sÓyÕÖ¡UaN
÷©AÓ~
+½þœí«xÎæ?¸¯¶Õ¼Kßû4Õ¹ bžLB%VìH©›Å©…Cœ}(€¿‰¢NŒ0¯w»‰â¬O²àv…†þ1{ ˆg³¥~òºÔfŸ-aKQí~ÍøÉñS|1GZzºº
+1†ÛØÛæ—úX¾”ž-_êS<‘/
W`ý%ù’?È
+u'#}¾_ÅyUÕEÁc8F´ËÙÓnÊA‡s‚×6Îö"RÎuûLž’#tˆç(õmµ[–ô\••ùŽÙ›*#‡¦÷¶€5*Ÿ¿îwðŒ%.x—i%ÑZœ1$Š³>ÉBPàP&D¬<ì„̹%’±áÙÍÏ»ºõ°¶6Úé<%ÀBx1ag>…f³R3:a]U_šÕÎç~à
?WÍ2ýŸ«ÍnÝ¡ÃV®|L&`êFòõá¥Äv¼Ðc˜x€ÐHíëcq¦8ë“, Á–ƒ£ÈÃN±Ýëd6¶Žp+à †ÆADÍvàe‘l£Š­ÇªVRoƒµÌ“ñøË {jëíçz;ú¼íªm­ãpT
¨#ϧ1GëáOð³†Í«X¶Þ<àqDʧð·/ùÁsŸÒûÞøÖÁí´WËP9Ä‘‚7Ûß|Ìþ'y²¿ñ¢VDêñm€Í¶Tš„CœLgDjŽXš˜?vVN?5ËÍÍSW·%P¨„ËüÍwGˆfÔõ‚…­^¼°U}WÅ…AÆèz)õȉseõoΰ»¯ð®É—6aš™¡Aì—/DÎŽ`>T:4½êÀÑ¢È}ó«ü·÷¥Ò˜¯òÿJÑ)X3žà,{'Çã‘×hd‚îO ÒAMPsè9½ñÐ^ùR7>ÃZÆs"èÚ­Ûæn¥Î§F…c„¬x0D¹?4à­™•R))8Š5ógBLœ	Á¸éOm¼ëuPh1˜ôKb»&–Q½¿$ªñPÝð!ײkº©Ûì×Ò¹Ñ&:¨ê9=X78‰ŒîÄ{Ê”ÝQÌqDÚGz¯Dÿʃ$Q¾@#À·~œþbKé°?;ÛaŸâñÃþÁú‚ßè/¶	`éε¾Lñ™ú"4$Dƒ®7%¬©T"…˜«N:@A1Ê$ÿe1€–U¾ãvÌRg’)•W4¸€7-‹ÎÔ>!越Àѳ|ɶÛîê#…EX;,Â*ëÒ*o«e{¤„šœ8/ü„UÂè­ðBÐ< Ê™uCwÇÔõ"¦	ÀdR¬Ó+‡9`ðÉwQYa­ dk?åMIqSºÁ§ˆ3Yv'üO6ìÿ¿÷$(¢¡òô)¶ÄÌ)yÇ¢0xPÌã
+åÙ<öÕ&ž(Îú$K&î+eÃE0Z4sM¨æIY¿Ç›EZ‰ò–‘µr'máõçL¯¡åò…ÒXúhtÍíSÉ£°ÙCÕ"T(¶Õ/^׶¾ÝÖí}œƒ
++7ÆeÏ(ÃåîXž=º¸qþ?ckMÿÓçFJËxÕ[Mì©Âo”öÂ0uæù
+ø¸ÐÈþ`ˆåŽói¸'ô†ÌsÍ¡]Ö»lBŸâÔØ9sjî¶Í<\í¡ñF&¼k—Õç:tyPíûºÝMhù'_Ï©œëÏþ7?Ïþˆ¾1ÔŒ~Dôû*×joXaJ"ìð×[?BâÆb‘Žãh‰WþöîUòlí½ßqAâH„fûßq1PgJéôíbªÃáwU—.T}Û`Açð.:ÅŠ'÷¤2±Ÿ +ùR.U÷¿ªÂ¤W8ßÇp¿Ë3ÿ‡¯?ÖËz)Oxÿ{ç“_üñO¾%„¤È>gÏ|žÈ8<ŸþâÝÃÇ*1ǼYÖë;¼õˆü÷ñ¥âÍQ?›E80_~Wž{ÿuŒ;¡ÿÂß9Êm¿_,`rÝÓ£øþXãuŒu³¿õ,?µUñrÅH°¨MÁæÛpïz5
+šK¯QÐä='ýÛfUmŸ†ÁŸñ26^þŽw·uWoWͺŽÏç™<^ç9ËÐ.pCã3Üìâ|¹x/6õ¶Â‚{Üèð>•²òÞ"y„™ØÚ]²i\"õ3“ë™#ž[–žÝ=î¿^ÏŠ A"XÏxþèïZ”Éa«Ýl»#—˜„$\ØD¬íªÎkpد
+5;ò(]¦4¹ÚvM·ëÒæã.«¡ty”n0'ù&B{
+Úé/pVë”­'ÕŠy·¿Ð߇ߡž×¬ï~wìŸàË¥¬ôûL:Ió¿ú× ûßÊJ.¹WÅ¥9ѧUùé؃µ3ÈJ„æ¥Åÿ/À@Þendstream
 endobj
 838 0 obj <<
 /Type /Page
@@ -2261,50 +2267,44 @@ endobj
 /D [838 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 250 0 obj <<
-/D [838 0 R /XYZ 56.6929 363.2968 null]
+/D [838 0 R /XYZ 56.6929 268.7207 null]
 >> endobj
 836 0 obj <<
-/D [838 0 R /XYZ 56.6929 335.217 null]
+/D [838 0 R /XYZ 56.6929 240.9336 null]
 >> endobj
 254 0 obj <<
-/D [838 0 R /XYZ 56.6929 335.217 null]
+/D [838 0 R /XYZ 56.6929 240.9336 null]
 >> endobj
 841 0 obj <<
-/D [838 0 R /XYZ 56.6929 306.9099 null]
+/D [838 0 R /XYZ 56.6929 212.9194 null]
 >> endobj
 258 0 obj <<
-/D [838 0 R /XYZ 56.6929 226.5017 null]
+/D [838 0 R /XYZ 56.6929 133.1778 null]
 >> endobj
 842 0 obj <<
-/D [838 0 R /XYZ 56.6929 197.9796 null]
+/D [838 0 R /XYZ 56.6929 104.9484 null]
 >> endobj
 837 0 obj <<
-/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F14 612 0 R >>
+/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 845 0 obj <<
-/Length 2754      
+/Length 2841      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]sÛ6òÝ¿Â{(G4Ið³}j\»u§u{‰2w3Mg&!‰cŠTI*ŽþýíHJ¦“δ£»‹Å.°ŸîÁÏ?O#×SYxžd¡y~tžoϼó5à~8ó…fa‰Sª7˳«Û88ÏÜ,âóåjÂ+u½4õÏ—ÅïÎõßý¶¼y{±"ω݋E{Λ»ûï’ñçú×ûÛ»Þ¿ýî"	åݯ÷~{s{óöæþú¦ÀÖûÂá…·w?ßðèæç›_nî—ï.þXþtv³”™*ì{
-5ùóì÷?¼óôþéÌsU–FçO0ñ\?Ë‚óíY)7
-•²êìÝÙ¿†,-;ÀH¥n”ÉÌ	†jî£ÌU èo*³5uß^J9¹®yð`ð8µYëÞ|*û
4*£‹²^óÄ|Ê+½Õ}ÙÔ¼v«ÛGF}ð"ï_}
ÿ5BbG׳ßÀÊ\¸We×ó¨Ö[Ó1·Aêú€â‘¤njà ¸	8Ž…ï»Y¤"ª&×Õ¦ézY²¹Êü‘ 6}‡ëöÂOÓO
-óÁó‚Ú`"	HöK3yNY¯šÖꎫ췇­…‘è‚C:f<nÕì­Lå°ÒÌéT˜.oËœ2˜b³â/$t^ñ ëáêðrÝQê&Y£%ÓÃiEiÙÅÂ.²ìbçÑx·»ï¸Õ…9¡Cõ¦,b@•ºCÝë¼/s^cØæ×l
P’Mk&Ý–]
-:"^{”:]Yç³GÓ™|ß–=Š›(”w‡ulÔ‰5|A‚Q}ú*8-†ê<7]Ç´ùfßó„¯|ÍöqÂBóM` ÛzjÈuQ0“®CR©ç܃Ã!V91bqýö¦Ýòˆ\adÄ@ë?0DÿakÆYÙYs(+±9²âÒì×¢åÔ’Š&ßãE‘]ÏÑ6ÍUy¨¾
-2g]~´»ßt$)"ð`!ž…~õ‰1(*bòf»',ƒ§LÌìvGL!ê#Õ[QaƪX–"Eßꦥƒ p=‡w7caûÎÎ&‹I ›Úr³o6cñ0—5ÜhÛÛ	kÉÖ3¶u»š1…Ù™ºènÉŸ6h(-ù’*Á·ú‡ß1ìP0“»†„¨9¬nè
-“ã[ Îû¥ƒ¾Pˆù*úßÈ
åÉÉÜà€Oº¥Šé9cß dLÂ3ølHV5sK@ª”½¥‡J盦š7LÜ8ŽÒQ`›F'ò4>Ž£ˆ±ApèÅTŽQÍOœw嶬t[.|ß·bÚbœU¹q¨’ã3
1G¶|Rû‰“RŒEKû
`Йö#…ˆ˜SÂÀy€ö¾“1ZUI¥"PÚ} \”
WG|Ñs(9Ì׎§`ô´)é`X4sÞÊb'Þ!Š¡Â³Áê±jú‹ØeÀPÛvý²œîv&ï'ô¾d5BVë*žÍ¯!ˆ8)Ó JÔZF¶†íd5C»ýCgúc‰4hDZ€#·€‚ûÌa°Dih³Œ:((*õ©Â|.ø³
-gœ8$ë‚v…5²+ØiåU‰¹*–É&¦Ç”á[cR”$v8·¥þ¤·»ÊÌ_¬í‰÷!ïۨ滫®‚ð[™ó„Ú e(8é·3>	}˜J2ê¸D	Ô°gÁxèˆâºˆÎ$í
8%URau+¦…˜ë`"°÷f‰dþñÕVMó¸ß¡%(ª `NdE0y¦o/ÓWÙ0ØTxö܈Àe¦ÎûnGa͇„„6~ÅÔãQ’¼Ÿl’¸©Û˜Ou%Ù:Š(NJÕÙ<Àù2êáÀˆþÈUŽ?¹jÐV¡—ÌtŽ¶Ž&&Ó@éhÒlm­m	ÞŒµoöŠ'Ø?Hѳˆ'Uº;œÛ Ë
-­V¥K†ÁÅÂ÷<Ϲn¶c=õû°O3'‚Ø
ЪÇÞê!yJ.&“^j`“ŽÙqû#eÂW¶õênÚ)ANÛíŒ
-0½§±Â!*¾©}ºìM·Ó¹´m[}8e>‹GRÓbäN¬ø0‚¢ía½oí­Ä)YHe°ƒ(¿¼È§amPñJN;‰µ›u«A§¶c '–T®%”í³Ê6Fs
-hê@áû.Ù–"Žd§Ä¹~-ßËKb8Íl;ÒAÛX]íL;4üTç¹c¡}@ùåÅh®/25Š(yÙ(®H„ÈÍ’K&7	UHˆW„°Ç?A,é ö¸±Ã¯æߎ{"¬¥®ù{ÍŒ1^z‘?³§3_‰Çz…ÇÉ÷êŠùþm¹./çrû¿þîˆldüþþî¿<¢»¶ü°ÕÀ]ý_¼n¾—†nNCGö¾Ókóåèp=z5•?ú¯$–GnM!LÛ¦nêÖ/18é!Ç'Ý玌"âÈ3—r½ ¯¾g{£®×mÏ~ÙTö=Aý“´XùF·:ïÉçqõŠáø¨ÙUº³í²ÃN¦âvŸEy0ÝãÕCˆ¬’Ç-b‚‘µléP/Î?aà%“÷J/9®`^˜
-*vîDa*Rxô‚ÐÙ5ƒŠ¯¥|€Œ=°ç×J£~¥Ïö88ʦR­À¤©íÞš?øHÀ/£‡LÆÍD´
-ŠòãÇ
-¿ÛvZ.{»¯úrW
•v.Ÿ»ùàèæ¡7C¸|ÌøÒÝqq¨<%Å!@‡âfö±À«Ó<}s·|¦ôžhùÛŠ_ù#¥Üc”oîLä!=‡ßߧe†tá·jê5“Ó,B½ï3iO¹4=—ž¤(Á×Ó¤ôÜ_OÈ×./o³©·ÁLŒ‡bÁöe–giÑ$Îâ³5~§q–ØÙÉSÎ^´)øT½·l›“}Œ¥£šmŠÙmÝbÎNË\S³S”Áˆ¬R¬´QÇ&B<Õ9Wܣœ؅3Üøx»È8”çî{¡mjTÍz\3Æ]˜PˆœQc&`Ê[¬Ñã_6ðn÷6œÈ¿=“hCW‚¯¾º¤¤5womè–ØùÍK’ªÈÅ6gþÒô†ææoÿ:þ½&®JÓ`þ¿QHˆnd‰
-	²SɇZŸ‹þXBendstream
+xÚ­]sÛ6òÝ¿B™{ˆœXAðóúÔ¸NÏÖÍ%ÊÜÍ4)EAÇ©’”ÿûÛÅ.@R¢äÜ´ã‹Åb±ßYL\ø“8p\™ø“(ñÀÁ$Û^¸“{XûñB0ÎÌ ÍúXïó÷¡7Iœ$ôÂÉbÝ£;n‹ÉbõÛôú_ßXÜ|¼œy;
ËYºÓw·w?$¡Ïõ¯wïoüüñûËÈŸ.n½#ðÇ›÷7oî®o`
+¤a¿`
+'6¼¿ýù†F7?ßürs·øtùû⧋›…½Lÿ•x“?/~ûݬàÞ?]¸ŽLâ`ò×IâM¶~ À—Ò@Š‹Oÿ¶{«zë˜-ÎLúNób'”ž´b~OÌ	c	70X(æ/®ˆ¯*\6ùѤOïèT‹u|¬/{Ç
+Æ~8<6-IÚ·è›®Võ¥ˆ§ªiðÅ
ÜÛ>ͪڠ?†°"N*ÇŽáKbêa“ÁzYLçNí‰éðØq1õ=ÓŽ„ôÅu½¯œrÆúcþšeÕ¦m^•gEåyNè¿ (‹sFL„ó²NŸ×ÑðÀqu¦tÝõÌbúáŠÍ‰­h¥EUªM—Œ×nò	ôÉãûÙBâH•\$Ž÷fœ䬶ªlOJ®&|™¼ çÖI¬—e}îÔž´—wÿX”™XºåQµf™—'\y›¶Ù††EÞ´£šyÊÛÍ9ÝxÄ¿ÈXîiVŒé&p<áÅߪ› ‡ø¼núX§uc±^ÔÍÙS;Ý;ª›Á±ì
¥jZ#ÖoÓ…*³¢jÌM–uš©ï1™ô7ÁØñ“2ôM¡Å‹”¥œfZÿ0X¢]Hø¸O‰²~a”Ò§Pé*/ïi¢¾fEºÕ!‹önÓú–0¾ýñê5F2ôm‚1M²E˜K!YºŒÐ@¢ö¬'-Ÿñ£iDRV¥"^Ñ…»	'	Ž÷°PTYZlª¦å¾Ç‡ËDt¥jœ8%qÓ„£µ5u(A"àì—ªCBq¯«ÚÜw™oG3!¾µ˜q°äµuµ7<åv§»ÓJ5YïXÊ=ϵNn¥ÖwK¨§øá‡h^¹!2¹ÀM\§ Ý}ÃÀmºRx&–!,å
šç²M³6Ïh"›ãµj«S[QosJ¨Û¼)¡ÆBO§…xÚäev ºQ£²}·Èn$‘o<ö‘QGlÔðÝ“›ÀR[ä1-òH‹ i–‘¯EdóÕ¾¥	©üžìã€DJ45ZÐå@À¶ž*í	HÚøò¥˜6
Ø’ŒÅôŒäXÀ¡£vlUÛªzËzÃqZGƒÆXD^°qìm¨h7šJµ¿ç‹öiUe{Ô•6íQ;úÏF¡ÅJ% ½dzŸ?V<pŠ(\–B¸‚¬âJVmwì‡+ZAAkbæ¸QXàëã^ÌEú	]ÅÀ1g.Ú:}Tµ„—–9T/݈.ö%Èd“„”+“¾9'!1¡P³¾²“8/Aw|ÛÖÄHØ«Í=!s7»ie¥vª\57èO4”š€¤$€r¼Äc	æ¥È§`ƺ†D©1ϱϪ²%ƒ(®Yž]”©Ê™	@»ªn›«a‰oÒg³PX%Td˜‚Á^§os½ð(¦
+äLtÎAÛtUá>ýåsG9¼#-{A%$–™M~0Ö…¤Š¢zjÈê£ÌÙLÃîïœá+U朔¬‹¨a—DÓÛ5Ú£N‘6×@"$ë…Ô\Ѳ&ŒÌ²ãÆâI:mÅ4¦BѼ«ÒBé¸AbŠ4¼ëz‘|=VI!TÛQÄÈW#äBÇu£p@íϽªG‰Žô=ñÿ'.›59ë½jÞ8ÏЃÞ\Àe½è@
šò~§SÂ]hö…ÎÐ
ß“bÀ'Q›>¥µ®šFj_(~…ù–28­¯ÍjDM€*¥QÓ²H³‡MUŒ±ëGNqÇ
ƒ)%ó8<¨/aÅD!XCÇ`(¦sk"š~Ê·y‘ÖÅó¥°i
+ðV	õ¬Œ†1¦5B(L	bß y
+±0"®BÁáªuŒ) ì‘hð;£Yåº\Ls”Œ|àz@2ƒ²C½n±“‚bÐÓ&×r€áªsWbc˜ymÃF«wÊ\S$Ä–g¶cmÝ´3CÒÃFx§²¶‡/8­éÅ⾂ªg³E5xe%¯E5vÊ#SÇ6¼› Í~Ù¨vÈQ
+·£àÀŽš§£ûÉ*%öM:‚QE±>–˜Ðy}©Ö¶xƹݸ¤˜œ®ô©°‡OÕvX}l®’†í]6‰Ê»±ÎŠð-1+r;ö¦ï+ƒý5Ýî
+5Z}ÑmžœDãSÂñ9÷üï0
+'ÓWk½˜ à¤ßø$´|2J<ÞO5Š'íœyÐq‰
+#-Gà´Uà|	,©à+\6-\±T­‰Ð”Ü
1LNBœò™¼7‰/¾[UûZ‚Ô%ü¯Öž)Œ2…´2!0Ö»7# Ìxú¹éBà ¬	È(žoBà+ÂîD©mÜÒ>l9±MlÖ…¥¶ud‘Àç²³ZG´¤ß”`a“>R™#zº  –øŽç»ÉÐ6–Ð=>Œ=Lu%‹mÔ–¦¸NM
^uÅö†&ØCpÕ³¶È½2ݱr³¼¬Ñjeè$	«˽˙p]wz]m»‚êöb_G$çbäv¢0鵇Pñk=42	·S–L¢F—E_›î‡±›~³)m·S)c€å=uŽÆ"EEèÒy«š]šqç¶MŸ	øGáH؇”02ìÃ(çT×»ß×F)a¬
¤P؇A_\&Þ´¢}@A;)ëDÆlîëîT7¤¼³VðCÙŽ!+ÒÉæ™–©	…eÝ„Â÷	<²UÌ™NNÑôúŠ¿oßjRÞ´mGh‹ùNÕ¶çÆëûšGÕ“tæá6¾MÑI›˜k'‰"|Er"_µ7zÁðÕ[Xè'€Ð¥¾¿)}H-8²æ¤W
vIßk"ŒÑÒ
ÄÈ™ÌL>guÇA0L½ó9ÑýË|½};–Ùÿñ÷PÇÅŠÇŸïnÿK#­jC;
hÍŸÑvØÓ¶	?p?×…&Û}nÒ{u&6Äd×Së⇟uJMràÕ:€¥¦§ë{õ)-d÷£á±ë_PÈG”r=ÓNÁmå[£¦Më–èmSšIµOÜae›´N³V»<.Ìߟ5›"mL÷…äô¯5‹ºA|¥AÿŒ7s‚h
+°‹Ÿ·4$ˆTtÇÛjq¼âÂ"Àz/–n4¬`¾RÔëԈ”¹põBcöØ+^qñ	Û’§÷J—‚~¹Ív)6ò¡\«À¤*ÍÙ)}ð€ÞF]Š˜´6r§Jòá[‚Ž¾Úvæljí¾hó]aëìß[ÎiÞh:3¼ï°Ò½u7TJWriP[ÂÌ> endobj
 262 0 obj <<
-/D [844 0 R /XYZ 85.0394 497.0473 null]
+/D [844 0 R /XYZ 85.0394 406.479 null]
 >> endobj
 847 0 obj <<
-/D [844 0 R /XYZ 85.0394 468.4726 null]
+/D [844 0 R /XYZ 85.0394 378.3469 null]
 >> endobj
 266 0 obj <<
-/D [844 0 R /XYZ 85.0394 408.9221 null]
+/D [844 0 R /XYZ 85.0394 319.8046 null]
 >> endobj
 848 0 obj <<
-/D [844 0 R /XYZ 85.0394 382.8699 null]
+/D [844 0 R /XYZ 85.0394 294.1951 null]
 >> endobj
 270 0 obj <<
-/D [844 0 R /XYZ 85.0394 310.3501 null]
+/D [844 0 R /XYZ 85.0394 223.2862 null]
 >> endobj
 849 0 obj <<
-/D [844 0 R /XYZ 85.0394 283.0525 null]
+/D [844 0 R /XYZ 85.0394 196.4313 null]
 >> endobj
 843 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
+/Font << /F62 638 0 R /F14 612 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 853 0 obj <<
-/Length 2299      
+/Length 2429      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZmoã6þž_! j£k.ß%ö>¥Ù$—¢›ö‡C[àY±…Ê’+ÉI³¿þ†o2+qÒøŠ`_†CòÎÌC:$ÂðDB"©¨ŠbÅ‘ÀDDÙòGsè;?"Nfâ…&¡ÔwÓ£g’F
-)Ie4½
t%'	‰¦³_FQ4
xtòãåÙÅùÏWÇ㘦?^Ž'TàÑÙŧ¶t~uüùóñÕxBAF'ÿ<þizze»¤ÓñÝÅå'Û¢ìç	¥W§g§W§—'§ãߦßNû½„û%˜éüqôËo8šÁ¶¿?ˆ©DD÷PÁˆ(E£å	Θo)®þÕ+zÍÐAüF”V»Šx@¡d”?~O$Æ£é¢hmÉ»Enm—6-Ö·ö›ÚOV/—yÕz„nD•ÿé”E•k`¥B‚nMë'KýÀû-Íl-¿Ë+¿¨z=_¸±Ý¶Ž²žYZ–ÏM¸ÚÙK¿ÏU“ßõº}´7PöñŒ³HPMJ’XÕ׋¼,'m÷P‚"ÊÕèW,pÝØ£²Ê×÷Áv·öûP¯D3&É(¿ÍGl§›¼µ5g]¼/º…f–mdi“f]ÞØ•n™œQŠ¸d–¬WúÕÀf€côÊ«õò&oÜÌżr«‚)Ójæ—WuEµ¶–0†‘‚æmÀ»:\'r3ZXà·zV‹‡V[ÎÖô‘ùà&lí·¨œ;~ó-x|Poê)Fc3ó™Ç>ÿ3]®ÊüÛ`ú!‰æïuÎú·ùÀWop¡('F‰„ͼ$ÌŠ”|8ÌÁBŠb…ùÓºì8º\ÑØVµI'C¢ˆyÜGC8÷=·‘¤ˆÅDF"ŽµpÑ¿’-cDÇƺÈ1`CGWæH’Œ.ú2?Æ
-fÁ1LÁ‚Óf°Šþá0‹
-Ëf÷TLÃÇ‹%>Õ°Ç(ئW<	5›m&<8è,A
-æ1ÌlÄúϘp°> Žå(K«ªîlyÝæ¶`Ž„.´ù²Èê²®lUGˆÿþãkxŒMø8½&Ù±µ
->£K#§»BÝf5£Ã'•	ãñèú‘\îå\ÖCF Â‘“¡Ü'uá“©ØÊõÐlÙ€­¸¯O5DtSÊË<îiç´¤•S°ZåicËz¥õÚHèóœ•u[TsÛw¤!7{Åjô9­œþƒ¬ê³qj?7eý¾ÙÛõÍd£È%óûE‘9î²Ù¤®”­§
-y³,*æˆÂ†ì¸© ·ò¾MâSÏ'n벬ïíNÞ6øãÙÛõjU70å·ý3‰Æqį1‘/1¾DÀÖ[¾ô×F©‘2èUj´#Øcgv[‚h¥ åqúr2`Ã	#‹ˆëÊiVx'ÐE rÙÔ8˵V&’Jeâ%$ˆ*]jƒê–‹ŸlS:›Y´Nt™vÙÂLw—à´ph˜R`ÊÆ)Ë2+­SœB3¾.‡œ,í‰&ø£‚×ÚÝC’§làñ6„µ-‘ñÆm^®Òïá)£ñ.wjÍ Íc%dï­M]¶/0\V:¯h=ÁÞ@lÀòÒu{r“÷ð:Ìo6äÞN.“c„ûˆçRM5Ë—%™_ܺ+Ê¢{BFϘpƒÎÛà~lAz@2„`É2¦Á–´×³|¯\».-z³`=‡ÍûÅábL)9{@£1"‰¿ç{kWyVh€f›A€\Ð+:ËžF`ƒt!Ǻ¥p=éŽ9\…³žÔ(O'lg=H›âKÀ‚ÖmŸ©¦×çϘ+@âPQêàæ¢Pˆ£{Ì…¢1·©î¬s
ÁëLÆb`†ý@É%–ChîL̇FÐk¸÷/fHÞgÿÍ8#k,!ˤs¸7ŒZÛàÙÂ@¢ii½7WˆÄaÍu@&4%”î	IöÄ$·Y¥¼oòý)%¼%™´²›¸BRJÿôdi®ZÆý3'¤óŽa†3*‘u®i›u”Å|ÑMîsý±n!uiˆn™¥Ž¥O¸È0Å‘uï¡úÎ;°~*PÂáʃ7°nî÷	^ØÈ3g&0ÇûuqHPŠÐ=™
-¸àÊ´rß¾ŠAÆÂÚ’÷Z¼"SÑ<ÑJXšM&¶öJnª¶¿íÖ7Neå4µez7ø*÷ŽÝ¢4ï¬ÜÿIÅîÒÿP.endstream
+xÚÍZ[oÜ6~÷¯‡ÙD4o¢Èö)ul¯‹MÚµ½X,Ú+kdP4•4v_¿‡7‰ãQfœÆÝ
D¼’çúŽI„ቄ¢*JG	&I”¯ŽptsçGÄÑÄž(©¾»>:>4RH	*¢ëÛ€—DXJ]/~š	DÑ8àÙÉÎ.ÎÿyùvžòÙõÅæ1Mðììâ臨u~ùöýû·—ó˜È„ÌNþööÇëÓK;%ï.>¼³#Ê~>ÁôòôìôòôÃÉéü—ëïN¯‡»„÷%˜é‹üvôÓ/8ZÀµ¿?ˆ)™DÐÁˆ(E£ÕOJ8c~¤:º:úÇÀ0˜5K'åG0¢dµ+À$
˜r$(Œ¤‰B‚Qfx½,»y,0žùoÝØoÕÔwEëæjûÍêGÛțժ¨{¤QÌà©Œb‚RÎÃø¯f*A*MEŒëñã3΂“Å”¦ˆp	W 
+I)
åÉë×q×?V+¿eg{]Ÿµ½m>”ýÒ¶ú¥£í·h™µYÞ­[v|l¿?ãwUÖ-ß8vº
ƒÄv³zá7­û²Þx¶Í“}
+O×Ü>™Y/»ØˆƒXRIb-¶Ì³j3*fUYÚð˜-v0Ïêºémû¦pcîÛÍòvNä¬é:Û_mª¾\WŽXo¼½G÷-´7§×cËìÞÑ6µkTÍݸÆ	ÚvºuVo_ƒškŒ›j‡0Û¼±í"Ë—ã¨m­6]o[›Î
YIAè¾ë¬lµ›¡a»)FS³ÝYÓ:î¿g+ØökE[ö=,±æ£ùjSݵp³µn8#ÒM­@cáOì;&Ôðp+êâw·À\nB0~[¿Yæ>lq~c{Å}QûC5›»¥[ÛoópꩧÊo¸Þ¹ËpÏu[ܗͦÛõÝ'Žˆ¦Ê°¾ZUú v¯‰uѺ9çC¥óÇfã(Œ·E;zÖ!/,#tÞ	e3JŒÃ‘õI_M\FÄBK O^oV7:¢™Ë»Ú*Áþ®3†‘‚ám
›(Z°‰üÖÌèŒÞœ“dýêÀjÍë׶áåóÄäç{Aêóÿp‚Wÿcxõ.0•¿!‰"Š	V')•ðé•¥
+ïáe×aàåš~Å6«(q¶MÈæÁìéßF‚"–q™›ÔÚÁ¿I'šÖ$)Xõ· :»4ÿÎdv1´éìü©¨`œ‚‘qÎÜ\/ú
„ ¢°m.?
+Å_¬hô®+FÁ-=ã8äl®)y`ç€
+ö	Ž­Ýý{N8(âÇc.Õm“wtÃX„ntŪÌ@9¶«Ä¾ý‹	<Å&úÌ	¯‰@vmã–‚ËèÖÌ1ÏÜ~>qšNƒf¶³ßÇ95g›ð—½Q³©t†O¸‰
+,aš¯î~œ“ÄåjèýŒ1…xC<¤Äú¥ž	n¤W—õ<¦/:;Û{2®4v=à¶Ø§yßmìµûÒ3‚ëöÅ$˜™t".¢RÉ(0Ó/3|íb‰`ù#þ2·Üö%L舙9GŒV,U°‰ ¾ê€˜ˆ!œ2sò25GéqÑy›­VYû‰L+‘HóÎGÁË\-e?ùÁô`Wv&‡‰I:ð5Zò¹ú6§>¥ÄŒ§³«'t…§sX/u½=…+ãI4èSzâSi²•éaØbÛq^5ÄsÓ*ª" î—Yï¸dµc°^YkÛú¤ÍÆPhsΫ¦+ë;;w¡0wÅjöÞ,z8΄ë´Ÿù\œÙÏMÕä¿nçõnsŒ\*X–ðŽ—Ôªó@¡hWe
ËL¡ŽÛ*ôDÖ¿öhⶩªæÁÞ4ÁÛ
+º{·Y¯›¶üæ©{BVÀ8¨b(%Ðx†/1¾D@×[¾ôÇV‰‘2˜ßW%ïÄ¿â‰3»+Ñx؇¾d†˜d$¢2÷¦Ör³¼šðN‚%Ô£©ËŒ‹Bû`m©P&\B~¨³•©È`äâG;”-V#]e}¾4
+ÓÓ8-
S
+TÙ:fyn©uÆ+´¥]5ådÙ3ÁÚ¡œêv0Ī
+ò(”Ç—IXë2!"Oô|–~ŧ”–¤HrËqÒ ÍsFäà®mSuÏÐ\^9·è<¾el–€ŠÊM{lSòuB¿y±½Ý6<&QX—#Kµõ"Ÿ8Ô,J0¸M_Veÿ8'„Ìöè0Ï—	üÏÔ!OT4Èâ©ö‚öfQT £ë¶Â¥E@{D6œæ¥öò‘ŠÂ–ΈŒ¥p#bÎ~-Š«[y©Åc$&°Y2ƒâ¼†³@¶HÏØájQøf°q(ƒóÒø17ÙLb€¶ü` M7ä©ë«‹ó=Ê
+$ñR1êÅÕEô›³P‡‚¼ÙˆêÕ;-‚ÏSKOì-“˜|ÐÞ›ˆƒÀ× î_-Ì’bÈýã:Ck¬ ÇdwP4Ì:;à±Â„»ILïÕJâeÕÅ_P])G$9ˆT(ÅØf”ê¡-§“°B2)e7@BøW'‹vÙ2П9"ó.«¡€ŒGä½Ú†Uy·ìã‡Bì„;HSûÐ#‹ÌAôXBÃ@SÛHÝ;¨®w'ÎO!tr¨wð(–É@m/Yð¸Fö˜ŒÕùºM&Áˆry  ‘èÕäUÖ™>>¦‰Õ%à#ŒxF¦£A¢¥°†Lìl9nºv¾ë77Žeí8u•~ÛŸpêÍðï73à§Êö#ÈP,_ot¦,]ˆÎ„$%¶Ñ¹YëTõ,÷pQ‹LÉÙ]Õܘ]@ñC\†ñÝJü6†Â†k¥Ã¹)Ù`~QÜf›jº&½õ½ÜK¾=*¤ñÕ‚~¢ŸX$;ú‰.ƒ…’./a̧…¯‡ó¢‹ú|ê¡fTîl—ÿk›RãAǺȺrŸäƒK}µP`Š8•„[¬Þ·‹°äg;S-µs93Ëmÿ݇««ÓÛÖüös<çËÊ’¼œ,uÑ—Ò8Cq„eSÆ}Y<|®=š¥Šî©ƒÓ|µÖ—JàœȲ’"ÈílL\Lbz駥œä¥¤õüÇé?ãA-LÆ ÉE1§HHA§þXGUúÜ?M	žÐSЛ¤áÏQ As	LX‚4/­/†w~xóÃ⨂£ÿG™àendstream
 endobj
 852 0 obj <<
 /Type /Page
@@ -2384,16 +2387,16 @@ endobj
 /D [852 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 274 0 obj <<
-/D [852 0 R /XYZ 56.6929 486.3415 null]
+/D [852 0 R /XYZ 56.6929 396.6777 null]
 >> endobj
 855 0 obj <<
-/D [852 0 R /XYZ 56.6929 454.4975 null]
+/D [852 0 R /XYZ 56.6929 364.8337 null]
 >> endobj
 856 0 obj <<
-/D [852 0 R /XYZ 56.6929 395.7282 null]
+/D [852 0 R /XYZ 56.6929 306.0644 null]
 >> endobj
 857 0 obj <<
-/D [852 0 R /XYZ 56.6929 383.773 null]
+/D [852 0 R /XYZ 56.6929 294.1092 null]
 >> endobj
 851 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F84 802 0 R /F42 601 0 R >>
@@ -2401,30 +2404,18 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 860 0 obj <<
-/Length 3170      
+/Length 2842      
 /Filter /FlateDecode
 >>
 stream
-xÚÅZKsãƾëWð*µÏƒÝ“,k¹ÖëÍ®|²].ˆ„$dI@! ••Äÿ=ÝÓ3x %[J¥xÀ`==ýüz@1ãð3gW™ž¥™f†3[¬øìƾ=aN'%ÃY__}õÖÊYÆ2+íìâj@Ë1],šŸþíäÃÅÙÇãD>·ì81–Ï¿>ÿ
õdô8ýáýÛóoüxrœêùÅùï©ûãÙÛ³gïOÏŽጀõ2Pسàíù»3j}ûñäûïO>ÿrñÝÑÙEw–áyWxýôŸ-áØßq¦2gf÷ð™È29[i£˜ÑJÅžÕѧ£¿w£~é”üŒrÌ8™NPË™,3FŽ$h2f•T^‚xhàœÏóÅŠŽ÷©ÍÛb]Tm8í&_¯ó
žö«·&(…Ï©Y¦…öÄ<K”’*_ôöo\9“Še(”¤c	W,—›¢i~]çíâæ×UÙ´~n²5™´ýûba|,àA§Œ[ãºÉGôMñ3ç²*Û²®¨'¯–Ôø±É¯‹°ÚÒ‹›¢ã¥Ÿ$2&„Ë`r”Æ.!a˜°*ÎiŒi3Ï›¦¼®šðBæa}Y¯Ê½‘T±ÕÖaZž Êcáæ Nì°s/SCÁ‚m+îæça«ë¢
û”±ÑÓ¾ò”êõˆ‘ÛM	Vð@/wMAšRšI'ÝX­õUëˆ'èˆæÆ…>7À$2W訊ö¾Þ|¦—²j‹ÍU¾(ŽÅ<.¨ºÈ3ˆemŒ<ÍC)ô€ê2yžœ{Õàplîé$㊽ªÓÖÁLõ¨¹ó”YdàUWa"²êD¦}d†òFO]ˆƒhˆFH©~dCOÒ)ŽuúÂî«8~Sb2Å	^5ØGª™ÒÞMŽÊŠÐ‹½Þ¦ÈÌÍ?Õ‹À"ÒдeMUÝRã– Â0—rVäô¸Ï¨ÑÂ`X·,`›uIQ¢gJLJê@Ô§úߨgUT@亽ièÝ1ö£¨ŒZ#£÷°KÌÏ+kî<þ‘Ä%t,ò¦x5…!Àb, É ÀCªNº¹cV­¨+F¼Îq"ïÐ¼[Ѽ¢¾xD˜íóîÃëvjÈ랈¢9€h‘Ñ~¯ºÃó\¬÷Ú¾ˆú ‘IÆ4ÎX–ebXÍíTuŠ[8MUV)KA©Tu*˘–NwE
-EÐñt½jþDig™JCÁÓSé+ºGV¾ÕÒ$ëÔ*oõvå_þCk¹“…Z),ÕŠRÑ_i(P Þ‡ãHX~[oÚŽ*½ø~R#w¡k·¸¤ßCéb˜³ ØÿŸ‹‡fLzF‹ßÐêøSbAúÃ3ÆÞL–²òp)kÀ°¤”õS´ø'ëY¯^s ž•ÀŒImpÖŽ…I¯–\íÖ´Êfr«P`•†³Ä
-§,nòª*Va[ìõWÉ7ï?
‡›»U,××h“a	I‘Û@Š1cáléjꤚºbŸŽÃ!½¿M”ÖÐtB
í¶SˆìÌ
_ܼl¨3§×‹ÓôÞÔ‹ÏèÌØFï/**naNº^±Þ‹]´9•É-3\Ç+Ÿòv;éÒÀÏ´3,…EOÈPNèÜt¦I:‚É€â.¨T(ke»}‘=R'ŒK0žÙxï"O—„Jî„Þ+í$3ö{)t@Cò4‚øP>SM@EÜ‚ÀH©€y½çh%o%C{#ó±LºlßCÑ=ˆŸC¥Ö‚AtÑÒìñˆaꣽR•¯3D
-Šîž-ÖŽb2$¹+Wi¼™4ëw>$XÈ\ËhYWXDj—»Xa‹”cê£-àÀspÞMÙ|&ö>²÷EGû­Ä(þ†ždÛ0+êÊÍïËÕrÑ_ ¡>{]Åt¨Èpµ•Z UÅs‹OrIùœ¤)ÍAO¾X·-¥:ã=G}­æ;®èéÙÂ%Ai™êÀ¤§³U}X§çÇ™ÄÇ)˜Ñ*Úe@”¬00ØŸu¢Xló
-/q¥¿ÜŠàc:€»¥{­UXˆ’25ÐÈ–qólkí(&C’µ5ŒI§›vÈZâk±Ö¼6Lyýz*AÓˆUP¢
ØىÃ8‹6]TÊa+Ü»o!ƒx¯Rù(>ÐÆ™AG‚dæ°[(±k·N©>ímͬo/óÅç íÁµ:y€AµØ­jÔW»ÂÂ[Š4òáŒqø‰	î
  ×}[©7Ó‚<¯;ÁO‘¡š%⇋”Íà :¨T,ãåö&Ò¿•ë»u„/‹»
B,!D@0‰ƒ"Œk;2çWã»FªZ†»Òç«í9™QãÉ}7é®ßcŒŸI¤Ôò”õ©Ò!Žê½qÔ°,Ø?˜å)zÚÒèò¯ó‹ž£^Ræ)˜pÝç‰ü/
“6ƒ|¡–ÆÏÏÿ‘`2 8‘ÿ¥c«ÒnßêD&‡3„þ€
-œëû"FÓü2`pŒµmˆ¿eÓÜ…ñ„û`˜¦ÞtFŒé¡«§Dw¤ØÐ|ѥˇ>¸O”ZC»ÿXéË牠‘¡ê¢¿`%0Y&BÉÕëèÉÀ™Z=JÂ;Ÿž<`7Rl}î=æLiU1FÆ,µ…ì±£Cö0mðåIÍoñÚ¯¥$¯—y0YIXÖ¨=b‚üÁ²„…ŸY¦•ƒZž;¬Á^ÁGŠÉä„÷·>i¿1rIß5w|,e6(öbæ.§QˆËº|Y¬ü¥MNü‚?í””ÌÄ#^aÁ>Ò@Gð°T
-öf·0é°?Ëd¦^ŽÃHð0‡šƒ]
-'Fîs ÆÆ;¸Ñ×ôòº
-ÿXÆ|>ÕFMä#H‡ƒpÀK~×ÞÔ›ò_ÝW6_@ËfM·Bt«|ŸæóUxéb-¼x¿S'r
úaÖÿ	gÑà÷R@Ó”Ið«ç§H0PœÐàA)AqÖ“Câ´´ûì/þò²
-’ÈéAÇØŠµÂhÿDáåÕvœú&$$¸dRk7³|ïùêè%=Á‰ÚˆRP͆I{c‰Ç½±ºó÷ÚÍÏòÅÔßc”œÅ„NŽ.,¼ÔY#½Ãg…¸iD?zV!ñvÍvwXÙ}øÁ1-¾DŠŸÎ^訽ƒG•J0) `uŸÕCi	9¶¡ÃÆàá(¾¦gñEmA/ƒ;fx#x%t¿á
-Š)Á|>žX¢	)5õH>{ô¿(Oý÷eÿ×T
Bpnð÷µu9ï?Õ¦PNJì|ÙŒÓÜeý¿@{Lþendstream
+xÚÅZÝsã6Ï_á·snÖ<~‹Ü}JÓl/v»·›>µŽ"+‰nm)gÉ›fzýß HI¶•6;sãQ 	‚ü@YÌ8üÄÌƕ׳Ìkf¸0³b}Äg×Ð÷Í‘ˆciÐb<ê«‹£¼µræ™·ÒÎ.®F¼ãΉÙÅò§ùé?OÞ_œ}8^HÃç–/Œåó¯Îß}MOÓÞ½=ÿæÇ'Ç™ž_œÿðŽÈÎÞž}8{wzv¼Î˜/#‡&¼=ÿîŒZß|8ùþû“Ç¿\|{tvÑïe¼_Ánä?G?ýÂgKØö·Gœ)ïÌì^8ÞËÙúHÅŒV*QVGþÕ3õ†©Sú“J°Ì¨ÙBiæ,°
:¬¸eNú´m<³Jª^ÛZMi[f½7AÛ7%
#<6óÀǬšë몾ŽãÆ,UÆ”N4.¯—Ó¼”ÉTÓÜvUS·S¼`\dq\Ûå]¹.ë®%ë¬ó{j4õ*µŠb»IÄ¢¤ÖmIESÿ̹¼Þnr\‘õ’	Á¼1—\!AU&·amtÄ9ŸçÅŠø}LEoÙäëu¾!®&탃ù4óZhR
+2°ÄiQçë’Þ~Ç™3©˜G§ZôBáŒårS¶í¯ë¼+n~]UmÆ.öÓiùãÍÔÆ@1në7$ŸØÐ×%ª«®PYDAs†Æm~]NXlo§»’pÉ•põCF”o•ß7=¬®ÍA•ÇÂÍAH°ó SêCÅBlPÜÍÏãR×eשRcà}85ëAn7xÁ=½lÛ’,§V:évÍÚ\EµîÈ\›d‚&ÊÔ¾¡ŸŸE?ä´©;Z>ï;HÍŸ¹á'§ßµðÁËÑ."c^É,,ü®é`Jznò[6();Â`GûP˜¿E2©©ëmy\FÊ’<§\ù®ên&ü@fŽyž‰ÇÁ‚Óê.Ë«†¤£…ª¸p‘¤'	,*~I”rÕ–w7%Íz´ÌÏë&žˆà>{f%îò0>z;ͽŠ< °D=çI”ð²Z5wårRßx «Gaä¯h¤	V—ÛjÕ-ªúõ~æB³,ËäÌÎ2/ž“z ¾ƒ³l7õüµYI>Dœ% yxÅfRñ.«E¿§…†œï”ñC®Ú‰R0a I.™–ÒÄs?á4^1%LJBߣ÷6[ÅórÓÀyaû6Ü1­!ü…yÙHc1c÷Nö%uæ G:ž=¡3í9ÓR.ê£nêòÏ)­nž§³‘0_Jg)Å=Ÿešñ°Î¬„SÏõS:ƒðdà-ž"_áöÿ„â2át&ççï?k"Q%’¤!䦉!5À rW Ôew×l>ÑKUwåæ*„#æiBÝžQ(ëRàiï[È ˜n¤“—éy0à
'ÿ”7¤›qöOº»ÑÌráÓ՘ǟm:áuˆ,ÐPÁ鉄0ˆº¨‡Œz6ô$›b_o/$_¥þ»›
+s)¦A™fÊz79W(/Bv”"½›lĤ¥aˆˆuÓQã–Âgp—jgäô¸(tÆyË–YW%ÆÁ~p)©#Óé#ʪ¬ÉuwÓÒ{pb¤£¨Z;NP—˜Ÿ×Ô×nü‘$%Š¼-_MAð`²/K6õ¢»‹Áúâa=ŽxýÁI²C3ʾØÊöÑþPA¶OS°¼Û©±¬DÍCÛŒ9µ£ãð²#6œÚ¡ý á%ã’ûB:¨M)ÿ>£ÎUz28ûãÀ0ª~R¡«gFe²¯T¬
+„Óͪý•aZpâ8p
+º„w¼ÎVGƒ«S«ºý5øUxù/ÍåP—c©´€â_+*ªþN]‘Û¨á>lGÂôÛfÓõ\é%ÐHMÒEÒamIÄÊÅ0g!DîÈÿ©¼owÙegòš|JìFaóŒ±7“•¬|¢’uL(¥z+êçXñ/–³#óN—³’ãm†‡µaòTK®KZe=„Übk¬¯²¸—Tàáâ&¯ër»±®Ej(xàè¹¼'JÌ+–/!œƒu6y×lZêOvÊ(ö£X8,–Û½€y[Òý	¨Îfã­‹±<R[n>CÍ”é9†w+QmìÛY§
»Ãî¡‚.Ú¶pki±CC`4aHÁ›zYLM¨,Õ“Û®ZUÝ=qWAî:®W4pîëeª‹U£’ž)=$Ñ_uªÅnS•ŸËŸëÅ×ï>Ž»Ûí*Uë£[ôÉ8…´ˆÈm¤Å”Ž“Fø°ìI=uÃg$Ž›çm¢²†¦jì·½AdïnøâæUKÄœ^/NßÓ{ÛŸð0cOYSmcòHŽxÔz[Ár9™É-3\§Ÿêv?éÑàœi7‚"·|FŠP뜛N5‹žãbÌòV*¬µ²ÃÊ(aˆªþ%÷6m#œ’ç+¢%wB?¨í$3Öûb:è9>¡
Ôˆä;:ùjZ*¡„GJEäΆ~0õ^JW8Ò¹ѤóóôK'  ŠŽK­ƒ£¥yà<@$²¿q>T¬4xßèa{Ú3åËÛs\ŒY*VÈe&óÃÊ)²$×29×Õ"•ZÅeDf@ûWÿÌ€£QˆDr8›ªýDP5N>è>”òw!£ú[z’{èd+7¿«VËb¸EC{¶JI°‘áj/Á@$ªË‚¾	À5È*d&MÉ(yQ”·%<ö†Š-®èÄÂ¥Âps™é(dà³WƒX§çÇ^b!„ýÒh­2bJ^ö:Q2–y…7¹2ÜzE2à¼ez«°+ef à5¯Œx±·öc–¶õ¬V~Ì[èkžðÖNmòúõTšŠ®‘j¡…6àgW¤¾ûf‹•°O>ÂÓ× lÅË÷½-xúX<…´qfÅ‘!¹9¬‹B¤a×5$¿½‘Ííe^|ŠÖÝ­Ó	0h»W“†šàPYxW‘%™ œ1?1!½äú,ÍfZñ€êu¯ø)6T¹$C ’ª#ÄH˜ÊeºáÞ¤rú·j½]'Sl7´„Ç,œgšk»gίvo©v¯:Ê ¯öÇx£v#tdôñ¤¿ƒO1.~+‘ROèRT©PXT^ûºf>ð?.Ã#}pÕDÑ.ËA¢ASî)˜pý7‘	OZïg2çÅ ñ['Ò¿D¹,­úk:áåøîb†è 3»Æ¾H¡4¿Œ0mƒoÕ¶ÛØ?àðÞÓЛ~ÀN
cô8Ñ5)6ãñt^ôùãò~ˆìU…ÖÐ>W†
+z"bx´›{ô»7TŠ’mC
=53À	–¯òmÈM„œ³)ö>øžŽ¦4Š
+#Ó%–Ú÷HèÁ=}{Røµ|]u”ááõ2þ*	Ëõ€š y0ßC“x©p€á½eZ99³†)ùò´Õó['ð»‡H#³´(ÊGß4ŽVƬçîKI×ó{T:­À+2oÇâ¥/üûGK3ðS?¤Bv»¸©¢Ùé)SVó¶Zß®¢]Ïß?ô7eþ÷dâO'|öä«çþÅeøÿ†ü뜜þCJ¡…Â}*qpÿ©3Nf¢ÿÀÎJendstream
 endobj
 859 0 obj <<
 /Type /Page
@@ -2437,56 +2428,57 @@ endobj
 /D [859 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 278 0 obj <<
-/D [859 0 R /XYZ 85.0394 769.5949 null]
+/D [859 0 R /XYZ 85.0394 723.7047 null]
 >> endobj
 862 0 obj <<
-/D [859 0 R /XYZ 85.0394 752.4085 null]
+/D [859 0 R /XYZ 85.0394 699.3651 null]
 >> endobj
 282 0 obj <<
-/D [859 0 R /XYZ 85.0394 683.64 null]
+/D [859 0 R /XYZ 85.0394 630.5966 null]
 >> endobj
 863 0 obj <<
-/D [859 0 R /XYZ 85.0394 653.5261 null]
+/D [859 0 R /XYZ 85.0394 600.4827 null]
 >> endobj
 864 0 obj <<
-/D [859 0 R /XYZ 85.0394 576.1881 null]
+/D [859 0 R /XYZ 85.0394 523.1447 null]
 >> endobj
 865 0 obj <<
-/D [859 0 R /XYZ 85.0394 564.2329 null]
+/D [859 0 R /XYZ 85.0394 511.1895 null]
 >> endobj
 286 0 obj <<
-/D [859 0 R /XYZ 85.0394 420.3273 null]
+/D [859 0 R /XYZ 85.0394 370.7816 null]
 >> endobj
 866 0 obj <<
-/D [859 0 R /XYZ 85.0394 391.7481 null]
+/D [859 0 R /XYZ 85.0394 343.1637 null]
 >> endobj
 290 0 obj <<
-/D [859 0 R /XYZ 85.0394 295.8129 null]
+/D [859 0 R /XYZ 85.0394 249.4174 null]
 >> endobj
 722 0 obj <<
-/D [859 0 R /XYZ 85.0394 264.2689 null]
+/D [859 0 R /XYZ 85.0394 218.8347 null]
 >> endobj
 858 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F57 628 0 R /F43 604 0 R >>
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 870 0 obj <<
-/Length 3251      
+/Length 3442      
 /Filter /FlateDecode
 >>
 stream
-xÚµ]ã¶ñ}…½À™á§(%O—ËÞuÛæ’îm€IPh-ÙΖ\K>g[ô¿w†CÒ’¥ýhƒÂ¢†£áp8ß´˜qø‰™IX’Élf3Íf¶Ü]ñÙæ>\	³H‹>Ö·÷W_½Oä,cY"“ÙýªG+e¾»¹þõþW7÷q/ýý
-®p#ÿ¸úùW>+`Û¼âLe©™à…3‘er¶»ÒF1£•
-íÕ§«¿D‚½Y÷é”ü"ÎBi–ÂúˆE³‡õŒw“ò6K”TQÞZMÉ;`¡¼¾+wMW‚¬œÌwn¤æßå®	ú®©»ÃµHçÍ–&óý~[-ó®jê_/&a*5jÖçe´ÃˆõËÒ¤ v.†~áF«æ@GSÕ0Üågöò‡æØÑܲ©á\®‡ª^Óìçò±EÎA"V3«…ž-„`™1²'i`¦o·€ R›ÁåPK4gÚ*Ãh
ØD’pÐS‘²ÔŠÔÍÝ®€aæu3±””`C6õd–¨ˆÍ¶XN¥@ÚØvyWîʺ#ÒUKϽÓâ²…‰7‹e‚Y“žk°…bj%8n~Œ°NÕvKÄÛÒ¯vÜÓ3§GQ®òãÖÏ-¦„€M^×¥ÙVmWÖt8ðꎞݦôóM³È—ŸIšàõ€_sqbyQø]¦UªçBZÆá'ðl·.^uáöÇ/	Í-›cÝ•‡}~èhêë¯8R+Äü¶&”nSùÏ–y[¾¹^haÏ4ómÛÞiSÖCîDzV Ç"1¯8Y
ŽRëd|²n^{U†vÊ£,(–ôÎ(õüáèES¢NHT;Úä_JåS:/K3”>ØÍ¥Ò+&mæ¶ùe4±{	ïŠ&e4!¯hÈ^Ø{®»†¶±mòÂC6~Ëf·s'ã^¢žÁpO_­Hwç/É0Þ$͆š…¾cëÏÒؾlðå©èù†+Œwd8’ñˆÁ·i	 øUÙMºˆcxp‚œ¼­íøR&T¨oíc*·*ªÃýDÂîMиSÞñv_.+BY L®ãȧ“ÇjÛ¡£CRð~ÉyCsKÒÏœÂ/Š7àN&ÀŠáakÜÈz¾È'J!%Ê}¼°@Š'fèäï7“Šgb¸}•â$™>w;’è`[iê…f=4ãÌ&JpV²	ƒC^·•”€Ò¬ªöå	ö¦üñÂ(Ef}u-À¸»¨ü²äT✊“‹åLj}aREµ®º¬RqX¸Z×qcèd¹u!çÈY 5B£QãË<~¾Fœnsô Ç‚w8 —çЧœ”¶,ÑZ¼àò4ãÙÙ;—ª®!ÜvD|—&¶pÞ_[ˆµà´/üuÓ¶ÕÃH%tvÊέä5=Ëß NR”„i(OéqNsBXÞy9„ÊÓ	_ZWàX£D×e§«2"NÀrÎûj8ÑKaAò $ ç“"ÉRiƒÂŸšÃg¿Õày!cB§ÆÞRZ®AßòljÅuÂL"ÂL/
¶ÆmÒ_ÚÙÐt‧‡öÚ
vûí#Á	«ü­\½ôá•Ì	A1ǾEBÂÿ;ç’Aæ§eØS¾‚¼dÈf§æc¿e™Ç2Ì\[ÚCUCÊ°Ý–ù'>ôKŸªzéL@žó”‹ÒHFÏ󼋂£ÕS.
-©»¬	žMU\cëeáWoè	¬6§3CS¾Sî¨ ¹ÝôÚY	bÑè=í=IBøeJö‚d•)fS‘Œ{ßZ2o--ªæ>çCøÐóÀçQ*¸<•…<
-͇f6Õzã±Ë5}\ÒŒs¹*ë[ìCµ­ºÇk)'LžÌÿææÑc‚ã…ÐÍ·•ÓN„;»¥q0&>t.”ôãò-¹´Á„mõÏ0µLiHï}péœqØ9fºˆñèxCŒMsÜD—G£©˜ÊÞ/æ´N«Ð"¦Ô
-r+s«SÕm⪞ùæTÓ n°Z
83ðY»!»ÆÛOÀÈ›‰RtoÚ8soñ8 e|"’	|ª×å€P=‰Avâ%µ
"ݸxŽ;éü`_v‡¦öª¶pptÑ× Í=ŒŒlp² ¥ò0y´¦—Ø‚8 ùK2Ç……îÑÆ£ƒ—&®8vÇ	g™Œqó™ôÞˆ˜ê’»R>Có5 ,‘·¾È‡¹¥€\.]y‡Àªs#¨Ž€?uÖÖVÑVá«uLŽ„ûVK½É9`ʹ!Ï„š7°w¿eܼ¯¹2Í4z蕹 ¥Å‰X…=€,}!N* 3|ZÐ)îÈ¥Û°m5³óºtÁ,KãúƒÔù™¬[ ÿ´^ž1C›}©µH¸ö+{“nªŽ $ðÆõàÕsTäá[SséC¡QÝëS1›I6ISè'i®ˆÓõd»,Q{ÿfÊE1ñ¤_û:QæP¹+#™Í\?eÒx1ㇹ^Î19]n…—ܧžáíÆ!iOµ28ö¯±ÚÈ|ÅÁ\zUmKŒ8ßLqÄÇœ$¯àä»Õ²µ²;d¯?¹ìs,ï'{€X’œK¦ÀÁ„&$X‡ê‰Þ®2˜ß——&¨Òa0ìÕ@…u®ÿ Ñè.°÷MÈ0Ò…ü6y¢y	õˬL~'çžé²ö}W2íÐ+‡@)S‘ÍøIAõv,šž`'¯•/1˜ë}$¡Sbçy±«j(¹££‚Iê–Ø	/–a·„á‚<]
-×ùʱO>ÄÅ8ÓHx_•fj˜`œÑÀÚ€*8îfW„rU‚ºn/}ÃÃP"ƒ™¬¶vþÓ„–¿åPç¢×…
e—´š9¶\Å™h,ߪ/.ÍÀÌyż
¼äþÛÜëÔ„c¾È
-À¦BöÊIt}JˆèåûœVOûž	K·ÞÒ}™ð¿ûG !JÇžŽÿåöy[†·¤Ã‰íºCÛìôŽè›©
k,Ìë/Ñ“tÿý”ƒCr7ž¾°ñÿ—{“Œ_ön¦oÉŒUBAZXc®wæ²D÷h7yLÜ{,LéÝmîN.6ã€ÊGݺý@#,mÚ²]_ZHªl¢¹I_ºPø‹þ™#ºƒUäHCx¼àFKË‡ü»O||m°^àaLí|™Š¹‘'ÀbâÜÛÂr–
-iÆ¥3%à6OÈTÅ$äž3ÁñVªåçeñýÆûÓ^R»ÿC@¾2â'±å$zÀÏHªë%.FÔ‚TÃÍ€àPD©§n†-eè	ʇËЙˆù
-–¨uì©?W)ÃðßN|óÚ÷¯Îÿ’Òï«åÿø±)Ó)ñL¡Ôèß=ÔDâ¿@Ƭÿ——Õendstream
+xÚµZÝsã¶÷_¡GzæÄà“rO—‹ïêLsI}ÎL;I¦CK´Ä9‰TEê·Óÿ½»X€")Êv{×ÑA\,ûñÛ…øŒÁÏt–fN¸™q*ÕŒëÙb{Áf+{ÁÃœyœ4ïÏúîöâ›w™˜¹Ôe"›ÝÞ÷hÙ”YËg·Ë_“,é%P`ÉÛŸ>¼»~ÿËÍ›K£’ÛëŸ>\Î…fÉ»ë?_QëýÍ›|ss9çVóäíŸÞü|{uCCY ñÝõ‡ï©ÇÑãÑ›«wW7WÞ^]þ~ûÃÅÕm·—þ~9“¸‘\üú;›-aÛ?\°T:«gðÂRm/”–©VRÆžÍÅÇ‹¿t{£þÓIùq–
+	²: ’SÔ.ͤ^€ùr¹¿ä6)š†öv—7Å’š¿1&6m±/«uÔÕæñ55óê7Kôψ+à„yÚŸŠÇ±€‡µ3LÇÄD$Rg­м£8Ý÷YB¤™r|¸ýrvÑç©uZ†]›b[TmO}OÏv]Lì?s©Ž‡/Q¶(ב¤„Y’‰¯'ƒŽâ32J¤’e°ÍÛÅú„IÃRm…ýŠLFŠÏ1i@å
7C&7eÓNU–Ú,ÓQà¤ÊtB媪é}™â—(&™°¨¸€ÔnýG·kü sÉn_nóý#½ä‡v]ïËæmYWÔµ-ë¼*›-¾ZÒènã÷‹z»Í«ex©U±¡—²9N=U	úæœÒç­FZ
‰‡¡ØS_~‘â¼Orâ0,HÊòì¸òS‡¡R	‡öñ
+ö^óa]‚vy‰-êªÍË*#§‡§å[ ÐSáÌ¥ÊR©
Ĥ5?'$Pë,x,3ýå
+	ÎûOEd@A™Žëžõ+.UL™ žbŽR6¹ÊÉøƂשÌ×	.mê¸å_o¿Åg6ÌËÜvÌÁßh8;ÚE‰†ä²3fÄ€eTE÷7)>³aÁ¸f†>gB€¶qË
m9ºZQ5=‹?ŠÅ¡-è%8ðIý¹Øå
ã
È»´z¾ /TécQœ$è(àil¿šQãfŠõæ?$â,Üê¯7Ŷö[1"ùo}K&ßçÐ]QïÛÿ0˜ïv›rá}ìï'PAëÜ”ð~~ºYÏ°GˆF<ƒFŽW…®¹à/•X7ÿ¹õOèâú‹Eˆ/ ™Ê”§â.ðTIõŒºYÏðqJ
ùøiNLÜ×{:š²‚æ6?²—ßÕ‡–Æ@®Â(lCQœ>DY®¢Ã=I=	O¹5ÑÉí«åb K•‰`,FrŽ˜Ï
ù5d®“ªžò.\€‰fé
©Þ4Ë@!\Óæ­‡DÚ›3±Å^š¡ç¬äv'ÙÚÄaÙhf^¤8™SÑçÞƒÄ]Îhm¶u=.iÄ›à¬BÏ:6öyÕ”!PZG‰!ôƒj€}‚=¡p¼Ð²(Pç0Mºä‰Ï”`ö²Ë’SïT¼\ JLjY®Ê6«”†Ô·Û:Yf|À1rÖÌ{;£Æ—-xü|?ìæ´ëCèòÜa—çäòüô)'¥Lš)ÅŸqy*eîèǽËC`1àº%âÛü±…ûþÚ@¬§=ò×uÓ”w< À¶4É¡	yEÏ∓%a8
+ô[zaN„A0+8/?¡tâ—Æ×
¡ãP¡DWÅOW:"ÀrÞûÂÔx¢caxÐÓ 2a¢Â?ÔûOa«ÑóK¹²#co–+з|ª~çsmÏ`zi°5f²þÒÞF€¦<ƒ8TÐnpM¹Ým©ïî‘fQêCÒW±Œ¢Že”Sß" ‚sáÿsq€ü”ˆ{Êï[ŸVõØtpj!öH€Á±‘k¨ü•@†Í&V“ØÐ/},«…7qÄ)¥ ÕçyÚEÁѪ)…Ô=j‚'Öb±Å1ÀzËbV¯é	¬ÖG†üL„|T$[‚ä¶;Ðko%8ë€FhßÓ“$„_ZêiÏIVN¦ëB'½o-.XKƒj XÀ|Ø?ô¼Ðp”Œ.Oºˆ£$•Š`d]®Öav±¢ñ.Wº¾ÅÞ•›²}¼ä91`²,ù›˜‡0-„n¾)½vJªÛ­Â²Ñ˜Øií	óN·¨åaƒŽ
¤úaè~0¤Þ‡àÒzã0	"]œñèyÃëú°YR'º¦Fæé†P(Èîõ©ø,Òr֯ˇ›-ß ò͇uyçšXôÏxèÏh2.†Û‘üòáú¯Ô–.2Ù¿+`õ¸_ÐKŒB8ÑR]§ˆ) Ñv»zOX=“¤{½Em¦{Ä\ÊG}8OP#ÜãH¦K¥+’ÌE„Ö¸ƒç¨f`ˆ-aû‚ßôËMðE?«¶>
+Š.w€aÛ‘^è—b\÷ùvʧ`ñ/s“4¹:K3Ü	¯&Ë=`‰2Úûë)•*Dz~îëIt2Ç;0-Rã¤Ä{»Tè füœsÆœ.6‡eÜÇžáö9H{ª”Á°~Ù†u”@±ô}¹)0⼞âˆr’½€“ïTË*æÊþƒüâÑç©tF,ÞNÖ1%9¦L‘ƒ	MÈ0Uµ]©ß{déÐÖj Ã:æ4ÚÑì]]Fré"¾={ç
+çŒÈ¾óÀtQ…ºëðÖ¥°ÜÍø¬ µ|	;MÏL°cÁkåÐçkñþ
+Fò嶬 åîRµÄLx1…ÝÐäàé!\2Ç>ù»‘zO"Àû*ëä`<ìK¢¹e„âHg,Ø¿Û—Ÿ=ÌÀļ6cƒÒGlÝ~¼~O-LmšÓhiTáÂŒÁçs÷©ÝôyoþÄ5æ˜êà6ÙQG¬(aRÍ|÷HŸ\¤v“žfà„ÖñW#€iıªE…²\è¡Òa°ÿïݤ49—©Ô9Ë4hÍsÂìfÏÓO·2¦9¼˜öŒrÂIfÙdªÇɉ,»9O¯?¢%™žû3þ7FÊ©YgÀ_üÏËã!”Á[)qæ^ßØTY ˜BæåÉ~÷ÍSÖÿÏů5endstream
 endobj
 869 0 obj <<
 /Type /Page
@@ -2494,40 +2486,33 @@ endobj
 /Resources 868 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 867 0 R
-/Annots [ 872 0 R 873 0 R 878 0 R 879 0 R 880 0 R ]
+/Annots [ 872 0 R 873 0 R 878 0 R 879 0 R ]
 >> endobj
 872 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [55.6967 755.8266 256.3816 767.8862]
+/Rect [55.6967 713.0444 256.3816 725.1041]
 /Subtype /Link
 /A << /S /GoTo /D (rndc) >>
 >> endobj
 873 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [268.5158 755.8266 332.4306 767.8862]
+/Rect [268.5158 713.0444 332.4306 725.1041]
 /Subtype /Link
 /A << /S /GoTo /D (admin_tools) >>
 >> endobj
 878 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [378.2799 116.2526 428.5017 128.3123]
+/Rect [378.2799 73.4705 428.5017 85.5301]
 /Subtype /Link
 /A << /S /GoTo /D (tsig) >>
 >> endobj
 879 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [112.234 104.965 168.4527 116.3571]
-/Subtype /Link
-/A << /S /GoTo /D (controls_statement_definition_and_usage) >>
->> endobj
-880 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [75.273 61.5153 131.4917 73.5749]
+/Rect [112.234 62.1828 168.4527 73.5749]
 /Subtype /Link
 /A << /S /GoTo /D (controls_statement_definition_and_usage) >>
 >> endobj
@@ -2535,136 +2520,137 @@ endobj
 /D [869 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 294 0 obj <<
-/D [869 0 R /XYZ 56.6929 441.8384 null]
+/D [869 0 R /XYZ 56.6929 399.0562 null]
 >> endobj
 874 0 obj <<
-/D [869 0 R /XYZ 56.6929 416.1193 null]
+/D [869 0 R /XYZ 56.6929 373.3371 null]
 >> endobj
 298 0 obj <<
-/D [869 0 R /XYZ 56.6929 378.9792 null]
+/D [869 0 R /XYZ 56.6929 336.1971 null]
 >> endobj
 875 0 obj <<
-/D [869 0 R /XYZ 56.6929 348.5817 null]
+/D [869 0 R /XYZ 56.6929 305.7996 null]
 >> endobj
 302 0 obj <<
-/D [869 0 R /XYZ 56.6929 276.8275 null]
+/D [869 0 R /XYZ 56.6929 234.0453 null]
 >> endobj
 876 0 obj <<
-/D [869 0 R /XYZ 56.6929 248.1435 null]
+/D [869 0 R /XYZ 56.6929 205.3614 null]
 >> endobj
 306 0 obj <<
-/D [869 0 R /XYZ 56.6929 167.2435 null]
+/D [869 0 R /XYZ 56.6929 124.4614 null]
 >> endobj
 877 0 obj <<
-/D [869 0 R /XYZ 56.6929 135.7502 null]
+/D [869 0 R /XYZ 56.6929 92.968 null]
 >> endobj
 868 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F58 631 0 R /F14 612 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-884 0 obj <<
-/Length 2414      
+883 0 obj <<
+/Length 2444      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥Ù’Û6ò}¾Bš*‹&^ñ“㌽“ÚØÙñ¤ò`»\	Ò°Ìc"RV´›üûv£!qâ©réA@hô}€bÃOÌò$ŠU¡gY¡£$ÉlY_ij
¬½¹¼gá7-Æ»~¼½xþ:•³"*R™În×#\y繘ݮ>Ì_ýë寷W7—™Äó4º\$i<ÿñúíO)èïÕ»·¯¯ßüvóò2ÓóÛëwo	|sõúêæêí««Ë…Èç%cxäÀëë_ÑèÍÍË_~yysùéöç‹«Û—1¿"VÈÈ>ų°ýóE©"Of{˜Ä‘(
-9«/t¢¢D+å!ÕÅû‹ÿG«îè”ü•GI.³	j5%À¤ˆR%•àí½E&ž¿Î²ÑV‘G…J3À{¾ØÃ)£BJ¸)MÈžÀªŒŠ<ϧ]c”Ž‹4™DºHNØ(WÄEÀ°Q‘$’¹xšSbnª®…‘Ìæ_švßÐÐtô߃4h
X†A:oLmÝI9/y“¡•U[›’Ïã.íšò­4+W¶éËõ¡l6t(¸@1ƒS±œ_÷^ÆxçñuÖ±j–‘B‚¤˜-Ç7nWh"öe¨D•Ä³ßÙíW»’Š£Xx!u½ém
DÚE¥ è ÐöRäsÚ@;#¢aT6˶&•Áž†aýÞ|µ´vgmC°33°n@ÖG’YͳÁÊ
-°®jÓnAíç
é?öÌVç’ë£a˜ÖÙ?yuåR&¬êá¢3ßÇ’IV̲\Mù÷û¶Ç¸£œðíTFRCܶ=îÛ	ØX3/(G%R”·`YýÖ	A¤VuvY~Œci;Úfn—;Äá¹Ù{‚¿.M_¶
côRÂÌgN²n¡mÐÉš± g‹BF*¶ÛƒH]MïŽi5ïví¶G£Á)Òr~ûþú
ÁΰꤑŒ'AµY¦RÇ}m–‹z•LÈMg`±ìÈT^Ó{†c4]¤š&"ÒÊo$£!âv¶Æ( RH)Y4P£ÄóªÝl(òŠ÷£0ÕÌÖÔµÙN „|›hvÅI
-ÿçDê*”<1÷´cyošÆVÁä3åÊ> ø'1mZ—o0è!8r(ð¬TQuV ¾b{^ÓÑ숰ÙÕw˜’püòQ(
ûïhºkª².A1g>…¡8`¶+ÿkÏFrÆ'“Ì2Ý¡ùŽÇŸ×fYVš¦2€?Õ¯ìv;E×_žßª:òñbL‡˜fÄbZ„KÁ-a
-A¨
-„·¶¡÷fÛÖáooá¤õ ¼;Q¦DÈKÙ¬ÛàØÊÞíSUU•—e°õæP.Ç,Ž%^0ú~Ô/ ¸ZðUf÷`Ù`ô'q²F;Ã¥FØK:DóÐcÝa×ÒMp§ ÚS±ð5†OçìQ®Ïrjøá~k¨ÛÀ¤ØµËøî¨{kwýÚö÷íª{FÕ?^^8r
ŸS™Ç5œ¹xÂ[ö奘S"\þU±oéT͈á»Æ5Ïh£+°¸	‘,&‰òÂI¬VПĒî»Æ+-øùGˆÚŽ…8ÆM˜œ‰®³€nadAwUÙ9Ò°wÁG^lò¼m=Š!o¸7|{˜ˆ;fÛ9ƦÕq*sÝkŽœá›VO+{ÃtH-6ÀÜ,wíÐ3d: I´^lùžÜb©&r\±÷wlüN‚æâµoÄ[ û,‰´'Îèt‚Q½Ùöœöô|÷€2H°¯¢ÆYQ£^½6$VæîÐôæO[êðÛ-Áw*üçDª&”
-«ƒRa¼iùDœÔƒsM9	G9î‘lœz|L5·’žLnG×'Q壔z"TàÓLZä^_‹Í7ß[""êa’|›{|YEfåŽÒãªÂGm•J·Hpñvë©:MœüJéñ›ÅÙK]Ûå(õåŒ7­ÏŠ^˜mcC)×-;-É+
Þ§ð@,Â"¨›òƒ*Ÿý^âC»c¾Ë­6_løNÀ™n”ËA‡u¸gÀƒ	Í×Íy‰$AпBli6ešú$ë+`X®w]Oke³¬vXf"Øøýx˜9n‡¢ƒžŽSÿ‡ÐÎ:‚A0ty•p‹Üä*®¾"€«MqÀ‘ç4æ)ÏçLøßó¿{ŠMÙßÜÛª×\°fuW™-Í}CŽã¡÷/Ò£ãä;x ô6¸nìmn¿úÔŒÂ/«˜¬ÊnÉX\ìÓÝ@ˆñÈG'0$üR4ñ‰(\ó»?H¿Öiˆóy.§¿5©8rYdž(TR§”_®ÎIÿ?í;«endstream
+xÚ¥]sÛ¸ñÝ¿BôLˆÃ'?š§\ÎI}í%­ã›>$™-A2ç$R'RVÝ6ÿ½»X€"%8ñLÆ^.‹ýÆ.$fþĬ0Œ«RÏòR3Ã…™Í7|¶‚µ·ÂÓ¤(Sý|{ñÓ›LÎJVf2›Ý.G¼
+Æ‹BÌn“×}õÛ«›ËTždì25O~¾~÷aJú÷úý»7×o¿yu™ëäöúý;Bß\½¹º¹z÷úê2…°_zOlxsý÷+‚ÞÞ¼úí·W7—Ÿo½¸ºtë+¸BEþ¼øø™Ï ö¯œ©²0³|p&ÊRÎ6Ú(f´R³¾øpñÏáhÕmÙϨ‚™Bæj3 )Y¦¤r¼½·¨Žm-
+–^¤ùÃ>z5¥É´Pž¦ë«ÞnlÓƒ}¸NæUC@;ŸïwV~­‡#0Ißn	³¶víé—"àÔ6Ÿ8—«ý®êëÖsEÌÚ´ž}ÝtõÂ㪈NŠfd”z¨í!¢•ÇåÜœjq!K“üÍ>vt¦¸{–ª,gÜp_!XiŒtQÀÆ.€V¡dôôMIÕséòœ)
>üŽÅKÍÏ,Þw29w–þﻩ&©ÖkB òè¤@¯“#ëm³ M&Y:ß©1ëÊÜ0%rí…¯õ»vÝE´€h-Œgq㬩gÚsjMÃ;kO³MpÍ2aòY®Ë¥(1îiq·šp3J”>o8O”s¾(Ä;÷èJdúLªi ³?K×ê{Rœqó¦$Âfßõ9‡Ãÿ…=†|V~™R	—o¸ ddñ\±‚K0¸PŒ˜V…DY	ѵ^µ;`°	ß
ùŸO•éìœëYX~FZ—¬2\yÃIçÕ­dÒäå,3ôЛýprŽé˜e$¹3ɤ†Â3=Üú.n!4¤\	­~笌(ò+BÝÖÎk,œ¶#²Êã-t.uÿøSµ‡ü„„ûÄqV†‘çβn¡m0Ë›±!gi)™â Ö$QáòWÓ»mZ%Ý~»mw=F
~RÔ@kÜ~¸~K¸3Wû«ÖŒ
—Ës•ysÜoªyºY˜ˆÝt1ÀCiG¥Šò‰p‘Ó:φ2ßÙþ4V´È¡mÕf–i¸J•?+ÇtÌòù…–|qg}ó—k0°‘Ó,ôÞÌ'Wð$ñ»ñ”.瑒Ϋúá÷•çXuL@JÒ"’Žl(ùƒDK,à`]jº±yÉZvµ¢Ò,>Œê<9»j³©v‘À†pA¨‚“y&pü¯3
¸«T2Ÿæ#QÌ﫦Á†ôñ….Ë¿o’/ØѲ^{òm…‚c{¥b%Ž_±Ã¡¸w5}6ûÍÞIÿÏòI(
ôwô¹oÖõ¦Ç|ö
+‚>Çj±?¯«ÿcÏ (9ãiTY/E÷Ø}Çð—e5¯×Pšbdž]ýÂîvß höëõQ—c9ÄTŽ ˆÅ{7‡O(Bë‰ÑàÔvjÆCµk†è§·°Óž–+1µn–ídÛÂÞí=#/•É–ÒG‡z>VqlñØqžåò¨O¡¸ZÈU¯î£õtkÚ—Qß‹sNSÃ=›SD¦¾9ò=.§E̾>Cæ©Þáë{éIüÏsùåÄYO®3Æ~Pzä@[c…çëË'Ê"t p§„¢(ø3ªâ/4eÕÇap(â¿wÕÊFn™“rs‹‹«<´aA‚èü,Uy>?§Jå£×j‚ëN\<¸÷„ª]m1"ñŸ\jPÚ!·=UIüpOÐÅ´äADù^>×®kÈqhéb¯/`iÅEè0Âp®Ýôy¡¦þÝÞï*6ðJìÚy
zw4¼µû~»ïimcûûvѽ æßT~eÐÈÍ{Îej\ÕðËUOr¨/EBó‡p·¯âa¢S|fDxwq—¼‡h–Ç1í$©ý(àƒˆ±JÆMhJ†„ŒtmœeE0é`!7éûžÀ®íÜÇí}{ ßî}[1_ƒ5­ÿpoø´ÓDrè<(–üÓ‰]„·h/õtÄxïú_©5tÂ1Õ4´zùQž3%t@µk–´	–ö3&`Âa+O·©/”;§(@4Ù¸¶a¡óÕy¨šU‡\.’ë%!ÁGíÛðYZp&Á&S·7mlW,—…~–A²òìaòÅIƒ9©\ço§€<Ôîнý%ÒÛ¥F0^âT6ök¤Å“07yy2ÑL®…]Vûuvq_¨—y9EºÞã¨hŸæÎô€}ã†gƒÑØÛL™¤'ž\§ÅZ1Sr¢¹Æ++ý
+•`s˜^|1ıpÂÇ™Íéøï§C€,xðn]wNtD\õ@hà‹3^®'Y‡§p„ï+Ž{ˆo[í:Â8³:Í`PõšÁðZ fø¦ÕÓÊ¡òôTZœý¬ÜµÃDì1ñŠ&1|qâ{ÆíÆeäG<âΘ¨ñ/2ÎôP°Ã~|Øßç†i)N²Ñù£új×û{O'û-ÚÀø·r$Ç×¢UF5¼z­¨J,¢î±é«liÀow~¾SᓪˆSÕñ÷
„W­ßÑNvê!¹"ÝP(s¾:¸G²ñµÐCåóRûI2ˆé§ÑåIYù$¥ŽÔ
+|™ÉÊ"ø+]}÷½Õ1"¡¶£š¦ÜãcÝ1±×xS©ØÛ:ûáÞŽ¿JÂ䬊BÆéÏX!Ë<…**u*ùðݹèÿkdÔendstream
 endobj
-883 0 obj <<
+882 0 obj <<
 /Type /Page
-/Contents 884 0 R
-/Resources 882 0 R
+/Contents 883 0 R
+/Resources 881 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 867 0 R
+/Annots [ 885 0 R ]
 >> endobj
 885 0 obj <<
-/D [883 0 R /XYZ 85.0394 794.5015 null]
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [103.6195 731.9163 159.8382 743.9759]
+/Subtype /Link
+/A << /S /GoTo /D (controls_statement_definition_and_usage) >>
+>> endobj
+884 0 obj <<
+/D [882 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 310 0 obj <<
-/D [883 0 R /XYZ 85.0394 662.5434 null]
+/D [882 0 R /XYZ 85.0394 605.9993 null]
 >> endobj
 886 0 obj <<
-/D [883 0 R /XYZ 85.0394 634.6304 null]
+/D [882 0 R /XYZ 85.0394 573.2561 null]
 >> endobj
 314 0 obj <<
-/D [883 0 R /XYZ 85.0394 376.1585 null]
+/D [882 0 R /XYZ 85.0394 303.7856 null]
 >> endobj
 887 0 obj <<
-/D [883 0 R /XYZ 85.0394 345.4362 null]
->> endobj
-318 0 obj <<
-/D [883 0 R /XYZ 85.0394 136.7105 null]
+/D [882 0 R /XYZ 85.0394 268.233 null]
 >> endobj
-888 0 obj <<
-/D [883 0 R /XYZ 85.0394 113.7908 null]
->> endobj
-882 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F77 707 0 R /F42 601 0 R /F57 628 0 R /F56 622 0 R >>
+881 0 obj <<
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F77 707 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-891 0 obj <<
+890 0 obj <<
 /Length 4109      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]sã¶ñݿ“—È3ƒ/’`îé’Þ¥×6—öz}è´™-Q2{©Š”·ÓÿÞ]ì$eÈÖµ7Á,û½¼ð'¯Ó,É
-U\ç…IR!ÓëÅöJ\¯¡ï‡+Écæ~Ð|<ê»Wß¼ÍÔu‘™Ê®?®FsÙDX+¯?.ÿ6Ë•ÜÀböýOïß¾ûá/^ßäföñÝOïoæ*³·ïþð†Z?|xýã¯?ÜÌ¥Måìûß¾þãÇ7¨+ã9¾{÷þ7)èqfÒoÞ¾ùðæý÷on~þø»«7Ã^Æû•BãFþyõ·ŸÅõ¶ý»+‘è¦×Gx‰,
-u½½2©NR£µ‡l®þ|õ§0á¨×}¥Ÿ‰Ò@«§4:FÀ´H2­´#`»ëë¶)7›GØšÎgå¦k±eg›z[÷ìï+‚m«®+×A»ê¡Ú×ý#‡·^ö<Ö†ÝñGåbQíújIýw',î˦ñóü]¤"ô,«UyØ0Bu‡”‡ýÄ(›2¢àÆêfÕò 1¤M¬2Ó XAÞâ¨ë¹1y’ë¨(eR¤ÐÀe˜j™ÏŽ÷ ²§—¾¥gÝ,6‡eE/e%)ÓÄš”WkÊ-lü)NZ$E¡=âóuÕTûÒÑÈ-Voy…®/·»[hkCCàF®Ûý#½áŒN³ü¦e|‡“Â7>)lz
-;
-H“%VÛlJîÀø@w÷lZ %\‡§¾”Í#6qÓ
-˜VØÜM÷‘V;¥r¤(<À5Oɤd’gšÇ,«®¯›™-²ÙbS:D @š@³#xé8€Ì»'¸Û@ˆÓðëÀƒm	èøÞ—u·(÷7rù
-¨¨pó~†²÷t”°³Ö±
±˜!ÖÅ”¾$€Lמ˜£ë=Ór@	ëæžmU6u³ÞÀ¶>ƒÒJ$Ff6ð¿P›*.&R¥YŒØ:O±uŽ!¬}GÄš8ÊãŽÃœÌ°¤Ðñu 3›ÍÞõüiÙPï bu*©dz!à¨KãÊ9Y–¡=ç„ý=å`ó,Ër¸i×4«G—"¦G	É*k"ë
-¦Ñê%Ýi“k¯9ˆ”¸ñd_¢lj'P(›ØCg„­»rñé°£þá¼°§]
”p݃ \ƒJ%ò=‰¦LçŠtA6	“l©uĺž@®ÏóÙ[§¨\ý
-~ƒü¤žÕ+‚Ò	Acq߶$vŠåIÍ>UÕίCkó€v³¤Æhk^¬°¡': ÍG¤§²³…‰<ϧÇ.Ež§ž9ð`MNÒÎþqèzjÝU¨ãH‹á{Íp”:|ÃF°‘pÒY.Œg«€M"#øäLjîyÐOÎÆÙVômd¥œ¨<²ŽŠ­6IË°í§“¥@@©§“ykßí§‹‰Ÿ+hÁmH'ç7$„TRnº# “vŠîé´*M2D[¼Ì™JÀéþÂØ‹—°é2`SþzSÛhM2,ÐèÊLjҙkP;0ï”÷GÚìü¡q†(ªl‘SxAð¾ùKÐðNu‘z:Û;ô,±í<ý‚¸¤wŽú˜L:D¼dWÿ+fÐÁîgiÒ¿4gí¥®k5ùˆß±FÛ:òŒ2ÒåØ Áž³*D'n
É>¸'
-Q¥){‘h³]Ô­eÛTÔwß±”
Vºï*ž%óšÂ«_UµìN>¬›e½à
Á ¤L‚ÏÞ·4Â[l-Ú©8^Ÿ €¡–_àÉ>ò«àþR£úµF¿iMoD¼Á–Lꮽϟ•;ØÙòŒÕ>ë?Û`Ïs€ÍÒSÀ(`Eq‚eÌ:nø	nÁ’º}ØÃLìšÎº£Kå(Ôû{Œ¥¥"÷Bæ>P±ƒý Æ#Üò'çðA
natbÞÎÀËÈóìe÷@¦aÓÎ= 嫳$çcÊ´]ß"3h`C—èäàÅI±¹NÚ À§6ÅËà„–ˆÊ+*C£ÔŽÈ•ÊNE§‹ª¢
-(Ö=r¸HIc@Wàph´Nx^§o‡XœäZèDgö$"ñˆæÐR’ ·›
±tò ˆûú.€ïÚþ‚£kå‚x4Õ‘°QIÓ*ùõ¡A=X¤ÌTÎyVV̪ð}ãŒer›^个BÉ	ÁoIa4-­°mÇë.˾äh “‹lª6ØäÙãùªw^‘  Â=ï¹—¤	‡¦¯ùË®Ýro{èçíj~GTÀ¶Â«î¶ôJ˜mº°çù÷7¦DUØ[ÑãBÌLcÊfªƒfç´üµÞ¶^‘r•Â©¨±Zd]YÝ—µoÏ&¼ÇÀN¡¹–3ã.C”	´=¿pñËþoG!¥“Ó’“ó\ÕH$ôŠÞÕWT¾izÐy`K‰í«ìöuÓÏ)bÅqU÷*fWiÜšŒGÑýÏ«
z!è ÏÉÔ†ÔG÷ØÅ}U
†¥gòLj”gRÓÔØSRã’b/pÔk÷b=Ù´G³w~NR¶œ£Rì£9=Éß³+¦g«rQojP—.€’<0‰ʭ<Íæ
ºâ[ŸøspðMa^$˜JÀò±Ö¶ä9w qߊlöû¦=2”ÐíëŠ#moA"Çe vÒA‚>Uû&ž§Ø4m‘()=rprûX¶d5ËÕ¥³lËz×
-& {vÏËTulGÎ3QöRdÊØþsÈ\¼¥³‡«lL”_:Ïf¥¯NžÝÐܳ
-ôu&Úܘµâ9”ÒDJãùöpXìb³¨$³Æ¾4‹wûèaç*½<+Py±S/Ð÷0—δêwçè,䥓lÚE¹‰EÑ
-X0ê³æ‘ÿû<éxõ…ðÑ_hó…ö•~!|²Ø<D9!euÖ1YHߺ©òPš«Lc~ÛEl:	Ìõ™³Ìéë-r¢é]Gˆ7à¥;ìvížs
rFÆ5|Œ	b,Q†ÃÁtÙ­g¿¥ÿieÌUZ®Ûsö݆ròÖ‹½Ü0zãZ‘µ".àóžÓíà)ç`f³“@’÷îzÍή_nè7¾X:”yª'ÛIm³Š¥_A%*91Á83›`¬Q¹xpp¹dìo¼"PI€à”@ûx_»²ôr%
€<ᑺ\†™A9HðÒ®b^f6±E>Uðϑʃ6äºúîO’x´À?¶ãê¹MÝ4ª8CâçÁîcB	ÐÁš(–/c®:ÚºP‚\AHÅ!"¯Ñø–o‚³8IõlA¿zÝpHÉùŒÁá0Óâ¼’Úë™PæÔ&©ô†aÀ*Ûý'fÏMý)êZð$BT|¡£ðuGÓÿ])¯Ý;E€o·CÆŽÒhi8_—ay$Ø‚xØø	.÷GOJHa_½"3µç醷3“¹Õ§	Ÿ}Y¯ïquU·À]òteäªÿnؽÃ
Z‡ŽçâºÚDÚü3+—¹Ñ³ÝKxITÅ8aãg„òsS•7]„«}”€ÑM
7’nj@s]?T¼—!7æÂ̬01ïyæãjÅ3•ëW¾Zv5ŠÁïøÕÞÏÄ<"É£YGÖö·HÎ6äÂ&6áðå¡Ò™cN× Ý?×%žªì6´@\×GØlÔçµyšè5>ãËÙ´ª~f…Îv·-ŸW!Ÿ*l§_Vûý™Hʨ<šüK‹‘çTœ$ÿ²€]1¾³ÅNEZ½]µwÕ/8¯ùË®éà[e4±Ãïù›žÖ*·è$h›$w²˜…gÓ»ª!ià´	u¢ÚÉF[E7}¨v®¶ZŸ›´* ‡m7·ÅÊÖHÕ#Ü•·,¥#ááotp
ðà®EÁg;z_ÀYßRX0¨Br~‚…ÓÍëaz€fCS³>ìËy,‹Œçs–8‚ãMäYrêÜðKµ@½®~àñc<àÜ~’ÀÂcŒ]R†Öß<™ø½]V.zU\Ë÷wÁFÈCD²éëM{W";ÙŒ­4Ã=N„ÒAe\…­ÊžN0÷¾*tý‹´[{n44dBóÌaJGÌ*;µ|ÿºKyÜV@u}¡7Ša6`˜?¹žÆþwÕ“j­êáv­»I0Š=ëH®
Ç”¡‚N_Tõq¦wPé¡Ný´æ’°a©÷Bæ±¹1NW"nTê’Q^µþ
-áx[%=v-˜Ÿú‹ã(½@íõ ™u:óeyÿåH#¶F›!Â!ÙØ7Ë+ }5®Æ$pÄ(Ñ™¯áÃÉ¢Æã“M‡ÛÞiá#µ‚sK‡:V}cÖ˸ê‹ÇœØóðÃÞ¯v¸`IyKš’n\Ï“,bŒðÊÞ‘€«þ:¹xšº:C'«F׉T:{M"QLÇŽMšµ¤¬WûÖŽôjás/Ö’†³ƒÌptæ„Ô2¥ ?ÄI‘±¼àš”—-†5ùB¼‡“2P_ÖodÛC¿;ô\½ýžŒ—O „ÔK·«õÊ_QÁP5/|Á—dÍI)g·'1"kÿoÏ\:€Ž©ƒpme@K¡¶²Ÿ
õ"P«’
+¦@]ç0Û¶'"¶ÊÀ£É”Ø5QÐj0#˜ÊÐ`:ضåqxã´'«¨pdKÏE¹lwÖ
+˜„”BqQÛ`Û
+-¸ŽÏÞ¬¥½´ +I;;=»âÞ-\Ë-kõ€4ò"ÚËÖîA™¬‚üñpRIN¶^Cщ¤rŽ1Q+Ç9~yØÜ“ò@kqV‡,.EL’ZUÖÖË%L£äsº3‰’T9ÍA¤ÄÕˆ'ûeSYBÙÄ:#l-ŠåÇãžú‡óžv=PÂv‚® x^2NÍ”µÐ”©Tò€.È&AȽÂÖ	wj[x.0¹>Mgo­¢pù	4¼õ2€Ô³jMP:!h,·mKb'YžäìcYîÝ:´6hë5F[CðÚc…
5Ñ:z½cVªá]„çùøÀ×NSïâÁ&),hÈlöOëûakQ®ókß+†£Ôá“6€€“6iœ8¶òØ€SÿŸ4“š:t“û³±¶}XÉ@t‘Ö‘¡uÀ&)á·ýx2
j:™³ð-ÐþLCÁBqˆÏ%4½`7çgŠ/o"
+ùBÊMwdRVÑ=žVêÈ sÄϳ‡‘D£Ÿûø9ìÑ›ò›ØþHk’aD¥3W vr`Þé©Œ´9Øùcc
QPA”$¹ç[¿
çTçÎùÇÎãnah[CO· n$郃>f&=ÎÜ’]õ[È ƒÝ7ÚKé_š³rŽR׵ˊüNÄïT¡myF†ãÝ|†Hæ1„ãùT[ìƒq¦¥ÖìE¢Í¶Q´V"kV‘cÈVº%Ïbœ¦°àòÓ²,WÝÙ‡U³ª–¼!„”‰¡ÓÙû–F8€í±E;’&Ž×G`¨µà@š}ä×Þý¥Fù©B¿is–,ö38Ô]zŸ?+ö°³Õ«}Ñμ¼Ì™Ñç€QÀšâ„Œ1ë8¸á'¸+êva3±mZëŽ.…«§~‹I&!ɽ©T²Áþãn¹“³¸ ·0:!ï@ð2ÒÔ<ïí7mÝR¾ÊDœé1w}‹Ì €
!\¢“Sœ	p1ü	B”xàÔ¦xœÐ‚AyEe˜HùG
+äJšs‘ÅiÇ¢ª¼¨ŠUkÒÐå9Ú#-¦Æ™xAž~5Äâ$×±Š”ÉäT°G<"‡9”$èm]»H›LÂ'DËCµðàE{Ï_pt-mP¦À¦i‹H
+დ;„²] «&•/eWTuX+$Ý‹“8þ[ ªC;²ž‰Ì^ŠLqÛ	™oéâáÊ,&J_:O½ÒWEOnhž³ÆèëL˜ÜµæñS(錀ãÛãq¹Í"#“%Ùs³8·aypN.õKQÁ³•w:õ}ä¥3­ûý%:Ç⥓Ôí²¨CQ´4±ü]óˆÿ}=žG~&|Ôgš'ùLûÒŸ	š+³>euÑIŒOßÚ©Ò 4—Fa~ÛFl:ŘëKÔÔ’s†C¸z‹˜hzÛáã
xéŽû}{à\ƒ˜‘qõc‚K`ápk0m6D©Ù·”ã?¯l€¹Òùàº=eß3¿CN¾Ã`±W5£7®	_+â2>·œn·#3kÎI_ôOS±³›Œ¯7ô_,ŠT«Év¢eÛ¬CéWP‰RLL0ÎÌ&kT6¸²gZÜ—*àhŸ¶•-;@/WÒÈã¸à]6ÃÌ Ž$xi×!
/¸¬ùYZí©3’©×†\W³7)\’Ä¡~ü©WÇÈm:»qÄo”x»	%@k¢X¾¹êhë|	r
!‡ˆ¼FãZ.¼ñÎâ$ÕS‚nÕ¦á’ó=ƒÃaêü…y)”Ó3¾Ì hiá/•x¬ôìÔ>2{ÖÕÇ ˜'á£â:
+_t4ýÏR&`ñÚƒUøöjÈØQMûóµ–‚ñ–Ä]H°¹?zRB
+ûª5A˜©“qžnÈáPqÛ$QžfgZ«ëEµÙâê2'n'2ºåéʈ.›à°­Å
ZÇŽçäºf‘ÈÒßé\ÙÌš}?èXÂI¢ÌÇ	8#”ŸuYtÜ´®rQ2F75ìHº©ÍMu_ò^†Ü˜
3M~¦Ò|¤¾pQ9ݲY=S¹~íªÕ~W£|Ä/n>$æIÍ:z´¶»Er±°™.lbÃ_Ž*]86àtÚý÷ºÄó„*»
-Ö5À™$õim®#•z5ˆÍOÔ°û²¢‘Ø»}yØU
ïñd
+[@Ŧ?Òõ|ß*NR4p¼*/å,½Cy¼ãfkkòÂU'“IuRû^TæTTØOÆEÿddñW0ttÁ¡Ë<*‘ˆ3ù\´”Ä|>íú@,¤óxˆèÇa¬Žý•‡Å±'ìÈä Öpbs6úyÎT¬§Êdæ*4Ò,Ï'‰NÅ¡†O
+H°!™ø¼QN!GZªäeÌ”Œã3—‘TtG›r$›ØaÄ=³&Sý& KÒ§¯ZAhž)Ïò½R¼ã;S-Ëð)pÙÔ¨¨†ˆ.ý1ì~ïM¨ÊÒ(WY6ål›<ŽÝý”B \×ÓSŽ]Ù
+=›rõŠÊ6Í؃†¶ÐúùRD¬¼î¸òø4€&Î9†I”êÄ1êeNÂt¶ôyJk§r³í®òKð×ÀÉŸfËBÛBý™493§öX³i°I>ÖÛN‘OÍËør6­¬î½Y¡³Ý…mK0ï{ÙSÒ¾.Ûõ+¼`Ž¤™“:yNùYòÏxìòñ-v*t>ôvåÁV¿à¾à/Ï® ñõOüÆ_ÿD'Ae°Ir'ó™6½­rN[,ÏT;ÙèLÒM	ª«­™ËMfÒ£‡m;w†•¬ªG¸-oe”Ž„‡»ÑÁ5À£½Ÿíé}	gýŠÂ:Aé“ó,¬nÞëÐ4ššÍñP̃	8Ÿ‹ÅRŽàxS¹»Í1¨uÃs,ÕõºêžÇñ€WTp‡OÇcìâÈ2´î.àÙxã{UÚèUr-ßÝ!GÈ’oêvQÔt—¬4ý=N„ÒA®Â–EO'˜:_º~#íÖ¾ò·2¡¹±˜RÇ	³ÊV`3¾ÿÝ„<÷v+ :ˆ¾ÐÄÐ¦®§qXö¤ZËj¸]koR¤âÀ:’kÃ!e(!„S/*ûú8ÓÛ«t_§~\sIc°aÚy!óÐܧËX7*UÁ(¯[w…p¼­‚ûÌOuÏÅq”^ öfÐÌJÏ\YÞ}9Ã?ÈP:Â_Q~>ÿL÷ÿûÇÃ/Y’4++‡ßaLT)Žà8¤:*y„¹ûUÇcÔÿÇIV
+endstream
 endobj
-890 0 obj <<
+889 0 obj <<
 /Type /Page
-/Contents 891 0 R
-/Resources 889 0 R
+/Contents 890 0 R
+/Resources 888 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 867 0 R
 >> endobj
+891 0 obj <<
+/D [889 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+318 0 obj <<
+/D [889 0 R /XYZ 56.6929 769.5949 null]
+>> endobj
 892 0 obj <<
-/D [890 0 R /XYZ 56.6929 794.5015 null]
+/D [889 0 R /XYZ 56.6929 752.0323 null]
 >> endobj
-889 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
+888 0 obj <<
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 895 0 obj <<
-/Length 2474      
+/Length 2579      
 /Filter /FlateDecode
 >>
 stream
-xÚÍMsÛ6öî_¡é%ôL„àƒ Áô”¦vâÎ6ÙuÝSÛÙ¡%Hæ,Eº$­v§ÿ½ïá)#q:{ÙñAàðð¾¿,þÄÂhÆU‘.ò"eš½Xí.øb{ï.„?³‡–ÓSßÝ]¼ºÎä¢`E&³ÅÝf‚Ë0nŒXÜ­IÞ¾ó÷»«ÛË¥Ô<ÉØåRg<ùîæÃ÷)èçíÇ×7ï~¾}s™§ÉÝÍǾ½º¾º½úðöêr)Œp_zŸ¹p}ó·+Z½»}óãon/»ûáâênäeʯà
-ùýâ—ßøb
lÿpÁ™*Œ^àƒ3Qr±»Hµb:U*@ê‹Ÿ.þ1"œìº«1ùie˜62Pç1ê‚eJ*'À?¾E^]§jr’/–J³"/´;s¨êú "ÙÚk{¿ßn«f‹Ÿ½TŸÈ™¬ÐZ:Îè1£’mÝÞ—H­IgÈaËñv‘‘¼}(›ÆÖ=íªáÁKoj¨’sÆy®á1|c}lÊ]µŠˆ9ULåõðLW
GB½ï-3RÄù¢§½ÑŠˆ&p<@‡Öq½”ø”ä:pO㶃ívUcɦå@«ˆ­ÜÚž¾‰û}ìªf`AŒ2eÐ:D7›ˆ
-Æs%“þÑ®ª_9—
¸SŠÊRf2ÎM²Œ“CÈ1ý±Â#„(ÁTšþØŠL…¥‹ä~ïTkœ'Iƒí˺>ð±þÈWp¯¯š•!2ÃR9²ú•„”uß^'Æžž$Ðë@¤3¡ Áá”RqË)g*ó™vV€gÛvÇ=YÆòL$àÄŸ¦pÃåÜ'(~ü¾·ý`×(<#‚¥At!ªsŒ¯¹/yø;n{¢KÞð|ï·Éðhí¬~¶Æ(£L–\WÓ€ˆãHI“ƒJ%3˜f¦rãHD)Ë…™ÈˆoüŽM
‹“…ˆK!§¡
-¾B¸¥ýBœNŽrÀŸF`uï!Á—i‘%w1›“ª`JféŒÇo²€„[i‡ªmzODyœ?ÁuM+—ODÈCXµ»{>Þ~éC'½ÒÅ™—:[U:(We`ç‡òØÔ)`Ž\ëâcøKV»›¶®ÛƒK4o)gÙî5ЕsT2's&°QCËáYòÞ’ýú=5eCïÙ—»ÇÚo&g‘úzž …×9Šª—Êô³šù²8×f”r¤kˆæ5Ýž-PÝ€þ±:œ&i–×ö~	™–_.3Ρ_sýZ?dŠ [ÛØ®¬A–øxÒ´Cµ²á«Û7
Ê=ZúLº›H)S‚3	êÛw~$ðÚbœ§LÐÕX,àé²ë‰ò¶ˆ+ŸžØ¿d²àA|PJÀùHÈň¨2êEO(×vSîë@g#[Cúð(š`æ“šä}{ 0˜è‘nb½/(&Mªç¾àYðeþ®m¿êªûÜœ×É"OY&eºÐêLˆyX±Òf·]ÐâvRâŽç—Ӯĉá)^$ð'»B£M‚„HÁä9Iš™âÂÌHzRk§ž!ä)6$„Å\h )“gî‡lÙëñŸ>ã:ØJ¤bf€™B¦Ç֥ݵͷ`÷
-
ÿÕ+÷®°ºsw	-çtž:5Ϧ\UµÏ6ÀÀü¨<+lñBÕlÚ'Ô´M}<§âI;¿£FΨ)Ãå‡j‹ŽKD)L
êŒê{œ»;¦Ÿ—º/­?+tB¸©0²â¡oœ“2ˆ1ß §P­œ8=Kv.øñtàôy>]qèÚî_Χ½U†îK óN'\ýЬÈ5Õë|™è€
-¨\ǒ¨¶Í†¿ôtµ9£>´4Sú¡ì»þ×vÍ1½Xn^xš\~aQ{{ôÝÙE„Q;Bõ‹þy5­ö]g›!XÓhET1ESFóK!a¢Ä/…w¹ÌŸ˜ccDïÿožüÕÂjöu=‘È!&ãÀdŠ!?Å”Ÿ¡íû@Ñqx}­õê[l)9Ïâž7=š@×”¡4ÆÐçF2i¨K¢“èhB’ÿyêUºˆw"WL¤Ð~~ÅJ²Â`ãQ-GŒË)Jʉó¶M°ïLjLô‹HE#™VÜÌ»Yšñ¸	ÊsßgÄ5٥ߦj¬}´kQ\Û†^Œ7ª d§“ÓëýÊö~/³àüÁµ~*´~î­Ù ÆéÑ€‹“îå„1WsøiZ"5mó*-[,¾On†°ÓíBk~òÐé ¦¤,6k_<¯àF(gål2èùòiýè’ÍS‰cbL¨4+_/ùFŸ q!ý¸¢¯¢R‘R5%4çàÐhçy6/p®q…=à…8éÂ~Ž²‡á%õ4¤Ü#R`ñ+”x^Eª˜)D˜9-÷&ƒ†èˆCäPBã·£¦>jš‰Ú§‚:ÕÁ/æHGµr:Ü€u쌞‘y.‹à²£F'¯­¼D¨D’ÐtI°9ôBž6ƒv8,0ò¹FB1­˜ÍâtîüF8»ñóo&iì ?ß|ÿ’V~˜c¨µvƒžàfô0SŸFÜit8¬£"³®YjŠü/‘†]®¨ð†j’ý£_(¡PŸ‡l"Œ¼üÜnQÇè¾ifãµm‘“\ùJ
-ŽÐ¯üüÙ
7”‘8Çr{ÇvO‹ÆZÿŽ“&ü®ÊÇa?¶†¹òI·H^nLÃO(vû~˜ÒçÑÑ*ý×aR»X÷(HjÒ!$,·_ëPšŸâÓy^)²Sþ@¹–NÆ~Ýy3%„¯àlë×n’S„ÿ+Œ7pf•âÌjïq‘Vf—q¨žH:úòápî«zXº‹Nc8t’Í8ŒèÍsƒ1¸àe½k×Õæx»OƒÍ'ƒø¸÷GÝx„úyS2OøÇÀ„Öéãå§ñ¡Q@Ÿù×T1øÿ¬HsÍG[úŸÿmvúŸbš3eŒŒw阙Œ„ â‰BÑ*}Nùøÿµ§¤ÿ	²¼^÷endstream
+xÚÅËrÛFò®¯`ùb¨J„çÇÀ>9Žd+µq²ŠrJR.’¨ÍånåßÓ==äX²k[:pÐÓ3Óï—ø‚Á_¨8d2‹i…1ãñ¢Ø^°ÅöÞ_p‹³tHË)Öw÷¯n±ÈÂ,Éâ~5¹K…L)¾¸/Þ}xûóýõÝåRÄ,HÂËeœ°à»Ûß$£Ÿw?}¼¹}ÿëÝÛË4
+îoúHà»ë›ë»ëï®/—\ÅÎ{ÃÜÜþãšVïïÞþøãÛ»Ë?¾y™òË™DFþ¼øí¶(í.X(3/öðÁBžeb±½ˆbÆ‘”R_ürñÏñÂÉ®9ê“_,U+‘zyga"…4ìš²@–²`èòB#CpLNŽEQ˜ˆ,†·$eÜo4Z×íC^ÓºÔ»5.UPëÏÚB‹¼¡Åƒ¦½^öÅ–~ÿ£»K®‚ö
+>äMIˆæ¾uÕ¬	mÛ–öÑa×5º¤u»Â³+s–‚v—*Ø5
ž%Ž¦‚J…QÄ”eɈ°KtÈRÐÛ’ó0‹caö›öK¢tÁkM$âàmŒ«lF¾RÁV÷}¾Ö=}U
!
F
+¥Ò}9à&ÿl¡9ý8Éž‘,r›)+)ØßTë
>ǵ®+ºåhÄ­‰gÇÃŒåRyU“ˆYÐî†ÇÝ€šçà›¼ièVØ6ù@«þQÕê@ùö;c¢ ïÑ@`HëªápÉ9®¶j;ZèçÛÇZ¿&‘ÇéDäÿ’ÔZ5—Ë„9ªâ“y瓵AÜù¯áUÈ0ã§Ú]Ÿ„ôbÕ¶/ÞLæp(ÊŒÄ<Ë.%¡/½7ÿõÆc2p³d!c\œ}…Ö"!ø¬Ñ+p119
+Ÿ¶ÀÖͯå—Òît„]ƒ‘$o´ª­¶«]8[ÕÅGƒ<{ž§õÈ4	ÈjÖ¹ù-/U3™÷ô˜’c„*š][†°«làhW¸³¯†ÇsCÙ¥.•‡&ßV…/hÉsiÑŽêëw½&bF
+8 Ö¿ìiïH´túF°<@!x‘êñ)ð 3Òݶj4ô~t“I@÷ié÷±«p0'Ɖ߮ØÜ3†… ²bº˜~ëv½ÖeèSaŒÜÅñ·S¿ÍÓG&áÅ1€„‚Z…*‰£¹Rr9)¤×ÄÓz Üèy(£$³h6è\Ù´¶(]UF©)Ø.¯ë[à|÷úª3É”ž@J#«_IH^÷-ÝkÄØÓ“¤3ZÅ.QmR¸ô[XUH:ÓN÷¬Ûîà¡'IÂ4‘.“‚(F	pÃÄ<ŠRüøs§ûA—(<Å¥At!ªÓ8_3_òðwܶD‡¬áøÁn“áÑÚX;üîuQFª$¸©£—u”*Ÿd$B…}*‡1Žxä…)W9ñ}ðI¢a`q"ã¾`ÉÅ4TÁ—7°4¡Ÿó#æ(ü°iVâpeT­y?ô5Š˜!W[TSMIg%°»jëºÝSípªxJݽZ˜4n€ª‘êhnÎ$¤š'h9,	>h[5у–SÛÂ{¶b±„o&¸H}í+*†
!yUáK&ñ³šùe";ÕŒ©ÀF
+°†h|¥4 l¼¦	G¨å~XB¦eTãðø5‹_Kð‡Dd­Ýå5ÈÃú¸*´ûêfe·ürév?‘R"''Ô·ëüHàRcœ§LÐâX„&¡óK¤µE\Ù¼pfÿ"sâƒRð=!#¢L,ÖËž®,õ*ßÕ€ÎF¶†4ôîQ4ÁÍ'RÁ‡vO`0Ñʧe8l…BE'e„eÁ–iTB÷EW=Œàæ´å)ök"ZÄL„ÝšAÚìÖZÜMºÇ9=@ÝãTç÷"¿èÎõß"E(NI‚ÔJ¬x§/œµ±#Ö3„œßFÍ—ÇÀy$%"z¢g°züd3îsÝ­Ìõ¶mÞ€ÝK4üW¯l¢1€á
+«;1‡ÐrŽÇè	CÓ/çqÁݳʋª¶Ù¤3Gž¾¤jVí5mSNé‚xÒÎù¨3jrwضš¶íÁÔ Oøkì¡H„Ñ—¥>i¥¼Bç§-šqÒbÌ䪕#§{`IÏ?b;NŸçÓds]ÛýËø´¡·êÀÐm	tÚ鸣Û£ ‘õ¹¦³¯Z½“/På¥/)Œj[1üÔÓÕê„z×ÒL	臼tùÔ=¦íšßôr¹zii2ù%ôÚ£·O¦îìLQ£aÔöPý²^MÅ®ët3œ5äT1ySxS>&J|*$4ä2=3Çþ$ÐÏNþÿžüÕÂjvõlÆÂÓ0“8‹œMÐ	ùɦümß;ŠÃfôµ~Ô«m±…à!OYâ÷8i¯qtMŠ¾e$“¹ºÄ;y€ŽÆ.ùŸ¦^© €xÇ¡Mƒnà«æ¿"Ì6¾éïr¼q9½ò|´Ë!'&x~D#2Ñ/<c9Ž?GuâŒÇLdšÚ> ¦ÉÎí6Ucí£îL‹bÚ6ôb›ÅÅ©ñ?YàìÆÎs¬i¨ Ñ{‚üzûý­Æÿ˜ÖÚzŽÿxq†`êÓˆ»ë(ϬƒÅa¤²ô›ÈwÃ.STXCUÁîÑŠ/ƒ+¡P÷uö`äý`ç6Ñô5æ›f6ÖXÛ9I¥¨Dà}açÏf¸!•À9–Ù;´;Z4ZÛwŒ4á·È‡ÝئÒ&
Ü"y™1
;^±ÝõÔ>{Í ¢ãÿj`í&ÕÞù·‰%~‚¤&TæBÂrýµ³£çÄ̳Þ}Œ6²€`%fÿ·Ò‘h»'_ø¥ÿkJP«”¾öÔþÏÿó<þC8JC©”ð÷û”³µD¡Œd|JùøÏÑsÒÿÂmÓOendstream
 endobj
 894 0 obj <<
 /Type /Page
@@ -2677,7 +2663,7 @@ endobj
 897 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [173.6261 554.783 242.2981 564.1926]
+/Rect [173.6261 500.8708 242.2981 510.2804]
 /Subtype /Link
 /A << /S /GoTo /D (the_category_phrase) >>
 >> endobj
@@ -2685,27 +2671,21 @@ endobj
 /D [894 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 893 0 obj <<
-/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R >>
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 901 0 obj <<
-/Length 2361      
+/Length 2502      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZÝoÛ8Ï_aìK æñ[Òõ)ÛMzY\Ò^Ö÷°·»(d›Ž…Ê’×”“õ-ö¿’²%G¶Ók
-i8’¿ù¦Ìþ±ÒD§<Ä©$Š25˜,ÎèàÆÞ±À3l˜†m®ïGg»Ò|’Ts=ÍZ²B“„
FÓ_"M89	4zûþöêúÝ¿ï.Îc®ßßž¹¢ÑÕõ?/ýÓ»»‹››‹»ó!K‹ÞþãâÃèòÎé ãûëÛ<%õ½»¼º¼»¼}{yþÛèdzËÑö,íó2*ð ¿ŸýòLáØ?žQ"ÒD
á…–¦|°8“J%…h(ÅÙOgÿÚ
-lº©½ø1J¸¬ž({T)Ñ‚‹-€8`¡”F£¹ñGœdµ¹¯Vÿöa¾Ê¬ÁÓ‚LÑ’IC.I*™tÒ`úêœ%ie»—$ZdåÆ“ƒìÜØ×çC)Td+?°©Öžw’•žbM9õ¤z„Õ½õ¤ÀGYYû§ºòCÖîÇfGð÷鬰ǼžWëˆGbŒ¤Jqw$”—÷CªÃÒ¼Ù)’¦Uùªö4”†$e]Ïüh`‹wl:²K3ÉgOÏ‚àÜ!U˜9™gei
-ëßfժÿÕc,‚3ê*=lÓ³-ŒµÙ½	{ÎËîù¼Õó±ãIK傧IQxúØx
-è"p:”‚:ñ6Ѷ3&IR6똚Y¶.ê㊀Á{®öâ	lÕÖ&›¢[JíÐDª×¬ÐDÚM¤gžÖ¬èhO ’I³o"a$a°ÕŽÊgUQT^ë`ü¿r.·"‘^î	¹õ×ÖLÿîªâ®—°˜¤°·½³jJw»Å—?;´vcA™oºÄ©¯Ú_o8eJ’$NÝrè.\EΧ¸ŽÌÙbY‡…Œ
-S¿²~ÀfÏ€ÖcÉ«\yÛrÌf²^åu˜îUÖALÚù×_)åÛÕÆëzo‰¬°¿YLGŸŒY†eשeEû
-[ºß*klæÙCîÌG0ý|žò¨Z¿šzŽÿÁKÝÄ»­Îê/öúó¾é5°Ø|l øØøÓí•’2*÷,/Œgú®=Éß½ésR‹áË“òrVy¶a¯ø¿ÞôÁÔµºúîÕ/Ýs¾^ñû&{„%pßXëO­ºíD#§Õà¹ø\tœaì‡VD?-Ãð^Ž¡¡×:žÆ7ΉE‡ÈU®a±§ÛåŒ40ÀÖgYpþ˜PÖµ°Ž®þ˜™ÕÓS;Dಠp\ßeU»c“p<Œ\µ¢"•»ÜŽ/ÞúåE6.ÎY3´Kö:>Œ6óSc'«|YçU¸ªYG°ˆêÍÒìù4è«E†Ó·³6aõª¬³¼$}ÝTÛ#ìŒ!ole‘mšˆŒf:5Ó®ÍÖõº-cW?zja j²d¿Jd4%þHN‰–‰~Ny‹Ä4Þ«ÿ¿YÍFÈÁ‰Vêðü<
-²Âc3£+j¸=ÔP$’ĉ`ýU(ï‘`ï’q\ùp…õl¬dãi®8•"Þ¥L)ZµPÂ|S¢ñµöSô.I µjL
_°¶ê±(-ÎÕ¬cøþ¸«r¥F×òd:põI˜V•øv¿^ÓDâ<³}~lLÙþÓ'f#UL$KãAà/SšÔŽI‡Ågˆlf¶MIƒŽÚˆ5œJ*ý)Í*+žg	,uÑe2B¸'Xã²èÆ58RÏAÝÖ?ÛÚ³ø–«€"³Öi
)y‰L>ì3]óââB9Ýf‹Í^ú1ÍØzéÿ6–sD¹-Ô¾LûÊ•/ª\¡Q7ò„r‡†T†ôŸÕÙ¸¿ìj÷f›´…RM(‚¤‚ŒDWcª¦>Tr+_
-N•B@SŸ›áÄÛq%Õ‰Ú[ã>ƒ®Ëvd¦ž_ä³T…¯ØtaRšzâcú·u™8Cs65P×/ò²!ÏÃkèúÒ'ªK$iT¹ï@ÔSAÂã<Ç|´ºõý
-G2ëéØâ#Á
 ç«€¥cN÷›Ç¾KAN˜Ði`‚ž½è¯QÏ_‰R?ˆ¶o
-wT. Ò­‹Ì}™!ü	®Ñ!¾¹›W&ˆÐ·ˆC™º3&Ó¤¹¦<ä
-<&±ˆÕþ—¼5Å+v¨aFó܆/*±»2‡î"…nÏBH(^ð«R§% ¹Æ(™mªV$9}	ìæ§f劕׾ÅoüÀî».æ¶ÿ«^ã±Mk׸e©øÜ«Þîßö©/óÓ¯I™N¡¡£'")‹a±ö‘´4õcµútÒñoŸ¡Pðº&åH´lïåN>ö«…LO@¦ᜅh¹œ‚cœî66óIs“„sŽÁÕÚÇ·—T/a¿Çá’)áZ‹\ïu¿´ñy¼}†/ÃERèG bF¨)áRÇ}?õ ƒ“ŠxîKv¿º‘1IÒª7»¡?=€ú^
B?ùÙKó”ÀÕÚúÿ5‰¨Dendstream
+xÚÍZ_sÛ6÷§Ðô%ôL„#‚ /OnjçÜ9;9W÷Ðk;J‚,N(RH»ºN¿ûíbAŠ”)ɹ83?˜\,Àoÿƒâ#þøHF,J‚d¤’IŸËÑluæîaìÝw<ã†iÜåú~rö·«(%,‰‚h4YtdÅÌc>šÌñ"°sà{oßß^]¿û÷ÝŹ
+½ÉõûÛóq }ïêúŸ—ôôîîâææâî|Ìcɽ·ÿ¸ø0¹¼£¡ÈÉøþúö¢$ôï€Ð»Ë«Ë»ËÛ·—ç¿M~<»œ´géž—ûòûÙ/¿ù£9ûÇ3Ÿ‰$–£GxñO’`´:¥`2¢¡äg?ý«ØµSñã>`õÀP(‰@Xß3
‡J¤—â¿È›-Ó¢Ð9Ñ2CÿçúWß
+=}>¾ò²Šè3à-ÝóT“€Í9=ÝÎhÃ0ò&ËÚÉÚ–õþäÈKóJŸs˜kߪ¥ÛÓ´ÎòjœnmÍÓ<£•fU¾=çœ{¯Qɘs–HØóMëŠtFËÂ,K«rž-¶ôL+ÂÃ\/Ò:wsòòþ>+îéeêX×eVT-u–Vú¾ÜdÚÐ{ê¦vöÚ]|™>´µÁ¶AU][‡CÁ8ïX9*l×÷}ÀR÷wû°Ü¤F;i¢/-YòÐJƒé„è2Q^º{‰½UZl‰¼;è<Ò3%
س ¯)Fs"Y‘È"9vå=¦EEOUICF;îÇfGðÿé,·Ç¬Z– Î-ƒ$ÒØ-4;µ¦R¯*¢¡«˜‡¼Å”¯öŠùÿoV³¬!WGRÞÍóA–{lfôEÛCAy™ÀšI¼kzÕxOö."Å?R'jh;”_³åi(Ô.i†¢S
¹!ª~
½V4%Ú¥	¤–±áVWö%¡Á¹ï¾?îêÜ0Bç"²
¸úÌM+|»¯7Î8‘¸LÍPˆŸj]•ï]Ã	¥b!O¼Ä_¦64¨ã&‹ÏÙÌ8l	)“Dž°¡2äú½.ô&ÍŸg	<±ñe¶CÀgXårïƶ8R-A݆žMeËY|tËVV@žcµ†îhÂÊVøxÈ4ví‹żÍÛ½¤›±zíÚ4g9G”ÛAíË4±¯Üð%•`CrHø	åúp*áS
+™§U:n$ûÚ½iÓ¶²	¦àCVЃ‘h«LÙTˆ2l…»IX‹Ó¨So
+ÐÈ–F ÛôvÄ‹t垌ÞخѪ֕¦êeÿ–…Þ3‚Y:k;~ØÒa=w|)=7åù"ëY–Dx\ÍA,˜„pîªUW[žRóÅzmÁ,Ò|Ź.²†h~›T¯µ©ÌXwûý2öQ
^UH‰ŠO$É@q&#I—+M69	ëÛý´c»XÛ†¹{¦tcÚŽ©…Üéb¾ƒGîlý¥þ
+É'CæGñ‰äà%÷)l´)stùSÿpûÓùXBYJ&	³jDú5Þõ*ÏÔ³%C®1Äfƒܽb
ø?hËËòS½64¾¦ì0ª°Èm*ÐF«Øî拾›ÌòŒšñîÕbºN­æŸD:Û3T{Ï—
W/ëX"€'!N¨Ê¡(I(-aeQ§²£šÿOð«MZ˜iönºY£¹rj×ÙÃqÏêìý[Ž]pÊøDæ@û*UbwËú0Æ«âãèv¶ý²è¾l¾õchŒNÙ/ˆQqBùÖõöÏ*™©Û÷“ë«Ÿ{A¿*ge~ºÝž¾a»äIÄ‚PÈ© ‹Å"t9ÕÆÊ“Ð}è¥Æ¡pû9JwŸ/'¤1¥äçˆlf†SD,TÁ	4cÅb•Pþ¬‹vc¤ž_àóDºoØpaJšñ1u½[]¤Ó\;NטÍ5Ôô«¬hÈK÷`›¹¡òµ%âÄ+íW Ÿ¾¨ áq™a¶FZÕùz…#©!:¶÷H°‡Cý|óˆ9‹TäN÷éÇ¡+Aˆî"Jô«*ˆ½ZC]ˆú‚Å¿Ywsnsõj•ÚïrÂÅ>á»Kô@p{Ëa‹ázqè“KØN˜ÄÍ%å!OSBÉýï4xgŠìPÁL–™qßS”½0‡n"…vÏB„Pºà7/¤¸K@³MPRzmjV$Y}	ìäçzcK•×ÔÞM·4°ûꃋ8™þ¦×8lÓÖ
CÞåóD|îEïÏß¹Ô—yé×£AÈ$NÅÑ Æ"P-tõXn>ôû[ÇGª]Û¡‹•½|Ë©‡Шñèd<—‹]°\ÏÁ/N·[ˆ‰Ù¬¹DÂ9Çàêìã[†Ë÷YäG'.¸2t¿Zã¯uµà”ñ9IœŽ ¿–$©L|IÆ]]ìÿÇ,5Ÿûßݯ¢BÅDÿé	TZ!Ð*¡,DUDO~–ÔüBÈqu¶þ?Ø	endstream
 endobj
 900 0 obj <<
 /Type /Page
@@ -2718,19 +2698,19 @@ endobj
 /D [900 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 322 0 obj <<
-/D [900 0 R /XYZ 56.6929 769.5949 null]
+/D [900 0 R /XYZ 56.6929 729.6823 null]
 >> endobj
 898 0 obj <<
-/D [900 0 R /XYZ 56.6929 749.9737 null]
+/D [900 0 R /XYZ 56.6929 704.9004 null]
 >> endobj
 903 0 obj <<
-/D [900 0 R /XYZ 56.6929 433.0023 null]
+/D [900 0 R /XYZ 56.6929 387.929 null]
 >> endobj
 904 0 obj <<
-/D [900 0 R /XYZ 56.6929 421.0471 null]
+/D [900 0 R /XYZ 56.6929 375.9738 null]
 >> endobj
 899 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >>
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 907 0 obj <<
@@ -2836,15 +2816,16 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 923 0 obj <<
-/Length 1170      
+/Length 1163      
 /Filter /FlateDecode
 >>
 stream
-xÚ­X[wâ6~çWø1ô©ºX¾œ>eS’fO7ÛRú´ÝÃqlÔ‹•Y¶Ýÿ^ùl0IÆÒ̧oF3£±°ƒì;ƒˆ†®ã‡.d3'^ódçµhJ½›~¼õˆÂÐ#ž3™5°ˆ‚;“äÓÕÍ/׿MFã! ]yp˜‡®ÞÝ?ü\Ž„åãæãÃíýÝŸãë¡ï^Mî?>”ÃãÑíh}FNbÍ~?@†sží‚8‰³¸ŒBæRZ¤ƒ?¿o³…j›ÿ
 ˆßâ@æ7ˆ±CâSÇg!ô(¡…£4•Ï`µL"ÃÁLªçH%"{¡«ËG”$Šk=]D&žOS¡M9þý§Ü–À†Œ‘âÚz“™9×B¿ì1âæ2å/Â(ƒ$ZK‘€µVÉ,¥2û„ò‘óF•Þk0òyž™Ùx#•R)/–Óò¥‘‘[pKòmñKò_V\m€–+ó
-§(µþBmËgÊ—ÿ
-,‚($Ô-$ô]Ê
-ÄŠ©Ú†Æ„…ÂyJî™°‡¿.ñ1a‘vâ“cü\»´PF çû¬ÛâS/0š`ˆ}äU¤Ü.RîëŒ&—à7öô0"ûa´ˆ¾£¢LϸF,8Y©–­\µÆƱ’\™Ë´D’žY
-w(õYÊÄK§‚guÚžU<^)-Ö¼‡FÉIs%¢”ñ¢l=»FCCpÝ‹~•ßVeÅÏ2ÚzÈt›Þ‡Á$3¬À3ßÆkñXDÙ¦ßÅ7ngT- ‹=+ãÿ­ôéÍÂÒKkAÖÃ=µµuuª­K÷(+±çCê·¥T0æE µR´ÔÒF.aŸBê†áI^E
ÙQóŽ©ÙöÚ[º æµçój!†¤èöŽÄÔ€Ëܶƒiu›÷"·…>$¢‡ý÷³®#(„3÷MéY@Û“°[i›;]ÞÛp=•jšÉÖÀΤ³M?w3]ì“·u·‡méûí±:£»HCb~)9<£TKP²ÛëµöŽÚNà²(õ”ÍÂJé{çÉ#¾ÎHåÐâïuÀýmÝšÙR¿SÈÿMõ’Ç­:±´ÝűlÓ]¼lãõÕ(ט‰´>túˆkc[ðË8Å)2ûaOÃÕ:JÏújÎ#eydú«‚³(æ}TpmŠ±ç¨ˆuÿeŒ\J»å›W|Ähk;™µ÷Jin€TI}fW(ÅÈÞv”1Ü2¾ò û%²Í›1i¯ØÎâ(žŸß%OéÊ_â	Ø­‰0›Ö:­‘%e¶-¯äyB”îØK%×"iÕêh%m»¦MùºóÉ V Ò@/££SåœÙ|f#j^tà}½e÷å"5ÜXÍØv÷âµ.T:ªÙí_ø‰
!óB;Sr¢•™÷÷Ý¡v¨Ýêm>Ô×”¶]Ï íÇØ«/ƒv7e®íaƒ€lïy\Ú¸ç¡Èƒ	ýšTn"
™ooŽ©ÿOªWxendstream
+xÚ­XK“£6¾ûWp§JŠPå4;ñLf+;›8Îi³åb@+‹Ù³N²ÿ=âeÀÆÛS>`D÷×_·Zê–°ôƒˆrÓ°¹	ÂÌðV#d¼èo#\Ê€J4¥ÞÍF?Þ[Äà[Ä2f‹–‘ã`c溹ûåö·Ùd:„¡Ž³ÐͻǧŸ‹^<î>>Ý?>ü9½ÛæÍìñãS1<ÜO¦“§»É`‡a­OJ„#
+÷¿NŠÓÛn§ãϳ÷£ÉlçKÓ_ŒhæÈ×ѧÏÈðµÛïGRî0ãU¿ ˆ9'Æjd2
+™Ii5Œþý¾l|ÍU»âǨ™CìŽ2»@ŒMȉM
›qhQBóºA½‚uì»J€E”¼º‰/×1°ºù·x¸¾Ÿˆ4¯\å-çLU1þý§,šÀrÆHqctª¥HezØsàz_–Q .Â(’d
+°1ÁÚA%ªM'éwiIÿJŒœ…un²°®a‘}!ˆBó¤T*äeúèê tõuƒÞX-…›¨gáªá*¹àÂõÄ\¹¢t•^:ÜŒŠâHOùöŠ“Wªs­–¹¨_O’T(%~U³K”|¤5EwŒ×Iî?v¸ºÛS*”Û¡çzË>ñzñ‘.ã%_€žéKµíœ¨Ùº’!H¢h@Û–íäÙ‚ÞÛºO`ÇI´‘~§Ö‘VR·k© _u>Ùðঠ݃ªÒç¶XèŒZæ-ûÐhéy9K
7¬)Ýîžm«G©ë
+ˆêZHi×…
Ú®¾ªïÎLÝ :ÙÝü˜´qóC‘ÂíŠTæåûÌw÷H‡Ôÿ;µ\endstream
 endobj
 922 0 obj <<
 /Type /Page
@@ -2861,23 +2842,26 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 927 0 obj <<
-/Length 3146      
+/Length 2981      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]sÛ6òÝ¿Bo•§%C	LŸÒÆiÝ^“»Ô››¶“£EHâ„"]’ŠãÞõ¿ß.à—(¹³.ØÅb¿)¶ŠàŸ­d&šëUªãPFL®6‡«hµƒ¹o®˜Ã	ÕŽ^€!«›îš­‘/­·ôìüšÖ4Ac bÌ­Y9Ô
-Ü`vßÖå±s¸HÐóáó˜tt¼×©–´ÔÝ'#%Óë¤1œˆÁ³¦"PÖÒ“ÎR¾=RM35@
'Æã2Æì‘4sB¯9¸(¨g¦¶uCƒCÝv4²¢ṉúØ=ݪõ/22á.$Ù„èY,@áåas¬lÈ„¸³1k°{$É‚£þœ‘\>g7h} d´bŠ7Ù¬ª;`x/ð4&GktºÍh¬M'4i{¦cÊ^<ÿ½ ~&‰´;[¸pú æ ÚBÎD7>C¦ ìX¦¸Òs>¸ŽÖ[©„ð¸/ÐÇà-‚ÓqšG²À.k:ô@Z“Š ¸'?ЉÉöõ±ÌiË{·ý }z£YˆíhBgSœ@Ψâä²scwN=Rý`ž‚³Š±4”i|™ºGZ >qPp‹RJ1%ÿϽ5g©¨iÀÐN­à:ŸÀ$Š
Mò̺[?­ÙûxðßëÊ´_ÿ!Meщrèqa›õáx_zz˜X·GxAjvSMñ‘ØõÒ`0|®z%À‰{‡¹­•5¥X¯‹-áå0^¶Ž%̵ÛÛÈÉ={0€ÃNqF.]qpqê#ÀÜ<²Ñ©"C´<Ûn?3Ÿ¼õ¾ß.+.Äip©òÅa]P\Õ;ÌàJn®µ‘‚mQm/Ñî±N‰Ëd¬·LuÀê”Û	¡†tE¸”
-a(Ó™%w¦uÈ¡xsﶣÖ÷à”Q"ÈÆPxR¥ŠsŠÖŸÂÓ^ØöÉí=’ÄSÜn1}汄r²Ï‹§"»a‘Â50Îæ¶`]ì®É!’‚Pc•Dõ¶ZkPzž0Ì4í{k²&ëz(/€!ög8’PkéCLj¢b“oxVÆä&ÿYà6´Ðí±ÚàÅeeÑ=€½J!ñ:dz &žpú!'¢7Ã8i:cB‚'Œ¸¸lc¬ó&Ñc!uæT
-žxò8TQüñkúÄ—3¦}OÉ“«YùjÇPâ@¸4UnÕZ:”^añ~\ÚCëÚe
-¥jI€vŸ‘×r‹á€ug*ƒ:”Ó
-[Hœª“€ #täÄ»ïoþµ H<
W}
-b÷w	O@÷.T¦‘œÞû¦,ÈëÔå¡PÓ·6ñÑn匣4
cHæ.3$ VÒ›¥ù´p°3`E1ØWÑÑDÂ6=…§(—ÂdððB‡éÜ´Å U˜qîF”êj;ÁðæÂI*9æ‘Vè=e"ù’30­/} Æ*“h`}gËQ9LM.&(¢ÚêÐê–Œ†¦~á<^È"±”:õ^ÃߊíTY¸75¼šnAàŒËPr-|Šd,áÏ/Ó!W±¿Ì™ùÍH$2LeïjqÃÐ¥Pú°$N§¢|‹ÕúcÑâ­yÿμ …K„D?M	¨°Dy¢±“¥ `ŽÏsgb ˤ5
Ix{óɵ›Š+ÄOªP1Bé©ØçÄÅ9šÛ•ñ_c<‘cöˆqÇ¥lpΧ†J¥:èMÖÚ4‘;¡žš(”$ôýˆ+õfxÈ“Äë]ŸùR&ª4†À@døÌ5ɼŸÄ181xá¡Jº1ÆXç#F5ˆz·œD=C»ÇZ .N“¨uWY¥ëW”Ûä3øÖ”å
-&E¾Q\§
@÷ÒùÕ}
§)º ̇‚Ž
ƒ“SkiD
(Ä!§Ñzj6³æzø#
v11Ó3œ+—Û”£.$:ÖÆê¯E&ܘ¤ûµ+ó¹:@­âûÄ4²2™²Îrñ[øšÇ.°Yúò¡NT0ê‹i
-B¢>Í*£¾B•öªÝ›@_±Xå_ªX°öºuËΛ¬c£¬ë/ZÞ¾ßû²Ýq(ÿ">cw#¬vç±l„²ßS†þפ+ÂdÁbWÐ!-Ÿúãª
M¨»Æ4^‘{Ú¸o…ÙKE¶%=º™Wµ“YÝõýÔ³²c(¦êŸ5Æ:/»Ë:äãááŒè0üH?C¼ÇZ >^ÆX`LÈS–+’I¡å²‘ø`ì[ðT“aŸÕ×g^ÒÎÖåY—݃Â;pMÏGJGaTTm×\«õqCÉï)¯	¿h9) d*ijÏ\U¾q–	\å÷g¢Lø(QFsÝΔbÚ7œXâ¤=_´™€u+ôtTÿÍoYDˆÏàºSBñ‘þ™o¯<„^-y
úƒñ–§ŸUƒmb­Ê^!ÃEÅ,T±`ãæ梩İêùeSa]0e³sÀ/2Øô¦=g3"	&T¹è±ؘØYHf'|Í(5¶¥Éf”/6”lfì
€MÑÙbàp8êéüh?"z`·OíˆUôn>3<é‹	Õ¬˜×2'í°!žŒ(,gB6;ãÃ_=[ïOI.–žÄ•ïÊ¥àn$5Ho]çØuSà :”¾©ìºÌ%DëÆ7¶­KÇn6q¥ÇVà®^²:ÅC¥â±Ñ…Nw–²|ÉœJµ¶mòÊʶ&XQu”GäÇÍb-’±ç¸|ZÏÄÇrvKÃ],š”
-¾ªp×°©=å<=[ƒØwÖL¡tçésßGHçÔ#Ùš¹ÈÏX¦ÂïòJ\¤ëqNéNzŽàðLèÞ-7)Ž¥C?qˆc£&ãÄÒÁ&±gÙ¹6¦ëÆmLë·¯|W˵”Ó)˜ f…Hçß›’h 7|œ£&ë©ÇàÁÁʽN¾ð¥µýr4kÖ}ÌšͱzAzò¾ÅXÇ#—zK1¾4ûNyTì«é~€˜C[Òátû¬£¹Ç¬r#RNü)ý,"^·Å®«™N;UÅožàóª
-3µ3?K‚8Š¿%ZЙ¨ÿAÇÿý“¥á÷\ضUŠ/«OU+ØÄ1…£S3s¿m:eý§êWendstream
+xÚ¥]“Û¶ñý~…Þ¢›„$0yrâsrIc·Îe:$ãR"$qL‘
+Iù|ióß»‹(’¢tÎÔ~¸X`û½ÐñEÿùB&,ÑB/R3r¹XïoÂÅÖ¾½á'ðHÁë뇛/_%b¡™ND²xØÎR,TŠ/ò_–	ìN—ß¼yýêþÛŸß¾¸MãåÃý›×·áòÕýßîhöíÛ?þøâímÀ•äËo¾{ñ÷‡»·´”¸3¾¾ý’ š†‡¾½{u÷öîõ7w·¿=|s÷Ðßex_Fx‘ßo~ù-\äpíïoBi%ð2®µXìob1G‘‡”7?Ýü£?p°j·ÎʇLD «sÊt @•0©BµH¥fI$"+ÀCÝt·A†Ëâð?¾Â;ÁÁçLK),V–çEWÔUV›¦ÞÙ±ÛÑ®'Ó¾«›wUMŸŸ´{­wæS¶“Ž›¬ÊaWn>k·íu»wU¶7W¨î³D)h‹?"ÎÞµ³¾º¯[ï‚}v8˜<ÖÓ¶¦°;Ëè¡1Ó4°m[Å_CÒì
ÿu_ðoxýæõ]¿…Ïrfòª
Žùap¡ê¸_™f»©ë„Všm†Âêª|ã°Ë|\—ÇÜñwH³,Zg:ÌÙ{þ~4ÍSYo?Ýò¢ÍV¥	²r[7E·Û;y‚^³¢ñÑ£|åX8üI$¡™R©S¢Å/_Åbу7ÈN¬X’¤§¨Á8.„ãꊧ%Ïþ©Ë:³7UGŸ/ͯa(*k½[¤ÉÏm¶5ŽV4ð2 %$Kâ8±¤v¦gè„ÄÓZ'€Œ8žƒóÃ"ˆ'Q$^;`.Š–­éZš4nËz••4?]>ºÇx¹2nCkrš­žhÄÐÇhú°+ܶ	Á}æÑ7²ÆѱfE³µ!ÍH‰ló±fPÏQ’,3Ò庮P¶Ûc“‘tq
!¥>©—÷v;ÓÜrµ4´™C0ÜŒ`Å”Öüyɦ0…`8‘ìp¶– e¢Õ	®Êzýž¦Æ?Ä0aF¸4ÕÐ2
+E×:£
¦¤ÖcÊÍ&;–Î苲¤™UŒ¨.v–k8K9O±ÖL­¹‚!–M
ñ\ní±Èi³îêæiJY§`ßJ]§ì‘f(õÀC¶Š1iôš rùX7ï‹jKÀµƒuwË—È—…Ö;¿§5Í°ÈؘÖÁê_Tµ‚0˜­ÚºT±ˆÉF‡g[)ÉJ>9£0›:i0ŠÉá¢0{o*e-t—Îýà‘jZé¬âìtc¼.çÜ^Is' Ä𖃀z6aiS74Ù×mG3+ž[¨Ýáè–èR­ÿ¡a[FŽ3ª"&¹…—³æXÍøÔ.P¬	çc˜ÖàôP’‡ý=C9Ï4hc d´cŒ7:¬ª;`z/ð6&GotÒf8´¦3št<	Ó1eÕã¿g¤aœIBíîÆfnÄL[BI7²Ï)H;–)¡ô”¡ÃåÆBê=!<î
+Œ1¸@›`âlœÖÑ¢,°Ëš#Öd"î	€âO4br€]},s:rå¶b´£wš™ÜŽ.t98D±ŽŸ	N¬+ÁÉc!Õ÷æ)¸ 8O™LãëÔ=ÒõQ€-J)£1ùî¬;s(EMŽ¶wfê|—(Ö´x<ä™
50·q
+Z³>öùàÔ•i¿ øC–ÊÃ3ãÐã 
Â1=êá¸*==¬NlXŠCTšhª)>;` @šœ_¨Þpaå07õ±²®ëe±!¼&ÀËƱ„¢v;›9…g&pÙ1Î ¤«.N}˜ºÇL5:6dÈ–ûcÛógæ‹·>öã×UÃ…LÄÂTÈë†;ĺl¸=V0ƒ(¹©Õ†
+Ž‹¼J»Ç:'.“¡Ýò¨CQ§Ú.ŠÔ©\‰\I…0”éÌ\8ƒô, ¿tï¾£6öàTQ"ÈæP©™Æ5EOa´
+Û<9 Õ3 ùL<ÆífËgKèxûºx,ÒiŽRP|ê6Än›lϤk$ªPK
F/Ž•¦ýnÍ!k²n¶ SñOáHB“®¥OFˆŠ-¾a¬ŒÉMþ² lýh¡›cµ¦^ºèž†À_•¨ƒÎñ숅'Ü~Z““ÀцEÓ%—àò¹|Î%XW\Âc!
æÔ
+žEò˜©0~†x5C}˹f)Tßcòj@V¾Å9´8.M•[³–Î"¥7XÔ+ajC»L¡U-	Ðî2ŠZn3\СnMeІrÚa‰ssŠ éD:ô
âÃwÿš1$‘2.T_‚Øó]bÂÞ#•²4”c½¯Ë‚â±N]
+=}kívN8JSC1w¡Ša%½[škH[^ƒn»H$lËS@¹ §$pXÎM[œ¤
++.\ÀŒJ]íµLo.¤R`i¥ÑS&RLnì±­o}"Æ.“h`gÛQyZ)(£ÚîÐÚ¶Œ†–~"ž©"±”:õQÃkžTYx6=x5ÝŒÀ¹L
+ùÉXŸ_§1¡b¯Ì‰ûMH$’¥²µx s%ÔC<‰Ó±e½Áný±hQë‘}|ç^‘+„¢~)Pßc‹òDs'ˈ’9Ž—îÄA–I/
+z4$áíÌG÷ÜTl]#~Ö…rÈJåÄ>'..Ñø¢ÿ9Æ#9`€˜w\É“nZ7Ð묵e¢pB=wQhI éû;#Vê3Ì&’ÄÛ]_ùJ&ê4N‰!€Ìð™{$óqçHàbÆQÌ’:À«cˆu9côX'QïÐã拨gh÷X3Ä£ó"jBÝuVéò%UÁ¶ø¾3e¹§†IQ,@÷Ò •ƒt~wßÃiÊ.óé CÇÔZšÑâPÐh=5[Y=Hü‘`¡¿ÙÕ΋Ëmc*ÐOg
+@cõ×2LRƒsO½+÷µ:@­á߉ife+eåâð=Ý`_dèÛ„:QÁ¬o¦)DíiÒõ=š´7íÞúŽÅÿ\Ç‚½×½ÛvÙeíT]ÑóvýÙWýŽ«ªQþŒß
±.û]e3”ý=åôþ5z„a´aöUÐ!ÍÇãº
¨»‡iT‘mÞ·Bƒê¥W‘}’hæeídVwý{êeÙÅÈÔ’×e7Àº";eòq¸ :L?’ÇÏï±f¨…—°Œyªr£dÔh¹ª&J|2öOðÔ“á;«ïϼ5"^¥ì˳.[Á;pMã#•£0+ª¶knÕò¸¦âw€”׎„ß4_2Ügò3W•¯gWùêB¶“‰Êè®›‰QŒß
Gž8zž/Ú™JÀ†®Óaÿ7Õr">uGŠ…!=8=÷ó°`Ðëù‡ƒþÄ`xäù/¿ØîèXëeolV`1g*ŽøðqsÖUB|ã‡XzÝUXW\ÅcÙªÇìñ™|zÝ^ò™(aTW¹è±fØù\9Š ˜ñA>£ÔÐg”&ŸQ¾ÙPúä3C`ï0|lŠÎ6‹‡ËÑ›ÀöGDBï/ìΩ±Š¾ÍÇ¢ÃfF$}3#¡›ä¤b<{;å“…ùß™ÍÎøôWOöû[Rˆ¥‘¸ò¯rŠÅœSS}ï^ŽÝk
+\D3é•Ý+s	ÙºñÛ6¤ãk6q¥‡^ஞó:%˜RñÐ阳¹*_A1§’“YÛgòÊʶ&XQuTGäÇõìZ(cÏpø²^°DÄròhyÒŬûA«à»
+§†uí9(§å	h
r»ôÇ(šð/HfÜ#ì#ÿ¿ÿPåôW<ø¦.Ô"Qpˆc
+o‡çÆýEË9ëÿ½¤oendstream
 endobj
 926 0 obj <<
 /Type /Page
@@ -2890,30 +2874,43 @@ endobj
 /D [926 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 346 0 obj <<
-/D [926 0 R /XYZ 56.6929 636.7498 null]
+/D [926 0 R /XYZ 56.6929 599.8623 null]
 >> endobj
 929 0 obj <<
-/D [926 0 R /XYZ 56.6929 606.5729 null]
+/D [926 0 R /XYZ 56.6929 569.0452 null]
 >> endobj
 925 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 932 0 obj <<
-/Length 3344      
+/Length 3511      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥ZÝsÛ6÷_¡éËÉ3Bð§OiìôÒKœœíÜÍMÛZ„,N)Rá‡]ßÍýï·‹]P$EɹdÆ°Xüö“’þË…Ž„$á"NBy2Z¬wÞâÆ~ºL³rD«!Õ÷oÞ+‘ˆDùjq¿¬¥…§µ\Üg¿,ßýõí—ûëÛË•yK%.W‘ò–?~¸¹¢ž„ï>ß¼ÿðÓ×Û·—q¸¼ÿðù†ºo¯ß_ß^ß¼»¾\II˜ïó
-'&¼ÿðñšZ?ݾýôéííåo÷?_\ß÷gžWzäÛÅ/¿y‹Žýó…'‚DG‹gxñ„L±»£@Da¸žââîâïý‚ƒQ;uN~Q E¤ýxF€a0 ô ªE%B~`X¦;GÒñ²1õ“©ñÀ „Ð÷–w{³Î7/yùˆÇ„ÅüÉb*N°€Ëìólõ«çù/VV¥áYC”ʋܤ,oÒ‡Â44¥ÝòÜ®±
µ¬6Ô‘Òãˇ+j7úÕ÷c·%ÍŽ>çEA­×SçmkJ^¸ÌÉÅJÆRø:ò¡%EAùKË—ËUà…KóGÞ´(û†GƒFÀ«c׃¡g})õÒìª'“¡c¹¼©Zk·i;#HßóDã
Ó}ÌÎDìKG”7´dJßÍËse·Î¾‡‰²hËïÚh{r;R'¦7´3;XÁø¾!‚f$»<ª)×EÕ˜ŒÞò’žYÕ=Ø€ö·Ј#Eñ„Ç^(t0š5L´R®g
ƒ£Bk³îêîÌÁr€#D°ÀYzªFª~î- £h¹OÛ-ë¼YTó½”KGÑcû]'+¤mgÝnßLÆ¿u°‚©sÓ¤-µRw•ør ×²-^¨‹ÞY@Ôõ¼¥°WÂQ´_x^6m}©—ݺu—ÝVî²éÙðó9o·³ö"2T	#¸.³5Ñ÷5g."Å Vš#ºÞòÆ&ö lÐN¡
Âßò¶eôef“vӦ߼â!_A$”L´S?¸¦LœãIƒÝSAÜótØJùÂó}yØCªÓÀî©pǦM[´Fëæ$²Úƒ‹;ËBO5ÃÃÙ¡‰Vј	m´h[˸Á'C;®ÉþqÃá)ÓýÞ”›³ÃÑxFEO‹MK>Áá(ãgSi×Ì;®U/ô¢1À	"&š™{ÁµªÄˆDœBÖçŽ$>†z$*8D´ô䉧¸Q‰Àk8PÒ&¼[Ћœù_˜æ(g3ÐVõË¥”Ò/—Œ¿ò€Ò‰ŠîÅ.e•ª6…;2«o¬„ͺÎ^b‚X?‚å=™,D2ÀˆF(Ò`ý¸ Æí»=ýj8á»Çë"ÿwpâ¼*]Èè	r§¤:
òžÊÚr€Aµ[eæ)_{G¸-)u~ûžjfÿqܹh&c,Úe‚1Qg!·æw4—øLPÜ¿PÊŸLØÙ˜Úö8Š~ÍašæCÇõt1>÷u¾Kë¼àîҘ̭j‡
¸ »ëwøi
-u2†Gµ7uŠ`nlæà/›n½Eåx4ô¼ÿÛõ¿¨êT6©5¯ú$q	NàZ¾¦—nŸ¥”y3À¹òÇÒ0ñ¿!	jP£„•ÊRîyaKŽ®v5hë‘J:‡(ÑýZ0@“¡È³FDºz$½oH”;z{Þæö°0ɆÒexiFoËd
-ù7vûœqÏÔ±€Û¢Do âáߺ¼&6Ùgtd9Ôá.6͹EA“)(ifú:ßqvdw&Lj=E.™é=ìÖ¦¿ÛšÆº£
„(ôžuKÖÇe	DZ©iŽ–·¹3¼ëªÄ[zìYÔYT)Ç`.~;øߺíölÍóse6ç@O¹TÀnù¦{h@ö6À´™%ÂMOçÿ¡’B{ú•üHuÚ	ôT6Ò©ÍÆÔµÉVˆÄ#/àad¨ÏïßSÍ00ö‘Ð:c¬îhª2‰SH,‹¼¡|ÈÚ—½¡"ü-ØÀºÞÂ?³úª–ÏU­`ivXÕÊ\ç¡–cá`†I+¡ÓÖj´à%Í2¶§`vEÚ?†ÂÈ¡«†Ð.H]ÁÇÔ/C4{°l†“÷ûS™ù8qñ+ëÆaÔVä,IËf‘wóùæÅsfRC+_ÉƇTg`樬ÎWU_˜G«g«
-C¼)Øb-¢8Öç¹è©fØMC*%rÌÇý%F
5æš42Ð`ÎÁ¶—†µÙQêýÖçj¼„1ã¶3çEî?^5DŽ"n«=uæÉ<½Â˜¶aï©ÙVàrVUKxŠ¡d0Á“õñÓ 2u˜ÚáfþX]Æ÷:#z'"1‰€*­TŠrÆ‹Î`W>”Ä8;À™²âå+#¶¿ú~xu¹Â„Í—àÿcÒùõÿNL'v}úzwýõ¶z¤N|"œ'ð„Žýpà!€}áÎ(%‰A1ýImn‚vR/7ZÁ>¾ËÌw?p³xê›]Ó7w|v;÷úß\…|´5‰œçSôï¯Øõ!Õi…ë©ßViñXÕ€›]s¬n D/>Ï‚#šaa¤lq$b0íc®ˆÌÌ8Äô±ær°ó4±µ°kǬƧ…<€£|~mE¬	!"#¹üÆÓÙkî'ôƒ1,öÅ\È‚µŽ0‘ã0aNžZ@öèJMX²–dN¯ÒAÁ#(Íç^™úÜpW5Ó¢íÚÙ—†öÙç~_ä¸Ø)ˆA©â×lúêÄ••JÙ€ƒ[Uõ{ÚäÙqð X\ç9è©fXA¢[/ˆÕ˜‡R¼ª°”qêñE†
-òÍ ¿È–§×è	…_Mù{Yè' mhFÆÐ=‡ô̆ðÊÆYi2Îø,ZS—TPÉrgÚm•ñ"U¿cS‚ˆý#›•»ü/F-áüQ¹’Ëâ‚OÊ5"®Aú"OqêÓG®Øz[ÃñX|ƒ±á.ùda*()§‚ƒYäà¨=TÆ™¬ót?tÊàZÌÞ4s_ü”ž”êÏ_Džì?ج%rYË`dzuÒªÔæåt#àÔ
-³i©‹×°Ÿ©Ñ•ThÇ•wìó†Âóu4vŽ~•–ë-É4î?‘*þDsÅßÝäèjmo‚üM!v¾µ¼"·K}cÀœÚekx´Û·V ^L”3˜rFÅ:-çî™…ifç@¨¹Ý=f_áZõë6'`Ûˆ¤Éwy‘Ö6TÃ嫉j<§<âæß–SV
-ÝfNÙlÇ€ý¹Ä-Ø¢ii|Á䃠³ßüœ4á2Šñ›RrÞ„©N›ðžj T;„ãƒY5ø=ïØŽkˆiB?>ÏFO5ÃÇÈŽ'¾Hü	ü
-ˆ/·&¯É]®·ôÑ:¹Ä„Mä–ZV„>Y&;’ò¸(ìÉœöH¨’†ïd% áð•õÑ'H8Ž'–K‘©Êâwí*/f.J ø0Ø(‚‰uƈ¾fQ“ô[©b+]¯Í¾åvÙ<›º¡—|COXÉ’ªCÀ݇ãJ­gÙ÷£@$ýï+æ˜gœbž
+¶aÅöÀ°r]Æ¡§‚±]¤8õ:	)B¢²^ð·è†,jp‘–ÐI鬞'ü3´â²VJþº’LF$ì´	^Hæ–éÊÌ0錟šÚ„Ú*ó
-Mݱ#üåQ/B*ÐMcO)´ê`.d‰¼ØÕY=†âºÍŸŒ˜ûÈ‹?è‰uZ@ ÄA•ûØ·çAjócUÆeœŸ9Û:ñƒ® ø+¬áõèù¿ìuø%„‚Öþ‰‰žÚObÇ-”SÎû_…³þ?ˆSäÓendstream
+xÚ¥ZQsœ8~÷¯˜Ú—Wí!@ˆÚ§lììe/qr¶sWW»û€Ù¦–	0öú®î¿_·º¥†oÕ%UFˆFjµ¾îþZL¸ð?\è$Q/Ò,&‹õæL,àÙOg!ˬœÐj(õãíÙ›÷J.² SR-nïcé@h.n‹_–ïþúöËíåõùJ&b©‚óU¢ÄòÇWÔ“ÑåÝç«÷~úzýö<—·>_Q÷õåûËëË«w—ç«P'!¼/y„#/¼ÿðñ’Z?]¿ýôéíõùo·?Ÿ]Þúµ׊òíì—ßÄ¢€eÿ|&‚(ÓÉânDf™\lÎâ$
+’8Š\Ouvsöw?àà©}uÎ~q¢ƒDÆj±Jâ@Å™š·²DV[¥QÀj3oåxÖÊN
+­¼-‹Õ¯BÈÊL†:Qœ.†£Ìí¥f&“‡2
+d¨Æ“ß>šóU¥ËmÞ?ÖùÆÞéesO½½{Ì
+Ú‡¾³3í“i©ýÜ–½éH ì;´=a°µé¸ãÃKÔˆ…T.?ðDuÓó˜[³.q6S|=?]aîó]Åre‡Özó>IKŒED:CÓàâÞ l¡”J2kª Ki>åí›vW¿ÁEl76™êŒÇ#)Èf2‰†;gïA'¸ÆË]g
+ê¹{aI2ÄC›oX¦Ì{zöœ×Üêºv¦.Hª+ê¼êÆ{š?^¶çz¹«ë²~ …zuG¥]•Úïx¬$†•Ü ±ï_x€	XC0¦Jðb
+S;XÝÔfÆd
+T‰{©(»ü®B\à+¤84À@ØPgØ‘ÓåâÉ~•2uSÒ[çÏeUQëÎõ{SóÀuÁ¶IÃ@j0	Û†"\^ÃE"^š?Ê®G;Ø;\4"»î]íFšMó #¦áòªéù™ÝÓCCJ!‚4Å0Cû1o8™©B	‡Ìéò»yynìÔÖ+Bç0N"b›à^[mWnŸ€ÕIé{•%Z¬¤TAœa€¦é)›z]5Œg~K×¢ÙÝêÅòÛÐÑšC¢R"YòJÜJ›^
+UlÍz×v°gÇ¢gœQœÔÀKͨ0
+	$‰h¢G‚d=ñ΢®ýy¸tû8‘8N|Åv±Ûl»Éóo;Á´¥ñ(h$ËÜm%Þ€è¶î«ê¢{6u=?‚SP@„¥h=Þð²îzOÖ½ÛlŠ7¸Ùtíøú\ö³ñ"
ÂX¹`ÙÖÅšäýFÍ…‹$HR0ë>À†Â&|уpœ¬nŒ>Ÿ,<ç’B%3íÜÏÆûS:iˆ{*J½NÇ€*uqö
+°R'€í¤pÆ®Ï{ŒFëî(²e lÜI¼ÔŒ#dÇ*È´JÆJ1€81 1_†(vxb`ã7<1É|»…tÆál¿4~£¡«Å¦Ÿàp(TðµkHt×Í'®U”"Éà„ÇH‘Ý̾Ç@Õ‰
+H«¥'ð
+E[|wLO2É‹†G{z¢¢#HKCŽ#ñ˜6
+¨d
—jš„g‹¼‰!™ÿ¥£gƒ0À•ú¦}9ÃÐ-7—‚?D3à„A¢ØäìRÍýÄáöL0áA'ìÖmy7ÈÄʆÀ9“¸X[®MÛ‡5®Øõò«á‡Ø=õ¿—Míê°ÃtªS|8Q2étàE^êMG;< {ëW‚ÇPêxððR–¦5m/DŒ_«Ó³z©™iǤX:ʲñ¼/ôòëÅ—7·ï¾ÐÕZÀWv›;
+	®€€Æ>Nh䄉"O±]Œ^S>13ó¬F[Žì{/®nèUæÙ}³n*ž«Íï±a»FƦcÿ¼Q…cF8È')ã[/¡NĪC›ԕ.›­ƒ˜^º¾M^Ö”€±ÂZGð’°±Ïø š±”ó¸S¡¥ÀKÞ©{JöÄg¥u¶XAíô´ëcwfŠ¦|:äÃáìça†lhgÁ¶æ{”x…èK ܾPZ¯w,HÕ¡íq~Ìa&¡ãr:B
¯Û¶ÜämYqwmLáFµXÃlÍÍå;¦|¸Ù´2l¶¦ÍÆ­ä²Û­Ñm]oÿvù/j#Õ]n+Â=Ëœ/BøTV®éf·-r*ˆ³aËXÃÂÿ†ò§CGL2v'+¹å­8&ÙÕÊä6ó¢TèRaˆ‰×"ÚX%†ÐQè	éþžL¹¡»çÇÒ.6¤Â»(ÞäÝ
7’sg"˜ØéKVÄ]s§N‹ÄÀÄÃ)¾íÊ–‚×džãÞ›ÂÆæ%·ˆ.I(>É'ÓAZ†ö#î>½ÃòÁ‰š?ó]×Ûº5Ji!(MA!=`Ù©+D@vAî)¯v<Ó,͉â*J¸SØŸ7ä´s4GqìXï!6L‚,Ž',MóƒÍh_eœ9k@‹Â¿ÜÐO=£Ø°U·mÙÈù\ví 2—
¦E»Ä,'fAg²ŒTIâÊŸ`¶>ÿÝVoÐ46Ý9¡ûbG °bž‘ex„¥Ô÷e]ö¥¹ë¦Æ]zز¨³jrf_Ž¹í3‰@ÊÛö»-ÇñrãÂ]Œ‰ø)ð7|·»ëÀö¦æÁI'=^ùÇ!
+¾Rù¥Ž'/e9NkîMÛšbõ€H=¿—šQ`œ’@ë(k`}GË©ËdÎ!u´¬ÊŽ*ië_¶†Zˆð·$`)t½…fùó,ÉçYÑÒlð<«pûS;Óxô@^	ö”F˽.yQp<…°dàýc¯B9tuCòìØîŽzLû2@·…Èf¸l¿=V“¹‡cì¬÷£ö,Î
+µl­‘ˆ«ÏW—hž£0‹À÷ÂP¼B¥‡RÇa楬Ï7M_™ëg«ÉÝl©’4Õ§µðR3jŒÀ¦¡ˆÀ“ê‘·çÈZ¬5yd¤!œCl¯k³¡¢úmÎÕ¸	cÅmgɃÜ~¼èHMÜ7[ê®Ì“©øõÙlÇÙSs¬À7(Y5=á)F<Ù?¥¹ÃÔv7óǺÚ¼ßè3O‚YjÛ錕¡\ð¢5Ø‘÷‡aœí
àBYõ²‡•	¶¿J_\â_>[ÂæÇs(íÿ1éüzƒ'¡»>}½¹üú	[©“œë‰Â øàÐÓtç?TŒ¤à˜rr*7Aû’·`/ß滸Y=ùæ®óÍ
ÏÝÆÝþ÷w6>ššR=œs8eà-ú•¸>”:îp^jðµ`•WM¸Ùt‡î& §§UpB3*Œœ-M`:ëpA:`MÆSâiË>ÎÓæÖöá@]ûÌ&`¼Zˆ€À$Êç×FÄÓ Dd.?AðtñZAú‰e4†Å¶š£,xÊû_óÆœuêêFwÈ„GQ6’ÌùU^Á"ˆ<‚Ó|öÎä«ÂMÓMk×.¸Ô×ÛmUâ`G fPqÅé+1}(ub^ÊZ¥î Á­ª¦ù=ïÊâ<¨WÑi
¼ÔŒ
+#ˆ»QªÆ:ü“øªÂCੇ« N"¿‘3*O·Q
+?Úó—:ŠÐO ÛÑ<Œ:Ô½„òÌR¸åà¬4g¼V½ik*þU¶Ü˜þ±)xÆÁØÁÄò f•®þKÑK¸~Tî0‡¿bñQOΧC|"
›Š„âÒ1¥Ï[©Í(öôF°ùφ³”“é(I9¼E	ŽÚCgœ)ÁìWÜØ9oAj1[ÓÍ}ëS*a¨þüÖ3Ré>šØª%qUË`Æd+ê¤Q©ÍÊåFÄ¥<¨Ì}O]<†ýˆH]MGìHPyF_„q©“q2pò«¼^?’MSÿqTñÇÑ”ÏúÝNŽ¶VÑôö(¿&¤î÷D-/(íRß0ǦDÛ~ºÛ§Và^,T2˜JFÅ:¯çö™ifç€Xót{̾¢µòãvG`›ZFÒ•›²Ê[KÕpøfâÏ9?qïß·SÑ¢n3«ôÛ)`­s
±hz¨¹`ò)ÐÅï=~Ž‡p×B'1aµ¥–5¡¤ÈdŸä<ׄ]™ËÀÒ„NÒðž¢4¾
+Ï>Á q:¡t€\b¦zhcüɈ;¹x1s,øa:ˆQÿÏúŽEMòOlSÅV¾^›mÏíº{6mG7å=]a$+ªö„»÷˨´žU_&Qù_VÌ)ÏÐ?¦<Vl»ÀŠíA`åsÄBMˆñôë,&†DÇzYÄ_1 ª¨ÁFZAg”³~žñLð¡5—%Ziòw•lBQÐ'0h¼PÌ
³«Ã
+ä3yjZëÌ+u‡&Lð—ƒÞ„t@7åža •?ûs”%©;#d÷2Äu_>™àØo£$ÀîÍ8µð;þÿ>pÿãÉ8Å_LÈ#Ÿþ„
+´ÌR§.(§š'‘-ÓÕÿÔ*q›endstream
 endobj
 931 0 obj <<
 /Type /Page
@@ -2926,42 +2923,34 @@ endobj
 934 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [250.9056 636.9561 324.559 646.3657]
+/Rect [250.9056 591.5389 324.559 600.9485]
 /Subtype /Link
 /A << /S /GoTo /D (statsfile) >>
 >> endobj
 933 0 obj <<
 /D [931 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-350 0 obj <<
-/D [931 0 R /XYZ 85.0394 101.0136 null]
->> endobj
-740 0 obj <<
-/D [931 0 R /XYZ 85.0394 74.7058 null]
->> endobj
 930 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F58 631 0 R >>
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F58 631 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 938 0 obj <<
-/Length 3525      
+/Length 3451      
 /Filter /FlateDecode
 >>
 stream
-xÚÍ]sã¶ñÝ¿Âo•gN¾‚Ó§Kâ»:Óó%Ž3m&É-Q{©ˆ”÷×w»à‡DINšNoôÀ°‹ýÂ.䥀Ÿ¼ŒmdS•^&©‰b!ãËÙúB\>BßûÉ8Ó€4íc}yñÅ;«.Ó(µÊ^Þ/zs¹H8'/ïç?Ml¤¢+˜AL¾úxûîæýwo¯3¹¿ùx{5U±˜¼»ùû5AïïÞ~øðöîj*],'_ýíí·÷×wÔeyŽ/on¿¦–”>G&½»~w}w}ûÕõÕ/÷ß\\ß·{éïW
-ùõâ§_Äå¶ýÍ…ˆtêâËgø#"™¦êr}abÅFëвºøþâ»vÂ^¯:Æ?»(VÆ^Nµ‰¬?Îe%RR§‘ÕJ·\6£\XÈål×,§åoójåþž¥²‘QR^ö'>X¾ÅY_÷Ö—ZFF(3$àf«~ñ.v=Ô4J´IazÄxÉkBΖD©VŽqÞ\Mµ’“f™—	‡ê³ÀÄ‘2‰äAoߎÍ·2 <
ΗLŠš¾Ùê9{a¸ÎZ¬*©áöŸ_üðöæ–þm¯¤›äõ¦*ë¼fó§œq‹}‘P?IoŸòm»P¬52R‰K’QÇÊUV°®ré$›5»lµzáp”Õ–“¬)žr|£’É=.€ýó|‘íV~¨ãöØ.Š[Þ|Yñ‡	!”¿n#p‘ðÍè3[fåcNK.*	Öê(MEzZúXÇe¡ÅòÂPd«ÝfYg£8ÉéeÒȲ}HeÜ“ÃeGí¼‹,Bç'éì¼’‚í<8Uf§­ùôtRYSSH?uü»*óÐVSÚaü½PKgv y^yÙ
-ƒw›•õ"ßòÙŒ,[¦¦fd4êÛ<_£\xÓÀAP¡¡ˆñ‰LuOVEù	}…S“çe1[Rë,+	x@gÛÉ­¸{\6ÔÆ?¼ÐH\ ÊÏB¨ßðX”àpCˆÓd?Âk(BÌJˆ‹@EàXy±k™Õ4Ù¼ðÓ<³JoQàxcÂåŒ3ÃÐÒ§f¤Es"šÐÖâ—¸ë[^6yuÒö_•3XcŒg"·9‡L¦P©¡®nÖTð×Ël³ÉKžM®–
÷B‡Tƒoõ^@Mp™íS¶zC+¿ ByðL{z(¥©âežm›Ïi˜iDîŽ\l‚n°aQ“eµÉ;òùðw¾Û²íSÁ² AÌ`ŸÞÊseÚ³UÍF´Þm6lÑê<Ä€«$Ñ{[¯ÖÁÖ-öŒÅ5ïaÖïR{'áñûÒè)—@g— ‹K’$q¯K"ÚŽJb$5Zt¶"äŠÆBC	1©q!æìŒäÞ:ZEΤ1£µ¶?uG 9 Cj+~ëM>+pïÞÉAƒwrl½FH¨ßXy*òçJT÷÷dtSN·‘‰? ‘‰ |±"gÝ€’­AÙ|È*EK+›#$–Õ¼3Á·z"C0eÆ;;ÀH¡/GÛb~à=WÕC+ÿ}Ò˜!1É+ÎC[7<>})ð¬öO£Líb6 °È9‡úï?ë¬n|@ÎHÀ#ÓpÇèOцî?Þ¶øVo¾ªvÍ`æÛ÷7ï~$˜Tð×]^3Ž7ˆˆæé–YeO¬©{ÆégV#%šm#Z³¢ñÚaP¬-êbñø詵|0¬w¤ª4ÂånýP}¼BÓyCÙí)#I!»R=læ-EЬÒÑ][p!ˆZUÏmh׊/ÖÔûÅÕϤ^g@tC¸Ø…_UY‚cjC·žÂŠîNÕÞ‚¤#¯ûׂ}ïÂ÷ªÑi)ÓðÐÑF!LµZ…¸øaÔ±@¨¥¡ZËØ F´DDÒÚ³¶Blj	8`ĦGç3i¤âV9ƒµMaã\Ð7×꛲Á;ÀÇç|ñ®he{®Ðâ£xøÖÍî¡…þÖƬ€ƒ9ƒ"L
-è'ìy¸½Ôü¸[e<êg¥LGFS¿¢ïl"b0.ˆ8M0;÷¯¹dI¶ÉÔ{[xÛÈ—P•ÞÄWúD2ôÌ;MŽ8
-%á¦~W\a"!‚$ä¿mŠîVë¼^6Ÿ¬¸zE_´h¨|ÜSzjL‡Id{¦î9žS=ÙxW”Þº¨´/òÜàC^|È«Q1—Xsn}¡/¥F.åI)kÎkF
-2kBhBn˜˜!ÜuM`k¸^ƒTe˜Ù[]DÚ;X}£†[T’j;šMV×`wÆt-Ž”Žå…F´tÙÑeDKõPmÄ~¸ç;É~›.ŒÃFBj…˜X€Çö
-càº×ºà-Åa‡9عêïH¦‡4b[ 
áÒ°‘ÍÆðUïá~FâÑÑÁ­bâŸg¾UŠ#ꦋbׯR·i;h°éžâ½éR‡Ìãȹ4D¥'„ÄDZëd($8í¿v5{™yQcÖ¤>Ü8㳶¤)R
‡ní¥Q2²Iš¼&®GeœóálT £B¥€Æ	˜‹Á0b8Õ4ìijD%ÊÄGÒ)E“FêHK)wxý©æ>b3ñi6k!5IÑÅè–Ltr€ÕÙ³þ¡˜DE)¸ð>ýÿKùF&æÁe&QbÓ#ÕŠ–ËBœ8NO\ýL$eý½H3Ë9cjiêÜa†)^‰xª1îõéúŒ¹çÀ4H#OsO; @ˆäD‚
Sè],×ò§ce¡>sV%˜KIÏp
-cb{:\2kD¬N1«#ã3æ•¡ÝfÙOaÎxü³¢uB	{t|ÆÜ‚‹Pjœ=Ã-¬ôjöüÇ}øn½ÆbõÈøs™%ÿLfiýSŸa†“NÈ~àüÇyvJ{äüYLëJùÿXH‚ã›Y$Åð­ÀA)/ëŠã±»ñ`ÇÁi¤½*p$.±t,·UÓ¦Sºˆ¤‹tú—Àý𼟡B6¿m¡àdºB¼ïžM
-*¤59[lUqŠœ>]bëc/±µX>}ʧÞ-B48˜È)­O/Þb¬®÷
-N;\þ¯íõ„»™8¼d¤¦­ÓÇ]æz©œ:§ŽºXïV\$R!ûˆXÕC]­rðÐL¥uh—ƒ
-7ØxóÝ×wW·þx2–‘úôÄ“”¯Â:RbïfTæ”ÉÁKn+½ù(wÆDr®wôp%^6ÏnëÄá,¸y3[NW»üðlUd•Ð§×n±Fœ­H"+ú;éÕÑ­ëNÐ&“¶ÏÓ—V“ @33 7š­€[¦qíí±·Á©âHØwyðk¡´0˸‚o]H²%½¬œã’›dM“¯7M?¯ähEÎ*Ù$rz¯@J´`¯EÕγAk(-ÖÃÒļ˜—axIF€8µ†ÅŒª¬›í•›ìf,õiØ!æMΖ5uÚì1Ö?\ûéŸþDc9Âî9DgŸÛäo]̹®ž°QÌÂ#‰yží½88xà6ªHøêáˆÂH«À„XyZaúXǦŢ+™Ð»z9õÅw,ˆ×Ë]3¯žŸ›gv©5§Ii±FhÑ{@ïÄüƒª7ZsòKCš­ó¶‚þ}ŒœÔôo¾Ë	`!Ë‹'*jÀÈïoÞß_ß}xC¼Oêªx²yÅ‹ «ëcyiO->ïÚK¡fåKx8BéÖýjƶhòúUUÔa‚S¢²UٓDzo!¤ƒƒíeS_W3™‚5;+f=¬b°|:.ƒ]¬æÓÙªÀêåá[FY-ÍiZ¬
-›UÀ	áê€.¸%¶5ÎûGN U%X)–¤Æ'˜±}½Yù’«Onc$F¸\;ð(aÎö]’ïà ƒ±)–›Ü_¥ —$x&‰„ÔrOð(ÃÞ¥@=àKùóœªÝ“ú_-Æ$
¸cL§œÌž|YF_šßùH(ª¬/^öHnž«þÝdøh„iõ‡2ªó¬2ïÁ£Ø=rý-#ìM'[‰È(m^QzŠ¹]ÌåS§ä³æ\Nª¢ÁTFÈàßòl~ü¥YiuF;œ¯ÌÇŸxU7S|IPÔM1;ÔE4':MO-Ýâ¬=ÔCÐW0jýÅ}ÔËþÂ7ü„½nxAÈNñSžoØÎJ.ðÊIúþËBÉ|<ˆÛÞƒdïiLF¯fdìKÙìÐ>.jˆÅôhä(.Ï&0^ûö¼{˜oðÊèÔ8wÁ7a`¨QÈ]£åHDJ[5Bú%d¾Pendstream
+xÚÍ]sã¶ñÝ¿Âo•gN¾‚Ó§Kâ»:Óó5Ž3m&É-Q{©ˆ”÷×w»à‡DINz3½ÑWÀX,ö—~ò2¶‘MUz™¤&Š…Œ/gëqù}ï/$ãLÒ´õõýÅWךּL£Ô*{y¿èÍå"᜼¼Ÿÿ<±‘Š®`1ùæãí»›÷?Þ½½JÌäþæãíÕTÅbòîæï×½¿{ûáÃÛ»«©t±œ|ó··ÿ¸¿¾£.Ës|}sû-µ¤ô92éÝõ»ë»ëÛo®¯~½ÿîâú¾ÝK¿RhÜÈo?ÿ*.ç°íï.D¤S_>ÃÉ4U—ëë(6Z‡–ÕÅß·özýÐQþI)
¼:d e`œFV+Ý2PÚH[„TÕ*ÏJÚæÇMSTe}°I%RÚËD©(Ñqr„(Bšö±Nа¦l×,§åïójåþêRÙÈ()O/ßb¬¯{ëK-##”p³ÀU¿z»j
+ý&…éã%¯	e8[¥Z9Æys5ÕJNšeüÔÂ!ăú,0q¤L"yÐÛ·cóº(¶2 <
ΗLŠš¾Ùê9{a¸ÎZ¬*©áö_ß~üðöæ–þm¯¤›äõŽ5¯™Àü)gÜbA_$ÔORçÛ§|Û®”kŒTâ€d”ƱòD•¬«\:ÉfÍ.[­^øeµ‚å$kŠ§ͨdr`ÿ<_d»•êx…=¶KãbË›/«1þ0!„ò×Àmä.¾}fˬ|ÌiÉ…gHµ¦Ö€œ'Ô¢$øÿ/ÕŽç ÒŸ]]”4°é…ùJ˜áÈPU«9)Õ··?PW‹æ™§{CM´
+ëì…€2Ïy\Sñ0<`Š¦íáZçô×蘞[ë/‰Oëy븞·X¸â<A©fY“O«ršÿ;ÚWvD¬ÚiZ¬"û5*2Nf@Å=É	p²òöŽàçÌ7J8ãpwu^Â
+JwE`^f«œzgË|ö‰þ-ª-Ÿm¾®¶/„¶öSXœgG6€ði)i!/SVDÎJ5T9öQÅcY±Z³@,óÃýd%ï"„7ùÈZïó„×ÇåA%‘H9#=¬ò°¼<Ùj·Ù_ÖÙ(NDrzÙ€4²l_R÷äpÙQkï"‹ÐyõI:k¯¤`kžœÙ)DkD}#TÖÔÔ
+@ÿ©Ê<´ÕÔ„ÖÿÃD/ÔÒhžW^¶Â`ÆÝfe½È··³Á;ÀÇç|1c´²=WhñQ<|ëf÷ÐBkcVÀÁœA&ôö<ÜÞj~Ü­2õ‹R¦££)_Ñw61Dœ&˜Žû‚×\²$Ûdê½-¼íƒ?ä˨JïÆâþ‘=óN“#ŽBIHµàÏŠ+L$D„ü÷MÑe5°NÁëeóyÁº«WôE‹†úÈÇm±¦†–¨/é=ÓFyŽçTÏ¿+Jo]TÚynð!/>äÕ¨˜Ë¬9·¾Ð—Š#©y’DÊšóš‘‚ÌšZ„&¦ÃAw]Øn€× UÙ#ÖwÆV‘vÆVgߨ!‹JRm‡B³ÉêìΘ®Å‘ұܣЈ–.#;ºŒhé¢
+¡Ø÷|'ÙoÓ…qØHH­ðØ^a¤{­ÞÂPv¸‘ƒËþŽdzH#¶Ò> 
ÙÙÌ`§jœ‡û‰GG·Š‰ž9«GÔMÅ®
þ^¥nÓvÐ03êïMW:8dnGÎ¥!*=!$&ÒZ'C!Áiÿ½«ÙËÌ‹«&õaà~À_µ°õ L‘j8tk/AÊ£Äiùš"¼N •q:,Âÿ¹QŽží=J0ƒaÄpªiØÓT'9*HÓÇË)y7ØÈHrxŸþTs±™ø4›µš¤hŠbtK&:9ÀêìYÿPЂïÓÿ¿±™odb:•ýŒ\Æz[®`´vÕrÙBî§æDêg")ƒèïEÂX_†ÈKKS' ÿ…¦˜ñT£ÜëÑõy¹÷YeìJ*{†{±'mÔ‰Ò»X®åOÇ26ʪ_0«´ÅÝš3¬2"ŠMz:\2kD¬N1«GƬ•*†1Ñg˜¥À«¥:=ãòÏÊÖ	-ìÑñ‹–Ô‘ÀZ÷inIYí’3Nü·^c²zd|ÁÌ2©MÏ0K˜È:÷#ç?ϳSúØ#çs1­{@ðÿ†dš@Ú©™…t_õ¯p®r0Y‡PÜb‘ÔD1xÙñ`ÇApŸBôªð.IháÛªiË)]DÒE:ý$p?<ï—@è:ƒßö¢àd¹CA.ùîÙ¢ &uõâ£Wl
+ø”ÈsO+úXǯØZ,_È>åÓs‹ƒM
+ Mi}zñkdu½w±à„±Ãåo0m‡¨'\´›‰Ã$#5ím}ÜU®¡—®SçÔQëÝŠ/‰T¨>"VõPW«Ü<4Ó;´KA7Øxóý×wW·þt%¥Äk¤>=ñ$åTXGJÄÃt°Ì©’ƒK²•Þ|T;c"¹Ö;v¸ˆâìéÃíc?ÜËnÞÌ–ÓÇÕ.?<[Y%ôéµ[¬‘Åg+иþNz÷èÖu'h“IÛÆg„åK«I ™­V@–i\›=ö68µB	!—×±W³Œoð­E¶¤W•s\Br“¬iòõ¦éו­ÈU%›DN§C™ ZðžÓ¢jçÙ 5\-Öë‰y1/ÿÂð’*Œqi
/3ª²n¶Wn²›±Ô§a„B˜7m8[Öd|©ÓVñþcÁw?2ý h¬FØ=‡èlás[ü­‹9ß«†çl³ðHbžg{/^Õ*¾z8¦0ÜarîÁAë„Â,JÉ„ÞÕË©¿|Çñz¹kæÕóá£3L[SðD'Ii±FhÑ{@ïÄü“no´æâ—†4[çí
tø'2rRÓ¿ù.'€…,/žèRFþpóþþúîÃBà}RWÅ“Í+^]]ËK{jñ‘×Þ‹“¬|	G¨Üº›±-š¼~Õ-ê°À%QÙªìÉcÙ·ÒÁÁöª©¯»3—F
+ÂÕÓRÖC:.dÉ×â2ØÂj>­
+¼º<|Ψ!—æäê-Òáòƒ}Bêc%ªýõùª-±­YFØ?oB y*Á>±5¾´ŒíëÍÊ_¶ú²66ðHÒf„ÐuÁ·%ÌÙ¾Hòüôc06Å‹@ç&÷W)H$‰œI"±'rT[ð—øóœK©Ýcú_-Æd˜cL¡ËždYæ^š?øH(ºS_¼ì‘Ü> endobj
+350 0 obj <<
+/D [937 0 R /XYZ 56.6929 769.5949 null]
+>> endobj
+740 0 obj <<
+/D [937 0 R /XYZ 56.6929 750.0533 null]
+>> endobj
 940 0 obj <<
-/D [937 0 R /XYZ 56.6929 434.0333 null]
+/D [937 0 R /XYZ 56.6929 397.1368 null]
 >> endobj
 941 0 obj <<
-/D [937 0 R /XYZ 56.6929 422.0782 null]
+/D [937 0 R /XYZ 56.6929 385.1816 null]
 >> endobj
 936 0 obj <<
 /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F58 631 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 944 0 obj <<
-/Length 3508      
+/Length 3363      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]sÛ¸ñÝ¿BoGÏœpø pú”Kœ«o§uÜ™¶×{ )Êâ„&‘ŠOýõÝÅ)Rrn2‡ °Ü],öÿÄÂjÆU/L3Í…^äÏW|ñk¿\	³@Ë!ÔÏW?½Oä"ei"“ÅÃz€Ë2n­X<¬~‹ÞþõÍßnRó(a×KðèçÛ»w4“ÒãíÇ»÷·¿üóþ͵‰£‡Ûw4}óþæþæîíÍõRX-à{é1œùàýíßnhôËý›ÞÜ_ÿþðëÕÍC¿—á~W¸‘/W¿ýÎ+Øö¯Wœ©Ôêżp&ÒT.ž¯b­˜Ž•
-3ÕÕ§«ô«îÓ9ùie™¶ÒÌ0V
-ã8Y²DIåøRvØ´<ºk:Ú\ù¼­Šç¢îŠ•Ÿ¨é9,›l3®áTŒ´L	5Òf9">gÚ!›ÏYYwð·,ÿXï®…–Y[œò Xâ‹<˜	:ÊÊ(•3ñ°)[Ü~5Û®ljÓœŠšÇ¶©ŠÎ1u"ydx
- ·ÑmGß¿dé¾%yÇ^Þq/ï8²D£kèutvÏe]x›¢Û;zÉèÑí²ºÍòîZD=«Uó„Ü´DŽŒKµ&c"Nb}.¶ÖÍŽ·uîäîô"«hò?ã æÑÃuÊ#¤¸6ÀfpÜ„
hJpŽžPFÀ+1
-ȨÀÎêâká™Ø6m[>V…Ç~»v»áaÒíâÐìIGë"è/‰G«²ÍàsziöÝSSÖOAÅO÷“ÿ£ý!¿·öGz߷ᜇš+“”Ù$¶þ ·»æk¹*Hg´¶hm˜´`\73ŠN'(ΛK@[¹Uú²Ñ
¡Î[]åÌ®¬Ëç¬ZîŠvÛÔmÑN,·BÚË,ôP3<Œ¶kfÓXŒ™ c>^ʤ°Avbl‚¥J†Ãpg"°gÚ©ž@ÇvYçu!‰HÂŽ|Fƒ¶Ø‘:"†²ªè‹¦®4—­V4 $yãž«–àHè²ý’,<7OS=VånÓìÊ1+e5bVI”h*NKaa•u­´…³¡–æýaÈ$ÄMÓø˾¤ÁŠ@þË5/Ø“³1ô4Uñ”9¬(A¥Á¬ðýkAÐ#YÁ§‚mRŒ<'p背û¶ùLlãÛbnç9«ó`©ëÞÏ@èz+«bí«ÇÚÅ‘`ŠƒgÕìä«ffÓe«;]0:älø/!/ó:{ž±¸D@* õEê=ДühŸI”QvDߟUªQÆÒ$D)˜*ý’wò0²â´^³ªj^ü«Aáîh6Ào²¯~&È€ ßÞ½ùpCf¢KcÇf215¥”ãN‚~-›*£}à4ê>.áàÝÝ'l;°°ÌãÀ¨RŒ¹øc[•yÙÍЊ!ÐInI¡I÷rBAçjÔ K2±×œöYžñu˜H'Õ¤…ã}‹ÙåLÅKÌx?—åCÒ=,¦>–ŸñšA
-­¿=ÇéAìBžó]ïøT{1iòxÇÜÏVÈýfK%0S)ŽYØ™-+`\ŒTö
IK$q€2£ÑcAÏv[äG«ð™
-.ÌëªH4“€<çŸgÂ…f¢¼‚d¡s¥".V²§ð²)ó

slP¸QÙÑRÝÝl¶½Ä
ºPûĉûÚ:jšMÏ‹+1`.§,¢”	õàã—f_­hèÚZ':‡¹ÈÑGîôêô–»ý®öŸ¬ñÌ×~™REœ©"—~µôóÌ猰ÖVãµ=r§\ÄôH³ò]ÖnÎf11(Îâr3„:ŸÅôP.‘,òý®Åœ†N	©Gœ¾Bº‡š¡=2=ùWcâgÜš¶üO–¹.¶¹ô0•”xÊ_ðý˾p‡›Ê¾ü+Ú®%(«H?öa°&x*¿`Ð×Àð‰¯‘RêæúF0M)=Ô¦þ™”8"yivŸ½ÇÎç|N?ªM9…'	A5«ÛÇ÷¡´5!ºF™Æ(Q·0Ú!pzKGuæ±Zè8Óï+áÆ).wÞÑPêlu •Ïµ+x†\yV!X *¢°t!½¥õÜz‹ƒ÷l8½’©ôftXTÃÚ±†—Ù:DΔ6Bµ%4wMç‰t›ÌQ0 §®›pV 9*b78@0˜´eƘàò½Ô°ßõ
Š¯—):iÍ„Ô'3¯J€p±YGÔ4nžéíɳ/IhŸL€èͱåGøCKßäY¾)þâÝ]G`!;ÐC=ùºx¹Lì±ðüh½"ðl¶LÌjêĤ¼hã{B}˜§ÓÜ—ýµˆŠ]‰E!Ó€žh$uc`Ðv¤ˆ%‡3¢YWó㳦¥1Á "X8‘˜)«ïQa+ÁuØœW‘
-*ž=„ɹ­ùò6”Y®Ô]­¼ªûŪi>ï·­ïý|*|â¹ð¹‹•!,®‹.ß,Ÿªý\-‹EÐ÷ìöÙ ¤dÊŒ~%
€Î‡ ädC)c—Ýa[LJ&kH«¤¹H»š™6x]‰
-fÍuŠínÔ̸$f&áúr…
E$·†<"t	A RZöe
tOH)W4¢bÊÌtz8&€M`o³Fˆ/€xròm¨Ã&b“ΔÔtƒÐ·:]Ë=yûç[ŽBƒŒE*¾£åîî$*é·Ü,*ë.JíüÍ"žäš'ú<.úŽ.?_ŒQ-wßXlÆíÆ^²¸I³€t›Y-¨¿7‡vUƒkàhÕÛìÇëe"¢ø_F7Ó&(¼C 1·ŸÅ—ž8MA
Æn·G)¸‰ŸnŸÅâ]{Z·0/‡¨Ý¾l<:_Ø¢åÀB«â¶å╱ÑáZrèô2¾[ʼnšž¾‹
-£éÝj±:Q‰Zåû}G¦,6Óððx³ü}
-)ÃE°ð,"¹à±·Uú•à
-å	>cY®–Û¦©&*  UébˆvêÔ”úøîjr®@cGäWÇË_õs/c“(1ó…ÐV¦qÕäØǥײÃðöŸdø¿8ÑœW[çOEtºp*(ËK¬4KÈ òée¶,¸•©÷@Sòãˆ3aS=¢¦hJ„TßÙšaÑ”„ÚdpÉ—ö—|PNäMUQêƒ aÏ.ÃÁ«
ÊìðÚ¤î¯?h€Bj	¶øöuE©¢	­
-ÀãÒG¼Ô?ܱ„úÄE+0ecíÉah±fô€<Ëý<Âw™aæ1kKß¼|<øŽ&R]æ3vôf1dƒvÈð„‚Ù©¾U"D¹ast¦ýcäéâ•–KŒ®+=ígÐ-ã2NRÂmèÒž°ˆ©­“š´xg¤O~ëàÚDYŽ
ú¡@r¶M‡w†²/–võ*§¯‘èœzÅà¦Ó>|¹«gzCøÝñæxµÞö7ÓÏ~ÔøÛâg’n~h²ï*Â<Ýë$InÀ®ÄP~$ ¥Ç7S{Aªœè¡¯R}‚ô	ö\b‚m­¹~íN!d
-Cøó?Uê¡F7
-ô[/É$ofzËážq4õ9ê5F&Ø.Þ[ðd¯þøitÞÉ >òùߌ3ˆ¸)×—Èö@ºã ÆfMšŒSÌSæØßÃq?w>楒)‘:ÕIê~®ã:Öî:ˆ€~ ƒ#—ñóÿ¾Üþëýýx9£Ç6Ûï«lGÁˆÈ—ðê.ÄL¸UñXw!FÈ6þ:M }h~rŸVÖîÇGMÏy#Ãó2izö?cóýâg”GLZŽ-˜å p>2ÔJ¼`X=ør?sOvŠuÞ°ì)7
-‚/‡w€|¢iæ2§˜IѤ’q&^&öåу¿ÂÍ)Ö‰føKÐj¼/²¾û§Ç_ãƆAÂæ¾Ò%fejSÈx<TÿËÔ)ëÿ¹-endstream
+xÚ¥]sÛ¸ñÝ¿Bo'Ïœxø8}Ê%ÎÕÆi÷¡½ÞMQ'4©ˆ”}ê¯ï. H‰’ï&“qËÅîb¿!>cðÏœN˜LÕ̦*ÑŒëYþ|ÅfO°öË0‹´BýüpõÓG#fi’af«.—0çøìaùëüý_ßýãáæþz!4››äz¡
›ÿ|{÷fRz¼ÿ|÷ñö—Ý¿»¶jþpûùŽ¦ïo>ÞÜßܽ¿¹^p§9|/†3|¼ýû
~¹÷éÓ»ûëßþvuóÐó2ä—3‰Œ|»úõ76[Û»b‰Lž½ÂKxšŠÙó•Ò2ÑJÊ8S]}¹úgp°ê?’ŸÒ.ÑB™ÙBëDˆôŒ”YÂ4Hmaeš+z!«I! ”ñºi»EÛe]ÙveÞóÌ•IRgßLíÞn/ÛsÍalíhÿÛeÎÇê~¤™n]¶4*êì±*ZZþZ›²~¢•fEÏhÕlç/ÅvOCä”V»uÖÅ=
+šª³ç" *¶ð
˺+¶YÞy±ÀYˆ„	na`DkbàµìÖ X’³ù]6(Ÿ7Uñ\À×Ë0QÓs ¼É‰z…34)ãòòA¡ÎŸt…”>gÀü-ÊßWÛkîæ‹Ç¬-NNÜ8@£.“NÉÐfxâV&©ÒGt<„ƒUófÓ•MMcš“óæ±mª¢ót)S°,
+]ðùmGß¿fé®%©« uÕK]ÍíÑ5ôº„}¶Ïe]ëbK/=ºmV· × 
‘Ôªy"…àZ EòH#<%Šƒªn:‘>Âà¶Î½è½vdMþ§ñ(6¸NÙw\àGf#šÒ#eØ(£G¤•…	$Ô€³º µ†·MÓ¶%XTÀ~»òÜ°È9ß}³¦QD-&±±ù²lÑ é¥ÙuOM0HTôcþ`òÄb¼µ?Òû®ç<Ô^aÒ܉½Ù6/å² µõÐÚ
 µM„IÀu3¡8‘¯¨8ç,OºÄZý†‹B]°¼å-¯¬Ëç¬Zl‹vÓÔmqêf-PÈ…»LB5AÈ]k—*>&‚ŽùHxàˆ¹‹²Ûa'Ø’TŠxþà,:NoÚ«ž@Ƕà‡IÌœ!rìA‚¿Õ/ʪ¢/šºÚÓ\¶\Ò€ä.[‚#E Ëv²HÍ,… 92ÈnÝlË1K1ÏjÄ,9nQ¢©x-……eÖe´ÒÞ†ZšJ-""‹¦iümWÒ`I ÿešÉ“·1ô4Uñ”y¬(A©Á¬ðý¥ 葬àSžLÙdôœÀ¾5þÛæ%šXi›bnç9«óh©«#ˆpÁÏ@{ˆ+Ëb•íªÍÚ	Å`’kÓìÄ[f§xQ•ÚËf7„:ov=”7;`¡„H¼È1¼Ÿáw	}™€j‚‚³Æ$ÒJ7&!œXª±Æ!RcL•a)¸z9ñº¯YU5¯aHeƒa€ Bþ³~½„™(‚|÷îÓ
‹6‰ÖåÄऔž:	júR6UF|à4j>½FáàÃÝ„„¬^fæÝ:
¬á*x‚Ϫ×löh»m™w褨WDB^´G›~¸½vó]EG{l,M·g_ÏYÛ‘Óa`žLô9%ùÔû=²ÌCpÚ€K(Úóz+àÄ…LßÐÛÔ½PdL]¹ÚŸ¨+‰åZ^Þ·‡šØxl›61©1ã'cg	¸üôb<Ñ\Ç ¾ŽËô¾¸>élÐЈ»Ï·ÿM`` möäVz‹K-ä4"_ìh‚RÑ~°CN–ÝŽby\¯üPƒ@]u”ºù—RE÷¡z/€ã^W`)fÝ•è›ÆH±[w9BOcz(ŸIùnÛ"#DZS@î¡Ò7¶î¡&ö™ž‰k¼ù·¦û“Õ®n>?LeÞœ|ÿ¶£öb*ú*°h»– B°"üØÇÁšà©
+ƒA_
+Ã'¡Æ:P7ß>‚iÊé¡D
ÏŒ øÉk³ýœ<¶š§“úQ‰Ê(>	ˆªYݾz
+Xˆu8 Ö8çèEªP¢~aÄ!ðzKuf*-Ftœé9Å‚¸ñŠË¼wT„:[îiåkí+ž!UTèc¹œSX:„ÈØ”õ.P,Þ³áô
+(^0.StÒ:áB‹qtÊ« |lÖsj7ÏôöÈ…»('@t‚öÐù#ü¡¥oò,_	î®#°˜è!aûºx½¼ÙcèÑ„{IàY;¥+YM
™‚”2m|7Ô.yâœæ¾í®ù¼Ø–XÂñA5
èi/€¤¦ÚŽô±äpF4ë‹~|Ö´4Þ0ŠŽE$5ÝD„Vö|£Í{(ÝæíÂäk¡¾u–¯u—Ë êa±jš¯»MZ@_ŠøD`*¼ã]ˆaqUtùzñTí¦‚¼r‰âQß³GØgƒD°DÈM/¡!Ôù ÔCyYåPθE·ßüôvKCf%ìåí{¨‰ýÇ÷[§©£ý¿DãÀN;Ex?j&œˆQ‰5L_.´¡Ö7ÀŸC„>-ˆ»¤œ}uCú'$–KQMe'>ÓÀ&\#Ä6ÔAÌ}Ë1“peÓ±ÿ7rlØ÷ôôçíŸï?r&–§ü;úPeCÝhf˜"º?r›+¿œvÓ·¹`{òkfôy\ô\a¿£ZDÒÜ
+”£FoáÈ!”&Š,Ùµ	MÇ»,´Q<4q´ìÍöóõÂðùü/æ7§&ÐwÒæÎ$
+£l>û6ƒØ£ÒTÔ`ì¹=HÁOütûÌgài6d+b^Q{¾œ:¾)v(HeªDÍ)º^µn¾¿b:½ŒïZq¢¦gè¤Âèô®UA¸6Ò€,òý¾#“jxx¸Íÿ>…‚¬+ÁÅv褽Ôg$'¥4ú‹®±‡By‚ÃX”ËŦiªÐÊt6D{ê#Ôéîãk`¼8— ±£í—‡k`6ïç.^+LóyŸøYHl-Ó¸jrìåÒkÌÚaxû!þbà@àá
+Ds6dq.ÁÏqs9d
¡.œK„Š%óÅŸd¤‰`N\& ‡š `´TÂ]ªÇ$œ©žò¤¸vX=™X¤.ýÒþÒꊼ©*Ê$²íS¼ä /Pêþ"„(§–p`³oWW”Ó šØ³<>Ä‹¨âmK,T|Àƒ¶Îéq¼ŠÍÖŒpù_L„~3Ìj û·¶ó,ÇÎýpÀœí×á¢è«¦m½ÌékÜtJ½ P«´bþ*ÚÅ&~w¸I^îž7ýMõs5áöxˆ¤; šìÛ‹0O÷EçZJ‚Y°,>”	hðMa3=ôX²Ï´MŸiOå&ö²†¿u¹Ó…ø„©á],ÐOì BòfO/;|ÌsCrN=NzƒŠc\Ówñ¡CNþ‰õyÐwÿïð#EU¼sg~¿¾,qr¬@®ä1åZ‚
:a'Hÿ?vôÒendstream
 endobj
 943 0 obj <<
 /Type /Page
 /Contents 944 0 R
 /Resources 942 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 950 0 R
-/Annots [ 946 0 R 947 0 R 948 0 R 949 0 R ]
+/Parent 948 0 R
+/Annots [ 946 0 R 947 0 R ]
 >> endobj
 946 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [182.6146 546.8636 231.8861 558.9232]
+/Rect [182.6146 510.563 231.8861 522.6227]
 /Subtype /Link
 /A << /S /GoTo /D (notify) >>
 >> endobj
 947 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [108.9497 119.3949 182.6031 128.6103]
+/Rect [108.9497 76.1205 182.6031 85.3359]
 /Subtype /Link
 /A << /S /GoTo /D (statsfile) >>
 >> endobj
-948 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [293.8042 73.4705 355.0043 85.5301]
-/Subtype /Link
-/A << /S /GoTo /D (server_statement_definition_and_usage) >>
->> endobj
-949 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [395.8905 73.4705 444.6373 85.5301]
-/Subtype /Link
-/A << /S /GoTo /D (incremental_zone_transfers) >>
->> endobj
 945 0 obj <<
 /D [943 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 942 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F56 622 0 R /F58 631 0 R /F84 802 0 R >>
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F58 631 0 R /F84 802 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-954 0 obj <<
-/Length 3894      
+951 0 obj <<
+/Length 3959      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]sÛ6òÝ¿Âo'ÏD,ðóÑMœž;MšsœigÚ>ÐdñB‘*IYñýúÛ/@¤D˽¹Æ“!°»vû	J]†ð§.ã$Hr_¦yÄ¡Š/›‹ðòp?\(¡™;¢ùêûû‹ïÞ'ú2òD'—÷«ÁZYf™º¼_þ6K\Á
-áìíÏßßþðåîú*f÷·?¼šë8œ½¿ýé†G?Ü]øp}w5WY¬foÿyýéþæŽQ‰¬ñýíÇwÉùñ¢w7ïoîn>¾½¹úãþÇ‹›{/ËP^äÏ‹ßþ/— öa`ò,¾ÜÃ$TžëËÍE› ŽŒqêâóÅ¿ü‚,½:¥¿(΂XGÉåÜDAûOkY©R@”Æym¼–£I-;*Ôò¶mžÊ¥—ßVí±ÈJ© Ê’ìr¸îÉîžjb{3Ø8¢$Óãý?[ËŠï×2XÚnÑ–Û¾lj4+dìH˜<
BeÀ”G[Çi 3Ð"—õ± :S@Ç#AÙ>^òàn ²§EäÓuYäÅA8´r•3d"¨txVSš÷T¯°qº²œX¸˜QªÁzÍÖTglÍQᎭýsg»~ÚÖÂ<È”Ñçw÷TÛm-
-ÀQãñþ­Kqlkq›/ÛZšĸ¡çlÍÑ¿"òéºÕÖLd:~åÜ=Õ+lœ®vÖÖ’‚‚	_±µ!Õ˶æ©pǾµE?_´W*›Í‹nÞm‹…=1:±ÉÕy6<Õ#£ƒë03r¿.;P¤f³3ïî:»ÄQˆ¦BÉT0ÊøÑ7üÜ_­@È~áζO¶ É
-RótQ´mY<ÊŒëw­lò{‡¿k±«hx‚:
-LFbÁõ„CDA^èüaÂ	L¥±[÷ý”ðµ.Úb1Ç—Àª²$Ó“HDZmQ9i"r¦é¬+6–Aû♤@@<åó¥aÓ2¦/À[²˜êß,3¬TÀ­ŠEY•}ÑËËUS,Ëú‘W€h@Àÿ4µ C]YÙšYáÇ—·¿
-»Ï]o7$bèd㢦_óù€ –Ï„g¶¶-0A¶óÊ.äùñžŸ$<ßýü™›b±.kEŽ	³Ù­;Jfù~>4ýšGÂ%Œ^:…Ù2Ïþêù×秚¥zpþNœ¥“ç;!~‰4LªòÿÑ
-Ç’­ðo’ƒÌ6Ò&€´í¶¶û
-΢ã`[øãÅIvë‹…ÝÂI¿‘)éd˜”šA>*å¥ò±nxÁå˱"nž˜ô•X: :K
-V,—%²TTóUÛlæÅ®_;îP°Ç“0«¡ŠMR“çÐSM°8Jt	)_y¼_ÛôgòHô×ñdÑÔ›
-†ÕŒ˜».žJô(ziÅOô8z‚ŒM‹¡|²|ê*ÓAcÕ7Ç¥öËœ…G”äIÌ¢1gQ„ò‹f\xø·Ìì©´ûA…;þº‡¾|Û£ˆ:æ ®.[	°¶:5
-FAjÌy«À¦SEÞ‡Ðàeõ©l¸µ‹rõ,ö:±Sݸص|°Èä¦Ð9¥pðcÇâEAÊÆ-ùØæ­l €Cwéõ Ž„ØqzTÜgØ¿VÍ£@$m͵L6ÿŠG;iLŸÏi#Ê‚L%®#˜n7¡ÒÕ/œ†J•øøX, š¬¸6ÖC—œ€Ui©­˜Ñn½Õn9vÌH™}“›Š$òã{.vX“ êš¯»-úPeÚBÙ^pÄ+"‘’{c]„@î‘çÀxËQ11¹\>"ª”ÕwhþE*š}s„Lšã„Ë^Ê©¦Ük±4*“ìð>Ä¡ÓRÚ55#*TürÔ
îF
-WÒíì™Æ–2
§žšïUt`RIýO¨žWèzO–$.%÷ñy´·dMã.ù0…u²ŸËiwŸþ„§­ýÆ#W¬ŸÜMvô½1,šŒÂ·Ñá Á™æ8Á8äÀüÄÊe·Ý¾A ½²m[T|kg4ß?#–­Å‘5lë{œÅiÇدHýÝ„PÒTÈfT>ðp+Y¥îyN«¸Ä‰×ùÃm?JgŸËza(Ëi1iÍúH°ÇêC]0Ê+ÈÁÝAb|¸<ê|˜ÄÂAtèapÌÚ¸pb"E¥
-ê\pDÚ‡ç øbÀ˜ãẖ€(pœU£tå:9UÍKQuîßÞšªÁ8!ÈÝ ŒP¢ã»Iƒ->´]~&J*Ì_S¸¤Û6œV2é¼r×ÇÄ_¦ñ›t±
w7ï¿|¾y0\>»à‹kטeâ‡q.™q*˜ÕÏ£f
Îa#q¦cƒÂáH÷‡¾ÐëþäX6v„îá–Š­¦=
-y¾ÑÜ.{„¥Ê/5$Ì0^¹R½|	쩸·èëù¦ØnírŽ]
pÁ½òè‹Î&‹Ïóá©&¥ï4
´‚cNnWS—‹x·˜œ½\„Z 7zÐvšŒšJ­Ü
-›8Ý~zŠDNF aÔ¨™C€xpœ±z„
-MˆV<&g"® kͲ|l|UÙa;¶qjÉ'v»„ò
±>…’Ópqxƒ	là=[Ínjˆ/ž’›¤l¶P¶°½á”Á®ûrãØÏYíª©ˆÇÄhïdnq2p€üTÖ»o<äcÝùÄ×0tß´_yÄ~Ã}>ÍùñÕ¶µ­xŒî#Ô’kSÅ.Ýy"Ý¿ý$覮ù2¥›¼g“𢸧…§ëðË*$Ó•tFZ"’’kå?èðŒUIU¢Äzð½®Y|¥N#Vþ†5Æ3eS£—GeIC1Ë%Ä£³œ’ÂÙG’’-u<Äêî±&s†7bIê,F”cU”_ú9-ˆ	‚õ=gÑT:¸$•Lœ:Bˆ|»mÄX—ßÓÙv×n·Îô].Ôç‹f×BÛðò7/E±
-*ë³ánHõr¸óTôÃoœã9#.ËNÀ,ä€Ó¨kOæ<;žj‚ŸQœŠSüΔŒúŧòQÜÓ9fbýÚW•(w-)6‰S	 ¦|I@üüÝIôbHm÷<Ç2ŽÏ6–“?mŠ®wK°ß rP%¼ìea" ˜Y¤.§ø;—Üò'îÖÌB1Þ1¦`³ó{%öQì.Ñ3\üá™aB…e?¤xÞj˜
-?ã>ÿ#‰‹òC‹Q’
-€êDW²N_ƒ[®Û…õ|È:×;ôdœõ-tc»ŽQÂŽ\õ#dQT‹]E?b 8CùsÌYùì`Æ\P/è’?NcñíiYópµ“sÖœ­jùs—\ßEîú.ŠIÿèøopl¾¹‚‰;KŽbÿS	¿B„ß.ëG+K,
-ÙàAÖ§ÃÙ”}ï8àÎD³%´ûyÌFöA“èøÅb2üø¶òØ$Æ—gC“˜¼¦ÿJ´EÿÍg§«zCÓCëdÚðóAÐò«!q刎ֻ|†þ§\0†>a1þ³:”ûqº…¨Þ~SšOè¾\Rëš!î:üGÊôÐ+ˆG½ýôEV¨²±›†Z6Cbîv—7N÷‰\ták(Éé;!RЇ*4|ï*ÅèÉÞXΠäu8ð^‡¾rÐ|w¥ýñj¹d æo[Ùž¯bsð“+÷㪺gÌà;g¬ûŽÝ˜ö¤~DÄ7‘ž3íŽH@áæ…Ÿ(›8ÀßOä ø/gûÿ|ùðÛîŠô,;ó³Ä(ƒE„)<‹(:MçT¾ë	Öÿd^ù#endstream
+xÚ­]sÛFîÝ¿Bo'ÏD,÷‹nâôÜiÒžãN;Óö–V/©’”÷×°À®H‰–ӹƓá.ÄX|.%f1ü‰™I¢$—ù,ÍudbafËíE<{€µï.ã,<ÒbˆõíÝÅ7ï9Ë£<‘Éìn= •Eq–‰ÙÝê·yÉè(Äó·?~|óÝÏ·W—©žßÝüøñr!M<óÃ5¾»½úðáêör!2#æoÿ}õÓÝõ--%LãÛ›ï’Ó㢷×ï¯o¯?¾½¾üãîû‹ë» ËP^+äÏ‹ßþˆg+ûû‹8RyffO0‰#‘çr¶½ÐFEF+å!Õŧ‹ÿ‚ƒU÷ê”þ´É"#u2[(e°ÿ´–E”
+H©É£DI´¬'µì±PËûÎ.Ê/ëöXÜ\Dƈl6$y²±G:ÝØ$ƒó$2J‰ñÆw›²»\¨4Ÿ7»¾ljØ}×T¶·Èˆ¡†Ôd¤D’HŽ7ÉÓùÍÞËâùs³'µµ+õ
=WeWÜW–&7¿¾¿/ôØm_.÷UÑÁÎ^ŠyûhyÚ´„ÖY„uo.Z˜1Ù~ã8ž-DœF`NF"Ê‘ŽÙ²^7í¶ qÑÚü“ß;:°Ì€7°œ»¶y,W‡³:RŠí2mÙkI—õñÑÊ$‰´Ñ³T§Q’¦ÖÚ‡
n‡ìÑC|²®!'T‘‘OvyàZdÇÜ(i¢$È0$bië.N©±‘(7–8)ª®9á#WÓñW«%à¿ÆÑ	ÝÅèHs£…‰d®_ÑJÀz…‡Sj¤•ãÇq$I§‰x%Ø°Î5eÄÃÍ8ŠÎÀ¯Ïî°&¶JF:Éäxÿ`èon°²Ý²-îÒ¬'1O£Xê¿åŠ	#O¸_!1f$è9ÿóø¯ˆ|J÷k=P‹H¤Ã³šô@õ
+§ÔÎÚZ’éH§æ¼©
^¶4„ÛµöϽíúiC‹ó(JžÝ: î=63¥èXÃÍÿ+;áØÊ Î“/[Yš”RþÏ™G?/ï	Õ¯51•F™4ç; çá„Öyû22ÊRýŠ}ÎØ#áv}k‹~±l/E6_Ý¢ÛK{bh2‡º'gyH§LŒ
ê?#c3â‚J(©Å!áÃø©` ”v+¹ÀA¸†QF,~ð¹->[†8›Õ1W8t‚‚È4]m[ü­õû–7ù=6ñïRj2Z¡GÙR]¹¬¶žpåàwÞ&_øÆSÀ}`?Á|mŠ¶X.¨S†Ÿl\€õP³nš°œi:%ÐSñL§@X*hJ‡ë†XþáJ_Ü€¶²ØE@5(3EJ…µu±,«²/z~¹jŠUY?ˆøWSóòïq,+Ë[»ÃDVèñóÇ›_™Ýç®·['bìe£Ûoè|@KgB³[Û˜p¶`ˆ2€~~¼£§
žï~üDƒm±Ü”µÅÚ)Îæ7ŒîM(™çoèyßô1—0zéüæÆ<ûÚó¯'ÎN5Kåàü½8+/Ï7,‚y‰ÔD*ùߴ±$C+ü‡äpf«¥Š ‰5µ}ªà,:._ÃñºZìÖ/,—v'ý†§N'ÃD4jø¥ò¡nˆàêÅ(j Ññkatˆõr
X(X±Z•ÈRQ-Öm³]û~ã¹?ZZ‚=žÄX	
r’ªì<‡k‚Åqã”/Æ<Þml‡ý]®YM–MM±© H͸ro7ÅcézE|iMOô8÷›CùèÛÅLF±ÁoèÑ>kÏŸ6¶Æ‘28¸$¸UB[¢eV¹ÜÐ8°üBP$­¬Š¾ÀÆ5QÎé‡Ôãùº©ªæ)Pûñêõßw5;dšïO‚aYwQÀ‚n_›Üaýâ6PBr¸À‘Ó<{Ö¯ý<˜9N:Û3vCÎd²azLãHzo{mœú›Q¬rïô˜¤è¸€äÊ®‹}ÕS"q;£ã¸±…:~&HÉÌÝ[§#Âî|Äå×Öd[^ßsJ¹ˆdz”‘¦1+w§CêDr–@75&Š‡}Ø×ËÚ%àêÚßP LoŽV†öàªSÚѽ³Õ¨‚í¸«ž	þTVLàÞNå#—Ï*ÇažS	’gP”P
+̃¤<èá` ®ð€…±«¸UTEÇ«5¾Ÿ1Ãvò—6†òÀºfË«]Ùï67zÍEÄÜ]BMú¾†2¾lñé
æD5ïöèl2—T1@ ?Bˆ“£4,i‰Ç·´-ã4T`ùÈAë-½¶ìAL¦êN‚h2
+ÆL4L¢d¢|3øa.&ê*"drPj’AÚ&Ø=¯¹¸CL¼Â¶mV%ž¯åùý3!ì1"â!÷~´ê8`
+îzÍvXT$Éüªê´N¨ŠÇ¦äê(ñG˜ ERpŠ†ùºi§k§àLŽ;ÞÈ`…í`ÝÎ]"p¿£g¨v3BX/±a ÉžžÄ ìš®+ÝU"‚í—­;^rGu†Qzâ¼çÒAuMõÈþöDŽš}Å©Ü9ÇSÙÙàzî¹#À{‰U¸÷çþc·ggŸ×ïѪ¸‚ýRlwÎàeŽ±Fh†a9,â°è>w4ZÓ«™Kwøð+=Ù®oˆ³öûlš®ç¸žƒ¶RQšå)GíuÓDÌQ´l¶Q>!åLfÛ™-îâtûžò‚Œï=€…‚bL¥[¨*G¼Ž*>:‰ã¹ˆé¹-Ê*°^Û~‚u¡Ddâp±»8þå¼ÆKãªrªŽ½î@Ùf:Œ¥b f‘+~ä‹çWð²ÎاŽU/!¥B]ÇìŒ`í@E—š\—ªS±øp.ìŠB“ýÂóÈ~âB*<ŸlU¡ AóCÐçºyªf]Ä(dŠý†	áâé3“	Q&uÓÓ ïðÊЪ#bD‰á“í{ŒLNh/ÈQwŒLä¡‚Z2Ô*£:8•‘ÊB±R7S¦ #ègým>¸èhu@ýPe"œc³r½|Àµá
9¬]wÐap•ä¸0
+°ÀA4Q|Ñ4[@sȃ|æPs(WÊÞ·"X#qÇáÓõdèñÕ¶Rƒj&‡jP!½­©àÌñƒ}Öñ9.µ/ÁX$<.¾à(CY¡ô¢á-5,íÓ ÂØÀU}ù®G¥¡ .*[`c·aéÔ(D¬£T©óVM§ÐÁ‡Ðà™ºû Aîì²\?³½NìÃ4\1.÷mG™Ü:§~츀¼,œ²qK:v€+(àÐ]=°#áuµIÓ±	ÜgØ¿VÍC8mMµL¶ÿŠ;iLŸÎiCgQ&ßL·›PéÊNC¤‘HB|,–PMVTË¡Ëjï†0 •iɵõ`e´[ÏHµ'GŽ©Ù1ÁÉ7©©HL”ßs‘êU×|ÞïЇ”ih/%{ÁU¬¸ˆ˜ÔÓë"R”xÆ[.üâªrÿý6¡‹ÄÝw¬†]Ñš#dâÐ'T¦ý©ºnÊ
©vaKse’Þ‡„ tZJû¦f„…Š_¡ÁÝHîJº½=ÓغLC©§¦ûD¡L
+®ÿ]ªÌºÞ£uˆœûè¼Zð[LSùK>LaïçsÚ½…Æ=¤?æig¿ÐÈ	Žëçw“=Fo‹*sá[ÉxPà,sœ`ò`zbå²ß=¡A 	½¶m[Ttk§$Ý?ã*Y‹GkÞ6ô28q3į®‰¢ëï&,‰›JÙÌ•4ÜqV©{š;*>qâÀwþ0ÄC@Û×éüSY/í¦w9É&-I	öC]`¨‚@Ùayqpw¨.Ž(4€‰aô¡‡Á1jåÉÒ•ZàAhIÚ‡ç ø"À˜c=æ˜A.pœU%d”å29UÕKQuÞÉ»qÕ É@çnF\¢£»I…->´…»üLWY¸¦ð
H·k(­dÜyå¾H¸L£7ÝÅ6 Ü^¿ÿùÓõ»ˆàüÙ_ÜøÆ,c?49gÆ©`V?š58‡-Ç™Ž
+‡#Ýú û“`ÞØ#þ¹?„[Wl5íQÈæþpÙÃ,-!P¾x	,¡z0"{å[íëåKà€E½E¿Ü,¶ÅngWìj€ê•GŸÓ°pVðÊY>Ö#£ô¦‘‚VpÌÉÍzêr—‹PäJÚN•¹æÂ¥Vj…•Iç7?=j–“ÐÒ¨™C{°ÉH=Œ…&ä(£UеfY>ö ªì0ăٸŠ%çû]bþˆ«!…:§¡âÖQB°÷l‰ž_×_&5+ˆÙì láßyÅ|S¸îË­g5íg‘ßPŸïæôølÛÚV4F÷alε© —îšFwoâ妮é2eò‚LJA=-<}„_V!™®¹3’‘_ëˆðA‡f䬂«ÁÖƒïuÍò³ë4Œ7¬Ï”Lͽt8*ë4dH.Få”Þ>’ÔÙRGC¬îjgÎ0£F,I½…ÀÈå\*ÊŠ.ý<ÄÄ„
+ÁúŽ²hÊ\’r&N½!ÄÿLp¸9®úüžÎwûv×x:Çw¹Â·ÔËfßBÛðò7/ý–Ð08î†X/‡»€å~¬ñ…r›˜”„©P’?w½RÛ'šcGgkøäHÛ¢ë=	ò\TI/{&ì8&Q¦¥œø&a©\ –?ñ·fŠñŽV
+Z ö`~` Ž=dü%:®‰ß?Œ±°ì‡O[m!»ÂOùÏÿˆâ#ÿ€Ä¢%N€u¢/Y'¯’Þ¡ngÖó!ëTï 0 QÖ·Ðí;Zbvøª!ˢŸÃöNPúsRþºÖ›1ÔKwÉoRþ=Â4W;9eÍ	Ùªæá>wñõö×wÚ85þ«#àÁ±éæ
+&þLpÌqX›ðS‰@Aã·ËúÁ2‰eÁÜ3}w8Û²ï=ôÃ=_A+ÑùŸÇly4‰Ž^,ºéJÐßÑ™ÄøòlhÑK¿GW&‘ODøÏúû¿«~ø!¿†²)ËäË?Óa¦PV­O¬+¨äëÿØ0Kªendstream
 endobj
-953 0 obj <<
+950 0 obj <<
 /Type /Page
-/Contents 954 0 R
-/Resources 952 0 R
+/Contents 951 0 R
+/Resources 949 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 950 0 R
-/Annots [ 956 0 R 957 0 R ]
+/Parent 948 0 R
+/Annots [ 953 0 R 954 0 R 955 0 R 956 0 R ]
 >> endobj
-956 0 obj <<
+953 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [280.9692 755.8266 342.1692 767.8862]
+/Rect [265.4578 743.8714 326.6578 755.9311]
 /Subtype /Link
 /A << /S /GoTo /D (server_statement_definition_and_usage) >>
 >> endobj
-957 0 obj <<
+954 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [277.6219 724.2256 338.8219 736.2852]
+/Rect [367.5441 743.8714 416.2908 755.9311]
 /Subtype /Link
-/A << /S /GoTo /D (server_statement_definition_and_usage) >>
+/A << /S /GoTo /D (incremental_zone_transfers) >>
 >> endobj
 955 0 obj <<
-/D [953 0 R /XYZ 56.6929 794.5015 null]
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [280.9692 712.2704 342.1692 724.33]
+/Subtype /Link
+/A << /S /GoTo /D (server_statement_definition_and_usage) >>
+>> endobj
+956 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [277.6219 680.6694 338.8219 692.729]
+/Subtype /Link
+/A << /S /GoTo /D (server_statement_definition_and_usage) >>
 >> endobj
 952 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F14 612 0 R /F58 631 0 R /F57 628 0 R >>
+/D [950 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+949 0 obj <<
+/Font << /F62 638 0 R /F42 601 0 R /F56 622 0 R /F43 604 0 R /F14 612 0 R /F58 631 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 960 0 obj <<
-/Length 3452      
+/Length 3538      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]oã6ò=¿"oçk­ø%Qén¶—âšî%)p‡¶Š,ÇÂÊ’kÉqÓ_3œ!-Ùr‚âŠ5q†Ãù¦ÅeâÒš(V™¾L3™X˜Ëb}_>ÃÜ÷‚qæi>Äúîñâã—D^fQ–Èäòq9XËF±µâòqñËìÓ?¯¿>ÞÜ_Í¥‰gIt57I<ûîöî3A2z|úéîËí÷?ß__¥zöxûÓïo¾ÜÜßÜ}º¹šk|/y…3|¹ý×
¾¿¿þñÇëû«ß¸¸y{îWÄ
-7òûÅ/¿Å—Øöq¤2k.÷ðG"ËäåúB­”‡ÔÿfݧSò3ÊFÆÊtB€Z
(bëä25Y”(©œŸJÜP6k—ôÌéÑUº	;+Úõ&ßæO5#ö-?W„§ª)ã+2¢µ5ãä
šrOƒ?Û†¿z)·]Õ6à-Ì@­+·€Bã}U×x †¹QfŒt{jJâ&ffáY®7í6ßVõ+òºn‹¼/ém]®Ûíëø“³UÕÑeQ—þ«Eµ¼v¶vàQ6û²N#Žb:›ŠCdÓ†ÀHó!ã¤!x,ÜózW÷Õ|w=°sD\h%ÖÚ·©¬	ò#5Ò6JÒXŒé?’à̺U»s¢K$iÂÊžûUÙÐèµÝÎ*a,·‡MíßÜ^:BZ¶[Öz°ÂR„,t"]W2Oô¾tŠƒ¨­S›9N*µkÏñ±"çt$/V æx•e³Û%.ññ‹±Ñ€g’±cu½u‡3_eJZÆA=·é¬É×NeŽSj7jZ&]·Ï0H3/=óf-*Û¶Êý»õ“Û"ŒÛ†>	ˆ¬nìŽ
-ùõò†d"D	u
-ùÙý*ïI»=«h»­—‘·«Uî$bPo&å2‡ƒ¥—ª››°*JQóH&M;%6>!B9k_I"£D$úmûb·¯€å´¢m*æeã<á‰e‘V¿M>`MÐmÕh阛†}°µ³Ïw7Ÿpq·×ÖÓDÕЄ–fösãÙ²ÚŒ-àè¤  ñÕ7³õµ`ñhÏQÉ™lµ¤÷ŠÙ\´uÜ©*5c[Í"­“#­ª~cY.>øðî86Þ©ÂÀïÞăÝö›NçÀ•®}ÒÏž^Øp:$”

PFc*òŒ)È„dY¥ô@2Õ¤e*p¢F½«Â&M#cÌ;:<Ä:¯Ä)«²ø6ÇSï¦ìâk‚úDrDž¥!ñÜô†?Å'†°]‡g¥8¿CŸP¿­ŠžgðhpªXAÂ[¸h©\>Å8.Û@œîµéó?ˆgë¾+·}^1åE»¦±&wÜ1CÍ0õÐcÅô1Z©d†:Z»¯àÈ~lyÜ 
x›¶é<Š²zqÛÈÒÚ5½ÑaДý¾Ý~såŽ%gŠààLñå%wšFEëVZ8ukµãÜ›…]—?£†§ +â&G»OåìK»Pï4†Š%ñÚ}È_O•[H‰„†Ù_GDÈžR1ˆé!Œµ²3ÂÛ2¯ê©@`"	¬XgX—`pYê=QWc{º 40“ìoä|Ÿo›)B@µLO9wDò¦Ûc6MÊ—@Ř5Ö¾±ò [:(ÏÈu±òÐ˯±‰'XR‚múmoYM§ü¹«l½Û‚ÕĵÉ?¢Ò83’¿ôeO©™•‚‰òâëvQͧêa
-wãPEËÀ‚®Š&„%räÛ›ÄQªRo3ùfS;¿!WÓ±/CÐî—cÄÁ+:è’@×èýúúš´m˜ùñ?`%eg„9…Ì’ÙmÏèuÇß悳ÓÏý¸…À;N]N­bï;pÿ™ÚBøïšæ\€©»‡xøéš 0‚@Àé4”i¸‡î6€øPèŠÙ"ïg]ìÂ'±’œ²’2+Éìëãý$Á)ٯʠ˜‡âR„òTö°jæ+‹P9ö<Ñ«K*Õ­?1ì딾œm¿í6LaI°œ^½9]ËÛ¼”Íñ†(
-UœÑÝÞͯ?¾®ï¿^e’ÔÁ_“c³mžº½{D?4ecFYµóH‹”ÈaãÊf0UÇ1:]ðÑ.RžKŒ>8WƒÇµtß"ll DU]õ¯„Qä
ŸøÎiÒ³Îqû2èN×´ð3C»ª/çûjQÒl‘ž‰–)ä̶çÜ®éÖ¡nŸ9-v3
-¦±Í]ÏM1¥`­ëÙ)
‡_5ß::®U6+ÿ€˜ß GE(.Ž˜*æ(ÞBtÌbÐÞÖqôÄì\¦¶¬®©Ó·§¡Ïé£W¢ÎTø#§Ì8Zðç®°ÀÁŠÃû±ª-*60Ä“)fJ®ÜƱãAZ¶WÜ6¸Õ²GIêdö´ë	a_u«á'©3¡© ŽSå²@™…›×}þz%„À¨o´d(`µE±Ûòmƒý\´m¦Ž«;”BäG1ðV²_UÅê(N:³‡B‰Ê2Ì›w°æ¶êó¾za|îíƾ0DçžàpyJ`xy6ïª÷YÔá³%l4²2~§äb/y–Ë!ÉÐOëv™TdoX”G)øò›1i.wÀƒ…r'³£ȺÌÐ宦lÅ œT2“CÇCf°ºêúñ‚d(×›>èZªŒ;Éë¯ØúÖh:*cq·>\VÛ®ŸNѬ
X°EÑÎEjÛ(NáXÆýZÊÝMØ…®oèÕD`KO_ãñŽe0ôiÈ,½H™ŽÚ΂z[n‘œ‘PŸ›ôÕvHhw½»å˜4>ÜÌk«CWØøvŒÈEà,Ù%MÒ …Y°’²^b¢!ô¡o=<	UO*ƒÜöLN¥:”jå
6\ŠAC%Sïm€tG ð×Û×ï”’kéT«±ŸŸÍY[‡„8RiöÎËë¼­¬­s
52w¥#‡÷&i4Azܦ˰ۣƴ‚ŒQèÞz%ØÚíWßyd¬èßÁÀ;¥8"uÉÄQÒ¢4W?™^ìF”É8¹aÆÖ0Ý%eœÜ‰#Ë>ª8ÄCÂ5H±õÇq@“ÒP"€Nú%eFnªmPZÏ;NUÚz|zl(çûF[ ï*Ls¤âÄ!P#™Iob0x®Û'WÒì	ä—;þª2uºS.=ÚV‹ÝiŠoXôÑÃ5bœ°aÎeÌ„ï:ªýþ‹‰,]§) ò›šmòm_;ÌÝû "Õì•Ëhvâú+ÑGæçœmBI3LžæF´¿|ú¢´ŸH¬u¥&öÎÅVJÍÁa|ônøÔ-Y%:ó
wÿ€YTDG©}È.{áÜ¢·Â|2srÉãš&ZÇid3ín÷irû|IƒûÅüùðƒS“?]×™<$”.¬Ód$Õ1CQf鈡Ç°ÞaãtµÐ%9®8èT5Y).‚>ïòzÞõyÁ}¢γÏWD19»á‡ØgtQã„oEúR_¸‚<$ïè„k¨`»„ ì%Ý¥w1œZ‡õÛ]ÃT¬Á	ôT—k¦âš¡á
-ÙgþäK5Xl±+ýÖ	»¨ƒTüµÀè¢+¤ÙeÅ72®0}ÑÇ¥êKâ-ä(YÆ:šÚ@×Ög㥈U”eæx9Ä:/–KËÂ1λÃÑâf’BœÏÌÛ<¬	&Æ“5$±s1ŠœJ–_¾‚ +ªàyE‹zû&\ÿÓÛ†æC¹§¹Dz®¥YÇ斦‹ƒ„NO22B5ž ”n:Ttî	¶¶ÔºšÊàC‡.=Oéz³eáûÔ†ìç×;·ëÔR­ºLFˆã:
"mýâ'VŒëé!P|1{¦7®2øWS©¬ßfx’D’$ ãÔm!œ2J/fÆï艪„#wÕX|ãD3ÜÜñ÷
zG™
-½åi<Ž&&’&ü„ƒëP‹=KeïeG·ëÔVWI$lfƉ«×á‹80åC?žà&mé¯$U‡'µ8cçE»^‡:º&ÁqO¾Œž§œ·´^žù.øà×s=ÕQj•tç£s¿yÃX &cP®×ÿïßÃ~,	ƒ²Vž‰©q¥r–z¦ymŽ9?œ;eý}üB—endstream
+xÚ­]oã6ò=¿"o§k­Ä‰zLw³½×t/›whû Èr,¬,¹–7ýõ7_”%[É¢¸"@D‡r8ßt|Á_|éléÌ\¦™	mÛËbs]>ÁØ÷±à,<ÒbŒõÝÃÅûO‰ºÌÂ,QÉåÃj´–#çâˇå/Á‡^~¸¹¿Z(Ixµ°I|w{÷‘!>üt÷éöûŸï¯¯R<ÜþtÇàû›O7÷7wn®±³1ÌW²Â+>Ýþë†[ßß_ÿøãõýÕo?\Ü<gŸ7Ž4ä÷‹_~‹.—pì.¢PgÎ^ …q–©ËÍ…±:´Fk©/¾\ü{Xp4JSçøgµ­Sé10Ž m’ËÔfa¢•&~÷Ò6Èëº=TÍ÷ª¦Ø]Å.(7eÓç5“à϶)y¸ßåM·*wt[þ>Êð¾+—@Ëß+÷ÎyÍp¸”ðÌEadÁN&.ÓHéyã+H‹1ÛŽ9ã;`á™7ûº¯"ü'Äc£ÃÄ9÷6õk†üÄt&iOé?0“àκu»'Ö%Š¥a$§Ð8¬Ë†[/ížqÖ`XDgØÖ¾GgéiE–%‚?"0ƒˆ$^)²\òt]){âþŠQ[›ëT™xª§×Š;w #y±1ïÀªè¬
+Ž÷Ÿ¬±¼¡Šbp´ÐP'œ)ûÒ0ÓÊ	ʹK°Ä$²@‡„šZM+¤ë]Ašyî¹HëPØvUî'ì7tDh“­J³#¢ˆµéªpa`‘_/o˜'qœ„±>2E,û:ïYºýVQö;Ï#¯WëœG ^MÊU˪›a[ìt˜¢ä1OšvŽm²Fy]¿T
+Bþ÷mýa½¡_‹¤¢i*eC–ðLÁ²PÅμM~Àš¡?9ª5~¤Ó
Ü4bƒ>Þ}ùróÛ`÷[0m=T
é’Ðÿ)üÜøkv¢‡.
8¹¥b`PüÅ7sGñu ñk	€J.d«÷+Ùæ²õ(ã$v
+d@éÔNuñx8>uÈ¿"^Æ„Æ%Éß ^d#q}[¼ÆX¯‹×€…ß—»ÔóSÉRIEÖ¼MyÀš!=9¥ŽÂÌ%é”ö—mYT+T`cÐÄ€É@;a4ïŠá°·'I¡3˜xh“‰Ü®‡øª\«4Üò¢³ƒÌCäû9aŽ7qì¯aÌ”““€¯Ò?3"Ù3$FIm1Â*bæÓ,4&9‘­ê×(Råòwò´cëM+4üém4:½ëI’uãCŸ(x|9Y@B¸îpL4B™,ŒÉ"3œIlè´6#ÎT³ú©Á”ZýmAZ«³oòë
AöXH±X—Å×Þz7†dß >`ÍPŸ	CNÈs¢M6ä.Znaœi‰ò"7Ô甆—J$`¨XCØ[ÏÔÕD	§&€Ó½@Jö)§Áyå®Ï+¡¼l7Ü6l”;ÙP3@ÌÔ×zO­!ÕB­it€ìûVÀrCN°…ÄÈã1¨(«g:.æ~CŽ=>"¦ehw_)ÑvlR<˜Tì<ç$i¼¢hi¥%É,­ÕÎeû.B	OW’à¡Þ§*øÔîfÄ; WN¼t£ØsáŽ8FF£œ•‰°>¥ñȤGo0•ZˆÑÌàäVyUϹš,vƒÁÖãW¶®@á²Ô[¢®Æhö|AeÁm&Ù߸óC¾kæ5*=ß9É›î€15_âB›Y=•¾©ð Y'¨#Ó%ÂÃ_#Íl9V
+tÓ{'b:gÏ©¦âͬŸP›uóZ`!íÑBVOM»›½‰,Ô:KÇ¢›‚y.„ø+cRr¾°»rÁ¾ædBû\DAøüD¡7ÀÖm׋~ãˆ$%D¹ªÄ–@–¥°åÌlLtŽÌ¼ûOœY%3}º#C:p*¢²ø¦]V³åvxSgÅË@Ü®gØyžÌ™÷Þ&Q˜êÔ«M¾ÝÖd:T,iuä󴇆Œh0Œ]1èú÷¯¯¯¹Á熑ÿÑS±GV¨,	n{A¯;!øö.Ä>“øÝOk	b´£”‚kyó	€û\“Ä×<Æ…­4¸ûòŽ_~ºfˆ”³:Î` _»í€øñÆÁœœGÉ}á—·’œo%•­$Áç‡ûY‚³¼u9Hæ1ËŒ‡Ërœÿ1°j–†,Ë!…ìe §™œ³;cXà)}^Û~Ýo…Ša9w½>1­ËÛ{)›ÓI'AÝíÝâúãÇûðúþóU¦X¼ü99‘rËÐíÝš¢9µ€03Ì"H*À†âi"‡UkÈŸAWã(ŠÐî‚™&gy®,šP%‰=¼¯MyÙÈ‚›*ªºê_£È?ʉk"+‚(âuûr"®yá'vU_.Õ²äÑ"/ü&Z¡Ëž°PG3¨üÖQõÔGOË}!M°MÕ45Åœ„µT½Ón¿j¾vܤ]ë,(ÿ¿ß ME(ß.¶„*Æ)^EL$l0^Ù±õ(ö­-G«®ù¸éãgžôÂÔ…ŠL"iÆÖR¦Srµ¸øSY[V¢aˆ§RŒ–(ñÆ6íA9QXÜ6xÔ²GNš$xÜ÷Œp¨ºõxJJZÂ-ÔÄ!6U	ªt°PH±y9ä/Wq£ç·F‰Ž„	°Ú¢ØïdFÛ`åm›ùJxÛÒ!6¤x59¬«b}â«5Úc²Ä©ÆÎ{XsWõy_=¾Ty#_£Kup¼<1²¼èwÕû-Êð«iÊ\hlæÞN{ÆX¯§=Å‘¬éçé{Ú4ÎÞ&<`ÍPžD¥æC¦£§¤%å6¤ÂzC×=ÖH×%š¨»6¨·I{¤ÒÓZ]†=¥ýeà12Ýk¯]»ýÌ€Ó×L=“×èË›p‹¸dñIТä?™%_b&”ٌͶ0dk„îŠCN©Æ±fŸÜéˆøqb¬qVvêÒ”²
+`Câ~%à8Ô6ȯ§½+m=>¶ö.|¹†È»ŠŸÄ£ñ‹<Œ0×”W2h<Õí#¥‚œ9{ð¡Ò‰Ñê2NÁ'–~åÁƒ»§KnÜt~À_Œ'œ+ýùº¤ôRÊ"J1”>ÝxGäY:ÙЙé°¾±óÕ†ZÉi¤ÁD§q¬}dÆy–<èã>¯]ŸR-ú"‘ö7“¢ñD¬6’AOá’>[ÅŽdAøšn„θ–óaÖ9…4;ILRË$8—µŽë·ûFê¨Û+yKnër#T¨.0”]!þÌ}²‹-÷å±ê:£õÀÿ80yôí²’wÊMŸÍi¶úœx
9	—1•–Ÿ9ðö«3MC•&ßp˜#¤×ý¥G¢¨l¸ÃEw¼÷‰ÛLRpó™}sÒù¦ï“à-“ÈM¶0ñšÚXá	&^>{ %Tð=ñ ˆÅµ};ü€{‡Š~íd’cªg$Ç”®åQ+×EKóÃAÂ÷ÅU'Úظ©3 u¡ YO°®…HåãË#¤Ð<åç
Œ”cÔ§nˆ¼p|³§S§Žód€ð“2Bh×éð ÒÖÏ~`-¸žÒ‘ƒ'îI†!¿5xåGxÚ†ø˹™‹†·×ÿûzÇ_/‚ÑΩWŒl”„ŸdSÈpcOw>ü’ï|ëÿäLpGendstream
 endobj
 959 0 obj <<
 /Type /Page
 /Contents 960 0 R
 /Resources 958 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 950 0 R
+/Parent 948 0 R
 /Annots [ 963 0 R ]
 >> endobj
 963 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [367.5469 204.2481 428.747 216.1483]
+/Rect [367.5469 174.8193 428.747 186.7195]
 /Subtype /Link
 /A << /S /GoTo /D (zone_statement_grammar) >>
 >> endobj
@@ -3144,64 +3124,62 @@ endobj
 /D [959 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 354 0 obj <<
-/D [959 0 R /XYZ 85.0394 437.6905 null]
+/D [959 0 R /XYZ 85.0394 405.7134 null]
 >> endobj
 962 0 obj <<
-/D [959 0 R /XYZ 85.0394 411.2314 null]
+/D [959 0 R /XYZ 85.0394 379.9387 null]
 >> endobj
 358 0 obj <<
-/D [959 0 R /XYZ 85.0394 188.4473 null]
+/D [959 0 R /XYZ 85.0394 160.1112 null]
 >> endobj
 964 0 obj <<
-/D [959 0 R /XYZ 85.0394 164.9671 null]
+/D [959 0 R /XYZ 85.0394 137.3154 null]
 >> endobj
 958 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 968 0 obj <<
-/Length 3263      
+/Length 3319      
 /Filter /FlateDecode
 >>
 stream
-xÚµËrã6òî¯ÐžV®!@`å4I<‰S›Iâñž’(‰±†"‘²£ÝÚߺ>%Oöá©)6F£Ñè7Åüã‹D1•Št¡Ó˜%O›ÃM´øsßÞpÂYy¤Uë«Ç›/Þ)±HYª„Z<îz´‹Œá‹Çí/KÅ»
-Ñòëß¿»ÿöïoou¼|¼ÿñýíJ$ÑòÝýßîúöáí?¼}¸]q“ðå×ß½ýéñî§Ñøêþý78’âãч»www￾»ýíñû›»Çp–þyy$íA~¿ùå·h±…c1™šdñ/ãi*‡›8‘,‰¥ô#å͇›ŸÁÞ¬[:+?1!AVSƳLR¦¤A€\±ÄEÑòíf“7
¾®Úc]Ú3%Ù£-VB±HFH#,ŠÅ²­í“/Û}ŽM~|Îo²
-g×4y¼åf™7í±Ø´ùÇÖYƒ _ÖõÄî‰l»¥¥´m½`r¢üû	ˆÕGbåÜ´ùîZFzù!ÏÇ·ƒ„"'!)™Š„#Î?.xèÉ= ¯zø(ö¾°&T­È>䛶ðÇSŒ3>Q%«=â×®þáæg*VƱ°«xÏۼ͊’.ÝñÏ}ý‚€»Px6Où¦ØñÅÝ<‡÷eÑ´
›ž…iÎÕB¥œE\ëgA¤Uë²,{–¬,ë—UU·–ÃÑæœKÆãH_ß=`Ílß%ç†q!†Û°²ù5ŠDnÅ øòe_lö HŽf(+w,;E‡'dxÒ	B»/h™¸ 7v@/3ÄhÊì9§!g€ûº¢
6û¬úè**Úu»-œâ+©X"DlOÏÒ$AÕ´¼HcД,€$-tÈÀ€Žx¿£k§œêd9w#*pf\&„|ÈÎH=+ÚzMû5A®[°Çð¼MyàR°(Ž=aÇ÷tw‘°8‰5!5m>!¯Zcò;Ð
Zp‰äžR§\{a*ZÀÓàƒà’ŽÅ֊ܾ¶·|9˦L«ÔsY?Ùû 5¯„Ì•š°MédyO|D¬®Ê3B‡<«ÀîN¥}çhún?|8EBÐ
-ÍÓÛá°ƒÇç:b©ó6}}é]ÒrÎ	;ϲËNe‹/E3t(OÎê.Þåø£j¯sJ%ïpÑÜ>,Ï%TTQk+—½€()ä+N¨Cºâƒ©Óy8Çz)ãôêÎiºõÐÿhð;JöúŸN{…Iƒÿ±üŒwþÇÚSMƒÍ'¨궨²ã§¾yÿ§0¦‚Êι‘&L(#Ž e–\ñ¾Þ ½ð*çC…sÉ\ðÀ;Øçäà9ïŒZqúŠsˆÁ5™ß Lè{éè|nnÕ\˾¸Ì7Óvù»âºÌ@¾þ¦.€&Y”9tPÖÉÀz±ü?0YÇ‚–¿ÂÛçÈ*ËÒç×’DÁ©ŒL®Ûaë²!¬NéŽùætl(Ô
¬Q@ý !J\e `Íp0°Gi%žŒXd¬‚Êè
ÀÎ ã¤g0ƒi´£ø”#„¨îLÏ4ÔÝ]±ÇK8}Ü#=Ê`ªË\BÀDðì nHSGj3Ò“–hÝÓmPK49m‚–Þ˜imzLÃKOq†IqV2•Ë÷uK+Û}F;n‹Æm‚™=÷±GŠ†>#ì*Iá€v;„¶µÇq¶bSù3`^4XÖþá¨iògÇ #œµ™_žÑª‚¶ÊJ\‘mÏ4Qvò5Ü Ä¹™ãm²Í>¿li‘d±1é+–Öúbi«³´Óœ._T_²ãÖylqš3A±x•‘€5ÃÉÀâ4$a¦¬©Å),NÉ`qvg_‚ÅÁ‹Ó^x6§õÁùr€¿9WÙ¡ØЋ€ày›Ñ2—B9c².ÚˆQвñÆyKZ’Œc¨Ž/È×Ö1“Pí5Àý´ÒP½|ô3=‡íTÊ…ŒÄôcš­Õy6ÿ„ì.²Á Ê¿Dð_s±YB¦küš7HÞËÔ2)eCÌ¢]:£Á'Jgw˜J¬P6B§Ìp‘…ãO•º^¾ÎĆ:zù”Ò!ß’{¼M!ÃEœ¼ÊÖ%á…­î	(¿Ad_ÇÎÈ	J:õÐ w™Un8âŽ<&‰6«Î^²_¾*ZÛzJ8êïîŒCFËç¬<9_p
jpDd]Í°Îe
-ÑJ˜?wÅÚöÑüqášfè
-¦T¨•¦Ç›£
-‚á‘¢%áÔœ@žg|ÙÔ§
-´™
-€íi³òåHFÆjT®È•YQmìݦÞ2ÒÐBz‚ü©XeÑžÛ€43ß©x©TÞÈD‰c;>•[„}o
-©¼í~´3Ù$.ì—è–U̵}Æc;É‘›2Li‰®#žŒ}Ä“^ÅQ9@±10À°?›…‡ÚNcyÖž¼Ë³¶½cŸò…ŸµŠ1Æ’ÜnûÇSÝä~Û!φ"Ü­DMîw”Šª±Úûßk]$ß´s½†äÆ6$ÃuõóÒ¶Í6Ÿš/)»vö$T®àv1hXddúJgÏ£¯úøÓH4¡:ìì+šÉI“
-¸D©!/“`°^a!¤Ÿ*òZ{‡º/ojô]Ì$”H®5r5Oèc]ÎVçJŸÕª9W »
†©AŠƒ
-EB_ç!`Í01HbÅŒ‰‡L¬*·~ÉÜ õlƒ?‚2!9êø&ËæP×ÎØÁ#„À“Rƒd6Y¾…?«iDá3«¶£Îû)¨œMV¤åä2ÈU[OPr¿Ë±
-É7—.‚Ð,…ðþŠ!ô°®‚ÇêÁ)Î.?N+Sð'†'×÷X3Œ@$̨1ƒ<9‰Ïé,Hyr,z•©y²}±gŸtC¹+ì춉
-huvá&÷„Õ¯J§™$LÙOYýdŒÒ„rH›QšÐêÄOÛ„+ô™dê —dÂsØQ‚×ñç….Ž°ß$¥¥$Yª§›7øÊïàSk©§GØS‚‘~Oé27Ú0‘˜I_ÚŸ®5W#ã¼*¾4ÒñL×ÙÙåÿ¡¹ÔS Æç4–„–Lêä•0ÖǺl½Ë5KÈ2öu9I/xÄYAçúÖkfïáFŠÅi2Ú|`¸R`ïö‹BöÄo<>ò¸”H
-ú@jï	Aå–…°ía‰@ÞõDp×<—^¯ÃîIN.KXÜÚâ .ŸsÏ.N13©Š§Ý™ó-ç|IJõóåî¢ÍòIÞèq©pìëãš°»Baë#E[Ó~—4tZI0‡XG¾&ª.½ý€¯ñ¦æ
-ÑYAÀ×6$,IuÒÿŸÐ÷ø{[(í2ȯ}†”à¸ÂÄú”°È*Ôaâ©>ºFHÊ}ÑžúOæ)ï¾ÔLrt‹›?Úõîà¥w-®:ã𚪣¡/…‰Sƒ8å˜Ma¹õG(4«Øyµª«™“¯î@Ðç͆H£Ä|éX2e¼³k³OX„ó¥ýé‚}âY‰¥¬•¨­øŽR<=¨Ð
ðÙ}Õµu͸N:01Ü,¸ÑÌHPŽÏø‰`©1fþ÷#«@qÕ'éœÎ€?)À9i¨ÛÆÊ¢Ò˜ÉDØšCþ™ô_c’‚(†[0é<àë&¸-A±—ÜŸôÊn!Tºè
-¯ØFœB0¡Æ½«±ù0æÌú<Š€“R%~;1
-ªôÓjÙ8û½m;äDŽ¢÷…à®·ÃÞCìóø¾â©œµÎˆ”~Ž	ftH·B¾àåÓ¯HIXtêw¾lÍÿÈÀÅ›;ZÉkÉ}¶;n\[ŠúT@2P“A+n\“ŒV¢ì,¹]< öžY²˜ÈÁÛ\]kóÁNÒÊ,¥'^¤»¡]©}3	«ì@CÁ
Ã(––Òß)Œ¸;Õ¾½Eàº)03T1»å`ÕC§¾Â›£gv1wô-²º@³~j7Ùf_T¹oüÎ椗 ;oÙ%½&iÏ)i—qÎ}€åKã?­¥~ÿ+Ék¸—EyÑïtM-ÐÏ„¶óìÒo!+°?ü›É$á?Éú¿þ}a÷ãËX3i»Á³)©€Ú"6@„˜²"‹ÕÅŸ¬MYÿ7?²Žendstream
+xÚµËrã6òî¯Ðž"WâA¬œ&OâÔÎ$ñxOI´DY¬¡HG”ìh·öß·ÝàK”<ûòÔ›`£Ñhô’³þÉYl…MU:KR#âHƳåö*š=·ï¯$ã,Ò¢õíýÕ×ï­š¥"µÊÎî×=ZNDÎÉÙýê×¹J\…hþî§ïo¿ÿÛÝÛëÄÌïoúx½Pq4ûׂ¾¿{ûáÃÛ»ë…t±œ¿ûáíÏ÷7wôÉ2oo?~G#)=ν»yswóñÝÍõï÷?^ÝÜ·{éïWF7òÇÕ¯¿G³lûÇ«HèÔųx‰„LS5Û^™X‹ØhFÊ«OW¿´{_ýÔIùÉH(
²: Ñ=:)â4gIœ
+«•öÜﲪyªw{Ø™Só‚Ÿ›¬™˜(™ß®id¿É	ØfËMQñKÑÐsuÈJ„ô¼ÙgËÏùê
¼¥Ϊºù -੨ M‘jûóÜ ™…§°hòÝs¾kxÎ`±P±Tð
+r!à!÷hU4ÙC™¯è­æQËz»Í*þZ’àú-Š£\<Š)™88Ÿ$JxƒU¶
ÄfBFŠÄiÉØ@WN]hÐMm#ƒ	¸Ö~¤¬"Š¢ùÛž ÞÕÕ~W—+F³…1ZI*ÔN2Š¤g$oè	^f}}à;<¨¼ÙïŠåÞïƲ†@I²4ª#vû3}ÈV+žÊËÖë¦dÊ€xQ=2+ÇfŸoA­5¨õ§<¯	Eh½4Ì	Œˆ>ígÜõ¬®Å^tè§67¦‰òúšY„½…àþ½®xå&«CEÅ«®V…W;òƒVÄJ™¡D^´sdEI„¶Øή™ò,ŽÓ$e÷3>Ž‘-„1©cFÞfG¢ž•
/ýÀë5­\W4€Û¼ò µ‘1°çûtu›àW!Ì€;È«=ÈÑ€€Â
+|‚.Á±¼ÀI&©L‚À(ûÀh©p?pH»b…"Ç×ýµœO²™(‘Ø4pY?áyðœWB–Öž°ÎÌ&ñü–ù(˜X]•G‚¶yV\J|—dú~=zxE"…è­iØ¡íËÃ4:›¾¾ôéÍ(ê­òuv(9h£Ðúä­¡îBM«üoa4#íõN©äñ5MÚ¢3òü£’Š¢­œõBq‚1$zÑõ±Î{¡«S{7»	'ª©Mzyñkbõ¡JD$­.?ôBC&Ñz!4³ÖÁxç…Ъjl>Ó@íQWE•íŽô黟èUPÜÉÜ%…äÌ:5p­\ÆÁÉ	YDߨà
Èêø–HÊ¡ÕùìŽyà#pÀ»:xNûn;2é+.€ƒrB¹¨¥¤ ÷´8*{¢û¾àÁ	~Õ·GÎp	Õx~ÖÆLî"Žäe#ëc·²«3³Ãì._€T_²Ý
+·<6·D
+Eú2#-Ö'ƒƒ˜—¸þ¶N-ÎêÖâ¬n-ÀÎâð¥µ8xñÚÏæð°õ^àïŽPvK~ñ¡Úo3šæS(oL蜒CÄHãý$O‰E0RÇâkE%>ÐAè§5†&óûð¥çª½Jù`u}/šA™É6Ìü²»Ã@•Cà?§¢²†L·íȼ!òA¦È¤”
3Kv醞$!úº¦$bA²QI*œTñP}Ãö¹HOæ/…wÆq“ ™?å; ´ÍWìÂî¯SÈp	'¯°õBxíÒ÷”ßr¨c'ä”BõÐ k™TnØáŽ<&‹6«ŽA²ß¼*Zl:Æ’ôw}$‡¡£ùsV¼/¸5ز®&X—:…X¥Ü¿wÄ	vPÃvá˜&è*ì$C²½íMQÁÈÈò”‚·ph Ï#½,ëCÚÌÀê°\„òJcµ£z´ðE®ŽÀÈŠj‰g›ËHÛîÑdNÅCQû#!P{Z€Á¶Åðò¨¼‰‰’ÆšM}(W‡¶Qy)ö›ÑÊl“4±_¢#«”e1ú„Çöþ‚Ò"ÿÉAM¨iÃñ´	O'åŦÀÃaoµÇòl.°½ƒÏŒ…Âí‚cÂT’ã²>ÕMi»r3iiµ’4¹ßQ*ª#tð¿—ºH¡û‡ßz½È%ö"Ûãêg¤{l7ßp^{ÚÔÓP¹‚Û™ik„ÅdírW/ /úø§‘è„ê°¯¬$BŸô¡v‹­òr[¬WX0*‚ìÓ¦CÚÖÞ¶îË›}gó
©lª“W
+ã>Öù<¡Åê\é³]4Ç
+t·¡05H¨P¤’Ë<´XLRc…sfÈÄ=åÃIÌ…Á/¾•ŸXPÏ}먔ŒYŽI›øÆóf[×Þà ^
+”$³ñü-ü1^Í#–žtПཟ…šÙ™Q3î7¥LUð^,ófoS	~É[ÂåébÇWœ(/Á!A½0áò¸ A—ðÔ™ÈK¸K¡öéiŸ–Ox"ßÝêW£U¨A‹ÇŠµœ]»jôõ6«ìªÖ#…æÒYCÀ,EG.½l}¬ó†Ðbu†àgïNËRð'NÆ—×o±&Š…³cy²QqÈéä<Ù¨^eŠãmžŒ/¨qøäÊ}a‡Ô&ö(¼?¦ÕÙ…ÿ¸a¬~UzÚÑÜ[¼Äì'cœ&¤Câ-Æ0Mè	õÄOc•:L:
+O2á9ì%Á€ïõÀóLÿFáA{év®™>(9íÕ¼¡+ª°BH­än’‰¨›#ýnÒyn'TìNúÊ´Õžø,pH;2΋âK£ÄLt½]þÚJ=a|IK	œ£°ŽîÝ/Xoë‚õ,ßr,!ËØÔåIz!#)b:——n±&Önd…IãÑâÃÕŠz÷ðÀ7‚ð
+HÓOH§.'’ŠïFhó=¥¸ÜBˆÚHò®'†»æ	¼ôz¸&S8ø,QQq‹ÌA]>ç]*œŒp©5§Ý™ãµ”rÎJõËù¾"æùIÞp¹pìëãcw…Â*DŠ}ÍëÝŸÓÐÓ’Hƒ9˜Þ½üy£ÇŸ~„oê*ÞYø‰¼Šù*þ¥u9ðë7ð´‰}J;É*Ôáþ‚¡!‹ö4Ü–§²»¤˜åè'7/a´ëÝÁKïX|1t¤á®Ž†¾>
+À©<ãÀ^Á¢?"¡¡bçÕ¢®&v¾hqzD>o2œ@BÅîH
6œÝ>ûLE¸œã¯ðIkàï\°”E‰bÅK’2c’Ú$ƒ
+ÝŸÝ•¨.ÿeP§@;é> endobj
 971 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [455.0966 729.7963 511.2325 741.856]
+/Rect [455.0966 681.8143 511.2325 693.874]
 /Subtype /Link
 /A << /S /GoTo /D (address_match_lists) >>
 >> endobj
 972 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [369.8158 409.2782 418.5625 421.3378]
+/Rect [369.8158 360.8503 418.5625 372.9099]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update_security) >>
 >> endobj
@@ -3209,105 +3187,129 @@ endobj
 /D [967 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 362 0 obj <<
-/D [967 0 R /XYZ 56.6929 769.5949 null]
+/D [967 0 R /XYZ 56.6929 727.735 null]
 >> endobj
 970 0 obj <<
-/D [967 0 R /XYZ 56.6929 752.0968 null]
+/D [967 0 R /XYZ 56.6929 704.2039 null]
 >> endobj
 366 0 obj <<
-/D [967 0 R /XYZ 56.6929 241.6876 null]
+/D [967 0 R /XYZ 56.6929 192.783 null]
 >> endobj
 973 0 obj <<
-/D [967 0 R /XYZ 56.6929 218.2875 null]
+/D [967 0 R /XYZ 56.6929 169.2519 null]
 >> endobj
 966 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F58 631 0 R /F57 628 0 R >>
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 977 0 obj <<
-/Length 2662      
+/Length 2708      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]“Û¶ñý~…úT]Ç„ñI‚öÓå|v•©ÏÎE™L'ÉO¢NK¤,Rw¹vúß»‹(’¢b§îèAàb±Ø]ì' &~bb
ã*Õ“$ÕÌpa&‹íŸ<ÀÜ»áq¢€u±¾›_¼|ËIÊÒXÆ“ùªCË2n­˜Ì—¿L¯ÿ~õq~swIç1»ŒĻßÍnß$¥¿ë·ogï~º»ºLôt>ûpKà»›·7w7·×7—‘°FÀzé)œYðvö½»»zÿþêîò·ù÷7óV–®¼‚+äóÅ/¿ñÉÄþþ‚3•Z3y‚ÎDšÊÉöBÅŒV*@6?^üÐì̺¥cú3Ê2ce2¢@­ÆhR+©œçë…Ô®®EÊx‹¹ÃÙu“—QUF±GîÒ51‹…Ò¹Ú5EU‚–4Ÿ5ü«tz¨ó%AšŠ õ._«g¿lòý*[ä~]V.»ÙUû¦&XØäi],.Åt= UçûÇ|O«žŠÍ† $
-AWÕ¥µ'	èO–#E¹¨¶Eù@çýùïÇ–AÒeC£CÝbÌ>>‚ý!=>‰¤`J%Æúy
:­™¤£µ+vXÿ¾ŒbÎAâç×4úψ¦”zyBÊü•sé´Ìí4óM8ÜÞÎIÂb®­?¯l¹Üçu=´dÉÁZÀàb«Xkó5¦,Yj­7ä(Œº‘ö˜öOTzÜ™ÜfÍb}Â"Ú½IÿŸ<Š_bRðJ«úL¢mš4,Mâ n4ºþÙôOq~'¾Úñd
-~ßu¼@]ÄÞ
Ð6‚€Y,«ÜFY5º/ÀuÊ`6aÉ.ÛgMNÎ!ã”i	1¥çuµø”#
e½OÛiž-Ö4B_ QëÑô‰Æv)µ®=Àý'ÓÂÓò,ˆEÄ´'¶ò®=¹j—£ä‚ðY?ƒº¶4^gžN^V‡Ï×ÕÇ™Ç<ì0’wíJFû&iÂòé¯ÜðÖÇÙfóLŽüooQ•°z[Ô© woAÅ×4V:U4K¡ÍM_D-a')Ìv:+A˜l‰çi½~‰,¢¦¥.âNN=–!â-™Óõ²/¥h½Þ„ÛÖ®ºÄ€D«MV¥“ ¤Wããn“7tA·ÚÓ¦—e]=åh“Z=¤Ýó>_g ®Â-³>ƒX~±Î¶7«ÇŽ¯Yg>6ÓÖ™õhd¾É…$¿…‘˜V+‚€ý7Åâ°ºoÒ+btô††Š“‹¬¤A¶©+ºÏ	Ò	Ì ©’pŽ“Ö:¬¯sZæ„të¼Óî܉;ÃV¯ã©üŒ‡vUá]sX/g #Ù‚Ð烷¢
ù,ÀQKøÿ´ÎcO™˼.h¥'L†aüYâÖd aþþy@oôÄÞ6MF795DNˆU_9Ñ"Säôܹãt|å!ÇçKôõ_«Çß3´ý#Ù5J¦´²}Æ{ü¸ü~šð_ãéBr.	©tØ_$çâÕòÞ¾zõRÉ×ã;œÖJQÁý¨TRÜ@àÌî7h\{Ë`éÜA­Ô™%Àˆ5„Egy.hà}	憾“iŸŠfíˆ5V`¤×hÖÙ9Nt1€»Èê¹Q(ñ(RãÕ'Rí,!ÄŽ¼!Eœ,<ÄeQ(éß©	gv´ýëwšêŽÂâ’Ö—ÝIå÷qJD(¹/Ž\A”1´£Zú~DÕæü2•ÓŠly›}ʇŠS©`:¥³ñ™Çp:ÕPýž‹#à@Tÿ~ÁAʪÌÿ„ýÎVí‘!%³©þßCÄ Žõ¢ûYúæãÛTÉF¤v/žN"mÉ=¬€†Ì„ƒÊ~€¾ÅÓ½:ú#m|iÕjPaTG-2Ögå_šøTVOܬ¬Ÿ—z=\“Ñ'´Pµ¯PáÐ]E£Zõxä—T”Xê#NËǨ* ­eJšpZŽRTW‡ý"‘7jÑû³=OŒF±/¢Ulúe+ÎPŒx€C=.Â(æÁ >¸“¾}„4›„Ò"´]¥Ãv]%bW¤n€ùªIQl!§œ„ÅÇJ` ›AxèêfÜò©¶=Ëgt`#™WCc§NÛÉY•0mE𾢡”²Dã1þ6ÆãÚÎ0~fàHû¢þäô*jêR4ü;/!¶o‹¦!%uád? Úì#Íô;à.c¡„ÇÐBš ÎìöêÍ›“ë ÃSf¬H&
-\RÙ4ùæµ¥uIÒ]O—=#$3	7Ç]Á{ûϱU²8ÕÉQ«”2"m8“ÔÝóï¯JR•«D(Œ1ãö‘ D2h*ô]§L@>þ#ãúÐ6 [G"ìvO\:G.v Ð0¹G®¶^Œr·/‹Mþàf½sèXø6rE¶¿
Ø&_4íåì"ß7Yá+-DZïèæǶu•AséK;J
ù«/ßÛöJ
ê·Žp"¤aF¦
-¸«Uúº&AŒÎD{%Õ¦€ÓEx•sþÚ›S¢ ëLÍÐ;NùÓŠéXžeOžg/IÏñŸð7öD"¨RûU—¶²Yê’íXR„ÁkX­Òó´hZ~Vòkû•*è¸û’ÒjÖw",^úÓ–´}Ûñká“–Q­?~€Ð|E±œÞ4µÎ8›à~°õä3è’ù*BꌨG8ÀËÙVLÞT Ф#S u);¡¬îú¸„ê
-BëD(h±h߇ ŠëÖl0¤÷op}ÿÛaã.i¥¡SI»å9ö'S²ÍK‰ê—u9Š-úðaÉmçù ÀÕ¥â.çãÇ}…]5Ž~zó‘0}\ÃwÁ¬Ñªï)ók¬ÿ¬¼A†ðî†2žÞ#“w©iÂu¥»ïê	ží ¸¬sáÊÔø‹`φ{`,‚Jsœ¢¼yBÄ…|öø¶ú¤ýÇ{R‹—wع꿱º!šm‰ƒàV64G&,¶&Oø6ßB/6)TpÑñ1ó›=߀ÐCëð]”·!ö›_aaA'PM[9þÀª '°jm5Ô~¹w'"ðd‘)r}}òÝÛ\Ns¹Ì'×·ƒ½
+Æ‹BL®ç¿N_ÿóìÃõùÕi&
Ÿæì439Ÿ~qù†(Ž>^ÿtùöâÝ¿®ÎN­ž^_ütIä«ó·çWç—¯ÏO3QëeØá‘o/~<§Ñ»«³÷ïÏ®N¿þáäüº×e¨¯à
+ùãä×ßùdjÿp™r…™<À΄sr²:ÑF1£•Š”åÉ/'?÷fýÒ~FÌÒ&Ô* q,WRyêåT5«¦¼YV8VÓí¢"bS®©«6÷Õ†¨mC´u»ÙÅ(¢Ü¶¥ßáâÍ”óùæTÓªë–3ËŠøÍMËfþØÞB*M´ö–(eóÈž´˜N‡«|2!˜3FzeWålQ7]aÝÐgSmi ˜¤ÁvQRÝžvÏÃÓ¬ßÝ1-Ayq™qÀZ¯”¬ì¹ç\Öݶj2–‡·¤Ñ.pFºu5«ã\VóQÈ G10·	#:‚ÆmøÂÈ_×`¦ŒËêf[mnËYÕ‘ŠYn˜µÒEMµ—êšà=P8x®tÌîó„š&g¹P‘¹]ok/‹˜+7ÝuÕœ(Û–(„ÛOèõ×C‘‰‹,©ç
+êÝ-ò°¨OÅt¶8Ø«ÇV,õK ¢{`,دµÅØÀêfÖ®êæŽÀücWmê*Þ`Õðw]Ïqñá>OÚÒ¿U0c¨ññ=ü÷4Ë9Ü^óéþ—@ú`g/·C‹BB1-ÃÄ6^îèdkYÎuîî üI!¢T)ç€É3âŸd®(ŠtôËâ†ÙpGÙFÂøŒ[åö“·oá‚EÄ`iÜÿSƸãç„ÔBy¡ÆB¢m%.Mælᦨ:¼›‘ã)Îr­Ä³O:HCÇÃ"òàhÑ
À,æmƒ‚ nÐwšh6qɺܔ[
+»™ÌÑâ ¼£kg}°UEðiÝ¥wB¡/Ш÷hú:Žò*Xª²Ó:ìD„E›é°Ùm8p¶k×J._»O׊Ƌ2ìS5íî.Èuöá"pîÖ>‚&KH{.*QðéoÜðÞÇf`?‡—?·Ä7kX½êˆêaêÕ[€ø5•vj˜$ýôk¢(£%œ$ n³^4 LéSDð&²ˆŽ–RŠt1AE†ˆ7Ÿ•ëùXKÑ{}¸ž£”×o[ôh±m¼Î@%\QiŒëeµ
ì„-LDl=u„fÐeÑ>Th“Ü¥?ó¦Z”÷Wí—!ƒ|¯bGUÊ.u}û„OGSdNgù3Ð\Hò[	_” ì[ÏvKÐ'\‘c€*Nΰ„ÁA¹ìZ⺩ˆ2NõJZ_©à$-tZßU´Ì+éקÒù÷Æ£"ßÀSù#:„"¸è¸
+	uÃ^³P–Ð×»`EKòY¬4Bqô°¨@âÍA
3¯ºšV†É0X08óé°
+ò†—¼±÷»å¶£KDN
‘bÕ³#§=3EÎ ¿N/Ws|5GÐ4ô8þY¢í¿Hd×ÌY¦´*Æé}$ÏïÇ	ÿUê’sሪéÁfÿœ‹—ó›âåËï”|•>ḦP‚)‰rßD(nú&BñÐ ‘š$õ6
+To–@#Ñ‚U)R¼å!¤ Að%˜;ô%˜ÄHûPoˆXcEAFqf½càDº¬Aª $£p&À'œö’
G²!Eœ¬ÅgQOhèÓÄ3kZŒþõ'Mn†H{eqIïË~Ž´
+çx‘Jî‹#_UŸ
íËØBÕêä´%[^•«'ú¾_Jµ!þVcõûXzªþUO;HÓ6ÕØïßèÜž"âØ—6r_%Kh“Yhþ‡†ªPÁ5Ù7¾|èÈÀN8`ö34.aã³}¥Œ¡´L(ÑC¨¢6j 2ÂhÍ7[šøØ´¼eÓ=/5{¸¦¤¯ÐCu¡DUÖø’Fõø”—´”YBN/Gå4SÒÄëò;e]»Û̪„¾YÏ>N™ý…b8ÊC­r3®[q†‚BÈjr‘FAÝÎ'y˜ý#ä‘ÜXÊ#Èз•žÛ·•ÈÝÜ@e“¢àB2O%‰‹÷¥À6pˆMÚôc?<4}FW¶‘H½:;uÜOl«,Ó…Ðûçã³Ú˜ÀñmJ4Ƶ‰’a-Á“6u÷ÑG:hVÔÔçhøônšCp_ÕÛ-¹(Á…“ã<‚lþq+?|ˆž’Š%<‡ÒDu..ÏÞ¼9zD4Ü1S;‘N1§uþÕ-j¿c6Ü’^‡â!™±ÜìOöïåRªd¹Óv*åŒLΤ4#ûx6®i&i-´t‘‡Ãbv(‘`Ö©§,EpÆ]žÓ¦¢œ´7
+誼Q@·³7
+_ÕÓ伺]úêbàK³[ÝTa‡[o‘-¬ù>ƒãÇÝn_ì{WÏ_×ßçDÛ­Ã^M „tšp]0§L>NôáUÍÅ^ÙÙX߉b©åÀsµQþ¡d
jY’Ë7·Á{zm죀2,©h#!z¨"~Bf÷:ÛÍ×½Ý_TÁ™†ŠyàÔ·ñº°u‹²YÐñ¹aÜ5LÚ|¸ˆZÐLXÅöV ’H‹§Ó¹ç˜Ç¤3OIg‘Îì¥;,å„LúŸÌÚ€Tæ1¢_˜ÀH)$a-’IaÝ8ø<OzÞ‚Ú±5‰ —ƒ*–ÄóT…¥X¡ú§æF`{hgq˜Ó›eaâ“›½¡Â|ÿêS”ÕÚd¨<ƒÃ}=÷N_‰ªØû¶w›rE¿Ÿà¾CF
OÁHñÍ|’“l7ø]ÝÇÉExq`fõM8$„†°â+.£oªaP­Õ
+‹åi¹$Š¿
ÿƒ°¦öäÅ9
+ž|(>][MWmKy_ÖK|I]“µ¹ùü5YYèñ5ÁØ(û3ú_\gí&FѶ¡ƒóû§Y½'|ÂyEª¾…z¨»êExJ
<‰ój2UÐÜQqíÆ®ß>4ã¸üòó¿g¹×°§‘Â|K£Üež|;r¯¿±gê'~eþ.ŸøAž÷±ë«þßÿoæ¾¢é_ö´;Q(Ô[Û£¾"þŸÀ±èKì’endstream
 endobj
 976 0 obj <<
 /Type /Page
 /Contents 977 0 R
 /Resources 975 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 950 0 R
+/Parent 948 0 R
 >> endobj
 978 0 obj <<
 /D [976 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 370 0 obj <<
-/D [976 0 R /XYZ 85.0394 388.7711 null]
+/D [976 0 R /XYZ 85.0394 361.5999 null]
 >> endobj
 979 0 obj <<
-/D [976 0 R /XYZ 85.0394 358.9876 null]
+/D [976 0 R /XYZ 85.0394 334.6283 null]
 >> endobj
 975 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F84 802 0 R /F86 982 0 R >>
-/XObject << /Im1 795 0 R >>
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-985 0 obj <<
-/Length 2975      
+982 0 obj <<
+/Length 2981      
 /Filter /FlateDecode
 >>
 stream
-xÚÝZÝsÛ6÷_¡·R3Š~iâäܹ:¹D77wmh‰¶8‘HG¤âºýíbISrzÉÌÍt²èn[ßä[jÚ–MK”7ô^½cfð÷¹²ø<ϘÅFU¾+ˆjŠýgBŽfcÓXÉ/˜Ë=CSTÌpývyõúßDï@B~Wx'ÐC
-Ö.ÂåaSTÅgРÅe@ì¾eõ6Ôºªï‰"ª€QÙa]Rä„.Dh±þã—eÇñ®DÑùNo–ãZá÷­XG?÷Kºþ0…R}Uûç°¸ˆ
d£
꧌6ÅöžIaxUsÛªâÝÆXyY07®ÝÚ0êÂ}åvKÔ§C¹úè}įpka滂'©h,,1߶jä峪W·Ãe)®ª8’õýA™^Q5ò„„Á¿lª
ó65$h¿-°™wåç¢â&~æ¡vÊŽ¥ž·þSY°KCéÖ`dÜ>¿Çi!Ŷ$‘÷Õ°ú}¹.è
÷wj©N_±ãIQ	=»r‹U°tcm9…±0obõDÿÚøÍpfrL& rýMð¼§7Š	™ÆchÓPR@¢­'dZ-¬NLW@OHXÐeÐj|ðñ¯_k—ÃØ”TMÝJž$h8U
!³gñÆVÈàlm`KV¸	yŠö
-¨Üî‚g­}Èny{ÌLãä¶.nóÖÊf”‹Ý}ËéÕêW™ÈŠ“]ˆïHãº1¬rŠlað«ÓP*DcüLìqÉ‚÷j—ÿ¾	Í»hË]±(«'I1Zݞ׃y&ÔÀ
P¤Pgô¸ªn jñs²PýJÈÒ6:T•Åн­«;*ª…y(*ÇcX]õH#weuhn&$!uäû]¹ PetUÙSøÞú‹P¡´d ‘
šÈ
”ð
Y{8Ø¢Üvôò9ߊáÌÚ²Øü±7k,ÍHâY$(…ÓäÔÕV@RŸë4’:®I$•ëí$’âLX¨ŸÎkÒqM¨2D“™Sv¨ËMªC“¢I!:>’€FOÅç½×½¾±ŽZ}=¡:d©Yp‚‚M‡BžÁï.ÅàR#p)ÈqZÿ¯àJOaK±õÿƒ–ÊD¢uú´z\g ¸N©úÐ>Rp:WNW¥ãšÐe€­Œ%©}eÞZV#œÅ±*í àµªð} áhå¹}´"*ÔR„)Ouæí<ŠéʉDJ7¬úþ2ÑJã¡3ö<¤ú\§!ÕqŽV“‚b9vϨÒqMè2WV#GÊ!ed€”‘r¯¤:Æ+ }¼‚çD¼‚>^É€-ëã•$lÍCÜÃñJ¼ü(ÞX
-gW5:þÁ$˜¥á| ÓØ=°×€._­û2ß.>Šýãb—#y&„"Š6"!¢¤_¡y´àÔ6²hcN #Màp.Oè>šÆBÇq<	¤+G懖£ùñò3˜:¼ù¡
Œ»:ì	òÞö~E4†ó›‚’üIòóc02"	Þpû;Fèñ·‘ðôYž›šR4r·ÔA™¾+Ã>,`ñ#~–„ïÐïèÁ_‡€¢¯CÀÎÅ‹Ý°¼°jì¯'ïþ‘×ó<‰
>ãA箪¹”8Æš‰û¦uݵҗ˜VILËáçªÂ;MŠ{š.ùá.\/.ãpc¸ƒXG·Ô±ƒ“U6òÜîŠæ¸\üÑ…ÂÁ-QÞ„*†îè×ôzhº'v#³"-ùs10‹3;ÚáÄ:¡zæûGét0	Lý>¾Ô»­÷»üií«gÌY
:¦§*‹)RüP××¾¾)—ôK]|]a*@â†ûÉJH±9ü ‡šˆ5Ô°^MÇJ«j¾ŸÊZ&ÖÅ!oPà&˜¸ŒÁ¼‰ÿNaäÂJÿ5”NÕ#Ï7é	$™ÎøF9ö_–Ó!~—Ó€ƒ-Œ;…NrŒ8%’Ô>‰®‰å„–ùòƒZB{=ƒIÖ•Iž¡¦çºðGÒŠÙÉ-=7ëC‚ø	¶\ÓǾñ¹B£ØžMxk¤E”'ãO'ìå°Æ_3Ñ4T¿, Ô«ëÔÂwÁÔêKlåXÓÇÿå¶k
ˆhHØzê[O­Iƒïþñ"ÉXuwß÷ùê#ëî?1ƒDŽ;ñ+.“üYÕ„“Êîç_ý¯ã§÷8ÆZ=íîbblaV
-—Û§NB0Hõ„êÿ«ÂÌendstream
+xÚÍZYsÛF~ׯà[ ªåd.€äÉñ‘U*‘½¶R{$y€HPBh”¢líß¾‚$h'k?l©JhzŽîéþº{†f¦áÏÌâ Bf³Y’ykÏë=»ƒoß^á™÷Ló1×77_¾
+v–©,Ø0»YÆJ•NS3»YþeÕ%Œ £ç¯¯_]}ûãÛg—‰n®^__Îm¬£WWß¿dêÛ·Ï~øáÙÛ˹Ic=ÿë³77/ßò§ c|suý‚[2~œôíËW/ß¾¼~þòò—›ï.^Þ²Œå5Ú¡ ï/~úEÏ– öwZ¹,gð¢•É2;[_øØ©Ø;×·Tï.þ68úJ]'õg´²tuª@ï¦g*8ëH×MW|u9÷6Dëü×ârîtµ»í¥I#zK£î^ˆm^ß-Ó·ÒÖîVÈú³ÖvQuW=q{•Ów2âªÙ
+±ØmËîéÒÚ}ê£güiY´å¥Yn«~ðò÷¢ÿ¶)ê¥ÌÝÔü|È·e³“ÆM>ÇÝ•ÌQY[’o›¯‹®Ø¶ó&ºÝu@¸,z,ð‰¬‹m^á²±™å^4ë5LÇ¥ôX4u——5¿ä¬Š¼•ï&¸Ô3¹i¶]Ë?kØi¾-¹5‹š…ÑŒÍæ	BQí‰LSµ
SÝ=L9!mŽ5!jŸÚ®X˜ôµÊwUÇŸh߸ýñ¾¨¹q×K¦Öù¼•¡º¦á†v
šá6Ú@lëîË–›6»í¦iÔ¬uQNú"†\æÖ6Z€L¢âWBÓÆž½¸ÇN4¦‡e—qI1!å¼COÀ.5ìõR¸Æ†ïœ26dÂÅË÷°Õi´«ë²¾û%–룺x–~ÝqôX²&|”ïºfwåB¬šn¥c¾ÙTå~Í àé’m¢•‡½þ׌æY5ù²X*ÒÚÜk§Àù­â
+vÀYCýðYÔ‹f·ÍIŸøÞ5ü›FϽëýýt¹ÆÁ°6±²°šùƒŸï–›9ùéÊS­BHbé€f1¡­tˆýxÐð
Ò¡ø
ô¼(l@ŒVÄaÓcª`bÀ, ó½”³¹3N9›$‡Š›‚3Düœá+;=PâÓyÛÔaÒ±¬º`,nX±Ã¯ùmûÊ:‘×êVFi€o+3¢-ÀþšºUƒã¤Ê¤&#ºMc¢
+à€vÉ+nØo<5sã#NrÎÒ Œ·ñÇÌÖª,I…‰=¬åÁÉñ‘Ø°îË[DVla%h\Ö»âgÛ¬¥…ðÑf.z…X„ÅoùzSÑŽZ“ÏèøpG¼¾úú·„lùEü¨ºé˜n§D· ]b~Ôc­Éìˆ.ý|Ý}³ëgâ+¢Ÿ~³-åÈÄO;…
“¤b‘¸dU´BÑ×Lm=…]­DæÝâžµc‚Q`çde@gã½%;ëÁjÕnÉhGô°Uœ*ŽÚM±(Ñ~˜ÃS”£—o]±Ä€Æ_Û¢ãO¸­Øð~WlŸ¸‰V!`|?þ¢ÙòjÚMS/I‡GÝò¶rÃPqyk)ëÈË
+Çîu]´y8øZJ!ŸšjÇ®Ð÷Pl¹¥O`–E•²ËX‹Ã	c×{†Ì}U®QÔ¼nB`x#ð8ãJDs8ûJ²œOó€\fAæ€à!ÐÒæ«¢‡£=´”õ¨Ò¾	⌃>×%l
¹Q7	=7ýX’~žQ¶#SºWêU›>æM¹ühˆÒÙFÀ'þpÔðÇGm6„°(ÿwŠ“Q'ÀYgãCMLˆ1€pÿþÏ×S»7±¾1ûÑB¡³ƒjÁ%æ …Ï4åªÎKÜ÷zœÝâk+Ùf}×·,Ëv”xÉ]|%\9?6ùÒžÆB~‡…r/Nïý¹-v>U6í7ƒÜxÞ´‹bBº`UÐCÂO!²J‚Æ“lÈ:âø8ªÓ\ ß‰é|†µÉ¶->".¾;ädÞe‹EJ{äAŒÓ#ƒ‡ ¾lÖPĈS±Âªwë[¨JŽ²‰×-kª—ÈúÔ¹b3FQ¨ÚÕef^SÕ&Xsð.;?÷Ó0–}áöU½‡ði!y¥ÃæÐvƒ!‡™‡²>¤ZªÒÑFÅÁÚt­bˆ²Q¯ÁALtÿmtR†Ã˜`A	ì-ÔÃ>P>{?3Jû,sÌ4¢IÖ½¨áË«µ™½h@¢ÙH¨~àùxd
+,hoS J‚©¥O°zOí=„±|¹ÜRôc=¥žB/?OJÃA:îUµLR!±?]Z°¡¾ÛxA!QÖ
ÃF.ÓÉ:80`ËêÒiŠvør™'S?¾xÃœ‚·€|Ú¨4öþÐ×nž¿ÁäÓ÷kƒôX'¦!ºÅER"Ô'¨È¼¡	Á—¸©–¿55ù²7ÜBkÁ†ã90û	îÌxäêsòI&@¿¨@1KK(= ¥”=Á¬n#crº¶äæA‚?õ!ôËÒÙØ>͹ÐãÊÃùþ\è“]ßÆ*Ž½û,c%ê5ãÿ„¤}s0â ä…ØÆQ\§.|NqÞ«ÌgáóÃÈxäó0i»Ê´g«|Wlpt6tŠÞ€|®/C:Aí
+-¸ tø0L$±r>„ãÄê ±Jûá¡v‚$á#ئ¢]=ç½c¼ÁŸf3ÿÿÞFü9I©G8ë Eã1͇½ÃfFÂýçôëå\ì?¿wŒG>ï6‹Ô†£Ï»†²SDgLS)(Ã$åYHÂ1fË-˦~:@¢ÝmFQ‰ZŠNªÇD-¨•Yž¡íø2R|Á4‘ø·ÍçWüWtÃÎyÈx“?Ín>¿‡ŒM1QÁ¦£|oêÇdVðÅÃ-Ž	*ÁTªž5µä¿7Th†a¶o™Xx’\¶ky§ªž›*§]kž€Eÿ/ ª²Ë»‚›~§¥Ó°
+ze[‚Kt ªrMçûH72		²¯›]-ŒTËc‡&_ò,g÷÷sRùÀK¦
+ã¸zçÃ-Ìë‡:|Õà™BQQ?.j!Ç’z†ò*xþ>(~˜ù´ê0*1%ô®³ž¹’b¦ù˜ëÆÐsQظ6çÀr<·Ñ1„KðùN>pMÌ>¶`w2û‹“ñšŒSª|mÝUÍ-„`SU¶S|œ•DWo„¼ŸŒZî/ç6ð	
™j‹í[‘M†ët|ü&¡Z:7ƶë×7W¯þÉôfÈñ¸˜ópÀ?›¥áxûP<¼.àÉW²¼{n]4›'¦Ø$ûcó »×Œ£ð‰/ð4-MʼnïJ94Züh4Ê^VxA½Ñ)pôýæûBfº~7•÷7sô\âQ°w›ø6*ÓÑ}Qm„$sÎðÈj‘	‘¯?#ËHr®2)Ö³Þ•€
×"ß䔨÷»rñ+ùu¯Šý…@&þ}Aļ’	E|YêÕjò䧞¼tåXGþp|©5X°ýÙ4Û¦…pMjeÞ•|φMòÌ'f„L*Ùg~´û§sYÈúL®E”Ä£@,ìḂ%0£è&j@úm¹,ømúhÈ8ùºÏNŽÝp¡”<…øŸêìx5r-æ rÒqzt/öw¾þÌܤ\¢Lì²±ˆ÷¼ò!µÐÁ/{±a:HtÍÔé§U©‡»…fb¨ž=PûÞZ	t>´’uÄ+06µ™2~ä#&Á:‰ãC“ƒÑ{g!…É.$±8Pé+ÓÃ¥XnHà&lÛGºþ€7æ8Ðíï»c†¬Ã£íõ¦ë/òx¹@áE-¯Çw:š¹éþOnÆú^|AæÎÅ
+¥1Žô‡òAFgj§©ŽkP*ŸÂ ²(T¹OOã¸üjätéÿ .åëendstream
 endobj
-984 0 obj <<
+981 0 obj <<
 /Type /Page
-/Contents 985 0 R
-/Resources 983 0 R
+/Contents 982 0 R
+/Resources 980 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 950 0 R
+/Parent 948 0 R
 >> endobj
-986 0 obj <<
-/D [984 0 R /XYZ 56.6929 794.5015 null]
+983 0 obj <<
+/D [981 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 374 0 obj <<
-/D [984 0 R /XYZ 56.6929 573.6377 null]
+/D [981 0 R /XYZ 56.6929 206.8777 null]
 >> endobj
 741 0 obj <<
-/D [984 0 R /XYZ 56.6929 551.8981 null]
+/D [981 0 R /XYZ 56.6929 185.1918 null]
 >> endobj
-983 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F84 802 0 R /F86 982 0 R /F42 601 0 R >>
+980 0 obj <<
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F84 802 0 R /F86 986 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 989 0 obj <<
-/Length 3506      
+/Length 3421      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]sÛ6òÝ¿Bo'ÏD,¾?ÓÔé¹sMr9wnîš>Pes*‘ªHÙuýíbŠ”(Ù™Üd,€%°Xì7Ä'þñ‰Ó“^M¬W™f\O›+6¹‡¹¯xÄ™%¤Yëû»«ïÞ1ñ™7ÂLîV½µ\Ɯ㓻å¯ÓwûéîæóõLh65ÙõL6ýþöÃ4â©y÷ñÃûÛùüöÚªéÝíÇ4üùæýÍç›ïn®gÜiß‹¸Â™Þßþㆠ?¿ýùç·Ÿ¯»ûéêæ®;Kÿ¼œI<ÈW¿þÆ&K8öOW,“ÞéÉtXƽ“Í•Ò2ÓJÊ4²¾ú×Õ?»{³áÓ1þié2í„a ’=r°2«}f¤»kî¦ESï°(àxÜÆÑEÚeCƒyl·uÓ”óuD-«¶ŽóÔlŠ¦Éï‹yô¯{‘ÁÍÁiÂÞ›¼zžåUóT욈ݧ×À=sé#rwßQq÷b…/Œ‰EYTír:ß·‘¸øQ]­Ÿ	jöÛm½k‹%n8™	Ã2絘Ì8ϼ÷šdÙ°ÎÛò±XDZªx" YçE‹Ý#œ!ì®`‹ÅÇ\H€|Ä9Œ¸ìψ\-	Øæí⡈\·¬«tŽÕñ‚*ó™©•ŒM³áÙ^fºÂE¦¯êÝ&G^zG¼„6_75A^†nàš÷Ixà:hüçr†ê¦^Å¡_k
’³¬Ÿâ¢UbC\„Ã(­ÂaÂrK¼ãi¾_·te‰Âx*ž¤cDÜX¦¸³¯”69-tD“^›y/gÚ,µ*ÂÁf‘M§‹Z‘	¯}GpHJ>ÔÖpÞ]¹\öˆ)çÔlãòĘøiÞàE ö<®¶oÊêžÀvT„R`=|"#.wJíL1æ†Ó´y[là:³sÇ2¦ÁWrܼG¤Y‹¬Ó˜yï°ú\nfeu¼9—63ŒÛË»wX#ÛŒ£`Dåpû ƒÔu“ÿYnöêTûÍ<\À¨Ø–Õ¼Þ£c篺ŠßuôÇî*B‹¼"`1w×nº¯*ºID¨«Å~GªTµ`|8çSôNR$=Ÿ"r;ÔP— +`ôô1_hÛ—Ož9©’†p6"I’^̸ÄÛŠTºÈƒìŠœmbÒ)KºÆ£-Y£ëëk	PÜl4-î·Øª ßaØóHÚq_T‹8.?$ËŒ ^Úe	˜Á+VDK½Ÿ+ìPÜ£}'(A <· ‘@ë:_„Ê{4µÈ×6Ï
¨Ðyý*³Ì¸ô§‡uAÖñõ¾=Q %3®@Û/nßaì?T —q!Ä€ AŠûƒa'i,\ŽQ…°G*„PO…T'‚
-!0˜}BÔ3*DšÄZsäöÿ6
w˜¬{èÑ싦m’@P[ü¹€h'ÞÿêøþËMÙøT®£$Ì‹þš«}S,Ñ{sLuŒ¨ÁaÓ1
– 2ÏÅרð)„¿Œk¥.Kaë¼vXC)L­jN„Q›Ì:o.SÑa18±á™µÌé svFì$aÌÇøŠÌ9vHêÉbèYÄï‚,âÐË–ðÈ;àù)z‡Þ–œ¢.RmNÓ'(~QŸ	-¢0t.…dEy,#ƒ×1Ê'ÌíÃŽ˜‹´­h·ñ-fò«ôQ{.ä•u“¢þ—#]È®3+ÍK6²‡uÁF&¬“|ÓñEqj"Eæ…zˆë*¸†|†éבq,MÀ5ëR*´,Úb·)Ai@3Á<=”!–‡sšå2ÖùD&¶Ñæb"SÓÐí§GEÐÝ»O€WÅ¢
I1…qœ9HÆ‘ú7!/ÕŽÖ‚vU´.ƒŠÇÙd“qñ“ƒýמòZÄ$í†VVJ‡[šH¡£òdðm¿Òýx@ئǠ7á`GšNõm¦õŸ¯ƒW~\ÛNùá`Vþ†Æ,æò|“b¸ë
B˜³+‰lsØ>~Ê©”Ö[>ƒÉ*4¿ß.Au0w—µ"”ªn‡'IÚH…¬*ÄŒÉ;5Ô&‚õÁ†‚g‚áò[òŽëu Æ’70‰‚$^í›}d– ‹öxˆÀP.Ù,"µ×|JH‹\Ån•/â7_„P‹uÝÌÆNQ"r¨á¸Ì>LÆxq÷ì)àHB¤Í>­™o·E¾£Ñ²Šû<ĵ†kK\ûocuÉM¦¹I~˜S?Í:Í)ØL1‘l1‰í€2]°Ì<äRGÎ)ðOJÐ7`f;ó"¸	™ì‘ò¡TH3-W„Hq …Ò€Ï_”X죠™©È´0—l7}2'Æý„d;wåžW›=ÁºP›ô	6ÈÉŽ‰8C¬€Èî8Èᄎù?7äa`à±çsê&üXbù1 ì!ÍÄ¢Ì$ÏŒà3!Aˆ²Þ/É;Ãp>**Óâk9Â3&Œ:vŸI& èPî(,{*Û‡²—*ŸR¢lf5Kl'>Ý’L#l¢¶Þ•ÿ ¶6:ø3º³>²spX¿S¼.Óƒ¢w¿ßå¤8ˆ#ëâl¸ É”~¡.ÖC:,$¤3w3{4'á‚\ɈËDtH§Tò)¸h«äŒ.am(ÿ(37³qáùW	˜çºÂÔ›C¶½yñ_'¹zLÃóîy: X›-b‰&¨‚ß5ç¯M«ÌiýB=¦uáâ™ÚvöšHŸ\¤#!Ð1¼:0D"é!oѼX‹»*Ú^Ý'û±
-öÑ.cKÐÉäÀȺlÂ3@ÀªÆ"n3c¬ûZëbº‚û*/×M$ºZŽ™
0è^%u‡¸g†ÜŽ¦ÈÃÙ½<Ê
-^mõ¥íÌHÅüˉø¤6‰-sæ5ÏÒ…×L7þü¡…ÃDH_Š>c°TÃÒ­4KÄAc2°Ù¦/.WÐjj°¬ z›nŒXõ¡Çm » ç-EbÌÇë™áÓ;ø_LoN8‹Jw'²­àÞ`óÉpʇ,
àpÚÂÀw·>ù¡†3MúÇJ+ÏúK‡s95HwàˆŽ UZ:ÖíŠ^Ξ¯±¹§Î|ÆCôžJŽŠõgFzƒ’0ʃ“ H0"u
iJP"X%ÊaÔÔÎcƒs,403¤ y¨÷ëe„‹ø°òtöQ/I;I4’ÛÂAªH’=ä	™Ð:YYˆ-wõȆ¡„SaȬ©H#Öi!’ÛÓD"áÀ,–Ŷ¨âà~[W)G‹[
Ⱦ/Ú–,²u!ÚÇÒ:Ìã!ÂØ<_à!~§^HlÊ©,=ÿî0BÆÎJf ƒÉ²I^žh¬ò`–° ÑWŠoÓ3é`IÏädvx²ÿ6#0>ÃI¶Ìpo.x%Àa¤*£/;¥ë‚S)Xd  ¿É©_ŠH#¤ü’CóbåôK²¾_Ân¯½Am9å6…j–ÅÄÁ²Î/!<î—˜Ë8ïbúól8¢Þ©Lq%†¾)>î›ÀTZf{¾‰ÔBQvªã¨³QÂ1`üXW%»ä›RÔ‚tp“ürhÓÇ:/EÖ©	ºÞàÕ¸ú‹ÄtX#ÔɃ¼)°Žr~	/u.Y	ç"å\_¤`ò R
M×qìZ(¥k*jÀ&$M\²‹5a¼—œÒlK¹©sýòŽ×cuKйÔPªzì9GÈ&Yªá|;pP騼!EÝ‘3™YáS
-õ\Œ•a!lƒ°?á|ašÅ2RÿWV.%H›-¤Fór]¶Ï€ÊÏ!Ç7En^ÂÖ!LXį¶\=Ÿ;Ú‚9ÿÅí;¬öç,¹‚ðô2Çy̤6|¤rŠÕŒX¾Â7êX9ÅÑASƒBaxÙQû¥A쇊 ~+‚ˆL…1œÇŸIÐÒ‹7T9”†.¶MpìÒØé‡w·ïÿC£ñ÷^Xû3F¦2LËXˆIe,œJe,㨌eRVaºVÑŽôà`Õt¼’e<>:Þ5ÀÜ>'àOä„Gµ4Àà­•>R»Å:߇穨Î"‘‰Õž17d(ÃÍ  F¢0ötæ3ð{I§h¯ð»Cž˜ÛõÊY¡ÊY×L@3æ»JÌ+ÄL¦ëW²píPÉB {Ó*Ö¬$ýf…²))1––Gµ­õ+Y¡¥¿Aˆ7,YœÝp†Ê\r½XÌ
-Qà3µ½b-:âÖ­Âg_ózv0ÏN^hý®`3ß±7'i!„Ñ|¨@¯ª8½¢rõª
-Øÿ­rÕ•-2üÙ鈅d]¶øÍ¿n=üôWÙ‚`1îá!?‚(ÉÛDžWùcÊ»ŸÁž’þ?èo%Yendstream
+xÚÝËrã6òî¯ð-rÕ‹'	'OÖ©ÍdvâÔVm’%Q6+©ˆ”ï×o7àK¤<“=lUJ6€Ðhô×~âÚÆ•ÓשÓÌpa®×û+~ýcß^‰€³ŒHË>Ö×÷W{ŸÈkÇ\"“ëûmo-˸µâú~óóâÝßß~¼¿ýt³”†/v³4	_|}÷áêqôy÷Ç÷wßþôéíMª÷w?| îO·ïo?Ý~xw{³Ö˜/Ã
+3Þßýã– o?½ýþû·Ÿn~½ÿîêö¾=Kÿ¼‚+<ÈïW?ÿʯ7pìï®8SΚëghp&œ“×û+m3Z©Ø³»úñêŸí‚½Q?uŠÚXf¤N®—ø'Œ˜æ2gÜ×–©žÚD·\Ö“\ŽXÈå}öDz9fe½Í7Â.–M±Ï—E9>¾H-s2éÍž¢¤Åš EõHV1ÇS;¤å®\U§rs³TV/þS•9A‘¼›jq¼±‹SYå
ïªòh'ÔǬŒPQ´ÏÊš¹/ÊS“‡îçb·#h÷Éûb‰GòVaáD‚9c¤§¯Ìš|b¤_Ü?æ$.›|›v
5pOü
+É	h·ÄÆ/ÜpIàcu:ÖÐãåà>ŠýiO§lwʇ+K¶Í^z«j®F;ÒÚc‚’¸„iÅåeiêcÍKS‹5)MÅf7-M	&q—)i±&HJ“`BY9¤¥“&ÑJ“J“@éø$	ಢïÁÓ^=øO^Ì¢d‰V²„ñL¿.háA¸ÄH¸€\'埮dN¶D'[ÿ?Ñ2’ÙT¿"YÒÁ
+HóVª:5g‚e5Ó‰I.ÒÑ"2+Ç´F!íQòé	b%Ä
+¡žXa³o¤°½«@<ÈNylo§*Â’&µ
%„Vq«¾(9p«ÜýUíwLOyEšzXÄ)bÍÛ©Iy¬Ê+¤´X´%*aIšŽˆéDJñ(RŠó¥â¢³T{Kß	K½¥âQ¶h®·T\-â…·TÜ‹—gI°„¥`¿†‹ü5¬•IK‘\°>Ö¼€µXÈ¡:?Ùnùû)?¾,À¬3ÁJ8“.1—Ih±&hŒÊäi@Ä»ì	¹¦$ÒóDÆIµ&º@fµ)ÖÙn÷BcžbÜguã
t÷æËESÑ÷Î¥·„€€ºã;‹-uÓH{/.Oû®ãe˦Ô8Èz$š­[¬ÁH>x)Ó2YÜfëGê¯OŠÄxª½l”ч®?tíA¿>ʲ¥¾æ1Ö»vG:åÍ2ƒ¯ÂjeÞCÿhÓD3©µÈmXç
íG=@o+0à%úà~ק#ɽ¿~¿L°G4'8:Qù™1òë)e;I.,ÀZVÏù†FÐâ×»Oø‚!¬ÐjòÕˆÝй`Š§¼¤1c±.‘šÀMwôÙT´Y5„¬Šßö1ìOãpê	»4 ˆT?0àÌ@xkŽ¹ÎCY…˜¢38ç7+PBQ_pµ‚Ø¿Ú`ƒîJp6?Pþflót´yæÌæi´y`ðü5Jí ¹JÝÐ~51ªèŽÎB#˜ì®c8ã^46O51Àn¤–`É—ÙÁT§vÄ9“",¤!J½bRzXLJÄòÜéGÂÛê¸ÏÎã`£q¢½LD‹5AÅЮ8ÆÁ¤Éø·„3ýÈ›kô	¬Â8ÝBáRü¤çŠ€
„ p’p •V¿™r`*eÖµ&§Ì—°ÿ3Ì?¿±X‡#TT˜)µ`–»¨{‡õ&u€³‘Qh(°À€‡	=rA÷ÓRçÀ\¿t•c±Ì$VM¬±Á³¥>¡ž8TÈva! Å€É#TôÝä>A-:é¦ÇôÐFáW¹©ÙĹ =‚;±½;	¬á–¥B˜¡‚ÏÞ—J˜Är--CQ¢òÇBû	D}óáGêÙCþ”=„^"`o°‚¤ °Îû½k²‘šYOc›©3I“0 _¦d8¦…‰’qÈÖ¿Ú³švôYgŠJ$(ž•”Îi—"Ñ^Sg¾‡ª®‹Õ. BV…qú±I9”ÌZñ¹Ro*†ŒEØ}_ujºÈ½£
^ ÅÞ5¨ÅÊ'H\˜T•>w¨>ÕÓà
+ y²ÎŒ˜²òÈñ
+wYÞxúÊü™€˜ H™ß]ÇÜCØÀ1ÛÆéà·N×cÙ™«…[lÖyhຠyñÛñ‚š9fåôÓÊ?
+Ó_gº… '0½ÕFÔ¾Ù®®êx雞kÎEá!_	ýßk*AÔÕ6týëÆœMõ-3â"ærF‡„–Ûà/|`í¯,R8¸±¢ž7ÊaÓ?mcGË¥Ì9e¿ÌˆJHÍk)ðÑ](£`Bç=›
…zÜÛQìÏèsËGê§fµ/Øö*¬ü‚3¹—Öó^òõ4iÁnrhðo!0lò½Og¢Ù±É+/O}¬ù¨£Åês¹žz‡œp‘^޽ŚØ~nh	£j¸½—A%u—C`£¦%åèø-Ú‡Ù>$ÈáC‚ôOO
A>\A`0/Vˆ0HJÀøÈn1
P²ËB•d‰Jg’PÅc²îÁ¨!&:y«tÔÁ'„"®õb©!Û¾+I¥óÌËÞ¹ÈÐ&®’‘²ÄkÇK†|ûìk	P\rŸ@x:à7Ä÷Øìy"íxÈËuèô—É2#ˆWv²6ò
+žÁ’@ć,é(L ûæË‹/!—wѽvUb
+‚CkŸAaâðñÐ~V¤WAþeýécÍëO‹5düTÝZ+ AÛ/nßbMì?T ËäeC¼iÑ˱5HKî/
ûª¶Â-R!„z*„è¤B8àUUÀ쫢Ψi›&#·OÉ…¿ÃhÝ}‹–€$­nê(ôÍÿXûŠº¿ÿíøþC}ÀPMh•÷×Üb}±D>¬jŸk°2
+Òk!¿D…ç¤kÊM/Kaë‚F¬¡FVž¥ ìM­K.SÑbM1¬u–¦Ü
é5Ìþ»4º¢`(		Þ™sl„*µ¼¶ø¦—Eœçe»VóLöóÁh^/
`©Gos[
+—>Ç}X
ŸPB–ÝW¾Ämž
+®,´¯ˆ»Eõ…ÊuBåf„
+†4Ñ/È)›Í\š&=¯Éçxà–;ó
+C±ÇPœ\/Š{	GõÞ!(3Ÿ=®çxŸ!B)X	9á3•q0ú!:Ÿ!Óà3°°Üyì!?%äÈ;ô¶Á; ’íúÔô/è=)½K¼ÎË/b"¸XãôÀÅZþÖ¢†¨
ÔÂ7£á³@§†@Áðß™ˆÚÙG
ÉŠJÔX&¯“è¶>rx<s‘¶-í6½¤¹ûk3
+açB^Å™H’¶÷j¤+$V3“W^›ûXó6²Å:Ë'0_Ÿ?ɜԯÑb½B…0ÏpóydŒ¥	¸–Ú˜
+µÅÿôÇÛjŽêB Ìi6›îÚ£…Æ`4ñl.&2uÝ}|ÒÝ¿ûH¨q™¯ŸS',ýµgpå]u*¶yCU&K*F‡%™Pyjí¿q”×ö«[+«„áPCG;äÉ`n¿Òíp@ئǠ7SïkT0I¨Å…çXh‡µÓÅOß|¤ÌÊß‹t¾²6ÀObv}¤Î^õ;éö„ÉÏT
+ßÄõ6/`²Š5ŸPÌÝ•„Cm	%&êœ
+5¡Â'eôN5µü…Io}ðCÁ3Ápù
yÇÝÎ}Ñ›EA/€Nõ)0K’Åó{<`(—R†g!°/7bAHÊ?4·Ù:ÌùEJ½ÞUõrêt%"`
+ñÛaçÀìÃ@îßÄVoOg@"íOqÍìpȳ#õú¿pH×¹€µ¿ª'˦	EIôÃþ©ªû«ËDi$ešËq)w@™
+.X1¹ÔÔ“ŠR oøצÐXåôH‚ÿ*Ÿ"LÂßÔ¢ýw€/=AøüuÅ>
+š¹LócÑvÇ?4õ¥GÅ!wnË=Ÿmö$oCmÒ'Ø ‹ÿ”ÃÌŸ‚•azúM„·úÿü‡áîßÔ:eÊÚ™C*ž@ÜéÒHžG»1å²$ce:Aú“
+¤½endstream
 endobj
 988 0 obj <<
 /Type /Page
@@ -3320,23 +3322,22 @@ endobj
 /D [988 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 987 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F84 802 0 R /F86 982 0 R >>
-/XObject << /Im1 795 0 R >>
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 994 0 obj <<
-/Length 2914      
+/Length 2907      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥Z_sÛ8ϧðÛ*35—ÿEÍ=uÛ´—nÚK²O{û ÛJ¢«,¹–œ4÷é HY²å´½Ng*Š„~‹‡bf,³™Ìfi¦™áÂÌ–ë3>»‡µ÷g"ÐÌ#Ñ|HõÛíٯ﬜e,³ÒÎnï¼ãΉÙíê¯Ä2ÉÎOÞ|¼zwùþÏë×ç©Nn/?^Ï¥áÉ»Ë4zýú?^_ŸÏ…3"yóÏןn/®iÉ¿]^½¥™Œ'˜^_¼»¸¾¸zsqþ÷íïg·ý^†û\áF¾œýõ7Ÿ­`Û¿Ÿq¦2gfOð™È29[Ÿi£˜ÑJÅ™êìæì_=ÃÁªÿtêü´tÌ*›ÂÈ1)€ÇwˆUΟ¢›ËÁ°•Nþ$/úŽ¯0Œ_ŒYÍ`&ËÌlnmÆ,ÏÒÞ¼ZÍ„`™1íëR&Sl”b§À¼WxÀž0cÆjt‚3£¤æHññ|nErÿËäÈβL1³°ÙL8<û2Œë,SD3ûîOÀOüz¹³·
ìg6ÜRà;0ö;rzà°B*°èžrÎœSÎ+|ÓTùœÐ$e{>W6K$3LÐ0¯W4(MU[šY5E ¯›Žín³i`Yó$Î]WÖ÷ôÒ=a¶Ùm—aœ¯VÛ¢
œîÎO€š¼7¨yûæøzêàãå¹äÉgü¯èÚsPŠž³ËJ—¹Y0±ûy¯Qà6ƒšï=ÿç|z.3°B
-8#
3FØi0,°6·¬g†Þ:F=ž¦¼{žÓqÏíá1	~`ôlÈúHH4¡€:—2Ì)£Æ|(?!d†ÚJØ"&?Vs`‘ÚÂÙJ©_ä-v
òÍœ²¥—®¡'±¤ñÜ+¿mQwcÚËOp2Ä
-|ñ\¸>(Z6¡÷\XÁ¤QýËõ˜/,s œhç+b÷çÛO4øÔlƒÌe.Ü[¦L©<ü±)WóG=ß­6s"¢:8ˆBYcóXE‘±Ôð![ûl#€µ›bIg—‰$LJ¨o;šhîhM„ˆ0eiŠ6’èW»‡<°x*«Šæ…èI³ƒ§²{ Åv·|}8Vœô|5Þ-UEù}„ÕíS±¥ñS³«V}¸ÒྃEÞþËñF"·Õ'ÆùöqBÒCþXŒÃ¿ß=ð»ÏËz*îùT¼g!Þ?nŠmNY™ÜDßĺ¬ˆ©Ž‚]N`šRßtý Öû¥¥©B
}(Ê,Yçõs ¢a€¬·Pø~™×4X.*U¬Ð3¸Jn–yå	Vój?ˉ]x©ªæ‰¨²äé¡pàAL9ü>(O’t€Ö&ï0@Dbñ5_oªâÕ¼A1&L_m‰÷Ç	¶‘.UÄïe-‚L‚•5œW^à8'ÄqÉT
-É,ˆã©JµpROˆ5’9É#ò¢{!ÛNñ%욶ŠFôÒë Ý}yŸ/ž»b2ý(®™Õ\Ž£kW#N(¥S(xÔŸŒOð¦Ìà[zm̯Ê%,a†Bëük¹Þ­é%ÌË*_Ta-_7»º›RYBÂtVÇœµ*îò]ÕM(ª4Ëœ‹t G{ ?Íåaô”²²¦¢4´lVd„þ§xôÙ!pŒà"µB—oClì¢8øhU´Ëm¹éÊ&°›ô!X€!µ1¿–ÿ-1… éLkÎ8wßS\J<¯S¥eÏp>àx\5*èԌ䦗€	IÉ47YØ÷hPQÀ'‰´¶½ýËõ ¬ìÉ5¹Å!Wß²Ëý™[èUËîÀé ÷°>îR#ÑË
-ñBXp6y‘h%¡ê2齕§Cœ¤¼¯÷ï®û¢8»OðÚ#8Œ¿$ÄŒ¶4è¢Ìÿ¼„àÐ0K5LI õ8¯¡é‹t{&@›ÔÁæÌIhøê_µ°pò^Gó­ç…#ßðô		é<º9:?7Àû”›äcøºÂH@Ú£%L>åÛšzH|ñÅ#ò^–eÛî< ãx o¢ÙÕAñ"TS`X†˜ÇìpÔOÆ&ªd–eڼܩ
©Nwj=•OR
4ÁÀ)&…ù†àH4!xTæ;€
-{ ø6bÙÞøP•ˆhTÑcÙô…âßn½	àx»ÇDBøx¨HL:]±ýfJÐ:tß÷6
-”Úõ
£¨^0J¤òšå]~Â()¦˜G¢	ÁFI5¸çH0&ôE{£`£å“ì¸
Ci±n¶¡këâ÷=x^a<.%÷röFËÄ´ÑP?¨ƒÌ
)äëg§’I–:+Çxã÷b H÷^¶¢·¤0ô˜Ïý¾ô`ㆪc”©C““Åbô,àÌ措
TMXÌ^æ]ødÈ»²‹¯K_åõée”íàxÕ_!ä¦QEPƒ÷ØÛäŠ*Oí D)}³³Áp6h`“n·
£ª v'#ûý6-^¨Ñ ¡'à=ä5½¼½ºÙU.©ê<ºz{((êC…%¢ò-=ÝÊÛh綡g¨žéÜîn‡Øm•oŽq.§ÇSh|¾°!M„{Ø=­lÑŸÀµ¼æ0åâ”w˜ë1†‡þæú à.îfÏŸŽT¤H»'™(‹3ÍR•E¤¨›/óåC1{,)TºJd/_~9–i;¿m±ÜmÛò±˜ÌqŠ9;r„eUõd[® ÷3.¶šûú
uŽ's’TœIü£Á‹9iHu:'õT¨^ƒTE{(7…rŸKõ²ÜH4!w¸mÇ™vʎ冪6¶iRïÖ*2SrxF
ýK?Û—£i4è1Ãe~¼ñŒ–M
V#è¨;!Dâ]Üì•Øç+x™ÎW)æSß—Zdƒ™Í©o•RµM¿qI? :mÐHäa¨Ë—Ÿ'‹Œ”YH˜/Š4ÇbÕÁ†Ðä
åN×}}ø*?¯a¼IHpªs&ËRýㅡ¿4pãþŸÂðð¦DkÍÔÅàáæîf ú^Õ
*5%³a³§ðn.‚®ùf±wó5Íu‘ÃÁeNõ $ ýµ,@´P{‡¤ë¹äAFS‡BŠº¿ùXÑrYwŶ†TòLïãÉqÒ¸ÓâäÞ 4ãkPÊz'£ÉeL*ñš}@t:š"QL"åWº–ŸWÍý|*²ð
-Q+­_Ô¡':VbüW/Ç´—jAÕ®ÊÔ¾.ÊB]„s‹¶©Š®ø^zj_m—óå²ØøÕ¿ù¿¿âò}Š¯°â{ÐoÆÑIJYoÀ‹²*»>S€ÛÛP	áœ8¬½ƒ®Ç±¤S\óô RÀ‡NfjÇœé¡7Ô›í¨l!üŸñånWîsÊðÜÿöÁ±S?kP†áo&Èû¿äÿôOö¿ÑùÎH›¶
ySE¥pï†û?$U¨U'Tÿ‹˜˜endstream
+xÚÅ]sÛ6òÝ¿BoGÏD,¾?.OiêôÜi“œë>Ü´} %ÊæTU‘²ê»¹ÿ~»X€"%Jq&™¹dÆ\‹Åb±Ÿ€ø„Á>Ñ&7^ø‰õ*׌ëÉìñ‚Mîaìûq¦	iÚÇúööâ›wFL|î0“ÛE–Ë™s|r;ÿ53¹È/ËÞ~xÿîúû_nÞ\Z•Ý^x9še﮼"èû›7?ýôæærÊæÙÛ¼ùx{uCC&ÒøöúýwÔãés‚èÍÕ»«›«÷o¯.¿ýáâê¶ÛK¿œIÜÈŸ¿þÎ&sØö,—ÞéÉ,çÞ‹Éã…Ò2×JÊÔ³¼øùâŸÁÞh˜:*?Îr!AVÇT²'@Çsí½žXís#…¼Û¶—SÉu6+V˜ì®¤Žú©Ülªù¼\Åv/¨¹.7—ÜeÓ§ªÜE„
!¤‘׫Hê®hª&‚Ï„T­fËí¼ZÝSw’~û.9ìF
»DNÛM±j‘vSo7³2NêoÒòœ	£âœ¦-Úò±\µˆ9™J§AšTóÜk-Ò®jªlûPŽp¢ln5'
;>^Y¨Ü›¸aÓUщ¹ ŸQ:Ìz‘î–õìâ­Ïcfõê7ÆÄývS´UG±gYæGšÉs˹ùÀ^ãšDHÓ>)Ò¨%&¬Ç3}2‡lpérÅõ'øè°Fé‹Š+	fa‡ŒÜ&ñ4Åc„Šfä0`6ñ9ÊelqÎ+"^þ5+×-Á¤òá"Á&r(Ç10E½y,çÔÜ6Á¼þødNq¸¼áç®uúè:,ÜH±l§'0<;ŸkÞå,#Ö'óS¹òÂ
YyƒNÆZd©Ü¬Àx±iöÇ‘=äsVR»ZÐ7¢“ãžeÕ´(怵QšcŒuŸëcŒLSEµl"Ó«ù˜ó r•Œ~Û”S”wtHà°—jè^È„«“Sª¢¢5e{¤@Éñ¹Q̾$,I¢¬Kl2uhIšÍc@+‚iÆÔ4q‡8÷Þ¸¾¾tbðesa˜ÉÁ90¶ý¾'mšÅr-Eø‡Ë©áÙ-üÙQ¼v&÷4':‡°KOþœ@QÞKBêÁa¯{„Žo®ùä»v4éo*žö)‡M9Õ72‘À½awG1ùõ™±ìùR°¬ÞRc^ã—g«º¥Ž]Õ<Dz@°Ôƒ,š‚Á(Ô¥gµ!*Q«£¦ï]lƒŠÎ_!h†4õv9pÙ’äém‡
õ8é:é3²ËÁ Ó$½Ê„‹\h¼l±^oê5°
YB»ZB¡È#÷Y}ɳ-
$6ÂB`^®ËUìÜ®ë™_·Td›|Ð}ٶ䑭Ãl'|V
Šo7úîŠnâj¡Ã7„0oš–›r±)ñ¼°ñç–ŽYYÙ«2>λIß"¾ÌÈ$¨¡ñÂL÷‰ä—¹€©ðà¶-äR Ãž[>,i	‘Ç1u>,uXgÂÒXVY²TàCú«G¦„5ÂÌ 2i—KÉÜŒL²~dÂæ>2a«™„å!2¬‡ˆNù)2!<™˜Ë9(èéÈq˜åCXåJ£S`|<:³´Ìö¢™†bp¼ÂÊ¡EŸÉÙйd^¼ :%Q…wçõ¨uZ:¬c7t>ÅÁ£ÉŸg¦Ãáf HŽ	1dç—UÀ%Oáü@¥°¯R0¸W©††ë8¾-G‡¦C¼À,LšH²Ë7¡¿Y—³
+ÝQP8…z'›—‹b»lã,ðaÇ‚ÚBM5Ô„U=rèP°Á!¥œº†
n JŬ·Š9roIÍÆ—„Ò9·¢«žËfl1›+©R½õÓlD£ûu¼K•Òãj¤»jYµÏ€ÊOk¡¹?‘d÷±ÎhaÂ"µÕâù”ÞÁfاVOHŸX8&–{~ùÃÒTU¥9/A#«êœd*Û=T³lèêÑbI½ƒ<†ŠùœÔ®i0àŽ‚4¢Ök¬P‹%FolÿòÝGš³®7mDÞUËHø®Œñõ@K”V UC1¿MˆíÒØìý‡Ûëwÿ¢ÞGࣸ/°c$Ô…áz|FÌ-Æé0´^—ņ`¬·‘&¥W¸Ì²xJ`¹yBµ*ûÛXq)!„sÑ%¡xû͘C¥«…Wè!`+m†©ÉlYlÑž¤TtÝßÀ¦” ë>€
ex2$½›’*Œð¢}n­LEk…›1ž„Ëí¯T¨Y¶q`üê„+H ½ID_ †F¹®¶J{,‚f€
+Ê¥U¼º‚ÎYó9Cî1`ôå.&dý­Ð_›R¼áµU@ØG誧ĭ>Ó·w¡EyãHH·àµ2/—óÌ]eúÝ¥U¬{Gü¶”Pz€JãE·N/¸½zÑ-Ø׺½J5¢´x€"ðkT°Ü´æ3’ë4ãT+¼Dm>QÁJHë´îkV°’›\3é¾~Û§|¦‚•Â«ñt÷s½,bÉ\¬ÏD®sN ʈ³¬B==óºŒøTæÐl×k4Dª{R}†èœý¾¢ÅÀÁGçî³P÷’B¨·o?’55u,åà:4`êtUÖ?å/Sœÿ{U&¬È[œÏc:¬#¯5zÃËr^¢Ozä’F¤xRçNj9äàÇêrô*/·ø,ôBç
+²’¯rCD	×µë5(å>E
ß7œr‹TÖ¬Ú!.^äFRûdS‘?Í
ÏÔšè±s9m÷²–	,gŒQ„ô>BÂDÐPB6I­Áïz-tWð<©év¾žbz5–vXHžóÝöG
+Cr´1qxª«ù§h‚2+(=_J3pi>‹KPj¢ŽÅøåÔ¿ç©;Hwzñ‹¤p¼2¼qá‹t„tV/¨ÎUÅ\ÃhH³sàÛ„pI„']ÄGÛ‡¢%ˆ’^Äi
+ôPz‹PÈ?à|!¢ì‡ŠHhpá½5izÇ@/!–Lf?—GuˆRS@>N¸PbÐàæ>FŒ›žwøÓþ„cC>¦¢D9‹‘˜‹únŽ³øºÙ_áÌèyF’K㔘thwu2ü‡zw¦OEµ,î–éí&
+øðM§«˜æ(]βw©-ÿ*×Ë2ºÌÛVXÔ˜–wo@‡yQP\m‡×¬èæAéÆ
ijÀaü‡>›bu_(…5Ž@£µÔ¯	þïë±Ð8bA}²
+|{}´„Æî¸Dƒ–88Šnäï¨"„¥àÁê°‹Œ	{ö~ûÉïbÿ"œEý8–¶Bð…¸üÒªÀ‡·‘BrsgÒsJ¬EE¼‡B™%â
^Ÿ9Ê@‡ý9bKówÈ\4O²G´P´Â¸ôðï9ê«ìþ"šÎ…̇qEÑ$Ò¿U|@4Çxá€Ç¢
³Í½bò3;‘Ê%ÑŒû_îÀž¤ýLÿÛ#~ '?ÈDrvŒ$†=k2¸§øžÀ‡ôLwÁâä1CQÅXªO:µ	ëÌê:¾ÅÂjÁÅBoì:à@ç¤a©YÎ ØÀ+òÆa@Q®×#@¡„o¨•Â–U¬*¡ó)(<'„ýïB5Œ}ÁÅ(z¤,wL=J³G:\ÏEî0Ý™wÓ¼Žó=Æ}x²xú	òá;2A!2”ãÊD‡]}÷D€@|âH·çÐxîÍ2~ÕO÷iÕìBÕð.¾KÁ$* ï¾lûTÍ~æ¡ ‰Ú|uâ7=`OøCœ‘èú"ï‹ï³ÿ1”²9¤ú'c¨Yr0™˜Â“Ðìdè> endobj
-998 0 obj <<
+997 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [361.118 436.2023 409.8647 448.2619]
+/Rect [442.7768 199.0224 511.2325 211.0821]
 /Subtype /Link
-/A << /S /GoTo /D (configuration_file_elements) >>
+/A << /S /GoTo /D (query_address) >>
 >> endobj
 995 0 obj <<
 /D [993 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 378 0 obj <<
-/D [993 0 R /XYZ 56.6929 621.8163 null]
+/D [993 0 R /XYZ 56.6929 254.8667 null]
 >> endobj
 996 0 obj <<
-/D [993 0 R /XYZ 56.6929 597.0941 null]
->> endobj
-382 0 obj <<
-/D [993 0 R /XYZ 56.6929 519.9904 null]
->> endobj
-997 0 obj <<
-/D [993 0 R /XYZ 56.6929 492.7975 null]
->> endobj
-386 0 obj <<
-/D [993 0 R /XYZ 56.6929 176.8325 null]
->> endobj
-999 0 obj <<
-/D [993 0 R /XYZ 56.6929 152.1104 null]
+/D [993 0 R /XYZ 56.6929 232.5443 null]
 >> endobj
 992 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F84 802 0 R /F42 601 0 R /F57 628 0 R >>
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F84 802 0 R /F86 986 0 R /F57 628 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1002 0 obj <<
-/Length 3192      
+1000 0 obj <<
+/Length 3256      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥ZKsã6¾ûWè¶tUÄàA€Àq2ñdJœ¬ãÝ=ds $ÚæE*"eÇùõéF$(QrR)ØšF£@ñƒ_•2i³En³T1®ëí[<ÁØ7WÜó,Ó2æúêáêËOZ,ljµÐ‹‡ÇH–I™1|ñ°ù9ùøÏ?>ÜÜ_/…b‰N¯—J³ä«Û»¯©ÇÒããwŸn¿ù÷ý‡ë¸Ú•{Èþ~FȨnÿ(©åQ‚Z•ÏEjNê@Úó6ƒýϘôË0q´ï|´K›°…b˜3Æf]€„@‡YDòU¹.]I©`!Ù¡yŠµ£ax£#ª ÁÇ¢ÚSǪêãUñd9lÿvÍ9O\Ž5ƒa8ìšaÜË ¢”¹Û)±A+KNù»£öçªnWo}ÙT)Ux/O^ŠúDp¹ZïÎƹ Wä—'¸ffŸÄ¹Ìaú£Ù)>¬ŽÂC˜í<žGa=ƒ/ýðñGßÙ6M9”tè蟋>Pn®|{èôaT±^»¼M[™ãá`º‘¡rk‘*“E¡<ã…Nš…ž)k¢»Ãn×îÝ-†Ç² 
-¦v–jpšœÎÛ½bØ"üå³Òæ
;hˆòREù)(«=9WíÇžÛW"¶EóF”+ž{,Â$²ðZP&CÊ*’Î~ê«š¹¤V/ u»b]ùZT=[h¸"àèì”OË\ÀTíadUïíŠÎá8¤]ö€g@,üs‚ÑŽë²ó,ª!Jz…(K»	½2U
åÌÕ@Qu˜.O!íRd©eoâ ¼ú+J¼Uä:åüz‰GƒäÇr_µ›jícÔ¡Ç¢ûLÍ[8RîBwçÂTæ"5™x'Lc®óa:p¹[S2[V^…Ó›ÀFRàE®¦qš§™±zª„‹½LjWv ¼ Óc“6©ñ^Û*Êl›˜¡k)î=ÛIJFÖ1ëfáƒÝ¾Ø8éPÈßf6Z
-›²Œs_ÛùK1£EæGw‘]/-ÞÔ	æàñMî¯dWl¸@‡§fô<óΈϠNfÑëÂxÙÅ›ëáîJοb*—niq^×I ß†#}éÁµ‹Hx²/èÙ´Ã=rþ`·ãƒ|»†³ ^½Ÿ­VP}a²wNU1×…0\îÐWû~Uý…8ð×Óu¸f”˜&x*µâS-(؈320öØý{Ûxæm:7E㼆zÈ+¹4‹}E‚ïuÔ·-öŸ]ü@wÑÍù;¥´Æ{è¦WÚÍ82x‡IseìÔ=”n27¡Låv	×?†²óc \nbß7Ix›|ßľïÜÃù¾mŠUí_}ñ%éƒÁë°R§¥'§n…¹¤qÁ³ŒáÕ¤š†•PºxVÑy8×!ä°ßánèÂÃ6…öD!7'[StåÚG°¸è‚]FPtA?¹ŽÄ®0³*º„B:8öþðW#Q2†Ã¿‰1×ùH¸†|ù áB$ÊTóì²
-iF…i=2©²JNuð76:ÓÖÞµʆ›I›4eÿÚî?ç°CðIÔ¹º"$KUfÃؼ	Ž47/¨Oj‡”e)iç,•JÝ‚QÅ­vþ‰OŒ*|Ž’à(g_÷p;Üõů£{ã“ܩȽ#¹Þ½Q6º7Ž8÷FÝÅ;÷†ô„ç×Ñ’8‚†w…ctúí16lpc×éOJ&ì€zc?àDênñ•ð\ì³n:(^I><:L>‘„z}Açè±/¸N>è¶*Ÿ*?“?ÍÅ).ˆÐU	ºéû…”Yân?¡“€<MùZ{rSuë'öØûê¨[ã¿Ô½TâÊPs/c̗بëö5HZ½×¾3å˜Td&¿@ºm=©wzàŸn	z‹Gî 6MR]ßîÂí,Î4 Š¶	_gÆuSÖ+¥ÉàÈÊs×í“¿Ò0gS·*•V„„ufŧ9Žé€œî{F@Of©ù1÷ ÙñGÝèkÕ€”ý-±{º²­RF*.ÛŠ—mý§AñäåijWÃW04ì‰?r&Ê´»ï—8þÄÿM0Þ˜1fþÿ&j<Þ•Eï1åIzC‰Zí–`í\šIá6‚«TPžæ<£ÿ#ÜE^ tÆé³zª¤È¼üxÃùy©Ersb*”ÅNä†þ‰³øun”Y+‰)¢ÝZG¸Ž/o·|ñu+ZÄ‹
-‚—‘d·*“Mn9Žš…)Ãÿæ¸5¹+W€šoׂ%¥oL¿%cGCOÿ-¨ÓoÉ™ÍS-µ\D¶ý{» 6ÕÖ³ÿjô÷|i¼
	ÄL¦bƒ+üíÿJ$Ëà´bŒ8ó/¦S#l¾*EY¸3êä?7J̇W¤ú.Ñœ‹endstream
+xÚ¥ÙrÛFò]_Á·PU!vÌÝ'Û±½N%vÖÒÖ>dó’„5	0(YùúížîÁA‚T¼[*æè™îéé{(gþäÌ›Dè,¹,MŒf¶Ú^‰Ù=̽¿’³ˆ@‹!ÔëÛ«¿¼³j–%™Uvv{7ØË'Â{9»]ÿ:ó÷W¿Ü¾ý|½PFÌmr½0VÌ_øødôyóéã»ïÿùùÕµKç·>}¤áÏoß½ýüöã›·×é„õŠw8³à݇ŸÞRëýçW?ÿüêóõo·?^½½íÎ2<¯òûÕ¯¿‰ÙŽýã•HtæÍì	:"‘Y¦fÛ«ÔèĤZÇ‘ÍÕÍÕ?º
³aéÿŒö‰ñÊM00ÕS4YbµÒU¾-®NßûÇbm5ª›5
?äÐÖôýýPìŸ	.¿ÏË
+xfe:ÿX·Å_}RÍÛ‡‚æ×ESŸ¼Û>¯îy»U^Q#ß45/yŠ–ìèÓU—×Õ†1?•írÎ81[H™dƨpºCS,ÓÅa½[ìê}ÛðŠWDb•Ï`%.È«õÄ®J$BYÇ0aS{qSç’Ôv›~$ë4ì½ÐÒöœ"IUâ4™Çº\/&¶Öp¼TÆ­ë][ÖUCûæÄ0ê0ÛÕ:¯Z*‘á0Ú>ä<¼mŠ¿ñõ>Ïã}ù¤è‚£ŒøJWS?–k¼Tˆ»zOe¾úòD;ðÔªÞîò¶\–›²}¦¡À
+l LáwW7M¹ÜðtSnw›òŽ{Ašhß2À®X•ÿB­r<2-	Ú%™ÖD1궴	)„˜Ú{XZÝÓ~7ÏM[lÙ*M}دçO嶜¼bØ_¹D¶¿
4*ßiØï:4ù=ÏÖwøÍæÛ¼zføˆÚ,‚×EÁÆ’wÙ MÅôN=¿Yå›p0ó˜oqY'
¡³ÙÔO•ÍŸ
+Þ1ðñîù€—}¤=Çô >EØ@žZ;‡×®…œ_s¸³âû‰›Z'Ò¨”EV¾Ÿà&\òN3™Á¾ rkj•ð+ç°sP‰vYT$)œv©ô*@‹²­DT¦`à`[æ
+uòÁ©é¨x‰{ÅÔÝ—÷ùò¹-¦ÄÒĦBEÖ’ß:T|‰D¥.q@5E—6·iñbµ¬¥n\‡HמFHa ±Í¿–ÛÖ:ùc^nòå†çòm}¨Ú)’••‰·©aÖÅ]~Ø´S¦(M2ïMo›#üÌ4˹õ”3˜£`at
+^Ëj7>4(,u¨‡,³CsU-L‡Mq°Í÷¬ôº(ŽGZíË`5i`R†`"1ÚÅ£5åű«×à™½ójf
Þ:õgœ½B†ùiW¿èv\·$?>$N‹³=â@"ÈìÄ)•¤Âx>q|tŠL€§nt
+šÜßϨñyktð4ŽDãd_ÄS¬zÆÛDS“‚ÅV2ÍFÔœÄ;Ô4œî†4$,t úÒB—¹àhˆÌ¸Ö }h0É?@·s³
+üxS´q´w"ÐíL9´OM'®$Ó1ì©ÑFœŠ–leWÞ 	?ßÔ®'`Âz9xÄêê;4_â¼ÃŽ)Ž7a/lCßà™.˜9ƒ9?0üN˜ù§Š78¬¸EøÀ¥
æ4‘@:åfC{/y˲iÁ²c{€otœh1™ðqDãÍ’•ÝDr“Cðf ]€¸>QæŒLE ÅêTõbÝAoUï‹)!•»¦^ÀÜAM yHe18Â}íZoêCüôGÑY7
+¸b(ÖhÛÊÛÞ>’µ|
&Ÿ‘I‘˜ÙÝC
+n$Õ’áÎß‹òI¦2÷½ .ÜK„
+”åm>}/ ú%\ÆÜAM ßDä\#ÜÄÏLî:äs©n&J-¶5&VØnãú΄½xäã/­z<ý½AgòÞ4„a.sß~o€H¢ dÝæè
+Tâ¼=
+lÂYd]õq4ƒõ‡o®tppCÁ2âLÍüÃ13†‹ ~iÁÚì®U
CÕ<–Ò^2Ü»dÜÅW´¦LO‡ƒÏudEé˜À	é°¹2è“aÃÖÄXÚCÄR¢iÄQ¾8ËØy{ØskS„ü:ÆíûcZ0{²!@M_°úà=¶ÔùáãM¿ª\Qz|
+R|Žª0bM§^h«ØÃQ;Ží9…9·
QøÝ-¸Õóœarú<å¼†egA–ßF‚à¬CÐxEŒbM–pµÏÔ<ã˜Mi…ø7›/(ØNó—’'ˆ6Cò„[0³Ïˆ'	ØŽ=»xvõZle‡q®íâ\KN	#ߺfømÄšËgšc%ŽÝ¢¼OÜÝs}`i[Ù M–8åÍe:¨	ÆÖ’X‘ec"¦jÙ_Ò0 †éM›WE}hŠTÁµêºþrØ5£KŽ°HÅñ•»«î„<°"­>z…_ùÉàj½ãÇ<Ã
+šÐ|?Ôy¦<(u–x¬cÆgS!¦Þ“t’á[úÚ Pó×Å*§RlNn[>„0²£Ž¦ù½Z9MÞååž–e;> endobj
-1004 0 obj <<
+1003 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [389.4645 631.0615 438.2112 643.1212]
+/Subtype /Link
+/A << /S /GoTo /D (configuration_file_elements) >>
+>> endobj
+1005 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [375.4723 755.8266 432.5882 767.8862]
+/Rect [375.4723 239.1838 432.5882 251.2434]
 /Subtype /Link
 /A << /S /GoTo /D (journal) >>
 >> endobj
-1003 0 obj <<
-/D [1001 0 R /XYZ 85.0394 794.5015 null]
+1001 0 obj <<
+/D [999 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-390 0 obj <<
-/D [1001 0 R /XYZ 85.0394 427.5127 null]
+382 0 obj <<
+/D [999 0 R /XYZ 85.0394 714.3516 null]
 >> endobj
-1005 0 obj <<
-/D [1001 0 R /XYZ 85.0394 402.5515 null]
+1002 0 obj <<
+/D [999 0 R /XYZ 85.0394 687.455 null]
 >> endobj
-1000 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R >>
-/XObject << /Im1 795 0 R >>
+386 0 obj <<
+/D [999 0 R /XYZ 85.0394 373.1735 null]
+>> endobj
+1004 0 obj <<
+/D [999 0 R /XYZ 85.0394 348.7476 null]
+>> endobj
+998 0 obj <<
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1008 0 obj <<
-/Length 3433      
+/Length 3036      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]oÜ6òÝ¿bïéd «ðK…<¹©ÓúÐ:­ãÃ=´}we[ˆVrVÚ8Fqÿýf8C-¥ÕÚ9$0
Éáp8ÎW.üÉE’Æi®òE–›82Y¬6'bqc?HÆYz¤eˆõÃõÉëw©Zäqžªtq}в±°V.®×Di¬âS  ¢·ï/ß]üô﫳ÓÌD×ï/O—*Ñ»‹_Î	úéêì×_Ï®N—Ò&2zûóÙo×çW4”2..¤žœ>Gˆ^¿;¿:¿|{~ú×õ¿Nί‡½„û•BãF>üñ—X¬aÛÿ:±Îm²x„†ˆež«ÅæÄ$:NŒÖ¾§>ùpòû@0uSgå'E¬4ÈêP€fV€I§ZéA€2¥¹!¢ëS)eÔ>´u{÷„Û": "K•ÆˆÔM?«ëÓ¥Áý}¹EPEý}ÕÜuÔ}SLÝå§]Q¿¤ÿx_6¹$Ì®Ü~öV÷mÛ•L¢ OSlJÝcʨo©ïÓ®Ü>Q×íöTڨݳUTW]ÏŒÞR£ûÃIçI¢ÜŽˆzŒê\FÌÑFŽhy#Ø¡‰oi›Ò÷Œ\ycµ*êú‰†V5n¬÷ãŒßwe}:˜]ß—,öðì´Èâ4^‘Åþøñ•çŒØõE_nÊƯw
-òøX2wE3³ŽÍb“f	Ï/ÖK'¢¥Ñy,“ÌŒEµÞ–]7½VÂí”j‘	Ð2+¿ê¨8·ÖÎ߀¥'¸)j·…gûU‘¿Mѯî§üI©b­µý~_àPÊ$Ö
-à“N3Rfq¦•ôѬáÐtUM_nYûŽûz?†ßU›ÝC¹ªŠšÅ“»Øhè2 7º´¬ËÏeMséžà@Y{ÍAÒ¼TÑuÕ]S23¼ÐæͪŒIW²4Ö©´cU¹l›eSÞ:â\%=y¤«DtWöÔ]PÛ“¤Î›¢óÓÚ†àúU[êzh»ª¯ü€ôÒý„Ü^f£Õ!É
4×]Êí¤“”ÇU76’o!Rµ<ÈËÛžúÐÈ`Ù‹Tø÷í¶wë†T‚­C7	Þ‚í˲!”ŠWa­–aÓÎÊtQÿ^ô€íwýU]Sçͬ1Î[
Ë ð¥Úì6ÔžUXßÑŒ1c`æ.nŒý™ä¼_5-µ¯(8ã‰Ag±^ÓœŽ±y0ÄŠ”“nŠ4³¹Çû
-倗ÅïínK~`ЂŠæ‰€&Tcì û‚+ô+?ƒ¼n#c !-!riyZù¥Ø<Ôå+²I6öÆÒ¢-û…e
-žüo·g¥ã#‘ÑÎ¥xmßÌéô?$„úµ2oæö7œ×2}C
”ô_š³œ]‘c‰€{:Deeàl©Í.ÊYìlàF´ÛÔ‚¾NEkÓºû¦,hd[×í£“1`Ü<Ñ÷ž¥‚1“ýS$F7E÷‘¦¨$‰ñ0`LÎ^§ÆdŽ42eØlOÃÄ2å—Uù@†1Ñ„`·g@?P4ŽQMà˜M@ôl:V‘Q¿:k>Ì©˜ö^æ¬çÔ£.¯îŽ=Ô于Tw˜„zí¶ëò¶ØÕÇÛ}êâ*”Λ 
ÛïFú8›LÆFæ_žƒsÏóÄÌû~Ø4ÐJ…Üó´hžZú“0bHƒtžÇYžÙ}¡ƒfÝ.R8ïL¦ØXÚœÜkp»’ÔHAˆ8ÑÊpñ„"!º_B¼y¶I‘©la$Q‰ÛËâÓâ.“ƒ”N»î%à:^_läâÇö³¶äé.ÂnGÖ'ù ÁêJÆR5èÛ“Mè@̆Á#’[-=bë¯UF¿MÛsÚV4»ÎB`cr2POfÒ<ÛbáY}Ûñ£¢%y
-ç¿Oõ¾M9Ç¥ó\?ŸB*ÀA„y¡öy¡¿Ï-{¯÷aÈ0^L‰‚6ûé\%B8RPóÇËÔæ¬ÁMñDƒ+˜FËC¯³BйSÁ9ŽhwXzW­û®;šˆ&óêªsFÜaݶÛKYq´øèÍæ’Ègnü2e7`œI0H™-B>³E˜Ý!ŽK”Ab‹cÿݶ¡6ù<‰€¾Ÿ‰øhÔDnuý˜F`bia³.!…ÃqR/ïØ™q¸Ÿ›Òh”%ýlê
-¶IâíÐv|,Û-ž¨L"béÔaúŠä«fz
˜•4Í“…†‹šÔ]CÜÞ±qº
-*%þ2œàmlàƒè";ÊÛ`ÆßsÀ“Mâ\@æ.qP³°^â䀋µHå)k0´ª«AR^akÒ&m׌YÇ®^‡xÅv[4wÁ:Õ‰â9¶N€u™dh!a{ È¡}ØVpZ`d)×Bp¼ê\Wí:ºV8ÇE¿ìù’é‘ö‘έØ”ž(#"~]â&·LŒƒùéRaC*ò3„…œ•¼š»¾ä# Y)ÜU lG]+wXã¢.M©xÈð8Ýg8¿åkÕ»+íºš?…Pw;½=‘GÿqE2G€(GlØÁ׋ÕcÙA`&L_yÞ˜´â8qænÓ†l†)¡û>”[´ŠAS™AÙÔÇÚÙdÐIÎ×q¬eZ2í៵‚SA«¨ÐÏTŸêäc½š~ÚUŒË”©‘ÂU^.îQ6×A¬ÏÐJŸ¶!›Ý$´G&ãâNÃx+78ÉC§MœH›ÎTèÀË¢]uæ7%ä-ì™r8;.Ý	1_º“ÚÆ¢¡v7[žCƒ¢´ReÐzÁ™kùk ¸I†ÊÚX%°Ž–è4Vcý~<_àQÃ1šL§c&—ètªÇ%:!KtØ×Ó‚¹i¨gÓeh¹Zj3•ŠÉîZØ‹Ñ“B×RyÄÛ¢˜<ûŠJ±ŽÁ¯Ì¹Z ½nÝ-ƒ\5òÐí
-ˆ-è(3¤ ù‹n—ñ—á„9·;¥;v»ÀØþ¹â@¯œ„Õá3n—±^âä€Zàv5¤ËT@uÇÐ>ÀUTÚDšÕ³'&
èQ>$+Ï›©GÜì:Oß½p¥^5aÒ±Ö )×™r!$Qùå¡®VU?ÃNjb¨Ï[	9Cb!YQJÁå7Ù·Ñ=ÅeHr¦ˆž@†›%Ù~åã•~›Añû1é)¾Äd.b«¬3yÌŒXH’‡@…!<+zXÂ(fKýcK€¯ã‹Q–Pˆˆh@¶®~¿Gò#‰à¢Ž¹d
-žIz¡¢‹ßH‹d|K3gYÜ´$ÇiîËVùø2A9{û”í äö•P©6Áu×SÙiê8V2’›-è;Z•åéwpLq’œsIœff¿ðqÇF7×™ýŽD`Þãë«ôá«Ógb`521dŸ5ÆXvâþmS)O=÷ÄØ[Ðgÿ"ì:ÝCXêK:éÔ†§‚doÃurSáÌB¤MÕÐ+ôášÆ[ïWo[ŽDŒŒÀœWCgq‡fý;>ôìèj›íq—Fiª€!º‡Ê¥õCcUVŽiGdÿšní~–ó2áb“B;ÀÁ§2‚8_p0?„Oç3
-7ÞQi8x+$a1yRÊÃ
-òPg~âŽ[úEiWªªyìZÀW><›ºº$\—å—žð6nˆrøféöå6lðO˜Äô§K!³ÂF¾®ËõOÉ3MË×ÊÐs„–Z¦¬Ö€XÜöTeµ¾ì	¸eÅ¥Ga÷%UOR1I®#zÙ¿ñ
-KÊ?ãܯ$ô|û»ûö±!0ø‰ûÑ]Ç(”ThÊ;Itôû ˜€?QLþÈ[}XÃ4ÿLGûÀ(Œ¤yäYV'1þÒq&oÃûç7ÿ rÿ(†i·µêH ³±±@„™Bi'E‡á——‡¬ÿªþ¯Sendstream
+xÚ¥Ërã6òî¯Ðm©ªƒA‚Ggâ™u*™É:ÞÍ!É¢ ‹5|hDÊçëÓø°(M¶¦\e4
 »Ñ/€â|¡â0NEºHÒ(TŒ«E^Ý°ÅŒ½¿áŽfå‰Vcªïo¾{‹E¦±ˆÛÑZ:dZóÅãæ÷ E¸„Xðöã‡w÷ïÿûp»L¢àñþã‡åJ(¼»ÿ鎠÷·?ÿ|û°\q­xðöß·¿<Þ=ÐPìÖøþþÄI©¹°èÃÝ»»‡»oï–>þxs÷ØË2–—3‰‚|¾ùýO¶Ø€Ø?Þ°P¦Z-NÐa!OS±¨n"%CIé1åͯ7ÿéÚ©sú‹”•ˆb«I!æuÌÄs I¤…é8šÕ±§BLkÏf³j›ü“éÚ×BsÉÃT-Æ+Ÿíïhf¶—£í¹ŒÃTr9Ýÿqg–«ˆ« >Vks@8š-áþ`L”n|cÚüPì»æÐâ°ä:pÜÓ´ms ¡Ç·¿,¹Hƒ7Ôm»MÑ ¬’Àt9؃f1ì\¸•jc6ìj׆–\O¨б
+¥ä„EY•°Ì›º9>íÐl´‰mÞ<£B¥A‡²!Έ0ʆmQwæ°ÍrÓqU(•EÛ™ºuô5p.À~»|¿ÊËÂÔÉÜÌ“)Ë1fàeouÔ<C¤Ôo*+ó·Yí		Ú?vOMQ?QuiÏGs(,·ÐÉê
E7UOüWS‚ºCV·[shAÛÒjÛ
lÌ6;–›míí»w*
+‡LòD¾D4µ¦ŒIhGc7QÃ&ÀQQ+êN¸ô-/íÞäEV¢è ùÊd5Å\88—Y/tö$Ó98X%„j`"*¤;ÉÑK4.΃™à`Vq äããO-!­‚¤Qʃ[PÁÎ8:'
‘~2/'ÇòLˆI&Š»èw¬­rÍf&N‚ïê”ùŒ€*j{i[ï=Öh¥ŒÂ8âÉTVÊ-´R¬Öö<•„ýÛ⩦<-l
+2‡–zuÙ
+`×ÿad~CžvE¾£ùŽGƘ]öìxq•Ø:T	D5
•Âå~a
¹¯‰¬‚Ã+jÓÎÙ0YO!÷ûæà:UãM{”f’‚ZÐFKªÈÎpQÇ.µ‡šóN*àÐrß´EW<»%­’Ý”Ϧ‰Ÿ¿'€¼Ùî馂öw›9Sõ5!ê„KòqhaA䈋à¾&LFM:>ÝŽ 
+ê“bosLy.Ì©ÅãܽãRû}Iu‘]pŸ²ƒÆˆ€€ðq@k`Ðb¨#·Z‚ÞÂ9Ù¨¸d8TPÐñ©•]Ì‹ŠëPó¯ÜFD—³¢'²¶Õ(Õ©+(çiQ²PCíquûžè|ÿéÍs¡Ò\NL]µL0±²’VKûngs–h{ÕÙü‰Å}µ(B)ÝÜûí$g¦¯µ)	v~ÓÒÔ>!ª(,~UOfy,¥NèbÓÙpˆ=!"L.ñm^AC”úÊJL9åMÝQÜ.ÝØ®9PeèqÙ²ÝQ×$ îjý’™ã‚Ü!t/©5éoC8HÑ3Vè¥6Œƒ«xÊÀ¿mF‚Ý$ ©Ü¸Ëüà	k³í㎬M?oŸµ­­“ãp§5O’àè.xà +†‘œŠa€¤cˆ
+»¡c¦(áî4ŸÍYÑbR¦¬2¶}HŒaÊbHQ¹ì_&xrQ‰1üW£fSää‹KŽœ·Ÿ¨{7=ˆyí%•iFI¢®»è˜ê²öT6s—T(¬
+ǹ—F \k¯²ÐSÍð0õÓ4ä‘äS&è†÷0¶KØK>té„îØW£âa3&hª^rGvVî éPÑ Iç÷va×®ÿeæ¤%”ÞPpûR£×+t*%S»ëõ•2PL*_ŽõÑÕÐ	sñ(…rìXO‡6fÔ^˜3Ü ãê•ñt¸DÒÚÙ‹Åp[™DLŠéºt?$á¯O¿ß’ùR6ÅðÖ¸Tó†ÚÚõ÷ã÷z£žsC¼Êå9\4.&*	l@¹/¿â#ª+nà©P’ÉÝÚdÝ?Ð!ƒÏuzª&&~ÉqO¹ ?`Ã¥+b>#´±"4½£ ºÊç:«­ÕÃPq¥¥1zïb˜Ü"8¯%\•>Yÿaö]hÆÞeƒ¾`Þ@A~ÜÏ2X‡†\¿ºôãÀX9d¢}žJÒÁ%,~pekÇ©òv¬Ç¶¯?›l_mæ<˜¬mêl]º©¾€D¸¿ßàt€Øi¨å„W˜Ëeè<Š°bNÔÔ-(‡ÚŠ‡úGdxÔI_€B—Ã>¹bF.7·vLÞ•ÄλzyD„õ.-È»ïžÔ’xb
+ßï¨i]©èìáÿõD‘°i0«ž8¦ºì‰=U/ñÑóŠ'*pHWyè©f˜˜z"áf«§\¸J:½úlnk‰á7
jÓÁõQöBÐÖŸ]Ê,Ê\¥‰ó´y%¼â\ó+}–=¤¤j–Â6%Õ«lïV<µï«¶E·ÂvX¯gVíí›C‘åì{<í[²o„Fö=Z×?9ÂÚ÷[±öÚ7.oíâS¥À HA½ÛÌ1cÜîttêž DêíØ"é5!:2 îÅ*ûé×1zt„)þƒXç…¶l2z‰„n·¶*Ÿ¬„|áƒc#œ·ܼçmmž
+·“»Í…›%T"ô@ÿ´.edoR^âç‰SéÀMÑÒ÷W!nü!ûx4£‡ÿ
­
+œ»5†€‰²lN~¥µ£p÷˜×ùBkô%_Ñ8›z6exÚéCÒôHúgæÞÑ'Qªíš½ Æú’¿	O? 0ÿfŸ–Ÿ]ü{¢à‰;œ `Y~1èqà9åW.ÊcªËA¯§²O…ˆÛvEÞ^­Ãc~…‰žj†‹×u8”Œ¯Øø`ŸŽä¨±pÏöû;!£'lËæɾ"|)ÂñT…2í?Ç\ø<ıx¦BŽ´tUª„þÍN‰äUÄóO 1éÁ¯)ò¶bÃÓÞðhbó¶ò¥2Bã¼­Øë¼
kÿãªx¬Ø©e¯¤Ø3{µ¨4U»D'ò¾3£¿1
ynö;3ÄŸ„‡1‹ÕåµhƒµègL—ZyîV{Æ&y·?8Û$‰ö{ƒ³8²ã§
0ÈŒRøO}¡Üãp}^Å"8ûü°4I£…†ydµ²ø¼ŠÒTɶrò[Äw÷_üЀ4‹±@nÙÕ°®•GG“Ï22Œ%r"êÄ9”}§…*óe)X`\§¨ö¥©LÝÙ—DÔԺߔžyÃEË“‘V¿íœ ~…PÄà®2ü¸à۬Ƚ„à,
+5„¹¹Å>kó¯#†ŸŽDpQÑúB°…†1ÄJBX‹Ê%Σ> endobj
+1009 0 obj <<
+/D [1007 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+390 0 obj <<
+/D [1007 0 R /XYZ 56.6929 459.5865 null]
+>> endobj
+1010 0 obj <<
+/D [1007 0 R /XYZ 56.6929 429.6043 null]
+>> endobj
+1006 0 obj <<
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R >>
+/XObject << /Im1 795 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1013 0 obj <<
+/Length 3431      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]oÜ6òÝ¿bïéd «ðS"‘'7uZZ§u|¸‡¶ò®lÑJÎJÇ(î¿ß‡ÔRZ­CÃ?†Ãáp8ŸËþøÂè”I«¹U©f\/V›¶¸ƒ¹ŸN¸‡Y eõÃõÉëw™XØÔf"[\ßF¸LÊŒá‹ëõÉÛŸÏ~»>¿:]
+Í’,=]êŒ%?\\þH#–>oß_¾»øéßWg§¹J®/Þ_ÒðÕù»ó«óË·ç§Kn4‡õÂc8²àÝÅ/çÔúéêì×_Ï®Nÿºþ×Éùõp–ø¼œI<ȧ“?þb‹5û_',•ÖèÅ#tXÊ­‹Í‰Ò2ÕJÊ0RŸ|8ù}@ͺ¥süÓÒ¤Úˆ|†j–Ú¦™Ò1Ï̳”àc,¹>åœ'íC[·wOx<@"#$l±YÊËÜò³º>]*\Ñß—[lŠ¤¿¯š»Ž†oJhÓpùiWÔ¯ 
œ~¼/›\dWn?«û¶íJ¢ OSlJšÝCò¤oiìÓ®Ü>ÑÐíö”›¤ÝD«ERW]ï	½¥‡·'â<µZw"ÂÞ¡Òò¤‚U2ɃCZÞÂH¢gÚ¦#…®±±ZuýDS«Ö‡yßwe}¢—)“\ß—žíñÝI–§™¶¨E"ûã¤ܲëú¢/7eö;~|,=uE3³ÉS•åʯ/ÖKÇ¢¥’6å:—cV­·e×MŸg6U"Ï942ÿêˆÔcæŸÀrÀ¸ŒQÊ7ç"U<Óû‘ÈMѯîˆT ˜øŽDŒ/©dše–‰tâyx—ˆÚoUt]u×”ž¿ÑÖͪLI`ò,•7cy¹l›eSÞLâZÁzÄ+XrWö4\P? ¤Á›¢ËÚ†à
V[zh»ª¯Â„cŒÒ#…<¾hiQõçë^æv2HÂãšU7ÖÜ?DÄjü
+@$o{CMƒC~ÎTd,‚¿o·½Û7Ɔ‰ñ”iÿX–
T~/Ñ6^?‚år­“3ß³ ÃÉ`ü±ªk¼™ÕˆÑ}‹a¾T›Ý†F㻲‘
+­ºîâv€Ø߉õçeIÓRßÑŠŒSë5­é<´?LyA²$›‘ Íîñ¾B> MÇmñ{»Û’1Ãhõ†ZEóD&c ÷‚-/ЯÂ
+dë™G’<ŽÖ/+¿›‡º|EZBçc“Ì
ê’±iXf`Îÿvg2µèŽŒNÎÙkófN¦ÿÁÁ'¯…z3Ç°¿	1À¼æÙêHÄäZÿ¥5ËÙiòСˆ¨§K†G—úÞ.cG8
€ƒ
¼ˆvû‘:œÑ׉BmZ÷Þ„‰lëº}t<ˆ›'úÞÀ³,õhÿdšÁì¦è>Ò¡uŠÿs|öé8	P*B«d"‘(¥á°ý=MÉÐ(¿¬ÊRd‰*‡¡ÐSFå•Ô“	€LG*v÷’k*{Ïsj¬çÄ£.‹ îŽ<”äºNPw™zíŽëò¶ØÕ~Õ^Bý«;é½øl÷©[p®;o¢>¿É㜋®rÞ‚ý:<kµš·ýphÀ•	ò»çqÑ:¸|3¬˜¸C,$­Ms››½!ƒdÝ.,Ksn0>0)7–Ìkôºt¦¸ó Xª¥þÜ{`
+	Nçù”1€ø!Šƒ©ÝYŸ|}k%ÁDmwÒ=ÜÀë‹
_üØÂyÑ‘Þe„ØȨØÕyÊrp•”à)çJäe²šRϺÂ#œà
+É`ÞUN¿MÛûT®¨wŠÀécIhÙtÊ1eÁ)Wz_Ö·Ý?Jš¶™],÷ß·IçX¤¤µòùè ¼í8:”!:º¯eoö>qÆ‹#a*ñÆû¡m:7BáÎÔýñòõ}l‡ÍMñD“+XFÛèSC0¸SÁ=Ž6hw®±®Z÷]w´uæÕUç´¸ƒºm·¸âlñÿà›(‘N«Â6eW ‰0Iñ-¶B|‹moqH¢8{Þùßmꓱ:üa%Æá£Y•¸Ý©æœ7+›u	¾(œ®“Fý¹€œK€ç¹Ù!>‘FYR£Ÿ
`áÀFë˜n·@DzÝzÄ‘Ñ,œÏ±ˆ¾j¦ÏŒ\Êx¶ð2•¹WHsÛ;¯œ®¢tI_ÆðAÅF&hŠiùP®¼JÂãPS‚$(:¡Ì˜¢ƒ´Íõ!‡Ø<ïQ„„ͼA«ºØ¤µ&QÂÙvíá æØÕë®Øn‹æ.º@×@Y"oNØT0Ôáã¸#„kä7´Û
+®
+Ý‹<ó霯:7”'»ŽÞ®q¾/6ön|éñ‘’~4œQ§fS¤(rñëB·¸õȼ+?Ý
+ýkD~§ÐÇ$¯æÞ.U
+÷¡3¶£¡•{CÐXã¦.H©ü”sßqyˆo|ëý«UïÞ³jþdLÜí¼ã…ä1›üÇåÉÂ<\±òF¾­ÊSq0ø*Ðæ©@Žg6ÈäºïC¹E•Hþ3%„É‚§Ov™ôÑ:ε×LgøgG½èVP%
+42U–:þ˜ ¦Ÿv•‡õ˜®â]^ÎïQ,×.lˆÏÊ´!™Ýı»%ãÔŽM³L_k°‡úMªTs£g’t`bQ©:]Š›¢o–,ÜÏÞ16Ÿ½ãÒ¤ÆÚlHßÍfè$—©ÎM*µÜù·&¿ŒËå¡!A]ê,×ûfè$9oâ;0¾D¤ÊS#yÌ–úÇ–!oŽ%£\“ˆ€¨=¶.w¿
+3šù„ι8
+7~%É…H.~#)âèæjìD¦³±à¸eÚâ2÷õ*éø29{û5(ÐÁ–;—¦4­Æüt×SÊiÊMY­_0kŠCËçðtEVðÛ-†Ç¸ŒQÎYz”éýÎÇÍZ|5pýßÈ€ñ%"s
³’‰<&’*øPm$ÄÝØ-}K*AËi?l„ú61–tb¨}2¾«ûrõÑgÁÞ©4c@Ã8 ¸+ª&äú}ª!Š¸ÑS‹ÿqrXÐÜ5}廂>¾ð1Jø·»f=ç罧Š†
+•$hÄÔH%&eEõåÑ
+O
ßè†Ê8ÊW˜Êµ+AP>^,<{Õ`\	‘Ã]p‚{ä›ß޹̸ÕÇŒÿ»/QHá=x,4«~çê„cªjSõÕç’º{EÂY¨rórêxFüá|ÂÎIp×
k[ú‚
3¶9º¾™;ݽ°Ó´—ZúnÚÏ“‘aÑMyW5
Å‚¤|4#u‘™t¥«Llò}
KP	
+?>W#ôTeþŠJ=…|õLpÖ•pãŽu&¾_&„oïczªõñ<0B>R½Ð*ì¼GbLš«ágÇ.³`Û2åjÚyþ\úókuYÀ¸ŒQÎÅ ó\ýöLÁReìw¤Ñ#|‰D˜U8;"ñx¡•0žÝ®zw4g
+Yʸ_åÚk¦®=^yð^l8»‘‚!í>8„së?ȚȼêÏs_ÆÑ‚>ûb°t5°,äs²©Ϙ÷ƒÐÉ+ÎX¨•Å@›ª¡ôáž•GŒo>ìÞךTÀœM«€CSq—fB	Tqt¥É÷õÛ¥’Ò_…Æ¡r1ýäX••#Ú!ÙÒÙ¯r6&Þl’ECd0X%£–\ÛWÍ¡…UóÅï()•	‰a˜Fžäñ0w׆ÿ&6ýéRL,3IHêúä§I¸Å(Ó¤üµP4å)B=Í3/ÖXÜö”b5!ç	°eåóŽÌìó©¥ð(}z0š‘Ã̾¼Ë	ÿŒ)p?óIPïîÛdžšÑoGÜî:B1…ä1¿µ–Éïƒ`üD0eü#;ìôñ&ý/tdpÈ›G*²R§øKÇ™ 
¥ÏoþA徆Q·1âHøϲÔ›¢ÛZN)~yyHúÿ
'®uendstream
+endobj
 1012 0 obj <<
+/Type /Page
+/Contents 1013 0 R
+/Resources 1011 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 991 0 R
+/Annots [ 1017 0 R 1018 0 R ]
+>> endobj
+1017 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [213.6732 308.8411 286.8984 320.9007]
+/Rect [242.0197 308.8411 315.2448 320.9007]
 /Subtype /Link
 /A << /S /GoTo /D (rrset_ordering) >>
 >> endobj
-1013 0 obj <<
+1018 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [209.702 230.3842 283.4678 242.4439]
+/Rect [238.0484 230.3842 311.8142 242.4439]
 /Subtype /Link
 /A << /S /GoTo /D (topology) >>
 >> endobj
-1009 0 obj <<
-/D [1007 0 R /XYZ 56.6929 794.5015 null]
+1014 0 obj <<
+/D [1012 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 394 0 obj <<
-/D [1007 0 R /XYZ 56.6929 769.5949 null]
+/D [1012 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1010 0 obj <<
-/D [1007 0 R /XYZ 56.6929 749.6227 null]
+1015 0 obj <<
+/D [1012 0 R /XYZ 85.0394 749.6227 null]
 >> endobj
 398 0 obj <<
-/D [1007 0 R /XYZ 56.6929 377.478 null]
+/D [1012 0 R /XYZ 85.0394 377.478 null]
 >> endobj
-1011 0 obj <<
-/D [1007 0 R /XYZ 56.6929 355.0589 null]
+1016 0 obj <<
+/D [1012 0 R /XYZ 85.0394 355.0589 null]
 >> endobj
-1006 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R /F86 982 0 R >>
+1011 0 obj <<
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R /F86 986 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1016 0 obj <<
-/Length 2147      
+1021 0 obj <<
+/Length 2160      
 /Filter /FlateDecode
 >>
 stream
-xÚÅYßsã¶~÷_¡¹'¹ÁøIwOÎÕ¾8Óø:N’éÐesB‘ŽHŸÏÍôïP EÙjÜ›Ž.€Åî‡ÅîŠM(üØD+B…‘“ÔH¢(S“åæ„Nn¡ïÃ	ócfaÐ,õíâäì2áCL“ÉbéÒ„jÍ&‹ÕOÓ÷ßÿuq1?qE§	9©„N¿½ºþ3J>Þ¼¾¼úð·ùùi*§‹«×(ž_\^Ì/®ß_œÎ˜Væs¯áÀ„Ë«¿\`ëÃüü‡Î秿,¾?¹Xt¾Äþ2*¬#¿üô¬ÀíïO(F«É#¼PÂŒá“͉T‚()D”'ŸN~ìF½nê~Jh¢4OG”b@eH"¸pVyûXo=	•N‹²ÄÖýö”éi¾Î·ø^·w¡™­VØÙ4ycEzZWØÕÞe-¶zjÛ:tçØ`†–hÂϸôJ«U¿Kø.T5Ä‚
Ï#F)îÌÿñ!ßh†™¢Y˼øœ¯pîÚ‰ê
ög(¼«›h·†™nuéW‡!ÛCÔÐ@ìZPÊ'”õÁ4ÌoÐÚ@³&Ú'L)¶Ø\ÞÑÖ.`%˺ªàÕzm_{ˆ]ª4
-»bJŒ€p±+6õ¶-‹GBéôwgÄØàí™ö;Ž(ëeVZßÁRŒ‚äì{®.í)¢‘êÆbÓA¾Ó-ëÛ›wVSé^|wq­u±
Ʈ߰%~áû1Q„mc°mV¿
-úÍëº,ëÇ¢ºEMÖˆ±ýñ†Æáû®/;Ñ¿÷ŸVåL¦Dsš>«9XiøÂÁáe™5
6ßæÍž[)Ñ£x?4~3	ûÆ£½õ>x/Ï×Ç¿7~4nüXÜø7ö‡qc_
7ñJÜÄѸ‰cq/áÆ_ƒnƒäþª¿@»[¬½rà’ò>ßo±X`VËÚ.+õ“ìE;D`P6aó$‰³ }Í¿d›ûÒ÷a]³­[(¯ØÂ2”5u•Ý„q7ù]ö¹°¡Fßhþ(Ø&ÖaÛrÕ?ˆlºÂÏAµɮڤè]í›	®§Wv•LWNÓiSlŠ2Û¢Ðò÷tÆ©žñðV¯ÝQyF­ž¨·¨P¨g2•Ä/ÞŠyÞÜו¯é0-¯Ú¾¿cuu¤eÄ=¤!ÂmÓóÑ‘Ä'û옳ê	Öûìtô¡µ’ˆHØ×L•&±¶Ýpk|vnØ—ˆ{y+F‚×óJ®E·÷šãÞƒ(ÃÇ `@Lx`@ÇÀì‹Tó.§n@¯@„+qʬ¤É6yO+8/i¡\Ùžà°hKi°Ér³ºÅÆMŽOCùêYª¦RµD‘T‰ñŒSµ!½Šò}‘‹ÅIq°à Éð¾õ.©À1önÅ å9Ú8Ÿ7¹GâãvPAÖÍT’dÒ)ùû]šnʶ蒓Ú=W
ÉPh¶•‹è.ª{üðªyt{gû|^ÚdO(¸ñj <­J”¹³OˆÅŸ)å·ñz>ß©©·)÷yÐå;ùî€é#[r_fKgµ`µ[VJ¯D>¤]pÚ|±º@&<Ø&d£A¿U»ÝÂÌjþòŠ•rãÇ6mÖæL[°ä}¾Ýî°‚!;ÿ³¶pç	F8?áÙYÙá€åæí
ƒƒ2lÒ~ˆþV”á#Šxëë‰e;~Êýø¬lêî’5†›Ná.UÀ"œÃ}Є$”ó!fß¿%I’ª‰`Æm¯ëØ·½`cÝïÃðY<~ÿz¿§Õñ	²dîáŠ¡A’'DÀµgÑÞw†nÔ†ìk³–àõ}&$¡Id?·Wc¸'ö{Eêáì56œq;Î	7kLÊŽùâ‰ÑZo™ug±Jt²g7à›Ü-ì¶ü>_Ž„çDRÎ]ákÂ*·Ç¦
-—öÌ‹‘„5oG
-db"@ÖÃ.bå®ùÏÊU0f©|ûtïù´mÅ=Ø´=oVõ&+*×ù9µ!Z§fPÚþž¯LجD'JYøP‰{µÆUŸF¼ÉVTœ²©oZô
-‹I¾,t>ºØ¼±ÎàŒû)Íh°çNÒòùõ?Æ7"12DAuhœöÆ™y“îón-×yÐ6ۦؖ
-"y—@ž³-yÞ6ܵÝB€7$'¡YÒ߬¾¹!µù°óæÚ—‹?s.Ç§6îhÔŸFÌ–àðàÔ BªhÖ´&ͯÐfþô3È‚Štì³Êü6ó<ésV>äÝ‘ØŽ§5hP"Nã1	'5])ó´àí^*)‘*•f(á)åǤ!5Iãô“É›¡»«ÜAp]¾f³Yp
-.Ü”•1²™DCΞØrk(„“ÛN /xÍ@
-4ÐÕb„tÞ£^’FÔK²!õ‚nW½eˆI“$”?í)ê'L˜4ÐB§ÿª«|ìŽag•9Ù+z¸l’ðIÍëà¶üKïãñ*ÃŒÃ;õ]RÈ^/ì ‚“e~ÝßÂÍ/’ÿŪ÷Ž;u¨hG¿šzÆàBøɺÛÍTNŸ=òçu}]Ø%ToiÔK°KËŒ¸åÓ²,–_
ö,P?T«¶nBÿ±yö¿Ú€ÝßTÿÔÉCDÊdPMXšÆ4vÎ
-št7ØDØëgÿ5ž§RŸQ.kÉ÷ŸÈÞ¸½k ºfï²ÝßCì嫈Ð]]ïضÎý·À}³W|â
!Ëzó&"iØÄÃùîП•@Ùì?Œ#”ŸN^aH¹EqUú…vv«Y6u
¯vÕöu€Øɹʢ °3fÄž¹ÛfÛU¥Å#¥4ùÃ9Å1ŒÊ¡k`ªYæ•ð
LÅ(hNN°åâÜž,J©¾/ŠòmqØ6øÞ¾±–ÒÈöÕwg—(­Ëmpv]zÁB”ú‰'æÀD¶Á¶Yû*Øw>¯›ªjîËú-Y'¦öÇ;‡ï›¡JìTÿÞZ“s™Íiú¨åà¥áS‡/«¼mQ|;ˆ3¥zï»Öo&aßx´·^ÁGïâÉ
þú¸ñâÆŸ.n|ŒûÓ¸±¯†›x!nâÙ¸‰çâ&žÂ¿7þ2ÜFÈý	Ôp‚,^n¹öK£%)¿æÛ-Ìjy×g¥aRB€ƒ¿“iGD`T®lÂæigAûZ|É7·•oúf¥k(¯(aÊÛ¦Î?†~‹›üsiW„½Ð…9|Q°"Öa+¹êT-Š®ðÁsTí@³«v)zWûæ‚ëäÂΠҤtå4KÚrSVù•–—¸§sN
œ‡·f=jŽÊ3*lõD»ešÀ ÓDC¾x/E{ÛÔ¾¦Ã°¢îb²äÓÝ1K<“±ï=o™X!2a”Vô”FôüC÷É?;òʼ~@Á.É>{Ct­&âö5ÂSei¼ÛŠ+q|~ê	¼DôË{1¿žZr-úí×·T9>FQbÎzf_|°B¯˜z9s#†ª0S[àΚ}ióM10ë—t¸“vL3µCaE@Åz8ì‹wË2´¦CácOIÅêQ¦¶T‘L	5™wcÂ6&YQ¶£O2²85Ž&¥>ô^*B3ÁûëK	ƒÄçÈãbщ÷Û@¹g2_q8N’Ig䧛Âå•lìS”Æ=W-vÉQ÷èh.ë|÷º½w{gÛ|vÚä¨øèÍ@‘ZßU¨s'Ø&%ˆž¦þ•R~}OéŸJ¼[…Oˆ.¹Øñ7¼ŸØ•Û*_:Ç¥ÇÝÌRz òíâÓ&×+¤Ä£Ma‚È>ì[³Û-l¼±øO€¯(QܱoÛå]±ÁüSÞÛMéŽ,8²ìןw¥;UÐíž½—=Xg`Ü^—)(€‰0¨Ç&Fyé¯G9>¢€€·¡X·‰ÑäCáûçUÛô·­)Üt—q©á(îƒ&$¡œ1ûfü¹@ð”ÀÁV3Á0Ú^ܱq{=CaÝôûþóxÀþMß®õã¤Ë2Ü'ÃI{>È6ÚˆO{ßú^Oy²gÍz‚Wù¹‡&•ÃwZOAŸ
+¶<¢}¬ÆŽÃL©ÖÙŒH8&cÏùøÂÁ9­§?½ÌƒÁyl—8pR’f™ÚMì6ý¶XNçDRNSéê°§÷÷Ü«‘µ¯'ª¤c"™ýhCt'þ³veŒYVß=Üzjm¥¸EÛòjÕlò²v¯^˜Q}sð{êz0kÏ…":UÊâ‡FìØ‹5~©üJâ]¶ªR¨-z¥Å¤X%:
ß_læXçpÊýv2V€~§YHo§—?OoDjd(‚æÐ9íRó.Ýý\®ñ o&öMð-Dò>…<æ[ú¸o¸k»‰oHOB³ÑeènHn>ì¼»ö%Ä⯜Ë)Ç©†M„‹:õ—	·%¬LHßÁ™AƒTѼí LÚßAfþð3H‚Šlê.£ªâ:÷dés^Ýý‘ØN8§5XP"ÎÓ1		'3}1óÜàõ8“0jƒ3f(áåÏI%Bj’Ñ&“?7*8Bíî‘/É8Ž‚-/†£lÖ/
+îÞP”1ÒSDBÖ³õÖPˆ&·›?_ðÂ5B¨ 5Dt1 _’FôK²1ý‚fW¾eIè³$Ô?ìæK4²B“5u1uÕ°£ª‚Œ÷[ª’)T—™—¡m÷˜ÞÅç›#o ‚£F!y=¾°*c~æ߯“ÿÅþ©öž;õû§hO¿ÚfúàDøíºßÌL& -çe}]Ô%ÔniÔ¨KËTRŒ·åò*—_
õ<êÐÜÕ«9JCûsñö¿Â÷sÕÿ#o²Ô‘q`§\–e1…Ý£²<Ó°spAu%Igòñ_Ï€ä©Ìç“óÆ_óý§²×îïh®Ù»kE7ø@âÙ*bs—;ê†Ò©ÿ&¸ãnö’O¼#dÙl^E
E<›oýh	|ÍþÒ8A÷éìÉóôÜ4w¿öJËV4ŸFÛoŠNY<”Üó<üò¹ïúïNÅendstream
 endobj
-1015 0 obj <<
+1020 0 obj <<
 /Type /Page
-/Contents 1016 0 R
-/Resources 1014 0 R
+/Contents 1021 0 R
+/Resources 1019 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 991 0 R
-/Annots [ 1018 0 R ]
+/Annots [ 1023 0 R ]
 >> endobj
-1018 0 obj <<
+1023 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [353.6787 309.2241 427.332 321.2838]
+/Rect [325.3322 309.2241 398.9856 321.2838]
 /Subtype /Link
 /A << /S /GoTo /D (the_sortlist_statement) >>
 >> endobj
-1017 0 obj <<
-/D [1015 0 R /XYZ 85.0394 794.5015 null]
+1022 0 obj <<
+/D [1020 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 402 0 obj <<
-/D [1015 0 R /XYZ 85.0394 379.8143 null]
+/D [1020 0 R /XYZ 56.6929 379.8143 null]
 >> endobj
 700 0 obj <<
-/D [1015 0 R /XYZ 85.0394 352.2229 null]
+/D [1020 0 R /XYZ 56.6929 352.2229 null]
 >> endobj
-1019 0 obj <<
-/D [1015 0 R /XYZ 85.0394 202.6239 null]
+1024 0 obj <<
+/D [1020 0 R /XYZ 56.6929 202.6239 null]
 >> endobj
-1020 0 obj <<
-/D [1015 0 R /XYZ 85.0394 190.6687 null]
+1025 0 obj <<
+/D [1020 0 R /XYZ 56.6929 190.6687 null]
 >> endobj
-1014 0 obj <<
+1019 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F57 628 0 R /F42 601 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1023 0 obj <<
-/Length 2922      
+1028 0 obj <<
+/Length 2936      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZÝsÛ6÷_Á·£fBŸ$1÷ä&NΫsç¨OmhŠ²8‘H•¤ìèfî¿ @‘RÓK'3¸X,€Å~ü2
ü£LâD1¤JÄ’P»<ÃØÇjy"Çù\?,oÞ~HX b•°$X®=YYL²ŒËÕ/a³xHøîÓÇû??Þ.R.ï?=,"&IøáþŸwØûøxûÓO·‹ˆf’†ïþqû¯åÝ#%VÆ÷ï‘¢°¹ ôñîÃÝãÝû»ÅoËoî–ÃYüóRÂõA~¿ùå7¬àØ?Þ˜«L¯ðAbªv7BòX
-Îe{óùæ߃@oÔLÕ%1ã «©eê)0q€’J'œq£À¦]•í"J	‹c±­Š¿ë3McÅY+)™aþ¯|ûApO,	"Nb™ÊÌð¼VÛ-h)IÂ"?t%vóúˆvA³°ìöMÝ•&¥áºiq¬?î-û­Ï\4¦]uH¬j+}›w–tÿ€’úMÞ#e“¿XQ¿2&pÓ#]0ÅbžRЫÙô¦éú¸üšïöÛ2.šÝÌ1•ŒA…`ÄâÑì&rlºÃZïöWBØ×7@JiØ7¨RžáR–:¢çÛ×üØ¡]=•ØâÁûC[—+¤˜S둼^ÁöLßꮌ,˜SÞåëÁ~£ïõ$ÍW#s¤þÑzh³ëé3ÁÝÓ¬Š$æ,÷käܶ}ª´jô½X¨˜&"³jlÛ®ì#´Á©Ê%;UÒòv}Þ—»²îÝ	öû27{yƒ8ñqæpuÓÛ³4»§j8!Ü`:ÌÃX”emêrXd[•]|ÉÑ	§¯ò[<²X))æ=T™¦q’$â²,œG@–íâ~&êQešÄY–¥C@ý½ãI†s&м›0¢!ÂH`°7ñ	â
—ð?'!d’Œ\ªöHÌÒÁï‰PŠ#“×7g=éÀÞÞïhð¾Þ¡œàÈ—l•	ßO³¸Ò ÑQ‘Z'[n¬-f‰H,RÏT†hFÂÁ&Gâ!g™¢ç6	ÞÇYXuØ“Ó£Tš®ÛíÑ2ê@£çik4„[Ì@º§tN"©OÁ¦8´èd£[ª—a)øjc‚,ôÐ	 Óö{pØ=Rt(3ájÁa¯+Ù`À¦PJU?O<@$*f™ÊßƾÏlµƒH•ÀNÙîûœjì	Bvò„9l!##lÀ4‰©ÈËe*<Ô I8 qJÁ‘$ÑS8»§‘)ò¹®ìÅqé½ló]õýö|aHcDéK¸¶°cšYx”áRÀU”Žþ\šx+˜
“‚‡õa÷dr›5¶ä—Úä`€„gˆE^àf²#Œèc¸	í‹RÕ«ªÈûª©u#YH¾ªºüi[Z©ZšV=
-ׯD’妲ۃvšmx}Ê\
-yø´œI3à,Kœù‘Íš;pÓU¹Ša5Š9véòŪ\çélÆìf`å"Vs0PÖÌú:1> 8%6Võ¡/;\Ú¤£zu–³vù×jw°ˆà%ßÊkÛÇcŠ»íÐl~?à)„zÛáÓíÄ—<@8pyÕ|®Ë | 
-jcQs~@ãåòúú×Ì|
PHM£”Ñ–ª`ÒZÇêPhu3ÖeÿÚ´_p°oó8ŽÇt(-pnn°1Pöex—×E©„¼\&ONº¾±àÇêò\æÅræu÷Z¶ˆSδ	¸ÏDò±yOÕy¦ƒp¬Òxã! úöŒ“CÛéô¦;9îód@³ÀR8·W™=þš´);K³çÀªÆÝZNnP¸Èƒx4r»Alë°éà°S%AZ§§8ñ-ÊQ’Ñ“r¦¾†“‰Ôy™w5Îb!Nw¢°WãxØÝ4‡öäug;Ï ÿÁþ¿ymáq–_‹Áq¦V_¶2Iýb‘hÅŽ¬É}^	ÓU[Dt¸jdNò~óÖbðÕPU¶†@»ò8slž­ûô®¼1Aïb<â
-nVQz=ù\—ãÑÀå4}9–”„suùkfýq8U§i2Þ€ÍÌ2qÉ ñ“tŽdt4è¼nªb3šãÅ=n¯1R7tmÙWÕy{DŠ6Í}ÓU}Éø¥té)9E¡ˆ³Ìn_¡ÌÈÎLæFqM2]âŒ÷ñy_•†ÈÑrbažî¸Ð¦û:´é'ºZÔQe4a}èîÉO¿nÊ{ï>¾{‡}8x;F»f~è›]Þ»C±&lj
-JS|·Øô\Öe‹ †SjÞ~59ÇO+ÙÄ,M6{úêXç;ýŠª‰‡ý
-t8¢“Û¹ê™ÊâLÑ, Ða„£ÂÁöÙz×ãGß`,äO˜^ÂT.¢ˆ±¹Þ›ˆÙùn8TLÀ•ùÂ'†0pýÁ¦ÒliKk Z3å×½ML„¢˜Œ6]ZÐæË\&¡
-HøæsÈ›Jˆ^™CÞÚºbVdÌ©8+—puâÕÛúÃÖÛºkžþ Õ¥»neÞZ’AòÍ!.)å(ÌÈIðÈ:­ÌZ'F¼øD@ç/ˆ
-†J³X%œÝÛ¼w£ˆ¥«
-‡Ù×ÿb><.‡éµÃâSz¨|»m^±k‘Á€Ô·Õ®ð~¾kNJc!~±m
-‹òº/å«.¯/B;¸è¤âz8ô¹.‡Ãk€våº-»M¤÷fxW™%î¾=NyqâA	’ˆëG¸fÎ0ò $‰eqtˆ%VÐTrÅtøæÑ#<Û"Á\­î8ØŸŠðog™~¬:ÇéOå&©ÌÕrÇ5¶hkñÌ»œ¡çØü­ŒŒp4Ù-—°–|Ÿ?Ýb§ØäõóðÒ¥jý…úa2ûJËöûJŽµ-9ˆî°ú‚^¨·%#N\œÑ8p‡}Ü”rÀ(öÐ;ý ú
ä
Æ¢§C4÷„q&Ó›—ÙŠ¨OÇavvy×—î§,-÷¹zÁóÂ`·Å3•:ÕjZô*šss]#t –¾i;ç†P :‡öíÁ¸â‹+£a3U{âÒ¿³ÍþÆgM'üdj<.h:æeM[yÛ±c
¶F†¿‡ÚÆÐôk™¡Ñ6™ØÜë`(Hwžx®Ÿ²²?Œ
-®_Þô¤Hß³ve!ÒK…ñÈ%Z£`áó¶y2ÖEéðm¢
-ѧ»‡¸°‹vw±š×<êgñþð„$½©Î.o‡¹þÑ{·Ÿ³è!d£i¿ézÚ½{Úrq½öAb7à´•÷àrù'Q×úf‚Š–ïþ»ˆÓ;AQ_øI
-Xdœ»MiUI1Í1ö(¦[ÿëoendstream
+xÚ­ZÝoÛ8Ï_á·“Jå§$âž²mÚËâ6½K½OÛ}Pd%jK®$'õ÷¿ß‡”%[v[tQ ¤†Cr8œßÐá3ÿø,Õ“FÍ£"͸žå›+6{‚±÷WÜñ„ž)rý²¸zý.3™XijÅã`­4biÊg‹åÁ›]ÿgqs?…fAÍC³à—Û»·D1Ô¼ùp÷îöýï÷×óD‹ÛwD¾¿ywss÷æfòTs˜/Ü
+g&¼»ý÷
õÞß_ÿöÛõýüÏůW7‹þ,Ãór&ñ _®þø“Í–pì_¯X$Mªg/ðÁ"nŒ˜m®”–‘VRzÊúêãÕû£vê”þ´L#ŠdB:(3™DðY¢MK!­ëfY4ó0f,È÷ùºÌÿ‰‡š…<‰ŒÄE9ŒÖÂ2ÿϾ~§ä`]6%‹t¢SËóR®× ¤8òl×Ôͪ=uš9Oƒ¢ÝÖU[´HJ‚Ǻ¡±n¿uì×C漶í²%bY¹Õ×YëH·w´R·Ê:¢¬²g·Ô'!	=R†0"’	ÅZ¡WuÛEÅ×l³]Q^o&Žit«~‚]–Žæ„Ȩiw(í'ÆÄ×W@JxÐÕ¤R™‚årXÍé”L8[¿dû–Ìê¡ –Þ횪XÅžG²j	âÙ¾Ó\X)X®ä,¸¶ÊÇÁn…÷zXm¨F fDýÖ~d“ûá™àîyÅ‚Åö,·Ä¹Ù­»TéÔ8tce"«Ô©±iÚ¢ÉOU®Ø)¸ñ¶]Ö›¢êü	¶Û"³²¼"œx?q¸ªîÜYêÍCÙŸn0éçQ,ʱÖUÑo².‹6:çé±—ëüWçà€F«iWU&IDZ:¿Íc°–ëÒy´Ô!¤ê$ŽÒ4MúˆúílšE	‡P
+†I¡Èï7¡a„bG¤ÁÝĈÀ%gû|óö¾dò5輬Ê|5š338î®1î³7t]ñWVY³'
+šæ¶nË®×{.|†Š(”"õÈS,TÜé‘ÉçÏqõõRŸ]µ›
Œäbþ‘X7Æì[—=àºpÙžË^vY…M]wí)
+3‘äxÑ—¶î¹&ö–GˆAÅÇ›»ð•¢þz͈Á€bÐÚ›ªÉ¡»Ù–†Ü	ôH×Æ…ç/»Ò¥3u¶’’»¸Š¶;bpdF»¦G»ÖÄòà,A@Ý¢–àÞAò¼ØB`ˆ¾a¥£‡-(@tâk21õ’™`-1œgÀ©â™„…©¾«î°9Pöœ/æy2‰©ŠÜŒ£ÆK
+©¡ÑòL1ϹŽbÉà]¤™âG5‹J¸Ã™P`¼	™ìßRÎ÷+‡Ã¥'êyðt“2™„2Ӟʗ³£BÚ*jÝ#0ôÌùÒu¨ÑŸ»$,Š
“?Rº^6¡¢¢·h( .D3à+å:/³žËÂŒò)„¤Y.Ën– À¾N®?ÑQ’ÂæÃ
N›çšcØ@Ü$ 3äã¶ÈKÄÉk%sX;>¸aƒ¶$Ã’ãÊhÂã®Ûù§?ü~YõÞÞ}üxó†úpò*óŒnÏl×Õ›¬ó+,JÁ6Æ©
+êSz¿èôTTEC0Frn߀‘œÑ§[ÙF-$[Ù¾ÜWÙ_S‘¸Û.a–F0½ë^
+¨Ô$h•›4LZ›¢ÁæÉy×ýàzþp8áôN×%‘@GÙ ÿœH“ B¬.~b	=×·d8YÍš®¾&‚š)¾n]j‚Ä §Ä`µéN˜®uDD{ø-§°7D!¦R½Ñº"W >quT3ÑîlPtã‡+º±kŸ¡ÅúÛ}‘5Žd±<äsKÆ`Tgì°ðÈ:Ýš¦Fºø$H7Ü05”%²8eýýàH÷ ë
+ÚëáËyÿÂï¢W;T9ÀåëuýB]‡
z¬¾.7eø³M½ó«Ôäçë:w8¯ý\¼`}ÜÁD	OÔep7ä:{®ÜMÑ®B<Þ«þqe’l¹»fÊë‰'„QàßÅ#ô\gyQ‘²a|ˆ•ÑÜ€r­Å´ôæÑ@[Á^-v<ðOTðÖÁ³_¬l ØÍC±ÊžK{µÂqE-™Å£‹x+|µôŒš¿Èʤ²Æÿe•BÑì—r–|?\S'_eÕSÿÜ…5ú~2ûŠË%õ»ŠŽGWt0üÞâV Öб(ì×¹Z„¡'í>iý¸¥>Éf<Š;ô¿/Á¾‡¼¢ô°ëˆæŸ3ŽÖÌK]iÔ‡}?‰:›¬í
+ÿË®ûT>Ó±a°]Óo›ÆŠ6\zNy;-h§«›Ö{#TªÞ¯‡fa=òÙ×Ó LÙ¸ðg·ÉŸüœÅš:XœŒ•H§ôŒ´å@7VSk•ayè»/r,
_Î,µºñ‰é±ööBtïÇú)J÷;©’ø
+‡“B¼gôh¥zÒsIaÉ’5¥ÁÓº~°—Ã%¹'i§\°W~î>,ð¢.ÙtüÅ"¯}*Ä'òn÷@$ªuÛ»a‰¿o¶SÝGn2íþ'Þ¶FoÉmùðÞŽã{¿bÛõåàååü/¤±ñ&bë«—Ÿþ;‰Ãï<*"!=óûx©0‰
+U¥õ±äýTœŠþÅ„q
endstream
 endobj
-1022 0 obj <<
+1027 0 obj <<
 /Type /Page
-/Contents 1023 0 R
-/Resources 1021 0 R
+/Contents 1028 0 R
+/Resources 1026 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 991 0 R
-/Annots [ 1026 0 R ]
+/Parent 1032 0 R
+/Annots [ 1031 0 R ]
 >> endobj
-1026 0 obj <<
+1031 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [297.8955 194.3978 347.2449 206.4574]
+/Rect [326.242 194.3978 375.5914 206.4574]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update) >>
 >> endobj
-1024 0 obj <<
-/D [1022 0 R /XYZ 56.6929 794.5015 null]
+1029 0 obj <<
+/D [1027 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 406 0 obj <<
-/D [1022 0 R /XYZ 56.6929 554.7106 null]
+/D [1027 0 R /XYZ 85.0394 554.7106 null]
 >> endobj
-1025 0 obj <<
-/D [1022 0 R /XYZ 56.6929 530.089 null]
+1030 0 obj <<
+/D [1027 0 R /XYZ 85.0394 530.089 null]
 >> endobj
-1021 0 obj <<
-/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F84 802 0 R /F86 982 0 R /F58 631 0 R >>
+1026 0 obj <<
+/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F84 802 0 R /F86 986 0 R /F58 631 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1029 0 obj <<
-/Length 3197      
+1035 0 obj <<
+/Length 3191      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZÝsã6Ï_áGeºVù)QíÓ¶›í¥Óf{NÚ¹™¶Š%Ûº•%×’“Mÿú’–9Ù¶7›~ H?”ùŒÁ?>3:f2S³4S±f\Ï–Û6[ÃØwÜÑÌ=Ñ|HõÍÝÅ—ï1Ëâ,Éìn5àebfŸÝ¿FßþëíOwW‹Ë¹Ð,Jâ˹NXôÍõÍ;êɨøöÃÍûëï~^¼½LUtwýᆺWï¯W7ß^]ιÑæÇáÌ„÷×?\Qí»ÅÛ|»¸üýîû‹«»°—á~9“¸‘?.~ýÍ
-Øö÷,–™Ñ³Gh°˜g™˜m/”–±VRúžúâöâßá`ÔN:?¥M¬…Jfs-bÃÄô!³˜i8´yªxœdÙñÕä!{*<ä²hºù¡ØÍ»êÏòtË\e±àf0ejù@õÊú\+<†ô`–ÌJLÌu‡d©»²ï.ç2Ë¢~SR%/Ê}_ueq9WŒEWïnniäçw?Qåþ°ºä&Z•{jÛ¥l­jÅS_v  ©6Ñ/—™ˆòº*hè!¯¥[4ß#+&웋Xáþyœi-¬|š ä,ê[(Y)–%Ôc— êoL³ÀÚí¡ïª¢¤ý¦rÝû¼Y—T}¬êš†ï]OWÕeÓ×OÔÊ‹ÿº¾,€3‡m(“EwG	Œy´ÊuOm»2UýJ(elwÅü~ȉ	3Ñ¡;äN:ƒ¼kZµ{ªÀåôU³&ªñ½Úq:åDѴͼ(½`ÐÃMY—=uÐ"“¦{,÷Ýsíò®oƒ®¥ßX¡ÛÃz6ÎdtOíeƒm7Âíë1¯ëŽˆúMÞ;òº]~¤êjŸ¯·pò¨n8s—/?Z¥ÄÁ¼)¾ÄÓÍQ$4öˆì½ZYâµ;ß´ur+yC8eu
+NyÉv†7*ÎXè!e̹ÃU„BžÀ@#ƒùæPÕý¼r\»rÿ€v‚õª»Ýæ}ÕºÁ?Û¦ì&Œ”ÑRŠ«Ö˜#3ix´£#EïÜh»ut›²Þ­5U¾nÚ®¯–48’;F·‰3rêoÛ{¿Z»¢¾û°9l‘ü–àÐç…’i´ëÊCÑÎûv7¯Ë‡²ží6Nvû:"›q¢ÓÔÔ}Õ‡$ÒX¤Ü#™	VÁåžßœH•ž8·‹3c<Õ²åG—
-¼€ÎíÂoYš£šÙÝåûžjö¨$™%4'­‡ª|¤a­®,ϹÅÏeý4´_Ϩ²˜Šää)䄧òD¸½ÛréôgV…î®$è 8Éó	oåˆ^á/”Ñ•À3ÃÒúÄýÉ,–©I^¹@ 2\(Gõ¸©–b‹ð‡eWÂ5@K0€«ö[³zŠ•€¡Ø û
-"¬s"
-fbZëV¿¾™<Oa‘|&EBàÇò
.”ø=ÁºnïÁYX')!€I%OÇ6@&ƒýìð^;jt{YåS2sÆc#ŒqT·ó?åþiBxX|ƒ§-ZZ¡i{ªä»zO\‹Žúz²¬Z»AWªet½¢¾§ö@•UYÖañhJë2rFXU—ß×#Î7$Ê4{Z»œ¤LÐÙ¢‘*å°*á¤ÒÀ¶1H±ä`À{êßP1œŒyâþ±áfÌk Ã!¸Ðæà9?Ñ¢E‰¾³!¿ýè°,?íêjYõÔòó4¡
ôœS˹HtœˆGóržyPu.<ø‹å9OXYÖ¸nò•#s´VàµN^³‡TçÃì@eÏ
BD¯SÄâ£zõòÂjbå±µJ89p£¥­3©	2ØFï{ƒ)b}Óê‚êdÚ»½„]åTqY­Z¤òlòm9á&E*b-ƒ[sòÄgÜeŠ	#Ó«~ãVyÚMyL¥c)3îÈïþs7gP•žã²F%à¬T2Ö¶³˜©ÐÏ‹×`=ürŒ©ƒp1TŽ!/4lœeïG]ðWS+\6BxukEvžçàîrZLcdÝîÊeµzBÃœðOLCìž\…[hbWˆLÀÈÜr(ç,Íy˲ë,"`ŸUÍœz@U§*Ï[¡ÊD,u*_¶Â!Õy+T(ë¢J¯›#3„pKBdöâžhbá‘ŽI‹L¬LF˜$Gl«÷ÝÁ
-±î­ }d…0FVWx+„ª=æ!ÏsVhx¬Ò$sWï:g†pÞ2!.2m„Yƒ5-O²ÈϱF˜«ÏÇSêB¦ô—
XÞ‘‰˜Ä[^Gý6gÄ’’•áÕ`7%aXƒGYnªf@K.oHâg'ƒÄG»H4â-|%ͪ…<ŽT¥Ö¡
-åQ: çõ"aìí‚O XÇ”ôÞù	»}µÍ­:`ã°ßµ6˜Q¡¡Ó…WÊx¤îÊ•6rAˆ#š°ƒz}\J|&2&ÔEcí²²5íšPBX¸Ì»žt.6¦$ßR,û¸è'O‰=¡4!æÚS-ÀT¯Áè–0BŸè8ñA|ûzÊá€÷Ddac\£06“1Sìûþ?hÇÁ©(ÐÚ—Ñn@õÚyªA
Ϋâ9äéXh#^^>PM¬?=ù*Äl#è¥Ñõ»!D¥S°—`/9½ôöÒç°—¾{ug*<$^¿‹o¯¿\-¦‡$†¨_}.èAäÁ9KþJäa%>CÚ	‘9d.#eûlÐ>Ú`ô1Á…Xú”‹0ÁE&XR6#.yD°¬râ3‚áh‚®xër[¡ŠŽi€Ø 4:8• t‰xKc˜’…7å¡Xfg!‚AÂÎÕ)DØ9ÏÀ IO•3ÁÃÙ˜¥™oüEÙU†Oçé´èRò€uSâˆe©Ì‚bÛ7e˜³Ì)ã”ÌZãd$”a̽Œñ¡§„VÞÑ°óeØe“Cd±qS/›»XÉ8yIž8:€Î¡£ãÌ)µf!„žx *3y>Ù#˼]VSÖçÍ¥çw&4.%,:ý‚™³Ú©§ØÔ=ņÞöy_ᨋ«ßWuù™ï®ö÷d:¦èµ[—M‰oJ…<¦òÙ‡µÊÍíªmUç6³xã¦\’Mo)Hk†e^;
-Ö	ú|üÕUÍñûC
-X)ÌË;*ÛcU®«Æõ:¬Æ”ŸŠ"¶7¾ú±üjâjŠ䴾øâ‹é+xV$¨­`Pif2•Yµ¼¢g‚´Àes{jØ×VmðQÖz¾Æ>unЕ9pMAtÍú¹©>Í»þ	й.©«¯¶%nw6®VѶ̻ñ.7ǵ+—mSøFÕ,‡ïóæÓ»ÚéG!ŽL3ñððrqô¾Å§8Šˆíî]‚Ϭ)dF×^Ÿ §¾Î9鹟ÑHÖç•{["ïÅ€¦·Ñ5.NÙÉChƒY’û”èÀ5ŒùÉV'‚YzisGKR$eŸç¨aê
uæ6v×jz’ô±@`3,@—~£XE½mɪT˜%ü«×UçŒhøÙH®';™lÛ~¯ÃŠ{¯Q¨oUàíÑ[‚42ú¡Ý"iSÞb½ñR"iØDª\R4½ðºz°_àFÏV[C“,å„Zº…ÐÕn«>@­>ŒÌçÐ@®ôõôAct–€†p¤$#‚>:ì#¥ƒ.gÐõèÏO(ÂãŽp?¡/ ª£m©»÷ÂŒæàxBÆÆŧZ"}}r2å'@ŒúsPò7!Ò×`òHówq’„È2åœ9û‡Þ£Eàpeá£,¾z–ý@Ä©tª ^‘ÊçüšC*ÑBzòkŽ¿7Ë»VilKÎK@óðrUš‘ž°š‡MÍ!¬Tºù_FB2Âá¼M¢è•²Œ\§‚Fi±ò'YšµW>¨[3uLèK.ô‡„Û¼pS­"{°óo¦Ð5Ód
-ðchõ[ê®…mŸ÷õÌdþÓ„hæݘ2c.‡™X—ô¨?ìmd!­óÅâæÃÕbñ“$}–ÚíÚÆæTÒ›¾¥ï©¬KJyð;kã¨(‡™‚°ÅâÙ3‚Ü>M1\ê?ÓÅXœŠÄàÛ7äÓ¿êÿî8þñ}A HkÅô‚d	ˆ©Ô1ò²?§Ñ§Ç¡¥‰µj úÿ‹ÝÐ3endstream
+xÚ­Z[sã¶~ϯð£2]«âM$Û§m7Û“N›íqÒΙiû X²­³²äZr²é¯?AÊ’#'ÛöÌf‡7àøPf³þ±™JãÔr;ÓVÆ*aj¶Ü^$³5Œ}wÁ<Í<͇TßÜ]|ù>å3Û”§³»Õ€—‰cØì.ÿ5Jc_‡$úöÃÍûëï~^¼½Ô2º»þps9ç*‰Þ_ÿpEµïoüñíârÎŒbÑ·ÿzûÓÝÕ‚†RÏã›ë›wÔc©8ÃtqõþjquóíÕåïwß_\Ýõ{î—%7òÇů¿'³¶ýýEkÔìI̬å³í…T"VRˆÐS]Ü^ü»g8uS§ÎO*+.S8I›„O2‹5c@£%ƒ5Úã!ËÉCTxÈE^·óC¾›·åŸÅé–Ob£Ù`Ê”øžêùŒ«Ø(Á_ỸY©‰™J%ˆBê¶èÚ˹°6ê6U²ü¡Øwe[ä—s™$ÑÕ»›[ùùÝOT¹?¬.™‰VÅžÚN”«•µ§xêŠ4E+ýriy”UeNCYu(¼Ðl|Ü2aߌÇ÷Ïb«wëSŒ%K¢®2±‘LlJ=NUKTÒ³…vsèÚò’Eyá'oJ?²Ïêµï|,«ŠxÞûž¶¬Šº«ž¨•åÿ=´]‘s;‘ÆFwîŒ`F^¬²CÕ¡“LÕ W»]%a?dƒžƒ‰í!óâé²¶©ihÕì©—Ó•õš¨Æ÷êÆéLL”EÝÔóã ?,ªna@¦¬‹Ž:èN‘IÝ>ûvÈÙF»¬mÇÛ ké6nÑÍa½+ODtOíEm	7’pÚ×cVU-u›¬óäU³üHÕÕ>[oáØQÝpæ.[~tJ‰ƒY‰§1š#iÑØ7">²jåˆ×þ|;ÐÖÉ­d5!•Ó5¬xå%ÛZÜœËØ&©žÍ…ˆà*Káà2ƒùæPVݼô\Ûbÿ€v‚õ²†»Ýf]ÙøÁ?›ºh'Œ4!Q’ÉÖ˜#3aX´£#(s§ö8Úl=ݦ¨v«CE„y™­ë¦íÊ%
ŽV£ÛÄõׇí}Ö¬¨ï¾ß¶hýŽàPçç%t´k‹CÞÌ»f7¯Š‡¢šçÍ6NnûJ‘Mð8UÚxº/ë|⸎¹f¹%÷ü渹ОüÙ‡Û	†2‰­1jYò£³Ó/ õ»[æ¨fnwÙ¾£š;*Af	ÍÁ‰Aë¡,iA«-Šsn1Å3L,B?
í×3ª,¦â9y
+1á©nï¶Xz=dÖ©0gÏÜS±²Â×òÜ[¢——ðŒ®¡•€g†¥;ô‰û6Ú¤¯\ Pƃo{Ü”Ë
±Eøò-àš	 Å€§ö[szŠ•C±A÷Õ/f["OL,Ak½ô뛉‚‡cfÉ×½`R$~,ß  Àï‰ÖUsÎÂ9IŒLm¬ûÙὶÔh²©5³„ņ›`hÕÍãüC±šXŒ™Í
[FŽ¡fÕ@G*µó¦\…HxÃ’0ðö‘'P¬µ„cÊxï„ݾÜfN°qØïÉHÑÐéc+i‚RwéK¶À uèA½!(%>éê"¬cíS²5L(!&\fmG
:—ýR†ï(–ÝüóS Ç¬žðšpí©ÖDS¯è7\è8ñA„ûzÊåˆX+à½G6Ša­ˆ™è±^ÿðŽ[‘ µ/ãÝ€ê¼TƒV8/ógaG[1ù‹ÒÑ„tq’C6’îOG×ï†ø¤§0O0/=Á<}‚yú9æé×1âm+û'ÄëwñíÕâ—«ÅTÊB¬%Ä	âˆK=KÒ¿{8ŽgÃ_™pË!m)Ûgƒñ·l€	Ð{ÄD`ò-6À›`I©÷˜‡°òÌ,XeÄgÃÑú€%X—ßÂUÜà˜耭:@Ó£ƒ×
+B‘ò—Ñ':†)¶PÚ‰cv"ÈÖ™<…7ç¤úT?õfÐƉ¶b¼ñ×.-¾›ëé¥Áz¬›Z>€˜Õý[=&ÔeFÙ¦HœýxFÎ?BÙùW16t”ÐÊZö®»\bˆ,6~ªwesŸýJ§Zœ€é‰Ÿäú9–x†þCO<p¥™<ž‰Ìì,±Á,Ë)c„ãf"ð;swÒ~………íÔ3¬öÏ°ýo»¬+ñùÓÖï˪øÌ7W÷€{2ÓóÊ­‹ºÀ÷¤<<SùìÛXéç¶å¶¬2—Z¼ñS>Á¦w¤uØ°Ì*Oá0ÃùÀ‹¿*Õ¿=h€Jn^ÞQ~Øî<«b]Ö¾×£5¦ûTT°½	ÕÅWWÓK$·õÅ_L_Á»^bO‚ÚjA­±Ò:µ¼¢g‚¬À§s{j¸—VeðAÖù¾Ú=µ~ЗpuNt9Íú¹.?ÍÛî	°¹*¨«+·nw.¬–ѶÈÚñÎ=7ϵ-–M‡FY/=‡ï³úÑ›Úé!†L­Š˜8¼œCJ½oðŽâTù{à+Š˜Ñy÷/Ï@Q_ëýð®<Ìh‰
+VÖe¥W"ÿÅ€¦sÁ5ŠŸì×ChƒI’ÿˆ”ªžk?&;užˆeé•Íû%H‘¤{š£„©7Ô™¹Ð]ÉéI"<ÄK°`¼·q6ŠUÔÛ†¬Jö³Ä‘ÿQzU¶Þˆ†ŸŒ€dðàz²£‘éÀ¶Ý·:¬ø‰úVö¼ =zLFD? ß§ÕjÕ?ÆHzꗧÉè~ZúœhZðº|p_ßFz­r†ÖOr”jé
 «Ù–]9$}˜Í¡\é³é9‚Æè,1<áHAF}t<ØGJ]Þ
+ ë1<œŸPô¯;Üø„¾U=mCÝ]XÌh^Ј§!d¬}qª¸¤¯ON¦øˆQ}Jþƹ~
&4'iq=²LùoÎá‘÷høü[:ø(ò¯ž¿øXÙ-Äà‚!Rùœ_ri ZÐ'¿äø{³ÂB`×Rdž'éùмxù*ÍÐ'¬æý¦æUJÆÏýƒ©s4Èëb“Jz%†ãÖ©QBR,C¼I†€VtêcÁJ=úˆý}:m–û©N
+¸y7S`ŒŠi¬CüJý–z†²°rBã?œ¾J8û‡fÖŽ)mâ3˜	¹¤FÝaïá|/7®‹ø«"ÒÔv×Ô.£Áò}GeUPƒŸXkOEÌ‚-Ï	¤Òp—ïîôŸ©‰L’XóÔàÛ7dÓ?èÿþ8þñOœŽß{aAÔòé7L…¤&¿bУ©JŸ¿™$`¯)Tƒ¥ÿæBÏ›endstream
 endobj
-1028 0 obj <<
+1034 0 obj <<
 /Type /Page
-/Contents 1029 0 R
-/Resources 1027 0 R
+/Contents 1035 0 R
+/Resources 1033 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1035 0 R
-/Annots [ 1032 0 R ]
+/Parent 1032 0 R
+/Annots [ 1038 0 R ]
 >> endobj
-1032 0 obj <<
+1038 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [84.0431 608.1033 144.9365 620.163]
+/Rect [55.6967 608.1033 116.59 620.163]
 /Subtype /Link
 /A << /S /GoTo /D (view_statement_grammar) >>
 >> endobj
-1030 0 obj <<
-/D [1028 0 R /XYZ 85.0394 794.5015 null]
+1036 0 obj <<
+/D [1034 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 410 0 obj <<
-/D [1028 0 R /XYZ 85.0394 675.8841 null]
+/D [1034 0 R /XYZ 56.6929 675.8841 null]
 >> endobj
-1031 0 obj <<
-/D [1028 0 R /XYZ 85.0394 653.5729 null]
+1037 0 obj <<
+/D [1034 0 R /XYZ 56.6929 653.5729 null]
 >> endobj
 414 0 obj <<
-/D [1028 0 R /XYZ 85.0394 349.5008 null]
+/D [1034 0 R /XYZ 56.6929 349.5008 null]
 >> endobj
 935 0 obj <<
-/D [1028 0 R /XYZ 85.0394 326.5221 null]
+/D [1034 0 R /XYZ 56.6929 326.5221 null]
 >> endobj
-1033 0 obj <<
-/D [1028 0 R /XYZ 85.0394 138.5868 null]
+1039 0 obj <<
+/D [1034 0 R /XYZ 56.6929 138.5868 null]
 >> endobj
-1034 0 obj <<
-/D [1028 0 R /XYZ 85.0394 126.6316 null]
+1040 0 obj <<
+/D [1034 0 R /XYZ 56.6929 126.6316 null]
 >> endobj
-1027 0 obj <<
+1033 0 obj <<
 /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1039 0 obj <<
-/Length 2879      
+1044 0 obj <<
+/Length 2886      
 /Filter /FlateDecode
 >>
 stream
-xÚÍÙnãFòÝ_¡Gy1êíû@ž&‰'ë`ãÙu @´DÙÄH¢BRò8›üûVwuó([Iæ!0`««º«šb
-l¢4ÑŽ»‰q’(ÊÔd¾¾ “ûê‚EšY"šõ©>¿»øç;Í'Ž8ÍõänÙ[Ëj-›Ü-~˜jÂÉ%¬@§_¼¿ywýÕw·o/œÞ]¿¿¹œqE§ï®ÿ}…ÐW·o¿ùæííåŒYŦ_üëíî®nqHÇ5>¿¾ù1'½½zwu{uóÅÕåOw__\ݵ¼ôùeTxF~¹øá':YÛ__P"œU“'x¡„9Ç'ë©QRˆ„Y]|{ñßvÁÞh˜:&?Ia\	$%’±Ó»âv Äùs71ꃠ)	u´S‰ì«„1E¤5£Ñ‚‹ ’*_æU•­¼l€^ôèA*FI›x»Çür&Ÿnvëû¼B¸\ú§˜þ²Ë«"¯ùôX̬.™æõnÕäÄ›þHÜ;¬˜™?l9cŒ8¥xػޖ›:¯É¡¥2 B,õÿkÂÒ;™%‚O©”–òWô#1œ¹ÀúæcUÕysžz„µ­z<ìÕ#¬ëÔã‘Q=ªÇc¼züŒ›÷W··ïo‡Ê@'Ž“P%èaOEóˆÐ¦Äç"k²ÔՓçU—ü”êÒ–vöup,c:ªkQ®3âYúâJµúò°×—¶úò/Q_ê‹+ôåGn¾ÿòý7o¯oƼg °ÓJésû7ö!m8ʽã´5ÄQ†1n™«]•ŸéCJ\²ip#x
n¤zQN¨6Êyü)Œr~$ÃW<@ êÏx!Ö¡•Í#š6Ù&AeÏîË}þ‚F{¢ú;k—Ò½µ†uu1kÍwU]”çú™fŸiL[×ù¼$?pžíêàa@Û¤ê¼ÚãlÚ”8¸Íƒ&G¹,«5ª	µNPE|–alÑj9†Ï)å›EÒwÞCúlT¿©Ÿ`:/è¿'ØO¥ÿ®²y­Tòs5¥ÒŸ›•´#Â@é2ãŽX¡X¿Ä:*µ¸þ­à`bÌΔîLLŒÔªÊÁêZí]eÁ»µ
FòìA—™ûàè0xÿŒÏ $O’¬Ä#ŸŠÕ
-¡`PHÌæÍ*N+7y–Ñ’û¦Ï
hƒSM¹ÞÍçy]˜¼NtoF–ÒD*%#Á5¬d4ˆâÌ•NW'‚A%ÌäùÌ›R'ŒjWšÑx¿9^q&…!†y…÷–Óá_p¯NrKÎwŸ'£Â×ù"û›äxÑ/×ÙsÄ,Ež­VÕ¼wD³\ÝòôR4î¥ILórG9'ÎKÚ}Û¨"”ƒAµeämcÆ4[”Ò.ÐÁšß6YÖ‹]Y•­×Y”½2½sBðã°Šc1‹Å54¬WlÅ—ÿ…Pé½×7ÔÓ}ù°«‘ê9¯.«Ÿ}5é_?‹¯ÛªÜ‹|V|\VçϪrðçº9{-_lþÀÉš
-¢3¸Xœ’2Ï«ô3Ÿ2²)¤Š"AbÃ}xÿ
ëlóñu;…¥mÂã§1^>äÏuÒExÔMUlÚ‰Œãüƒ‚Àïç°R—»jžw¬[Ù³‚ßÂ\¦æ– F
-VøGŸ7FOzøŽ¹mY5­eu/xžƒ 	S^:Õl¯ûÓdz
-Òbñ`òÄÁä:çÐøª‡Úøý³17¥áv€	';÷´¯»ç—y¨B4:ˆVßÕÙÃXlý–µåÒq¸bPªi“²B<ÀH8…#k¢Z=<ÛÏ–ZÆùcVA"„ú«nŠy=Ѳº.çE»~Ÿ™õ+«uÙÄ	›l¡xÈTAn€Ü.¤·5K¬bæev!ÇÈ3Øΰv€°A œCpG0‹cXÑÁÑšr‹˜U¾ÏW‘~9 ‚•Ê—Üîʢ^é1«HPÆå‹M
ñWÎFØPI3%l<ð¾ÈŸF¸‚Ìd•=â
-|_7½^ž^ß_KZøé}…JnÄXŒç¹j ˜E¬’<:p
-ˆu›©ÝIJ¬Qç(Kv´}²¼ƒ-1—Û®Ý2Ól»m±%¢bqn‘K¤B—³ÚY>&Áòæ7ðvÔºIÂ}‰ñ'÷‘öe]£4¡öM.Šs‘/3èÇñº#$©àõ˜J‚¥š>—;E=/±l‡7hµé c©QÆ¿·5>ÀEχb¦‡Ë]œŸ-âY“½Áúʧ-eÑà3‹«Äȃ±yh‹ûïƒwøe—»*\ŒäßÞÍQN‹à½Œ¦K'šÄƒ/ûlµKËQ—²D_GýàOEÿDUÔ#+9¢YZó“!%·$Éa€œ:iQ¿»9…–·5ïAx¼›Æ´J»ÍW±Kƒ8·È}™Í¦ëýPO9^Çøì÷Œ®Ê¹oÉ=®K9oü6$©yƒš†Á a _guÓ#bIÏƵ÷t°mécHØ4d¼°À…a¡^ˆµJÿpª§¿bw	Pªü›¿PÌ7ÿ	Àzn`ìð>àJ0‡ð«lŸ{Oi8Ö5Ž““ÆÄpå—iâžcQIXJL[`@=f’8)\¯äôˆq	Î_ óƒö¢‚O–(vn8€A7ö²ˆ4 ¨|Ÿfl˺.îW9AE^Ç<óëŒ2Æ¡#U]ÿv†ÍûËg«Xôš‰ðZÊ>,Âyªý!“"2Éá›Y,G¡ büõ%CòJäyµf7Óþœ.šG¥(`ÉÇ{_fHìÎtQHWJ$.·±‚Õ‹M·žS°u<Vå}¸0ó¸0µÆ—{pÛq™ˆ
-™%ã¯S´“CÉdõ òŒô ¿è—«ÊpEûж•¿™8ŒLÜrŒL1,q˺°ä£,X
-K7p`äéW@”EÚèÔܺd<–÷Ýgz¨UR§†N‡1ˆ=´c5]¢·­ã Z³JÈㆆ­øˆgº.¢zÏ´:z¦ŽÖf6oúò±d­&~t‰g‰Lþ2•·IëuµY­Ž¬Õ„5؆05‘
jJÌ©Œ¤±Ö¥
{\kþIŠ6ì|DÅ[ëÐ9m­×ß¿óÖ…<ãàm`e_ãÖG~x‡QÒžn·Å¾×vGS\¶kÊ5ô1óxYƒKuÝg¡Þ¾oa	‚àÝc¿Ç‚Ø«T÷ïšÃr(F8ü,)ìt“wðåØf—ÎÙ¼&.\û5@¸>ó¶Ï¡k9t±è¶?Kz-Òöeó@2…ojÕ+l¯*ó³ÇJ1) bqN½˜(g-ÕÀëÇr·
-5ห§ì¹Fø©¬>xÏÑ:},qÓí®ÚbÛ£]üZâN…sˉBÎ¥á©HôR
”J*u¶Ççq2òUÄ'~«ñšþ²¡ê\ÆŒÞÒaõm2øÌAb„!CR›´@•1åµ6PŽÌŠXoyªû2Ü_.­£í¢/R'Å:nVÆÑÖòà¥ÀüËüW¦¸ßÇlíKÇtÆ"ž°í£¾;¶VÞ(÷»‡‡çƒ›¤y•Õ©ÅHQj^VÕ¥î¶MÝý ^Ú ûEá,rêg9ByÃbc¿¢¡“dÙù7;Ýš¤!ÂZ>þ(~Kí©¼Ì”>:;£„ÍÇÿ½øpØendstream
+xÚÍ]oã6ò=¿ÂÎa­¿D}Ú¶Ù^Škö.MmQ(¶œk[®$;›^ûßo†3”%GIÜvŠŸI“N³ä|f²túùåÕ—„ñôùâýջ˯¾»~{nõôæòý¡¯/Þ]\_\}qq>ÎX/y‡g¼»ü÷A_]¿ýæ›·×ç?Ý|}vqÓÉÒ—W¤
+ùå쇟ÒÉÄþú,M”wfòƒ4ÞËÉúL•­TĬξ=ûo·ao6,ÓŸNE"¤Q“™I-Äó§Ò	)œÊ T‰G>‡‡Î„²‰6M¢u’úô`Ý7‰Ð*qJ™‰5>É”TÁ&u±,ê:_¡r`ê-µX£-œ‚„7÷ÅùL9ÝìÖ·EMpµÄ¯šþ²+ê²hùp_Îï	¬Ï…›ÍnÕ”›þŸö Ì#gB$ÞÎn¶Õ¦)šäØ‚Lh3p¼¾äM›J»DÇNf‘àSH¥KåkR –>ȾùX×MÑžfå\g„Ñ>Êùƒ}ÉöAphÄ }pÅÕû‹ëë÷×CkPó"²	EØCÙÞ´©è»ÈÛü{õñií¥?¥½2Y&óî5{vœÛkQ­sPãI“ÆtC
†ßÎ`8`ƒ!84˜4Ù´<Ó
Wßùþ›·—Wc!40Úó†éKü7¤ÌÊDÿZ¦ËœM|*(Ó-órµ«‹ɨ`Pnˆ%†X2½\§L—ëK†rÎä4$UÅB©jïÉ=Òi{Ÿo"TÅùü¶Ú/˜´§«¿³Ias­ýk¹1Ë`#Ÿz.^ó]ݔթÁ–‰C°eT½w6Ä`pžïšf@ÛÆ
š¢ÞÓbÚV4¹-‚)G-¹¬ê5Ù‰Ì9¨’¿U˜[tfæ$úcšÊÍ"¼è!±hÛošXÏÐÓì§r€C‡óZË„kljZ¦?·*2"2Ÿ(ÌLzp#ú­Ö“–K¥Y⤷àcÂ%R˜ìàcj¤g5vÏt°ÞEÂ;sÁIôÑE¹‘“·ô
FB’è%ˆ|(W+‚‚CAñ1Ÿ·+^Vm
+–ìÉ}ß—¬!Ù‘›Ý|^4͈Ã+%K¢{3²Q¡Ö¼ÐøÁN6{u#ÍÏ7(J@;,ô©½P9µI¼²¦ÛiƒAótÇ™†Œb…’Þåùä¯$(7‹ê‘w[Ä“µ×Åòú›u”ëü‘1‹EÙBXç«cØÖ1tGÌ*u’u2½”Ê@z‘¦Qój¬eŠgøMºs»”´Ä€\Я@§>£)Qá…JX¸]¥izÈr°ç·mÞ†ýø6Uçëuκ7¶Ç'd>	»xÁ5Œ÷È`¿rû3¨ˆÿyC×Y?´Ómu·kˆê±h~®êŸ±¡ÄágcÉu[WûrQÌÊËúôUuÁÜ´'¯"ÖŠÅæpÖÖš!ÂxI,;¯ÒÏ°^ä-Qþ˜š” È3Îõaü}Öùæ‘ñM·DÄcÂç§1Y>M´Eø4m]nB>Åá'I~?E”¦ÚÕóâ J¹Õ=/ø-¬™ÅT
€H¬†;ü#LAÌ[›MzøƒpÛªn;Ï:ˆŸ™€Œ	K^âj¶ÏúŒeOƒr àKèDb‹ñ'ÏÑ]ʺ!mÂe¯¸b¨ÎE±Ìá6N¯¡H…¨§RT¨Íô±Ú°(›yE=;Œà¢Ý"”k3È28î|€Ë†¾wå>L„«¯¿Í|@Þæo¨ù‡öéCGY¶ôÍynä›@[:¢·]îêð,0R{oG‡tZ†èi|vJ£zh°ÏW»øÜ°
)—ˆk¶ñø\öTe3²“O2ÑåŸÎ=ÕÀe€bX&1`€‚:Z1{!wËî»{zħ§,ëî ó_Ñ Ï-
+l³Åt]R\êá¾ ÇÐeϺ骚ã}q‡’ó_µ¡HÍ[²4Lý:oÚ‘ˆv¶¾{¦ƒc+Ì!áÐPñÂR†õIŠJ˜}Ðú~Òlú+]-ŠýŽðI±Ø0þž	À{#nàì0H¥„§ÄøU¾/%cuC³Áå´µœ®p›–ÏËJÊ¥‰íè±Ç\C'^+ß»Êô‰à”<¾¡Ë£ëÅA	X,IíÒJj6CaüeÁ4 ¨bWl«¦)oWEB†¼ä:Ã}F“p#5‡ûÛ	>¶ÏWÜô.aX
Ú9l?õþXHÅBJ``3ãv"!!^_r$4¢$«³°º%„F>=»¢b°bòñ»¯°&LìOQ(WFÅx®¶ÜÁîåæp
+q@%ØqŸß»Uu^Ë–64¸…°ýÀÛ0*TÒ¾¦d^5“7ƒÎ“3èQ}É^î*µS²»ó÷î¡#b|™8ÎLÒIÊLœ–¤‡´„“¬Óâ,ý!-!]
+ˆr¦å –ÎGçq²Þ´j4êÀ¬:õft”ƒ¤Í†~l¦KŠ¶5O’7›˜ˆ7tls$ót‡ŒŠ‘é2ŽÌŒ½5¬lßôõsÑ[-ÿìÂ<Œd&p@-»¢õºÙ\fžx+ì^rú†žz"¯Ž.¨±0Ç62å^7=ø0â:ÆKû0xFñ“u¸9쭗߿ßå•>Jã”m`†tßЀú#œ^ð4iév[º÷âìacv%À延ZÃ=fÎe0¹¤TÐmêû¶H¼¹/øwcnˆÑ¤*„ÿá2pÜÅ(O¿L*7ÝAA€¡°Ûì"/PÍËàâÊw?(ßÞõ%ô„ž›~åú먥Gh¯ÚÏÒ1}ÃTg^åz]®kÅ´‚ŽÅ{ób¡œuTƒPlî«Ý*ü¢ì®òÇ†à‡ªþ€‘“eñ—?Ýîê-]{2Ï?•øçÒ¹“‰VÊœœÎµ•±ID­&J£99â¬÷ƒ<Ér•ü¥jÐÒ‚@.tÝAJ®èupM†˜9*ŒpEȉÔEëÐee*yÏTP"sŠû-¤º­Âûà8i˜|€}‰$)×|XųçÁ ¤ú+ð'&>ïc¾ÆÖ1òX2G”€êXd3>ùÕ±óò^B¹ÝÝÝ=½$Íë¼¹WŒ˜¥æU]Ÿ»énÛ6‡ÿàG VÎQÂJžûßeбÄØ¿Ò¤“èÙùwÿÕ¤m¢œ“ã?u?$E®PgÆón0ôœ´cÌÿ¢qÊendstream
 endobj
-1038 0 obj <<
+1043 0 obj <<
 /Type /Page
-/Contents 1039 0 R
-/Resources 1037 0 R
+/Contents 1044 0 R
+/Resources 1042 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1035 0 R
+/Parent 1032 0 R
 >> endobj
-1040 0 obj <<
-/D [1038 0 R /XYZ 56.6929 794.5015 null]
+1045 0 obj <<
+/D [1043 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 418 0 obj <<
-/D [1038 0 R /XYZ 56.6929 567.2594 null]
+/D [1043 0 R /XYZ 85.0394 567.2594 null]
 >> endobj
-1041 0 obj <<
-/D [1038 0 R /XYZ 56.6929 541.57 null]
+1046 0 obj <<
+/D [1043 0 R /XYZ 85.0394 541.57 null]
 >> endobj
 422 0 obj <<
-/D [1038 0 R /XYZ 56.6929 374.0866 null]
+/D [1043 0 R /XYZ 85.0394 374.0866 null]
 >> endobj
-951 0 obj <<
-/D [1038 0 R /XYZ 56.6929 342.623 null]
+957 0 obj <<
+/D [1043 0 R /XYZ 85.0394 342.623 null]
 >> endobj
-1037 0 obj <<
+1042 0 obj <<
 /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1044 0 obj <<
-/Length 3111      
+1049 0 obj <<
+/Length 3118      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥ZÝoÜ6÷_±o·,?DŠBŸœÄɹwMz¶‹Cц¼+ÛB´Òv¥µë;ô¿©¯•c'…–
‡Ãá|ý(‹‡?±°šq•Æ‹$™æB/V›#¾¸ƒwŽ„ç‰S4äzsuô÷÷F.R–iW·Y–qkÅâjýËòí?N¼:»8Ž¤æKÃŽ#møòÍùÇwDIéçí§ïÏ?ütqzœÄË«óO‰|qöþìâìãÛ³ãHX-`¾ôž™ðþü_g4úpqúçǿ]}tvÕíe¸_Ánä÷£_~ã‹5lûû#ÎTjõâ8i*›£X+¦c¥¥<º<úw'pðÖM³ŸV–i+“Æj΀:eFIåxuŸã&€uhk‘2ò‘'_WgÊ“1Kb¥=ÓªÌöM~)a—ë¼Íw›¢Ê|N–÷y{Ÿïè%ŒˆZÖ«¬$Z“ïÂûÇ¢,‰!kÛ|³mý´š~ý"ÉòìÝÇK?ã>¯ˆ¶ª7›}U¬²¶¨îPåEƒI¬V‹H–j-²E{Oé´ÁÁî$固õÏ^%8†²¹³”{³Îo³}ÙÒCÑÌ™Ï$ŒK{Ó<åsæ1Kc•zFÚ
-Z§®eIÒŸQ¤¬êÍ„ãýv[ïZ´°—ícMäÿÖ•gnwYÕÜö
œ@½n`/IØ’å\îšödf2áL£Ï‘‚ 7 ðp/Z2ÈÀzrÅppR
­ÒéDGæÔišìÎS·$sS2‘ˆñYÑÁ4õÞ
VxFxêªv¿k¤ñnÇônÍæNFj¦xPt“UO~Ss'd,‹ë6[}nh鬡åpöP™/«8™¼­›¦¸)=kQ¡{»÷^6Ùgn‘HK´V¯ÜŠ4Á×
-Ô!†C ÕP‡X.ó[|@‡Xy.Ôxy³o‰™&I8Ëò‰(Ÿ«ú±"¢ÓH7^Ö¾Zƒm]¯=ý‰è>3%õò{ŠexZV­‰}›µ«û|MÎá·0ò
ˆ†¦¨+t³Ä.ë[ú%™8‚c|Þ¤ñòçã´ßÓ‹UVÑ Ùæ«âö‰ï‹Õ=
)^hìRORnë
2/$Ä%Êp©ÅM›M­­Ñe8‹.JÁöÈÝdíÌñEݬÑöëm»‡ýÅÖ.ÏogV‹5K%ÿºÅ	õÊCï,Š§Ëªn):‹¡›äk8/%ãg6jSL¼aåÁB¤zj0¿^¢ ²ãsÉ4s¡ (¥ý›6ƒ"þNK¸âC¹(…’k;³_Àfó%î°ë95bH™JÚaH&$G‚B
-(e±)ZR­‚AµßÜ ¿!:=ÒVuµÚûÔWù	EuSï]0ÁU'ºS˽¸u“êÍd‘‘ùqÚ¸"y”X¿•‘oVõ\ú…Ì%msÀïü	Ce±JO052ÇÔd§Y3`¢¨Bà:ÞðÆ8¢RK£ãd+t"49Ä+¸©X>‘c€‚cÈI«ú+×üêòüÃÉôT„0,MYž0C¤w»»
.(¡cü‡ á@*êp™½m5U¨b4B
59@)ç…å'’¼-í}k–mV~vñ‹dg}ü¥®6õòÈ=Ê\‰äËÿxA‰«àÝŒß÷yÓÁ•=7µj¿¸
-œ_X(,tBgjáHeÆE×ÔédM 4Å]•µûД)Ý!í]~ïò*ß÷­éqßtêƒIèÁ$pTApŸ÷ÂSê³Ü`»Í¡cóOè’õHdÚ÷£‘QÉòÔmŽÏõé~;˜Në]qWTÅaPh^¼FéÛu=óïûÂ7ùãÊ3Z2¼s½§[/Cû!<æ—ìÓú¾ý´p1÷:âàn—m6ÙŽ°ä†·s5.e‰Ñæ…¤
`\5IÚ(5+Ëú±¡±Ë8Øà,¶¥gA™²X³‚ÓÂŽ<æ<àkt‰+
°\Ñ[o^zÅà,oŤ½ô¥7¢G¾ùél÷Å"©[H)ç:A„L«|®~B}iH·è¨³r¤«çåFfF4tÒûº¡å¶Ñ=±ñþ	Ôób"y`âHÆO‚>dY¯=ô2	4•2z
-5R‰xlt*<Hžë!’ºHwÑ	¤Q¾ƒÃ4änH¼J[ÌãyÜ?Š¡v½§õÒA"FûEÊXn|(×Á9Œ£™ÑÖ|Õ‘Gݬ±¢ZRzÂï ©aÊåòÚ½2Ûùma3¨Ùùi~Î(£„#Íx[8÷™mI
xRKýÕ§Xšc¼b?ïIõ¤èÔ8*`ÎN€ÿ:o³¢lNBîÌ'Ùu7«]±¥úíÒòílÒ‚F
o,¿6H¿¤:QߤR¨ º¨¦$/&­Jqj¡ù[|¹ûéø£á„ÃþãPî¨ÿ¡[f		„%*蜌’#•Ú Žë%E¤u·„ÎÂ]ˆ¸À©€¶M¥ ^§gz	Ž¥j·o kG®¹m\öÀ×]hûçäëdi¥a""áP’Ùÿsî)ÁÉÑFÁÛ´;Wý‘-€Ö/‡üß9±B'™ôOMªûaÌ£1™2¸a¬öŸßÍÙ™ã™È0ª³¯ä¯µï;$EïGTL`ð“»	=ŒÎðæËÅ5î«ÙH™kÚ”IÙÝÉ®>¤ådjèñÝÇË˳·4öP剞¨‹«[¼LÆ®cÈY4Af׃!ù0€
zglJÒ·?_àÀ
'ÌÅÍTî8€A™˜Ù©6šƒeât¤ÌáwÏô‚²(p]¿uì…›Ès<5}[‰ÎØôäÌ¿xPÚã"|AiÛýMY¬hìzÀ¾&*ºe†Ÿª®¢l
/¬—ag@dS¤x·ž»êuÅQûa B%«‚b7~ªóW³¨‚NAB}ÕŠ`¹À‹¶çúm$€+Ð(/Â#¬”«ðmÉ,w
©	 	>'ÿmA˜ÉðÉ·Q0ªçÅy9Û¬¿;Ï+í+‚l¼1ÊIŸª•ƒJœÐ Œ/ïñÊ)7¹ÚÝÕáùÝí;ã&z¾ŒÛÝ1^9·áu@-îÊÁÛÁ#$œÕ’¬¬‹†[bî³uР©$–YY¬“+Ï´%k>äÕÜqöÇ=ýH>‰””ó_ó|zì’ŒýÚ}‡2$b_Ïì›™¬Í<0¬ ¹Y×ð©¦ënhn臺`Ò}æš~¸€[ŸÂa„W/”¥~ZÜ….º®üÝ!ÑMº¡ÀDz Ã1%½ƒ|­YÒwƒ/%l‹WIè°ºÏ5 }Cîö+9Œ¿ù…ß*\NÜÑ”uIpèÎ>
-¯R2Ï9p|
3&jìßnŸ„dš¬ÃxeÞwßî-åDBΠ0ð…QgÏ['±ŒKûjãXk»;Öªì€[ÝäÓ¥{ÛÁƒ¿eG^΂û ŸË)ÿ<ûÙÛEAG&¦_ ..š¼:oÒ¿w÷ìØiHW;£Ëƒ¯}¶àZ§¯7š0f¦P©Ç&Êb‚¨a7Ù#gÒ®}bÏt‡Óî[
-ß>ùã·vÝÔü‘ãe]£­œ©”fÖ艥VeÖŒzóIÖÞàgÕhUâgÞŽÏýàí¤ŠkÇq]ºl‚ô?‡-9Ÿ~yFiÐðµî²Ï}ýf‘Cw˜»èJ"ŠmdÊ›ëzw]ÕÏcÙìš¾»LZ~~˜Ø®»8óÎýkXÿg¦Aä;üåûéÿ'*N ‰´ÏÜ–+n˜•P¼R¸}L»ÿ:TýÿÓ’«1endstream
+xÚ¥ZÝoä6Ï_1o7b>,YFŸÒÝì^z×m/Iq(ÚbáÌ8c=ötìIš;ô?R”ü5N6»EF¦)Š¢(òG:bÁáO,´a&•é"Ic¦¹Ð‹Õö„/6ðîý‰ð«š»À¾…¨×
ì%	{Aò¯œË}ÓžÍlB&œéÔ†ó¹|Ç{Ñ’éD†ýžF1ž”Xz;µèÔœFM“måSU?VDtÚéÖË:TkУ­ëµ§?ÝY ¤^~O±ìO˪5±ï²vuŸ¯É;üF¾7¢)ê
+ý,±ËúŽ~I&Žàš1
~oÒxùói
+ÚèÅ*«hÐìòUq÷D÷ÅꞆtghìÂOÂîê=
2/$ÜM”á‹›6^áB@T—á,º›
+¶@î6kgŽ/êf¶_ïZØ=ì/¶vyy7³Z¬Y*ù—-–Hȱ"zgQ<]VuK±ÐYÝ$_Ãy)?³Q›bðý+"ЋPƒùõ7;ŽCÈr¦™»
+*tÚÙ¿i3H4àï´„K@ŒRH»&±ãkvëó¸Âl|á£àv=§FaSI;¼’	ÉÅ‘ +”²Ø-
)_Á :loÑßi«ºZ|è«ü„¢º­î2Áe'ºS˽¸s“êíd‘‘ùqÚ8+y¤Y¿•‘oVõ\ø…È%m‘c€‚cÈ	\ý•k~s}ùþlz*Ö2€axÂ^í7\
+…À
ØË„©LTà:JÛªžê!”a‰1z¨ÈQÒ1½¼þ‘,oA«{°oͲÍÊOîþ"ÙY	Ù&#<ܣȕH¾ü”¸ÞÍøý7-\ÚsS«öåUàýBÉ`¡3:SGš@4J"¸¦N'k¡)6UÖ(Sº+ˆ´w-øÝäU¾ï[Óã¡!3èÔ+“ЃIà(ƒá>ï…§„³Ü`·Ë±ù§w4™öx42*Yž»Íñ9œî·ƒá´Þ›¢¢r̉æÕ×(|;ôÑ3ÿ~(<ÈGðžÑ’áÞn½ í#„ðu×8eŸ—€û€p1÷:â`³Ï¶ÛlO˜rÃÛ¹—‚kó™ ­FM‚6JÍʲ~lh좶Pt»Ò³ L,´”E8Çõ„tW<àkt‰+
0]Ñ[o^S0PÏ[1—‰®ë¼Yí‹¥p–ïfƒ5ìZ~é%MtüÙKªõ—T
+DÕt¨L  Ä©ð	¶xþtüÑpÂ19–;‚@Ô0–@X2U	¢13YF*¡Žë3ŠKë:…ÎÂÝq¤²¸Mˆ¾=.ÒÓHpLUûCQ;rÙÈmãº/|]‡Ü'8'_'ã’V& Ò%ý?çžœ\ðI0kÚ½ËþÈŠÖ—ÆCþoœX
W'™¸ü_“ê~óÕ˜L™…ºa¬öŸßÌÙ™ã™A‘aTg_É_kß·T½Q2ÁO®z|:Û—“kŒ]
+~|83­Ú”IÙõd­iyW25ôøöÃõõÅS©Ò>Ñ¡¸ºÅ†2¢Ž!gÑaunCru|[³±U%¡Ò·P~¾|;þh8aîÞLåŽ/0(3{¤
àô”Cd
+?¾»ës:I£»ë ×y0iš'êxjŽ Ù[‰ÎÞôä,¿ƒ
+W*îK#|A‘»ÃmY¬hì``Ÿ5šá§ª«(;æ…õ2DöÍ"Å»õ\·×åGí›Â@„dVÅnýTç,.mQÖ	õ-$,ªÌ¢,ÚžƒÜHo:£Q^„G˜,Wá“Y®©©F&|U2þû‚0“á“GR0ªçÅy9»¬oŸç…•Ul¼1
+K?T+W-q*ðD¨Ãøò»þH¹Í]Ý©]»Ïosèê7ÑóeôØîO±ë܆סpq]o_$ᬖdeíX0ÜC˜pŸ­ƒ>P–Ž)î…lÍ’~.f[ì>†r%ë¾Ø€ôuáÛ¯äÊøÍÿ(\ý­BbCSÖ%U$@wöQØMÉ<çÀñ}'*f:MÔØ¿Ý>©˜i²®„À®yÀÝ[Š1X9ƒÂÀFu`:Ž¥‹&HÿsˆÊùôã3JÌ׺~Ÿû ûÕ"‡
+î1v7€J"ºÛÈþ”7ëýǪ>*&Ê™‰>½LP??l»{0æû°8þ[ÎDä;üåÿþéÿ5*NDÚg:æÂ%À]”Âýè#|Ûý›Ð±êÿéW¬æendstream
 endobj
-1043 0 obj <<
+1048 0 obj <<
 /Type /Page
-/Contents 1044 0 R
-/Resources 1042 0 R
+/Contents 1049 0 R
+/Resources 1047 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1035 0 R
-/Annots [ 1046 0 R 1047 0 R 1050 0 R ]
+/Parent 1032 0 R
+/Annots [ 1051 0 R 1052 0 R 1055 0 R ]
 >> endobj
-1046 0 obj <<
+1051 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [116.0003 603.8664 166.1092 615.926]
+/Rect [87.6538 603.8664 137.7628 615.926]
 /Subtype /Link
 /A << /S /GoTo /D (tsig) >>
 >> endobj
-1047 0 obj <<
+1052 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [399.2874 494.5894 467.9594 506.649]
+/Rect [370.941 494.5894 439.613 506.649]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1050 0 obj <<
+1055 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [461.1985 318.5752 510.2452 330.6348]
+/Rect [432.8521 318.5752 481.8988 330.6348]
 /Subtype /Link
 /A << /S /GoTo /D (DNSSEC) >>
 >> endobj
-1045 0 obj <<
-/D [1043 0 R /XYZ 85.0394 794.5015 null]
+1050 0 obj <<
+/D [1048 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 426 0 obj <<
-/D [1043 0 R /XYZ 85.0394 478.43 null]
+/D [1048 0 R /XYZ 56.6929 478.43 null]
 >> endobj
-1048 0 obj <<
-/D [1043 0 R /XYZ 85.0394 449.8913 null]
+1053 0 obj <<
+/D [1048 0 R /XYZ 56.6929 449.8913 null]
 >> endobj
 430 0 obj <<
-/D [1043 0 R /XYZ 85.0394 369.322 null]
+/D [1048 0 R /XYZ 56.6929 369.322 null]
 >> endobj
-1049 0 obj <<
-/D [1043 0 R /XYZ 85.0394 337.9739 null]
+1054 0 obj <<
+/D [1048 0 R /XYZ 56.6929 337.9739 null]
 >> endobj
 434 0 obj <<
-/D [1043 0 R /XYZ 85.0394 181.1837 null]
+/D [1048 0 R /XYZ 56.6929 181.1837 null]
 >> endobj
-1036 0 obj <<
-/D [1043 0 R /XYZ 85.0394 155.6098 null]
+1041 0 obj <<
+/D [1048 0 R /XYZ 56.6929 155.6098 null]
 >> endobj
-1042 0 obj <<
+1047 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1053 0 obj <<
-/Length 2906      
+1058 0 obj <<
+/Length 2912      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZÝsÛ6÷_¡ÉËÑ3CI\žœÄiÝiÜœãÞÍ\Ûš‚,N(R);¾›þï·‹ø!Á•ÒËø˸X,~û™Í"øc3™„‰âj–ª8”“³b}Íîaì»3fçÌݤùxÖ›Û³Wï>S¡Jx2»]Ždea”elv»ø%HBžƒ„(xûÓõû«ï~¾¹8Oãàöê§ëó9—QðþêÇK¢¾»¹øðáâæ|Î2É‚·ß_|¼½¼¡¡ÄÊxsuýŽ8ŠÏ½¹|ysyýöòü·ÛÎ.oû½Œ÷Ë"ùýì—ߢÙ¶ýÃY
-•ÉÙ#¼D!SŠÏÖg±¡Œ…pœêìÓÙ?z£Qó©×~,
-¹[P¦>J&‚cÀ?^ã^½ùŒ±PIÉqj4›ÇY¨DÆ{+s–‹¢(x(õ#™áS—wz­ëŽ^ßé_£ˆ×eW65qòzAÄÏm~¯íBb¤¬Ãe˜&"5ëÜ®t¯Í0‰º)Ë`2Î1ËJ1L0a'µƒf"bAÙâô¡×Mó¨·Ë]EÌ·ƒì¥Î»Ýöœe¦‘fIä(bt«ÜJ®t7•]çkûu«·zKܼn‰î'¾»þDï¿ïôö	w6Ã,p¤ýQÀ^åuZjR­îª'ø0‰ƒ…ÞèzQÖ÷ôŠFÇçãªABÒ®‘·Ÿa@<‘<¸ê¦ƒ›|ەŮʷNì®Õd —Í–ˆr½©ŒAûåÚMUZY´äén·iÍ^"·	òÓDz[5;”Uþ`Ä Ý5ôÜžgÁÎÂf½«ºÖ£7²cöb³0V\±—y±ò †Çà-ò(`xÌ”0Œƒi
”5‰1sdÀ%ä#eÁšdFçßnòÂò-R€z,«Š¦ÜÙ±V뚨»§É:íî,9]©¨JЬ0•.,^Б5ÅÍÛei°Î»b…»À—ìâœÆ…á°eÆÊÎNjrܾ_}´/„¿¶¥/'¢;縓€Ãe2.bkcŸïÅLq	f²Y"¢P¦<>%jòPeYæ™ó^â|,ò0 
-„L'aš2üf9Ž!¿k=þvH“ÈEXc¹Eç¡”*óA¬õh DAH°’Š*‡h‚Î( a †ÄB·NrJÈ@¬™©c¬!£Ç¾<ƒ5P4“ýÊÏbM†OÒYQ$a)ÿX³çc‘>¬AÕÂd2¬ü'`Ë0‹óo¨¤“xLIÅ ¶NU|ji¥Š æÎÆÏB-‰Â$É	P£Ä1‰o€\¦²x‚7,æ¤
-®P'!‚ºéˆh7º(1®ëÅKàÈ8¸k:_ú€B”ÌØDÉç1Ÿ@­—¨Ô!pîÉHp0PvN$ÙšÂOúµÐËÒ"í“&>L¥Æ€àwaÌŸújŽi‡ƒ=F^¥1‘Wu?Ö—mÊæd€ÏŸm¦V”	öåø¶
-Ù7…2æTë‰0ÿSëAÇR~õ2ü„÷(w­Z»¹.ÿì+6çB²Ñ½&Vü¬Ÿ|«ÀV;ø=®Jðf*«Œ‰š‡r‘ˆ ·ÕÙZ«¼.Ûõ¤ÀÖs€ãÒ7Òæœa°Õ•.ÏM4Õˆâ)ì”fª­QP[’öŒÔUfä	®Dô™Âínâdý­.vÛ¶|Ð󦮞|è…œ¹ŒîÆÓÄÙ‡§Ì%1‘T"ñêmex0»Ä˜ÅrÛÙ—d㵕è|Áˆrx3CTzõ“FË¿±ªNÎ{d\IӘ̹AcÖ\`-o^—ôì¼4ªŒ©Cã0NÓý2´%¹¥}¶å}mµ#Ö¯œ§HŦ®F_÷=21¬	€ºÓã)mS= Ìbõ°#¸hêNéú­kAABÛ²çô
Të¨ä¶Ïck0³è#ÿóÖHxêLf¡bKû´•5sH&YÂØ´'øwCu;ø„+ãôŠMnéÜf¢,qm!¸§qjH_ƒ'zÌÉ‹bgyWÙwãår„YäÆAö˜%¦f°­ó
-é½[
dì
¡qënBl/KM³¹-ÁŽ‘ú[hš½Ý퇼Æx(Z
-çfÀØPâ3/Î@–õ0Ñð8	™Œ:!ž2>	3Á=GÙ6™Š>™
-:
xBõµ Êùš™çSêá4Kùñp ûB¬×ÃOìÂì¶v5Påß»BÉ7“Y”r9¨Ç•1PC($¨/eJÓÝâLØR™HÀ%ˆX¦Á¿zau3L˜÷‰¶°Ì¼Úi"K+ÜÞËÑuÂþ¼z
-Ø!ÞzŒ
-ý_œ¨ãÇ#ö®Š­Z±;IejzÒâ¸ï˜—”#­»Â”œÊ–!H¬ò=A/f«vî¤.1ÚØoýÛK]ÏpÿÁNÏ,ý®_Ûk(H*6ƒ0­ÊÖ«Míh¨­TôB×…å5æÚ¤6Nªþ@ì…ž.æ'9fÄÊ›Eư∧aäŸç’;„[ÐÎ)wWœøSkùÖC4º4
DOç–öéÀËY<¾ºžNƒÝZ/¬Ü릳«[wŠÛ¥˜Åê¹ûüaPz½3•jEIîw
-d!îØ‹´¡¼-‡ó¡`ÃW×.vÓÌ%¥%Šf½)+½˜»#àkóßMóI¼Ô½Å1û/Mëi‘œqtBdŒcå«A.©ê
-0Àjx´÷ô†¤Mrœ¬ÆÇ»âý_o¸ðÃ(3±¡êÄUÝà®k`vYÀ©Ú#Ë°ƒÛË™TwgŠÔfŠ¹c@ÖÕuHÄEýä-Ùâ2€3–‰AcA©úndl,”<‰:¸|SÓ€±ž!š
TúAWÄÔ<šÄzï¶öJGÉÒD÷'og·åÂ"cáJë4L%Ÿ†3SÕd¥Xxâ…=Qt¿‡(6†ÏÆÈL‡õ’îk)YfÏE –rˆ@ê¤Ü)•y²ȶmP.åfQ¿{éÔ<pÑû8—F9Š¨­ýʦ¢ì¼=j¾R©§};9XGyfØ[WmD&Dyì9Zq€1Þ–%Ï,lƒ†¦z^—0ÞÛ©(Œeõö•[u™Nlš¸QÄú^-P:³Ô“ÒØ*ºœÔµÝÓ½ýH‘k废’´-£w­½ÂÚïk †Úê¯íóïž;bص£,ÞÛ6»÷Âû/èý¿ÆXBB—)÷ÞW¯hÊ­q>¤ÚU³«DÛž
Iü=ÅN6½Õº{l¶ŸG©ãàŽ¥o$Hó`Qhþ^e¯‰A¿ßšR¡‚p8ÑîãÖ^AáËv¸PIìï“ea_ÐG•œh€iÓ«­•‹!ç=éötr»Pƒ è,s8„™Qoe‡,ï}án_)·¤ýjG?’šõèwÝNåO·
U[·0|po‚ÊH“ãhÿÐ-,õÚÛ„–Õžð¹Ó+\ܽxm=×'ÿûãû¨w=ìé¨ÿ0àÛTn`1—î½'hëø;çä87[ýP6»v8÷¯ôÈ'9Â^š_¢Nõg’ÉÖNAÝ|5øݶ,:g¥¿ß?¡À	âŽxþe$êÿ×ãÿþ•á¿wâ4Y6ü²´÷sÜ„X¥Ð&2;ÐÜý'Ë¡êÿÎßcdendstream
+xÚ­ZKsã6¾ûW¨rYºjÄÁ“““x§2NÖãìVm’MA#ÖP¤"Rv¼[ùïÛøá±&›ò`lt7¾~Aæ|‘é˜É\-Ò\Åšq½(·glñæ¾9ãnÍÒ/ZNW}y{öúm"yœ'"YÜ®'¼²˜e_Ü®~Ž¾úöâÇÛË›ó¥Ð,Jâó¥NXôåÕõ×DÉéñÕ×o¯¾ùéæâTý¦=8 lŠ{ËÇ}KÏýyl¶‡º¯`?z#;vñÀ6‹U.´e{Y”›b„oÑ/F(žÃ˜ÖBÙ ‘8·GTB>Ž,28ÁLÀéü»]Q:ºC
+Œªº¦%wn®3¦¡ÑÝãlŸîp–œïTÖHVXª\G/èÈI>Ç­Ûei´-úrƒZàK,º?‡°./€-;WõnQ×’ ø~õ£ûxµ"üu}9cÝ{Ç¡Ó˜éYàçG1Sf*N˜L‰d±N…:%jŠ8ϲ,3—Çå”åÓ€(³4Ö9ÌËPL«Ø±
+PÇRH:™Ç„T‚Ç,Cž	YW]u§)÷Èo×ãéØøo]Àa #¤	ËÜwÖK1!b­ó,„±. ”d/AYNÁ%X¬á`e:ˆ'å$ ØìÒ)Ø0€
_žšéaçgÁ&c™J±HÀü	OÅ_6Çq9e[Ëd²ñ'°–Ä™JÓ¿NÆã2B<Œ3<½™Ïa-üæ|‚58vð,Ö'°É	X£Ô1AIp]žgj8¬ât]¡LRFMÛÓ Û™²ÂÈnV¯€¢Ut×ö¡¥™ñ™Ïƒ>j/É}…‚@ä$8(2g_P-ÇO†µ2ë#i‚iŸ–&Sk@8ºX	ÄâÔYL<ì1q+ƒ™DÊ$ºj†¹¡pË]VÎ#pºò£ËÕ9å‚c>!U!ÿ¦PÈœj=+ÉÄ'­ÀTJëϱ^†Ÿˆ!^ѺsÊõÅÇP¹¹”9 lfÅæ1´¨šhåá÷°©ÀŸ©°²&jï«:D"£ÂÕg[SnŠ¦ê¶³K:ÏŠOà8¶ç“©Méi~¡­GrÙÒŽCQ`—º*ù-IgÝ9a&žà‹Ä)¼v3‡$ëïMyØwÕ½Y¶MýB/t
™O)àn"M¼}DÊÁPÓŠ$‘BŬ,涘’ \îz÷ášl¼u½/XVovŠŠ¯aÑd[ë7NÔÙyOŒ+™¶­ÉRHµvÏVóöuMÏ>غ@«šÁ앨Š16¢ñ­Ü³«>4öÀàP{"ý"DŠ#e+; •Œ'Æ"‚3ŒîÌtI×Ö÷»Y3*c—mÓ›ßûAUk-(ébh\Žüƒ¾z…Ücj
	f–CäÞ‰H½É4€måž® v`	É$K8Ÿwÿnmå.˜
+yTIÛ†X%-f˜€³üEy’zMdëì›903ò:»eYB̬îlkÃ(Š#}Ä*S^e&¬2õ¼4éi¢^j´Æ‰O#€gÄ—´‡3ИB øiÅzPlLý‹#×'¾‚AG}/L¹hUC”±ŸC*JÙaú…&âIo;߇G«¢/ˆ‰f®}ÂŽDQ’‡Ù
¡Àî™Û€èPÍïö¸¯ˆ!‡U€ý}SÔ8>ºÏ@øÅÑôxŒˆWâºXj—í=	öŠÔÙB»ìkß
ž–_´ôî„%<ûâl€Ãª€­’˜kå}Ï3	ÔïP)J!ØÞ.‰Ê!‰J‚6<¡êZÑhð1\Eh³T¼ôP€
rØãQþ ¬¶¯}(#Ä1pw;ë„yîÝFk4!òð:¦²áW‚.8ʼWm’”N£
Ìšv\°léˆE}04¬s{x¯&	Çëš9NÇ80*4~jðñOo‹PàÊ•Kù“ÌmM@Oz¸õV"º¼¢ÜHîŠKFpæ®üÀÁ¦¸73ôbUukgõˆ•Æ}Vw©%ô;ãÍ?=£Z¿qPL\æzzp@t";¯¶5£í\…bV¦)­µ~ĵõ\} k"vsJœä˜Œ?)\”ÇJCÍÃÈ?ϵƻ›YtTøËM|N©sôQe—°qÂ	‹èùÚÊ==xWÓé«ëù2˜8lÍÊñ½n{·»Or‰ëNìfÍÒ~?
+½=Ø
+¥€b¤;…²w\ŒEHºPÞUãùPp‡aW×>v“özÒ
Êv»«j³Zú#áë6ßJZói¼ü3ƒÅ¡>Ís`Ú@k,áŒÙ	‘Q©a >‚·R,V:çŸÓ@;úL	GÙæm±¾5STÞ,.ì¹ÒØ	ºžÕµýã½ý…"×ñõ?"WF:×w÷5Ð7Cmõçôü{àr´–1ËÔ‘Úì@Þ¾Øÿ‚Þÿk%5t—ú¨Ñ}ýš–ÜZçÃQ·iõŠÆ®gÃ!þ’bž7½5¦h÷'©ãÉÝÊÐH(öÁYlÿ^goˆ@¿ÜÚŸP¡‚p8“îǽ»z—ýx‘’¸_&«Ò½ >r&¦Í ´Ž/†<\÷hºÓe*ÜF-‚¢wÄñ@fV¼›r ŒK¼îA‚w¸c¡ünöëýb¾ôrÅ«»/Þ8Ï
ñÿã„Éá8ä1ê}{:êßø¶•Û°ØËöÁŒsü…svœ»½¹¯ÚC7žûgú䈓áƬíOP§ú7ÉLµSÐß´Ÿ
~d¿¯ÊÞ[éÏÀ?ôï'p‚ø?#aÃyüßÿš2þߎJc™eãoJóªAã" M;¡Ð&:?–|ø–§¢ÿ84aÊendstream
 endobj
-1052 0 obj <<
+1057 0 obj <<
 /Type /Page
-/Contents 1053 0 R
-/Resources 1051 0 R
+/Contents 1058 0 R
+/Resources 1056 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1035 0 R
->> endobj
-1054 0 obj <<
-/D [1052 0 R /XYZ 56.6929 794.5015 null]
+/Parent 1032 0 R
+>> endobj
+1059 0 obj <<
+/D [1057 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 438 0 obj <<
-/D [1052 0 R /XYZ 56.6929 731.1791 null]
+/D [1057 0 R /XYZ 85.0394 731.1791 null]
 >> endobj
-1055 0 obj <<
-/D [1052 0 R /XYZ 56.6929 700.243 null]
+1060 0 obj <<
+/D [1057 0 R /XYZ 85.0394 700.243 null]
 >> endobj
-1051 0 obj <<
+1056 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1058 0 obj <<
-/Length 1065      
+1063 0 obj <<
+/Length 1064      
 /Filter /FlateDecode
 >>
 stream
-xÚÍXKoÛ8¾ûW9ÅIQä”flŠmºëzOÝÂ%Ú!ªWI:±[ç¿/%ʲì(ŽóX ðA|}ÙáGÎŒ‘eë²|
-m8–8ÚˆZQÚ³­™ž»ì¡z
X/íUF½“[\ìZ£iK–mßGÖ(þz|þÇÙ_£Á°0µ]ØÔµ?\]ÿnFó9ÿ|}quùÏð¬ï9Ç£«Ï×fx8¸×çƒ>@>Ek	.®þ˜ÖåðìÓ§³aÿÛèco0jliÛ‹lRò£÷õ›mÅÚì=’À§ÖîضҞC	¤!둤÷¥÷w#°5[A»üG‰©½R¯å@„mØN`y4€.Á¤òàÉI¸¶}å™
-yƳ™éçY²4­b>Ix´î…QĤ䓄™þM.•„¥#´6!PŠ+É?ó¬^sÄaZ$Fyzd†~U@ß÷‚mœZ5.
¥bât[¸9ø)Ov„¶Ð‹³0ñäÈ`@§üûz’Pè»”vMž\8Øj†§å控]럕DÁD³ÆÖû3KR|Q¡b)ËTͦi(Œ¼­“Ðâ0…ˆP²ã¨²5δîFI(å–¿J^m¹¢Û_žçn&I~~Ì™X®¥š3c¡uœ†*º'\*3~o>§]§kd)frÊÄ+Ä¡–¸yk¾Z7#¹æí¶¥fflfÆb¾&„ð“e²\ñé¶P^ŒK-ëÛ’Õo:§š-øðµNè¾ÓeÑ
‹¾ƒ’-5Gþµ©}Šl5
y²â³,L¡=&Åã"¦ú>	6Õaá¦âè3¸ýXµ›ËÃ@¨µ×Á ³“&>ˆ¹`‘Ê׺ÕM•ДYE¼*«ØÍÂdÞ²®¤¢¹;Ââ˳ŠwŸ¡€:<5<}•šï$«ÀoU ÿ7«À/Î*ÐûË*ð²
-ôYEY#Ƚ¦þÚ¸¶]XÈ£W‡“´‰çM£}J§ß]…µ®ÙÊj¸£¶›zíÕE÷æ	]ôßÇM=íVGlú8ðÖJ•Þ¥Á®æMuþPõÿ¹endstream
+xÚÍXKoÛ8¾ûW9Ù)Qä”flŠmºëzOÝ %:!ªWI:‰[ç¿/%ʲl+ŽóX ðA|}ÙáGÎŒ‘e번½‡–ºØˆXQÚ³­k=wÑCõ°ZÚ«>Œ{Çç¶BzسƳ–¬ÚA€¬qüµïAZ‚Ý?û|u~yñÏètà»ýñåç«ÀÄîŸ_þ94­‹Ñé§O§£@Aý³?NÿGfÊ«e|¸¼úÝŒ„æóˆÐÑð|8^
ßÆ{ÃqcKÛ^d;¥!?z_¿ÙV¬Íþس¡ĺÓ¢0ÄVÚs‰‰ë8«‘¤÷¥÷w#°5[A;ý‡lˆí«]¿åÀCB×òI=;•À³í~”gŠòŒgצŸgÉ´Šù4áѪG£ˆIɧ	3ý›\*	K?heB0$W’æY½æˆÝÓ´HŒòôÈýª8„Aà‡›8µ(j\J¥bâdS¸9÷O¶„v¯g4ñôÈ`@§ü‡zÒ!0ðéš<>w±ÕÏÊÍ]_{ÖwÒaGÉÖû3KV|QT±”eªæ› iJ…‘·qZ&9ÄÙrTÙšd4­»QB¥Üð—Ã’V®èö¡ï{›ÆÑ$ÉïÀ9‹•Ts¦q,ô¡NRª¢›IÂ¥2ãæsÒuºF–4“3&^!µÄÍ‹X»ðÕº1 È5o7-5333ó‰ „‡˜,såŠÏ6…òbRjYß–\¨fxÝ9ÑlÁ‡¯mtª@.‹nXô”l©9ò¯Mì;*²åŒòdɯ³\0=†ö˜sšÌ³À´'y¡xžíÁ¬¯žT¢y/ºoi.´BñZ½òUYθê	Åj$
ÿßÐf~?`Jå¡ÆTëUZ€ƒ`öHõ“Z>«`k³““\L²|/öÞÀ’üHþ³†fótººpz–¸Õ½<Ö/c>WObñ.Vñô9ØöÍزoi>ì¾Ð÷Ž«=Êë`ó-vw|¬ýä	­€Ìç"bk"òÂmiY!!ÐE¾Ž£ú®ãVøßÚ¯ik|ÍßGYXEä!¹Ý`VàÖk+æí*æ;ÐqÃðmóCè`Ÿlú¿Œ@@ê@¦ZÉÃÙ*ù5¸¥	¹ZMz&tï@æè7™>ã"¦ú>	6Óaá¦âè3¸ýXµ›‹Ã@¨µ×Á ³“&>ˆ¹`‘ÊWº ê¦JHhʬ¢Î^•Ulga2¡·¬+©hGøò¬âÝg( O
O_¥æ;É*ðdèÿÍ*ð‹³
+ôþ²
+ü‚¬½AVQÖr¯©¿Ö®m²Åèåá$mâyÓhŸÒãéwW]­k¶²í¦^{uͽþCB}NজvV‡ýºR+UU†öŽæ«â|WõÿE¼“endstream
 endobj
-1057 0 obj <<
+1062 0 obj <<
 /Type /Page
-/Contents 1058 0 R
-/Resources 1056 0 R
+/Contents 1063 0 R
+/Resources 1061 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1035 0 R
+/Parent 1032 0 R
 >> endobj
-1059 0 obj <<
-/D [1057 0 R /XYZ 85.0394 794.5015 null]
+1064 0 obj <<
+/D [1062 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 442 0 obj <<
-/D [1057 0 R /XYZ 85.0394 672.4064 null]
+/D [1062 0 R /XYZ 56.6929 672.4064 null]
 >> endobj
 965 0 obj <<
-/D [1057 0 R /XYZ 85.0394 645.0635 null]
+/D [1062 0 R /XYZ 56.6929 645.0635 null]
 >> endobj
-1056 0 obj <<
+1061 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1062 0 obj <<
-/Length 992       
+1067 0 obj <<
+/Length 996       
 /Filter /FlateDecode
 >>
 stream
-xÚíXKsÛ6¾ëWð(u0IŒOŽ+»Î4J«ª§4£¡EHÆ„…€b+‘ÿ{A‚¢(‹²%GÍôñx’ØÝo¿}x
ì óƒæAîøÜ…aæL’rfæÛuWgÀúhžz3êœ]yÄá{ÄsFÓ†®¢ ÀÎ(úÐõ =£u/ß®n®ÿ^ô|·;ºy?èÂP÷êæ÷¾Ý]/Þ½»öî^þvñǨ?´Ÿ¼JÇ››Á¯ö
·Ë¥ÃþUØ\ö{Go;ýQíKÓ_ŒháÈç·ȉŒÛo;R0çÞ< ˆ9'NÒq…Ì¥tý&îüÕù³VØøZŠ¶ò‡$ÔpµK ód
-ŸqèQBK“ðȇiâl”ü*zÀC¨›.’[‘Ûýyá¥10†œ1RËé_Ü~Ë]‹ûöJç2=ƒªöFe‹|REîÄœ»ã0Šò5ÂB{>¤>q
-è»”•~)?1È}ßsïl…çY^ù$çã̓Å°O¡yøâ5y»À©±Ws÷sÆ1$ñ·#ÆGÚFÍ	Iã>$žé[´µ`{‘:‚8$˜6¦F¡éDOÐ-”{Ù«+¢5ímíF7cÐÅ>9-Ý6½Ó
Ú*úà-òÜåüÄÅÃ!%þ“òùš¥(j©´œ¨ÖžÓÊsêð6TâÀæ‘ÈäbšuWvÃ#ºèQb¸aMçËãm+´ˆµI¨ôúX+y€p>߆ùX«$rŒÜ:$V¶ØÓp
f‡ªŠÐ7[¥ÝVª—óêüLõy3k¶Oe|hð"‹™I‘,Y/O’ɘ|…j“ñ÷až®¦¡ŒWr–f¹Ø$ð¹]ÎÎì:Ȫ¾Iæ±HDªE[é$­tÒ<¡SéÅí~:Ã8ÎîÁç…È—kåRÔ¶Pjœ„zr7ŽM™Ù÷§¤­-f2Œs{ÀîÇÙ¼áç#rišåÆ“hãWai5•¹Ò/xTIŠ¼ÀÄ6»MÝÛËBX	=î™÷Š:VϪú¶nw•P#¶«ZìE`õˆVovÊ¡½?eN; :äþfLzúÓþíý9eþœ2÷L™¯›¬M%gàKËHꥩ3Ó8ÌÓ…zðÈ…èÈE^3rá>rdFh»}¡æ¿JÛîJÌoeú»of6×V®izA@êK—6.]ˆ@70J*På¥ÚA¾¾ÂÙ…þ/%gËendstream
+xÚíXßsÚ8~ç¯ðc¸)–dÙÖä)Í‘+½ã¸§^‡q° šúµDZò¿Ÿlc‚	†r{è0ŒdY»ûí§Ýe²lýA–O¡M˜cyÌÔFÔšÄÛšéwwTîëM ¾ëͨsyëb‹Aæb×Mkº|hû>²Fᇋ›ß®ÿõ†]€©}áÂ. ®}ñ¦?øÕ¬03ܼÜöïþ^w=çbÔ?0ËÃÞmoØÜôºùiy\jØ#pÛÿ½gfwÃëwﮇݣ·Þ¨ò¥î/²IîÈç·¶j·ßvlH˜O­Gý`CĶâŽC	¤!땨óWçÏJaím!ÚÄ%>¤>ö¤^@„È°G,2èL
+ãà	ˆ§i¢t¤øÊ»Àµí‹dßóÌ̯r7µ-€d”âJNeA"§<"Œ8ÉÉ¢éB”E»²Jħš-DÛ˜5²IªÄti6,¹§Ù8IÍãÊüi‰‰P¯`Ÿ/î?ñå®Å}s©2‘Ì^AUy#ÓE6)Oî›Úb0ÌÖsYäzxXç‚žCh¡á—â…Ìó¨U[×Jž§Y铘7@ÄaìU\à‹[‡æîBÓyC´ÅšóškÕÖ[Ccâ"-êgD
+GÛFM#mîI´1bWˆ-Ú°¤ÛbD³ÂÓ
+u1zn!9ØË^•o²§Ý”Byø¼t»H—OÇoÊéÖ1º‰ô3ó$X§Þ°¯iÂTR‰‰l¬:<‡
+îÉ[–X$ ãӌˇ¢QGC5k*[oëX¡E¤ˆ©ÖÛɘAß÷Ø6ÌçJ%&!Û©ŽÄÈæ³q¬ÁL¢@–'ôÍ$d!E¶•ªå¼Üÿ uUš-äSµ=¼G|¦C$M@šDËöA2yà“O ÷@n"þ1È’Õ4ÑJÌ’4㛾2Ãå¥iÁýxñ˜'Š‡°‘NÜH'ù>:ñ:¥ZÜï§3ˆ¢ô|^ðl¹ÖYyns)Çq &ãH§™Y>'mMg&‚h17Ì|œÎó#ü/ÎùˆXš¦™ö$Üø•[ZME&ÕJIžU‡6ÅnS@÷ÖÀb€–BÏ{:¾<嫪¾m ›Y)T;ÛU%vXÕ¤U“t(@ï™ó¶ÈmÛÜÿQ—IÎü3ù³ËüÙeê2Oh›ŒM)fàK‰P¨¥Î3]8ôSËDmÝr¡ÚráSZ.ôÃ[®³ôM0Dÿ‹ ¤éºDKÓß}9³¹¹rtÑó}\Ý»8¤vïBlú˜ykP¹s.z‰¼ºÅÙ…þ/Þ™Zendstream
 endobj
-1061 0 obj <<
+1066 0 obj <<
 /Type /Page
-/Contents 1062 0 R
-/Resources 1060 0 R
+/Contents 1067 0 R
+/Resources 1065 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1035 0 R
+/Parent 1069 0 R
 >> endobj
-1063 0 obj <<
-/D [1061 0 R /XYZ 56.6929 794.5015 null]
+1068 0 obj <<
+/D [1066 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1060 0 obj <<
+1065 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1066 0 obj <<
-/Length 2980      
+1072 0 obj <<
+/Length 2978      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]sÛÆñ]¿‚ÐL	wø?ÉŽä*S+©¤¼4ÉxNH¢–E3mÿ{÷ë ÅN=
öövïöööóèpÀ¿p–Å~ óh–æ‘a<[l.‚Ù
-æ>\„B3·Dó1ջNj77‰šå~ž¨dö¸­•ùA–…³Çâgïý_¯~|¼¾¿œ«8ðÿr'÷îöî;ÆäüyÿÃÝÍ퇟î¯.ÓÈ{¼ýáŽÑ÷×7×÷×wï¯/ça‡À¯d…WnnÿvÍЇû«¯î/}üþâúÑe|Þ0Ðx]üük0+àØß_¾Î³xv€Aà‡y®f›‹(Ö~im1õÅÃÅßÝ‚£YbÒ_¬3?ÎT:¡À8)02?òt–ƹŸh¥Iƒýq[^Γ ð–íî`vÅ[<Ô,öó4Mfó0ôó8VD*LýKmSÿ³¬v]£ñÌLr–»Ž‰þ
W𭶟LQì¹mw=C€oùãû¾0ý÷l¶„¢¬Ë•é«¶™£XÌt,»OíîSÓŽe›«Üϲ4?qXUi?ÇËCìïm#ÚAèSc62\Ô¦s‡AFËu²è Ü3ñ¬$SL,É››HÍz‰‚E©$qFDh«*"ÛåCoúrS6=¿+	ÕT¸/cLS0ðSgV¥Ûh°T@vF£}üPvú‡Ûéñ2ýnËîÜÂØã4šÅ	¬šÂ:_á:×~¤g^ðÿqYAFWùªÌÀZZŽÓ¥æîPó8JàÂðS¡¯µŽáð¡Ÿ*'%nL×—;Q¶‘§)Pƒ¿Dö¸FÝF±×•»g 8ñÖ¦c¤á¬Eð¢Ý™ª]2¦·K¦7<¾w6'æ‚k’5Ñ¡ªkF=Ù©§ºœrå¾åûßî.ÃÌkŸ«BÂìûu»«À«g‹jºù<XªÞ?·™B“J ܵûm7†¶¡!O€„1Pþ)#ŽW@ëÀÏ’ì‹F S?ÉULŠëjó\~Ñ®.ç:ˆ…ÀDn‘UÇ_ú€r[WÔh£yk)vˆŸQš•½t{*ȪJ¤`ÖnBZ8Q‰ÐÕU׋ÀÛrQa°á€€A˜2•œFi¶<ˆdðÝ´|…Þ팥¤€è®+;aX
-ƒµ€ÙO:æíצg4:γ\´Mo½,FçÎa-uÙse€²`YžÔ*Qsµy&UäIÛŽé<…²9Ó³²
²gzÝ’ΦãÁS¹–Z5óÀ”ŽBR·‡ZàjÉßc»g`»ï™zJÆàÛ“¥ån4Ü	…·ª¥Õ(*	‹}"„`Ù¾õëÉFc\Á[W0j4í¡NÿÌš–åÕV#CŒ£è†VÊò\:~ÿô5†‚•hÒ69Ž
ÌAÜÇLJ¸Š£?ÎIi
 2RÊÁ¤å¶gB©Çq=ùŽ2>'Àñ[
ÓOfý»˜ÖÚe=úRòÒçÍBÁÐõÚ ª¬)N9¸&VX®>Ÿ{šÖ ;Ùjðîó€Ü´ý©ŽzH/L_ðÄÖìD$‡²rðÝÝÃ[Ñôº•…ú°è²4ý~ŒwÅÖâô¢ÜÊô:¡Ù
-ãö&T_NfgÖ€ŽœtÙ2SKqaf+Ãåi4”‚^%ÖŒ’y«z/TxÓˆ9½iž«&ëÃ+zjúóTAÅEÀ@!ã~ÞB• cŠð݈5ðÇ!nH&숅}(ÊÁ4ÖHj£‚b`‰ÛC‹G»H‹g§l•ž7»ÈÀÇ=wö8ñ#ízo\¬ð!.'|=Îý43!ÅÊ])èü¹@OáÆÌJ$©dK4^N}˜ƒ$:=ÒYщ¦4o*Ä{=0ÄAS\íwdTÅ…PjI˜—§y`ÉÑí·ØÄuŒäÊ5¶Q1¯]¼J v+ëIŒÄ}¶¢Û†Ñ²#@Ñ›ÅI"7îŒÅ^™„vý±aáxàƒb»Þeñzk§c6h½]89tÛ8;âźªÅžã,ÛYG6FÅp¹S˜Þ”†@(±â‹ãú“ÌÙn$8,·¸½ÁIˆn÷uÁñdUÚ¨†&õBgï›<‡Px€!¹È‚Cœ¯þà:f×ІÚ7ÕKÛ€c‹a‰Oz±ƒ‡@³‚zðDÆÀ]„ä½ Î!Ä&˜µ[^‚}(Ò"gÂ.KXli4uÏòN}~È?JŒq4t‡Z#àäý%–»	Ó	
ɧpÌÝ&Û9ì»NоWŶêÚz/ïA#.3¥÷UõLÏ%å‹3ä6Jòòhø!‹“j±çŠÏ¦¯áá3}ñÂïòuæ©ëDtùy>™¥Å÷
-¾*<©+"[…gH|¼,­á¯áÏvW=óKmˆöÍÏî7žÙwn©û›÷af“r—È#ï GðÊð{nŒåЇ{H$]UÇHiÕÏ»MÛMr:¿jæ(Ä+ݦ$¹ÝÖL5ˆÔ¹†²]¦Nä25_¦Näò¤DÔ7å®15cEÏzôÜJÌ#¥:vWän]»[áEžó|Ù›¤ÀLðõŸ~FÎ76O‘Ò¾R	tdº"Å¿@žÿl¸W¿ùGúá0DÐbe™rÍÚéO'Aâg*Og:öq-úyõe‡jͪ‘èÿ@(Š%endstream
+xÚ¥]sÛÆñ]¿‚ÐL	îð9~’ÉU¦VRIyi’ñœD,ŠaÚþ÷î× ÙN=öövïöööó¨`¦à_0‹b?Ît6K²ÐTÍ›5[Á܇‹@hæŽh>¦z÷xñæ&Ö³ÌÏbÏ—£µR_¥i0{Ìöb_û—°‚òÞÿpwsûá§û«Ë$ôo¸»œëHy7·»fèÃýÕÇW÷—ó ïý_¯~|¼¾ç©XÖxw{÷c2þ¼²èýõÍõýõÝûëË_¿¿¸~ìÏ2>o ä_?ÿªf9ûûå›,f(?È2=Û\„‘ñ£Ð‡©..þÞ/8š%ÖIýÊ×tõRQ2R`ªüXÁRI”ù±Ñ†Ø·Åå_4€«Ë¹Q‘ËU!²lùkùCÚ/¶U¹°L‰0šwfâ¸&1™ØK׆dªƒyÛ	qáH™RNܪl;‘x[,J3
+0|SªãÓðÌv1ƒL¾›†Ï£À»ý‘±”
ݶE+KapÖ0{I˼ÝÚvŒf3ÇyV#‚‹¦î좓ÅÀ„'{¿ŸAú4mK–0¼<N«:ô>¢T—·.VBñ1»ÕlÍ€­Ú†!r7X³J;%í›Àþ°1/ò×Û:±A›ðeèÂÉ¡ÓÆ‘Ø/Öe%öPógñÈÈ&t1*‚£ÈÂô¦°äB‰_½ÐŸdÎf#Áaa¹½Å~LŠ@t³¯rŽ'«ÂE5Ô0¡¨:wßä9„ÂùEâ|ù™'è–ûf60Þ¸¡^ºæ›R‹Ÿx~ÐoH†rïˆÌø#Í íQb(¤?ï8âzºE¼žŸRÝ„€ª.‹qÊúx	 u)„J©YG¦
+å >Ç1³{¤À»ËR®›\,êOüÙ”¨}òƒ¦ÇËŸcNz'€¾–—“°¿º¤/
„ÎÍ÷·ÍµÌŠŸmpþE
+FÏžs­²Ñk8|(	ÏêÁ•ºÉ[@œCˆM0ë~yYö¡H‹ž	.[X\u4uÏòB}~ÈÏ%Æ(ºC#‰pòöIŠŒú	Û
+
ɧpÌÝ&Û9ì»NнUE®j›j/oA#.;¥÷UùLO%åó3ä6Jòêhù‹“r±ç¢Ï¥¯áÑ3yñ¶ßç1ê:!ÌS׉èâ÷ùd^”Vß*øªð¤®ˆlœ!ñáb°t¶š¿–?Û]ù̯´Ú4?»ßxfßöKÝß¼² ”cȸD|=2€W†ßs;`,‡>„ØCBéªZFJ«~Þmºn’Óq ü²ž£¯t›’äv[;Õ RçêÖ¢Ë4±\¦áË4±\žô€ˆ€ú¦ØÕ¶b¬èÙŒžZ‰¹e¤TÇråø¦=ܺéo]„yÎåeo’yìÐÈ_ÿÑgÔé|cójãkCGf 1ÒüÃãùOåªÿIõ›˜þj!„.+Muß­^\’úajôÌD>®E?ªê6à~Áª‘èÿÍXˆ:endstream
 endobj
-1065 0 obj <<
+1071 0 obj <<
 /Type /Page
-/Contents 1066 0 R
-/Resources 1064 0 R
+/Contents 1072 0 R
+/Resources 1070 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1072 0 R
+/Parent 1069 0 R
 >> endobj
-1067 0 obj <<
-/D [1065 0 R /XYZ 85.0394 794.5015 null]
+1073 0 obj <<
+/D [1071 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 446 0 obj <<
-/D [1065 0 R /XYZ 85.0394 636.8504 null]
+/D [1071 0 R /XYZ 56.6929 636.8504 null]
 >> endobj
-1068 0 obj <<
-/D [1065 0 R /XYZ 85.0394 606.7365 null]
+1074 0 obj <<
+/D [1071 0 R /XYZ 56.6929 606.7365 null]
 >> endobj
 450 0 obj <<
-/D [1065 0 R /XYZ 85.0394 606.7365 null]
+/D [1071 0 R /XYZ 56.6929 606.7365 null]
 >> endobj
-1069 0 obj <<
-/D [1065 0 R /XYZ 85.0394 582.3251 null]
+1075 0 obj <<
+/D [1071 0 R /XYZ 56.6929 582.3251 null]
 >> endobj
-1070 0 obj <<
-/D [1065 0 R /XYZ 85.0394 582.3251 null]
+1076 0 obj <<
+/D [1071 0 R /XYZ 56.6929 582.3251 null]
 >> endobj
-1071 0 obj <<
-/D [1065 0 R /XYZ 85.0394 570.37 null]
+1077 0 obj <<
+/D [1071 0 R /XYZ 56.6929 570.37 null]
 >> endobj
-1064 0 obj <<
+1070 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1075 0 obj <<
-/Length 3257      
+1080 0 obj <<
+/Length 3263      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZYsã6~÷¯Ð[誂‹jŸœÏÄ©OÖvj·6É-Q³©ˆ”ï¯ßn4@ñåì¤\.‚ÐèþÐ(1ãð'faÄ"#Í,6š…\„³Åö‚Ïž ïÓ…pÝ]}þ|uw9I(‚÷ß_ýøp}G]‘›ã»›ÛD1ô81éÝõÇë»ëÛ÷×—¿>üpqýÐ쥽_Ánä÷‹Ÿå³%lû‡ΔIÂÙ¼p&Œ‘³í…µRž²¹¸¿øG3a«×ÓŸ–ŠE2T³¹Ðã¡œX—Öà°®k
-aXŠ¸·î<F‰t´No”0nÅHf’x‡†E
-F›¬ÊýKº_¢n¾ý¨U‹;Ž™R`_nù®@™1~‘RÓK‘K"þ·,2ì ·¼¢gJ—ô•uIÏEYü¹|:Ø)2"¶æÌ‹'¢•Eg¢]fûçËr›æ
-¢Í…`&¥•ñ1­ò
-ÐaŒyiGmP‚Âc%”ÛJ=²m1¥혪:­³mVÔ—s'A¹ÂgÔ¯»ld$dQd¼ÊN«V&­e‘m‘49(¦ÆÙґ飘qmÌÙéç9]õ¤ÅòÛr?2¯½Ä‰êÎ›í«‘©CÍ”²¯wp$¹^Öùb
ò‡ÐÌ7l‰ Ýí6¯DDàó÷C¶Ï/EUž¹^;“ÎÑyèE'ÏQ¯'JÇ3¾m?åÏ™mFÁã+‘>k\Û*Òm˜ˆ8nVŽTŽ(A8D‰IÞ¤Å@Åñ#8{^ÑF¤†av°#ÔW–]&©=>Áà½gÛ]ýJÍM^9¦Õ¨Ý„ÔLŠøMKÅÆ›ØQ˜Öjl'U“ (I¢Þ™´›qÄ©î¦ÈØJðàµ.ØÉê_Ø“M
²íÓ£ae%#<‹lc}‹Ù
-×^e‹º¢xú°#-^›¹½„nÛG—@ÀA¬H!N:T ŒY(C Ê]—Řöà€$"ø†R@¨YPŸ€ã|E«½–"¼¤ÖÌ(@I”C•y‰r7Ê:K+WD!ôºaVïœ;]µ/Öiñ„ÊRÒiM)°À:}έÒlUT×-ƒ§Mù˜nÆÀ N„8ë\”a	ëŽÎhê_xÈëuZÓŠy…æ
Õ dŽ„Á0êy(Œûªv±Îu]":uâÑ	¤a‚3W›Wìxç^÷Äûœ/2¢<>R×ûx¨©ÛYýFI²Žw$H©À}Œ«Êö8'¥©{VYM
Ò2ÈÄCA	Y¶¤A‚äæÕ.[ä«W×g×of¢vÏè¬$L›§;¨îiý< nåKµ5*%„À„ŸÇìšÞQÛø$„8æ. B9¹³-õ»0w¥›[±[¼%ciç¯óG§s¼ƒ9w©ƒcb÷.uþ¿Q^elcÂ.
Ö¢}4¸’1$l	jNGŠ	žèƳé±[5
…‹ÖÍ–—sÁ¡ÄµQd/„:fIÂܾ©¨M±[[¼³Á¥÷˜ÉÒû£cX•›Mù‚˜°T×›ÒÃÆYF'ãx¿‹š¹_6Z}÷{xÉA‚âpê{wŽ>³©¡;s‰˜.}
}SÔÙ¾ÈÆÒL³Dòø8¡xG¨‡bˆA²Ý«óó¦4¨Ûlɨ`}X{º.ʽ;du“ä÷J€ç´r}Ûô7ï$á­t.c‘VÎeX'‘Fœ“xðUowËÐä¡WÍ:«òòD¡Çòű³œ’šÒbx"^–Ô¤"iáx06nÇGæ=¶³ìÁ·Ï7߸)¤Žß¬6p……_Šþ2웺+…dlQ¢‚N[1t&Ì£{–i‹fcÏ#E85Ïé>/m5€|­ Î¯¨g™Öé#*Óq9úoºìpÇÒ쩪6ÚÇaçÙwû¡åf¶©4Ž©Jz–…ÍL¤ü'{})ó©`@[úþ~ìhðaÒ¾ò	é2+Õ×¢,^·=Ș+ÑÝø¢®
-Ÿš&!œûs¶)w[w©º¦0x¿NË
-ÎÓ;J_S¢þýê–ÆÑeXY—‹rC]‹Vd§™
-b¥Ó„m¾ws›7ü›*èA3mG;yéø…±;aÝš˜öOáPÿàûCîUûþû«/cP’©8‰Úˆ\¼Ì…Y’DD/¼?NTÛ±+çØÝ6A¢/ÇkªÎ×HÂøD©%Ä£_oÓ¼Íu:Î4\6«B—?ûã%EoqîVhðŽ“«7\#ËwˆÃKæÎò÷YÖó‹Ë¬ZìswåâP½&f\jo«þ&úפà0TsùOWÒí}–˜ÄZ§½êÜ?ͨq×ìžÿÌŽ‡óÒ–ÇÍ!DÄt_$" åÃ7\gΆ‚°“`ƒÓyKtl-®	°y®£ð;ÁÖ$äŠÚL/Þp¬ÞÅàCDª»ü_	¶f}¬Å¸^<5…	[ÜÙç$Öÿ™ç};Ö´a1Ô­Óªo¸Î2œmk"L$ô½ô4ÖÚ\§±ÖpÍTï¡òYeûÜ$ï,Âéõ®:pC_õ%ø+áÖÞGoñ(ê| 2‡Út¶:¸†ÿ̦‡ó¾qT:
-f›Ô~ÃuNÁlÓˆ9ƒ*÷L(msM Îs-uØAÆ’
Ý•Gzzõ†kdù.Þ^†ÅÝõï›|ó4žø·Pß벪5m¾Ð㋯øÉÞ[±:¹ž	—' Ìwå&_Œ$&ÏâÐL®Ý0
W½Oûq«ÎêÝc{,æð;Ó=^¸ºàqß@‡Þ²R»¯ªðîÄBî^â~ˆ-¥@K	äÂ-9§bgŸÞ×`ÖÑH›F“0
ákR»
Ó)úsM†(dJŠi$yNÉñôÀÜ}kw¿±è *†Äˆs5%BÃ3¡ƒ'üª“7óõY‡éd£[IµC“ˆ“ù‡ædØÚîâîÉ÷ç|sæ¡#%™0Sºox¦EèÍ462üáÈjðï"ÇWÿPñø+NSœwÁt-­¼PöZB	gRErDôÿíú=ëendstream
+xÚ­ZÝsã¶÷_¡·Ð3' œ>9w¾‹2=_j;ÓN“<Ðe1•HE¤ì¨}w±Å/IN/ãñ\,€Åâ·_ Ä„ߘŸL¢IœDLq¡&óÍŸþpuûØ쥽_Á%nä÷«Ÿå“lû‡+ÎdbÔä^8IN6W‘’LERzÊúêáêÍ„­^;tLQ(™•œLE¤Wá™ui
뺦	SJĽu§BD,Q1œŠŽ‹"`õ§¢âÖ©ˆP0)¥šÄ*aZÂÚx,Ër÷šî¨žo?F²ÅÇÀGÌ-ß
h3æÁ/aÑka‚ÿ[vÐ[^Ñ3¥Çkz F]Òs^¿p>ïí[sæÅ3ÑÊ¢3Ñ6³ýÓE¹IóÑ`÷°yZŸÒ*¯I"A^ÚQ— óXŠÐí¥Ùv¨™ŒL䘪:­³MVÔ×Ó(6A¹ÄgÔ‡m6²€JëÄ«ì´j#ÁÂÄË1OšSãÎì
+éÈô:fPsWŽi9zn"ŒX(â7I2'þˆ­‰Â´VƒpvabUç$(J’¨g“vS"ÖÌ$Zv7E‡-žPëBÀ9YýkÙÔ ³±}pôxŒ°²5À<[[³oññ [âÚËl^W4­;ÒâÐÌí%tÛ>ºb%â¤C†1S¡òUnë¼,Æ´b„ø†R@ÔYíQŸ€ã|I«Ê=^S{Ì(@I”}•y‰r7Ê:K+—D!ôºaVïì¢GWíóUZ<£²dè´&%œÀ*}É­ÒlUT×Ïëò)]	@m„¸è\dÂ˜uGg4õ/\ñz•Ö´b^áñ*9„£"¡Ò=…qaWÕ.–€]×%¢32@F °¹²X°ã{ÝïK>ψòøH]ïÓ¾¦nw:è7J¢ÐéxG‚”
+ÜÇ°ªl‡sRŽ‘ºg•ÕÔ -ƒL\	¢8Hð È²µ< 0­¶Ù<_\Ÿ]¿™‰Ú]¸³~J£¸·™X;øÊäBÂ9IÈá å<ÿÄ”nÀÉlE+‰…¹”­èˆCɵÕ:D‰úbªò豞y£ò “Îæh‚Ô^–ŽŠa‚ZÍÉ"S^9"Â	û
+˜õYð–:ZíXŸ±±\åŸÐ2Î4C¿0ÁÇì¬Ûú~‹–$“ ¯©PêºÜØÎfà
eð%‘PöbA´tlLqèÀ£CÌ ¨ñl•©½Z›²r$‚óœâ!¼SÖռ砅u£y˜Ãi£5XÞÌqc8§?û¾&³„}Y‡Êîaa‡Aؘ¯Óª¢æìîq“©µômR1v§nd¹Ùæël1µ‹l™î×µ:*šõçI{Ãøvt§Ú£‚GRïQ:».p• ׎xj@ÚÊæð2»£~ðòµl¼†çÓ>_×$_ÒÈ7Ý¢§üGÛ2¿ÊØÞÀ»7úÏÌèGœôLÎå%÷¡´È™ûXdëì9ň5ňñO‚Š„èiq± ŠÍeᙈ.8_5¶c•o5Û‹ÉÃÞMj«	~j¹K«zwm‚ý¼öuÑ	¨#<„¶Á6cÏ;*øó;¢ßÝ>b%lßâàËý'AŒún0oÂFZT¯\ЦˆÌ¹›Ú0$‡¢`~^Ú¨iA*ûc»Îç¹…8§œ€ûÜ´©G…Ð;AÕy@$¤{Xg—Ûü7Áp:÷ÌÂå˜H~rÜ5	
+ÉØbLY©Í“àî_`>¾|¾™Ý1¢Ð±JŒ£eæ¸
+뎀äʤYß)ŒÏH_UX®ì¼}g«@IëQYììŸ\XÇUò~"°ÎÒ%µìA3Âg×=­_t‚æ"}Á¶B¥(ˆMè3ðy̱éµOBˆcîBIÈDÈ£m¨ßÀÔpnÅn…ð–¼¥eÑ_ç$Ž~çxsévÇÄ<îÝîü£¼ ŠYcÚ&Xiˆö­ÐàvHr(3 צ%ÜDo‹Æ®×"(_¢Èªïð¼ž
+…®
$#`àx5À¸ò˜(‰„àöMEm
+ÇØÚàÍ
6(ÉÇ|–ÞŸò\¯ËWÄ„¥ºÞ”6Ô2²Tåý.jæ~U4l´b7ú0îcöÐ$Äœ’ƒ6ÄÅá†Ô4QìÝ9ú̦’˜%<ô•ô¬¨³]‘ešQGÄãã„â¡J")w¯ÚÏ›¡Úo²£²õqåéþ9/wÎÈê&Õï/iåú6éoÞIÂ[é\Æ<­œË°NÂ08'ñèkßî–¡É•WÍ*«òòD¹ÇéKdwr2Œ(3†'âeAM*õ¡‘ŽcãÆy|$`êck2ËÞ8|û<{üÆMù#uüfµ„,ÿRô·dÏê®’±E¹®?œ¶bèT–$xkÝ9™¶h6öö[ϾÝå-7³Í¦qLUÒ³,l"(È0‘òŸìðZëæSÁ€¶ôýØDà#”i_ü(ºRÅzõP”ÅaÓƒa¹BÝï ê¦ðÙ©Qxp؈À¹¿dër»qW[Ê]3©àý*-+°§w”Á¦DýûÍ£+±².ç嚺æ­ÈN3ÄJÖ„M¾ws›:‹(ø7ЃGDÌ´!í䙧ã×Æκe0í9ZáPÿàû!v9Õ¾ÿþæËØÈÉØ趱‘ë—©3Fkˆx‹ldÛ±KçØÝ6A¢/Ç˪Îg
(–•“0
+YÁdü3Žcš¶¹NÇ™†ËfUèò§pþxUÑ[\DàM|aõ†kdù.r5‹´é­ÿe=ǸȪù.w÷PÎ#õ›ÄŒ‡‘÷cý]ôoKÁcÈæÝL·7*!®hEE{Ô¹{žPã¾Ù=ÿ…-ç¥-Ï›C@PÌ@$8T¨.è¾áº$È`6„D˜“‘0ô<ÚZ\gÐ湎焟FÀù˜ÑùÅ®‘Õ»`SLjÈ:Ëÿ•`k6ÑÇZŒëÅg°æÂ{J>‹5ÇaÇÃyߎµ¿ëÆú¼ê®K‚f;‹5a†¾œžÆZ›ë4Ö®ã1Õ;(}–Ùn·„…¡9¿¼gY¾6©:dUÝõ¿l¦¶ö.z‹kÝù4Ä”*‚ÙÙé9¼yþ›Îûv¼%ŠÅ†_P~ÃuIÁlçñ¦8ƒ"÷B$msÁ›ç:žÔ~	K6D¸#n÷ìê
×Èò]¼” Qgý‡&ÝÁ4ÿõÊ›`UVµ£¦Ígz|ñ2Ùk Vû§M± ýáõ@>'†wD¥MVD¥´¨¨h2×vj_¯@M…¾Û„ý+望æ·Vx_d…ûµÁqI +
û{{‘d»K¬É }WÖQÝ…1–¯ôs g„.,D÷?S ³)ü}UãVã(øÆšý8zQµX¸Â½ª0/ªlî®ÿæ¿0
°BŠÎãHMÔöâóÛðOÛ†¨Î;0ØÓ¾4šC…lâŽ4ä6\—dÐ’^£®M¥²Èê4_W'm,=‰Å…PÑb:m¹ž	—' L·å:Ÿ¤%†‰0ŒÎ®Ý0
—½O²‚˸³z×lµ~izÀûV<èÐûOVj÷iÞøBˆÀ]K<±%ᜄ„L¦%ç¹XàÙÏïk0ëh$€²g	¢¿Äãdg´Û0—b0×Ù0 ÁÕ†â<’Ž<§äxú`ê>¸»Zt,Šƒ¶ :'BÃ3¡cM\쎛ù«³ŽÑ­ô1-b¦#Næ‘äX|%­ížA\Ã}vãý9ßœyD°M-LtN÷
Ïyz3ƒÍD*†¿$Y
þ]äøê,ÍÅgÇÕßJ;¡ì­ÄÀí+i˜2a<"úÿ¾->zendstream
 endobj
-1074 0 obj <<
+1079 0 obj <<
 /Type /Page
-/Contents 1075 0 R
-/Resources 1073 0 R
+/Contents 1080 0 R
+/Resources 1078 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1072 0 R
-/Annots [ 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R ]
+/Parent 1069 0 R
+/Annots [ 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R ]
 >> endobj
-1079 0 obj <<
+1084 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [284.2769 238.6772 352.9489 250.7369]
+/Rect [312.6233 238.6772 381.2953 250.7369]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1080 0 obj <<
+1085 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [282.0654 208.0269 350.7374 220.0865]
+/Rect [310.4119 208.0269 379.0839 220.0865]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1081 0 obj <<
+1086 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [299.7586 177.3766 368.4306 189.4362]
+/Rect [328.1051 177.3766 396.7771 189.4362]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1082 0 obj <<
+1087 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [184.7318 124.0912 233.4785 134.8756]
+/Rect [213.0783 124.0912 261.825 134.8756]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update_security) >>
 >> endobj
-1083 0 obj <<
+1088 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [330.7921 92.1656 399.4641 104.2252]
+/Rect [359.1386 92.1656 427.8106 104.2252]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update_policies) >>
 >> endobj
-1084 0 obj <<
+1089 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [401.5962 61.5153 470.2682 73.5749]
+/Rect [429.9426 61.5153 498.6146 73.5749]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1076 0 obj <<
-/D [1074 0 R /XYZ 56.6929 794.5015 null]
+1081 0 obj <<
+/D [1079 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 454 0 obj <<
-/D [1074 0 R /XYZ 56.6929 446.1352 null]
+/D [1079 0 R /XYZ 85.0394 446.1352 null]
 >> endobj
-1077 0 obj <<
-/D [1074 0 R /XYZ 56.6929 419.8946 null]
+1082 0 obj <<
+/D [1079 0 R /XYZ 85.0394 419.8946 null]
 >> endobj
 458 0 obj <<
-/D [1074 0 R /XYZ 56.6929 296.3851 null]
+/D [1079 0 R /XYZ 85.0394 296.3851 null]
 >> endobj
-1078 0 obj <<
-/D [1074 0 R /XYZ 56.6929 270.5629 null]
+1083 0 obj <<
+/D [1079 0 R /XYZ 85.0394 270.5629 null]
 >> endobj
-1073 0 obj <<
+1078 0 obj <<
 /Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1087 0 obj <<
-/Length 3398      
+1092 0 obj <<
+/Length 3384      
 /Filter /FlateDecode
 >>
 stream
-xÚµ]sã¶ñݿ“—Ê3B€>^î|©3Í]ês¦í$y %ÊfL‘ŠH£þúîbˆ_¢’I2ÀÅ»ì7ɯ#øã×F±(NåµN%SW׫íUtýs__q‡³ôHË.ÖWW_¾OÄuÊÒD$×›Î^†EÆðë‡õ‹·ÿxóÝÃíýÍR¨h‘°›¥J¢ÅWwÞ$¥Ÿ·?¼¿ûúûû77Z.î>~ ðýíûÛûÛooo–Ü(ë…ÛáÌ‚÷wÿ¼¥Ñ×÷o¾ýöÍýÍOß\Ý>Yºòò(FA~¹úá§èz
bs±85êú"ÆÓT\o¯¤Š™’qì!åÕ§«…
;³véÔùIe˜2¹^²ˆ´˜>åˆE
-Nm©%g"•q8e9yÊO9+›zYÕm±9%æ±D<~ÝÝvD<`MP;Ôyœ2¡Õ€üǪ<±‹t±Í³ª¨ž6‡’ž‹
ò3!á¬"»øÄö€–€¡Ò©C+Ú1[µÅçœÆ›zOƒöÙOÿ¯®rБ8ŠÏ­É[ÔÇe¶z.ª¼ñ‹37ÿZ”Žïý
7‹|•R1¨t—ÁD1©p¾ûð	‘à¾yÄtöÂ9H „ýðñáîý'ÄŒ
ƒƒOÜ&Û¼i²§%pòá€ä‹#cå#AP˜µƒvô‹b"n†ÒÐr‡QM›¯i\e[mòýç|ïü©¨†rV
6Ùí‹m¶?’¬žûž¬ÛÈìa'+¤prÀ€ö±@»òÐÐ(«Ž4¸ûÎÖkº‡¦ÉZ×ìòUñc	+à¼í󄊉D0¡ãNu`ƒ ÓJj‡‹ÆèÅÇ^½oi´Í{ù€—¾vè8àé΃œ eÒžnš7Á®LX¬…úMÜ*Áb‘xn;gDÚÚ_jµvº8ã-´†ô¬·4ÆÝ0	
€ 	f¬	f±Î7Ù¡ô¨š7!á‚B‚($åLKð5žÐiÐó5ðLÞM{x¤ªYƒî€GÎ0p~×ÖÏæÛ]{¤!ZE禓$fÜ€•Ïúò.Öy_°PÎÕs¾zY¢u6#_.c–˜ôñ€5A½çË%\	ú©ùr5ÜÈ®-j¼rwL;4ÖððÀj‚8ík÷Ūu3dä)H’íÁ][ÂkÉÁPNf•pšcÕf¿Ðj®Ë÷mV8ÊëzKcI.«qUÁÿh!eßÞÈÿbœ,Ð@K»
-€ì—µ›@wmN‚]]5¯ãþ×ÙXP½¥'UÞ¾Öû›•R1Ÿ>gû"0°ZÕv§5h®Û«¶’D}Ë i5ó¸Ë
-¿‡µcÓJqî‚“}"Ζ‚[thÖ2ª?4Œ‰È­™çöØdE9AˆCTLyÇžg]O&ö±¯)3·‰€b:ÆëOãü5ÛWS„ =“âÄù9Ó èé$½`ú¬Ó÷XHqµÙcÖä#»’H«ç)¬	Ò½ûÄÊ$\ôiÂhf£ƒô&§VùDÆx¤ùš Ëùé¼1¢4m½'eËÈ'0Ú˜yûÁ5§%›º,ë×Þá…Ø+Ñ÷ÝóÆ|pyQäóƒ—üøêì¨Mþ+0¦¹ÊœDI7™Ñ†	Ù3„×碇’­òå:/‹má–ê…§‚AIA.Aú©½ßgÀË:¯ÚbérKÇwÏYØ„m"ÕÎ&`pº(†‹ü;hë{f.4‡Ç&ÿådè9péðH~zØe½c;ÑCx:laÏF=ÏŽ›~̧œßèÔy|û›ÑÏkæ¢tHÃVÎ)ÔCçp¢Ü©'jX÷AòŽ/ïK”é:\ÈÀxäÝÄûÇö‹éòŘP¾ü÷‹}å;§ƒhØиÊ\Mƒ«å6ßÖû#=Ò!¬—eYAKžS'˜­w´‹Ü¢g£­Î=H¬¥jY3ÈÚÛìÅQï>û‡¥É[|tya,!¼•
-oñISpbW7MñXæ4Ul
-	kyEV¼ëOäb½/\)SÏ,ø1Ï+‚•EõB1Y¢šÔuþJºR›6$óŧz;©bM¶Ý•^A<Ñ“ì¹×¹UyX{
¤4¾¯[ºªÇeJ±ÏS«|bK/@W¥½0v6ðHUMÌ/ž.ÖùÀ°¬£,àw£°Ã%8U-æé¬	½°.Ú`‹¤GùSžby³Ú»Ó‰ÖS=„T³HHo]'þÇIOœ„V%]EA	Ÿêžˆ4¹º¦Á}GØ€AØñ¾$ìê$6³xÂø%pùŒ«ô©¬ŒŒw›Mm$Ô\ilÌ
ë`Íh˜Ç²7”—ùS†Ò/kì
UM%	¦óô=Òýž¢%0‹uMòï©-âì	ÇjQSã
- ÙnWC’ÅsAQù˜™øÚF¾¶”R/î6n6wø”ÔↈSÆO­žcÞLeÏxæ6еƒqTŽ5/†+€–ëZ¡PNÓÈÅUŒ÷,JÍ _pa$±5sδýTÇnãSô^g­§ºû¼ŽOI©:ÖÁšÑ1eë‘z‰ýzœ=s¦4hþ,á€5A¹Ÿ='L)¨Fz¤©Ǫו°AjCp¢TÈ|%Ä·†@ýÿ6ór1Pº„2i5x¢„RØlý o\ãÊÆpí˲‰æ*;¸ªWžX,ëúÅ6cE>Lúb|`ÊÇZªßÊÙØ’[hЃýѦëBs§¯:	‡“dU0ù”·mXRÕ̪æ•b9&O:Á´ºœ>Îc|èSé‰S°MúPÖ‡ÒÑÏ°Äp<¤ª÷[LQäÃÊV̘ЂE&‘C+òõYˆTÈæRýØÅ:o«cx¾o07KÚ#M¾0X÷hOUw¹=6K ©ÚØœ¶Ðg7 r	G¶‰fY?Ú³X_Mz³”Ü+Ln¡uKܸV zma‹QFFÎYšTM¨R¬R¦O]’ŽGÆUð±H‚›¦â|—	ïW¡Uú“^4ÒõŽƒ]‡d1t1CBtj‘½tçÂÑažds¦©46´L±Ø3ÇYzq‚ T¦Îöà´2—ä!nY?Ñ¾Vù¹>ì¡î¡÷"ÄÞ$aÚ{GàúŠ•cvõ‘s5?ëXéÛµ*…ÎÝÞß3‚[$C	ÅdjDOè™"9à_¼ï¹"YY’
-xž½‡€u‘ñn³E2Ooy©Hîb×€5ygźœÖBÈ3$^³œ¬	VúZˆù<\C—?§13'ÑPc–DácŠ)-àõSÑzVþñÇûþv-”m`’1{ë#ãÝæµ01p½êBºÖÅšÑBuÞsÔ‡v¤†F2™ÀªYVÖ/}5LAjTê.3‘vEòAvÁ“ô¼"¦)S:Q=±çÑã_8€ñ¾¿]“?w™¿tÑ^óZkfq¡™ÓÅšÑBuÞsLj!Tÿir•€5ÁK_–h=`æ/
-É]‘†Þ[…ZÎ(¡„CÓª'õ¬:üò÷ýJ1
¥×ì=x¤lŒöšWÂH3tñ%ì`Í(¡Çê›Ø/"€9ÏÓ
X„ûïE4jfÒ§üçhÜÙO«b¨’$9ÿ^D%,ÒÊôDœ{/âñ/;Þ÷w¼óT—N=`]`d¼Û¬†iÍ„N.Tx¤™ïv’Û_ò	õ‚U‘Q³DÒ˜j¿"™1©é‘½Ã“ÖÒW\02Øa5ÜGPÌÁø5s@|/_ÑëP­\§
-À®M⸒Z¨¥+±cWKÃ*Ø‚ÂòÏùžÞßg'’¶ì¦xª2÷é¾g”±é—ÿíáÔÕÔÒÁßw>}º}KcÜÃò,døx†¯ôNEؾ÷‘F§®™ÀÞM¶öëNŸáÓºh^ìKwîÏ€©›«=êº	ps<1“˜>óyz¬~S>qñðïº?øÓõÓwýR3¨ÅÄK‰fDª=SxêI<ä\ņ)#ôëÿ;_ Rendstream
+xÚµÛnë6ò=_ôe VÅ‹$êñô4§›b›ÓMRì.Ú>ȶœ¨‘%W’Oê~ýÎpHêj©E[©áˆ3CÎb×>ü±ë ô˜Ç×Q,½ÀgÁõöpå_?ÃÜ×WÌà¬-Òº‹õåÓÕB~{qÈÃë§}g-åùJ±ë§Ý«ÐãÞ
¬à¯Þ¼ÿp÷õ÷ïn"¹zºûx³æ¿úp÷¯[}ýðîÛoß=ܬ™
+Øêý?ß}÷tû@S¡YãË»û¯ÓÏ…En?Ü>ÜÞ¿¿½ùé雫Û''KW^æä—«~ò¯w ö7W¾'b\¿Áƒï±8æׇ+/BXH~õxõo·`gV¿:µ2P^Àe;)<îG|z—™1H‘d¥p»,'wÙbá.'y]®‹²Éöç¡Ä̼XFÑuwÙq‡5A]t¨3æ{#ê‹üûÎãÕ!MŠ¬xÞŸrzÎöÈÎ@¤„’@_n¹â0¢Ø e5­˜l›ìSJã}YÑ y±Ó¿•E
+º"|±zz1huÚРÜ.“íKV¤µ}91óoYnø®n˜Z¥ÛÔ‘JˆÁ ê2žŒ7~uÿˆHpÜ°G‘/aSHp={ÿñéîÃÿ&Ä
+6Ž9¤u<§(‘$Ÿð•–`Aavr:Ò/Š‰¸	JC¯Œ<«›tGã"9hVŸÒÊøÑü^p”“b°È±ÊIu&Y-÷=Y	©`%oHn䀭!…@ÇüTÓ()Î4¸ûÎv;:‡ºNkz¯>¦ÛìGßçZ
+ÀyËš—	ã!÷x*³«óœ€ŒWF=ŠVï{eÕÐèö6逗¶vh;`Òìù@ͤÞÝ4o‚]z"âÁïâ6àžà¡å¶³GD¡)í¡;¡ƒSÖÒHkHÏz/Ƙ&¡à4A5A­vé>9åuO³àâ&$\CLÑ{öeARpˆ2]®ÐiÐó5ðLÞusÚÐÕ¬FwÀ|ãè¸Æ»jcgÓñ9Ó­Åã¥ÃPxL•Ïºò.ÖeWî°PÎíKº}]£uÖ#WÎ4p¸Ãš ÞsåBòOäj$¸‘c“•xäf›vªµáᆕ1Ú×TÙ¶13dä1H’Tவᱤ
Á­™0¨ÏE“üJ³Z}ð¥´j’ÌÝ•KòWµá¦pÎ'âRöœ Šp…Ö™ë·àÈ~Qš	ôÕz`Ø?–Emñ:¾G½•z"ù`P¤Í[Y½êÔD‘~!¸µ
+xø”T™c`»-õJ;P[³V©%ñûfAÞQ«åù˜ýýïŽí*=Ÿ1ë
ŒìA†CÔm¤Òf1Ðû¡UL„íÈ“àßÌû$Ë'îɘu|éeÖ9ð¤„
|už@¬È/˜^ýeœ¿%U1ER3É[Î/Ù½/
+ã»ï`ÍؽÅBŠ»¤I6I	Ç¡!ç	[¤	½Óñ1¦é(Œ×Û*;¶ÛYNõâÈó¹´Î»e~œïˆPÙ‚ŠòÅ®|¦]Öi²z¾¦ÁCGT‡¿ ëx]vÛŠ…
1zlÄTHŠq5¿çk‰‘Ñj³Y„A,”ZP¯ÖŒzY,}Biž>'(ýºÄ.Ñ°¢áPb­2ˀÚࠗÞá…XÑôX ÷ëj@$Ï8V%µ¬šyF!44Á)\½d2C[UÂÈV•RF«»½™M
>eôƒ°uîÎ@ ÛfPOÃ@/E
¼®V¨qîþûáÁ£¡©/Cº@ö\”¦½IÒžÐw]º¥¶ C¨ÕiÛ_ á¤Í¨b+#áYÑpBW6HàxL£ùðø#çrâ.Mrî…AÌ»í7´+íÖÏE¾˜>i2ÓM#Œé9_09’ä¢Ípp¾~fm¦‹uÙfVÏfšÃqm¶stÀ<%ƒ&Ö}§zŠ‡6œíû1^¤Ø•[Ý°ÙcÙ)×lEÛ^Ñ+Óþ½sŠ¸»„_ÞiÈý#¹Tøv±fvÚbQ¯ü×µ¶Ü}jv<;¤ëq©È Ó‚d~–ƒ3ÁF¿7xAÈDŸ¿¦ž“f˜Éâec]¬Eè{,`}‘gjc‡¿ þxÝKµq4d	㫌ϟ‚ÃZ`d¼ÚlmÌ õ—r©6îb]Ö@‡5yfÙ.ŸÔ@A%Ç,'k‚•¾r/Šáz¼üMZØ‘h¨…PªûîÛ‰	-¤2õ„žÓB‹¿ þxÝ? …øÍçóçà°¯6¯…¡ë	²´.ÖŒZ¬Ëž£<5cGI.‹Ù<+k‚—ž†¯3‚>3§34"MäŽ1ãËŠÁ9	¿/öœ"Zü…
¯ûûQ@®ãÇJá°¯6¯ˆ€®B¾ÐÄébÍ(¢Åºì<&QxBƬ8¬	^úþ/7ü3NãY8­ˆ1¶#1–Ø4Öz6*ú‚ô£Uÿ€rÈ#ЀçNÁa-ð1^m^	ýR©X,(akF	-VÿkÄÞuˆÄë5OÖ"MíJªb¨iÑì»dÿu»ø%•€Ì+g®CxäE<–=ç®C,þ‚¬ãuÿÀuˆô¤¯âù=wXKŒŒV›U¯(òx.Tw¤™¯t
’;ž6¯éH·ðz,ä³$
ʘ⠭¤=Šw¸É‘´…Œ6U³_ÌÄÕp0~K¯áºýŒÓ›°i˜ž­¤®©DÁrì]àØ”ÐðʪAîõOiE×õIKR×à€]gÏEb¾t`Ò‹¥Pýª¿9µÍNmüýêþññö=q
Í3—îK!¾Ñ
+×­î3Ú>Ç~M²³ïµßzáÓ.«_õ»ë¯06s¥%@}6NîÏ-3IËô…ïÐEàáÇã§ÿ¦ãó§¿Qo?à‡A(Å/I‰¨‚ESúó}9¶òPÇ1ëÿyš›(endstream
 endobj
-1086 0 obj <<
+1091 0 obj <<
 /Type /Page
-/Contents 1087 0 R
-/Resources 1085 0 R
+/Contents 1092 0 R
+/Resources 1090 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1072 0 R
-/Annots [ 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R ]
+/Parent 1069 0 R
+/Annots [ 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R ]
 >> endobj
-1089 0 obj <<
+1094 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [259.4835 478.4263 328.1555 490.4859]
+/Rect [231.137 478.4263 299.809 490.4859]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1090 0 obj <<
+1095 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [387.5019 224.9363 456.1739 236.9959]
+/Rect [359.1555 224.9363 427.8275 236.9959]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1091 0 obj <<
+1096 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [381.9629 194.6431 450.6349 206.7028]
+/Rect [353.6164 194.6431 422.2884 206.7028]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1092 0 obj <<
+1097 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [398.5803 164.35 467.2523 176.4096]
+/Rect [370.2338 164.35 438.9058 176.4096]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1093 0 obj <<
+1098 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [393.0412 134.0568 461.7132 146.1164]
+/Rect [364.6948 134.0568 433.3668 146.1164]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1094 0 obj <<
+1099 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [255.0796 103.7636 323.7516 115.8233]
+/Rect [226.7331 103.7636 295.4051 115.8233]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1088 0 obj <<
-/D [1086 0 R /XYZ 85.0394 794.5015 null]
+1093 0 obj <<
+/D [1091 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1085 0 obj <<
+1090 0 obj <<
 /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F58 631 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1097 0 obj <<
-/Length 2801      
+1102 0 obj <<
+/Length 2803      
 /Filter /FlateDecode
 >>
 stream
-xÚµZ[“£6~ï_áGwU¬èŠÄîÓ$é™íÔf’íéÔ>$y ¶ì¦Æp÷8µ?~8ƒÑ©ÌÔTB|>:—OGG ¶ ð-TD¢˜ÇK¢(S‹õá†.vðìÝ
ó˜UZuQß<Þ|ý6⋘ÄÛŽ,C¨1lñ¸ùeNnA]~ûãû·÷ï~~xs«åòñþÇ÷·+®èòíý¿ï°õîáÍ?¼y¸]1£ØòÛ½ùéñîE^Æ7÷ï¿Ãž/BîÞÞ=ܽÿöîö·Çïoî[[ºö2*œ!Üüò]lÀìïo(±Q‹¸¡„Å1_n¤DI!šžý͇›ÿ´;O럎úQÂøjè@):4Œ¨8V­b	.jæš´Ï“
¶’Ì7Ò]–·Ì,m‰Õ“ÅF~¬Ò<#ëÑŒEÍ
Q†±	m´ê¢PÙÑh7(§ìŸyfWe•TiY¥ëòz|Æ)1ÓaZÔˆ]w1®ˆžž÷[7è×o•é Á\îg["¤/L“XðóÕíJPíýGËÒ϶ÀöKºßc룵Gÿ¼19ñÒl›‡ÄE;àÕSZbË9«È,_žÒõö®ÿ‹ßýØ›Óáh7Nep#†Rç#Fb¥x­l•_¢†uãÄ5‘&RÞ°KlV¿RÊ÷vÄÀ>©Ú_l¬f¶á\vEµÖ5-íÊIÞEF¥¥	ó®‹šæ]‹ªÍJw«çdŸnÒê¼J³
-t‚H\³O‚+$ð*¨F‹Ñ£Gʼn„9ÚÓヵWîÙØr]¤GOç£íHbM(—q¤)k®Tˆ¤•Xú_Ad®›Œ–t-Á‡Ån‡Žé-~Æô¡\´}}±Ò¥}¦®u’0i•˜¡BšÑc Ë©1M>¹Òðù:¨ùT=ÿŠ$+·¶ÎÄ«2?k;L|€×zF‰5¢E?ñÅD©+-þõšÄ7aË•;­Ä£†ÀuïNx¦ÂðþýúºÎÜZQÓ¾¶Ûç/+}bóJe³F»s#cˆ6dÿ
-¦µ:ºØŒæa÷å³Ýã÷woŽ?rt|}¶ûó-cyÑt_pc ŒFcÜ<Ž{W¡^i^½(4_eÖûäTZ˜RUÉ÷(8dz"ðèå)©°u™¬N¾‰‚´58îRk`7.Þ\,ß8ÿ©ei0%½Ó%Ä,O{<¥ÐPèu³!uŠÚM=K"P2mí¬Mê£8¾;…`ø !W=`Ï76K­ï»PÇwl„¹ÿ³Ö‡#¹ÉñÅ	0
-Ég$
-‚{ôÙÆwž±…»F:‚ÞT¬Ò
-´ßI&ÝY©†,Ä%‡¶C Åüq²e…A±2Ùù§©W²LwyhÿJ­\ˆ{vaÓÒ§¨´j¦ÃzÚ4§Ø.ž†¹ƒ—Ç÷ïü¤ò Ã
Aá?66]ÿWW“Ì;àÜŸž—“LN}/Oa¹ôßÖ5•jæˆ7œ¦žj‘n	\ßtøæ:"œ`‘žZM˜€jòòþ}~bkÉšÂèO?¿,šù™ÛWßlÆîƒM²4ÛmO{¼GªºXÕp'Û±FDlùß'›áôdÚÀz¦âa1
êMÕë-‹…êZ³ˆ£Vä馛ա„ÎÖX!Ÿ:ˆo/{s :m‰©À[4ÛLE†KJÚt~t/ÜFuÇy¬­j
-14¼?ï;†9Ÿk=±(C8e¡TбŽGôÒ¼áƒKû)q4/±'t·“÷ؗà­Ïÿì&÷‹©µEX²Ùx»J¤~Œ,¯<Ÿ¸€u-æ}>áöö9qî["SŸ8šëSþÒËÚËÝ­;é
-ù:Ë©sÊÖn1ú^þ¼“þöæËo©‰0†Oì‡`ºKB¼RõæB÷¼þ°óPõÿï§ë†endstream
+xÚµZKsã6¾ûWè(W…Äk÷4I<³Nm&YÇ©=$90%³F"’²G©üømÅ'¨­85å!~jôãC ›¬0ü#+Åf:^I#Ž	_mŽ7xµ‡gnˆÃDuQ_=Þ|ù^ЕFZP±zÜud)„•"«ÇíÏë¯ÿõî‡Ç»‡Ûˆr¼è6⯿ºÿøíÑöòõ÷ßßøéáÝ­Œ×÷ß´Ýwïïî>~}wÅ	üž:	3?xÿï;Ûúððî»ïÞ=ÜþúøíÍÝckK×^‚™1ä÷›ŸÅ«-˜ýí
FL+¾z…ŒˆÖtu¼‰9C!‘‚-YPšÐ£Ï>ŠÓ¬¯ÈÛ°/`Î~1JÌÓO &뙤ŸÃ/X?–ûÐ!cŽB‹ZPd,-Ì@A`¹ÀgŽ.*À@
+„l*	*‚„aUÃp¢ÓæðÍ°€Ð†`±pHmQ#×N-ܼyÃ|Õ•=qBu¨	z$1eET_‡·ÉNS–§A9xs–'±† Ö36Ä_0{,÷ú¤D8’”«°ÿ[Ô‚"ciá¼Ä$(ÅN¨]T€ueFs~űg²)昨ãÒÛ°¢¢g›Éèz3P±ÎjÐ|“ØÔK50ËB@\rh;„EX1¿ŸÒª¶A±*Ù»§™S²Êö6òÐþs\›÷ì²Ì*—¢²ÚO‡Íá´õ¥lOÃܱ—Çï?¸Iå@‡Ãdj
+šþ/“Ì9àÜŸž—j&£¾o+±Lúo÷5µ	jnˆ7ž¦ŽjB¶nn:|3ÂN0!çVÂ`7Ùn¯˜Ø2&~9ùÆ„_–IÜÌí+‹o~8ÛîcšäY¾ßöÞRÕ<°û±ndÖ0AÖÿ}Js;=‰T°žq=N ¦™of˜_o™f¼[¸–!v†ZÂÑMúÕ¡‚ÆVÍ-Ÿ:ˆÄÞ^v_”iiSio­Ùj.24†]:¹z4oÜ&u·óXZ5.dÊTœÑþ¼ïf|.åÌ2G^ŠÛõö¶h©'ô’ÔóA²uú914¯l¿ÐÝNÞÙ¾ÄÞº\ðÏn21¿(ìFj“ZX²Ý:»*ÈÜyQ;>Q뚦}>Ùҗĸcj‰Ì\âðקⵗ=:yûšÆì²?ŧê®tTö·½þu¼Èä›ÛHÀºÉÿ¶ù§½@f9Û–MH¦uI7æÎ$óúüœ^î`CN¡i:«¹bek7›|3ÎI¹ùRåKÄLýãôIöºŠjé•jã—Œ¾ây¬úÿP¨ìèendstream
 endobj
-1096 0 obj <<
+1101 0 obj <<
 /Type /Page
-/Contents 1097 0 R
-/Resources 1095 0 R
+/Contents 1102 0 R
+/Resources 1100 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1072 0 R
-/Annots [ 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R ]
+/Parent 1069 0 R
+/Annots [ 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R ]
 >> endobj
-1099 0 obj <<
+1104 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [352.879 681.7691 426.5323 693.8287]
+/Rect [381.2254 681.7691 454.8788 693.8287]
 /Subtype /Link
 /A << /S /GoTo /D (tuning) >>
 >> endobj
-1100 0 obj <<
+1105 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [307.1508 650.7179 375.8228 662.7776]
+/Rect [335.4973 650.7179 404.1693 662.7776]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1101 0 obj <<
+1106 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [334.8268 619.6668 403.4988 631.7264]
+/Rect [363.1733 619.6668 431.8453 631.7264]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1102 0 obj <<
+1107 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [337.0185 588.6156 405.6905 600.6752]
+/Rect [365.365 588.6156 434.037 600.6752]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1103 0 obj <<
+1108 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [364.6945 557.5644 433.3665 569.6241]
+/Rect [393.041 557.5644 461.713 569.6241]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1104 0 obj <<
+1109 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [374.6372 526.5133 443.3092 538.5729]
+/Rect [402.9837 526.5133 471.6557 538.5729]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1105 0 obj <<
+1110 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [292.0276 495.4621 360.6996 507.5217]
+/Rect [320.374 495.4621 389.046 507.5217]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1106 0 obj <<
+1111 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [319.7036 464.4109 388.3756 476.4706]
+/Rect [348.05 464.4109 416.722 476.4706]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1107 0 obj <<
+1112 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [460.1655 433.3598 533.2211 445.4194]
+/Rect [488.512 433.3598 561.5676 445.4194]
 /Subtype /Link
 /A << /S /GoTo /D (tuning) >>
 >> endobj
-1108 0 obj <<
+1113 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [362.144 402.3086 430.816 414.3682]
+/Rect [390.4905 402.3086 459.1625 414.3682]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1109 0 obj <<
+1114 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [293.1435 371.2574 354.3435 383.3171]
+/Rect [321.49 371.2574 382.69 383.3171]
 /Subtype /Link
 /A << /S /GoTo /D (options) >>
 >> endobj
-1110 0 obj <<
+1115 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [288.6803 340.2063 357.3523 352.2659]
+/Rect [317.0267 340.2063 385.6987 352.2659]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1098 0 obj <<
-/D [1096 0 R /XYZ 56.6929 794.5015 null]
+1103 0 obj <<
+/D [1101 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 462 0 obj <<
-/D [1096 0 R /XYZ 56.6929 323.2894 null]
+/D [1101 0 R /XYZ 85.0394 323.2894 null]
 >> endobj
 779 0 obj <<
-/D [1096 0 R /XYZ 56.6929 296.7987 null]
+/D [1101 0 R /XYZ 85.0394 296.7987 null]
 >> endobj
-1095 0 obj <<
+1100 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1113 0 obj <<
-/Length 3154      
+1118 0 obj <<
+/Length 3150      
 /Filter /FlateDecode
 >>
 stream
-xÚÅÙr#7îÝ_¡GyËêðì#o“‰gâlʳk+µ›ë¡Õ¢­ÞHjEÝgöë À>¤Öh’IÕ–«Ü$‚$€8$'þä$µ‘Й™$™‰¬vRl®ÄäÆÞ^IÆ™¤Yë«ùÕob5É¢,VñdþÔ£•F"Måd¾üiúú›Wÿ˜ß>\Ï”Ó8ºžÙXL¿º»ÿš }^¿»s÷öû‡W׉™ÎïÞÝøáöÍíÃíýëÛë™ÔÆ*  ™Äïîo	éÍÝw·×¿Ì¿½º·[îK
-ûýíê§_Äd	§ûöJD:Kíä:"’Y¦&›+cudÖ²¾z¼úgK°7꧎±Éê4²©JFødôŸlÅZiϧۼXÁyâxº¿N§‡µ£Îó>ß65µ«=~“éÒmKǰݾ|_®Ý³«/Ú¦ÓwÛ‚§æôÙ¸ºÎŸM]å<¯><Ö댗7ÅÊ-sy+7ÐKÄ´Y1åjçöySV["ZÖÈ~àÁLÊ(³Vù•›[–yãüiFGñ¤)€þ,Kjç[nl+ú>ö°æžfð^jÆÝ_Ëtê¨ã~Ï7åÖ-FÅÓWíø²&*Ý)ø²r[jÑÑ Q—Ï[Xqä<4ɘ„ñM:-áMÙ| ðÏB(·^ÞÐX‹´Í7ŽzDÚñ¤O—[æEQùã.sº\{)›Õ•æÃnH‰·‚¬œ‰”“æ‚ñó¿ßþ@-÷{±Ê·Ï<Õk;.±p×rê'Açhð-hvI&[¯XË–¼QLjÍÍYaÒFô.{È<ü¶Ã²¦O–§×<öÜÎñw­¼>"wa5b¼ic“:Ì-èàýYž£#×ø7¡²pJj?ð¿x“$=KŸIx­*Þ"†zÄÁ“` iˈå¡HãEàG¢(°(ÖJNˆJžSÿqñüøýúþ‘FIi8ç.ßÖ`áé¦gÒÀI´Ê†Ü¨‘
za“žÉµ^×Îw;ÿ jE ÍaÝ”»€ê9sÛ.é!ÓÚÛ‡SŽÂæ"u™¥^ê4Ö',…å6‡º¡mÕ¶ÉÉ€‘q˜g¿òuÏÌgªM^·Äë(µÂu€¬Íkwz™E2N2ÞckÀÇ#åÈa?éÐ0ôyŸ¯ÁV|IDlµTFZ·¬óæít%¥£=&Bº!c¢,•A¦A°~G³qÇ>x°Õ›ïÕ	ÐÍgHL!,6Êü¥Ô]Í_%@´>¶ö3ΑU½pøŒY`LÍ¥×àX€FÕökdr×IdO.S0€ßÖoÒçz¿€ÞoÂÆÐoBHÏošé,i㮼`<õCÉ£àžäž94}s#l¡ÅΩbÙGL–}¶²ßÇPìLkЂ\…’Mf»ñSIöþQ?"Ž½‹þ<áéä1ÕQœíO'fœ•Gcb8{é´JEÒ‚ÓûOb̘ɬç	Ë,î.GèB±å™‹ãt]âE`{¡P`órlÇ:[¤•¡@H™3¶(Î"xÐ’Oð¢Áï7™>¶G ÒêŒæ¤›Ôè‹š'uv¢y°ß’÷AqÅabˆA2¥Hy ˃×Naeu õµïÂ7x8H
--?Â÷Œ6 À6µŸÄƒœ?fLlMǘ¡³ξhý3ò4SiI%ãáÝv¹°jÓ`56UÝ‚[[†ž¾õºza8­±¨¶L‰£c5Ý'½Ø¤†Œ_ªY,Á¼uÅ¥BÎ㬸Ad›2ý!¾‰T÷h÷‘FÌ¿õ:ö)Ššvóš‚q£ˆÏEZRA(.ÒOŠÑPsLB2åÄ
-5‡)0í…êô¾302"Æ‹ŒæéýmôÊm	kÀ0IAjé·Ø¦Õ‚;[äµ;o{ûFíóeg{»d÷ÿ#ú‘`¥t¢@álHé´Ÿu?ɾÃÝC˜Ákda°üÑä»°f*HÌï˜×ùzݱº¾ù˜7§Àm©þ¸3ÇiVNAp>õéo€>£)1e—Ú·»LÃ,³,)\€‘Ÿ•2¯îÀ„ NdA0².ž‰ö|ØæßPïeUúbN†‚„÷•Á=¸÷˜„ÝSo1ú‚ó“9äˆR°÷UãB¢:o8ÇMÑÏêsò»iÜf×óØ›|Éék÷¬µ¬]Ã0:I9½
-5¬ëª(9–òiõPmÈ»¬z›AwR[ 1]fÄž[‹_ƒL?…XËQÌû¢eÝ´‘ýpƒ]…!b}Sðhƒ¯fV‚\ÅšÂPŽÀeBLôOž/–k×M
Ü÷SÁ{™…©‘äÉ$œãWW‡}áBö¸¬»Ü”op†¸—}ø¾æ	ðPmFlæ|L”iz.¥¶x ?EÃÁEO×ÄãgGº›MÕÞCªØtúDý
?¼yM`
YººØ—RZNå".x“A}©‚Àœºtp¤\0öCï‚5éáÁChâxý	X4_¥hL?{Y@XÉc˜½Çò¸¿¥¯‚!”vv‡Åóø>€Á¿cøÒ‘¡Ž¬ ¨UÜcLð­{!¼Ô*Ïä.lˆü6/#šÛÞw¹Ù­ÝÆm›³Õ1ˆ£V‚,tåLÿ
-ÕU˜ŒË-;Yȉ•\g÷òÚJì¸h^¶WhuÒöÁ6{i"é󠦱œQª¥ó¥)ÍUì¤ù€zí=@Ðß‘&h R-·OX¯ò®T0«8èÍ?6Œö
-{ÑØýÌWìðÒâРB‘[‹JÝâìJ÷,"öÉ"úúìò}SÔIß!¸lëYEµÙUu Ö¯Ìä”D!Äà*mËÇÃZ†Eq|ˆ…/4Ê^eЗì†óø¶bVýeÂÅ z‡É…
-a‹¾àÒàŽùåöïCYpÁ•Í )h©`t_ßP$8¼îÁª°_ß¹0d'ÚRÁÕ×PEk€¾KTÃÓI]íùéèÍì›êy¥˜'€ØgS6¤±Ð¥	7·kÊMùßðKÄ<ìñ
-k^¬ÅÄ ìðw#'	vàçñkÞy|}ññîË÷F&vR{jìû2X¼Ä½/ãm<:w"@|!
„R‰(‘Æhpÿ<¡ÆCß“ø³þ„SWú”.ž÷ÑM›GŠ#DXÿ$l‘¼ue{:ñé[¬;1°˜i9Ü	?:ƒeµ…'^ØOeE‹i'tϲÂïÉŠ$ÒJ|”-Ö…œRkK\p¥"p?Óa¨0ï²Ù`¡¶§ùì¼ïï3Ù>,=¿ŒŸ±/ÏÔÒ$Šeÿùˆ²ã‡Š¾2µñÏDëÞ}öÏ¿ºŸÀ`ošª3bP¤åf{rááwbŒÕÛúÿÒßÜ6endstream
+xÚÅksã6î{~…?*7±*¾$ªß¶Ûì6½Nö.q箯²Ì$ºÚ–kÉ›îýúP[Þl»¹ÉLD‚ H‚ˆ‡Å,?13iœæ2Ÿe¹ŽM"̬Ü\$³G{{!gæC¬¯_¼Iå,óT¦³ÅÀ–kÅl±ú)Jc_…$úñÝíõå\š$zsó´„ÒFF¯¿yõÅõ
¤ŒúÕÍí×ÉéóúÝí››·ßß½ºÌt´¸ywKà»ë7×w×·¯¯/Y|{q½è¶<<–Hî÷·‹Ÿ~If+8Ý·I¬rkfÏÐIb‘çr¶¹ÐFÅF+ ë‹û‹v£~ê$›DK,9å“VS|2yœ*©<Ÿ®‹ò	•¦ÑþÒF‡µ£Îã¾Ø¶
µë=~³h嶕cØn_½¯ÖîÑ5À:elôn[òÔ‚>×4Å££©OÏke	‡õúãmùäV£¹¼•+èeIÔ>1åzçöE[Õ["Z5È~àÁ\ˆ87FúU›[UEëü6§£ø¬¥³ÐŸeEíbËmM߇ÃÖÜÓÞKøûKa#G÷{±©¶n,Ð2^´ç#tª†¨ô§àó“ÛR‹Ž¦zÜŠç¡™HFgŒ¯mTÁÚªý@àŸ“DºõêŠÆ:¤m±q„0 Ògݸ
\m	X”eí»*èraì¹jŸ&¨´vcJ¼díèL¤œ4‰çA«ß¡IÆãkv®¬<õü6‘©Å›ˆ»µ³8WÒúµS,̇°ƒµ˜e!õór‚ºÏÕzU’l¬zÞ£jˆ$º­÷›å]]Ѽö©bÒÕøVF‹<
-îoÞŽ×ÀωIø'¦¤çWçSIä¶Úš¶…"Ǥï‘v+Pj“ ÿvpM‹ò
2ü//¶8VÐgñ÷ë¨å~/ŸŠí#OõÚŽK,»Ñ–:G;€oIktK2Ù扵lÅuŒØ^&¥“Á…b™‡ßnxDVÉòô&L€=‡9þ.°U4Gä^X¯»cãXͤ€sK:øp–çèÄ5þÂMÈ<Ü„ÊÏü/ÞdÙÀÒçB£Š·ˆa§qô$hhêÌ0b¯@y¬B{Qø‘¨Ã
+,ŠµQÕRÅsšÃò?®d ž¿_ßÞÓè1)çÜÛ,<Ýô\h8‰B`È	™ &˜\ãuqMàb·ó¢ÖÚÖmµ¨ž3—¸íŠ2¥¼}8å(l.Ö©–/³ÔÀKmSuÂRXnshZÚFYoÛ‚€ù7qþÛ¡XÌp¦Þ•×"Ï™ªØšÄŒu€¬Íkwz‘Ç"ÍrÞcgÀ§#ÄÄa~Ò¡¡éó¾Xƒ­ø’ˆ˜ájVÄJu¬óæít%©â=&Bºš £ãÜŠ Ó Xž1Û©M«\Aù©°KájJ=²ØÊ$ë(ùƒò›vDRj8¤
¨[?¼xÈøØ{	Üü›¥BÇ°nö)þ£Ò6Î’ìÈüs³ÂF@ˆh«úüh^´¸7&5ï579ø©y¦:ïtÄ@!L¬ibb«rñ1aÉ’8—*ÜðõïEÙν*œér›í+ªtjÁªúÇG:CÎåÀùd
+Ü|2Æ
+‹㥫¶$ô`‡„‚ŒCY¬Ù-©üT~GÞµ¡—#OÙËTÛ”'u"ÆZz"]Úd±y6ÞÃçÝ-J‘‚+ˆ‹úKÅ%…Îf—Æ%ûE£0’iÄðéC'T/Z|s"¸fÐêd@e@DlA¿£ù´[ü×ú
‹÷é¦äçê3HXŠµ4©õ7óWÉ¥Où$ÃŒóò£’ØÈA0<-@ø#¬~é)8–ŸIe…íjñ’®f±Ét~ü¤ª”Büv^“‚(×{ô^6Æ^B^Ó\åYuÍáýÊá¡K…𠬡ZCak-vM%Ë>b²ì#°“ý!†dWZLøëà(Tl1»ŸJ²oúq\ôç	O/VÅ©Må fœ•G­SxØÌÏŸ‘2<Þ¸S¶ÑߧÈÓþ>q„î[ž·8N·… ¾Ov÷‰ð¶.Çf¬7EJjŠ‚¤>cŠÒ<†ç,ûœ~«cs-Ïhº¶Z½¨yB*ì·âýCD\sŒ\Ç)DxyðÊi ¦¬¤½؈ßà?à é´|ðß3&Zƒük>‰19̘Ôèž1cO¤/é<ý3ò4—f	)ÒñÝö‰°jQ0›ºi	‘-Ä,cƒ/ßz]?³@œÎVÔ[¦Ä¡±ŒvÓ/¶#V“í³ŠÅ¬›^–CÎãÏNö¦·Ïtÿ?BVJe^†¤²Ã”ûIê]f˜bLc¤üÑÌ»N`M›˜ß0¯‹õºgusõ1g.µÀm!ÿ¸/Ç9VÎ?p2õáo€>“ù‡$bÚ·û4Ã<71§J
EŸRïÒç.Pêª3º¯ÎLØs`kùké‡j9ª~yW´jÚ.®o°//ĬomðõÁŒÂÁJð‚ËTÙPy—)I’èGÿäùÊcµvýÔÀ}?œ×4yW´<¹—Ä‘o|çšú°/]èÁWMŸ˜ò
Nrß7<ªÍ„ÍÀ„Žs-ôÀ¥T&ä§l9¶°i´&?:ÒÝ~Á¿cøÒ‘¡Ž,!¦UÜcHð­{&ww¼ÔSñžÉ/]Øùl^&4·»ïj³[»Û¶gKc<ÆYèk™þjê0
–[õ²>’"*EvÑIì´h¾(l¯ÐêØîÁ6{iI6äACc£Ô+çëRŠKØH-ò{ôÆWy€ ¿£$˜ ‘H´Ú>`±.È»”Á¬â 7ÿØX26Ú?ªêÅS÷³xb‡—‡U‰ÄÔâXQêgWz`±OÑÐgWìÛª< Nú~ˆÀEWÌ*ëÍ®n°~ã`&WŸ
+!W¶«}kkVÄñ} æ,¼Ð¨eA_¯kÎãÛšXrô—	/ƒèF$ʃú’ë‚;æ—Û¿5Á%—5ƒ¤ ¥‚Ñ}sE‘\àðz«Ãþ}qâÂhK.½†Ò(Xƒô
X: ž^ˆHšzÏOÇ`æ ÒPÏ+É›ª%….½H¸¹][mªÿ†Ÿ9 æaWØðb&þú`‡?’˜8I°û#?_óÞãŠwï\±_22±“ÚËP`ßWÁÂà%î}eoãÞ¹ãXllGÈ$΄ö•Ü?Ψq7ð¤;üùp©+}JÏ{ïʶK#¥±„h
+bý“=Yë,méÄ¥H/íÂߛ¦éxüäŒb¥$ƒ8B*úËŸP=Ë}²!ˆYr«íÇÙÐa½´‘j]iˆHƒç™£„EŸÇã´=ÍdCW'XÈîM¸dü‚}y¶—”
+›þù`²ÿ‘•Œ1µ‹_aM:ų¤óì>ûg_ýOß4ܳµršù]ø©@fý +MO~”~ÆXƒ­ÿGÌÚêendstream
 endobj
-1112 0 obj <<
+1117 0 obj <<
 /Type /Page
-/Contents 1113 0 R
-/Resources 1111 0 R
+/Contents 1118 0 R
+/Resources 1116 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1072 0 R
-/Annots [ 1119 0 R 1120 0 R ]
+/Parent 1069 0 R
+/Annots [ 1124 0 R 1125 0 R ]
 >> endobj
-1119 0 obj <<
+1124 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [341.1654 116.9088 414.8187 128.9684]
+/Rect [312.8189 116.9088 386.4723 128.9684]
 /Subtype /Link
 /A << /S /GoTo /D (the_sortlist_statement) >>
 >> endobj
-1120 0 obj <<
+1125 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [434.6742 116.9088 508.3275 128.9684]
+/Rect [406.3277 116.9088 479.981 128.9684]
 /Subtype /Link
 /A << /S /GoTo /D (rrset_ordering) >>
 >> endobj
-1114 0 obj <<
-/D [1112 0 R /XYZ 85.0394 794.5015 null]
+1119 0 obj <<
+/D [1117 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1115 0 obj <<
-/D [1112 0 R /XYZ 85.0394 626.5613 null]
+1120 0 obj <<
+/D [1117 0 R /XYZ 56.6929 626.5613 null]
 >> endobj
-1116 0 obj <<
-/D [1112 0 R /XYZ 85.0394 614.6062 null]
+1121 0 obj <<
+/D [1117 0 R /XYZ 56.6929 614.6062 null]
 >> endobj
 466 0 obj <<
-/D [1112 0 R /XYZ 85.0394 327.2191 null]
+/D [1117 0 R /XYZ 56.6929 327.2191 null]
 >> endobj
-1117 0 obj <<
-/D [1112 0 R /XYZ 85.0394 295.1135 null]
+1122 0 obj <<
+/D [1117 0 R /XYZ 56.6929 295.1135 null]
 >> endobj
 470 0 obj <<
-/D [1112 0 R /XYZ 85.0394 295.1135 null]
+/D [1117 0 R /XYZ 56.6929 295.1135 null]
 >> endobj
 647 0 obj <<
-/D [1112 0 R /XYZ 85.0394 265.2577 null]
+/D [1117 0 R /XYZ 56.6929 265.2577 null]
 >> endobj
 474 0 obj <<
-/D [1112 0 R /XYZ 85.0394 208.5998 null]
+/D [1117 0 R /XYZ 56.6929 208.5998 null]
 >> endobj
-1118 0 obj <<
-/D [1112 0 R /XYZ 85.0394 186.2886 null]
+1123 0 obj <<
+/D [1117 0 R /XYZ 56.6929 186.2886 null]
 >> endobj
-1121 0 obj <<
-/D [1112 0 R /XYZ 85.0394 99.9723 null]
+1126 0 obj <<
+/D [1117 0 R /XYZ 56.6929 99.9723 null]
 >> endobj
-1122 0 obj <<
-/D [1112 0 R /XYZ 85.0394 88.0171 null]
+1127 0 obj <<
+/D [1117 0 R /XYZ 56.6929 88.0171 null]
 >> endobj
-1111 0 obj <<
+1116 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F77 707 0 R /F57 628 0 R /F42 601 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1125 0 obj <<
-/Length 3068      
+1130 0 obj <<
+/Length 3065      
 /Filter /FlateDecode
 >>
 stream
-xÚÍ[ÝsÛ6÷_¡Gy¦bñ
ðÞ\ÇNÝÇ'«3¹kû@KtÄ©,êDÚN],HAŽI&µ2çvZKöó·šüËGÚ$&éȦ*ÑŒëÑüîˆ>À³·G<Ì™4“&ñ¬fGߟ1J“Ô3šÝFk¹„9ÇG³Åïc“ÈäV`ã¿»<;žÍÆç¿@K¥ÅøôÇ“«ÙÙ”˜0õ‡‹Ë7DI©9}wy~ñö·éɱUãÙÅ»K"OÏÎϦg—§gÇÎ~::›µ[ŽÅ™Äýþçè÷?Ùh§ûéˆ%2uzô–ð4£»#¥e¢•”
eut}ôÏvÁè©õ96)Æ.´M¤Jüþ—ü¬T.±Ìvü,M8OR­{Ö¢÷¬ºÍûKM8Kÿ1*›ky+F%#1r®åìÈjž#­cù¸Î·Äôuv—CÏ¥v\/s¢-Ê»¬Xï=‡ÞãÞán†íìiwQQ{[Þ¯ÉS*mÅSØH´Ý—±™-A5G!“´W1>[²y£›«0Ãã¸*SÜ‚ö\­?m€%F=΀{R¨q¾>æãy¹È4æfrSÔØ—ã‡luŸ¹^fXmòyñc"¯šG9=¡Õ‘TÞÊ2H,dùÈIâU«i¸³ª¼÷sæAdô¼ômŸ¬"&¼Œ±;Yø`ö+–lÞ蔕±:I•²há7ˆ#³Ù/ *=–LŒëâ.ŸÔådU¶ˆj½¨¾ƒ‘b ["aÚf[ÜeÛbõ‰†÷U&Ü
-‰»*Wù6¼ÆL{h}9x8*¾d@k³¹·pƒÇ®ðÜ
-ÏHžØYäÕ|[Ü ºâpY>b‡Wåú‘²f‘fÝ5unòý
ÐñýÏ.HMoòÛ2v9ÈKl«ey¿jçŸUTóŒô9ïÑèXU^¦~ßÔû-&õ€÷1Æ&ÚZò>óUVŒTŠÜ”à~ß##ß#w¾GÊÆ÷À„b‘¯ëóg5Ïײ.ç劦Þfw¨oJ\†èR¬«:[7nÇë3´5ñ²=‹Xq(DÔA%&Â5 1%1iú†þïäx¢Rܽb¦µÙãVLY)ZëÈ‘6r‡"Ä·ÃØÖËè"¡·ð|ÁÞL3t&=aã.G¯»×0x‰+lBÕ¼GxW%¼fû{hìeŽˆøA‰lÂì>xüD
-ë@îøjKŒrúÑ \íDqÊPŒjÖm¹Z•…w¨h>Á'Ó¿?‡¹»enÙÁÎ[Èùk¬2ÞGBd\–ºQNs±Æ‹QS;7¾XÓÂ0åâ’Þ¢ ¬Kƒ&ëÑP©%ïM‹"àÑÅÕ3¿ökÕ3öû&ÄæE㌃xÏO©Ñݶ³äP¶Û@¦?Zòĸ¡ôGÃI…
éÏ	ü.Pqdèƒ	Vµ'6ÉÙ0ûœ3=ì‹öu¨<áŒÖ_±dóF'ûT
-3Ðô³$+yÈsN€cF€êw3„ìÃF¶Ž¡oö­‹lõÙ4ɧhîoñ†š»ðC0—[w[@±^!Ù©‹ÍPƒ–¡õæÊq±å¸–ng„½Õ4òyA¼ÀÞî‘€»Ç§Ï lB=y|`%1	:žIІ,Ò…t|öq“Æt–­)ÖM˜]„·I7¡#ð£S7c¡¿L‘¾)¦RøÆù€S†ÿ¥%©æùõ›À´…Ãdž‘Ð…ÓæœÁD@dt“U9‘«|‹ÉpWqû”áHÚ1¼GÙž:°ª[Ñé^±UóR=”\+ƒ5üë$‡àS³f{ÚO”UQÕÁá>ÕóÈC¦Ùá†%}\Ž¶(7ü
Šx
-gzý\Ö<Ñ.$|§gÓcÈäg>s`@V‹j/¿ZŠºq°ó|K¹E>à€Ù
s…–®‡¹Ñ®_q-O	•°”
Ä8%ÓÄHAŽäôòä×3f*}’¤µO›¢Û.×ÅÜ3†¡X
-=ïn`¦wë0pùИš=¶Ã£"LA…îô-ýP->à+®ÓIkaÒ!%‡ÖŠ€`ƒ´Sãi¾Yes/,Vƒ’z)@¿­WC?ˆz»Rê‚E½¤H­^ú
-øÞ:€qY¦¢Jù—¯¨¤r|¿ùÎÇšqîÊ-‚Œ‡ëp8Ó‹Ü'm~´¦wP•Zˆôêþ¦¦qN<¸H	\<Ú³2Ùìœ)8kæ‹,@ÜfáhÌוÃÔ,̃ý¬š‰{E`zžUôŒ~!”#0ÇHùL¹®ÉÛÛ€`8”F&ÔÒÂXѭܱÖªd÷
<8¸
-€ÈÊö+·„ì9eœœÌÛ«wF”¼v×ý÷úaUÞ4N|SVBšà¿¯ï7·U¾hK¦Ÿ¨ýåÝiG£­¾b·-KS%5©CE9úãÅåù;lNûÂruîU¼³±Ýxs³*æÔÿËßA'«ªr^h\Ð8DQ|B/¿¹¼¦1†£„îþŽX„î3‘ø¼¯ØD„q‰±rÀg	§ÁƒkøùýñÄpH–ž8,C¾’tòsˆèþ‡·eèPí{$#Za¨}¼iÚËÇgÝÔNB²aD§§;Jf››QìboU>˜×íÐÞäuoCéÆt;ã¥ÏÂ;k>¦]`¯ë!Ü…IÏ€jbªNÀ/ԴԪﾪÆËïP…ÀoaÈÆ\jõ€šq­"‰^ž\ͦxÏ)ão˜²ûz	Ö\jð4~–±Åد(‰¤\Oø¸‡«Ñv[s:he§³ŠUŒ%Z¤ÄÔë“+46gšÓ:¯Ëí_ÁSæÛ‡¢¹ìÏæó]ÕùÜÁaàìgÓ²ž‹•xÛ‡Í^
-и•ƒbw.ÑVºÀ]¦)/™´U׬öß$!©)1ynï¼{²¬éîíÖ;JXs¯èÄ:@€Øý¾#:àakNæ5'@¿µø€’sȈ‘„“/ßÏ<!ÔÌyG€-à«ë³Sêã=’f)~žE_iøÒÍ^Xg¥çô…
Ò§ÓŠ:¢ñaßíUøLSA^JbW!ÝDJF
Öu3¢‰v÷Ÿ›m°n€ôEV)kê䋪~ºÞ3‘è¿åÚ_qÊ”±³;Žéë!èá÷]ØÒWеí‡
-ž%~D pî—¦Öojò\Ñ«…_
ªý‚XØŸNÄjqØïÀëD‡Ån«S‚œˆzÚÈÔ£)cÛçþêÓDPt
xKd_{4¼`§©6â´pKj,UAŽ|Ò­À/ùü :ú+Î÷¬…—Ùþ…Ô5•‚>¹Âlt³ùúí`0FIgöm6 éa0ó1Ïýí¥<ª‚(T¹ÊûD1hû5“N´;h:ÜôH¢#¿bÁh	¬gCŸã¥	"¤¾W^0ÂgvøE§7-¤nU¹®h½BqãKꪉÁª©Þ*Å`Ö\+÷Ø˳WŸæÓ[ÆŠÎÿ2–‚v%~Ø©K˜²ò¹¿–`£A|ú¥›±ûûp¸ÒueïáË:‰ù¬þ<Å|ö§#œ%BÑN‹6ÿ?’ Uendstream
+xÚÍ[ÝsÛ6÷_¡Gy&bñ
ðÞGNݦŽOVgr×ö–èˆYÔ‰´Ü_»X‚SLjeÎÍL,AØÏß.h>`ðœN˜LÕÀ¦*ÑŒëÁìöˆ
>³·G<Ì5“Fñ¬×Ó£ŸÎŒ¤Ij„Lo¢µ\ÂœãƒéüáéÏ'—Óñäx$4šäx¤
¾>¿xC””šÓ÷gçoŸœ[5œž¿¿ òd|6žŒ/NÇÇ#.•°€KüûýŘ&¿ÿ5ýåh¶Ê÷ =[ë/kà‰QF3`Ÿj˜¯ŽùpVÎó9¹]5öåð>[ÞåD®Y Vë|VüɘȫæQNOhu$•7²’Ëy>p™Å·º†;«Ê;?gdF/ÌJßîVÄ…çqv+,¿Ì~Ç’ÍÂ2V'©2½6À5þ±d:}²ÒiÐdÉÄ°.nóQ]Ž–Ž§pâ4>YÂd’eº@}ÇžÖrNÏbFC)‚¸T¬êü#š
º…u·*j´%iýïc[¬VóêŒåš¹ÓÖ›â6ÛË/4¼«ò0á:PHÞU¹¼Ï7á0gÚCë–ÈÇÃQñ%j›Í¼o#aa\nÕmÅj^„”§.J4D
†X†Ö$t(ÕÅ^”êJXºöVÓÈ'ñ;»GîŸ>³	ùäñi€•Ä$èx&A’i"épüyЄ–-)VN˜]„·I9¡#ð£S9c©?O“~(®RøÆyŸ_V_¤›gWo^ƒq‡yÈ,#©§)Ô9ƒ3ˆ€èè:«r"WùS$`¯âö1Ç‘´åøm{ì"8@«n)DÇ{Á.VAØKuoŽ­ÖÖDp±—#jð
›íè?Q–EUŸûXÓ#7|	g‡'–\ìcs´ÿCyâPÎS°8c,íc³æ‰v!ï;OŽ!£Ÿúü
+YΫ4k^|,êÆÇÎò
¥x`yOn7ÜZº=ܶý‚«zJ¨„¥¬/Î)™&F
+ò%§'¿ž©ôQ~, £2¨MÑu—«bæ¹ÃP7…ž÷80Ó»vÆÎ|xLÍßáQ¦ Jwº—ý€->á®ØIkaÒ^5çp,€lƒvj8É×Ëlæe€…kPS/è·µkè@o[UᡨÔ±Õ_
ßyÐA§08ËT@d)?ùÒJ*‡wëW>ÞsRniÜçX‘Ù^æ>y󣽃ºÔâ Ww×5sšàFJã	Ñž•ÉfçLÁY3_mâ&Gc¾Ä¦faìgÙLÜ©Óó¬¢gô¡,„FË'
+wMÙÞË¡t2¡NœÆŠníŽÕæPÅ»àÄÁWNV¶G»%¤Ñ)ãäfÞ^¾D¢ ¶«ø`‡£—åuãÇ×eU ®	.üên
fØ%Ÿ·ÕÓ/Ô¾{º‡¥Ñ^_°ç–Š%Š©¾âšÔ¡º‹,ýùüâì=Â6'{nP½bxzù;u(—€J§„B:P<+…¯ëcƒ‰¾‡à»
+-)4´.œƒzØrça%ÂM¢RÕ¥Å[<øùÕ›@„L7WVõHçáÚZš.`F„sž"ý*BÒáÑy|Ê\{©<({=óµX‚¿Žÿ…è\@j]‡[ïo,ÁF7\ß]/‹õ?ù[!èdUUÎ
+€Žs‡HŠOèå7W4Æ”ÐeÁß‘‹ÐûŒ$>ð6a\b¬ìs[©Dðà~ýp<2’¦G>Ëû†„üóº¿UÄáM:TGÄIÈVjušö.òIOµ•†l4¢c6‡=h\Ú$¢AŸ4üSä² x‚•(ÄtÍ•šK[‰{yÕ@™›ò›k†ÖÄ©.îÖu²8Úû®$
+Á§EŸ#¸ÈV=‹…×)¬ð’iºG7CÀ¹Kê5O#/œ.èMÀÄX¬±ËóHk¯=¡Î
øFÝšŸÓ%³ÍM)v± ·,S‡ûwh¯óºÎ7¡Œcº¬ñâgáž5ß×@‡®	°× öò¤'°51u§aÀ7ªZjÕ«ïªøÇL=!%ÔÌy?€- ¬«ñ)õñNI³¿×¢6|ˆfÏ,¸Òsúâé“IEÂÑøpßMVørSArJrW!çDJF
x3¢‰v÷ߟmî±z€ôyV)kê䟋ª~¼Þ‘è¿åÊ_wJ—±³=Žèk"èá_ØÒGеíwž%D pî—¦ÖojôTí«Å_
®ý†X¸?£ˆõâ°†Ö0‹÷eÝÒV§¹õ´‘©‡Sƶ1Îü=¨‰
+¡èðV–ȾizÁNSuÄiáÊÔXª:‚æù¨[ƒŸó5BtöœóY/³>ùk*}Fr‰hgó=Ü=aŒ”Îð[¯A×ÀæCžû«L˜T'Q¨€”‰b,Ðv+'x·×x¸ÙS&‰Îü‚%£%€AÖû^š0!Bþ{é%#|v‡ßØQJ±aÓBúV•«ŠÓk ×¾¸®š8¬š2®bQfÍ%ó‹yò´Ó€öV³"<§ ^‰…¬vꦬ|ê(Ø ¥~ëŸllÿl|®t])|û­xX‹dhìc~àU¦vb;-Úüÿ¥Õendstream
 endobj
-1124 0 obj <<
+1129 0 obj <<
 /Type /Page
-/Contents 1125 0 R
-/Resources 1123 0 R
+/Contents 1130 0 R
+/Resources 1128 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1072 0 R
+/Parent 1134 0 R
 >> endobj
-1126 0 obj <<
-/D [1124 0 R /XYZ 56.6929 794.5015 null]
+1131 0 obj <<
+/D [1129 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1127 0 obj <<
-/D [1124 0 R /XYZ 56.6929 579.9063 null]
+1132 0 obj <<
+/D [1129 0 R /XYZ 85.0394 579.9063 null]
 >> endobj
-1128 0 obj <<
-/D [1124 0 R /XYZ 56.6929 567.9511 null]
+1133 0 obj <<
+/D [1129 0 R /XYZ 85.0394 567.9511 null]
 >> endobj
-1123 0 obj <<
+1128 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F56 622 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1131 0 obj <<
-/Length 3381      
+1137 0 obj <<
+/Length 3372      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZÝsÛ6÷_¡·Ò3Kü¼{J»q/MzŽîÚ¹¶	Kl(R(+î_»ØEÉ”•¹¸sϘÀâk¹Ÿ¿Nø'Yì2&iùqÆ“buL0öíEÈs¦nÒt8ë›ÙÅ×׉˜ä~žˆd2»ì•ùA–…“Yù³÷êÍËfW·—S^â_Nã$ð¾¹y÷š(9=^½w}óí¿n_^¦‘7»yÿŽÈ·W×W·Wï^]]NCÅ6¼ÅÞ¿»¢I×7o¯.}wq5ëY¾VHä÷÷‹Ÿ
&%¼Ýw/ó,žì øaž‹Éê"Š¥GR:J}ñáâŸý†ƒQ»tLLQú¡ˆådš_& ›“ÇÒËMûYÇG§Â[§~§(z)üPƲ}$¢#égRÆ“4ÎýD
-ie{)Sov	ìd·¹3¯ÝvzÚ-¹½X‚“Ì›WMY5êܵj,[Ólæ^·¼=ÕQ§li¼i;ž¨î5µº¥®64«Ý5¨”Iùyã«„Ø–±²²èvˆdîíªRSKÑ€‚^xîvíæ#•%
£
XA–¦ÞÕ§µÞT+Ýtª¶¤Ì{­§öààðHSlª¹.Édª†íëú5Â0Ã:2¢¬(E5eÿeú”QæKðÉTH?Ò2méVœ6‘ ó…ˆÏYìo•Y©|¸ùÜ)Ësï— ~"2Õ¢QÝ–$Á„‚Ô+ZsÕìe^©:E-µ½7]U¨Œ$0>a€F¼çi«xýîƒOêx­ŸV8Yü„ºörø2Ñþ©ÚJ²È—a”žQW’ç~'©ëýKPW$c$þK>šÆ$j‘&žéÔ¦#Z{G$E?ÚF
€êÚMÕ=\†aèôe–HæXéÃ¥?¢;
-óðªOhdø®Ï«’èYU’~Dçbl’Æ~%ôân/ãØû7&¥$YAø\©®jAh­ær±™x;]×DüØ`t´Ä>Â!ÝèÍ}U Bq=’\f]+¤žtœÿñ½ôs'ÍĪÈà¹Tååó·towZU°yå✪b@ ¦`7ûi†j’¡×éO	ƒóPkŸ%¦žákðöeïûçZ»0'aó3"Œ@sAâ,
D(Ryhé±”ÎÒ±¹[VÅ’›Öè±ÅFÍÞè±ãŒþÅiû6[ܯ=?|?ûá2¹÷‚úÝR±B=Êv¥œÚÌv½n7Sî›Êtó
-D'U8Í_9‡àî\ÊOÂÄÓ€@áO"Æ”§lûkUˆ¡H›‘ˆl‚ˆDìýäãt¤ì±a1a±ÓY^	¾ñs)féÏÕ¸&
Ò£á[å	“Ü—ÊÀ@R?Hk‹G5†?y:™Æ©ôÃ8<¡{WÅqì‹0K)Zˆ2¾këºÝ!ä9}'ƒ•	TLyÁq¸¤¨ª˜æœ r_H`„æY@ÑÇSÓØ+ôh”eOeíaÃsž+{¹jèëaȯ`g¥æ~*Ãœ¯" ðå™ô^-Uk@˜…¥!Ò–A‡ØƒÞ4}²‘f/µ*mŽ°qÐ=¬-Ñ$¼ÈíÙì-]â<®	qyÅ'mc «ä£>	&(¬‰=·	Ù£)ZÔ¼Öc…ì}™»}MðßKæç bÄWëÌÀl´v8ÕAÛ~lãÎ5I™+qüž½j$øp³ÒŠ4!ùF‰dÂ@éÅ^òÕ%u¬;á½Ï®V<½®VUGDº{+lw<ÖÒ)”X‚zÇ~¡xù¨×¼KÕœT¨b©Á¾ÀO³¥cƒN±µ²¥k¬>Èœx½FÿAšÍ%HâëGH÷š†èZ[ăŽ¿ã7 u<Æ›«ÚðV(‰’ˆÀj¢ $X„£sw0I×éðŽU¹d5„ÞºÅÐäxG‹KYv—<²¬LR°Ë™£‘ÞrVú°Á;uËP-'y´ßC•çÀ
 ÚX•stÀ¥Qk‡±’Óï~éä$è¢j«Ëšð~\Võh@0 |t‚,D®
µ¬I`c®éÉ`2#µá^Uh· @ùYè’»ˆEŽ
-?ˆÝ¶?†Œ±—Õœî£}80†¬)¨»JóLë‘ðtÅÌØ»­õÆ“¦` b¶‹…6ŒLÈû©¥
Ï@2s&€#\’—³”»'!šxà]HÃ%)	Âc?°YØ•x7¼VÑ¢}³mä°"g®PÞìKÌmQæËÙ¡ñhÉ´ÜîrÄNÄkÎ8o°
33Ì€½ªéCyñ@¤r»áìMªÑíûâ®!uÕ‡+»Œ»,š«â#OcTW¹ÈÊvu˽ª·n:c8~:>‹$`—ÂUw.á ©ÉÈ&œžpÎÀy6W'°P¨Í¦¢*’amBw–8Ö®æ踼KØï‚ÔÍÓ¡`݆wê¯;a"	ãI¼¿ÞŽÚé#72ß®d¶½&"Ç/„ë–€7¶µÓ²sàþôeŽÏµáðçÀ¼Lü(ÈI-øé?ôÅå4‚$¬ô§nkb¬G?­7Ú˜¾VuiUð¸ð„ÍìÈc¤¦\$G÷£öåsÊL8¡×K.$Ì:cÉ\uÇ'X¶r±…·§ùÃktåÀ¡ž<<äkk¶EO3iÙ1eµXÚ¥Iî·h,©ÃüCjÜ‘
o(RP¿bº¢CÖtpi€þùéPR#à&ȡνih	»Rî€9ÿÒ€…p_•Ç‡Òqj?¾D/ÆÞ
ƒg±»{¨57!HÕjC»‚>ö.³!Íb
x®1ž¸Ëò…â†fÛ‡ãuÃTÐbÙ¹C™%üˆZâÝl΀' b÷$±ò¡Õèm
UÛöÚ'öV­±÷>[p˜,x~CMë!éG ˆÔšHuÕÐ=€‘ý.תٺˆËpª¡æà P[ž7¯ùØ­¡€‹Ê]ëbž5O\Ù¹†&…>éÌDÚ“±%¼`Es4Ê¥çèJ[bã†Gíãv”ög
ØÞUÝr0
kÕ|Dñ€r898¹â-ðmŒŽ˜¨Œs}
ùÒ ²î”G{û=]®Pã¿ß ·Ôtº:ì\‰sŠ­·¥‹éTõŽ*Õ¼ª÷¿
8Ð}Q½ÞgWôm2rhPÀé1Žåøé›èueØp*€”L¢*çÛ¸‡4[NòžwG+©Æ‡Æ«ý¤~!nF­­ÑGW^µMU˜ÑÂE£ß7}Šž·÷Ö9‡b“ ÏêŠS¯½Ÿ s@ßµ½Ü‡àx×vøQH¡Óþ>˜Øé-‘Õ}[9®(,¶¨šxÎfA£‰â1caÒ¾†Œœp±¹‰íîí:ee~ÃÛÊÌU
-dzøÕm½.Óý!ôÖØ ·†½˜dˆ»Õ;œ±
Œ!2–AÄÁæá·Œ=×#‘±‡¤‡ϸ@l×{eŸ•C}fƒ-ôP’뎮
-€ÇÍãŒý6QÆ~$e8öSÂ`rö'ŸûÃÅý7£ðNvâf¯¿t\YÈ•óËÌ3‘Ž1ÿ_Á÷uˆendstream
+xÚÍÙrãÆñ]_Á7CU+3ƒ3yZk%¯|h7»bûaŽHD @s@qå¯O÷tR¤´••+.U	==W£ïnPŒ"ø£$
ÓB£¬ˆÃ$ɨ\œD£Ì}{"xÍ™_t6\õÍøäëËTŽŠ°He:ß
ÎÊÃ(ÏÅh<ý%HCžÂ	Qðïקg2‰‚Ë«*NdpþþíÇñÅ
M¤¼ô›«ëw„)èqþáúòêÛÞ¼=Íâ`|õášÐ7—7×秿¿;¹÷$_KD
+éýýä—ߢÑÞ(TEžŒ60ˆBQr´8‰&±RSŸÜžü£?p0ë¶bS‰PÈDÎRªxsôZº"‚kTI˜§I²w뙈ŠPÀ?`½’¡P‰êY«ë…HÂ8ÏFYR„©’ʱþæTeÁø¨É£`u*ò ]w欛3<›Ó<˜TÍ´jf4¸kWÌ[ÛY‹ ›ŸŠ@ƒÄ‚Žæ¦-=›–sý`êæ¦ZѶvÓ \FYI"ámHÜ´rT˜NˆUlª©!HÓÜÇQИnÓ®îyj:¥Ik]ɳ,¸ø´4«jašNוïÌ™»8Ú½Ò–«jb¦¤:UÃ*tyN€9hêžÅIÆ¢ÆØÿe"Uq*0Ñ™Tañ¬r>9Òï8®%QJ™¼ $pL–¦¹cÊíÕ·`syQ¿FIô«”±­fîÖÄhDÀ„-Š² lËUcqZ ;M^ƒØ›®*u‡üEòŸ0A€5%Ÿy\)Þ]߆$wæyi™%ÏHkˆ/ãìŸ*¬4C%âìyi¥EæI“´>¼iÅ*	À\€á¿F‘4h¥YBœ–YØN¯:µw„Òôø£mÌÞH®]UÝã©"æ«<Ýa>¬q̇'2ÿ€èÈÏÛ>#᫾®DâW•H…q¿àdÓ,	‹8¥÷¾½9M’à_·ÒXþs¡»ªž)ೞ€ÏE0
6¦®	yß ktÈÞ½!ÞšÕCU¢fÑx¹^-[kðdL0ð"šp>¥c¥%Ô6+ƒ‘SûáTŸœ³ñÜè©°ÛLÝãÒÑ+Ê Þ/®ã¢·W|YÙ6$}4&¾ÀE#QèÏ"^Ä®o‚KлèI}ðUI5Ð쑸›wôÕÿ½ezvJF|»Î1>SõÉm?w8Ëb,ú2_ä„=y9T!Ü2'“jF“0wTIZàa\“¶žÒÀY6yuµàåuµ¨:BRó±Ýð\K·PlAŠÇ¥æµ>æÞ,ù”ªÙ¹©ÔåÜ€Š¥Bçžºõ€¦-õ!}äQØñré:a·ÇÅícˆ †¦è«BDçÇ/8€ëxŽ×µå£SBB­‰#A™ÎNüÅÄ]/Ã;åœÅ ‚e‹ÞÉÓŽyàåè”"v¤O2Ð˱ǑÜ
+š±ÅO"Ž8À:JŠx{†ž‚«3OèÜUÁ·î\DÐÝ%Gàí1Êó
PÀÐYÕ@ºji2øi^í
+9<ÌG#ÈRm	r*ÀÄГóɜĆO$xQýaü†ùç²—Â;-2TxüAä¶ý5pš=¯&”ä>9‡}£`IA5ØU†W:‹„§¯g:³r¹ISr®b׳™±œœõd,¯@²¼xÞ®kÎ}&DOÚg©÷Æ©ÏbÓ¨êšC¯kQ: ŒïÚžïÃähCˆK;|XkÄ°¿u&nyKhýÐVž*HfkÍNzÆf9ƒFÅkŽü°Q%a¬”8ô;Ähôâç‹ÏýÕãö—Ÿq±ö؇Jn@©ž*îó'´‹(”*•‡ˆÿ/ßGr‹endstream
 endobj
-1130 0 obj <<
+1136 0 obj <<
 /Type /Page
-/Contents 1131 0 R
-/Resources 1129 0 R
+/Contents 1137 0 R
+/Resources 1135 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1136 0 R
+/Parent 1134 0 R
 >> endobj
-1132 0 obj <<
-/D [1130 0 R /XYZ 85.0394 794.5015 null]
+1138 0 obj <<
+/D [1136 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1133 0 obj <<
-/D [1130 0 R /XYZ 85.0394 552.4093 null]
+1139 0 obj <<
+/D [1136 0 R /XYZ 56.6929 528.499 null]
 >> endobj
-1134 0 obj <<
-/D [1130 0 R /XYZ 85.0394 540.4542 null]
+1140 0 obj <<
+/D [1136 0 R /XYZ 56.6929 516.5438 null]
 >> endobj
 478 0 obj <<
-/D [1130 0 R /XYZ 85.0394 229.3354 null]
+/D [1136 0 R /XYZ 56.6929 205.425 null]
 >> endobj
-1135 0 obj <<
-/D [1130 0 R /XYZ 85.0394 203.1874 null]
+1141 0 obj <<
+/D [1136 0 R /XYZ 56.6929 179.2771 null]
 >> endobj
-1129 0 obj <<
+1135 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F42 601 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1139 0 obj <<
-/Length 2798      
+1144 0 obj <<
+/Length 2778      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZ[sÛ¶~÷¯Ð£<ãà~é››8­:“ã¸g2§é-Ñ6§©CRqüï»À)Q¶“8s2ž1A`±X|»X|Å&þØDi¢wã$Q”©É|uD'7ÐöË‹2'Iè¤/õóåÑ¿^k>qÄi®'—×=]–PkÙärñçTAŽAþ÷íùÙñ	Wtúzö;”˜ŠO_þzúîòìtýyvþ
-k>^¾==ûå‹Óc#§—³·çX}qöúìâìüåÙñ_—¿]v&÷§Å¨ðöþïèÏ¿èd³ûíˆᬚÜÁ%Ì9>YI%ˆ’B¤šåÑû£w
-{­¡ë(LŒ.’}œ¤ÃI9¢§ËÛæ¤å´>fvš7Õ&æ±v‘µ–ªŸ¯ÿï«š|ÞUå®ñÙ&ÅøÌp|¹)>å±Ã¦)Ê,þ]VwË|q“PÕÞ¯‹y¶ì¼Žvçe›#À#Ë	cÄ)Åïƒíà7T?-Ò‰â·AôuÍ?g«õ2ow±ßª¸¹m±ØÜVw;Z/.,̳º.ò¾%>³¨"ošì&öÈšŸvC†07œiÙ“‚HhJ´æjD_×+Òñ Ø‚®XL=†ªNºIÊ	Ä#ëBT™^ˆ2ê €œª	gܧÌÞÏÈÙ«?`‘jaéô͇ã#Ÿ2
-5”Nÿsv~vqJ:±D¥`°D{cÛ|ê ¼^Í|Ó4xßÐÒo§!ÿæóª^4#¶û$‰“ϧ~¯Ô|ºÈ›y]\…]PÜ^x^¸Í̾¾ÉëOyû4m•n3|[QâN…3´gQ.ëúy¬
-[3Ôíß·øV¬£öEì`à~oÜùG’WܽÓ~€Ç:«Ûb¾í#¾y¸àb€žƒ)„®WÕÆûKФ%ÝÙ@±Û² ì·,,}¤ŠFJTF#6Í&[¾Šoúˆjz…ª¡sÙò.»‡ù¦„WyDô¨jZAš‘ÎDõMá×Bãé
ä"Ђ՞/øŠö¶(ÿƪãI¡¿˜ò¯ÞNÿž¥gìx¿15묨±UˆpäÃmïbZ_Dç`(›FMHp”ï¡û—ù§,¬.à6+šT@XÙ…_|4Ä·TÁP‚Pxo†ë2)Ât°eèj¨Ô
-ž·ùrÕÜ7m¾j¢	90ªUQÆîw·yê3™ÄE¼UMÙª?©Q˜0ÄÀNðcewm(B(—@)¸W ÕùⴾǷà/xæàœ¥¿åU"FŽ
—›¾Ô¬ÁEù¼øH)O#gú‘’øм(”¬ÄǺ.ªºhãàÁ_Ø:S0ÒD~¶O´êzº¤îϳÁö6	Fƒ©‡WÔ©»ÃT…Ùc±—mP6kÁÝë6_ø˜6,…iP€E62‘t¢àÂN=€un>ê4…äââ¾ÍqN!ú÷í0¼à=*ˆ7~ù`®1‡Ù˜Q ˆÝç0%Ùi
hW«˜fã[È2QqÊáaì6>ñÑe7·E~,uÛ.‡¯«rQ”7Þ^Çã4¬œ"è^®ã@ªnñ5»Á­Ðú•»Œ2×–à–ÍÿŽýªøL*ËüsÔ±DCnBâóMÑqþ’Ñé».„|ôSƒâ‹jÔ•!CRó(ç‚ø«²«¦ZnÚßVyVâ½=È|äÜ`5XšÄ; @`'¯AsU.£`ÑlÓ aâ^
-ôÕXû{§ª—$|#Þð‡ñƒ[A..¯±IÆÅÆy\lJn£’){«î+…/†•¢â·_XÁžrb¨­ð™ÖÜP0¬=•œíKWiX\˜Ë£M³6ò4Ýã.ÂIBý¯Õ¦iGÐàë:
-Åû&C &,¡þ8馩æEÖ¦§ý´½Mw¾.:Ú;?}s6Ìó<ž‘níó¹`^ä{I¿ÿ¥EãúÓÛõEt†_Nvçk¬‘> YžWUØú´Iz’aÚîÏÀVv|†¸ÚŽƒÇ/O‡¤ú¦`âõïy‰ºö×6A‘ÃŽd“¸üjúˆðÏ⦬¶ñ !g%ìÅYÈÌ4}l².eGG”Â
-«0•¸ØßÑm>õåuoïV”±W-ÌßÔ­+ç²gdÉ]Ýï|*^ÚûR£á\j¬°p@µîIßO¹#Ê0óe‡ºñ^ßãÓWšÓ	³p¨³ÂŒŸµ
µ•ôS÷×Ï?ÎÆs™W«ðñ8×ìܳNêâõ!µá“¡1ÑA—ÝS¸ƒS8XØ·äÛ&çadFðgÇËød!‰áV¸Ã¦P¶JÂ	ÖÁâzÚEÇ%tD@‡?æ&ý‘ŸöœøhNŒò1|4œž•sðá}|ˆ§›5©ê›ÐéûG¢Ä2ËYmJI%îHûëÈûvÉÙpoCL…Ë?v¢Þà?0D«Å#IN¤tºChg
ÁîöDü0DÛÁŸ¡§_~=Ã/8K¥òwXD}ÊE`ð« L2ýðE Sàu£¿QùiŒ^½AzÀyïÄÇ9KdêY€gwöÃWÜÀw¯	#Œj™èçÎJ¡¢ÁÏ4QÑHvµ:Bîéä(õ8-·‰ûû¦ÀTü,Ê8Áî4ìïŠ^ijHd_þlQÇøñ
-±Ì‹xÞ|¬©Ò¬f3ŸçáŒ.7·¸*z6
#˜ëöM±c¨q)IEùè+‰]ø¦}EýòL("ñ{änÌÑÉ£)ä©¿JÛþ2O"l/Ë#)È£Qá*×îYž~¾¶oú?f0eñendstream
+xÚÍZ[sÛ¶~÷¯Ð#=cáàN on¢ô¨“89ŽÛÉ´é-ÑO$RG¤ìøßw(J¢l'qçxìK±…?60ŠPaå µ’(ÊÔ`²<¡ƒÌýrÂÍ0
»T?_üëæK¬æzpuÓáe5†
®¦&¯þ}þájty:äŠ&šœ•¦ÉÏã‹×8bññêýÅ›ñ/¿]žŸ¦2¹¿¿ÀáËÑ›ÑåèâÕètÈ„TˆÀâ÷#$z3~;:ýëêדÑU+r÷XŒ
+'ïÿNþü‹¦pº_O(Ö¨Át(aÖòÁòD*A”"Ž,N>žü§eØ™õKû`RÂexÚƒ“}8)K´àÂ㔕S8ŽÉd‘Õ56—e¾¬ÊbºÙú”™$Çδ¨ÿ[esæº&¹ºzÛGù,_מ*ÝnÒÌAs¿Êw7s=•‘Ûâ.»m¬ô…+Âõ*_t¥†[(†Œ«ïœ®	$ÄÆm¶Øä5¶·ÂB§ºiò24—EÓäaå'ª–ØË¿fËÕ"2(Â<hrdZ7uä‹Oq]4÷§Œ±„´²¦Ä
+n¼¬x*-“À ÚøÆ$ŒN³&ÃVµÆçåkTX÷ï‡ê|ÒUènðÙDÆ——øÜž:³â66uQΰù¥¬îùt–a7WL²EWàU;/›Ì±sh7^ö.bîX½p¼‰¤ò3ìÝ…uËb6o°YÏ«»=®——ýI¶^ñ*ãueE^×Ù,¬ÈêŸö͘	F$¸“6’h+ždÈBS¢5W»†ü}«¢ J€ë(ð
+Íh»¬†í¡†:å$†·nB¥7ÁDJŒRv Sp{\⥌?ŽÉèõo`‡Zš¼ût:LEÊFa„Òä÷ÑÅèòœ´d{ˆJËH* ÚÙûÇÎãÜšýs"¼S#úâÒ.AYµ–Dh«=@‡ˆœjñ8Çv£Œ†4â‹yL_'’IéáØÕ°´´|UjDÜK@$~ÜÓ¾pd„&&…Ðûˆ¢HJ¤²q[`À@=€A‡ûÆ€KbYªÓ¸sE%FƒÛÂÞ´Xxz–Ά/Æú¦!Á3vW5¢}ˆã tØ?ÛóÿêàB‰ÖÀUšîæº9¯ `ÜBΫ ­•F‰‡s^¥Sg×Û|`ï³!ÂaÒàæÙm˜ÊÊ0µ›j¹©6Õr»y1™#é¤*ëÂgnÂ%NžN2=¼.*7ËkH}û¦Z,ª;—§8ªëûÎ"‘L«eVAÊl™“¾L÷*¦>Ùt±z/ÚÔùNþS7c.¤ñ‡#< o[f!ÝjªZUèí¥T‚ãùÚ\¸Ì›–{é^º'ÿuu›ïd~Û,/HS_ۣŴ°hæA¼»jïÜQð<›ÌwsòfŽ2Å\4íÚèº71ýX,Èå÷ÇÒœLrž“~‹Óˆ+öý\<ÔP°jeŽºA„sÿÒjÂ)Åøéyûê#y7¾j“Å}­†<7ʘ%‚¦ƒî˜¡ð.‘ÂýIyè$a/ç$»²ýØy²Ï)¶jCR*ÄcBæ̵¡¼q:d4MU@ƒ'-˜>ù„ØBÃÒÙðGc‡ýöØñüšÍRKÌwÄ)á\?;$è·"ÆŽ¢~ØGµn¨ãøò­7u·²Åp³LpâZÒï
+&ˆ6šò³c>.xæiq㤸	割i«Á!÷í{˜VÄ0@S(Â@Ëü6®ÆÒv½.êɦ®±ÞÐÙÑÅSï€óIµžÖ=¢;Ù¼& )»`©y2Íëɺ¸öaPŒg.1ܺf7^çëÛ|ÖÔM«n®(1Tad†ù,ÐeíÚ"C>6ÃØa½ÅÍâè¹Ok/øvWcèï©u„øèËWÌ_]’IÖ€vµ\ÄRwg^&0Ž>ÜïÝ„'>Zïf·È÷9£VbÓúðUUN‹ræäµ<ÃÈAwt
Të»Ù#¡q–»47¶àE,›|	ëªðŒ,Ëükà±@AfÞñ¹©Vèp~Éhò¡U!·ï©FòiÕw:tÇàÔðe”sJ|CÙu]-6MŽ½ež•X·šÏœ§8’Fò( Øók0]•‹@Ato¶qSpGüÖØôñ½eÕqn+ü~­@Ì«O_ƒ±qŒMÉ­1*½·j¿R¸¦·¾E¸Æb²÷‰~´Âg´¹]Bo{*^¶k]ÇmÑÑ—™ÆMHÓt'w\P™Æ¼k¹©›žÒJ­D¡ Ûdˆè„!TétO¥ëºšYûíé¼ë¶·îÎ…‹v_//Îßvý<*KH7>ës¾`RäN?í|iÑhzkÐÄËpæ”Bt¾ÁA¯	ñ’ÁMáy]ùЧÓÈ'
+¦Íá	ÜneÛÀ§×«â°yøòtŒª+
+:^×Ï×è¨×®nã	¿m½ó‡TÓi„{³²ÚêƒE—‹3ï™iüØdlô.–ö0ÙQ+BWbÃzK·þÔµWØç¥(Ã*Ÿ»`ÛC`{ôÆVî³lg«ž£^ßï}-óuð±ÆÂK‡%̽'*jŸô›[¢R–~Ûk]ÿªâëW<Ó)MR«Ž}Ì ‚HÊœö0_S«™TKÿò.÷Zp
+Z	ïDɧÐqß~RÙY¶‡±‚×ftåù±#:0Y*ø3)¶¨I	oØT©fC Dz&
‘`´±„ãP±¡Ì
+ððð'âÓÙùã#81FÉÇðšÈ£ðð.<Ä¥ ›©Ö³Àélû¼à<«Éq
+1‡ŠÇLB§b\‡Y|×î\1ÞxòU@v£Îî/X¨!6E؈q¢4K[Œö¬Ý ñã u¶.ž^ü'‚1T*WÎ"²Ñ'Ö \‰ôá’ v,©íý¹ÊOÇ~&‘XtÝßžU¨§þ`lû£9™BëüÈcç íyƒP¾ÂgÔ#þ²ìPô¿ÕßLsendstream
 endobj
-1138 0 obj <<
+1143 0 obj <<
 /Type /Page
-/Contents 1139 0 R
-/Resources 1137 0 R
+/Contents 1144 0 R
+/Resources 1142 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1136 0 R
+/Parent 1134 0 R
 >> endobj
-1140 0 obj <<
-/D [1138 0 R /XYZ 56.6929 794.5015 null]
+1145 0 obj <<
+/D [1143 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1141 0 obj <<
-/D [1138 0 R /XYZ 56.6929 726.9349 null]
+1146 0 obj <<
+/D [1143 0 R /XYZ 85.0394 697.047 null]
 >> endobj
-1142 0 obj <<
-/D [1138 0 R /XYZ 56.6929 714.9798 null]
+1147 0 obj <<
+/D [1143 0 R /XYZ 85.0394 685.0919 null]
 >> endobj
-1143 0 obj <<
-/D [1138 0 R /XYZ 56.6929 546.8104 null]
+1148 0 obj <<
+/D [1143 0 R /XYZ 85.0394 516.9225 null]
 >> endobj
-1144 0 obj <<
-/D [1138 0 R /XYZ 56.6929 534.8553 null]
+1149 0 obj <<
+/D [1143 0 R /XYZ 85.0394 504.9673 null]
 >> endobj
 482 0 obj <<
-/D [1138 0 R /XYZ 56.6929 435.1867 null]
+/D [1143 0 R /XYZ 85.0394 405.2988 null]
 >> endobj
-1145 0 obj <<
-/D [1138 0 R /XYZ 56.6929 410.8471 null]
+1150 0 obj <<
+/D [1143 0 R /XYZ 85.0394 380.9592 null]
 >> endobj
-1146 0 obj <<
-/D [1138 0 R /XYZ 56.6929 210.9925 null]
+1151 0 obj <<
+/D [1143 0 R /XYZ 85.0394 181.1046 null]
 >> endobj
-1147 0 obj <<
-/D [1138 0 R /XYZ 56.6929 199.0374 null]
+1152 0 obj <<
+/D [1143 0 R /XYZ 85.0394 169.1494 null]
 >> endobj
-1137 0 obj <<
+1142 0 obj <<
 /Font << /F62 638 0 R /F43 604 0 R /F57 628 0 R /F42 601 0 R /F56 622 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1150 0 obj <<
-/Length 2704      
+1155 0 obj <<
+/Length 2777      
 /Filter /FlateDecode
 >>
 stream
-xÚÍY_sÛ6÷§ÐÃ=P3!
-	ö-íœ:­SÔ¹›æò@‹°ÅŠTD*NúéoP¤LÅé%7½ñŒ	-`±~ˆ‡?1ÓŠq™Å³4‹™âBÍÖÛ>{€¾×Âñ„ž)rý´ºøá:‰fË’(™­î²4ãZ‹Ùªx¼úûË7««å<Œ6UƒŸ7—DÉèóêöæzñú·åËy«Åí
‘—W×WË«›WWóPÈXE @:¿ßÞ\Óõâ—«ùûÕÏW«~ÉÃm	.q½.Þ½ç³v÷óg2Ójö?8YͶ±’LÅRzJuñöâ½ÀA¯:¥&%5S:J'ôG3!X¦T4R”ÊX"#i…[“°OÎyðÖt]Y?ÐþV«_ZÜH‘móYÅ,‹El‡¯6Ù“ +·&ìš°*?:Jsß4è<ËrIßs™ª eK\9ý”QxWv®«î̃ÙÓý\èÀìèÓèòjp¨Ë®Îœ­Y7uѾÀ_:ÈëÑ”I°Û—Û|_VŸ€D†q‹½Ö`‹wØŸH·‚¶©>š}K¤Ç©©›tlë|m7Íå²³‘±vjh•…i×ûòÎ8I›æ‘UcZ¹â庩îÌ`¢ÂÓîZý¶*„o»iUÏ3Þ9JQ¶ëÜ-L«Ü*j{“è64‡ëí>ïìò¡Içn{ÐÈûÕÀõaO?뎔ÍIÙ¶EçÇÉxðGS»Qh&•a§>&˜ŸJãY’)–ˆT}—ÉL²”§'^ößòEÆ)ÓOϯ€Æqåš~ÄXTØo*L€#Í}ôá¡÷‰H0)¥š%:eQ¬3{†oo_ÎCŸ\Tyk½H½M:eÇÞ'%
E
-9…ô=qP›‡¼sÎLÆæìÀ1#¦ÕÆOëì!7UK}hÒhp‰"k9•3s¥‚fÜS³5{ç[àeUÙ{4ë&lëMX4Ûœö¢`ƒŠßüëòö×—‹h¢:oÝ5ukÚ)ÿ§ÕnÉØ>76åü½+lóOåöà¸1ØyÙSc¨.>Twªå¤¸ä¾õ&®¸Ü࢟˜¹âšE	$º¡A|›‘¡9KÈÁ%˾˜Ÿžˆô#ÎÛ-ph¨çìVf,Ž4)÷o6\ÀOIz–‘v4¥™èפVìÌ;úvÄ
¹¥Ù%x9G°Eq„ºQáÃX9¾@öƒÔ˜´u³ž7ãÂÜ燪;	~½Q0gð–‹<–@7ŠyíάK\æúDPkº/Æ@ãßvŠ§†OÃP˜AšˆçC(¦DJÍ+Ëb0JS\GA3RÔ)—¡±É­ÛA+§é·ô¥ )‡¨}Œð£¬O8—K„
Ä¡Mégv!	ç>F»óÆA9¶áƒ?;>vÜíÅŸ^}£ü‚µû½Œàˆ5ÿŠ´*2Át
-èÎñtzŸ€_Ɉu€_•F,β3v汯R‘“„ÀëKÎF
-€ÆqaOoé)¥C]I/Õ„ûà[Zç§ÚÚZŽ4ЉÑÒwo°¢ø8‡úâDf?¶*[z€vã6ÿPÖOÂ^œ¥,‘‰œ
ÝéÛ<cÊ’ìÏ„½/Ç¡ÓÇ,ÑqòÌ’€ÔÛÇÂP¹Âðöx¿ñ{‘]V®uYîé:ïÜËR ÜUƒ›W­¡¾Uï©íD„@´µ'
-ÔG‹¨4yÙ•²c)€x±¶çd{ièòú—ŠZô6¤µgÀÔîZóáàŸ, ëÎØÇh™O€ùé¹kÐnpU6Ùã°~#mô[°w<­©îÇ÷Åë*o[_Vf‡sÖþæ.Çù}ú¦2=ýöÐ:awfüŠÓ¯»Íý=·]Ëñ†\C
/S»Éiá—ÃËÛ~UëêP˜þÊax%˜:ÞbMDÓ‘`4 Áß‹	Qn´^ÐâæÕ/¿]^MUÜZðQé«.&D‚OH@†^¦}ý°!4J ·e¡H‚wOúèL8èz89r„çýàíçºË?ý8±.‰7¦Éd
-JÓ'JKF—¡­•žNžJ‹cï&¤æÂG7b¤·E›œ8)ÀD±ô‚ÞŸ{)‡=Ä’¢â)Râ3ïKßüŒ~pqʤÖÑô%a™èWe3{eýƒûÄâÿu¡à7endstream
+xÚÍZKsÛ8¾ûWð°ª*Bð Hpn™ØÎj*±³Š¦vj29Ð"l±–"‘Š“ýõÛ@$QNf“­ÙJU5€Ðϯ³ˆÂ?É”¤9Ï£,Oˆ¤LFËõ ïÕsc¦~Ð4õóââùuÊ£œä)O£Å}ÀKª‹åû8%‚L€¿½¹šL¹¤ñõì5´˜H$_þýÅÛÅÕ;R7ôçÙÍ%Rrü¼¼½¹ž½úuþb’%ñbv{ƒäùÕõÕüêæåÕäÃâ—‹«Å°åðXŒ
+³ßï?Ш„ÓýrA‰È•Œá%,Ïy´¾H¤ 2ÂSê‹wÿ½vꨘ%\€HN唈19Éœ¤‚+§7EUá8K]WŸôö‹ùÅâǪvô;ߢïõzÓëö­9üók™K0ÉàÜi3Ì×ÀœèÏÅzSk²l×8ã`SyF”¤©›P4åלÐ,
xò¯0ÑÅwSþ ’V;EãØn'LÁ¡·ÐËžšòËGS‘1¢R"eŒäRr˧ºGõ7ºêWz‹?ZGìWm§±Ùí–K­Ëgø+«6*¶4'R°<Û]±ü×nCÚíØÔ8a2‘n¼Óp¿s;tEÜd
¹¦ JpÕ­s+pLÚäàLÐlÚ)„ØÕ´l!R6H31þæ·ËÛ7/f7&¢#Õ9ê¦m:Ýyô=îvvö¥Ý‘1ϼ`]|®Ö;7ÚÄ9ï[Ÿö⢡¸¨-~À··nIÅÊlúÄ“tÎrÖð}öe,YPÆ°~
+£œ°ô3Ι¬ÌÒÁÎÚ¬„/€Ì³Q"áJ Œ$a¤	žA@Bý-Q¤¦³èñÛãhH)í)&îX‚çƒáô0|`·v"˜ íê,Ú¹UÏ›p©ï‹]ÝżÁ ô>óÏØ|ðÐîúƒP×mô²2Û\1êtÞ(ByŸ
+­"ù‘V!ù`hç­"U`9º›—”ÅSže"¾W2Mb'—.	BcUXƒVžùÝᣗ`{áGÕœÏ-$„´ªüÊË0Ì·Ìãpåè>ÊÑ0ÊQw1|Jõê)dû£,`_iü¹”值3 w@ý‡%ÏIéÃ30åÑTrI NO—>’fP 9¼û¨SäCGÎÈ
„7$4=CŸ°}Üjq„™†„óY2ˆÚÝÃêh0C]›Ywn)ýySWËÊâ!Cb­ °AML—«zž”Gy­«ŒxN”Ê|¡q¦:pcNŠƒÄ³Æ˜®3Ï7Åf³OrÎŽgo?%_¯æÚñ9¤ÎÂdS¡ò=ºÞõUÛ`¯	ÛýÊFQ¡ŒÁ_·EÓÕ…=û|nfÍÞ"µ(KǴëDè0‹ºˆŸcŠ¶Ã!mÃÖJ¤Ðo¨k
k!	Ž>ŠªHÏ«¢j¦vý,‰I±Ý#r"ŸåÒ—«Ö•a¥"T¿]̱áR¢+_MU‘q_A@ªlº‚I89uyÍŽ¶`»Öò!t¬‹Rrª5 ISÓ­[@”¶Dö{>J]õÐ`+“áß×ÙfuTÁäq±¢Äµ¾·c…U‹¡l«‡D½iB3.Š_N
ëͦíª^#y¿íô¼Üh¨ÐŠ/H1Va¾UhÇz_«@ÿ®Ûµ­RÌìmÕOÇd¯b!ìtgìRPLëÆd,4ìrÌûH¶ÑÞ™'?6OîìËt0‘„›¢Ü2pt¸œ—+=ì±n‰þh,úDñÜYý°ÐÈ‘¬iîqÈñtS
+>à}å9AÉ<”—@u»ó¥¼Bã5¿½kïlc©±ûФq䣿NJÑHª5\¸DnkPåýóÎj±ö‰†)¨±(J¬ÖcHñ‚µ©Ý<4Ž<‰öŽ(÷f
»d¿Þªp#×û2ÝŽG«€=ø‘æ<Æ´D_[<f»1pÏ1‹ôÈá}pKöÁ]FYŸÿé\%-L%çâ/¬¤ýI¾Ñøç¨ÐJ’})}8‰¹D,mË’ÛùìÕìf2•LÐøІ>È€M°Ö÷mß2õ?‘dáTØ{R"\žI‰!a2UÈÂjQtÓ¸oÛð2–œ—L°æ’ÌÿTjdž=
U9#YNÍh@àÀû·<0ÐE.“³Þ¢Q©ú3ææg	uxka# t馎2–F<·È8¼	0LÁúí<‘ s‡inÁZUÃÿ<>y5ž4ãT*S«ÐècÄML,²ƒ‚¶=ë^–ð|¶fÑe'Š‚CyÆÓ³=”JBƒWFegPO‹Dw>öT*Äv D€‹þT>Nà¸e’„Ï5d«fmCOÀ­ÐÜbëºîMbo¶í„ÉøS…ÙÝLŠÓûÖžena›)Uéjk[{0€ÙœgØ2,W:zÙâ·i{×ÐK@+—¦°§ÊO‡R@š€ÜiÊü^Lç²<…í]W}žÉ$(ž*B?ŽqhˆT¡táíþ^ã÷áÒþºª]ë²ÚâÞ¹W$E¥2¸jU
+êJõÛŽ@WBk«Q >Z$¥ŒÊ«¾òPÝ”'6VO¶§Î¯_"Q!±…ï@J9PƒºÝ]§?îüótÝiû°-ý°>>˜ÚóŸ+³«§ð×p„iG°w;®ï/ˆ—uÑu¾œ.õƬÙøëBÿÐwŠ=OßOÆ—_ïºþð±pÿ‚éß/±m÷2\‰séŒßǘ_†7¶Ã®–õ®ÔÃUCðì	™Pe)‹¦6b¢)gþ¹óÙ+HÀŠ	Ïhvóòõ¯—Wc•68QÆ÷œP^þÕù€%à5°çiŸ;Î<÷{÷4ö8O£¯¢·oýS€½»&Jññ«.w%Æý¦Ìæ3z²sÿ7§[ÿà°Mendstream
 endobj
-1149 0 obj <<
+1154 0 obj <<
 /Type /Page
-/Contents 1150 0 R
-/Resources 1148 0 R
+/Contents 1155 0 R
+/Resources 1153 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1136 0 R
+/Parent 1134 0 R
 >> endobj
-1151 0 obj <<
-/D [1149 0 R /XYZ 85.0394 794.5015 null]
+1156 0 obj <<
+/D [1154 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 486 0 obj <<
-/D [1149 0 R /XYZ 85.0394 769.5949 null]
+/D [1154 0 R /XYZ 56.6929 729.6823 null]
 >> endobj
-1152 0 obj <<
-/D [1149 0 R /XYZ 85.0394 749.4437 null]
+1157 0 obj <<
+/D [1154 0 R /XYZ 56.6929 702.3779 null]
 >> endobj
-1153 0 obj <<
-/D [1149 0 R /XYZ 85.0394 707.9711 null]
+1158 0 obj <<
+/D [1154 0 R /XYZ 56.6929 660.9053 null]
 >> endobj
-1154 0 obj <<
-/D [1149 0 R /XYZ 85.0394 696.016 null]
+1159 0 obj <<
+/D [1154 0 R /XYZ 56.6929 648.9502 null]
 >> endobj
 490 0 obj <<
-/D [1149 0 R /XYZ 85.0394 527.3014 null]
+/D [1154 0 R /XYZ 56.6929 480.2356 null]
 >> endobj
-1155 0 obj <<
-/D [1149 0 R /XYZ 85.0394 497.312 null]
+1160 0 obj <<
+/D [1154 0 R /XYZ 56.6929 450.2461 null]
 >> endobj
-1156 0 obj <<
-/D [1149 0 R /XYZ 85.0394 408.0188 null]
+1161 0 obj <<
+/D [1154 0 R /XYZ 56.6929 360.9529 null]
 >> endobj
-1157 0 obj <<
-/D [1149 0 R /XYZ 85.0394 396.0636 null]
+1162 0 obj <<
+/D [1154 0 R /XYZ 56.6929 348.9978 null]
 >> endobj
 494 0 obj <<
-/D [1149 0 R /XYZ 85.0394 202.1472 null]
->> endobj
-1158 0 obj <<
-/D [1149 0 R /XYZ 85.0394 177.8748 null]
->> endobj
-498 0 obj <<
-/D [1149 0 R /XYZ 85.0394 109.157 null]
+/D [1154 0 R /XYZ 56.6929 144.8272 null]
 >> endobj
-1159 0 obj <<
-/D [1149 0 R /XYZ 85.0394 83.1291 null]
+1163 0 obj <<
+/D [1154 0 R /XYZ 56.6929 118.1807 null]
 >> endobj
-1148 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F56 622 0 R /F84 802 0 R /F86 982 0 R /F77 707 0 R >>
+1153 0 obj <<
+/Font << /F62 638 0 R /F43 604 0 R /F57 628 0 R /F42 601 0 R /F56 622 0 R /F84 802 0 R /F86 986 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1162 0 obj <<
-/Length 2290      
+1166 0 obj <<
+/Length 2294      
 /Filter /FlateDecode
 >>
 stream
-xÚµYÝoÛ8Ï_á‡<ÈÀš¿ô±XàMÜž‰Ós¼ÛÅuû Øt,À¶Knšýëo†CÊR¬¦)z‹å˜
g†3?Î0¼Â?ÞÓ‹R‘öâT1rÝ›oÎÂÞ=¬½;ãŽgà™M®_ggoÞF¢—²4Qo¶lÈJX˜$¼7[|"&Y$„Áo&£þ@è0x;¾ŠK¥EpñïáûÙhJ‘cýu<¹¤™”†‹›ÉÛñ»ß§Ã~¬‚ÙøfBÓÓÑÛÑt4¹õ?Í~;Íj•›fñP¢¾g?…½X÷ÛYÈdšèÞ#üOSÑÛœ)-™VRú™õÙíÙjUûi§›xÈ„—œúIuúI§,’BZ?ßLÇïÆ4Øeƒ]ÅL
-ÃÈWšªDãyP­‹b“å[¤E°Í6Æ/gQùzMÔ!®l·3Û…Y8΂ÆlûDÄaûpÈÖù_a(ˆGû>O3/ì¸(áœ$—Á‡•qûfôåßÅÖmŸ;-QȾ¬Ð®ÞÀ›2àœ¥Zk‰Îp#®kŒ`-¸é’ÆÌ.Ë ßìÖù<¯œ¿šîå\3'©sX˱œ7‚;¾_ˆCÇ
Ž˜Å*ñžGÛÖ¿§¢ : ê¥ãüW‡V-Q¬ã˜5S:õÊÌVÎîùaOnØv™ªKâZê!d-ulµ+A€þ.j¿“‡]TÙs“ðH·®Ü™y#HB:;QÆ©²QÊxœFßV‚„¯mfÍ¿?lдËÒþwIã¶pÙ]Y¬•a'
-DL¥<
-P*Òª¥Í 
-ÃÀ|É º›+4iÙýáÃÿ8/&ÃkD²èëáx2¸Mÿ0;5*lïçu6‡üs¶®mƒS8Õ¹þVûíÙèÏáõû«»¸¹f¤´S%jkÒf<=“Ï–éHÔX­™ƒÐ8ŠAPê|<¹¸úýÒ÷e¾7ó*ÿlº­šq¦Ý>m«ìËÏûJÍ4”¿eŒ›¶k
†KË\Ug`;}˜9÷ø±C”†X;†bŸßSt?“š%èibûD6w‰ƒhÚ§„Ê昢­hæ,Q’×òl>	ÉY¨DÜŠ) Lå,;ýÅÜ”%­Pzy·6ÑÂ!TµRÉ«\Æ“=2·ƒM/ØÚ¦ü~<â0®nçëòl-ltèe—³Ê/æNø®€Oðò£`¼ì@¨„üæ1…à@™6!
Ä7‰.œP±D§ÏnœÊGv­lF.÷¸ö˜W«Î‹NQÖHõZDƒ¼Nv—™›(8˜Ÿˆ.ð|ÌKsÄTK¼|#ðN?Vß«“7þ63‡ùqÕLø(	TâOÆÒ®ÊGJ[JÚ•ºFÚÕ(@Ïg³w\Ö#G9	9¤$™0ùD³«Ìí·ÛçP‘œ|Ú7gqüm¼içàR>®ŠíÜ´ÄBDÁý‘@ØŽ¨f ­2çÌ;cÜ…èKöµ:Uó”)®õ«
-U.XšÂytªÁ©dBDé×eÑw!Èr¤ÿ¢-êX÷+!TDÇzVöjóáfPpñÙœKšA§#Åmt†LCè¼{×fð¿N*xÆ€J'L¤2Á­{=ÄÍ4•ÄÔ ­­G؉7ã
ï]`Q¯a”j_'5Mj4¾”Ò@`átܳqU¼¼šVÇÐŽ\`ß¾®³Òâ¾}2Ë}y1úR™m	xò3¾Á4
-Ãów£Éh:D—ÎFÿ\F´v9
æê÷Pú+¾q6ëUÙUo	–„âµÉÑa¿{äxì@è“iM¯°èðòrʆÓ÷èÌ¡—ç7`/½ru¼ÈA³å„`
¹ÃΧ9w‚3÷ÆÂ	 arK#=Ž×¯cmQ¼[1‘ç'/nç,|éÍOÿÀ›ypê‚.£øWŒ/Èa]‚Ä‹‚øK‚ž!¾ož¹\¼R¨xPÒ”±nDüZçWöëjçáÊÄ¿uü‘(¬‹þ“T£˜Ž™LÑìÎ÷Yœ0¨ˆ¤W
-ÃÍýß®NUÿË9Ë(6°%Ç’›æ>ý
9¤,Åjš^¯‹å˜
g†3?Î0l@ᤊP¡å Ñ’(ÊÔ`¾>¢ƒ;X{{Ä<Ï(0Ú\¿ÎŽÞœÇ| ‰Žy<˜-[²RBÓ”
f‹Ñé?OÞÍÆ×ÃW4ŠÉp¤bý:™žáŒÆáôjz>yûÇõÉ0‘Ñlr5Åéëñùøz<=GLHÅA€ð"þ}5#Óùäb<ü8ûíh}øH°î·#J„NÕà~P´æƒõ‘T‚()D˜YÝýÞl­ºOûܤDJTÊ“?É^?)MbÁ…ó“µL†RJ£Ù½A㎯®'o'ÞgùÖÌëü“±æ‚PÑJÀBD‚^¿y*êìóÏž¯½¹PD±X¿åâ_’´ø¤$)g±ç[”ë,/FE¶îÛ;N	—’yÞ=Ò,Qža^®×¦¨{IFR)‚ =ê˜$‘ÖÉvåŠÚÑ™ÁeâEV¦®¬/YT£‡™7ÍÒ÷ZZ!Ûʹj0
+¦Œ#ZyËQtf7b2r†ÀÖá‚Ÿ®pÌܲˆòõf•ÏóºÇÁŒÙ(Ju_€0ÖvlJðpV¿ ‡jz•Ï[ÛZñÓ¹˜!<ç?z´êˆ"=ǬˆT:(ƒÙöÎw[tCÑgªâ$M©/„³Ô³5®ÜõwÙø=ì£Ê› €Åª{pÕÆÌ[ABñì`´2•5a‰Ž¿®,	ãAÛÌ™·sù†»,ý~W8¥ŸÈn«rµ«
é9Q0 &R³´?ûF1@—ùœAtYîDXdjÛýþý{r§Ó“K‹ì)З'“éèf|ý'\½àÖÞ/èlvù§lÕاp¨ó³oa{2þ×É廋19½º$¨´W%îjÒe<<-$¡àtáüÂ'ÓÓ‹?ÎÆ?ÃüCØUpÓÀ
ã—9¸ªÁ\kŒ‰×"x¹Íï0ºŸÉÍÒX©ÀÉ}â š¹Jþ—|$¡WÀ5‚ Hå‘DýåÜT®`zaónez¢…A¨*)ÓW¹Œ¥
zd~—^°µK/øý¸Ça»ZÌW;
ËS8ØèÑË-guX̽ðM	ŸØ˃ÆÑdÙ€TߨS0~6ùIB¸ Ï€1A¦ádá*CHÝQÒ­45
+оF
+y>™­çrÙËIÑ!Ê„É'œ½Ïü~›mÉÁ§=x3’4ÉßÅ›nNÞHâª,æ¦#"
+îÊënDµé>óμ5Æ_ˆ¡Ä!_ªòebQŠÕ×”ùŒ­•ì/ó¡¾ä<Ö_–…ßQåÉðEWÔ¾k)T„­éÄ 1 ’„A·$cËÆ°hŠ¡¶¶ÑI‰‚Ð{÷
+®+Íàô? S2PÍYkgÍàa`qSkL-ÚÙº÷›x3Y³ÁY	
ZFÁ£¶dgT*Û‰ÄBm"I™"µ‡èóÓ!T±:‚–L•ÒæT¸„錔A›.ì¬X¦"L;QÝ—»Õ9m…n綦ªË­ñ³Ù²v™GÃ4n‡·à$Vû¬‡û?n~¡­­àïØ¥Ü¡á®’RE·C¸`u—±»ì¤Å;V9Ö.–.äy¼7®xw“è ö.€
,;¢üt¶ªJ¿¿O¼ œ·+Œà&[	å»r‘(Û•hÄýz…“·€©H•KA½µÿvæ.);9G5Ü&LUç¶3”yö‡…
+@ð<õÕŒunÝÓ4ZnË5R.˜,aƒé'$3Ïde™¬ÞmÍöô‹ë`´v@‰Ô	ôâ±´“õûòßfˆ‚Œöo߇N]H‘qÌ_~`RA¢Ûâ :Í.~XejeÖ~î©Cº-Ì2Û­êQ]¯þ槈±DÁÅFE÷–¾q%†U^Gü1*Háµ	¿4J¤/¬óõUŒ‡áÄÒEÕ¾¯vMŸ?
à¤+™µƒÓÂcáª)»ßì¾Hˆð?íÖÙ*o­XŠù®Ï«b“5Ó“ZÛ¬¸ó¡@m}¶€ðÇ™
++ì{EoïÓi›£îxš=«“Ú&µ_Ìh lá´ß³uUŽ‚¼´Ô4MuÙ±ëýËâeV9ØwO„y(/ÆŸkST'?Û7˜Vaxüv<_ŸX—Îþï­ZS:u69ŒåÊw*Bú´Žfu_õ•[œ¤”¿67úŒ%Dž~kǶʪ>¸&Ðéî^·%•Ó sý´ñn{
”pÜþËâ ÎS?ëÃëÂ'‰ŠE;¾¹r}R®®æq4÷5lmp>á2ÛÜø\žÂˆœU¹s„« AÀ!LXéØúØ‹ÕRè@eéB~/±![£“ÍïýXeXòÖê^aÌ!o2¸øí[|_ê‚Õ ùª«$aqSÍíf"Ž±Fˆï3;c}fG“A}ô„ô)¬Nž×%­Æç\K¹’–üdqòa—#ÑÙ'DÞlJÛC9‰»[$ÞpÙþº¬Ê—RÁN)µ0+s—Ù:¥Á¸j¾Ío_À8–x:µÉ´ÂG
+Xòóäììšœ\¿³Î<	òÂäë\9èõ¡˜à¤%÷¤÷eΟàÌ?„±÷p˜ÞàˆocÇÍãØ«DAC€äñÁƒÛ1¡?öÉÏ: Ï=V±­úAü‚0ZØK‚Z®A¾/__'×ý#UÏ_§hs~÷ßÂöe¨}ISÞnlÛL½u”²†'ì¹æÍÍUÿ/Ø
ìendstream
 endobj
-1161 0 obj <<
+1165 0 obj <<
 /Type /Page
-/Contents 1162 0 R
-/Resources 1160 0 R
+/Contents 1166 0 R
+/Resources 1164 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1136 0 R
+/Parent 1134 0 R
 >> endobj
-1163 0 obj <<
-/D [1161 0 R /XYZ 56.6929 794.5015 null]
+1167 0 obj <<
+/D [1165 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+498 0 obj <<
+/D [1165 0 R /XYZ 85.0394 769.5949 null]
+>> endobj
+1168 0 obj <<
+/D [1165 0 R /XYZ 85.0394 751.3508 null]
 >> endobj
 502 0 obj <<
-/D [1161 0 R /XYZ 56.6929 653.8847 null]
+/D [1165 0 R /XYZ 85.0394 609.4345 null]
 >> endobj
-1167 0 obj <<
-/D [1161 0 R /XYZ 56.6929 627.8019 null]
+1172 0 obj <<
+/D [1165 0 R /XYZ 85.0394 583.1171 null]
 >> endobj
 506 0 obj <<
-/D [1161 0 R /XYZ 56.6929 405.3123 null]
+/D [1165 0 R /XYZ 85.0394 359.6137 null]
 >> endobj
-1168 0 obj <<
-/D [1161 0 R /XYZ 56.6929 382.8411 null]
+1173 0 obj <<
+/D [1165 0 R /XYZ 85.0394 336.9079 null]
 >> endobj
 510 0 obj <<
-/D [1161 0 R /XYZ 56.6929 301.1931 null]
+/D [1165 0 R /XYZ 85.0394 254.4059 null]
 >> endobj
-1169 0 obj <<
-/D [1161 0 R /XYZ 56.6929 273.8371 null]
+1174 0 obj <<
+/D [1165 0 R /XYZ 85.0394 226.8153 null]
 >> endobj
-1160 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F11 1166 0 R /F57 628 0 R /F77 707 0 R /F84 802 0 R /F86 982 0 R >>
+1164 0 obj <<
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F77 707 0 R /F11 1171 0 R /F57 628 0 R /F84 802 0 R /F86 986 0 R >>
 /XObject << /Im1 795 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1172 0 obj <<
-/Length 2368      
+1177 0 obj <<
+/Length 2424      
 /Filter /FlateDecode
 >>
 stream
-xÚåY_sÛ8ϧðC”[Ë¿¢toÙ®ÓËN7ÝK½3;×íƒlɱædÉ'ÉMÓOAʲ£8Ýkwîá’Ò‚À @ò	ƒ>‰uÈd¢&&Q¡f\OVÛ6¹‡oo.¸£™y¢ÙêÇÅÅב˜$a‰h²XxÅ!‹c>Yd‚׿úu1¿»œ	Í‚(¼œéˆ?ÞÜþD#	5¯ßÝ^ß¼ùíîêÒ¨`qóî–†ïæ×ó»ùíëùåŒK¥0ŽÅ?ßÝΉèúæíüòãâç‹ù¢y¸-Î$Êûï‹Ù$ƒÝý|ÁB™Äzò?XÈ“DL¶JËP+)ýHyñþâ=ÃÁW;uLMJÈ0ZNfR…q<¾bY™ÈÐ0s²ì7ËKÂ@
hý¼4/×õ3ŽYÍ8Wa¢
¶g¢(Æ炇RJ=1š‡"’ÆZ¿I«ûÔr@m©ÆEj±)Z°e«´¢Î2§¶®lÇõšº‡š:ëºÙ¶»]GAÛ¥M7k»zçf5ÔÆh»|Б‘n<«[äÆDÓv('êŽsNXÑp J’ÀŠí¾Í³)0â ¸	.”ïŽÉÚ¼£NWSËau¥£àª,iÀî)QHÇÑm8¦Uæ?{ÖÛ}ëx.ócYÉÕvu[tŧ<<õÍb0	øêЄß '	"J#ÔŸàÙOykZƒ§'J½„5®q2U¹i¿i’³ ËÛUS,ó¶7%×UÞÐX•nýàú„ª¹äq·õÞvV9}¦ÑUmÛÌ-„öÇvéˆVD•vyŽ!îªzĸ†/ªûÒ;ÏpûTljÛÒ«±M‡:Òžà¦YV—eÚx¾÷ŒqÄ>ÚÇí².[úôPt›¢¢¸×§ks1.bÆñ×9BÅ¡K4m‘åÄ>¥­êïÊt•gôyùhõ1Îóct“îÁ}‹.oÒ]}JË= ~©$X\&"¨iüý;)5¯ÜäŠÚž[½ïv{ë~0÷±ÞÓh•£P–Ðñ¸¤»ü0ù©jNì8ftC¦œ^öh``(+#4Ëtõ¯¶LÛ
Måj8•ƒFÂÍ­F˜Ðc.n4’‡÷á3…†‹ø„™8e¦Î@ìh5<“•ïÓ‹0aÂØ9^GjÙ¦¤z×u•–¥ûmÚ5`¹~°öÐ`L€Á°­³£{Þ´¤‡M±Ú`¼vc';LpP6(,×6zãïµ…i½¥)=YAHWPÕFÚC$/3·L‘uêb 	ÖË´EØJ)‚_†B
-m~?Šª#²½óƒ›†‰ÛrCß[f=”’ƒèPæëÎ1nÀ]pÀµ·Û<+ T•nAÒýÌ«<‚l’#•;P›g¼R#m¤8Å<6Óv,‰P¿ó8RÂ:×/áû`ôSk¹S4ÏÇ#œñOûØvÿUž!‚ëKn“)À®ŸÓí®Ì§#REI(5Óßmc3Á¦ršEX	2‰3Û82¹
Eg‡ï#«·ûeØél—‚¹$­wu	W¬ö
A¼êhÀFqp$Ž´kòíьظûÒMHAJŸ³|UlÓ’ÆèKÈ;NýîKN"Ívi–Y‚³¨÷]q—i2ïÃØÅ¢C*\áó)-ÊtYæŽÚžDfSRêŽ:>”ŽY‡‹’¶RQþ`ÍF,AUeøÁoù”,"æU<>¶H½êpI©ù³Kš0îÃn=² µL†;›šbgPî÷vf¡8AFÞç?‚M™Èƒ
eÔçcÃ<ßDzЂL¼ó¬­»LûÝŽL¾—ÆM`²À…=¬,A–¯S‹+ü†nZ…2ŠO´ê5Ç
-sý‘Á‰õÍ>ì	Ø”{0‡—ó—‘:"éö‘±~.8›Ê·è|rgÂHÇ^:›Nƒ*ªº#Æé²­Ë}‡Î¬¸?1`èòcÖ…”QÈ>¤¿»»yss;¶§Vï#$`‚ #Š]=ËWäãšòpÛÚLïG3ðkŠÔ:XÕÛ]ÚË¢,:›„(›!ÓÇÚ†@l‹*+ÀÎ÷º1ù ®bi©|é¾DƒæxÄäY+¹ÐÂÃFºùv̦LÃo˜ãøS˜Knüµ»›- Ü¦Ög8蘉à^Ž@»,¼vmçZ7>pœÿ/Üñ½p+d˜œ½LÂÒÏx·ƒŒCòpÉa	²Í»—¯”¯:ÂØζÒ}B_êÊ^,ÀP)bݸ˜l,ÿ–¾ôY<Žÿº¸›ÒðëÛ«_æSý©ïÇÁÕtôBþÜá[9ÃÞ¾?c¹J¾M̓;Z'Ο8¨ÝŒç-§¥IÌK‡ªÒ"„ôOÓk$”³ˆÅÌöžš²—t:Hƒ)KVoSÙkÕ›'ƒ×«¼m½µÅ*¶†î0‰ ¤·g¬0ØÞ·©ì`…ÃÓÑÿâQsÃ؉ÙrÇ´5ÿ†õä-K²(Œ¤¤˜Å‡šÞüŽ7÷Ц Õ&6î–=þõ)þ›ùíüÎÔ‹ùX±+CƤ¯^²Â!ø¾qlpÓbþ¹Ë+ÌÆOœÎfS"iãzõú$j!áÉÈëݬ/ô¥é’ t}¬ôSJ'³U¨­À;L˜HA:8È{üæí‰ .ðœ¦ÝîÞ“~-oOöñúíÕû÷‘ò2{Šcoˆéøh9òZÉ&/…¯}=¼+ƒ/b*=¤œP¨%ßx ¸ÅÂŒˆþN:SFendstream
+xÚÝYKsÛ8¾ûWè]%að$ȹi9ë©Œ“µµUS›É)‹µ©%©8ίŸ (‰–=ëlmÕÚ@`£Ñè¾؈Â?©„1G:–DQ¦FËÍÝ÷÷ÌÑL<ѤOõËü⧫b‡<ÍW=^¡QÄFóôsA.
þùñfv9áŠW× Ç„TTØYUõ¦ùùr"d4mR·“¦­¶nVí~ü§¦Í¶`YŠàÚ³Z»Eþ ”×M;ä$f ŠãÀŠí®ÉÒ10bÌ00âÆf¡l{HÖd-vÚ
+[«KÓ¢À»#Ci„tÝ€cR¦þ³g½Ù5Žç";”“̶jò6ÿš8¥Ô yëQ߀¯ó	ã}ÒHj"4—g7å)GS4"Lƒ	Î9Z\˜ŽíÖ‹uóB/ŒiÖ,ë|‘5q¼z(³ÇÊdãWGTõ%‹‚¬©v¶³Ìð3Ž.+Û¦n!c{Ó.Ñ©’6KSÒ´|4)Œž—÷…œƒÓÔE±ÛÒ›¡MªÈüAM«¢HjÏ÷¾„1füžÍãfQ
~zÈÛu^â³×Óµ™$©ç=¬sBÞãÊÑ4yš!û·Žü±¿-’e–âçÅ£ÕÇ„385ytèبzˆÜ¼Íê¤5Ñm~}MŠ]f²µŒƒùẽ
+ÇïMè™N‚Í7¹Ä¶ãVíÚíÎFÌ}¬v8ZfF&Kèø·$Ûl?ùT3Gf2KD`ã©egìyle„f‘,ÿÕI³Æ©Lö§2Áлq9Àü8aég<é· %àÌ?ë·<"T+——·Ïß#O[ô±­+l!:(_ªÒ^)ÀPà°ª]BÖ–ƒ_:ünÆ?ÍoÇ8lßÆ8ú®ëGÁt<”~§ðçŽÝÒYõæîŒÙz
+yŽ{³.dþÂífªq¡TøLšæîü0/‡wî±;µYi@øQÄYe]$©]¯Z  NŠ!ïf}Ç7'…w…ë›?ADÁý2ƒµ5‰¬Ä{y"ï¿Ys$ˆË:ÇhÛ]wâ¯ùüÃÑ>Þ~˜ÞÝíEÊŠôÔ÷f!ævàe–ŽžÍ/}Þ¿…KmÞ#ø°«t.å„2ZÒüDrÿ`|*úŸ¡V‡ºendstream
 endobj
-1171 0 obj <<
+1176 0 obj <<
 /Type /Page
-/Contents 1172 0 R
-/Resources 1170 0 R
+/Contents 1177 0 R
+/Resources 1175 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1136 0 R
->> endobj
-1173 0 obj <<
-/D [1171 0 R /XYZ 85.0394 794.5015 null]
->> endobj
-1174 0 obj <<
-/D [1171 0 R /XYZ 85.0394 769.5949 null]
->> endobj
-1175 0 obj <<
-/D [1171 0 R /XYZ 85.0394 769.5949 null]
->> endobj
-1170 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F14 612 0 R >>
-/ProcSet [ /PDF /Text ]
+/Parent 1134 0 R
 >> endobj
 1178 0 obj <<
-/Length 69        
-/Filter /FlateDecode
->>
-stream
-xÚ3T0BCS3=3K#KsK=SCS…ä\.…t œ;—!T‰©±ž©‰±1ƒEV.­knj©g`fA‚!ÂVŒendstream
-endobj
-1177 0 obj <<
-/Type /Page
-/Contents 1178 0 R
-/Resources 1176 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1136 0 R
+/D [1176 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 1179 0 obj <<
-/D [1177 0 R /XYZ 56.6929 794.5015 null]
+/D [1176 0 R /XYZ 56.6929 723.7668 null]
 >> endobj
-1176 0 obj <<
-/ProcSet [ /PDF ]
+1180 0 obj <<
+/D [1176 0 R /XYZ 56.6929 711.8116 null]
 >> endobj
-1182 0 obj <<
+1175 0 obj <<
+/Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R /F14 612 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1183 0 obj <<
 /Length 1550      
 /Filter /FlateDecode
 >>
@@ -4579,46 +4599,46 @@ stream
 xÚ•ÛnÛ6ôÝ_!äÉ*Z¤îí0 MÛ-]1lMúÔöA–i[ˆ,ºº$͆ýûÎá!eÙR/Aè<<÷Íþ¸“„ÌóÓÀ‰Ó€…|?óœ-œý6ã'}¾‹‰S7ô&"vÜ!‘—·³å›@8ÂcQ$BçvÓóŠâ…©pn×çW»ìÐÊzáŠÐ›Ç‹Ï·oéVÀâ$æxË)ã¾ë/¯ÿ|EØ)}ndÞÕEûH«+U5ÅZÖY[ÔÓãóƒHzQ̸ç'š€—{ž7¿ÌsÙ4=™¶V%-ÞMkIùNÊÒHD†’–I5ãín/x2'
 ¡ Ï>y¡wyõ®/†[Ñ<Ó¸’γõš–D,˜ï³6ßÑYy$Óî²–ÎUG[yVÐHsÔÍjM@UäwU¶7¬6ª&¼M×vCºÆEÕ[ðDmÎY†äÁ¬,Õƒ[©¶Øo¼¹ÚÐ÷ú/úÒM6Ìr'“RÁ¹ýП
}3òüè+‘2/ÈW[¥ÖæÎZfS¡ÂY’Æ6ŒÑˆ¬³ôXÉSÊ\RÔ"åÃÒ¢Å1†G˜c(Ü9š-܈§P‰öE«cÇ—ýñe
¯)ì axXÿp­¸k.ôÕmaaJøB–Ɖ2÷½¬ZÚhJéÐ3Þ4ÅÊ›¯eUdå©ÛP¤"—Öï¡÷JÝ`%5WÛòÓðζYQ5íyè-2áíßå±zÚç$“I¿¯ÙþPÊS™vêR½Šê ëÒt¥ìp° :÷¹	¡xÔL„ïQ[Z.Á_v·–Lü¢(ø:`Ž­	¼X©m×T²m.hƒºBEY´*U~Gàû7W<å	-šC–ËgSùgeyØ؉DÃà7Wû½ªP7-cc%)*KT©7-;ù‡M1Ér+ŸÕ–ÿÒÇcúo™¼ 5?[‹óówà)‹C!ùiD5†¢é-.”x”Ðfd6ÿ{ÑÏR&žè´j²µ„¦‹ú2ãy€.#­­¥©®Ñž9¬efl†ÕLÇB·_Éú¶üNìû•é¿£µú
>Rù$÷4hZˆaO¸36)Ôh›¦€¡”Vôoˆ$&»þ“	|C¨cóRìÃõ§Hº“Æ™Ž¦TeX]˜ºÃ Ý.~hêöñ`îí³ºê¤ß6…Õãb¿’ÿŽIÇþȪÇSµ¿§ßäôܼ[é>÷ûqa*ÆÚ“8¦àJ¡.°û< œÀ¾g¼¡:¼§UÒ·+\tUIð”†
ní2s¶’²"V¶8!u
Ö>Ü^;iº$úY«¡Yí
ß|¾WÇž# tÂ\¾×ï:¦¯°}†›>#ì˜Îí¨[tÄmjeÞÒm€ülƒ£FÎh¡ñl㨢^`çÖË7W¯ß/àqp;5ÙÄ,…vlgÜõ}Ѩú‘C+Ò8Nô`ª8HÌ…_cöú¶\†ðp‹bïÓqz€Òéc¡?Q{ÁÜÐoÑ“n;¢«s¢=<§(` ‹àÁ{’2Ë% °¬krY·LÕ[€—‡nµ4[K«îòò»pCliŠ¶ckzŠ5DÄ’0Þ4B‹ùeöñ³ç¬AÁ·3ùi:°ðÐÎ~&àý$v]Înfïé¹G‚c½Q±$€Î ¡^k5üÇ)7zö÷8çOü{N	þzÎÎþ0à‡f˜âfQÜ#ýÂ0Œ>߈4¶„ôûÞÅ”ý½bÌîåÌMendstream
 endobj
-1181 0 obj <<
+1182 0 obj <<
 /Type /Page
-/Contents 1182 0 R
-/Resources 1180 0 R
+/Contents 1183 0 R
+/Resources 1181 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1188 0 R
-/Annots [ 1186 0 R 1187 0 R ]
+/Parent 1189 0 R
+/Annots [ 1187 0 R 1188 0 R ]
 >> endobj
-1186 0 obj <<
+1187 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [513.6761 73.4705 539.579 85.5301]
 /Subtype/Link/A<>
 >> endobj
-1187 0 obj <<
+1188 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [84.0431 62.7606 448.7754 72.9224]
 /Subtype/Link/A<>
 >> endobj
-1183 0 obj <<
-/D [1181 0 R /XYZ 85.0394 794.5015 null]
+1184 0 obj <<
+/D [1182 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 514 0 obj <<
-/D [1181 0 R /XYZ 85.0394 769.5949 null]
+/D [1182 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1184 0 obj <<
-/D [1181 0 R /XYZ 85.0394 570.0146 null]
+1185 0 obj <<
+/D [1182 0 R /XYZ 85.0394 570.0146 null]
 >> endobj
 518 0 obj <<
-/D [1181 0 R /XYZ 85.0394 570.0146 null]
+/D [1182 0 R /XYZ 85.0394 570.0146 null]
 >> endobj
-1185 0 obj <<
-/D [1181 0 R /XYZ 85.0394 536.782 null]
+1186 0 obj <<
+/D [1182 0 R /XYZ 85.0394 536.782 null]
 >> endobj
-1180 0 obj <<
-/Font << /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F11 1166 0 R >>
+1181 0 obj <<
+/Font << /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F11 1171 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1191 0 obj <<
+1192 0 obj <<
 /Length 3207      
 /Filter /FlateDecode
 >>
@@ -4636,45 +4656,45 @@ b
 oNIÛŒ\q¾ÀÐ
 Ñòòg¬Û2l]®1J3·)ǘ–
xW‚Á‹ûB¸"l°I„Q3 [e~K×!5-uYä§ùŠ1Jd|©-ë1‡î4(G¿¶ýªaMÔØýð@²’â!¿0ÿr.Z°™2šÏì{˜Ý(xÃ<í““pnN„Jî–†¯$öàËÒÀ%ž¿¥Q^W¬G±ß]¢è3>-®ÝSý‘^—®ckhò:1Ê¡£wqÀC¿.¸=šõÅ/åpüròƒ¸³3÷³R5ü¸Ž.È¿2Žs?ÌúÌë¿öWPÝãŸÌüM@0ôþï¿@8ÿ™ˆœŸ¦áù¦…tê«„ð¦l] ®vîþTázëÿ2}endstream
 endobj
-1190 0 obj <<
+1191 0 obj <<
 /Type /Page
-/Contents 1191 0 R
-/Resources 1189 0 R
+/Contents 1192 0 R
+/Resources 1190 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1188 0 R
+/Parent 1189 0 R
 >> endobj
-1192 0 obj <<
-/D [1190 0 R /XYZ 56.6929 794.5015 null]
+1193 0 obj <<
+/D [1191 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 522 0 obj <<
-/D [1190 0 R /XYZ 56.6929 769.5949 null]
+/D [1191 0 R /XYZ 56.6929 769.5949 null]
 >> endobj
-1196 0 obj <<
-/D [1190 0 R /XYZ 56.6929 747.0488 null]
+1197 0 obj <<
+/D [1191 0 R /XYZ 56.6929 747.0488 null]
 >> endobj
 526 0 obj <<
-/D [1190 0 R /XYZ 56.6929 613.0366 null]
+/D [1191 0 R /XYZ 56.6929 613.0366 null]
 >> endobj
-1197 0 obj <<
-/D [1190 0 R /XYZ 56.6929 586.6546 null]
+1198 0 obj <<
+/D [1191 0 R /XYZ 56.6929 586.6546 null]
 >> endobj
 530 0 obj <<
-/D [1190 0 R /XYZ 56.6929 473.2336 null]
+/D [1191 0 R /XYZ 56.6929 473.2336 null]
 >> endobj
-1198 0 obj <<
-/D [1190 0 R /XYZ 56.6929 445.9291 null]
+1199 0 obj <<
+/D [1191 0 R /XYZ 56.6929 445.9291 null]
 >> endobj
 534 0 obj <<
-/D [1190 0 R /XYZ 56.6929 376.148 null]
+/D [1191 0 R /XYZ 56.6929 376.148 null]
 >> endobj
 974 0 obj <<
-/D [1190 0 R /XYZ 56.6929 340.4845 null]
+/D [1191 0 R /XYZ 56.6929 340.4845 null]
 >> endobj
-1189 0 obj <<
-/Font << /F62 638 0 R /F90 1195 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F77 707 0 R /F58 631 0 R >>
+1190 0 obj <<
+/Font << /F62 638 0 R /F90 1196 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F77 707 0 R /F58 631 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1201 0 obj <<
+1202 0 obj <<
 /Length 1962      
 /Filter /FlateDecode
 >>
@@ -4687,84 +4707,84 @@ i	
 {ÊËޯ̸xå¹ëésüʶª²$ÂOÊ߃¥>hùMCˆÅ9¦B)³‚Á~‹*ïþø2?Å$i	iZlD‡¹,蹆¤Ÿ6žúóåéfž°]Ìp/72_ø½³‹Þ{8¬þböá68ÓÃRåu<7ÏG³Ò]Wk¿³…1ünå°p}”¢äùÄ¿¶¦µóçí
 
ní6)ŠPä"½Æö¹ÙqóCu€à°+»"e(sñK{"R¸Ãd	D…Eÿú¦Ì3¶Ë)÷»roÙ5Öž¾x|<ŸÏ!ïÊ£/ËGFßãn²pÇ71ÞlÔ¬u×U>î­ý·­ÂÁèªK§jW\†=¿ï„·Aû×ÄD†ø6¹±WÙ^tèYr\Ca—¹7„¡äòÖÛüÈyïî?lYŽendstream
 endobj
-1200 0 obj <<
+1201 0 obj <<
 /Type /Page
-/Contents 1201 0 R
-/Resources 1199 0 R
+/Contents 1202 0 R
+/Resources 1200 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1188 0 R
-/Annots [ 1208 0 R 1209 0 R ]
+/Parent 1189 0 R
+/Annots [ 1209 0 R 1210 0 R ]
 >> endobj
-1208 0 obj <<
+1209 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [348.3486 128.9523 463.9152 141.0119]
 /Subtype/Link/A<>
 >> endobj
-1209 0 obj <<
+1210 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [147.3629 116.9971 364.5484 129.0567]
 /Subtype/Link/A<>
 >> endobj
-1202 0 obj <<
-/D [1200 0 R /XYZ 85.0394 794.5015 null]
+1203 0 obj <<
+/D [1201 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 538 0 obj <<
-/D [1200 0 R /XYZ 85.0394 769.5949 null]
+/D [1201 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1203 0 obj <<
-/D [1200 0 R /XYZ 85.0394 576.7004 null]
+1204 0 obj <<
+/D [1201 0 R /XYZ 85.0394 576.7004 null]
 >> endobj
 542 0 obj <<
-/D [1200 0 R /XYZ 85.0394 576.7004 null]
+/D [1201 0 R /XYZ 85.0394 576.7004 null]
 >> endobj
-1204 0 obj <<
-/D [1200 0 R /XYZ 85.0394 548.3785 null]
+1205 0 obj <<
+/D [1201 0 R /XYZ 85.0394 548.3785 null]
 >> endobj
 546 0 obj <<
-/D [1200 0 R /XYZ 85.0394 548.3785 null]
+/D [1201 0 R /XYZ 85.0394 548.3785 null]
 >> endobj
-1205 0 obj <<
-/D [1200 0 R /XYZ 85.0394 518.5228 null]
+1206 0 obj <<
+/D [1201 0 R /XYZ 85.0394 518.5228 null]
 >> endobj
 550 0 obj <<
-/D [1200 0 R /XYZ 85.0394 460.6968 null]
+/D [1201 0 R /XYZ 85.0394 460.6968 null]
 >> endobj
-1206 0 obj <<
-/D [1200 0 R /XYZ 85.0394 425.0333 null]
+1207 0 obj <<
+/D [1201 0 R /XYZ 85.0394 425.0333 null]
 >> endobj
 554 0 obj <<
-/D [1200 0 R /XYZ 85.0394 260.2468 null]
+/D [1201 0 R /XYZ 85.0394 260.2468 null]
 >> endobj
-1207 0 obj <<
-/D [1200 0 R /XYZ 85.0394 224.698 null]
+1208 0 obj <<
+/D [1201 0 R /XYZ 85.0394 224.698 null]
 >> endobj
-1199 0 obj <<
-/Font << /F42 601 0 R /F43 604 0 R /F11 1166 0 R /F57 628 0 R >>
+1200 0 obj <<
+/Font << /F42 601 0 R /F43 604 0 R /F11 1171 0 R /F57 628 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1212 0 obj <<
+1213 0 obj <<
 /Length 69        
 /Filter /FlateDecode
 >>
 stream
 xÚ3T0BCS3=3K#KsK=SCS…ä\.…t œ;—!T‰©±ž©‰±1ƒEV.­knj©g`fA‚!ÂVŒendstream
 endobj
-1211 0 obj <<
+1212 0 obj <<
 /Type /Page
-/Contents 1212 0 R
-/Resources 1210 0 R
+/Contents 1213 0 R
+/Resources 1211 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1188 0 R
+/Parent 1189 0 R
 >> endobj
-1213 0 obj <<
-/D [1211 0 R /XYZ 56.6929 794.5015 null]
+1214 0 obj <<
+/D [1212 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1210 0 obj <<
+1211 0 obj <<
 /ProcSet [ /PDF ]
 >> endobj
-1216 0 obj <<
+1217 0 obj <<
 /Length 2598      
 /Filter /FlateDecode
 >>
@@ -4781,39 +4801,39 @@ i
 ‹ ~+ø§‰¶×àfÖ.µUm¯r[Ÿ)³ÃXp=ͯØ#›Á,ôÈ<‘ëß½^ÌåbcÓKõ¾%ÕƒßU‰ï«¢P–ëcIk¦È‰ý$ì7;¸È«ê,`-µè½ÑÔ–ù[÷0”4(53¾|Q°Âöþ5qÀ$—£J4ëÝæþ.j#ׇͪz$þíغ½,~»H>‹Íl®ÝÛ—˜šÚ§dØC69ýh‚¹æãÌAZ¶Æ?B!ɶ•ð¢œ¦±ÚC 6²Á€ôW}Bü]t|-c˜´u¦*1ûì›ÕBÿÀ5:Ʋì³à
êh`6)@IhÃh.æ9ÍâM’ÐVÚ'иˆH¡K€ÁYû†'¢S1…ÁØÿãlsÞ9€ÂÚèÙ7\@«º’¡›~ñ³Ø]µŒÔ’´nßï@³u	ã÷›uÿ\â‹™ûƈ ¢.·CéGÏ7®§'ôöfK:_ðl_!W,/êCHÓPÆ9Œ£¿¢ñÅŽTÞ4ï2DÝ©‰üD¢}Ͻ–wçmŠ;Æ> endobj
-1217 0 obj <<
-/D [1215 0 R /XYZ 85.0394 794.5015 null]
+1218 0 obj <<
+/D [1216 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 558 0 obj <<
-/D [1215 0 R /XYZ 85.0394 769.5949 null]
+/D [1216 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1218 0 obj <<
-/D [1215 0 R /XYZ 85.0394 576.5762 null]
+1219 0 obj <<
+/D [1216 0 R /XYZ 85.0394 576.5762 null]
 >> endobj
 562 0 obj <<
-/D [1215 0 R /XYZ 85.0394 576.5762 null]
+/D [1216 0 R /XYZ 85.0394 576.5762 null]
 >> endobj
-1219 0 obj <<
-/D [1215 0 R /XYZ 85.0394 544.2616 null]
+1220 0 obj <<
+/D [1216 0 R /XYZ 85.0394 544.2616 null]
 >> endobj
 566 0 obj <<
-/D [1215 0 R /XYZ 85.0394 544.2616 null]
+/D [1216 0 R /XYZ 85.0394 544.2616 null]
 >> endobj
-1220 0 obj <<
-/D [1215 0 R /XYZ 85.0394 517.7268 null]
+1221 0 obj <<
+/D [1216 0 R /XYZ 85.0394 517.7268 null]
 >> endobj
-1214 0 obj <<
+1215 0 obj <<
 /Font << /F42 601 0 R /F43 604 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1223 0 obj <<
+1224 0 obj <<
 /Length 3012      
 /Filter /FlateDecode
 >>
@@ -4833,45 +4853,45 @@ L9
 +i‹ûaÒ¦mYÖÙo-–[½Iÿ­	̵6ÐLH±!ƒ+Ñ&ÀJø!Š
 Jæö8™ÿv8‚6iÆ¡v-lY§;·¾c´^FsKô©×ƒ­é)@¢Oû”ÿ8=o-ŠnQrš/å)…_ušF”ðã…Ó{-É)]2z$Ë?8ýΤªÃš"psëÌÉß~eá†õšCÊâ7m?QîrPF¨U‡¦ÈÀ»šÁmi«>ÐØ£ùs­£jÕ¯÷HÞ‘›¼J]oQeå}EhO§lŒñ·:èRµÆ´›»ß¡™Ll^umõ/ö‡y½Å$¡¨Øl,ê¿NOÿ‚~£ýÊ	.ló	S‹c;OÀì´>€.„{,Ð6Ð-$“vS‡:ó¬‘MçoîÊ…/úÞå>l‘ûû¨Üù’wüáglÑì(3þ!›ú”,š½ø~üÜ×qt2)D-úWcÊ$ä3ÎýnÏYÿôͯ‚endstream
 endobj
-1222 0 obj <<
+1223 0 obj <<
 /Type /Page
-/Contents 1223 0 R
-/Resources 1221 0 R
+/Contents 1224 0 R
+/Resources 1222 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1188 0 R
+/Parent 1189 0 R
 >> endobj
-1224 0 obj <<
-/D [1222 0 R /XYZ 56.6929 794.5015 null]
+1225 0 obj <<
+/D [1223 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 570 0 obj <<
-/D [1222 0 R /XYZ 56.6929 689.3212 null]
+/D [1223 0 R /XYZ 56.6929 689.3212 null]
 >> endobj
-1225 0 obj <<
-/D [1222 0 R /XYZ 56.6929 654.5655 null]
+1226 0 obj <<
+/D [1223 0 R /XYZ 56.6929 654.5655 null]
 >> endobj
 574 0 obj <<
-/D [1222 0 R /XYZ 56.6929 654.5655 null]
+/D [1223 0 R /XYZ 56.6929 654.5655 null]
 >> endobj
 814 0 obj <<
-/D [1222 0 R /XYZ 56.6929 626.6465 null]
->> endobj
-1226 0 obj <<
-/D [1222 0 R /XYZ 56.6929 541.3941 null]
+/D [1223 0 R /XYZ 56.6929 626.6465 null]
 >> endobj
 1227 0 obj <<
-/D [1222 0 R /XYZ 56.6929 529.439 null]
+/D [1223 0 R /XYZ 56.6929 541.3941 null]
 >> endobj
 1228 0 obj <<
-/D [1222 0 R /XYZ 56.6929 423.6955 null]
+/D [1223 0 R /XYZ 56.6929 529.439 null]
 >> endobj
 1229 0 obj <<
-/D [1222 0 R /XYZ 56.6929 411.7403 null]
+/D [1223 0 R /XYZ 56.6929 423.6955 null]
 >> endobj
-1221 0 obj <<
-/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F56 622 0 R /F11 1166 0 R >>
+1230 0 obj <<
+/D [1223 0 R /XYZ 56.6929 411.7403 null]
+>> endobj
+1222 0 obj <<
+/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F56 622 0 R /F11 1171 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1232 0 obj <<
+1233 0 obj <<
 /Length 2647      
 /Filter /FlateDecode
 >>
@@ -4887,178 +4907,178 @@ JA
 N«JW†×Ù©fÄ½ì– F¼a3CÉþ¼ÛÇ>+yˆ`ê3¿T¿”Š·[™âL§õ´]/ÿ˜We‡> endobj
-1235 0 obj <<
+1236 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [429.9899 660.9265 539.579 672.9861]
 /Subtype/Link/A<>
 >> endobj
-1236 0 obj <<
+1237 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [84.0431 649.6389 140.332 661.031]
 /Subtype/Link/A<>
 >> endobj
-1237 0 obj <<
+1238 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [507.6985 649.6389 539.579 661.031]
 /Subtype/Link/A<>
 >> endobj
-1238 0 obj <<
+1239 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [84.0431 638.2615 199.6097 648.4233]
 /Subtype/Link/A<>
 >> endobj
-1233 0 obj <<
-/D [1231 0 R /XYZ 85.0394 794.5015 null]
+1234 0 obj <<
+/D [1232 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 578 0 obj <<
-/D [1231 0 R /XYZ 85.0394 769.5949 null]
+/D [1232 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1234 0 obj <<
-/D [1231 0 R /XYZ 85.0394 744.2337 null]
+1235 0 obj <<
+/D [1232 0 R /XYZ 85.0394 744.2337 null]
 >> endobj
 582 0 obj <<
-/D [1231 0 R /XYZ 85.0394 744.2337 null]
+/D [1232 0 R /XYZ 85.0394 744.2337 null]
 >> endobj
 648 0 obj <<
-/D [1231 0 R /XYZ 85.0394 716.4931 null]
->> endobj
-1239 0 obj <<
-/D [1231 0 R /XYZ 85.0394 585.5597 null]
+/D [1232 0 R /XYZ 85.0394 716.4931 null]
 >> endobj
 1240 0 obj <<
-/D [1231 0 R /XYZ 85.0394 585.5597 null]
+/D [1232 0 R /XYZ 85.0394 585.5597 null]
 >> endobj
 1241 0 obj <<
-/D [1231 0 R /XYZ 85.0394 550.7275 null]
+/D [1232 0 R /XYZ 85.0394 585.5597 null]
 >> endobj
 1242 0 obj <<
-/D [1231 0 R /XYZ 85.0394 550.7275 null]
+/D [1232 0 R /XYZ 85.0394 550.7275 null]
 >> endobj
 1243 0 obj <<
-/D [1231 0 R /XYZ 85.0394 550.7275 null]
+/D [1232 0 R /XYZ 85.0394 550.7275 null]
 >> endobj
 1244 0 obj <<
-/D [1231 0 R /XYZ 85.0394 543.9179 null]
+/D [1232 0 R /XYZ 85.0394 550.7275 null]
 >> endobj
 1245 0 obj <<
-/D [1231 0 R /XYZ 85.0394 529.1534 null]
+/D [1232 0 R /XYZ 85.0394 543.9179 null]
 >> endobj
 1246 0 obj <<
-/D [1231 0 R /XYZ 85.0394 524.9381 null]
+/D [1232 0 R /XYZ 85.0394 529.1534 null]
 >> endobj
 1247 0 obj <<
-/D [1231 0 R /XYZ 85.0394 510.1735 null]
+/D [1232 0 R /XYZ 85.0394 524.9381 null]
 >> endobj
 1248 0 obj <<
-/D [1231 0 R /XYZ 85.0394 505.9582 null]
+/D [1232 0 R /XYZ 85.0394 510.1735 null]
 >> endobj
 1249 0 obj <<
-/D [1231 0 R /XYZ 85.0394 444.8058 null]
->> endobj
-751 0 obj <<
-/D [1231 0 R /XYZ 85.0394 444.8058 null]
+/D [1232 0 R /XYZ 85.0394 505.9582 null]
 >> endobj
 1250 0 obj <<
-/D [1231 0 R /XYZ 85.0394 444.8058 null]
+/D [1232 0 R /XYZ 85.0394 444.8058 null]
+>> endobj
+751 0 obj <<
+/D [1232 0 R /XYZ 85.0394 444.8058 null]
 >> endobj
 1251 0 obj <<
-/D [1231 0 R /XYZ 85.0394 440.8655 null]
+/D [1232 0 R /XYZ 85.0394 444.8058 null]
 >> endobj
 1252 0 obj <<
-/D [1231 0 R /XYZ 85.0394 426.1009 null]
+/D [1232 0 R /XYZ 85.0394 440.8655 null]
 >> endobj
 1253 0 obj <<
-/D [1231 0 R /XYZ 85.0394 421.8857 null]
+/D [1232 0 R /XYZ 85.0394 426.1009 null]
 >> endobj
 1254 0 obj <<
-/D [1231 0 R /XYZ 85.0394 407.1211 null]
+/D [1232 0 R /XYZ 85.0394 421.8857 null]
 >> endobj
 1255 0 obj <<
-/D [1231 0 R /XYZ 85.0394 402.9058 null]
+/D [1232 0 R /XYZ 85.0394 407.1211 null]
 >> endobj
 1256 0 obj <<
-/D [1231 0 R /XYZ 85.0394 376.1861 null]
+/D [1232 0 R /XYZ 85.0394 402.9058 null]
 >> endobj
 1257 0 obj <<
-/D [1231 0 R /XYZ 85.0394 371.9708 null]
+/D [1232 0 R /XYZ 85.0394 376.1861 null]
 >> endobj
 1258 0 obj <<
-/D [1231 0 R /XYZ 85.0394 357.2062 null]
+/D [1232 0 R /XYZ 85.0394 371.9708 null]
 >> endobj
 1259 0 obj <<
-/D [1231 0 R /XYZ 85.0394 352.9909 null]
+/D [1232 0 R /XYZ 85.0394 357.2062 null]
 >> endobj
 1260 0 obj <<
-/D [1231 0 R /XYZ 85.0394 338.2862 null]
+/D [1232 0 R /XYZ 85.0394 352.9909 null]
 >> endobj
 1261 0 obj <<
-/D [1231 0 R /XYZ 85.0394 334.0111 null]
+/D [1232 0 R /XYZ 85.0394 338.2862 null]
 >> endobj
 1262 0 obj <<
-/D [1231 0 R /XYZ 85.0394 260.9035 null]
+/D [1232 0 R /XYZ 85.0394 334.0111 null]
 >> endobj
 1263 0 obj <<
-/D [1231 0 R /XYZ 85.0394 260.9035 null]
+/D [1232 0 R /XYZ 85.0394 260.9035 null]
 >> endobj
 1264 0 obj <<
-/D [1231 0 R /XYZ 85.0394 260.9035 null]
+/D [1232 0 R /XYZ 85.0394 260.9035 null]
 >> endobj
 1265 0 obj <<
-/D [1231 0 R /XYZ 85.0394 256.9632 null]
+/D [1232 0 R /XYZ 85.0394 260.9035 null]
 >> endobj
 1266 0 obj <<
-/D [1231 0 R /XYZ 85.0394 242.2585 null]
+/D [1232 0 R /XYZ 85.0394 256.9632 null]
 >> endobj
 1267 0 obj <<
-/D [1231 0 R /XYZ 85.0394 237.9833 null]
+/D [1232 0 R /XYZ 85.0394 242.2585 null]
 >> endobj
 1268 0 obj <<
-/D [1231 0 R /XYZ 85.0394 213.9136 null]
+/D [1232 0 R /XYZ 85.0394 237.9833 null]
 >> endobj
 1269 0 obj <<
-/D [1231 0 R /XYZ 85.0394 207.0483 null]
+/D [1232 0 R /XYZ 85.0394 213.9136 null]
 >> endobj
 1270 0 obj <<
-/D [1231 0 R /XYZ 85.0394 145.8959 null]
+/D [1232 0 R /XYZ 85.0394 207.0483 null]
 >> endobj
 1271 0 obj <<
-/D [1231 0 R /XYZ 85.0394 145.8959 null]
+/D [1232 0 R /XYZ 85.0394 145.8959 null]
 >> endobj
 1272 0 obj <<
-/D [1231 0 R /XYZ 85.0394 145.8959 null]
+/D [1232 0 R /XYZ 85.0394 145.8959 null]
 >> endobj
 1273 0 obj <<
-/D [1231 0 R /XYZ 85.0394 141.9556 null]
+/D [1232 0 R /XYZ 85.0394 145.8959 null]
 >> endobj
 1274 0 obj <<
-/D [1231 0 R /XYZ 85.0394 116.5111 null]
+/D [1232 0 R /XYZ 85.0394 141.9556 null]
 >> endobj
 1275 0 obj <<
-/D [1231 0 R /XYZ 85.0394 111.0206 null]
+/D [1232 0 R /XYZ 85.0394 116.5111 null]
 >> endobj
 1276 0 obj <<
-/D [1231 0 R /XYZ 85.0394 84.3008 null]
+/D [1232 0 R /XYZ 85.0394 111.0206 null]
 >> endobj
 1277 0 obj <<
-/D [1231 0 R /XYZ 85.0394 80.0855 null]
+/D [1232 0 R /XYZ 85.0394 84.3008 null]
 >> endobj
-1230 0 obj <<
-/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F77 707 0 R /F11 1166 0 R /F57 628 0 R /F56 622 0 R >>
+1278 0 obj <<
+/D [1232 0 R /XYZ 85.0394 80.0855 null]
+>> endobj
+1231 0 obj <<
+/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F77 707 0 R /F11 1171 0 R /F57 628 0 R /F56 622 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1281 0 obj <<
+1282 0 obj <<
 /Length 2583      
 /Filter /FlateDecode
 >>
@@ -5074,183 +5094,183 @@ xÚ¥ZYs
 b> endobj
-1282 0 obj <<
-/D [1280 0 R /XYZ 56.6929 794.5015 null]
+/Parent 1279 0 R
 >> endobj
 1283 0 obj <<
-/D [1280 0 R /XYZ 56.6929 749.0893 null]
+/D [1281 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 1284 0 obj <<
-/D [1280 0 R /XYZ 56.6929 749.0893 null]
+/D [1281 0 R /XYZ 56.6929 749.0893 null]
 >> endobj
 1285 0 obj <<
-/D [1280 0 R /XYZ 56.6929 749.0893 null]
+/D [1281 0 R /XYZ 56.6929 749.0893 null]
 >> endobj
 1286 0 obj <<
-/D [1280 0 R /XYZ 56.6929 745.5361 null]
+/D [1281 0 R /XYZ 56.6929 749.0893 null]
 >> endobj
 1287 0 obj <<
-/D [1280 0 R /XYZ 56.6929 721.4664 null]
+/D [1281 0 R /XYZ 56.6929 745.5361 null]
 >> endobj
 1288 0 obj <<
-/D [1280 0 R /XYZ 56.6929 714.8926 null]
+/D [1281 0 R /XYZ 56.6929 721.4664 null]
 >> endobj
 1289 0 obj <<
-/D [1280 0 R /XYZ 56.6929 700.128 null]
+/D [1281 0 R /XYZ 56.6929 714.8926 null]
 >> endobj
 1290 0 obj <<
-/D [1280 0 R /XYZ 56.6929 696.2043 null]
+/D [1281 0 R /XYZ 56.6929 700.128 null]
 >> endobj
 1291 0 obj <<
-/D [1280 0 R /XYZ 56.6929 669.4845 null]
+/D [1281 0 R /XYZ 56.6929 696.2043 null]
 >> endobj
 1292 0 obj <<
-/D [1280 0 R /XYZ 56.6929 665.5608 null]
+/D [1281 0 R /XYZ 56.6929 669.4845 null]
 >> endobj
 1293 0 obj <<
-/D [1280 0 R /XYZ 56.6929 641.4911 null]
+/D [1281 0 R /XYZ 56.6929 665.5608 null]
 >> endobj
 1294 0 obj <<
-/D [1280 0 R /XYZ 56.6929 634.9173 null]
+/D [1281 0 R /XYZ 56.6929 641.4911 null]
 >> endobj
 1295 0 obj <<
-/D [1280 0 R /XYZ 56.6929 608.1975 null]
+/D [1281 0 R /XYZ 56.6929 634.9173 null]
 >> endobj
 1296 0 obj <<
-/D [1280 0 R /XYZ 56.6929 604.2738 null]
+/D [1281 0 R /XYZ 56.6929 608.1975 null]
 >> endobj
 1297 0 obj <<
-/D [1280 0 R /XYZ 56.6929 577.554 null]
+/D [1281 0 R /XYZ 56.6929 604.2738 null]
 >> endobj
 1298 0 obj <<
-/D [1280 0 R /XYZ 56.6929 573.6303 null]
+/D [1281 0 R /XYZ 56.6929 577.554 null]
 >> endobj
 1299 0 obj <<
-/D [1280 0 R /XYZ 56.6929 516.4589 null]
+/D [1281 0 R /XYZ 56.6929 573.6303 null]
 >> endobj
 1300 0 obj <<
-/D [1280 0 R /XYZ 56.6929 516.4589 null]
+/D [1281 0 R /XYZ 56.6929 516.4589 null]
 >> endobj
 1301 0 obj <<
-/D [1280 0 R /XYZ 56.6929 516.4589 null]
+/D [1281 0 R /XYZ 56.6929 516.4589 null]
 >> endobj
 1302 0 obj <<
-/D [1280 0 R /XYZ 56.6929 509.9409 null]
+/D [1281 0 R /XYZ 56.6929 516.4589 null]
 >> endobj
 1303 0 obj <<
-/D [1280 0 R /XYZ 56.6929 495.1763 null]
+/D [1281 0 R /XYZ 56.6929 509.9409 null]
 >> endobj
 1304 0 obj <<
-/D [1280 0 R /XYZ 56.6929 491.2525 null]
+/D [1281 0 R /XYZ 56.6929 495.1763 null]
 >> endobj
 1305 0 obj <<
-/D [1280 0 R /XYZ 56.6929 476.5478 null]
+/D [1281 0 R /XYZ 56.6929 491.2525 null]
 >> endobj
 1306 0 obj <<
-/D [1280 0 R /XYZ 56.6929 472.5642 null]
+/D [1281 0 R /XYZ 56.6929 476.5478 null]
 >> endobj
 1307 0 obj <<
-/D [1280 0 R /XYZ 56.6929 457.8595 null]
+/D [1281 0 R /XYZ 56.6929 472.5642 null]
 >> endobj
 1308 0 obj <<
-/D [1280 0 R /XYZ 56.6929 453.8759 null]
+/D [1281 0 R /XYZ 56.6929 457.8595 null]
 >> endobj
 1309 0 obj <<
-/D [1280 0 R /XYZ 56.6929 393.8353 null]
+/D [1281 0 R /XYZ 56.6929 453.8759 null]
 >> endobj
 1310 0 obj <<
-/D [1280 0 R /XYZ 56.6929 393.8353 null]
+/D [1281 0 R /XYZ 56.6929 393.8353 null]
 >> endobj
 1311 0 obj <<
-/D [1280 0 R /XYZ 56.6929 393.8353 null]
+/D [1281 0 R /XYZ 56.6929 393.8353 null]
 >> endobj
 1312 0 obj <<
-/D [1280 0 R /XYZ 56.6929 390.1865 null]
+/D [1281 0 R /XYZ 56.6929 393.8353 null]
 >> endobj
 1313 0 obj <<
-/D [1280 0 R /XYZ 56.6929 375.4817 null]
+/D [1281 0 R /XYZ 56.6929 390.1865 null]
 >> endobj
 1314 0 obj <<
-/D [1280 0 R /XYZ 56.6929 371.4981 null]
+/D [1281 0 R /XYZ 56.6929 375.4817 null]
 >> endobj
 1315 0 obj <<
-/D [1280 0 R /XYZ 56.6929 356.7336 null]
+/D [1281 0 R /XYZ 56.6929 371.4981 null]
 >> endobj
 1316 0 obj <<
-/D [1280 0 R /XYZ 56.6929 352.8098 null]
+/D [1281 0 R /XYZ 56.6929 356.7336 null]
 >> endobj
 1317 0 obj <<
-/D [1280 0 R /XYZ 56.6929 338.0452 null]
+/D [1281 0 R /XYZ 56.6929 352.8098 null]
 >> endobj
 1318 0 obj <<
-/D [1280 0 R /XYZ 56.6929 334.1215 null]
+/D [1281 0 R /XYZ 56.6929 338.0452 null]
 >> endobj
 1319 0 obj <<
-/D [1280 0 R /XYZ 56.6929 276.9501 null]
+/D [1281 0 R /XYZ 56.6929 334.1215 null]
 >> endobj
 1320 0 obj <<
-/D [1280 0 R /XYZ 56.6929 276.9501 null]
+/D [1281 0 R /XYZ 56.6929 276.9501 null]
 >> endobj
 1321 0 obj <<
-/D [1280 0 R /XYZ 56.6929 276.9501 null]
+/D [1281 0 R /XYZ 56.6929 276.9501 null]
 >> endobj
 1322 0 obj <<
-/D [1280 0 R /XYZ 56.6929 270.4321 null]
+/D [1281 0 R /XYZ 56.6929 276.9501 null]
 >> endobj
 1323 0 obj <<
-/D [1280 0 R /XYZ 56.6929 246.3624 null]
+/D [1281 0 R /XYZ 56.6929 270.4321 null]
 >> endobj
 1324 0 obj <<
-/D [1280 0 R /XYZ 56.6929 239.7886 null]
+/D [1281 0 R /XYZ 56.6929 246.3624 null]
 >> endobj
 1325 0 obj <<
-/D [1280 0 R /XYZ 56.6929 225.0839 null]
+/D [1281 0 R /XYZ 56.6929 239.7886 null]
 >> endobj
 1326 0 obj <<
-/D [1280 0 R /XYZ 56.6929 221.1002 null]
+/D [1281 0 R /XYZ 56.6929 225.0839 null]
 >> endobj
 1327 0 obj <<
-/D [1280 0 R /XYZ 56.6929 206.3357 null]
+/D [1281 0 R /XYZ 56.6929 221.1002 null]
 >> endobj
 1328 0 obj <<
-/D [1280 0 R /XYZ 56.6929 202.4119 null]
+/D [1281 0 R /XYZ 56.6929 206.3357 null]
 >> endobj
 1329 0 obj <<
-/D [1280 0 R /XYZ 56.6929 187.6473 null]
+/D [1281 0 R /XYZ 56.6929 202.4119 null]
 >> endobj
 1330 0 obj <<
-/D [1280 0 R /XYZ 56.6929 183.7236 null]
+/D [1281 0 R /XYZ 56.6929 187.6473 null]
 >> endobj
 1331 0 obj <<
-/D [1280 0 R /XYZ 56.6929 159.6538 null]
+/D [1281 0 R /XYZ 56.6929 183.7236 null]
 >> endobj
 1332 0 obj <<
-/D [1280 0 R /XYZ 56.6929 153.0801 null]
+/D [1281 0 R /XYZ 56.6929 159.6538 null]
 >> endobj
 1333 0 obj <<
-/D [1280 0 R /XYZ 56.6929 93.0395 null]
+/D [1281 0 R /XYZ 56.6929 153.0801 null]
 >> endobj
 1334 0 obj <<
-/D [1280 0 R /XYZ 56.6929 93.0395 null]
+/D [1281 0 R /XYZ 56.6929 93.0395 null]
 >> endobj
 1335 0 obj <<
-/D [1280 0 R /XYZ 56.6929 93.0395 null]
+/D [1281 0 R /XYZ 56.6929 93.0395 null]
 >> endobj
 1336 0 obj <<
-/D [1280 0 R /XYZ 56.6929 89.3907 null]
+/D [1281 0 R /XYZ 56.6929 93.0395 null]
 >> endobj
-1279 0 obj <<
+1337 0 obj <<
+/D [1281 0 R /XYZ 56.6929 89.3907 null]
+>> endobj
+1280 0 obj <<
 /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1339 0 obj <<
+1340 0 obj <<
 /Length 995       
 /Filter /FlateDecode
 >>
@@ -5260,52 +5280,52 @@ xÚ¥V_s
 c¹V¯ª¬÷¦>È(N™?ßíKeèºqÞ{¼Œaž:]WjdUw.t}Z~h¹E`ÂÀkÚâ%³gèüç…~ÍÊõ³Ê)w«Õõ¡t\Õ\V
 Ïo‡ºSkT„-/׎Y|lÄÊ9ÛÔÍ.+‘9|_ U	0;ý<¯wÁ¹÷Ùg•¶ÞõWïxbGÀe­Û¼ÌôN5GAÖõ*Nù£	xâ<2=×"iÓ…_±Þ¢jÛ£‡".Eöêœdx”z£ZH)Û­p¶ú;^vuÕÎúý˜â[¡óâ\¡.c1̈µ*ÂD™¹ï×Y/X9Sp¢çåÐÐYÄ}Ñ'£B‡‚0Fã~(„n(Üça:x/3YWõÁÍŠË9ËÞoDÂ(îýR’²Ôº]¨jÌgÔþ×à)',fáÏwÂPçÜp<±0%<òÙ‰ýÈžÊ%2åìçQ{­ÏaE<+‘I(NÃNoaÝp*ÜwEã!Tìc˜¨æ¼µº@›ûìP¢Ñ¤\éîŸO¿jtþb§h|ÕcÅ"ÿªÞ¿7z[t¶©XÛ!Š¤Ù ”bR9Ƈùý?à¶",‘Þì’3©2N(•©Ë¶–Ä|Ô*k»z_ÛY#öjòJî~Y(]–8o¡aL¬ä‡±[¹Î´mkèdìÔs]­jvâ™×¢}SÿïÕûÑnQBB)ùùniL$à\R¦ùéA¿£?§þ/.û9œendstream
 endobj
-1338 0 obj <<
+1339 0 obj <<
 /Type /Page
-/Contents 1339 0 R
-/Resources 1337 0 R
+/Contents 1340 0 R
+/Resources 1338 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1278 0 R
+/Parent 1279 0 R
 >> endobj
-1340 0 obj <<
-/D [1338 0 R /XYZ 85.0394 794.5015 null]
+1341 0 obj <<
+/D [1339 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 586 0 obj <<
-/D [1338 0 R /XYZ 85.0394 769.5949 null]
+/D [1339 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1341 0 obj <<
-/D [1338 0 R /XYZ 85.0394 752.4085 null]
+1342 0 obj <<
+/D [1339 0 R /XYZ 85.0394 752.4085 null]
 >> endobj
 590 0 obj <<
-/D [1338 0 R /XYZ 85.0394 668.8754 null]
->> endobj
-1342 0 obj <<
-/D [1338 0 R /XYZ 85.0394 644.5358 null]
+/D [1339 0 R /XYZ 85.0394 668.8754 null]
 >> endobj
 1343 0 obj <<
-/D [1338 0 R /XYZ 85.0394 609.8359 null]
+/D [1339 0 R /XYZ 85.0394 644.5358 null]
 >> endobj
 1344 0 obj <<
-/D [1338 0 R /XYZ 85.0394 609.8359 null]
+/D [1339 0 R /XYZ 85.0394 609.8359 null]
 >> endobj
 1345 0 obj <<
-/D [1338 0 R /XYZ 85.0394 609.8359 null]
+/D [1339 0 R /XYZ 85.0394 609.8359 null]
 >> endobj
 1346 0 obj <<
-/D [1338 0 R /XYZ 85.0394 609.8359 null]
+/D [1339 0 R /XYZ 85.0394 609.8359 null]
 >> endobj
-1337 0 obj <<
+1347 0 obj <<
+/D [1339 0 R /XYZ 85.0394 609.8359 null]
+>> endobj
+1338 0 obj <<
 /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F14 612 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-881 0 obj
+880 0 obj
 [594 0 R /Fit]
 endobj
-1347 0 obj <<
+1348 0 obj <<
 /Type /Encoding
 /Differences [ 0 /.notdef 1/dotaccent/fi/fl/fraction/hungarumlaut/Lslash/lslash/ogonek/ring 10/.notdef 11/breve/minus 13/.notdef 14/Zcaron/zcaron/caron/dotlessi/dotlessj/ff/ffi/ffl/notequal/infinity/lessequal/greaterequal/partialdiff/summation/product/pi/grave/quotesingle/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 127/.notdef 128/Euro/integral/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/Omega/radical/approxequal 144/.notdef 147/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/Delta/lozenge/Ydieresis 160/.notdef 161/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]
 >> endobj
-1194 0 obj <<
+1195 0 obj <<
 /Length1 1628
 /Length2 8040
 /Length3 532
@@ -5315,7 +5335,7 @@ endobj
 stream
 xÚíte\Ôí¶6Ò ˆtÃÐÝÝÝÝ¡Ä000Ì ÝÝÝÝ’‚R"‚´t	ÒÈ‹>ïÞûüž³?³?½¿w¾Ìÿ^×Z׺î7¶‡Œ5Ü
 ¬‡¹rðpr‹t´P(ÐWç…C­fL9g0ЇÉ]Á¢#°5@ðòxDDD0rp'/gˆ­+€ù‘ƒ…ý_–ß.+¯ ‘.[€ññÃ…;9‚a®ÿã@=0àjØ@ `€œ–¶‰Š¦€YIÓ †P€¶›¨C@`˜˜`w@ÿ:@p˜5ä÷Õ\8¹d\@€‹y{‚ÀN¿!v€ØÙââòø
€¸l0×ǸÂêfý[À£ÝþG“3üÑÃñ{$Ó†»¸º€œ!N®€Ç¬ÚòŠétµºþÎíy„p›GOk8Èí÷•þ`4¨+s¸‚=]粬!.NP ×cîG2'gÈn.˜í¿°œÁ¶@gk(ØÅå‘æ‘ûwuþuOÀ¹=ÐÉ	êõ'þÇëŸ ®.`¨
'&ïcNëcn[“ë÷¨¨Àlàî¿ìÖnNÿÀÜÁÎ
-Äü{fXE­á0¨ÀlƒÉ¥	w}L	`þŸu™ó?×äÿ@‹ÿ#
þ´÷×Ü¿÷è¿,ñÿvŸÿN­è…jÁ‚ÿxcê€ßÌs:B ^ÿÎýïžFà¿4þ;Wàc!d`¶Íàáäæù€¸(B<ÁÖÚWÀ}¬Ô»Ìì…ÀÀýSL7÷ß0};Èö»ôA`˜õßå?6éx.9}S¶ÿöªrèA§Ë‚GPè¯íÇ9pÕ÷rþo:#
¸õ?¿ùdeáž^7Ïãú=*áðû7¹ÿñüë¬tu†x^psr?Fr~ÿsÿÎýOÀìo4
+Äü{fXE­á0¨ÀlƒÉ¥	w}L	`þŸu™ó?×äÿ@‹ÿ#
þ´÷×Ü¿÷è¿,ñÿvŸÿN­è…jÁ‚ÿxcê€ßÌs:B ^ÿÎýïžFà¿4þ;Wàc!d`¶Íàáäæù€¸(B<ÁÖÚWÀ}¬Ô»Ìì…ÀÀýSL7÷ß0};Èö»ôA`˜õßå?6éx.}Uu5#}¶ÿöªrèA§Ë‚GPè¯íÇ9pÕ÷rþo:#
¸õ?¿ùdeáž^7Ïãú=*áðû7¹ÿñüë¬tu†x^psr?Fr~ÿsÿÎýOÀìo4
 0Üú÷äè¹aÖÃöOÃoäæìüØã?ûÿxýœÿŒ=ì	a.ÌÁAb¡ö™9Y®
Ä£ò/z{xÂœ*Þè—ÖÁ»2#×Dj,ïêÃ8›ÇEµyÍî;Ýoª²n
öA™ºÓÁß‹(üèX>ã.3v±ms™W`gÅúϨ¯"›
 rn­êèš—ß¡RŽwð9£_²Ò¹Ð_8=óe4%v>oFÀk(Ù?`LÙ½¼`êú4ð±ûåÃ&9[~ƒ˜;26cLà«|r)Sƒj…×Íl(ßÛ
 b¬Å7ÎßÊçÏVð™h9Žù,¢I‚°RÊ• e®äß·RÆ%=²ìÙ
êt›œ(†Ì%³LÇî)®Ž>1Ù¥‘„µ…^Ñ2¼éˆO£Ý	%õ‰>•pjÕr{2–ÂwÍ<–g¬™-j—!3cäáakIè,AŒ$ÁLˆÇÆ‹J¯³nöùU»Ïm›Þ‰D3
@@ -5338,35 +5358,35 @@ $O
 t‡Í=žÝbóÆÃwî6ß"£“˵?”JËOP2RÐoQo+†â1)©w†¦ÜèådîI½ÈZ¿VÍ­(e÷åû È"QÔüFØs(úF$'‘qL ®/¶!õÔ
¤HvkÖ‰Œh¼È‰¬ê؉á¶o?Ùa:Šÿ±qêcŒ°gã!_QÇ~ÏWê¡1üaœ¯UÝGmã§Yñmn%ìRãr9÷¬ß0qˆ5†/‚E…(êÚ“†,W‚˜$Ù½ï¶åçLxËÎÔ|ú奕£w†Z|ÂV€ãž÷,éOd
 ÞyŠGÝ
 ŽÎ¨Ý3lÍ4©¿Î\×T2Zª½Ag—.7Ù#ÏPæï™v¼eŦQLÞ»±Oþ¼Ô\’	¬ÿĵJÅñ¾(š3Ç].Å*,MÎ>ÛBx(ÃSÃó|D³uû‚Þ¡ï†{:Ò‘Á¨2G9¡Cê{É•<|?ÒK áéá@F)Ø,êw÷ó?È ¸¢Ëa„Çh%Ù±o^Œñ{‹6™Ý@¥-«ä%Å~jÉwXjz1îi´·î¬%uÕ3^¿±g¸`d+ÎK[ŽDe—„]âò†YèÖýÇ?Ï>£³HjË,èkѸÍhÔ8Š”™v_Å
[ªJÖ®²9m=·âú?\‹k>¼à¬‡¤*³Ñ³ž,Y
ê<‹ý¹uÓZ/ZV$S·é#ƒmNOš¨5M@¿§rãÝ0Hõ7¬&7[àçŽAØñêOõƧÈêÚ5±pE6~d»Ž^.x¨T1¬µ¤$£Í7¿ÿ4òÆêüj§‹G1¬èípoóÌ3³QýÐZ:œNÍÆéç,0½‹Š‡Zg‹ðâ£à)‹Q©¯³‹X""œÛÆ0ÏÁ¾äBvFA‚)Y9(ÎYÖý…ì¬S…|¸Ôü¾“qbæÇN.LÔX§…_ï‚¿œ%%½¥åŒìé|°D>W²7}C–Í#—ZR¸­$º`bÛGο…a¿9gÝS%\”Á/œîñhC|?s§Ø…šg¯ÎÙÈ)ª¬m}ÐvÖËk†Ÿ.bÉ&O
 üõí+uqfº`Îa‡„°£â,I§ã¯½/‘˜÷ÇÝ›Á¤'P6ߢH‚Ú?÷›½šÙ¹˜Žà9¦ŠmHr7:pMRYŸ#£ 'æW¥¿ðKCß|-¡mWÝ躖nᲶË0–«ÞÐ3äÛÙ=j’¸Ë-,n–³e±€¢üb½iÙ;‘˜Hâ°l<)žL.ßÐYÖÿ°Ú·)wL=(‚Œ£± L|)=å'ÀÆ-Å@²öò¾µ<ÃNrä³6îµEôʃ3±d¶kÓ»¬ÿ‹%ôµøü·(kD~ô(¬_yñ‡Í;¯åä²fùOî{&*‰äyÒ¯9ÛB±T¨d>è.òY[a-³ZyÏ•px9ÝØÜ>穾„»*|,4°ç	Žð=Ï	añŽ©{ZwLVqžCÅo, H;ç_7Gg[åGxd½DŽ…*~ÂJSÛ/
*ûÎÔF‹µëújQ‹jw	Ý]_-Òq;Œ,1t³õ2ߥÆíËòê{:Ö§Ùo$<×ð¬žôôJ©Àëóüλì„b›F=ÍçåcT”u;ÐuË›÷#³»Z1q“ÒYÖgHŠ^fiyv|‰¢,PkŠA±¢FH£s^…EËRôƇnQWEÛt%Ú·y3™{æÈŒõFbKã<%Æ)â"-L+{墒zS'“#é²ÊòZÃ+•÷U­Á׎#Ç©ÃCcæHŸ,êä;÷=íÏô.óYäg:¯jÔn¹¶Æô×êS:c¤¬UºW¹Þ/Ëf¹ŠšcO¥ÛøŒM¯lD‰Á¦9²ú:­ÈùÈßÛ˜ìÑËr6½õx§ç±2ú]úS¹‘	p7O¼,j1îöÐËÚ{ž$ªS7O–xYŽróæs÷â»ì(è˜Ýš‹ÏD‚@§­Y#žC²L%¯íáž›1A•Ã¸©3¾~M+ÖAîDí>¤¶¯cãµã-Nˆ¥”ûÚÔß	ÄÖtzâ"¹tãØ'>(˜“”hSðÕœM]ˆÎÛ…0ìŽ
ñâSPÓKD³—dOjnÌó®|KHtÞ‘Ñ+㢟S'÷@6„iõ“¨C,÷ág3B½žpÖáΡÄêφÖÑn‰Ü;ɦc“
_7T,Q1çTiHøBÕWL8­¡¾	 ,œ²£.±ßu2†)¶=–Oš ¹ÿêÚ´­Ùê²,
Aq¨¿râ^T!1í¢ëç2)áN\§‹¬‚)æÄËR…Ëbž÷ž6Cb5ü´çêÞ›Ô;ð¶¹mH“üÅL¸^Ȭü¤Ý¸Ê	{>«m@Ë›ðzéN‹›´×»ÔÌÃBÿ]¬—š@)õp[jÊâá…6붡²BSHQøר.öØ«N÷Ž`ðG¿§zŽ^n)?ìû±«892ÉÿxÈÌÄ÷Ù%¼­Ø3ÕÎZJðô]\ÿ^¸Äé„SXA㣅¸r}[(â0Ò@¥elöÉmi¶ö­EWÕ9úQѲ´ˆC¶Û¯µAñ=°g>MF{Q’= †*Ëk¨+™×Øõµk¤i@ïħÕW:x<›ó"Í}<=<²šC½Q¤4Æð÷i©UµSöA-ÒiMÛk×qnñÔÆèO“¦R<)D¾€÷/ÇT#î¡ÍM©	Æ$ÖžåÔ3³Ð¿Á¢\ç{Uª÷Þ<UW=ˆ$®&<ƒªZ€0óØÒgÒR*¹ÉÒO¦1‘'£ùŽŠj*5wË-·‰ûùT j4ÝióÍu``òh߯µ“K…ݻʔÑk‡‡A›”ôÈÔDôìtk¯ö2ÅÛö÷ú—¨§$ÌöZ¥ï@Î^ùÝêõ^E~§”Üúí¨u4߉<*ôŽ±§¸KJßùy/žn•C*}…ÃåLgI£J·8jŽ[“Þ³	”ØT7%JÈOïä,Á!ØžÈ+ÌÁ¯f—ÉȘs‡h`Úq¢O”1£<ƒ3(©dØOfBOŸ º'"p=Q£B¿âäpJ}ÝØü™ŸZ®¤!p{òëÈa}÷qÑ¥³äƒ£DKXôžòxÇ(žÏÑã
©¨“{ÏçÉšj¿dqX·ã·ŸP¦Üv£ä£Ï€³i¬¾AÕ;³@øyŠ*œoLœOœÕøë…ú¾›ºxOÛÝËc	-@YšUʳªø;žBiäMÖð.•\rž;ùU´¾Rø'î…ç)眄š˜	…@ƒi/_	A®ÉéÙêr«0áFx<×Er;¾zÇ´UÏšøSÂö²Ù„.¥mô÷Œhâæ¨É2Ø’ç/{I;õŠjÑm÷¬
-*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€Ž¶Xo³êÙ}U¹ôZø: hÁ‚)8f÷EµÔëÛDäµsüð¢ qTMŠ:ù‘ɸX!±l®ûÔ”Ëû΄,ñº17ýbŸgûŸ&fܽ×Y'jeAt
]ôÛïwV^þ%ÑåµÛR¼”tμ‡Ël¥¿é˜¦j¹„‚øϸ3èm>YjŸÖCƒÕ¸ÄžÄÈÊjbÆn“ªŒUý©?ô‹ïðu«ÈÃWøìý#ë,M€¾ߥJBQlŽ‰âXè-ebtxÃ]€s<—ÿ¢:XÝQ…¸w¶²-N;N¾?Vl¤‘vG‰…,Å%ë9êçöË'bìη9|1.…±!]¹¶DšÏó=RԌݬ¤Iˆg‰=Åh_ìŸ5rÿ/˜ÿŸàÿ	tv…;0ÿÞâõ´endstream
+*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€Ž¶Xo³êÙ}U¹ôZø: hÁ‚)8f÷EµÔëÛDäµsüð¢ qTMŠ:ù‘ɸX!±l®ûÔ”Ëû΄,ñº17ýbŸgûŸ&fܽ×Y'jeAt
]ôÛïwV^þ%ÑåµÛR¼”tμ‡Ël¥¿é˜¦j¹„‚øϸ3èm>YjŸÖCƒÕ¸ÄžÄÈÊjbÆn“ªŒUý©?ô‹ïðu«ÈÃWøìý#ë,M€¾ߥJBQlŽ‰âXè-ebtxÃ]€s<—ÿ¢:XÝQ…¸w¶²-N;N¾?Vl¤‘vG‰…,Å%ë9êçöË'bìη9|1.…±!]¹¶DšÏó=RԌݬ¤Iˆg‰=Åh_ìŸ5rÿ/˜ÿŸàÿ	tv…;0ÿhÁõ¸endstream
 endobj
-1195 0 obj <<
+1196 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 67
 /LastChar 85
-/Widths 1348 0 R
-/BaseFont /UCTAZU+URWPalladioL-Bold-Slant_167
-/FontDescriptor 1193 0 R
+/Widths 1349 0 R
+/BaseFont /TJLKWT+URWPalladioL-Bold-Slant_167
+/FontDescriptor 1194 0 R
 >> endobj
-1193 0 obj <<
+1194 0 obj <<
 /Ascent 708
 /CapHeight 672
 /Descent -266
-/FontName /UCTAZU+URWPalladioL-Bold-Slant_167
+/FontName /TJLKWT+URWPalladioL-Bold-Slant_167
 /ItalicAngle -9
 /StemV 123
 /XHeight 471
 /FontBBox [-152 -301 1000 935]
 /Flags 4
 /CharSet (/C/D/E/H/I/O/R/S/T/U)
-/FontFile 1194 0 R
+/FontFile 1195 0 R
 >> endobj
-1348 0 obj
+1349 0 obj
 [722 833 611 0 0 833 389 0 0 0 0 0 833 0 0 722 611 667 778 ]
 endobj
-1165 0 obj <<
+1170 0 obj <<
 /Length1 771
 /Length2 1151
 /Length3 532
@@ -5374,47 +5394,43 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚíRkTSW‘ª¡¬òRIÕzX%2yj	 b,žò˜{CnIH@Ä•TeYÄF—ì?ØS1ç˜4	Gt ‘Íd³9$‘ÜïNÉÓš‰Q!hàò|€Çåz
-9DdÄ@PÖXG*f1QŒ ¯Ò™\ ÄpÊä¿ú°K
gfN¢o.`¥MÎéÞ$öקa:c0¸<²{¥/àóع"*´8£ÄÔø½‹•é)ë`ÅrSømýtßéíµyâê®cöôÌ…¦#[;Îo;eòc÷ù¹\Ç›~Š†?úÍy›ó§Èq§Ò‘ˆoX’×O=-Ê1d¬m½ÎfG7zå~Ù¬‡Šá¤”—ËÛÛ>ÐÜqϲؚÑäýðgÏgw³ÎÛׯ¹ÏáWQGŠfÖÞºùêI^ú¦Î~‹Ã×çP)%¹üÌš½pì?ï_x†Uc–šËó“ö?s}m¡¶ÝéI¿íhË¥v7Lþ/ç°é:å@'…s }±%¾L°Z&œ½Ðçzl…	Ø|èïaŠhiŽþ:{°›.ô0½ß#)È-
“ÄŒ.8V風] ö«¡ÚÂ
më[5èÅBkCTKzC׿„“Ñ´—¶.uüí·%;g>M~ñ¢ïù#µõ¡Âàaã~bFœ·ïÀ,/ïaz›jí³G‚\õÕ=BÞç°ÊØ®ù{à@N˘Änä»Ý<ú…§…K¹/×ì«ø›t½÷·Íæ=Ib áúñ@Õ£]j5঄'ö¥ž¾å}¹®ñBuˆk]áÌdsshhõ’æÙXï`Ð|×…~sDIÖh Úe¹Ø£+~ :—ã›_t\ès°ç¥ßÐO¥1榑#>‹ò쇶,HßÅ|½Üàû«ÝùˆºT}—oÝIóó–탢sQûÒ×FÔn×èæì=&hxı«È9÷TÔüƒ²/õ^›ž-§·Ó6\©{L8G¾¨Jeâ	g[ÛPµž7dqÏ~²ç—”öº'àȺC5†Ý›>¾µrÑŽ
¡Ã@ï €š!þ¼4ïÍÖÑÞ0­ƒ³¸¹#Ñ‚Þ;fºóc?"Ürî³ÖÓ?þ›¥­Ôúÿ[Åà:+£
lu‚w‘íÀ
j©ÒÔ¹Ñ 7ëå yš—ÅÝ,uý^òÔ5·d·‡´Ã¯NV—Ʋò¬½«Nùxkƪ„¨l©ä´z¹ÍŒ;3Çž”º[Ÿá›^ç7Vì‚oWF®­œð¿Û=¡Íw½2RÔùË™R¥ôM¢loê|e¶^×5/»¹»lS….˜áµõÌ'†/¹_66m¶™‡¯•DBßÙª:¶_w½ë¨ál‰è¸ÏÆwؽŸ[´šJý5.­Óí¯/³öÝy);æÃBó]¯X÷2qékÛ„Øú¡Ûò¤Ã\¡K“¢©Á¸çbU‰ãDZê`¼,º@Ñ~;eËêai}ã‰Ý;8‡T9%Ýs[f-ܹùg·Ç˲d•_¯8Ï/ÈŠ=Êëœó½çâb¥äž*×L»'î
ÏyøÃÐ{ö!£KžÄ5¾°ªúÎøV”H†¯t‰nµí¡Õu«›kÊ
-÷HçÖºlx/ÌépÇá5'ÿÝ%¼ÏÚǩˈ—¯O-wûVŸZÌ	é1>
-k]“
¡GZ±ǵ}M.íÌü|QYP÷]#ª”ÆÎëåù¿ 1²FêD{õþ9œ˜|V@û,|±ÀnÖý®&|þ]j
p삸5ùZï—£Q;ù/-É,zr1CN¬êáͳl|šy¸ šZ7Àþåÿþ'
-(Ô°'0O§ü†ßŒ”endstream
+xÚíRiTSבª¡¬2©¤j=,Œ)™4„„ƒEÂ(ƒÄÜrËͽôrIˆ8PIU–E,ºd¥Âª"P”ZbZÀ‰´ŠðËçCªVEÀé]°®®ÒŸïýzëóçìogïï|g3\"dbßáéÁeqE @*
åruæphFËIÇå$,\¡Ð¬Ö €·p"þ
+_@c€<]G ©*¸0'I Vâc@*'U°šª¡£@†+˜Ô±€EAää	gÀD&±h\.€	6©FcOj
+Å”8¼…!Mú»T&LdP¢€Û”L& DB8†ê+iì58Õ
¦´ü7dM/¤AÑ5rõdù)§þ–—«T÷W§kH˜R‚	l:5~+N
+CˆF==JÊQD!ÆRQxpW²8+ßâHF¢…¡„T¨€RŽfÀS8ŒAÓ•PþMé`GJ£bÃ׺ÿñµSÉ9‚‘QºtpþdOÅÜ?cÊ$Ñ‚‹ÃáRDj¿;%Mk&Á8„`©€Ç÷r‚ëhÔQè¹Á X`-¥˜ÍÂp’º(gr€'h“ÿêÉlÎȘDß<ÀNœ=ʽIìïOó÷ǵz<àÁãS­8+½€€ÏÉùQ¡!#§Æ‡2è]¬D(OaX+h¦›¸Â{ë§ûNo¯Í•Tw³ff,,=²µãü¶S¥Þ¬á>o‡ëDÓÏQðG¿Ûo³ÿ9nW2ö
Ròûé§ÅÙF½Œ½­×ÞhëĬÜ/›õP1œ˜<ãry{Ûêƒ;î™›Ó›Üþâúìnæyëúðû\A}¤pfí­›¯žä¦mêì7Ù|
¹•Ð’ÊÏ„ï…cþy·èêă`¼7Õ\žŸ¸ÿ™ãk½íNOÚmÛR¡¡\ju£ÔçåS«è¤q¤-6Å•	WËD³z^©(ú¸”Æù¶4‡I›=Øͺ”¾ßšŸS=ºàX¥ƒ¢vê\C·„ÚÖ·ª}±‹æ†uùi
]<ŸbnzÓ^FdÊø+ÆïKvÎ|šôâEßó7zëC…ÞÅÂùÄŒXw¯~™nîÃÌÝúÚF—x¹ê«{¤Ø/¤Ïf•¡]ý“ß@v˘Ä	oä9Ý<ú…«‰G»/Wï«øXºÞýÛfãžD‰ÖB	ûd êÑ¿.µð’ƒúRÎFÝr¿\×x¡:б®`f’±9(¨zIól¼wо‹¯ãBï¹vâDsPí2]ìÑ=PËvàOŒ/:.ò<ØóÒ{èç’hcÓÈÏE¹ÖC[¤íb=ˆZ®÷úÍê|X]Š®Ë«î¤ñÇyËöAQÙëö¥¯
«Ý®Ö=ÎÙ{LØðˆkU‘}ùe9QêÝÂ6=[Îlgl¸R÷˜´+ŠxQ•Â"âýζ¶af>1®Ïä]»ï˜úºÇ÷Hä¡ýîMßZ¹hÇšÈf wPHO—|^’ûfëho°ÆÆ^ÒÜ‘`Âî+½óc?"Ürî½ÆÕ'¾­ôúÿ[µÎƒg¯ŒÒsÐx÷BË	ÔR¥®sb@NæËþòT7“³Qêø}èSgÌØ’nØD2¿:Y]ÃÎ5÷®:åéB†U‰0ÙÒÐÓèr‹wfŽ=)q6?#6¼"h¬ØùÝ®ŒX?Z9ás·{B“çxe¤°ó×3+¤Jé›ÙÞ”ùÊ,¶k^VswÙ»
+m€‡ÛÖ3kõ_ò¾:mhÚl1X}g©êØ~ÝñjHŒ­š»%V¨å=?×™oõ~Náj:ý3Ì°´~L»¿>¤ÌÜt祬èŒwÝbœË$%¯-ãcê‡:,ËóDMŠ¦Þ‹UŶŸÄ DYT¾¢ývò–ÕÃÒúÆ»mvp©²‹»ç´ÌZ¸só/N—eÊ*¿^ï{^Ÿs.ˆßï7ç{×ÅE*JÎ99T$©9˜zOÒ’ýÜ÷¬G—<‰=[ZXð¬ê;ãUQ:|¥K|«m£®m®)+Ø#[ë°á½`»ÃWD×ì|vwwð?k§/#_¾N8µÜé[]J7°Çð(¸5<ÂŽ´â¶kúšÚýXyyâ2ÿî»FTÉ×Ëó~Å¢eô‰öêýs¸ÑylßöYÄb¡Õ¬û]ÿü»”ÁàØIkÒµÞ/G×í¼4%±™IErrUžiãÓ¬ˆÃùÕôºÎ¸hÿ/ð?Q@Âr‚ÄÕr"öo„:Œµendstream
 endobj
-1166 0 obj <<
+1171 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1349 0 R
+/Encoding 1350 0 R
 /FirstChar 60
 /LastChar 62
-/Widths 1350 0 R
-/BaseFont /MAGIUQ+CMMI10
-/FontDescriptor 1164 0 R
+/Widths 1351 0 R
+/BaseFont /RMTWLO+CMMI10
+/FontDescriptor 1169 0 R
 >> endobj
-1164 0 obj <<
+1169 0 obj <<
 /Ascent 694
 /CapHeight 683
 /Descent -194
-/FontName /MAGIUQ+CMMI10
+/FontName /RMTWLO+CMMI10
 /ItalicAngle -14.04
 /StemV 72
 /XHeight 431
 /FontBBox [-32 -250 1048 750]
 /Flags 4
 /CharSet (/less/greater)
-/FontFile 1165 0 R
+/FontFile 1170 0 R
 >> endobj
-1350 0 obj
+1351 0 obj
 [778 0 778 ]
 endobj
-1349 0 obj <<
+1350 0 obj <<
 /Type /Encoding
 /Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef]
 >> endobj
-981 0 obj <<
+985 0 obj <<
 /Length1 1608
 /Length2 6751
 /Length3 532
@@ -5422,125 +5438,115 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚítuTÔíÖ6Ò’J Cw·ô€ 
-3383´t‡ ”´„ÒÝ 
ÒÒ-%)!)ˆä‡>ï9ç]Ïwþzßó×·¾YkÖúí¸¯}í}íûfg1ñ+A6Pu$Ã’èÁmœÑ k„¿2Ü8ňØÙUPPk‰PµÆ@¥¦P@
-€RRRD줓;
-fgp™™róòòýËó;`ãþÈÍI4Ìà¸ùp‘NŽPæâ|…0öP€-¨è<ÖÒÓpiè™4 (Ê0p¶ÃÀŠ@C¹¶Hþ—#ØïÖÐ7XJh€5íÃnŽAÝÀP§ß!>€åC£o¾04ÀeÀÜ̃À`¸3ä7¿-ò!'ò&Ãñ&vf€DcÐ`Ì	¸©j ªþOŒ½5æwm4ì&@ÚÞdB`çß-ý‰ÝÀÜD1Ö0€ºa~ײ 0´ÜÚý¦ö
˜
-ö‡†3†°û>
-jg‚À¡hô
Ì
öïéü«OÀëÞÚÉ	îþç4òOÖ?9À0h(ÜV€(|SŒ¹©mC	þ^-„-úËqvúGÌŠú3 ®ß;Ã}C‚DÀݨ-‘ sSÀõ?SYà?'ò@âÿˆÀÿyÿwâþ]£ÿv‰ÿ·÷ùïÐêÎp¸žµãÍüõÀn^4@ðûù¿r­ap÷“ý÷DSè_ÿˆÆúfJ»)„„þrÂÐê07(ĆÛl­á73úã7A@ (8½ÑòÏü@1±¿ÅŒíaàçˆßC—ú‚" g~#ÏÞ‚ªúšêzxÿþšþÉ2¸QcìîtCì¿úÐEBþiüÆPVFº<ù"~!‰›Ë&$•òú7õþÿeëZcP07À“›¦…€Zÿ¯ÿ¿,Ë¿Á¨!ÀHÈï=a¬›Õú§ãwìŒBÝ(úç¶ß´üûÏ’C¡nP0ÑÌ$,蘒„)£}×5 ú¤½ˆÓä”[iü>Ë·Ù⓺$Uøì¢4H jPúªÞ}bËérU›g­§•ÎÙ’ÝÍdðbãn˺;ÏñQ‚wÍ_Ð*—4iÛ4Òso\g×\\èÑÚ×C#«œ<ÆÁ"(‚½ŸÜ¾l.Y¾TNœîxƒßVDS7’WaQ”eomsÄ~ûyÂÙÙÛÝõ©åàvÛ*=oz4!»Œ.)G„ï‹tzs“BÏW69ÀØÎ’¸Öà6.‘ùéšêE€ùaexÖs»Zƒòó÷Ô<·úò;óC«›þ'/ÑÙñ€†Yú•ó·ñ¶I„VØ~ŽRðŽj×ÒÞõ]ž÷ÐÌ	¦;®ß(Ð\.MÜêûüoÿd?ïs¢Î
c—xž6£ÜYXþñèÈ%gr…é GLwÑWªpVØ/:ŽI‘|C
–ãÕ}(X)QÌgfæ½kbO—Ú+rêÌ՛̋m_%-ïŸî#3
î7ŠÇG7¥àç´bŒ½62Lú ó£@ÚÛí¤Ì±Üôì:

Ê8¼2Ô·I•f©®¿VNî¾ç"4¿µ	L?Õª*Nsÿa ˆý¢ôœ„ÛGPÔó<•ÒÕ‚„D»b¹Ô=5y÷y‹GDv¯î€ÝÆ'ÂÀÂ>JèÐla¤dˆ/øûçÐö­<Z úEüYmñGcŒÌ$ôî}Ý]všø”,ü[Ë3håþo•ßœôj0õæGIѺE÷QÌĪÂ=Sµ†j
-a?±"²=;£€»òýÓY1“²aÄ\'ñéÜE2º_ÜrBebPƒ¢y<­55J+qD*á„‘C-Ÿn«Öë]¦y,%ƒÔ§Œ‚®Ž¾ïÚí¦ó$à”=+ª:‹º©ñ:›BŸÁÖr•–ô쿞䣠s¥¬i³ÐrªôdxÕaÕrCVäÁé
]—ø IÜ•ÏÙ¡óP5P%>äêÝEû/£?g˜’ž•Ãh›¥å¬ál5ÙxÞ§ø%í
-Rrd
”é­aAfµ|ù±G¡A;îR:?+ˆC§Ý‚ôò.¿v¶é²ö™ ØÆùܯF‹Öüp-møPžÁý뉴$Еçhð¿~)£¥ÒcE‡Cá¬' ˆ ù$°Üæ]úZÉë)ÍŒj(Hï;KDldv`ú¶Í –Ÿž›HSJÔÓûcƒuTf¾L)>¾9{rò`ÿ'-MË0šñ7BŒÈèôPÈè†*d¶g¹9«°Oë¨ñ³9¼)*úpĹÄòaõ¶À(“ÁDzØ_Oµ¯\"U#;íÒ¿N3vl†æÎ|T)D<¯áÔc=™-g¨ë2Ée3¶±cýD>¹¬ü•€Õ:atµ¾D t­"]àHÁŽh)…Gàâõ)ËVøÕÚ–»NÞ9ÀùÖEýĈjiTyf^ã9ù–ËÞeÎîçF´œ"ÊT Äþºá­·T„]ò°Øyãp6[qy¤3ƒÁ· q±4²¬×ÀŸÖ¥÷”á9J{`zò ÙdX}ªáA-`-Ïë·4ÄåPff¤œq[®øÐj5{1õ‡›vñÇûòöÔ)GñH:ç3s+‰oØS,_	gÓiv¯ÇNõ8ß‘Õ²¨¥ò`S÷”Ì.­­Lï¾5&ç´½ÉÔéï©ogaðåÓ`çžÚ~B¡É0?råžÓ½Çð˜&ε's,ârf4s'³c`œÉlœ¼)£Â¯ú¼ÓDÓÞ¤Éã²DÆ7L²eO’ªöìWtG ÐâDC¨ûâNé`y
-|”
-8T–’>úAç*º^îö3®fhCõÇ9™Îãüd”«\ö<äU‰ýe©e™ *4¡ ÜJjÐ/Ö­YvwÊrðù²"ìŠ/1^xx6"ìŽQã‚JŠT9o³,ì.™¾sÉ©½ŽIÜxH\5ŽÂ•‡´‹UxÉo^TN‹ÛÝ#VH{ßÐÏxÇÐÿAÔŽo¼r<l¸ðª³ÍúBâ…§j—qëуŒ.˜#ÿµ²ñüʧõ]ež„Öá¥'›MiõVB @ídΊ¹
hSÑ8fW\Yt0\cî”tÓ¹•1Òñ–„ö=ãf};Ôù±DO¾)þ.¬@!“ªÚvfU‘¦€<{¨¾ÔA²í‘®Î—Û¾ÊÑ17FÐÆ8®„¯Œ,AS¥pž`åˆ6í5Z_ÉõôýðGyRpixüìÒ#±¸ƒ’_zg”5,•/JÛ	7ÿ‹ÑÃ<¹;·ä5ômB†&—´ìÄÅ•Q¹ÞÌü™“ä‹Õ@(¯{»$E¤­aØUuà=‰D…!'¡*oì.܇3õm¿#°»Y' E5+*f7ŠcºvëE·ŒaÂ×Kõ½agÒ±SžëjŸDÜÀnKQÚÐ=yàzÒrtæ ¦Ö¾<‚pÆ)&þ ^™i°ÿ^yGè±æËQd‰×¡žù߈b½`þM’¼ÓK`Ø5{dúHïdÙÃæ/¬ÄƒÚBk
-ÅóŽà±—­\º©
žÙ×´m¢,ziº¸=[mI…jk)<Â4Èwoï1±q×tÖ-¸4°E‰ÈÊC.Æ,^=ÕÚ¤‘H\S"MúZ]÷yÕ'®Èo×Kñ=Z_1{þ»xÀ³JQNŠ_W¦{I÷«Ù¶GÅlrJ«±šd¬¿tÈÕ]}<› QK ÚfSç7t—>À;u¨]™bDÒ´N¼éT'¯Ž2}âÐmÃÞÓ´ß¾³Q%½pUNË`ó«xx$ïœKÞ”†£êTéÄ›”ž¶ï: ã½žƒ1P¥¸×´P˜¢ôÃÞ§Èón•‹gšÉV½3gj"A`ÖÝ[8Ô‘ZTÉÓÈ.­…Ô"Ë‹õ‹´à&½q®.a¸_ÆZxþüc Nuµ‰þgúÞÜвHnªfüâiàÈ뙨ª~)š‡Ð8ò™àQVŽ@¼¤c1qËò„&ö짠ÕâንM‰€õi¡ËY½ë—ý»û—ðùD·è#éª^3½«ÎÖþU†ïèö\‚3Êwvßíñ›U+šKλO®=Ö\‰ô¦b-äÒv˜Ó^¶,þBõÚ}ßïIŒkѹÓ&IŸW0êãšZ•t^­FGœ®¾«ûÐë1?ö>HÙ[]œ Ž’€ûj²?<Ò?qäÐ'e,ÝcEÀŠÝášöçàž7ü’?å@ª·Ä¹W¸ðív+Ñ×,’”M‹Ì£±]^Ü9fŠ‹¤Ù¸sÍ:eƒ”'CøEjíyâª;N}6s•Ô2þ1q÷
-íµcªîy5`j8NÙÜq#(t.«[q)ÉMì»
º¨¿÷,J΀5J’ןl™–r!º©.6(!’r˦ë-‚к‚n‡_€´} îDÈtr]Ö)cršLÁ¢G3àç6~²
D--ýNïð™aG¿²­Ÿ½^§Ë»¿ØGÔsn.p7mB(«â뽋P´‡×ÔNè
-+®“Ñs¢§˜òJŸóÜãÖnçvók}ƒ%ó¢òI2¶¸×‰Ë÷Í#|æ8¸œVuä-¸k	±3gzn´¢°oo…~ÏàUòM^{û¼L|ç‰<ÏÎkùþ3žˆ–ÞÄÅ«_ŸüIGÕHç‹•Yý.¬g¿â% 	ÊÉœ¨¾^øÉJ¯$³‘=THÐ4ÎHe^"ö[`
-¤çS–7þp%ÿPhÌÉÝþ9™ê“”=zn£TEùÖ‚prŽw{^aÇÃ}Öíf¤žÜL€ã	ésˆ¬;xúFu¡f«9eü÷qmï¢o£b̺£{¤ªÁr)ýÖVfñ0%ñnû˜vÂ.å"[eÀÊ[ŠaöTq&bn2
»SdÐèw)úÐ*Þ×ꩵW®^ jxõÌ­ÛPfÙñþ7éõs„T0Vé–·àö*}åg¸|+þ”ÞYÈm|À+áÙE%)ˆ@Ÿbƒñ}_@.¼qúË,C‡v‡Ž=wêáNå¼SXDŒb¡LÏþGSÎ’oRXvû±£c/$ó·Gf^ÒkËÑ
-›´d·EuÈ)˜dK¨bÆ›Q/.K
¼„‚’¾Øsñ¹fL„
-O›[>`³ó¦Q¯fiXWowÎÍb÷WתXü¢÷!Ãà|ï«Ôm»¤žÙ÷Îøêç¥ÝqXZ$[Ö+îæÚ—Ò°Û¥¿ô¢ D³NŸ}f²V—›Ï‚ÎPÌSuÿÖ¾[j‹HχëQÓÛt\~úLÚwBÌM„R0µg3\lù턹MÔ­ä}zŽ§&®ùkº“Dyâ-ù™“öž«Çú2m|™þÑú‰1Ÿ>¢ä“n–ˆXꊴmXë¶aJYÏ}²L™ézÆìûzøb:׽ߢߔëÖ
f/²Îe®ƒ­ûTˆg¾0ë½)nbº6yº¯Ñv`SpJr¯”NQ`WΗØRÚˆQlËÿ|„•¬PäÞÖõ»V £ÑÝÈhÙOç™ßœÌ%¬¨Í]Ae¥\ótÝfÀé±E^•¸Ë6©‘@žL™¥E>‘_ÅÔ.	ŒòSöYo%ŒNOw21Í'4J:¶×pâöOØg°¿Ñv"¯]—šÞ¿@~Iê5ÒZ¨€^Ðfò°­„;5ä3ÓYQdž¶¹9žœà~n—ÿ~Är׬å<*ÄælË7Kõßu;rÆõåäΡ®5³r^f ‡®·Ö»sßêÚ¹O¾è³òVß,iN6r½ý$tsX§*;]å]ÂÝÛâ÷㦇cÃ}Úªveúñ4˜Ìçs¥rŸ0Ú‘™Ð@ËÔ¢æDàeÜÇs4¹/Lø)ÂaI/F,ì(x—s´9,*ÔO7ã´1øï
-GoãÅ ÕJ¯E˜QEAN–£oô¯_±u¯x3H3ŒøI%\Å4rÕ‡¬~«¸™ô¾Ù«Ÿ¦¦4¸¯H~–š±ê.ΡP†]­4G¤Ýñ9˜íl¯÷TO´{ØñRßÞ«ÖU¼›7µ¹¼žÒ”È°"¸·­ß¢ò|ؼSí;çQž±ÈÇÑï·ܨ¢]»¯Ðãþbÿ›gÝ^dcŠŠÙÌãÒ`&4>ë/MÙ×F„ªÓÄŠ§Ñ|T¦3½’ò·è[É*gý™Çä7´f_iu¹`æ~á–ö|²¢VUZè_ü w±¢y¥Ë;:ùD+â[ù‘éŠY†šEõa(¹“ªb$°Ò&P¤æ[w÷c¶ò—~¡
-V.‰L„Äu-ábHovWîó±Wƒô½Š·‚p.•†¬Zã«ž'¿°šqäÿ&<ŒÌÐŸëà©ò”çȘàÓÝhäx3y‚{È­x>ty€´õ5
 (ή•m“#UxÆGÄÞî 6I¬™Ïw…—ÙìÑx?åÊ쬚¤š ;qè$zÔ>€ÑâÚwcyÅŽ r‡ô+gd`ƒ†m›ÍvߣR+k®Hsm³Á¯}A{}ܥɩ‡\ú¥&îÍsæÞYÎ×	t@übWdìIjÐSTqìš¾îÎ}‰Ñ}’•÷Ü)×É×ÆÅldzÖ”þ‡“KbJÆ(ß²Ìà)Öð¤mµô
-жý>Bŵé#5Z%ç›o¬¤]§ÙÏEÕ`œVã®vÒ—æ$Œoµµvej¾
ß6e¸—’›4óÐøjk½-0÷”Ì©¸ºn…_ÄÍŽð 2;åùÈbÜ?5Fõ5Ý7§ÊÊ»šè¼§ðu®¤”U”±·ÆâáEÀ¡Š0~Ü×N6´§Õ?òd‘öFdeG¯\-]?^j~ÅÓ–£§¡¶âs·b0࿃Û&ow¯ÖæRÔ¶¢BcĈD^·8ÖÄÜK¬)ÁÅÒ½}‰™îà=Ý;,'ÓÇ”{}š»“‘!¢ÜEÊI®g ëâdï<ëIŽšfý¿íÒ”|ÿ0¨—¯ÉzjÎ,v§,Mý‡ç¤wÔÓ²‡%.ú¥ÜÈ]MÜŽé;w¸nU™²ãˆ+0øÿ:1ÿd“ä"21Û…k!zkÊlÍDD‚kÕFѧ¥ÇÉ„Œ¯1SöçOqßéË¢2eŸu-ò‘ö4ê"®‘õºç4aÌ{âxP9¹HµR÷¥#¸|#æÇ,v2SáèÀê­VÇáÆñÍ&m#`b»JºÎéì ýú›Q+EI²©á$8§<ꇡ›Óç…oÚÎÚãeØró¾µc8™&[Uå>Tƒýòf·ßxõÜË=üÂÇØáÉó-”íÍ«W&…P«^Y§4XÑzήhjG
-¹I»ÎØ/.^¿v#úNûqÕJƒK²óY°œ}Åö“ÎããÀ{!¡ôñ’ý¦4RÏN¢_Bo	TΨ~¢×{Y¶_MNA"yZ‚àŻƈûÓ!Ä}vwRC%fB@»­Gé¦Ù÷ºQc(ÛZa}6ÆÄÄ1Þ»œžÛ[âÕîU«d5µ{›
-vˆ±
-ÞͶD=­-z¿áݸY,åóS-ú–Óºµ²ú@6WptLZJ:ò]ïebø\û*(R°ô;1î3£á«W4é
-*ìÝRÇBáªwx¹:á&ˬ3$àòK6ìþŠë/ÜÀ¢§ÈRZ«³H‡ÐN)ª-šéJZ
- ‡•*ÆÂÀƒ98cÂ2›a]Ž]ù±ÛUr©aòºžmº9¾ª&*è»Fæ/b3Èèfr*ݾ9Ð0Ç€%¢azcDùzŒ˜NÉ$Í粿"²G'[DLŸUfÿ(p^RÑ
-/Q‡ÏÉ™äžE/nåÄJ÷6c¹L\y/Ô˜0’¾|Ù:'Ÿ_©…dAeº»UO¼é¹Š,Õ&7 å›/~–ÊÈ.Co-Gn‘ïCèJRŽX)-¥yÏ,¿ž9pyO:ò³föˆMìPF#¢‹å™ß¡‚PMYíÈRBü\¥Øëé“o 3\Ñ)÷p÷Éue2Aì0.Œ>ÒÉsE>rÝâðN7ˆhükvŽ¸èÔCdØ›RZ‰‹XìjÍ[èù#úÿÿO€áPkéhzNôÔdždendstream
+xÚítuTÔíÖ6Ò)H©äR’Cw·ô€ :Ì08ÌàÌÐÒ‚RÒJwƒt—´””¤’‚H~èóžsÞõ|ç¯÷=}뛵f­ßŽûÚ×Þ×¾oN6C€2eÓ@!±@Aa€>ÜÑÆ#uTP(àÚ)NÊÉ©Š†±pR
Œ…ÉÌ`P€¥¥¥I9ª('w4ÜÎà156ãåããÿ—çw
+ÀÆý‘듸ÀuýáC œaHì5Äÿø `ía[8P50|¤­¯	àÑÔ7hÂ040t¶AÀ!]8†ÄÀx¶(4ñ—€ PøïÖ0‚×XÊ€q‚Aà×Ç`n˜Óï?À	†v„c0×ß8`‡#±×3À¢p$áýMàÚo‹úCÈ	ºÎp¼Ž]ƒ¢0X
w®«ªiüÅkÆþ®_‡(ÛëL(
+âü»¥?±k˜ë(GbX˜öw-
+Ç8!Àî×µ¯ÁœÐð?4œ1p¤Ý¿ðÐ0;0Š€a0×0×Ø¿§ó¯>ÿ­{°“ÂýÏiÔŸ¬r€c10„­ )Päº&{]ÛŽ$ú½(ÚH[(ü—êìô˜ýg@<¿w†÷šŠB"ÜP˜-©>
+{]Àó?SYð?'ò@âÿˆÀÿyÿwâþ]£ÿv‰ÿ·÷ùïÐ΄>Øñzþz`×/ øýÆü_¹`G8Âýßdÿ=Ñöâ_Aiw-…° ð_N8F{€-q=£?~S$†FÀ‘°k-ÿŒ ÿ[ÌÄy†ü=t	é?!úwæ×òüá-¤òÐÂ@ù!ßß_Ó?Y†×ªcMÜ®‰ýWz(è?ß**(7€§PR  *,y}Ù„EÒbÒ^ÿ¦Þ à¿l=0
w<¾nZø§õÿúÿ˲úŒ:‚‚þÞŒ„^¯Ö?¿Ãg4úZÑ?·ýºåØ–sƒAHg&QÙ@‡Ä”$lÙí·ÝƒjÛ[xÝAN¹•&ï²|KP->‰¡KÒ…OÏKƒ«†d.ëÝ?m:]¬êÜ_ëm¥Gp·$Àv2™¼8xÛ²nÍs}ä[ó²Î¥HÚ2‹ôÜÐ]Ä·~¸öeÐÈØ:çœyèƒ(šx÷'¯/‡K–/í½c§›Þ7ÑtTU8ÔeÙ›[\±_swöõtwµì´­2ò¥G“pʺàSpEø>OgT´0-ô|i“Œí,‰k
n3åŸÞ§¯^XlT@f=·Êa5h?O­3ëÏßq3ß·ºty‰…̾4Ì2®œ½‰·Mº'´úÃöc”¢wT»¶ÎŽïò¼‡VN0ÃQýÞ`ŽÐr™XâfÿÇg©ÒÝy+é„ÊÀ¾ق§#µ¯Þ<¨”/%‰Ñ¤}˜€±q]óSä.ü‹{ò¬j,6Û'ÐÖÛGþruøÛhŽË{tdI5»ÐE¾7¶âãÖOγ~'ºÌÐ0¦pÉgiÓ9*åå]r&WXö{Åõ}¥§…bعȗpôP9aÝû‚•¥|VV¾[¦ö©}¢'Î<}É|¸öU2
+þé>²Óãx"LS
+pN;Æ„Ùk#ô6?ô¹MÐNÁËË8È©ÛРb‰Ç'KG@¡M–¾ü(F¯è.š•LDM¤w*£ÖH]1ì'ND¶gg1pGa`:#+fRî<ŒŒç8>·HVï³[N¨lzH,ƒ:ïþBkMòJ©j8IäpKZ½AÑEšÇRò@wÂ,äzîèûN°Ùn:ŸIAÓ»¢¦»¸ wŸe„M™RÏAÿ¯Î7í¦×Âqc@â¾ñÀ‡ûTœËcÚÒ·<6KÆ£ë’Ëll¦l˨?—,j'§œÐc{Ò^ŠñM!¢0Y‡âR+1ÙZ­Þ¦8½# /õ0èL9kÚ<´œ6=ÙQuHRµÜ¹2HÏÐ-1Dwészà<\ÍT¹|{ÞþÊìϦ¬oí0Öfe5kô#[].žïÉ QI»¢´ÇàzB?£
+ÒÿΙ˜¾e3¤í§ï&ZÀ’õ‰åÝ‘á::3_¶Æœ‚ˆÈ‚39yh K[Ë*Œ~âµ03*:=:¶¡F
+í]nÎ*ì×>l|ÏjhŠJ£;Øq/±½_%c1üÐKûë‰Î%±K¤Zd§]ú—iæŽo¡¹3T‘Ï kxõ8gË™êºMs9LlìØ»¨&—U¾³ƒÆVK@Wª2ŽÔœ(€¶rx>a¿Š\…_­m¹ëäÍ}¼¯ÝtùaVÆ•§5ž“‘o¸qì]æì~nDË+¡ÍãAL/ÙúKEh‰Ø%Ëí×.ÀAIg󗇺3X"Kz+c«ÊpM¼‰i=FOYþÑô{fÇ÷šMG4¦îÕ0
+|~KÃ<eæÆ*òÅÖ«Ù‹©?ܤq‹?ÜU°§K9ŒG18ŸZXK~Å’dûŒL8íœN³{5~¢Ïý覜¶e-­‡†ÿTîHiµXezÏqyß ­-l¦®è@o};“/˜&'ïÔÞÈcj-¦ùÑK̜ަGô¡ž]Ù#Q—Sã™›™ƒ,æTM~Õg¦Zö¦¥¨û.K”·2!ä»Qöä©êOEw
+/~J`
+u_Ü.*OAŒÑ‡ËRÒGBßë^F×Ë<…âk…6Ô?ÌÈËvƘä' ¢ì<Øå³ç¡/Kì/J­Ê„Ô`	åf0
+Ãñ­²[SVCÏn¦¸PÙàV|Žñ"$´åtŒšRV¢­Èñx“`óàtyÄò+H^ýULâƲ¨áp4¾´]¼2ÀKáÛÅ qå´„8™bÚ»†æ›Fþ÷¢¶}ã•a£
¤WmÖgÆ/B5»Œ?1ÉêÝw¸R1™_éz^ß]æI/=þÖ”Vo-ÔNæ¬XxÑßç}S2‰Ù‘PŠƒÔC:¥ÆuoäGŒv¼!çFC|ÏÆyÙßw~(ÑWhŠ¿/P̤­¶YU$D¦)¢Oh,u0€l{eªóå·.st-L·cWÂWF—`©ÒxqrÄšv
+Á—*}?¢±û)øô÷ýìÓ#qxƒ’_xg”P	7,—/ÊØ‹4ÿ‘‰3Â=y;74
lB†'•´lÇÅ“–ѺފÌü™“ä‹Ó@¨ GP’À&ÚÖ0âª6øŽ\²Âˆ›D/v‡áÃúfÀ‘ØÓ¬¦·›Å3[»ñ¼GÖ(áË…F‹þˆ3ÅøÉý«jŸDüÀ+±Û¡»
+Àõ¤åè4ì~M­}yÉŒKLü~¢2ÓpïʶðY ©$_–†ž]šý.¡þœèÈ}7õ
+›wö ·$7UŒ‘›UõzL.·FxÊ6¶wÍW Ô“ÄR©#-]?ú¨C—JR`“ziÂÙËow¤3ŽÖ8[ÅpëJ„d):šE›8”¶•µýµ”°W]±?˜eÚdBµ4­1楲(¹)!ÇôÈ@‹Ú!«>±æÇQt‰„Ï¡^`ùȘ“z½`þu’‚Ó`ØgdúhßdÙ&Ó·_8‰ûµ…`jC¥³®àñ­qE~;V8Jï0BJÙóß%žÎЈÉrSÿº4ÛMº[ý˶ý;:æ·Œ:»iÆú‡<|¹õ±G³	šµdÒ-
#w™}‡ڕÉàafÃqë§×TÕQfzc8{›öÚ·7ªd.Ëo3Ù<Ã)Í;ãQ0£çª:Q¾'ù:¥·mÔ»èx§wT)á5-	¡.}¿ÛyÖ£zþT+ùáªwfãL­q$¾s.r_›6yÕ­½Zdu¾~žœÀ¢?Á“€Å'	÷ËXÏŸÔ­®65øÈÆØ—»ZÍMÕŠ_<	}p9µB; Mÿ–@=:ÌÊŒ·“r,&k9EÓÇžîã´Z>X±¶)ô£;)´f;­wý¼wkcï‘¢è}(SÕg®ÙÙ:°ÊTâÝžëB|JóÖî»=Q³ZEsÉ™PÏñ•Çš+©þtB¬¥|Ú6kÚ‹²¥#Ÿi_¹ïù>Žq-:súFÞïÀŒ~븦^c-“W«Ù§gàê>üjܳZ6ÇQ'¤«,辚ìˆôO=ðIO÷X´æt¸ºýsh×y!²/ÝWâÜ'Røf«•ôKyÊ7ËÌÃñ>ü9Ýfêó¤Ù¸3.­:ÔÇÃDEêíyPÚ›Ný6s•t²þ1qw
+íubªîx5`k¸N8Üñ#¨u/”ª[ñi¨Lí†z»é¾.JÍ@”4K’×oš•ò »•hÏ7h RH*«¦«M͂І‚‡_€´= Þ§é京æä4Ù‚ç÷IÎ@žÙøÉ5¶´8½%2a…þʶ^p|ú*x!ïîb?iï™…à­´OÂY_¦]„£=¼¦¶CWØñü‹ž‘>ñÀ–Wúœåµö8·[\.Y„h•OšRrĽJü´|×"rÐgŽ‹ÇiUWÁ’·–7söçF+—`3ô{Ÿ²ïðXòÚ‹ØgeÛîo¿RÈ8½ÑÒ—¸xù«ËˆbLb¾X…Ýï<Ëü…0E\NéDûàÕÂOvFƒ ÙÔèáBâ¦	>@*sð™ßK #¿Š‚ÉÏ€K…ÂãNV˜öÉ´]Òö˜¹U¬rÍK’É9¾­yÅm÷Y3Œ›±Fr31ž'H´ß!²nÿÉkµ¤º­Ö”ÉCüGµ}‹¾J²ëŽî‘jÂÄË¥Œ››™Å#4d;Uœã.¸	;4‹•+o¨G8Su'XÈx)5íÍPAcߥ3@«„_fè¦Ö^ºzèÕ37`¬r¯Ó¹êçHˆiáì2lo íU*Oñù¹Vüi¼³P[D€—"³‹ÊÒ±õó»þÁ\DãôçY¦;<{ÞÔƒíÊyM–°ˆ¥BÙÞ}ƒfÜ)ä_¥qîàFÇžKåoμ`Ô‘¿-HeZÐ’ÝÕi(¯hš-©†ÝŸhF?¿(5ôZü
+JúlÏÃ_äšñ)Ì(PdÚÂêë¸7¨F5[úF»sn^§¿ª„¶pÅâg}„%þ'îwþ±Ê=¶K™qoM.^Ø…¥Erd½ä½g¡s!'(ý¥#uúè3“µºÜ|tŠfBjø·ößP_Dy>(X§ŽšÞb¸çòÓçÓ}'ÔÂô^(5Ócé N)’åòÏ =¶]ê£vÙõSF9 ig{ßL›®ï­ÔZ¯7ÃßbžZS‰
¾Ãää*]‚»·N‰áW^ÓOî‰ôè£)îÀ»#
+1Õ,6CJíVØ:ÖöúOn³G¸3e†7î?+Õ§âí5×HB™u×(Óø.RÄì¡ë¥Ž~Ý›ÒKÐÏù{êÑ+–±2¤òƒƒ¶⇧B_$J;	k°=HFøœäÓÀò†ÏxœnV[f-Y•8Å„ŠM‹aùˆš¡("öÐ`D]€V•nÆ8<Ô·‹¬pwüøÀÝ‚ñ.úꫪɇ‚äZÓ=^w-X7>+Åõê3ÐE¹§‚ÉÞ=à=ÿ¡/¸:AlƨêZ¬i¶µ8üL{/Qº^¼ü2‰Ö>²Ê^ŽîD¬äýxrž"3&ŽcþH$müª6NÍ–ŽÝQlÇ´ÌËô1ƒ·/Õ`´2Ùž?P _¿Âù%ÁÆ’`iž73œdÔÄb%(,Àí1}^ÞÇH9ƒý¤T™–ó4xéÐÈö˜ùMɼ¼v÷à|¹`^ŠG0ÐdNÌ"RŽ¢ž)ú´ÆëÅþ(<•fù]‚óÛ¼1@È™|“¾Î+)ˆM&Óâä÷x—_³¿ª²ˆgjÖV¶‘Ó•çsØ9ç‚CXšRvtV°¿Dö]½Ò¯å`;ÿl«<çËw@&¿ðO„ã}K;?¡–®ÓÆè­fm,ÌùŒÚ¨ÝÔvW:÷1³]¥é =¬L=jNQÆ{4GŸûÜTà€:žôbaÔÒþž¢w	W›ÃR¡být3^“ÿŽHôaLF½ô*Q”]„âf;üÊøêÕ0GçÑŠ7“Ó¨ŸtùeL#OÍHÈê׊ëI|ß55¥¹ÏóhEê£ôŒµpOqµ
+ür¥9"í¦Ìþlg{½§F¢µøƒŽö^µ®E¸|©Íåõ4f¤FÁ}m–•g#Bß9òŒE~®¿eàF}£ØÚ]Å^÷çë_½¸ëv#STÍg•n³`ˆ¨Ùiɽ2&Q›&S:ùÍO`6Ó'¥@pÈhÒJY9ëÏ:®°¡=3ôR»¨³È;÷ë¿´·Çv˜NMya`ñ½üùŠÖ¥ßØäc툯å‡â+æê–Et¡TNjJ‘ÀJ›@Ñš¯==8ÊÏ]„+Øy$3‘’Wµ$‹!}y¸Ý¹ÏbÄ_1ö)ÝÄ»P¶n¯z–üÜzÆQà«4ð 2@?r¦K¨v¿ <8GÖ”ˆ   ‘ëõ$ÿ€× ðløbeëk@\œ]+×&G¡2ø”Ÿ"ˆ³ÝA}’L+Ÿÿ’0³Ù£ñnÊ¥ùi5y5qOâðqô˜}³å•ïÆòŠÝm€êMŠ/Ü‘
š¶m6[ýKÉ­Á<‘:æÛB_ú‚vûyJ“SxJMÝ›%ç,¼³œ¯6€D
d®¨ØãÔ 'èâØ5½í»’c{ä+!îÛ¹	Ò®“¯M‹9(õÁ\4þ“KâÊ&hß²Ìà)öð¤-õô
+ЖýRÕˆ½éF5ç«1_¬”]§ùÏEµ`¼÷ûÖ®v2äÌot´·fj½	ß2e¸›”R™6ߧ÷ÕÑ~S,há)•WpuÝ59›ÞCgv(ðSƸjŒên8¼kA›•wù©óŽâ—¹’Rv1Näî›t„Y—ÒäQ;9ÄÈþv¬Á¡ ÇŒ²|?*'7vuèjåú~èBë¡Ž<#=õˆU¿»ýcÃAÿmü6»;
·m.Äl+*4GÉôð‹cM-¼Ä›\¬ÜÛ—Xöß1¼Åq2{D³Ûÿ¾¹'"Æ[¤’äz
+º·.AùÖ³žü°iÖÿë}É÷÷CúùZì'¬â7ËÒ4~xnCûÆ<­ÊñØâ¢?ÓÈÞÒÂy“çF•'ž„"“ÿ¯c‹.›$ÑO³Ýø–b7¦Ì×LE%yVm”|ZzL9(ù3å~þ”ð¾(j TñYצmO£+â9Ç]¯{F¿ƺ+A“—T/õxWê0ŠïÀ?jqÄÆeg(;E¼Ž	, Ûlu¬QiœøÖ$¨CoL¬àTM×=™bc\=f¤.I63š„ä”Gý0rsú¸ðUÇYg‚x°wA~Þ·v</Ót³ªÜG’vh@Áœ Øèµ×€á܃ÏüÌžlpßB¹~мFõARÚÅ08¥ÁšÑÄsæ`
pÛ¸6Ñd´Ð„—¢û”óüüÕ+7Òït±V­5y¤:ŸËÛWŒã>î<:
+¼Ê/5`F/ýô8úì†`åŒêÓ6`p¾”2ÿK›@A3!Õ}µ¬çIkY£ÞÙQÙ7åÃ9òå–Ã4ì›
+æ{ä¬ÞëP:°{f¸þ¤ïu!3)éfñ¿Õ®i,¦ž]||®3÷D…<ìŠ0CȆÅ9OÝ9ªâ/ЯӖ*
+E¹?ý¡UŠ-ÀR7ÔÕŠTvîO湿|a¦3“>«ÁÚ¥‹£zg¨cÀ+°Èè06U›¨¾¿­Æñøö®6ˆG½…Ï}ÑÇOìj7Ëö‹é	H4O[²xËyoo:„¬ßîfBj¨äLh§õ0Ý,ûNzm[+bÀÁœ˜8Îw‹Ûskó\¢Ú½j•²¦v÷ASÁ6®qÁÛÙ–¨'µEïöÎýq×#‹¥}~ªGßpZ«hfÓòGÇÔ©§¤£Þö]ô*…ϵ¯‚"…Jop’á?…Ò;½|IŸ®¨ÊÙ#}$n©vó¹—«~²ì:S¾€daÃv᯸Â
Fê,åEñ°:Ëtèí)%õEs=)+AÔÁˆŠbÅ„qd(gBR&ë`3¢Çµ£0NP%Ÿ¦ Ù¨WáÙ¦—ã«fªŠ¹elñ<6ƒJQÉqŸa&§âÀí«=k|D2®?Nšo©ÏŒí”JÒz&÷+"{l²ÅAÔlñieöç%Uíð
Äœ¼iîiôâfN¬L_3ŽË§KïÅ‚bfŠ/ZçDãó+µQl¨B lOÚ±7#O‘•úäÆ>¬ü[ÄóŸ¥C
+rË°Kg‘›T{P†’”CvšF+¾3c«ïgö]DßQŒþ¬™=ä?ÕŒèf{êw (\S–u{t_9!~®RüÕôñWЩf®Ø”{¸ûäº
+¥nÖåä9¦½jqx«Ä4ù5;GVt@á!:âM#£Ì†C&~¹æ-ü¿ü‘þ€ÿ' E9‚ÑÏHÿŸžwendstream
 endobj
-982 0 obj <<
+986 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 36
 /LastChar 121
-/Widths 1351 0 R
-/BaseFont /DOHFNV+NimbusSanL-Bold
-/FontDescriptor 980 0 R
+/Widths 1352 0 R
+/BaseFont /BVZOAV+NimbusSanL-Bold
+/FontDescriptor 984 0 R
 >> endobj
-980 0 obj <<
+984 0 obj <<
 /Ascent 722
 /CapHeight 722
 /Descent -217
-/FontName /DOHFNV+NimbusSanL-Bold
+/FontName /BVZOAV+NimbusSanL-Bold
 /ItalicAngle 0
 /StemV 141
 /XHeight 532
 /FontBBox [-173 -307 1003 949]
 /Flags 4
 /CharSet (/dollar/hyphen/C/D/E/G/I/L/N/O/R/U/a/c/d/e/f/g/i/l/n/o/p/q/r/s/t/u/y)
-/FontFile 981 0 R
+/FontFile 985 0 R
 >> endobj
-1351 0 obj
+1352 0 obj
 [556 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 722 722 667 0 778 0 278 0 0 611 0 722 778 0 0 722 0 0 722 0 0 0 0 0 0 0 0 0 0 0 556 0 556 611 556 333 611 0 278 0 0 278 0 611 611 611 611 389 556 333 611 0 0 0 556 ]
 endobj
 801 0 obj <<
 /Length1 1166
 /Length2 7745
 /Length3 544
-/Length 8567      
+/Length 8565      
 /Filter /FlateDecode
 >>
 stream
-xÚízeT\ݶ%šàîZ÷‚àR¸C
-ª€B‹ªÂÝ!¸	îAÜ`	®A‚$M¾ûî½ý¾ûúWÿëÑçü8{ϹÎ\{ͽΨ±Ç(v¿<ÄÕªìê‚âJ´`ÎÖîH=°‹¿.ÔÎpŠ‚ñØÙõa('èÐ÷Ä3Œ‚¹º(‚Q÷¼¾½;@ŒB@) „”¨ÐýøøŸ®)svõ€ ((Â	ærO)ºÚ¸;C]Pzîp¸
-Ñ…"]Ý6P¤Àö~eÿ™ðÌî€ÙÙ£\ºFܼ¼|ÿF„$%%ÖÞÿdŠP$ÌÎÀq?ð€:¹Âÿdº—Pº@÷‹†ü‰Ù‚• 0ÔŸr\ö(\JPn†ÞcH[(Jû~¡J.g®ÎxP{¡[+zçûA`Zlò²Mµf^Ê0Ù܇+³ÁÞð4IV…â.æ+krÞ>SP>ad÷6ªøR,ŠQˆCïôÑSÏeMÈtÖˆpøYáƒOoêòªÏp™yn·0»OG…=kSŠÀ˜–¯T°N÷î¥a"–˜2­Ô?«ý%Ofô‰i2±ÝK-±‰ç©ìÙKGŒàª”‚f…²hGÚi“­§á͹ÑC‘·Öw¹QçZfÝFótVmpX& Ÿ~€sÎ݌ֿ*„½øÇÞzQ1j·Æ‘´m gÂêCNÌúÆö¯ö¨k9cY-A—¥€ÄfŒZA™çoð‹’¾Fž•àŒX¼‘NSPX”ÑãòñnÔð÷º´Ø’¿~Žæ€©' ’‡rÕÎB˜¬'nÐ`s’ÒÁÓ÷œ‚”§uKœg4c.T•üK8qâøö³†®×_¾‰+ìe~ýí›6±<ø¬<¬pXŒAzãßF:‘cÐI0PŽ
-xWÍW?Æß1,6¬O°±’$,-v¡Ÿ½”Ñz}¼¨]6dÓÄ-®OXÜ—U¾ìMÔNÕ÷ýhô¢ºŒÛx:U‡SqÀS½õ€†§½žo€s{(t÷Œ?qöÕFœ<«Š CB+J3àÉÇwÌyØ—ÊiÇ­+¹j!²G©Ávb!þäñÚTÁ¬NTúëdB{8UDÈÖ/´%UÎÅRëƒç…/Š¤ëuíÇÉÌÝ•fÞèpW¥«;.$Ck²ùFBºH-X:(¡Ôe„­K·¼1"¿`å¥M6×zÉ^Lç‹„¹5ïÁÆ•=ì¡ÞÙ[8µ?]nY¶+Á&]£hàåþcT‡noáØ–æDw)¼†r.ä¼³¿ì­;K€ôN:òÅUšŽ\çëЙ¸0ò·–uq'©ž9Þãh<¾VÌuž½zs
-eÓòárø÷63æû¯É^£2Ï «Œ‹Ý·-ß.p±ü+®„1ùò¯]p1×^'^ÿ¾y95Ží{þÞD9‡¡ DdäF’{j0`¢ñsOL…x~W¿ŽîO7I7'U¼úÆ6ÙRÆYÑZ$Áδ1¡ükÐSò™.ȲI	ÄûJ? ©Ç"â¸?qîg®ÎzvxÛ*pÊ|!où±U_côRò;ºv+u.VÇ6›F«q•PDšWd_vßê›ómëìÖS¥S©Ó±Øk¦\a7뇢ÃÝ,¶cÙßõLãÕ†DŠ}5™+U(8ðQÇS3U“«NÝFÔXt¤þ4„vš{¸½p<«åY‡µ×bš›q²Ç®ˆ]ß²â|V3Q@*bCHô˜ÇN²WB¤X>:¼ƒo`‰çÇ'R?²)Ù’Ä>ºÄð¹F÷™CZ2“3ë(0³yšÏ¿í…Ç©_æÅ"dØrÙ°I	ìU
k«2ܬÜ߃HX}:³z~Gʼø½Öøq3AÀ69˜‰WÛ!g§œÜ7³¤Þù¼e{}ëÀè(xÆÓí„íe¶ø“%
Qù·G†ÍVŠ™=,G{_)ŽBˆfi,õ,žHÔ‹ñ®jEk—ßÄ7œOào(/øéõáåÇ÷ó;ÓÐèë‘…™úÑ
-„\¾*¥ìÇ„^ðI1'mwE>[$£Qï»&nnžíZ옕P¦~¾Ø×çñìõJ«^’qpW:ƒNÁ$t+×C9_Ò'¤O3“ÉÔ[¥ãZ߯ÚÖ¥âEå.˜¡KŽ»ÓØVìß"¤&éý5œôª[š«˜Þ?*zà.ãëaø"²5[;'3ÞÚÊwËö»}¯÷ãÙ¡z½FQDûy¿“ØäDCvϘäeø>¢Å¾¶©=ÊFǯ^Ülë}[¾òÜÿ˜æËd«ƒDÏnÊQé)ž‡Y;H7ÑøgcÞŒ4‚FZïR–eÁùAm¿¬4›/Ÿ.9LÞe4
®eOªX«cÜ*UOM4¼
-¤*–?ã°_UiŠfc°' <Ó!÷
|Bhy«F¬>À?öCø':×nÄi¿±ÚÙûmp9eÍßÚ‹„ïA¹é—»:óLâHÝ”p<ëßtF½ø|ü/FdûhÇTè
îB6†ß‰–”Ú9ìîppA· Terùö/Eô—¸aªDãò‡‹IT
»õ<ú=Ç›§	“­„öJL	'É`qÙmž8AƒEpûKÌi¶‚ø‡ÑúÅÙ^ò··Çæ#ëGˆ†ÕRÁHÕ
-‘îÃpwªŠßVé§t¼ÎÉàÄ•Œ
4.IcA#ê˜Ġ‰žs²[Š…J¤ü–Sú·XêÞÀó0*v/ß+—¹°ä^†­Ý*\r›63q‹Á¶3Ÿ§ïy0­ýóY_åE4¸#u°Óë²WoÑKúâÞcÑí1†vÄ5ú“\ž%WP1KudD·?}Üv§ôôΫö[Ó¡”—oÍN?Ë#ô
-˜MQ‰¦i@.YÇAž}êÃÐ	æÞIS-¥ÅÔJË®†e‘·²~·E˜›ñÞ¶Œë—­±³È˜| 4h¡©ly²Sz£t0Ÿ=H?Ýê„¥¼Pøth›úaŸ÷ïé´‘þjúÌäÆ^½Ó·+f?V1D$'¦¹tÄÍô|Œ¾EÉÒ+wÓû£Î%ϱ_-»Zeã¥ï·¬:}ÞýØ ¡q*Õš‰£Ã¼ÇÙ›$ž€dz+6{²K[Rè⃧à¦EèdjŠÔLŽìÚï_)t$ðˆ›‹‹‡J)ƒ>½J6~›ÿK"MÎHú4‹Õ†føGª¸¦3›‡Â¨°ö£`h;YG/qç—íyãíù¶Oá;J
-õÎu§æŽB_Ò¯ƒâZ¼Í¶éëy©žÅ÷Î1uíŽ	8x²M÷½øóŒ á#:æxóÉÔß7’ÚjÑ,+1r-°o<Èýìo%°mGÛfTqS4¹N‘Ò<^ñ™ªo–[^·_‘õžÐ¹œï±¼Øø°mòS–Ý‘L&q!„ÂUÀM.t	ŒY-'zâ{EÛ,hy’Á†i½L]æïà
-ŸúüPÀneÑÿ K€!¦±f}i/YÿÛô	Åò¡ɤ\\Ý#3•°¶<@$›!†i4Œ@ÆÏJÓO¢\íÈkÖJ¢ãñˆÞ·ÏgƒÅï» Ä)7Xߎä‰ð€§Ò‹«Ê	¸#vÏŠö_rg·3eØ]êJ~Ðd‘‘eOixh›o+ÍÿKøΠ¦„lÄN•\Âo2P÷šRä˧\›¢,¾jÔħN›	ÞéýF„´
¯=õ5™Áº‡†Ö˜sìlH¿îd6'íˆÄ€¼î€"@êÃôÙîÛ䇇A
-	S“)bêš•Ý‘ïS‡uÃ
-Dk›R …
ŽM
-½u¬NB\ßw9pŠ[—0åäxÓn©±¼6ˆ¡$-Wnò£k=—.÷ªz³ç™4w¡áœñäîU7ìÐ䶟Òãl»;$êËq¿½€)áuI
üîwêÍ,S±ŽÅj:M¤J1uáù“\5DõÓ5©ÖRrVô+`8ƸYâld%é”éÀç¤C˜Á1Æ¡ˆ÷–„»Œ”DC	ØnÒÿ*7Ì‘y’~üóÇ­­ös_öôB¶àÆ¢¯ßÒ9^*ÛßÌ
š-<É’Ø߇}¾ÀjÜp ²É&Ëlm0?J”>Z˜àNMEü"m­9Güoø7e<_Wƒ“®Ì´ò¸§ß(ƒsŠÁå“+/Jª[tUßNñ–J„Q/Ãò·ÖnoÂÅp	|´”,p2Ùì.cA‰£bíN%€<«ñ˜·^
-[ ò¾7ÒYçF†*XöyuÄCu%=g† ‹]›;Öó\ÐNNÚ[­º·;´[Ý\̬~äGGÃÙ¿]!G´‚7\¯Ìq}wÄÍøïæ4ò¨2GÊ"Ž
-	)¹ÝʤŠ[‡J¿&¬D`§¡HGýÐ~^¬Ö×ḸK±I*¼
-¢àLk`hË‘§|—–5<ð˜«=5mÖbv"‘ÍHÍ}XçÎ:X_¹¦üGaF)Ó=MÇõÍøÚîq£ÅÉ5ëO±3›SÅ6IØI¼8ãÎâÚ¤áÏ*±5ê3n:Ó¦
gѵ5š¼JÜÞ®œ\‹‘P÷w’áÄ)·4ï61†®õ,ªùOMæøî%’Wøš$ŸÄøƒÁįäª_ÈÿàaópŠzîÁud·LŸµÕÉ¿ÑUè]¨FÊì0˜ff=(
?‘å­ô4">Aæd§ýâBºDÿ«àYLþ[…¤>¨%—ïj×b“F-Á‘Zµ{ž7“ó43·“
-qïqNËzF¥üQª2eæ¦à¸Ô»Žš}DùäD—óÄЂˆl¯iE? FgkæUŸ¶•mFj2†qŽ`gô5H*f>¡¶ë“69=Ãâ¼·•¬þ^ê®°‚ý¦ ܹµ€ÈÇ7Œìº sJžìdÜâe¦ñŠ•ÛÛ¬ñh­†XI¦PÙ‘ï?Èä6ÌJiNì7U±Â>11²ûÎÿÄi|3ååCßSMì“DäO$ŽÎ4zä}߬E™WÐv©D6ºŠ$RðšAŒ’G?0ë€rßœŸ+f³`Þ‘»éíj_}ÌOóXdò˽ý—*Þè¸wäϽ	YÔ¡q,©&ëš÷©Ã
-QL¾ÌY®Ùv´)×õ-ËGÛj½z¤Ègh•Ù¡.†©æ&$RD	LsúpûÂJ¿'+Ž*‡p-rÙÔsmD_ã.:.¸·WàlKº×Öe÷÷Ã)ƒhe<Ú†uDÂÍ]÷
-ºŸçzp·sB¬ƒúŠ†Ñ¬¿&˜çä×*=ÔƦ(“I¡X¥Rwýö¡…*ÈÌÁ¾žVŒJl–fF}ç¥Ë.G$=ˆ"Âü‰_dm-ní‚Õeßul}h ùøE×öG|d#±ÁðÕŒŒÉÿ¹‹û¸fê¢åW4íµÐ•(YÕq}Gk¡w¶u^ñI_Ýry*pŽ•t7AN	gNØâôÙ7·Ì
-_žŽ¨Ö‰›³:û0h"ÎQo¸…øÔ'û,E@îèò…ôjÄ€"p.a¸‚ðâ{«ôgòþñ(gæšpXÐØço
-ƒ&+»ø‡±[%B–YZ£Jž4¸¸ûA£&“†ðÓÉ3/™çJ„Å­L׈”8æ¶ôr?¡.ÁBãu°‰§è´u±Îë·§£@uìQáý¯ö5™tÎ¥ßÈ÷˜ñï"Kã"Ýaz‹ëÈ$&ƒò%ôµË#»y¤õ«xÃæȲ+xS«ò"¨ˆÊL=˜#Éx÷{ž².^7‰‡…|íÒøŒ±ùîî°Na©9ìâUÙÐ<ªF'”ZB™–K-Ž¤BEÜ~l•Qî“TJÀ3‘äDYr;€„»Aü|þwâ¿Ïp`¨5`±}؆«?À›ÌÕAH8Ô`
+äÀ?÷¿Fæ
+vqvôúw¸È	à—WÐÑ–{Éý÷Úÿ%'çò É+ *à~è”Eqá§Wü—ÿôá/Tý¯uÿ-©âlãÿG9>þ³$wñЛŽ¿Ú˜ðßõ5\Pk€ãß­c>tÍÃCàl©ÿÆÿõ÷ŠnŽŽ¹Âñ;~ j€?Ž8‚àÿr‚:zý/ü=Ðòîÿ?è¨ AŽPkYg[ÇÙE(B=!`-(ÒÚîíòO—Á}‡-ôÏ—àø§gµvp† {ñqÿ-¥‚³µêlÐE>t%þð‡¶vƒÃìùkƒÞýçÜú°@Äb³8çb-jÿ!´õºF–Öƒwgüiˆþåo7F!œXGÔ->´n
*‡RZ¡¼±Ôly­;é*StutÔðZ…XQq¹6¾Ç$¤a$hÊQ4‡|uRx'X“§ÀšÄªôwß^xõ+3•_³J¿#Ñ
w! ¿6ÙÝsÕ|DËP^P‰­¹7Ç)Nq|¤©ìè¯-ñhf¨]h‘Ž«ÚÑ8uîj‚ÛxxEZÙFòjv®W_8`&\	ùáÄŠÖ¸TT¢}¬CðÖ®¬Åæ¶fV ¬úÔ¶ÌÓWˆnœ·ÛmˆYlåvð'~”ÜWk‡OX&¡NÛú8X%ÅL¼îXèÇ•Õמl«=1¬·­œÕºdèQu'{š¼Q§®ß
®³dœr¦h²Õ¦ù¢'ôñJ¿íÌP6q«gE'ÚÐì·Ü&åéy­ÜÕ"Îï<á7|¼çR$8Å–ô¹RÇ(ùƒLKGÑ]©úKt¶»LÕv3|$KLßîÈ´ÃH¯ÛótkTÉÌJhOúóS¶è~l†x ß¾¡¶Pœ¿îL$cò‹¶²=åË=ËÂ!cEK$›gÌ]_C¥û1r.G"¥û‰/É'c[¤}ê–á]¨ø4õ¡ëL¼r“Í¡ÇÀ”W'éemä·¹éeîçä_=„Äý§^¤ö>MñFCí¯¹Ô©¾÷ùÄ7-2yÕ¢\½ adæÍ‘Qo«ž(­Dvõ‘6¾h›Í/›°²z–)F+À¢uzëªæ0Çg8©…Ûÿ,÷Æ¥5q~S†c°Â8¿WÕ«­Äš9€.gDÍSÂ_ˇýûÊ CD‘Zb‘—Ù#êÄ4‰H³Î•†ÈÄËÖ¬åüczPer~“\i”õ4žñöó0º¦œ¨Áˆ;«ûœ€È
Ó.ÃËV4ÐGÛÏ>ïfJm†[ÌZôc£°¹Wí@ÜÚŸ=aù);zcsç—?k䌑´¿ó¬‚BZ
¿öìËw¸…r‰_#΋ó±†-ÇñÞI¦Ê)	ð-Iéò>»1ø½!)²ì§—-‡ÞïWâÁÅà"_³5$éŽÐßš$·÷ð¹ #æjÙåIŸQ&ýF˜0¾ó¢¾óí—o¢rûŸ†G±ïz§-g‡äŽŠÐˆoýZ‰Çóõ;ðüûËþªxêFyÛ‡D†ôð67‚%E.õ²–Ó[nN–ä²J­9e±Âôð‹z3Ë–=	ÚCÉ#z>c†ÏÀÊ+ØgSµXå‡\UÛð©¸ÚêˆpúÙwCöÎyæÞ¢ÅÊ2+ñ3ÑÅ· ÕýŸõ³}G_Ðöƒ~©˜vؾ–© y’d+ìG§©VNÄìH¡·A"°€UI€hùÒN]\éT$±1pQðªP²NÇn4ÄÌMaqö6ûIešj‘Ó	àR<„¿:‹g8¸“Ð†¦á	ãK\…Û8wÉÁãpóW_[gqlïGw¼ŠŸ_÷hXÝÇì™»ƒQúÑä”VbºàmÑ4çó_ùóhrÔ@æIÞ(©;±:
+7çÔD€ëwÕÛ¨¾4ã43bùëol(“Í¥ìå]!…b¬›Š¿<Ä_xëhY4*hq¿ÑóOì6?éK˜ÿ™£½‘Ö׺œ2[Ì]yjÙÛµœô¦ÍR•ŠƒÙ¡Õú”Þr\)žêË“Õ»6Áât×2·ý\áLâl4&ÚŠ!GÐÕê±ðÐ@“ÍhVÿw]“8•A¡Å"#uÆ
+%26Ü'”qF”U¤ÊS÷áÕæí)?M!fÎk¸6 m5èЦ&¬¬ÑkB—ÌX3*Æry`°‘.ƒÁèiÖj°ÓÌaƒþØ&†h^\åëâmqÌã+4ïTïy„#)£¶#‹ç‘ÙÜÉû>aX¬êUn\Š%‡“ÏNÙ ¦2Ý•ÎÒ•þ£ó€wGf÷ï©W¿×ƶâùl’‚¸5
áⱶŠI±³Ëª/›w6¶
ƒf=\OY^g‰>‹“S’~{b@×d)ŸÑÍt¼ÿµì8˜`ŽÊB×¼¡ï™X÷šæÐW”6Ù-\ƒ…xÞú²üŸžŸ^}„ó]Ü›„DÝ/öKÕ”Ãeò”É¥ÇüáºA÷ÆEìÔ]•dy\®ô†õ܃
+¬êØ9¹6ë1£zy"__ƱÒÕ)¬yŠÇŠ•Ã\hô;øQ-]Žd|ˆŸ=‘<ËH&Qn—Œk|¿n݈–¹dˆo€,Û;ìM_bZ²–—˜¤õuPsÔ­jnªdtüø¤ð‘›”¯?´›î‹Ðö\ͼÔxWbTJgìËï¶ýž±ÒƒÁ´º
öÂð¶‹>G‘É~°šô¾+!Ñë°	\x³]	tKs–…†Wµ¨ÉÆë®lõ¥ß	Ô	šÀRŽšÛ’¡Ð•¿µ²—l¤òË"D?º9lÐn¹O^‘å¶þ²Toºz¾l?UpŸÞ8°ž5©d¥t‚v§P55Qÿ&€l°HöœÍnM©1Š…ίŸü\3˜Ô'àc0¾Å
+¡j?ïHèÁŸ¨{Í`ǃ†*'¯K­(ý«‰H+6Øö~lÂÁO»Ò‰Ð^`E茑Ãp¬~Óöàæóð¾6–î¥U¢Õ¿Þú \\bk¿wÀÂÖºÓJQ$•mûRH;¶bÈ	
W&—=ZJ¤¨ß«ãÒë>Ù:‹W›lÁ·S`O8Šw‹JïrEñªí̓Ú^£O³äÇ=ŽÒ+Êò”½»;1Þ8ƒÕ,—ó‡+W	t‡¹Q”ÿ¶L;£ávJ²%¬¦o¢pˆñj)ºG:ë¾ ¹#[¬@ÈÎb8¦}‹¡ì	¸¥`õô¹vžMê¡ÛÞ«Ä&µög15h=÷~þ‘]ÞÊ/ùMnx#€3B3­6kíµ¸7ö#Í>}Hçil}€ñáÕyR9£D{zTÛó§­—8
+Ïï=k¾±ÔÒ=L~­ÿßôliF®ÛŸÏh‚L0iOrH;pP…L0æÒ+Îødy{%N5—Q‚+,:ëWø„ÞKûÞ¢ÓmÅyÙÐo\µÄŒe’09>ú„¯ßLUÑül·äVáp!k€vºÅ!CqÛ¿àùÐ&'äÓ÷î³uHíõô¹;(Еµj·wOÄn´|@F1î—XªŒ¡äY&³5ÕÐQu'w¹AÍ'A6.ÓöÂŽ/;F;­ŸÃväêœjÏ̾¤ÝE5踛žìÐÖqS¼ˆë	˜gèÜÈ·÷`šxò,åÑB†7µÍp’(¿o&¶Ö XT éç˜cݺ“ú"Xß-=‰g%ØŠ²+I¯ä$kt™"
 zºê=U×$³²a³°<,í5¡÷z')Ï7|e©áqëäçLÛc©Â0™Ÿ«LÈ2½JFøÔ皺‰ßâ"8Ýj…²0Ô)ÎÞ65‹ø”ÏjiÞ÷¨“.ܺ¡zcy?IïwÇäÙÊ‘ѤL0LÕ=#¿¦Ì_(‹.ša$OÊ×RÝW¬LåØsÎR¬ýé°î·™ó¢	ö`Âä[ŒoDz8À36É¥Ã5ÅxìaÛŽ…¯9³Ú2ƒðl¯tÄ?©3II³&׿M°ŠÉ³‘äý%x¯_]L2l«L*æ; sC.ôåsŽua&Orâs‡õ„5÷ôA0ŽzŠ?…ëñXnˆá3¾¯¯¯Òï äj¦úæËF,aÍKJá«‚
3nPþ>öwFþ	ù#TŒÅM²Ú»z1üJ?l™|]§g=“çÓ©O³2¼jÑÑƬ˜ßÜÞŽ2ìëM±µm³©6Ýá¿všÈ[ÍÝ*(ʺ¾aH0¾Šh<²Ò«3G©IÝ;fbvó뛚‰~Ôè6}?©T‰³èÈ¿;§­bÃÞ"ß»ó…LõêÊà·uéÜ“}‘ëÃ)Z:úú0‹é
+ØœXŠbìôëú£‚@)’š¿õ%µ_î©Víá‚~©¾Ä•CT 6Ú˜4F³”.µH埯›i¹2è,Ò\MØÇ÷ó3pœÅx¤¿6ýñ"òË(aœÊ%V®<&n…KÉ’wšOøïP¢=˜
‰lΫ\ð¯"#%^*ðÏæº×œGª wù¶|ã¯ð'§¿:0?þì±ó-\ÒšÛŽò†DÃ]McTƒ1f._¨Og2‹zXlŸ@Z{Hæ/ñiú‹t×]Ò­ýã@¹ø©ÉdUõŠò®ˆ)C:¡ùÂ5òÉ‚z‡ÇÆùýˆžZwfGŽ€ï»OìÙE­Š‰²³=©·U˜ÞêG“ãk­Tlð¢j¼”,ó¬|·ï‘8©æ”þìþMôÈø®Üý|§+8òËIŸŸ	îmq5ìþwÊíC‘¶ùZU„Re6þųOÕbduÓæÕ)
V2–´«í Ú¸iÂ3LDá˜aÏ㨟Î6ʦ€óžˆ³”˜HMØjÔû*3Ä–qšvòóÇæKÖ´– †Â¯ßÒØ^+ÚÝΘ.>Ë;ˆ;Î\b4lÚSXg‘d´Ô›'H/N𾤤 |²Þ”-ú	Ï'ì›"Žß›IpFjYìóoäAÙE ²I±ÕWÅU-Ç:Jô¸KÄB)W yÛë·ðwa"XGxÞ
+æX,¶W1Z	#"mŽjÅ€\Ëñè÷žrécÍ`YŸ[ÉL¶ÃM¥vŒ|»ÜZÂÁZýâîs-ó=ë{æ‹­ÝD¬Ô÷µïw©·»86™}I‡²~»€Ÿkmº\›aó{ãòÞÏ«åýPf,Š$‘†à“sº–JÒñéµüº‘|…_ÇL=Gø¢ü¼\««Årv“`—{HÆžZ_sfÒ¤ÁèH$ž’ó¸Öy ®b]ñ–ܬBº[Š¶'ò›ÑíÓ1²ÓæŸ~"çÖÁ&ò­âÐÓ8QúÝ¥õIƒ/ý•"ë”þ¦œ4Þ&›NÃëëT¹j9»=Ù9æÃ!nÄÓíïô©.?l¡
ÞèšWñž/ðñ<JįqÕ‰>‹ðÍßÈT¼’ýÁÌ,âîùÒãØv…6g£w«#׳X…ðÙ¢1Ìλ‘Rj¾B+Ûi©h<üŒIŽázEÅø4	~×AíÒè¼wXr‰½j‘ÝB
+ÎßUnDú'
›ƒ"ž´hvÃøÄ«þE6ÙgµfOÎÈøuu°5HÎc§#I¥$ô*Ë	IÇd"œ¿£¯ÏGrC8‘·.ªÿÝGþÙŠÑݤ 4…¸³«¯bM®ö¹Qn­#cŽáó“¦öèÝ_Ê/T	Ä0	÷	h“®wô+ŸÃVæÄpøæçøŸæ7..QÍNQâ˜w¸øxl°ÕéÁKïé©U‡ïÅ"5&ï`K‘ô¯{Ù‡ï†ý;n’v}¯CJ‰ŒI´$O{•]uõ¿­;Üf¾@­‘ÞêXg°º=¢‹ª¨'ÿþC¹Íø×æEƒ‹±åa&Ê[Ê'khÅwˆfM;=Ï&?		ˆ)f
+›oƒ_o	oñÂýË›%jË%¹]ë‹í¢¾œíH»˜,ÿ‚‹¢øk-hÔ;›:-¿¢6ó•IÑòkJM¼»Át‘r…ç(ÚÊNöìï`>jŒC4|»…–Ã}RLaR’QLÁ:¬#oúÚU…Çü9¤œ?ÒÇžµÔêS¶ðšåT@ÇxeL4µç;,Án¸ËÄàüõe®–]Y¾À–Úî…º°©S8‘ru|IíàÅ­>š°`|˜;A€8>ˆj’Æ-N‡/#-Ê
+± %¤VKô®g;˜¥ÛÅ›gÍyÃÝ…z.F}oµ½ðþ…é1£VœÕ~û7õ„#K^‚Gud‹ÛÖìÂ%¨Ntxº*‹Ráom¬´2õ¥Bw$6£ÛFã~T7AŽÙ|Ý}­•Õ­ù‹¿Ohš%™–3Í¥¾3‹Míe¯êm±Ò£þ”°âSöÎw[¼ÙçüŒ‡¾¡çmM ijúê+ã—1eÌKµ€º8uÄKHí¾ß_2£…ÛÁ§hÿÄÜ~‹ynÇWW+÷(@R‰*¸BÕç<%-ðµ—HµÚ3äÄy¦fºÐ¡4•Íú¥&×@ô’£BÑ÷¨ðþtaÂúFÝ÷‘£@¢_£À™;îUFg9¡i“›âÕN†žxïÄ€”@O‚/Ê®cŽ•ÊÏÇÂ}g6"×#
Ÿ±‡#
+ÝöMGÖùn2—
G}9Á'ÏÏÿ#
Ñû‰:°ß~ñ#ƒNÜ÷ú¨Óú¨É»F byª¦…õc«.|#„íqF	Qx€“œ ®z«‰©ô6çg7jL ƒèûZ‚Þϯ¬ìîJDwLG?O/b°ïp—5“ãs6}ôifÕDËè­;}»ðÄ=oè÷³Ðó7]µB«öz`)Õ::x)þ“56a¬@ãK ˆ™Há`±ÔóÕÞ¼Žû¡Ž1lÀ”í¡Îà¯tŸvß’Rº&E/L]·¬H>P¢k”q8«¨ÃA•{
>ò#¿7¸‰UkIˆêL_ôË”õe“Èl‘Mæ¹UäÎvGa½_…’È.·Oøˆjs-ÌîßZ
+]a‰‰Û¹ú|ç~±ªï`ï œ?Ö—VŒ¹…Äû/	¿¥fþýÙ•N /GËÔµTÃ~‡Îg#"`™ÎMYmN{tŸVá­"Ug%±ÀFõW+¹ˆÆQ‡e@5ÃΆ–Â:©ÁÒtªÅþ‰›…º!q~Xñc
+8S °‹AïfoQ„
+S‘¡&Ðw†Lˆ-~KÔõ„BÓž$CÃE(rxÄÏ,ßLüÒ½xÜ0€ûý7Ó&\%g¼àA³_±Ÿ©QÇsOÈŸêp£Ÿ˜¬â4®êù'CilL=ëò@6ÒMuú0öaÌôÞzqùŒÇB”V¡½’úÃgçìWã6âUßK<ÂäV1ßµãö‡9µäxû„’Üäç¡OÉ’œŽ›¿Î0ZÕ p}Ÿ9¥Q#Î"$.ôý‰Ì¦i	Õ©Ý–2F˜ÿŒ=¡ÏÂO¬†wSžÞ´ÝU„Þ‰Tz¢¸ @ƒ^ÐçÝz¤Y9u§RDƒ‹Pb¾)Ø0i䣶VÎÇþ‹ù,&ÌCâ; b/­Må«·ÙY.“T^™—ßrù;m·®á¼ùwÁKÚTÅU$Þ5£ÁªIWÙAÕ‚Öe:>¥y(Û-×Oäy,3ZÁ”EPåœ$ý²H¾iv?y µ”{ë¶P˜©‡MâCªš3ù‡IÞøDµ ¥ˆëÁÑtQÄÖŽç×"ºÈΔ>'B×8ÍQ%…Ù¼ÁA÷©-ö‹•€bf•Gí>‚êÁv¶ßÏdDú¥™Û‹R®²×Lô½Ya’NW¤Wéã9MœkŸ|HZLj}äV+"ÃÞÞr|]§•­XÙ؆z|X×òW£f¦ã/ºÞØòñºœ‚¿•b1,Þo@j›%‘Ï ¢y«­ì¸”$f‡zôíçÍàì<8–¡3¦üD‡Š–Êšà¤réKE­.¡K‹^³Í„Éúw"#c:áTòÛÒÂ!‚´¢¸ïùÝW{ìȶæç´¾#;|¹cZ.çžÎ¼=•$:N'ç•(7þZ5¹ÍÏóÊñR¿‚ÁñtÔ}®o1’pn²$>G’VX¨}¬(/…ë¼Ú®ÇR$úÙ—JÈN8ÛÖ‡¡ÖáÜüä£ù3¹Ï
+ʤǴ‘éauNº…F­¾iqTrå	Ç¥&GÃјÆvcùXÓ¹'O؇dž:"óïÑÚÇgØÖòW(“Ï:¥3fȪNËçx©0<
+þù8ÑdÚZÁw…É…ü‘+ˆ|‰ÏqÚb„‘–÷C•£°ÆžËø[ˆ=Ø=à«ýâÔ‡ÑîÅäÕw7âëͱ÷ÒšM¶°ÝÁ—ît§_ÆXØl²²ÍS„7épÑnµH(.‡ÍP}6ëòŽ‰I“‚Š[ë/øŠ‡î»Ú„¿zmà8ú(ŠÎð“Ôšm÷`Ž¯º,i§ïeX˜v•UM+šžíNÜâ––¼JÖlµ8»:±¯tø€Ø?À éZEõõØêrŠO¥€¶SþBRÑ›áàVqþZc …X[f°"Èä+•£ƒkoÞ?6WÖ2µ·«£¡™£šUÝ}í|«ÃAË£EnöÌ7¢¦š»fÑòª÷&¦.¤PŸ~ѱùQÞ³ Ñ}5%aðÃ}éì6®ž²dñEs=d5RZy\ÏÁJàƒM­g\bûW×ì®r¬…EÀm cü¹#¦(mÖí£Ü—çÃʵ¢fÌNÞtêðä;N#^9UúÉ^!-7TÙ‚KZB@!(?LNpé£eÚY¿8¤c=U6(4ptæ›Ü€ñêîQÌv±€E¦Æˆ‚6öAàˆñdºìlòœI_ûKÆÅ¡~QÃ
<9–±5­ÌW SŠ¿ÀÝhdì!ÜÕÊ-7…^^!+ê›FThRŠÉSs(1EÈð{ü±)Å^q…xÜPcqv¤ÛcÕŒÙ7“åGƒiµæzî rMò[';¹o¨Û'ÉA\\Ú7ž…fë2&2_É°R:ɾ&â:õL;ÚH>¦–¥}Qùs~ô‚»ýtp±
Æîëi¶`½ÐÖ~SlØq0B1ñ‘9¡éCè«Œš
+)VÖBs.W1Cé.	7;±âäàH%v´®-úèýû¸Qém©]'¹¼‘í—õ±zí,ß_m¯1fbzîy/ÞF«ð´yVJF†±yš1¡›GÊf•¹
+\îMxv‰@qÛ`d”ØŸŠ-h}šÐdyì!t`vThr‹¬>Kˆ9<™Q¨5н²¢Øa-°e?I{{”PJƒWûÒè(ü9Ie(ôÛÈ<ú˜&ó³i࢕ñ;ežÛ«ë×EwŸ4x°ž½øñýX«ùäË+‹WÅŃîIÉ{CZàyâž¼¼Ô>tp¦*t[NÜóºî¨”רøWF/S¹ÿ…›5e[žÿãUµî7É1É´jâ*”¯,$¢ŒÃÜoÝTÒ9|<7ÚK~ÊÕŒ2‘+˜E|™Ý [»Õ]ÐøFü!¸¾õ·¼¢›ÞÐsU}Ù”g«’îJ“2x®c>5ê”oý¤Ÿo(#0›LZP€ÿ—ÎÿøBÀÚ‚#]œ@p8tÿùËÎÿ†8Ó|endstream
 endobj
 802 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 2
 /LastChar 151
-/Widths 1352 0 R
-/BaseFont /PNUUAQ+NimbusSanL-Regu
+/Widths 1353 0 R
+/BaseFont /DERQBK+NimbusSanL-Regu
 /FontDescriptor 800 0 R
 >> endobj
 800 0 obj <<
 /Ascent 712
 /CapHeight 712
 /Descent -213
-/FontName /PNUUAQ+NimbusSanL-Regu
+/FontName /DERQBK+NimbusSanL-Regu
 /ItalicAngle 0
 /StemV 85
 /XHeight 523
@@ -5549,7 +5555,7 @@ endobj
 /CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/nine/semicolon/B/C/D/F/I/N/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash)
 /FontFile 801 0 R
 >> endobj
-1352 0 obj
+1353 0 obj
 [500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 0 556 0 278 0 0 0 0 0 0 667 722 722 0 611 0 0 278 0 0 0 0 722 0 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 0 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 1000 ]
 endobj
 714 0 obj <<
@@ -5560,46 +5566,46 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚíWgP“붦ˆt¤w! E@z/‚4•^B ’„Ò{‘Þ‘¢Ò{Q¤÷ª  Ò¥IWŠ4)Âî»Ï>³ïùuÏùuçf&™ï}ŸµžUžõ­™psè
-*ƒ¶û8FPTHD u¶uEk#àU0°®-
-À’$Üܪ(EÀÕ€ˆÀ¨A@11€¨¬¬,	7@ôDAí0€ÛƦ|wþºùe°õüÁz¢¡öpöÁ
C !p–âíh0€¨êê=ÖÒÑÜÖÐ1h@àÐsÅ–<‚‚ p4„`‡@` ýUZË¥Œh$źA<@ä/è	A9CÑhì3ŠØ£€p¶
-Á\Á¿ÀÞÛ!~'„D!°ÎXK¦‡@cÐ ‰`£ê©Ýÿ#OŒó+6Š…;¬%rýUÒoKƒE1@(
À@<0¿bÙB`(	zbccÉ(èï4\ÑP¸ý_Ü  ö@A£±4Xî_Ýù«NÀ?UD"až¿½¿­þ‘ƒ†Àì„HDÅ°1All{(œDø×°hÁíQ‘?îÁ®È?17êwƒnÿš>l@0ó€!v$Â:6$àöÿNe¡ÿœÈÿ‰ÿ#ÿGäý÷Äý»Fÿôÿ»ïóß©ï»Â`:@gìü±dØ-ƒ<üÚ3€_‹ÆÅò?|€ÎP˜ç¿ðú»¡)äL‘ýÓ±íP†Ûc%ù㊾õ€€õ ÀÃvë÷½1AÁ pVÕß
Å:‰ˆü
3r€‚œà¿Ú/ùƒÿž;V¨ß™ë˜=~l /ð¯vëoK=ì`Œ<‘À‡1ÕF€ÿqøÅ£¢‚ðxJ‰Ťe2"iQßñ7è_gm õXˆ‰ˆˆ°¿~ÿ:=ù:„ÿšCÆŽÙ?.~Á W
-«îï7[ôŸçßx@@$ÓŸ ù`Ç´ÌtLCNï;5‹ÎvQüÞda­ÑË|ÿ
-D›_Zø¢l©ÍEeˆPÝ°Üå[ω-äÏ/øWûÛéa¼m)0DEj™¨<Ì9ëMþ4ÂM—}VB?÷ˆj´˜
V‘¹HC¨Hi9¨{»µ_“å‡k‘hî?á£>îº
¼üòeïÏ©¦:ý˜¨ùÚâÝç|~)P+"r>r‰æ§;—,Þô}èøŠæâ´Ž
(àçä8ŽWӥؕ¤JÇ,ÕåpcòÅÙae°íJ>»æ¤U³øí«øê3NU‚±ã,=šÙûšÙ&ûæø*â?åuŠ
-R~Žú]%™å‹•`Œ+¥ž^M8~©d`VC/»°lþŒ<˨Æo¬ÌS†æZ’>#nÏâc`¹`¸YÅeqÜ*.ìTOo-ž‘6ó/’Râ$ú€«^!î8Íro8”½¦©í&yÔº©m­›˜ÇcÊ@Ú†Ùu:;ýPËX5j!%#¬ÅQZß­ØgïÔIK×5–Í••5‡fQ²®¿®¥>áfc43	Bµ“Û¥ãÿìªcJŠ)þT|ßÞ!܉Ju‹Ø=3ñÑ7H
-ú<û¬ö}£ÈéI-Û½^zeÃì¸×¨"ÎSskk²O2ÃM-ÚæáÇýÅìdú‹Ó]º9QN5éLm/°ÆýŠº£0U´Èf r5’;ƒÇ.‘*ºiݽ	Lí¥ÚÜRŒºž65÷‚5Ü’³¥Ž¶ß ¨;ªêYIOÐRSÛ½’bíè¼Æ¯Ä³âL.«õ”ƒÔ¶ÂÀ©¼@—þäÛž²~'1qvéCY¥¼©²o+îÎåMë-îéÐŽÆçI}èäg`Oòf›ép†ËÝăõji¥Ü9I„“̲{†â6Ø–õ´_Ù^¯IVHÔ[u3­E¿T=ݱ¯¨ºfHåâ#wÏ“líÐnÌcnÔ⑇³øl½ôâf`„+²fkQÝiS>P²s{RNAüµÆ¿ÄyôË»®o¶Ò[ÖÅï„ÔùΔÜåíÌöhÌ!eõ¢tÖËÇ6Þù­a7"7¶Pþ&ëìì¼òæ&ÆžïSôÑÏ—¹_WlšÝ´
-ÂøI
_Õ®"¿iÌõ<·_HÇ£œË­Nº÷äï¾ávVîxùnmhm¥ðòûú ™š‹/U쟕ƒüówÈôë¼oš€åªš"T"éK)íIóú“CZ5[¥LƒÊ„1VD„Æ}“¥
-›^ˇ³Ð,Mþ!7‘<&ÞR’‚‘îþèöu³ºÌbÖy±ê9+¡ÑÂo®Ð˜9U3£‘ãäzÇ82±Lû¿ ßšÏÕà7úFo¦Tû²èX½X|ü£ÑaÏø“Ëú5¼f—‘·lºs¹Hk‘¶xs›“vÞCŠT+WštN*áUWf&,ã;[]MÉ-¬”f«ˆu
-‡ùÆ£Ï)wCp†L§X/'zFCf"ý•„SÓbò)›_äôqZkwm˜6ŽHEëÐß#|¬áÕ6ŸºÌ‘ô2nî¼R–.§¶@ž«„®f²¸£DŸJ^xj›Æà\ÓöE˜$ùõ­±7š<	ÝšOÙ-2tHô^¥êm>zkèàjoR}šš»]GÍ|ò· #X‹e%臈ϸ×jYJl
š«*–8h¤-ëjíh„ë»	6OLO&ÇÊ&–“&¶ß¥¼½Ìñ¸±.cÒÊÉ]$TÇËíÇ:âs0ÜìËíy¯iƒÉ	dzv5³$+Š]©Òí†âš×ké_éx̘­ƒRj5ÍçJј/!›j#z´dÁoø`YŒëB’«(¶wŽ™ÆªLIzç~¿·ôaãˆMHMT.
-ñ±Sq–£qz…‘¥órn¨h^•x²ë’š¬:ò˜
àèÔ:[8‡~çsÎA©jÍꇳ“±eNš9µ,+×TK•ã%TuËóÃßÛr}7¬pûæp1$è/ãù~p’xë“ÑúÑ«è§ïVžZK4:0WØçÖä¬5³hu2ÒÞîãownâú˜x{Á_Q÷ñRö10ŽÔ…RG"%Ç}P‡é%‚Ùûæ_åF㩪UãºÈpÓYâØÄ×|‹ù€Í9¦é3ñ¸ÁÄÛÁd9TZÄÌ{¥÷ÑÙÖå¯k+ò‚ÖŸË78µ%®5Bf‹’ŽuS}¯è#g6ò\œÞQ_OŸÐx€@üR€@*;÷…äyí·ßj¾Nf\çT-¯Ýö
-Þ,ÌY:'§`™Ç«x“Öð¹Qΰ ˜úsš?ÜYî“ÒÉ|½Žx›£ÒF†Ö³¬rï%ŽZ½8Aÿi7Ëι‘	­„á½U½Úp¼Û]6£a·5 ¹ôŽƒ]@ݧ‚’™x%’Šôóï(]‚Dë.ŒrJzª#ü<Ëì6¨U˜¡ÃÒÏ—oY­Ñ}H´Õá/s"ŠïŽcX[÷¦}@QµŒÓ‹tæ[8IO6½Ÿ]·aƒWË^õ=©È‹G3*î+RJç§ÐÍI|€8´mjX$Iÿ¾'ÂãgøÑŠcm°H@blEêÜôGly£æ+Ef÷j—oPd€{7¯®2”0C¹‚¢UfÆÌ˦µR¥tÂSåγœÆ'þ6í§½×ÎÆ`RINÇq°½«‡Ì½6Æ„øågQånpfƒX”óöaKêdaWè[Ä~‚°û3Oz}Ï|ÏñÞ明›¼i¶ºäÐî«ôL#ö»"½z—•òó¯ì¡´9ü,ѹýùË+xdÌÛ`ýü¸û±¦HÉ+‰Ô½6›îHÍæMÏ×A5Á6L·}zz_ÏL}'‰@ÞÝLÝešAl2®“¡GÖÌ4žà[†¤9¯fŒã¾•+㥙Ì}^Û»?À­$¯¦hm[×”rÞÈ(ÆlVãìÚB¬qõ¹ýyìÈD EÓûÞÒG¾§œqVÄ0|„öQª^æææ^‘§QVAöáA	¿5áÓ©3fVbÐçn2	Yöiœ¦ãcᙃÑ-_Â}x¼1þÐö”<Ã]Ç]nL‘gVõœòFn!&ÖO¼°˜~ää-ÝJ­SWHêI™¦Z|š;&v'JA®}íÐçS>AàYWô¢9/ï.Q…cäø­EgF´¬÷änõûã*•¦BòVÒ,©YŸU iLoîngs¾Ô¼ÖöAÂuÿ#Ë™gÍaÞŸí7†^/ª9jöæjæçù¨VßÊíIŒ¦}oØ7ò&Î6?=M“ñ}ôa(¥É%²û¿a0“¬ÃvuŸ´%
-“4r÷º?Ke7bCËñÂ%Qx\èpX)„¦¤;ò"OÁµýËw”#;9ïÇÝO·ê#o°RÐb¢â@?ë=yùÐÏœæƬû#®ã-WrØHر	²Yë+_~¬êüå
o‘pGCÓ
-ˆn‡Th~5ÂìKBL	c%[ËŽ¡ÿT/ØýKŽ‚+Õ°3>“xZí!rû!%"s`7xµ`^Džaq{7×RAÖ•!8q¶‹Á)4œ˜—môIIp,tc»ì˜Jáˆ\_4	hË­3?åËñU”ëý)š->Ü —½£ÊBQ®†Óséë:(÷Pù¥¢›ùÛ²ý¤ê,!¯•(S
Q• Ôƒýò„T¼é½ÜoG|$ýî¯%ºÚ&¾?óïqÃ73!4*ÒåîšÊ&%™ |ÓÒ‹Spvïb°Ø„àhl;«¢þ&ëàê]7*þ-OQëÛíbøì¨è‹S)ËôÕGG_El<^sU¡æO1ÅÅÍ#óåÑR^äœyv¡ å¾ô3ÖLìÌÊiøºd’^‘¾­p”KÕ„ÿæåËaçêDva”Óà.Ä6ÊtVpas#é« °¡¹$—L;.î,Ö<«`.àÁd_Vºä‘¾¬t¤«™#~Êßèò´Zºë©f¯fßR@4—,矌e¿yHòáE¥ ûÒ*À˜5—d£²`çéÙ´Ë ×bóÅ…´a'õ—Ðm=H‚0ĺ$þk"kÒ—Òº±sE†-\›oUÑ—TÏäÛ÷«ÊŸãÄñ}¼Ë¬øæÓqhÈÇ»T…¯Á]%¯2Tü¸ãJ_;»m™æAÀ7Å6p‘µSÈúeÉ^¶“ü‰¨Û’è{ŽP$i½§x"¼ylÈÙn¦£š‡#Ê“v÷inp´›¾,¤#¶Œª!pÂj®àÍb–Ej‘ÛO%{#™×¿|ç€þ–ŒUNŒ!ãÆ€.ë±{ꈰfŠ[›,rkï.^ôòþ&­MçºD'il”ÄkÛêƒZ©÷ͪËÒ‚*“Ÿ¶â&å“eeSóÊ<^=§¥çÓsMéŸ÷t]U;ŘaÄÅÇL”×Íñ'‘®™ŸrªÖ<»ÎÍÌjðà«}P\ƒãÄ¡¬Ý¹½SFÊÊC58UZ:ÚÖÊP>´T‚ymçț>¿˜0}•9;#}À®¥kTr‘×óð…Û2‰êŽà-­U„K÷;iSâöÏ_:÷N}A2/"Þµ—Z=õ²Kd‹Ž÷½?"WL`:%ª¥›ºÐ.-s|F©Ü¯%îìSùvªýV¨z§á:ÍRIËè»Q˜Šù´~lIÖˆ¨ØCàfn€Dô²ÛtÒ›$3i±õô£/‡—üMÿ°A‰”pºŒÆ ½ûàÓãr:…ÝåôŒ9ÿ«¡Ò‘¾kÔaúO"	VÄ3e\ô¤®mz£Ýq§û¶÷Hrwñ_Ê„¤èóЩ:Ÿ\”˜
-&™U†Ë°êÖ‚hÉžw´2Rˆ°´-è•SNXÞ_¤›'W;‚R׸äƒèà¡IXud"ˆ}¢)šòOn¥ÏVQ®ÇŒ*J¶(E»h¨»ªk”¨V;6NÕX5‘+̶©G0!^s™ùáÉD¬2ЩèR‡Ö©_ËøÞå1û×ÇÎI8ïÚõšžãEí{ï8ü¢ÕL—YéኳSÉvb?V†V…+W¨í:‡l(AÍ‹”äOkÇÒÔÁ•vD"‡7¬x×&ZSf4†‰ê8üðA^S¹*…Ú‡øñ8eÀ†,šú–uVŽª“7T™UK[k…aº{fѯ=kݱÙ“å¸tÌ×åÓ~äù×	…Wôñ_gö«…[5÷i^¨ææl`æ#×#¨v?ŒÔ8ˆø=íq¡	Ä+ ¾’5àaÅ#¨”ïá¼Õ
-hôqåÀPh2Ù"eà=¦H«¹Îš·»µZÂöéÆ#ÊÄÐ%&R•O€ áÀ;Îóh¾¥ËÕǹÓcÊò­)£“g¾ñ,>¬}1b¯CònDîCôƒJ¨uÑ©¿Ï#H†R nóø-Íc-*Ÿ¼è—ö¢ïÂ|nF)\¤¹ìªJðíÜ?æzNôð&'!çÀÊjŽ,7Nùå ùƒh±ò2tôýÌU—²¹¼ÁªQÓãÖq¦ÆÓ-#@/•«·6lÔz>)úN®É¾r‰—Æ­öÂ÷T?KMÅ
-D=¿o«‘Eˆ.£9 «6.ÄŸS3Uï,ª{^ˆnIb(»5KqˆG·Qáë1øê‡3¡;+ ¥¸[ºº¤ÊJáß¹{MÓýŽo¸-t}<Ó×õËé–àûès‹„cËHÁ)®×a"rt‰¯|x¥ž4ns%ûçßô§Ò-ÆFÛPÍתçDfîo_s]^ž3ZM¼
-òÖ'µ›“q¸Fm!¨bý®ÚÌŽ™™'±—£Z­Þ¥»t”crÚ°ØpéGÓJŸè!ÂÞ½;cú±*€(À•®ûbÂ"½rEAøÌgŒkpŒô>¬ŽÐýÐ5ü¾3êØèû	ŽPórñš¿c
-	ê5 uVÒ”]Ž¯pH2ÎæôçVKÈB>‘ÊÝJ["gù¤x¥•%‡­{ìoÜh—ä罶W ³#Ó ËO*èsmú|…W·1­œR¦i!9w¥íjƒrÏíᶞÎd§ï2ëƒ'Á¨3`	¬mŸ™Ã 0dÍÅ)´äãùé—›ù8ë÷Ó;®â§Ç.z•u陀ùw>ê¡ŸKèi¦+Aþ&b3¤’*õ?;ÂÈsà­…ìþƒ
¼´(Z›Ž¨©Â÷®çLŽ6(V·û!?hšÇ"x·ëðNú‹È¥†©6â‚öSb,ÀK/²œ†ÅÊû¯|ç@…wê#6Õè%‹ÝÉå&p
-?V,„Yr&Ÿµ±—±Îµ³ZÖŒÊ_>~B‘]ºw§3„úËDkäÑN!/
å¨'¸SqýÔB¨¿à Lö+\ã ÔÃODÇß	Æ@ðWû,'V‡KÄNqƒšž[­¶ì=–ÏEU~5Ê4½¨6YÍ‹9¬±|ýÚ-㘙GÔi¡Tp
ÓYÂnI¼=çOäò½ùæyŸÌ$IQ»{‹2#\Zf*£l–­†´ÅÎr_F¾Žqv\uŠ` mµÉϹ–ág…Èâ7W®£åÈY}	=5•)À:-
-„ì|6ƒéšŽÄQ¼€$2¡ùÛ½óñC×m´ø£z˜ªÉ)·e&·ölªÜÞx
ƒWüŠµ´v_zD:ïËóQ½àDãî6î7«—'Øn+À˜v»ô3ÜJÃ:,®?ãRë&™ßCÏQΑ|ß=_zíýS0…{Dò³Í5ûVòªfÌj£‡ÂÛ„å¬Úƒgú# KY/mÚ”ÖÔãZµ>Xïø‘}õê}‘O˜æ©²8î#]²=x1æò(홟3LU3ÃdјNÅR¸«^+E¢=JíÄ.ŽãÚ!µf'òo~HþŸàÿ¢0g ʉ促„®endstream
+xÚíWgP“붦ˆt¤w! E@z/‚4‘^B ’¤JïEzGŠJïE‘Þ«‚€H—&])Ò¤7ºï>û̾ç×=ç×›™d¾÷}ÖzVyÖ·fÂÍ¡o$¨FØAî#àAQ!9€.ÔÅÎ
­ƒ€?TAÀÀzv0(H’ps«¢ @Wb r3 ÄÄ¢²²²$ÜUÒupÄn›šñ	Üùëæ—	ÀÎóO뉆:À<ØwtÀ1XŠÿµ£À8BöP ª§ÿHKWp[C× CP@@ß
[
+ð
+‚ÀÑ>€=€ýq€p0ôWih!,—2 ‘ëñA¿ ;$åE£±Ï(à€Â1Ø`(sÿJ{oø…ÀZ¸`1,™>AƒPP$€ª¯vÿ<1Ž@̯Øh( ì±–`ÈíWI¿1,
Å¡p4ñÀüŠe€¡h$è‰%C¢ ¿ÓpCCáep€‚8Q`ÆÒ`¹uç¯:ÿT=‰„yþöFü¶úGP³"ÃÆa°± pá_â·GDEþ¸»!ÿÄÜ!¨ß
ºýkfø°IÁ8̆ؓë"0Ø€Ûÿ;•…þs"ÿ$þü‘÷ß÷ïýÓKüï¾Ï§¾ïƒé]°ðÇ’`·ððkÏ~-W7Èÿðº@ažÿÂëï†f?2ýEöwLĶCDPTLHäk(ú>ÔÖ‡b@Ž{ Û­ß÷&p0ƒÂ!XU7ë$"ò7ÌØ
+r†ÿj¿äþ{îX¡~g.¬oú@ÙÈDà_íÖß–úØÀ{"!€ÿc¦ƒÿãð‹GEáð”ŠIËd$D2Ò¢¾ÿ"âoÑ¿Î:@
+ê°`ÿüþuzü7u8þ53F Œ³\ü‚An(VÝßo>¶è?Ï¿ñ€€H¦?!@òÁNi™é˜*†œÞwj–í¢ø½!ÈÂZã—ùþˆ6¿´ðEÙRÛ‹Ê¡ºa¹Ë·ž[ÈŸ_ð¯ö·ÓÃxÛR ;y¬¾·ø:ò©æyš¤V…­ÉÓ·Í¢½w?>\¸f!%bººôÎÀкàâúÍá&qÑî	Ÿÿ-÷|Z®c$ÅSPjÍ3ºfÊ:êª[Û<‰'ǼÝ}½=mû_Xž?#æ–w¿FÎåïúœEɤÔ;‚KQ}`ˆŠÔ*Qy˜sÖ›üi„»,.û¬„AîÕh1¬"%>r‘†P‘ÒjPïvk¿&Ë!×"%ÐÂÂG5,|ÜmxùåËÞ=žSMu†{1QóµÅ»ÏùüR ÖDä|äÍO?v<*Y¼è«íøŠæâ´Ž
(àçì4ŽWӥؕ¤JÇ,ÕåxcòÅÙae°ÝJ>»æ¤u³øí«øêsNU‚±ã,=šÙûšÙ¦ûø*â?åu‹
+R~Žú]%™ç‹•`L*¥ž^M8}©d`VC/»²lþŒ<˨Æo¬ÌS†æZ‘>#nÏâc`¹`¸YÅeyÜ*.ìTOo-ž‘6÷/’Râ$ú€«^!î4Íro8”½¦©í&yÔº™]­»˜Ç#Ê@[Ú†Ùu:{ƒP«X5Ýj!%#¬ÅQZß­8dïÔIK×5–Í•—5‡fQ²®¿®¥>áfc47
Bµ“Û§ãÿìªcJŠ)þT|ßÞ!܉JuØ=3õ10L
+ú<û¬ö}£Èùq-Ûƒ~zeÃ츭ר"ÎS²O2ÃM-:á§ýÅìdú‹Ó]º9QN5éL/°ÆýŠº£0U´Èf r5’;ƒÇ>‘*ºiýI˜ÚKµ¹/¤u=mjîk¸gKm¿aÿPwTÕ³’ž ¥8¦¶Çú%Å:Ñy_‰gÅ™\Wë)©í6„Sy®ý?È·=eýNbâìÓ‡²JySeßVÜË›Ö_Üӥϓ:ûÐÉÏÀžäÍ6Óá—»‰ëÕÒJ¹s’ '™e÷Åm2´5*ëi¿²»^“¬¨¿ênV‹~©zºãP9Pu͈ÊÕGîž'ÙÚ= ý˜ÇܨåCfñÙzéÅÍÀ7dÍÖ£ºó¦| dç÷¤œ‚øk3~‰ó$è—w#\ßì¥·&lŠ;Þ	©ó)=‘··XØ£±€”Õ‹2@ÒY/Ùzç·†܈ÜØBù›Bl²³óÊ››{¾OÑG?_æ~]±i~Ó:ã'5|U»Šü¦1×óÜa!r.·>8éÞãd¼øv„ÛY¹ãå»u µ•ÂËïëƒfj.¾T±VòÏsÚ Ó¬ó¾i
+–«jŠP‰¤/¥´7"ÍëOiÕlA”2
*ÆXšôM–*lz-ÎB³4ù‡4ÞDNð˜zKIv.F>ñG·¯›×e³Î[ŠUÏYû~sƒÆÌ©šä˜$×;ÅɉebØ?øµxøÖ|®¸Ó7z3¥:”EÇêÇÚâ㞘
+{ÆŸ\Ö¯á5»Ž¼eÓ›ËEÚˆ´Å[Øž´óváP¤Z»Ñ| sV	¯º2·4eßÙêÚhJna…¤4[Gô¨S8Î÷0}H¹‚3d6Åz9Ñ32éo¢D œš£Í¤l~‘ÓÇ-h£ÓµaÖ8"A­KðE°†WÛ|ê2GÒ˸¹óJYºœÚy®ºšÉâŽ|*yá©mÃcpMÛa’ä×·ÆÞhò$ltk>e?:´ÌÐ%Ñ•ª´}øð­‘c€«½Iõijîv5óÉ[pÜ’Œ`-–•`">ó¤VËJêdkÐBU±ÄQ#mYOkG#ÜÀ]°ybz21ð8V6±œ4±°ý.%àíeŽÇuÑÓVNî"¡Š8^n?ŽÐW˜£Ñf_öhÏ{M[LN Ó³«™%YÉPìJn7×¼^KÿJïÀc†À|å”R«i>UŠÆ|	ÙTѧ ~#ÀËb\’\E±½sÊ4QeJÒÿ8÷Ã何÷@lBj¢rQˆ­˜Š‹ó+Œ,—K‹p@EóªœÀã]×ÔdXБÇlG§ÖÙÂ9ô;ŸKJUkV×$œŒ-sÒâȹeY™¸¦Zª/¡ª[žþÞŽë»Q…û7Ç‹!AÏ÷ƒ“Ä[Ÿ|DˆÖ^E?}ïx°òÔF¢Ñ僅Â>·&g­¹e«³±Îv»K×ÇÄÛÓŽøŠºß²€q¤®”º)9Ou™^"˜½oÎñðUn4žªZ7®‹7%ŽM|Í÷·œ¨ÑœÓ% lš^0÷ŒA¼L–I¥EÌüx±WzíhSþºÖ©"/hý¹|ƒsûÈQâZ#d¶(éXP/Õ÷Š>rf#ÏÕùõõô	ƒˆ¸QÄ/¤²s_H~÷Ðyû­æëdÆuNÕòÚm¯àÍÂœ¥sr
+–yܸŠ7i
ŸË³$u˜GŠmB®péEà‚)¡?÷÷¨ùÃ]ä>)Ì×Ëàˆ·9)mdh=Ë*ð^â¨ÕôŸ¶u·êÌ‘yÐJÞ[Õ«Ç»Ýe;vÛEšKï4¨ÑÔ{ú0(™‰W"©HŸ1ÿŽÒ%H$°îÂ8§¤§:¯ÁѳÌ!aƒZ…:,ý|ùæ•ñÝD;]þ2g¢øþà8†µuoÚUkÁ8½H¾…“ôd³kñÙu¶xµìUß“J€±x4£â¾"¥t~
+ݜĈC»¦†E’ôï{"<~Æ­9Ö‹$ÆV¤ÎÍ~Ä–7
+a¸Qdv¯†Ðq	ùE<éâæÕS†f(WP´±Ê,âÀ˜ù‚cÙ´Vª”Nxªžð,§ñɇ¿Mûé൳1Ø£T’ÓqDìàæ!s¯ñ#!~ùYTù†;œÙ0å²}Ø’:YXÁú±Ÿ ü䙧
+½g¾çxosL×Ð]Þ,[]rh÷Õ@z&1û]‘Œ^ýËJùùWPÚ~–èÜþüå<2m°~~ÜýX3¤ä•Dê^›m÷¤fó¦çë š`[¦Û>=½/ƒg¦¾“D ïn¦î2Í 6×ÉÐ"kHgOð­BÒ\V3ÆqßʃñÒLç>¯íÝàV’WS´±«ŒkJ9odc6¯qqk!Ö¸ú\ŽþBç(U?sss¯ÈÓ8« ûp‡ „߆ð±ÙÔ3+1èó7™­„¬Fû4NÓñ±ðÌÁè–¿/á><Þh{Jžá®Ó.7¦È3«zNy#·ë§^XÌG?töˆn¥ÖÁ©«$õ¤LS->Í»¥ ×¾vèó©Ÿ ð¬«zÑœ—w—Œ¨Â)rüV‡¢#ZÖ{r·úŠýQ•JS!y+i–©Ô¬Ïª!Ð,¦7w·‡3Ž9_j^kû áºÿ‘Õ̳æ0ïÏC¯Õœ4{s5óó|T«oåvÈ$FÓ¾7êygÈ%&i‚|r®ž‰¸w¬¿
J±aeÓ-ðéle‚u=<\²>TÉ]Ì“þ:킶(6— ,zqÇ$c„mו?u~A0ä)¦Ì$<ÝQÅ|ôÞ(<×_0Ð*»ûú€jµ†z‡ 2®Mü~“ož•ãÕj0.'jY4M¡~Ó}vV¦ðx_M¹•ƒ xÖÛ5þLì{æÍš3Q(%ŒŠtŒg˜3tÁÀÆÉ
‰Þž¥vìw̶tøÔ/y-©˜ÞŒ·¤¢×¾>=M“ñ}T;”ÒôÙ}ß(˜IÖq»º€‹OÚ
+…Iš=ñº?Ke7bKËñÂ5Qx\èpX)„¦¤;ñ"OÁµýËw”#;9ïÇÝO·î#o°V0b¢â@?ë=y©ígAscÖ‘}‘×Öé–9l$ìØÙ¬õ•/?Vuþr„†·H¸£¡iD·C*4¿aþ%!¦Ï€„±’­åFÇЪŒìþÆ%GÁ•jØHŸI<­ö¹­M	€È$Ø^-XTÆ‘gØÁc\ÆÞ͵Tµ…„DeˆN\ìcp
+&æe}Rœ
+ÝÙ.;¦’ÀA8"×MÚrë,Nùrû*âTJÄ2}õ‘ÇÑ—C„×ÜT¨ùSÌð_qóÈ|y¸”9g‘](HùF/ýÆŒ
;³r¾™¤W¤o+åZ5á¿yùrØ¥:‘]å<8…±2\ØÞHú*lh.É%Ó‰‹;‹µÈ*˜x0Ç—•.yd +éfnè„ŸòÃ7º<­–îzªù«ÙwFÐM§%«ùÇcÙo´I>¼h¢dRZ˜°æ’lTì<=›¶gôZl¾ø 6, ð¸Þ㲺­I†Ø”ÄMdMúRZ7r®È°…có­*ú’ê™|û~Uùsœ8¾w™ß|:
ùx—ªð5ø‘ë¢äUfƒŠ·`\ékWã-‹Ã<Èø¦Ø.²v
+¹S¿,ÙËbš?u[}Ï	Š$­÷”çqºü	´>c¬£q.7U|JÊâÐôØÅa9ÈFdü
+Âs²®ïxìÑ·ÞÎõU¼çNÙ÷ÉQnÜo×TÏ’ÎuºÄN‚Kò»LµÈ¨?5Ý¢Dª:¾¹Œ÷ôìJ¢*säÝO„7
¹8ÂÂtUóñpDyÒî>ÍÍŽvÓ—…tÄ–Q5ÄNXC-¼Y̳H-sû©do$óú—¯àÐß’±Î‰1bÜÐc]#~’:"¬™âÞ&‹ÜÚ»‹½¼¿ÉAkÛ¹.ÑI%ñÚ®ú VFê}³*Īô£ Ê䧭¸IùdYÙÔ¼2WÀiéùô\Sç=ÝEWäÎ1æqñ1SåÅuüI¤[E¦Ç§œª5Ï®s‹ó•o§Úo…ªw­Ó,•´Œ¾…©XLÄ–dˆŠiÓ7s$¢—ݧ+Þ$™I‹­§}9½äoú‡…J¤„»Òe4éߟ—{Ð)ì.§ï`,ø_
Žô]£Ó0xI°b(ž)ãê¨?h,umëлýwºo+p$wÿ¥LHŠ푪ËÉÕI‰™`’yÕh¸«^ ¨–ìy×H+#…AÛR€>X9å„áýEºyrµ#(uK>ˆš„UG&‚ˆÑ'š¢)ÿäVúlåz̨¢d‹R´«Î‡º»¡zƉjµcãT}Ué±Âl›ú´â5—™OÄ*‹.uiûµLîÝYsx}ì’‰ó®]¯é9^$й÷ŽãÀï ZÍÐl™•®8;•l/öcehU¸r…Ú¾sÈ–BÔ¼HHþ´v,M\iO$rxÚwm¢5eFcXHT‡Àá‡ïòšÉU)Ôj7âÇ㔲hê[ÖY9ªNÞPeV-m­†éí™G¿ö¬tÇfL–ãÒµX—Oûç_'^ÑÈ=žÙ¯nÝ@Nܧy¡š›³€YŒ\ Úý0Rã(â÷p´ÇY„&¯€øJHÖ‡ R¾‡óV7* ÑÇÿ=@¡Ét‹”÷˜F ­æ:kÞîÖj	Û§wŽ(C”˜JU>‚†ï8K,¢ù–.WåN)Ë·¦ŒNžùƳø@²öÅTˆ½É»¸Úè•P›¢SŸÆ¥ CAÜæñ[šÇZT>yÑ/Dß…ùÜŒR¸(HsÝU•àÛ¹ÌõœHû&'!çÀÊjŽ,7Nùå ùƒh±ò2tôýÌUײ¹¼ÁªQ³ãÖq¦ÆÓ-c@/•›·½lÔf>)úN®é¾r‰—&­Â÷T?KMÅ
+D=¿o§‘Eˆ.£9 «6)ÄŸS3Sï,ªÓ/D·$1”Ýš¥¸
+Ä£[‚¨ðõ~õÙÐŽRÜ-Ý]Re¥ðïܽf0é~Ç7ܺ>žéëöåtKð}ô9‚ÎU©å±¤à×ë09ºÄW¾
+¼RO·=Ž’ýóoúSéG–c£m¨fkÕs"ó'o_s]^ž3ZO¼
+ò6'µŸ“y¢½Fm)¨bó®ÚÜž™™'±—£Z­Þµ»t”crÚ¨ØhéGÓJŸè!ÂáIwÆôbUQ€+-\÷1Ä”Ezå"Š‚ðY̘Ôà|&,X¡û¡gô}gÔ©Ð÷¡æåê1´xÇ ÕkH3ꢤ)»_á˜eœÍéÏ­–…|"•»”¶DÎóIñJ+K[	öØ߸Ñ.)ÈÏ{m3®@fO¦A—ŸT®ísmú|…W¯1­œR¦i!9w¥íjƒrÏýᶞÎd§ï2ëƒ'Áhp3`	¬ã™Ã 0dÃÅ)´äãùé—»Å8ë÷Ó;nâçG®ú•u陀ùw>ê¡ŸKè]h¦+Aþ¦b3¤’Úˆ•úŸaä‡9ðÖBvÿÁ^Z
-‹mGÔTá{·s&'[«ûý4Íc¼Ûux'ýEäRÃTqAû©±
–à¥Y.Ãbe‰ýW¾s Â;	õ›jô’ÅOÈå&p
+?V,„[r&Ÿµ±—±Îµ™°ZÕŒÊ_>zL‘]ºw§3„úËDkäÑN!/
å¤/¸SqýÔR¨¿à Lö+\ã¨ÔÃODÇß	Æ@ðWû¬&V‡KÄNqƒšž[¯¶ì=’ÏEU~5Î4»¨6]Í‹9¬±zýÚ-ã”™GÔi¡Tp
ÓYÂnE¼=çOäú½ùæyGŸÌ$IQû{‹2#\Zf*ãl–­†´ÅÎrG_F¾Žqv\uŠ` mµÉϹ–ág…Èâ7W®£åÈY}	=5•)Àº-
+„ì|¶ƒéšNĆQ¼€$2¡ùÛ½óñ†C×mµø£z˜ªÉ)·e&·lªÜÞx
ƒWüŠµ´v_zDºìËóQ½àDãî6î7«—'Øm+À˜v»2ÜKÃ:,¯?ãRë&™ßCÏQΑ|ß=_zíýS0…{Dò³í5‡VòªfÌj£‡ÂÛ„å¬Úƒg# +Y/Ým:”ÖÔãZµ>Xïø‘}õê}‘O˜æ©²8î#]²=x1æú0홟LU3ã	Ȳ1Š¥pW½VŠDg”Ú™]Ç­CjÍ^äßüü?Áÿ	Da.@”3É..„Œendstream
 endobj
 715 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 46
 /LastChar 122
-/Widths 1353 0 R
-/BaseFont /NXYYRQ+NimbusMonL-BoldObli
+/Widths 1354 0 R
+/BaseFont /PVJASU+NimbusMonL-BoldObli
 /FontDescriptor 713 0 R
 >> endobj
 713 0 obj <<
 /Ascent 624
 /CapHeight 552
 /Descent -126
-/FontName /NXYYRQ+NimbusMonL-BoldObli
+/FontName /PVJASU+NimbusMonL-BoldObli
 /ItalicAngle -12
 /StemV 103
 /XHeight 439
@@ -5608,7 +5614,7 @@ endobj
 /CharSet (/period/a/c/e/i/l/m/n/o/s/v/w/z)
 /FontFile 714 0 R
 >> endobj
-1353 0 obj
+1354 0 obj
 [600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 0 600 0 0 0 600 0 0 600 600 600 600 0 0 0 600 0 0 600 600 0 0 600 ]
 endobj
 706 0 obj <<
@@ -5619,45 +5625,59 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚíwePœí²-î<øàNpwîî0ÀÀƒ— Á	îîî$¸w×à„@\.ÉwöÞ§¾»³ݺS5SïÓ«{u÷³úíª¡¡PÕ`·t4Ê8:¸²°³²	”Aöæn.JŽŠ,ê@k7s0ðp£ÐÐH:Í\AŽRf®@€Ð ´ppØùùùQh’ŽOgµ+€^K]‡‰‰ù_–ß.sÏ /‘. kí˃;ì±:¸¾Pü5€@€«
`’*ªzo•eô²ÊZY ÐÙPu{iÅ ²:¸VŽÎð_€…£ƒ%èwk.¬/\â.3€hz	zX!¿!fèlrqyy€\ÖÎf®/wàê9X€Ý,ðb·rüSÄÙñÅÃþ{!Sutqu±pA\/YU¥dþªÓÕÆÌõwnÐp´zñ´t´pûÝÒì…æu59¸\®¿s™– ØÌó%÷Äô§7ƒõ¿*`8­Íœ-Á@—šîß·ó¯>ÿ­{3ìù'Úñ×?k¹ºÁV¬(ì/9-\_r[ƒPÞü–·VŽv¶¿ì–n`î@ç?Dÿ{f^Š0³tt{,V(o”]_Rèÿg*³þçDþHüø?"ïÿNÜ¿kôß^âÿíûüwj70XÙÌþeþZ2€—-ãPüÞ3`3gÀï]ãäü¿ÂÌìA`ÏøwGà_Åþßßá·®f/—"î`ý";+Û_f‹Èh©
-rµ°X™_îì]ËÁè9_´ýs­/AllÃ4m@v¿Eàþ:Xþ½ü¹þÿF_FKAU†éßmØ?žª/“àªé	þ+Ž’£å?¿y$$=Þ,<ìN^//€Ý÷ßdüCÃþ¯³’™«3È`ÀÆÊÆÆxùýÇ÷_'£¿ÑH;X8Zþž
W3Ë—aû§á7láæìü¢ñŸ÷ÿ¥éœÿŒ=è´@Y^p´¶MÍHs­%È“2èíf‡”4hæT;vù§†mòW˜>Ô„°6N<µxÎBwå÷†ºñÁt]ÉÀã<_*†ž|¬¯´m¼L{ïß— §ýЉò>™SÜ€ÓçaÓÞÛSS7.~@ hãtF:¹f rÏÀ¥¾‚`øY¤ÔÇ⵿j„®-8üA›ðýúŠîËðà@×|Ï.1Sv,2 ;:md€S6±¨¾V…w8ÓLÝyLO|¶Õ±ÌmR0þx`ê\y®š½–æ9_{¶O¦/lqR‡ú>R±ñ¯,[¼¶Œ×â5^_¶ir½IlqO›Á¼ß™Äö&Ê”¤Ë‘D¹a}SžU¶W~e5ÁüzÌx´.wíoÛ‰4Š{½#U–pO@¬ æ6Á»¼ÃiáâÍ0:Û¦±™§ëGþ®Ÿ0h3\i³NwÙ{ø…,òŒã·uÏZ!¤lÔppIödp'$ß¿Í…ê)O2å¡8±â*Ú!|Eºg²Yñ¢º.€êYŒày¼F¼mÚ™¹@.Aút˺—µX[Y–"˦¢e¦ ’÷+çí¸Ùš¤œÝU—w3&4|Á|—
ÃØ8¯‚ÄQ-Bâäkµ¨ÝOÕß·­‡×uyrŠ2¤îI¤ù§6èP\1ìZõ|lýa?‹õ(a§d¿Š¢Á!~±‚¼€Ã,F.ƒ4sýíÀOKúsÁ´H
]h\]çþêTÐÂÎE~£Îéâ2üE2Î$ÏOt:ò«
ŸÛˆC™ öQÄ–¬ëñçO$¶"æ$:,þa8§}îsž©*“v¥Ðš·ˆb½LÇïƒé]9v¦²=»
-ÙAš×`aßy\Ò@§ÕY~Š“·Kã›–%’Â!
-ŸíB(Ö†ðÖØ»±µŠ°
‹…,×ëb³’ª*w3¾é‡Öm‘$Œ
-½@}ëœ){Çw“·µx´Ë‹D®¯ã#^Á2j¯õ–pÁŒ[‚‰³¡qòºãïùRì}¡LÓ¥›%'!*=wÑvÑ*……Ûš,T«âˆè9Di‡Ù5[ÅÄHÄi‚=ÉÓz°%ÈûÔ'|Q/:Øõ³à ‡?mn¤ârnoÍè½
ŦÔê;@,æ!ŒÁ•f£E%¡keÔ­Ž~$ƒ­©é[*":]V]™¹øLÖû“è–ÖUw‚{çĘ¯ûéb0n§3‡}ñcÒMî,åpàNý¦)³Ybº	ô›<ãZ»J'ßê‹T{YΔo¢EòªEÅÖÊ<ÝÊÌG¾ô»½Í[ÿá¦H[S
ÜÍ<Û>hÒÒ÷|×4ôs£0Ÿ‰ÉÕ'·_,Ž±]ƒB·%EzûæñÓ¹²QÔ6‘fæ鋽”±ìH[Â*â9‡=öÂÏÜˬ8U7&%ÍŒ’*XkËþó;geÉæ뇷tÛð˜¼ÊÑüífi‘̲²Z:öÜºáð\åæ„?7½[´:‘BWF}g<KªjZmúU%Sþ,‘Í|BºÉ”dÛ¡Þ¤gÀ)€0t$/10žšGrÉæbpÖŸâXÏx"1%¹ˆ£jÞnÔßSƒã¶qU%nDY>BœOÑ5;·,˜ßîZ“ÄÙðØÕ°].¡ûÝÄb½Ò$ –­Ô)mÎP*ºìÄrÒ-¼¯D’E*žoeÜ'ˆJw(8&*d§»ô¼_¾Å–2¦<1ªÁc‚\iìx^#T9ØÐÅÑß&t¸å_A°Y¥®Óq_›às¡TÆ^Ÿ›ûIœ‚Þf^‚6+òé«Î«ÁO¬ØÁ{8Nïô&ß(ÿˆMÐyO|1ãøé8˹Wâahgþ}AI<_àüŽ#’ýd~PŠ¬ÂC ðê–ì#¶Ò GÜQ¬1,–}NèëƒV,*ü7ç#~‡	ôÌAÌ͘¡ÝëÚ4f7\ÉôŠÉu-Ý>c#Fì¬1¨b•	P>O
-×#uŒ	dî´vxcA°Œ(ÓåNÆó•“øÖ°á#ø›YY¬¼
-SÛ7Šlzrs;Ó7_%w—D0òŽó	Ú.Ħ›k𲳩1PÖ¦6²KÈguZíÅsX!ÄG…w‘èêÆÁÙzûŸŒùTzŽ|=šÈ-Ñ*鹂ŸÓñzŽï‰Iö¡y¨Kï–]»î:b(WýnšvòcƒN„dy‡Qr
´6[¦$Ös•ä_Í‚
-\Τp£I¤3D,R·àIÉCÌbúÝÆcöè¥}p›¹kÞV%_²[¼Í®SW£¥ýbõ›jÖ`#~	Éøš©¾¹H,Ôu´ãZªüÌÊ\¹åP¾‡ÞG¸íjý¼bVËJG´Îw´ÍÀ÷Ý\‘Œ•^¾($܉öBžÉu	ågXçš?‚åJâú–Ä´Ž5űgâ¤]ÙR10í±ù7â¯%±ÄnT
ÛD3Þ›¼C;Rš ­xÑ ³î÷îéüa¾¨ï+b£Œæ‡Åà+#pœ”ìÒÄÁÌ
-åÞÖ,„'µEjŠ–g-ÃS¬²«¹
cùüÞ:^Mö2æ!r¦*Õ´]“îÉýõ¯
4öÕÇ°ã¶`4½MG”nNÒ	æ
˜Ÿ³zG˜ìrºdéó)|ˆ“]È¥dõÅgy-š~ˆ¶>5qNÜ=Ü×k™¹æýµŒ÷W¦'«žv†9[jä[oíÓ¯§×Ð~º·4±ó+
îÉs*¡Çˆ½¬DWŒ H;,ðMAK¡†Vª’½?2ÀŠOq#¥x¯µ× MQ~{÷¬°ð^t&!4[]Õìçí*WÜ‹Æ[“ïµ#.“O&Þ‡Ãü‹ï“çu§Åü짶iX©r45s	*Œ9O¹s£z‚k¥´¨=’¨Úˆ«†­Þo_Ò
ßÈüCÒå^„ú‰š´Çzó•]愤f¦ßŸ}‹*BÚ;ÁB_~ñ¶Ö›¯V]ºOfU8°ÄÜóÅÏ[Wkx~Úò5¯àϘY?ß*ðI2ˆæˆt_
-VJ•Ux‡Ž<{-o‘òzzQvŽnHᣎìÁëŽLÜÒxNèTúÁQÕdÂt¤–²ž3TK¢³ÐÑ.ëÚÑÕSíœO3†<—7?¿t—F=ôFé¶?^K”½û‰×è€{ºÌyÕ…G5ÑaÔ]:»4aNØYW¢ öX“Sà#«tqËG<¤¼qêN‚Cw#¤vë#g“AýÊ=×4}Æýn–	Yƒ²2<¨Ò÷åqñø'
¨iaŒ€½¯©5[ùsZpñ’]:à~ÿYsÚC¾	׋…f^5ºʺ%iö>®pý"½ê+Åß_5rÎÌð–rb¡úñ%&ùòsÆ@%s‘h¼>¹eéN!I±rÝ\ÅI-ÓávL^lVc°èé4ÐvcŒ~ŽuŸÊ:êšÀ(VV±FšÉFÊ„5ª@w:¤¢O.¸Ò:¨EˆPáüòkýÁâ{b_(R{°X3#Ñ2a@wî*sH6›!	rÒ\žÿMòÔtÌ4":Û_Ïi{ójćˆ
w<<8×Ôæ‰Åø=´©AÎIé	·´¦áƒû…öêFé³¼fîAz(`w|îwÝzmYE5Ðnv.Ç„½Vã4É®U‹ÚÄòŠsÃÀ®»›„äØÏIt£ã€;œ©Ø!‰ïmåF£0U?N#€‘Ô®ù\ã–mTù$5¦M…PÏ`‡Ðµn¹óòËj{Xá‘‹ëi&‹ß‚0û‰	—È÷”¾ŸÄqDéªÂä’½É}ýS_gøë/ã1m“.d½¼Iö»8–areùƒAÕ?"ìoHàØÎG
-Ö**ñgòñ¾]Užx9ˆC†ÿÜåxž„î(O®–ØþÛŸÒè!Káüˆjª&8^µêð‹šn³•žëÜe«?âåßpÅÙÀÑJˆï	D
¿Áó4lr™‚pFmiøÃ÷¦ð(cÏžƒWÐÈ(ò¾KÄQ$x*’)onud€F›f¿¡™²r*f¿+báÖJº‰uX“>ïãFä~vSè>ÁÞùEYZ3íüúiÌH,ÂÒ‡èÁ9¼`£x¥Â-rñη,ÓŽ<‰ò1‚Hv¹5ºæÍSlVr&Sø o­‡n¦¥°kEª3¡6ÿP Á€vúw«±K¨~Ñ~ïÛª„¢Ï*:„‡Äd
-ÎgÎ<Šl’ÝVà®õÙ86„hd‚b•…‹q?þh8_JƒàôXMàÙ¹[ŸGTtõœÝ%±_~MgþDõ:ÚÆÇëÔ³
?ä•Zož¦Ò>#™ëlY†ýaɇ;eJÿ[½DýîRŠaNï}X[ÓB)¡ËÄv‚e>8¸>§DvZÿšÙJ=ñªÓÌÎrdYS¸U—äeg•‰7£1bµ‡?ôOåMWâ9ìX8+¼§”n‹&y+‘¿‹uðà¦y
?;å^¬Ñçê^oàÛ0|½Û†Œ~HÈ.opc›7Õâ̹Ήé.­2
-‚—y´’,¯K.Œ¾DKÇ5Z¤Üiö•®‡A‘Ãn•?•‰†Î_#ppÚ“øëslg°ˆ!P@0ŽÇ0!IôqªyÕ÷ƒ,#ÆM>A,†o†•¬‹ÉV3Ê,ï42~(ã³
C‚ý(]åÍ\Hæ?òÿŒ½My•Ô»=Iñ NiõÉ -ˆ'{€¦jœ%á	ÏÆÛÀŒ
Ξý;û•î|©ÆxCõQ®"‚Ćç?C¡øötxäI™šº”æ)¥4÷nYoôÙ!s©ÂÝÍL¨:éˆ	qQ§¾pº¾îáÉï¹aÛ3±/¯ïÙ”¹dS’)뼞Tð£ŸNjûÉ…Äáv|Næ­P8Ël®BP³³8mÌDE§¦õVû!oÕ«Ir°Ì3)Èjk("÷ÚÜaä¸Ò¹²àÆcqÙkŽ´¡ÇoÍ›×,Åì"‡Tl1x>X
X+„p§¡9Ø6⟧ÜzênMÞtÈó/@a·q…>JÎåƒ×)Öq’¡•aòö›’¾Óª#FŒV^Q*º/Ú£Jiî–ûTïØ]¿­"»dI0¾—ÿ1 "¿*!›–¾5ù¬ƒ{î„ŒŸ›¹'ZÀ#ê¥økø+³QÛ×#K-nÕeµÊsˆgâMØ¢{¤Ê1áå’Á„f7ææ,^|æ‚m”¹_1Ê*5ƒ­6È]¬‡—UÃä]²Ãm½©8g¢²©'š¢OS-PÑ÷"²u\O´•»ª’¿Â6Þ¬ŸŒ¦ ‚Ù
-ÀV²À&rG\@¡2;º‰—ßpq1±nÑ#›·ž´ÖLÇÏróqøØY"’*ùý,¶Ý0‰¢
-¿Í•¥,á	4[ì‘­îeÃüd?i‘âÊôb!ZçO;í,§©ñ’‰0Ò*Ãj»ìép细ÖKLØþorÍ¥ã;»\Ç‚ÄæYq¼I›Ÿ	êihëx6ïè„Ŧl»½µ}KÐiÆé`¸YKqü>ªŠXà¢8%	De‡)eZ=éÆ5¹8šˆˆÚ@Hø°û,ÙÕ©¦šc£æò€çSÌàŽ-·ÏŒ·…âŽó^µz2gt_‹^)»ïqŠ;AQ3pÀÇ÷óÊé¥ôv8%þ¡úƒèÙnä°ù.ûÇ$˜'¶‹ò¢¹›·MWÇÞD±Œ· A~Xû×iÆZ«¬²·„Ñöà`Ò+p솭ñY‰Òduéì½:šê÷}'F4Ãɯ2‘¦ák±Ÿ~×eÐæ¼÷rB†A|t#¯]vË=~gWƒàFòµAp)jKâ}*3Ñ4W`æóý§/Ü兓DzÂÈ×êŸ/|Í8/mÞ'*ø~VŸ‰|sófbrµ®]ÒÙ‡ÊÍóI:˜S±¶gšÔ¤-¥D8fv»—RŠñä@þ›ðšaîèáÂb&%dY7üõÄGË£ºî¬ ø~%ˆôH¿j7Þ›×µâ×Øiœ%úS<ËPÕl­M•„ïãø5ûk *«B¬®&œŒÖÏüͲD ¥÷À“	ϱ´5w½S~A®}fÂ
`sÛÀ¦f²‚ºÎkž™Ú‹á‘IÞÓÁ¤P ;Сv¨5eñ¼® ZÈ÷ÂhÒ®»èü`qú£^kMà7ž5 ¦XÃw¡Ð4ýbrfZo½t“õ—ó­ðëZ	F•`\ð¤h’´V4ÐB¸Ë>únNŽ:I-Ÿx”YP†²1¢‘Å×¹·¯G§åøöЧÏ8­ˆ‹/Ò•wWûqº!œÔP§i(e¹y¯ÌÝÂÎlY1öjŒ›ëë”!êEoL]—ÝúL$ÂöjaãõµUÒ\\
ûÌèVþ@èd®@î§èB”³Â ºô°O«ÑUŠYÄ!÷œðéùìTmü	¯I¥â`%s’x´ÞI™®1̱VÇ‘”ÇßxŸzîjyá„LøBgÝDz)„T0˜i !Ièv»F*}TL¦	ºnåòñúiÃÝpæžk
íšË3£Ü7süÔ÷}R÷6â
Ùi$4`WÏeÓ'+:Žc8ÄvdƒÆ }ÿ˜zZ²49ŽQüpwØ^:Óâ «[³ÇÝ™=¦›—í,´£
§=“i»X½ ½%_tõ«!y§ˆÃ|ؘھx ú•@4†ÿ¼Ö1}ÒaÂÙ-ó|3diˆáVn@–!ƒ'“û]áè_§1†&yßB‹:Ðä7UŠ]æŽáµ¹Ym†"Á¨jqLT©»sU™Çª…ÕÌEkö•ÏKo«£Õ;`5UûÃa»qõšF^`¾¬9*ÈŒ·†…	;.}1ǃtŠMýÙ;
ÛÉqIÓåµ×2C~eYý%ÁÚ÷„Ñ{*î¤ãë¬brËuŒÀRÖsX™€(¸¨.¤àÀHš":Κ%ì(Z%ÒwÚ‡×ßù|Þ[ÏãË~ÜX²†*ãQY®˜?å~€Ð¨Ù÷w_pOÖ}Ìjàå¨òN×±“R†êVªv3ÆxSqÁ×¾úË‚ÿªb_µÄ<1Eø}PV-ÊíÚFPô¯ƒ6Qöi‹mÆcÂ;1êèXæ_6êMqÆ9Îc÷&¿¡päxy Yšeì÷!jZ—vs@#ñó0涨løTŽoüS¯ Ö“D¦\Ýj‚RÍŠÃn;y:Wa·¾ñ´Œ¹Âž^ÚÚò Ýô&3Ï}•Øä¥á:’%Ž€Eò±¹©OÝ ëCÿìè…­JQ}ÛydÓ«ÎÁ&ñ.Gp©]¶²ÞI‚46~m ],¯D½Î']øèÃFÿtLÍš¡E
}â"¸6²––Þ{ß¡Žjºr•2'C¬Ú¶$'›§]É®A°2Ø3ýtËS›ÜêÞp|ÑVÍW#VôÜþ½¢t†ƒê=,MS®é/þ§9?-7IÏ°t3·s¾˜HK=ø'Ct zºCä0ÈhTp!„­ÑöG–¶÷òüxá3œ2{ïÍx€Hè ßÅN¢SWÈÞU/­QuO}•ý*ÐÚ¥Æ&v¾]ÉšŒÉUþ^ñM%fÍÎ+ª‘S¿³Ïªs†]Ì™ƒ
¤4"Â	ž?ˆ'%¸ î9õƒó‹}ßùqØ]–]k•8xEký²eEJ4¿°’³úBÛœ!¿E,~ãŽTS`Û$螺úˆ)äÎX¥wç}¡‹g¨’ô¸ç¡m¾Z„Ï€ÄÒw°e³ÿ6¤«Í@MýSô7nDAðÙg·u{\úzoáiC&‘RŠVçÇdA¿W"MÎàŸX]2P‰éÐ.ØYËÍY.oiªƒúˆU÷ÑkZlü!µ9(1Ÿàd¶aw¨É¾ †µQ1Ÿ”¨9ŸDv2@&*•ŠíùAùÿÿOX€fήŽöfÎv(ÿÀ‘bYendstream
+xÚíwePœí²-î®ÁNpww‡à>ÀÀƒw×à$¸;$¸w×à„@\.ÉwöÞ§¾»³ݺS5SïÓ«{u÷³úíª¡¥TÓd·t4Ê8:¸²°³²	T@öæn.ÊŽJ,@k7Us0ðp£ÐÒJ:Í\AŽRf®@À[ %@
+hàà°óóó£Ð$!žÎ kW½¶Æ[&&æY~»Ì=ÿ¼Dº€¬¯_Ü`Gˆ=ÐÁõ…â¨	\m€+TUÓ“W‘Ð˪hd@g30@Íí¥€ÈèàdX9:ÀŽ– ß­¹°¾p‰»Ì. è%èa„ü†˜ ³=ÈÅåårX;›9¸¾Ü«#ä`v³ü]À‹ÝÊñOAgÇûì…LÍÑÅÕÅÂq¼dU“’ù«NW3×ß¹]@/0ÀÑêÅÓÒÑÂíwK°šÔÕäàpz¸þÎeX‚\ `3Ï—Ü/dgП2Ü\@Öÿª€à´6s¶]\^h^¸ßοúü·îÍ °çŸhÇ?^ÿ¬äê[±¢°s¼ä´p}Ém
r@yó{Xä¬ìlÙ-Ý ÿÀÜÎ.ˆþ÷Ì0¼aféèöX­PÞ¨8º¾¤ÐÿÏTfýωüø?"ðDÞÿ¸×追ÄÿÛ÷ùïÔ2n`°Š™ýËüµd/[Æ ø½gÀf΀߻ÆÉ
ø…™ÙƒÀžÿ&ðïŽoû_|‡å]Í^.EÜÁúEvV¶¿Ì ÐR
äja°2¿ÜÙ»¶ƒ%Ðr¾hûçZ_‚ØØþ†iÙ€,ì~‹Àýt°ü{ù/rý)þ¤Ž‚’²:Ó¿Û°<Õ^&ÁUËüWš·ÊŽ–ÿ<üæ‘pôx³ð°X88y¼¼\>vvß“ñ
û¿ÎÊf®Î €+;àå÷ߌþF#í`áhù{r4]Í,_†íŸ†ß°…›³ó‹ÆÞÿ—¦ÿqþ3ö@ ÐeyÁÑB0Ä6=+õ–0w`LÊ ·›v RÒ U˜PíØ埱É_aúPÊÚ8!ðÔâ9yÜU`Üê&Óu¥?’úR3ôäc}ÝÆË´ôƸ=ãÇÛï“9¥
8}6½­1u
ãⲉ6Ng¤“k†j÷ü<š+†ŸEZ}<~;V#NmÁá×I߯¯è¾ôwÁ÷ì’0åÄ#Ó
+ºÃ¡¿ŽpÊ!Õ×®ðŽdÚ©Û£ˆëIÌå1ñ:–¹M	!LŸ+ÏS·×Ö:çñkÏñù È[œÒ¡±Tlü+Û¿-ë•øET×—mÚjËl	ò>õ	_Ô‹vý,8èáÏ D›[©ºœÛ[3zoÃC±)·úˆyH cpeØhS‹GéZuk€ÉaëCkú–J†H‚O—ÕVf.~†÷þ䄺¥u5\càÞ91f&ê~ºLØéÂÌe_|Ÿr“7K5¸S¿iÊl–œiýæ£q­]%Ã['ßê‹t{YÎ(”o¢E
+jEÅÖ*|ÝÊ|™w{›·þÃMѶ¦šx7Zmû ÉJgÜó]w2ÐÏ"|&&WŸÜ~±8Æjt
+Ý–”èíC›ÇO/äÊBEQwÚüEšm˜§/ÞôRų#m ¨ŠçöØ
+oJªb¯-ûÏ¥š¯:ÜÒmSÂcòªÄòGµ›½d–ÝÒ±çfÐ
‡ï*7? Œø¹éݦÕáˆú»2Âœ;ä!X25#ÐjÓ¯*™Zðg‰æ²M¦Û&=N„¡#‰ñô¤—l.gýiŽõŒ'S"œ+€êæíFý=õ1¸nWQ5’F”ÕØ#Äù4]P³sÀ‚Y~ך4Á†Ç®~„ír	ݯ¨¨è&K‹F¶òmis–rùÐe'¶“ná}%’,Rñ|ë,ã>aL¦CÁ!0Y1'Ü¥çýüªPXXÊH<–êĨŸer¥¹ãyPå`C—@Gr›Ô!à–Áa•NºÎÄ{eBÀ…P}jlî'qþ	z#„y	ڬȧ¯úc
ArÅþÃqf§7ÅFù{ÂÎ;x’›¨ÇOÇ™œØνC;óA%‰|ó;ÚŒHö“IÁi²Š1€À+,lÙFl¥ÁxI¢ŠØcØ,ûœÐ×­o±©yÞ<œ_4Žø&Ñ337c†u¯ëКuÞp¥Ò+¥ÖU´vûŒ±³Æ¡ŠyT$Aø<)^Ô1&‘»¿¶Ã†ídD™.w2ž¯œ$à°î„!ðØÌÎfíàUœÚ¾QbÓ“›Û™¾ù*¹»$‚ññ8Ÿ°íBŒaº¹?'‡emj#§„böm«]²x.+„ä¨ð.]Ã8$Goÿ“1ŸjÏ‘¯G…%Z%½3WÈs&¾CÏñ=	é>4Méݲk×]GÕªßMÓN~|ð‰,ï0Jž±öfË”Äzž²"Ö,¨Àå¼A
+/–Tª1KÄ"}žŒ"Ô,®ÿØmo¸Ny\ém<
+~Ç€ŸFš[pcù¢3yŠ˜…Š\ØrJn‚Kµú‹ÙváçÔN_1oÞAM¤œ“*‘~à0sæQ@ÚtíÁ~Ȧ.ìó?–µçã’»ÿ˜ûnW¿	mC­åÚÅ‚¯•Rî“CùW&Þ„Ù-’ˆ»[—CxþѧgT`&1|ÑJã—1`~	PVƒs
ÙÇ„ Ú)a4»ZÇ[X€ÆF¹”2‡;mS¢ª&ä GÅ*‚b˜Xõê¬ÌyÏë:°íMhÛÔÑÜ-¨‚Þ¦!anPÏÇ”díFÚüÚI·«³J 95ò«‹iYïIôÉúqËñú“=ŸÑÒ~±úMuk°¿„‡dbMTß\46ê:Úq-u.Á
+fežÜrßCï£Üvµ~~1«e¥#Zç»×ÍÀ n®hÆÎJ/_Rîd{!ÏԺǤò3ìóðæ÷`¹’„¾%1íc-qlÇÙ‚iW¶tcL{þÂÄkIcl1‡E5Ã6Ѭ 3€wXGZ´/dÖýÞ=“?Â5¨r!>Æh~X¾2
+×IÙ.Ch’Ŭø^AQ¾f!2¥ý+RS¢°k¾R•]ÍmËç ëDuÙ˸‡è™¨tÓv-º'÷W¿6ÐØW#ŽÛBÐô6Qº9É&˜7`~b8Ìêa²Èé’gΧñu NvA —’ÕW”Ÿm´ifø!:ú4$¹	÷p_£¬eæš÷ײ‚®LO„yÆ0Ž6O Û—‡œjæýgWp„å^eÖTiDÞ6}Óû—FrV=+ìs¶ÔÈ·Þ:Û;§)^O¯©ótoibçWÒóÑ©„#þ²])Š2ã°À7
-ZC¨JBöjüÈ+>Å”æ½Ö^ƒ6iDõíݳâ‚<¼èLRX6Ž†šÙÏÛU®`¸	My“ïµ#.“O&Þ‡Ãü‹A©ˆóºÓb~öSÛ´¬Ô¹ZZy„ÆŠƒœ§Üy1=!µRÚ4)Ôm$UÃVAÛ—tÃ72?"P„t¹á„~F£¦ì±žÅ}e—9!©ÛFè÷çœÆ£ŠõN°Ð—ßC¼­õæ«Õ€nÇ“Ù,q÷|‰óÖ!šžŸ¶|Í+ø³fÖÏ·
+|Ò‡b9¢Ý—B”Óeß¡#Ï^+X¤½š^Ô€ã„R|ÿVöàÕâÞ¼ÒDNètúÁQµd¢L¤–²ž3TKâ³°Ñ.ëÚÑÕSÜO3†<—7?¿t—Æ<ôÆè¶?„^K”½û‰ßè€wºÌyÕ…O=ÑaÔ]:»4aNÚYW¦$ñX“S «Ÿtq†(D=d¾qêN‚Cw#¢që£`"“AýÊ=×4}Æýn–	Y“ª2<¨Ú÷åqñø'-¨iaŒ½¯©5GåsFHñ’]&à~ÿYkÚC¡	Ï‹…v^-¶ʺ%eö>¡pý"³ê+åß_5rÎÌð–rbaú‰%&ù
+sÆ@es‘Xü>¹eéN!I±rÝ<¥ImÓávL^Vc°èé4%ÐvcŒ~ŽuŸÚ:æšÐ(^V©FšÉFÊ„5¦@w:¤ªO!¸Ò:¨M„Páüòonñ=¹/)‰=D¬™‘x™( ;o•94‡Í‚¹m.Ïÿ&yj:f•…
+ã¯ç´½y5âC̆7’gjóÄâ|ÈÂÚÔ¤à¤ò„[ZÓôÁûòúêFù³‚V"vÏ[´¯'›0¡'Øüˆu‡Haq>æ–‡›äã#‚wk¸WS½Ê9¤_,-Vˆ:´'Ù™ªÎSË^eæD¤‰0
+[ê©úɱշÆ#]ðN«³¼6m¥‰8\mm×–æO*Ídœà?Ôd&ùãͼbÀ`›ÂQ EÑöý¸R>™üý‡Âk<7½¢ŸhTª*ñ!þ™ï¹ûXâ%|‰ddu:Ò_'r䕯w–Möaª4¸Í(#在žÜköÓ?%
sö)Y~;=N³2€†»F
+ØŸ;Â[·^[VÕG
ô…›Ë5a¯Õþ·«Ê/qhÃP៻AxàIèŽòÔ*a‰íŸñýi"ñ”Îèa¦J‚ãU«¿hè6[é¹Î]¶ú£^þ
Wœ
­„úž@Ô	úØÁq‚'QÞG«Á.·C—‡¬ö™Õš#ñÕY”…ý!A¦S3çìºâÆe²OÙð<è4ËÕhB\ÎÛ/f–Ѿ39ó6©ÇfžÝ†ÒanÂÁÏ×áá–>Ï€V=Æ]‘ïÈ|zˆ•T°¹ÝH’“=æö+•ÜÐ~áâ>è?¥ðR­M	:Öª”¬¯¤1ÕUÓ2jmƒ<ì &oÅ•M<Ã,Aí‹KoLÇ/ ÝžKÅ7™ ¡„<¾Cšì+Í5Êhk£JVY+x°ÀBú€ÛH¬æó§˜W+°}_…{½FpÓV?aÐ:Š&2ìå;t‘Á(Ò#8UXÊÈÚèhÝk'gY;ê8?çèX¯^a’öþOw£RêOé}O`)Ž}yªÔí*°¢ÑSK2qLØ,V¯`¢~Õ‚Íà6ÛÊ¢o&߬þÁñ÷©â¨)m[z2{i¤o‘ê&ÂÑÚ\Œ4æ™m’íõ;v¶,ÃT¼ó&æ·ñJö6yŸÎ4ôk¬`äÌrâœîLC¶
+Ún3!©E:qg^˜½“çEÉHûK뵋Ùãi¬r°"×$n{G4.ö5b
+C'75¾caÁ¢ãmƒž•å ûZ *œ®ÉÙ
@œË¼,A¾‚úqhîA¨øy#³
+1jÚlÑ&³¤=mÒ;HW3ßF]-˜b:¼a²-m½Í¸×8%3,Z¼RåØ;*…0â+1wf	ž¡¸rA7DZ	Ž»µ‡Á8Êœ”ÎR”Ä<¬¨ÅòBu%Ô_`î”Eû1B–Y«æ;7¢rœ–õôú[¦uÍê«‘âa®
+Øcîmë5+¨38…y-5*6Ó¼'G†I¡s*Éžš<ªf'&Â÷ç)7+9Si|пŠ·ÖC7¿¦´kEª3¡1/`@;ý‚·ÕØ%T¿h¿÷mUBÉg€Kj2ç3gžE>Én+p×úˆlJ<2A1ƒÊÆø4œ/¥Epz¬&ôìÜ­ÿH\tõœÓ%±_~MgþD	õ*ÖÆÇûÔ³ K½?€÷£–ò>#¹ëlY–ýaIø
+•ªÿ­^²~wå0§÷>¬­i¡”Ðer;á2\ŸS2ûkÿÚÙJ=ñ8ªÓ;åȲ¦p«.©I*ΪoFãÄjèŸ*˜®$rرpVxO)ß-.LòV"ëàÁËð:¾ßOw(ʽ +X£ÏÕ½ÞÀ
¶aøz·#
OÈ.oðâ›7Õ̹Ήé.­²
+B–y´S,¯K.Œ¾ÄJ'7Z¤Ýiõ•®G@QÀn•?—‰†Í_#ppÚ“úëslg°ˆ!PB0ŽÇ0!)ô	j«ïY:FŒ›|ƒYÞ+[#’¯f•YÞifýP!`9†„øQ1º*˜¹’οçÿ1›†•Ò»=Iù NeõÉ #˜'g€"C-†óçþ9#Èï³Æ<4Wkë]i¤ê/£lŒ$%~î
S,…@õŸ’Ñ–hŒµ£Nó+G“}Õ‘Üi­álNͯmÎ#ý#¾tK§·¢žZí%á†ÕU©„#àš?,âŠãµ Ê…Å_gd4°‘½ÙÇTK°$:áÙO"LÁØнݳg¿Ò/Õ˜Hh¨1ÊõòþQD„ÒðügßÞ[2g¦¦.åy*)­½[Ö}vDÈ\ºpw3êÛÌ@Ĥ΄˜S_8]_÷á°Ô ®EØ6ä8—×w‡lʃ\²i©Tu^Oª±O§µýä†ÉBâp;>'óV(œe6W¡¨ÀÙYÜ6fâ¢SÓz«ýPy
çjÒ\ló”µ5”Ñ{mî0r\™\Ùp†?ㇱ9ŽìµFÚзæM(j
+bvÑCª¶<áVÅák…î4ÛFüÀãó´[OÝ­É›þ(œ6®°Gɹ|ðzCà"å:.B*´
+ÌÇý¦”ït†ˆQF'£•W”‚Jî‹ö¨RZ»å>Õ;v×òu"Bä—,IÆ÷
+?tBVå äÓÒ·&ŸõaðÎÑ3ã?ì‰ðˆz)ýþŠË¬MÜöõÇÈR‹[uY­Êâ™xŽ(ä©rLx¹d0©Ù¹9›—€¹`eîWœŠjÍ`«
rëáeÕ0Eg—¬ÀpÛco:,Cú‰–èÓT`T콈l×ÓkŽÊ]5É_oÖÏFSPÁÈl`«@Y`…# Œ‹H…ÝÄN›Ëo¸¸˜D·è‘Í[ÏZ{¦ãg¹ù8|ü,1i•€Â~6Ûn„DQ¥ßæÊR¶ð‹š-΂ÈV÷²a~ªŸ´Hqef±ÐkçO;l§©ñ÷’É0ÒªÃê»ì™p细ÖKL8þoòÌ¥;»\Ç‚ÅæYq½ÉšŸ	ëi_×ñmÞÑ	‹MÙv{ëø– ÓŽÓÁp³*•âú½W±ÀCqJÞ}‰É‰Vþ`õ¤›Ðòåâh"*f!)|÷Y²ªS]-×FÝåߧ˜Á'VnŸÅ7H­z2wt_›^9§ïqŠ;II+pÐÇ÷óÊé¥ôv$Á‘ƃèÙnô°ù.ûû˜'¶‹ò¢¹ùž)ײ°„Ã\f+5ôeP„œÅhQ¯5F-1á:ÝÛŠ«ëm&5£‚Êñ@Š"œ¥JdIrù’ÔW®VéTÿ]ìò‡¢ªÏ§Çñ¶ÛÑûÎQó×pàûŸVŸ¦«ãobXÆ[)íz;J}$ã%!ša˜¡(¤<¡Ú»álÀ¼ìHÅ­p$Èkßã:­xkuÂUö–È£×=#˜ôŠ»küÁV"‡´ÙCz{XgBSý¾ïĨf¸ùU&Ò´|-–â¡àÓïº:œ÷^NÈ0ˆnµKÃîòÜãwv5n¤_‹—b¶$‚Ò™‰§¹?<ßúÂ]^8y,»1!Œ¬y]¡ñùÂ׌óÒ&(YÑ÷³ÆLô››7“«uí’Î>ÔnžOÒ!œJµ=Ód&Ýhi%Âq³Û=xTR¬ˆ'ï
+¿Ø„×óF¶?0PA–ßâeP¼šxoyT×]ƒ߯q‚éWëÆóªVüš'ƒ³DŠgªš­µ©’((_«¿ª²*ÉêjÂÉÀhýìÀß,[Rz<™ð<ËXs×;åäÚg&Úö7·
lj¥*j¼}Å3®³â=Bºê„YSÏë
+¢…~/Œ%뺋
Í_g>êµÓ~ãYbŠ5|
+ËÐÿÁÓ6æ›.æÏcÖ(‰…4Sü4ºÖ. ³îñ à“ò<¯¬ˆ.76Ÿ?õ#»Âoyù£ðc
™2ô2Íû>Úé	\‘ðc"l誤çoIk§†²ÇÝ‘Ïs§§+Û¤ßÈ„ÊMðʪìW¯> ÕÅŠJ~à‹“ç—=6óÎ/QP<Ž}%´5*¦²ÍÌà‹r][¸„ìWMfRA¾.¼Ôã·v’ówØøÍÄVn®q»7OçÙ`°W¹(ã#ðmL¢mÚ¬61$"ã”’OãÙ¿
+F
]bI“•C·v0ô]ïsŠ×V*à&Æ:-H3Ÿº?éU#™”@¬dn
+ö;)Ó5†90öê8’ÊøïSÏ]m/‚ƒÐ	_èìûD"6ÅÐ
+ó/
¤¤IÝn×ャÃH£J©´Á×í£\^"^?m¸î#ÜÓã­¡]?Âǫ̀ôÍÄ?õ}ŸÔ½ºCCv‰ØÕÅóØôÉ‹ŽcÄqÙÅÄ 1È‚ÓÏAK–&ÇqJáw‡í¥óðq-²º5{Ü9cúxsœ…vtàtf>Ø.V/èàl)]ÆüjEÞ)â06¦±/ˆÅˆÅðŸ—Â>¦O9L:»åcþ‘o†,
1ÜÊÈ6dðdrx·±+
+þuch`’WZÔ6¿©Rì2oŒ`¨ÍÍj“(	FM›c¢JëÊ<^=¢fÎ(V«¯|^z‹D­Þ»©ÚÇ«×4úóeÍQCf¼5-LØñè‹9¤ÓlêÏÈßiÚNŽKš.¨¿’ò+sÈî/	ÙXй'ŠÝSu÷ _g““X®d–²žÃ2ÈÄÀÅtÑ"ÝF2”Ðq×,aGÑ*Ù¾¿~}õÏ'Èzž@öýÆÊÈ5Têr]Àü)÷„Vݾ¿û‚{²î}v/G•wæ[;)¨nåj7cŒ7|íÛé¿,ø¯:!öUKÌSDßØeåÐbÜn ]`EŸñ;¸`“eŸ¶ØÉ`<6,¸“c΀Že^ðe£Þ”gœãÈÕ­&)׬H1ì¶SdrvëOËx0P(îée¬-ÒM`¢!03ðÜW‰M^®#YâX$››ú4ºÂûgG/lPŠêÛΣ›îXßl’ìr„”Úå¨è$IãÔÒÅóJÔ¿ýä {Ø蟉©U³ ´¨©O²Q×FÞ2ÐÒ{ïÛ#ÔQÍÁ@W®Zædˆ}óº-ÅÉæiW²…k¬6$ØÌ<ÝòÔá·º7_´UsÁÕˆ=·¯(!Ä ‚¥mÊ3ýÅÿ4Çà§í†+é–nævÎi©ÿdˆÍTOwˆ
+.„²5ÚþÈÖñ^ž/|†Saï½	ô»ØIvê
+Ý»ê}­€‘D=Tÿéâö·½‡žëÑG]#ÂâuöñçP2ÀÂ,NÈËpߣ¶ÓñuþE+ë¼íà0Hû"C«™»‘ïìºúŒÛ[rzaD%ƽ¯ÅSØ×¹Òøç7
Á‡;"ó%O,Gaes:εç2g‘ÇÞtR%>”¥I æ7iÚµ;Øù,Î’`kõK%hDЈßXˆ“maîÝÇì’
…¥âœa	ųáb•Ž-%ÎhÈà¨ñÔÀI•°{‘ÓÌÕ7g[{H"Ó·°G×(RJÖĤ®PgŒHºX­ó~ø6hv÷bÄ„)Nà‘o\jr¼ki´Û¥Z²ŽâËÖ
+ï:/ÿ©Aàéžµ@vô®ž å—þA·žÈFàQ=á'ê²_Z»ÔÙÄη+YS1¹Êƒ”ÞTRcÖì`Qœú}V›v1g1ÒŒŠ$|OIq
@Ýsêç?ú¾óã°!¾,»Ö.qðŠ×þeËŠ”l~a;$gõ…<¾9K„‹DüÆ©8®À¶IÁI3ýSȱ$FïßûBßP5åqÏ' KÇ|µˆ€€‰¥ÿî`Ëf_>´«Í@MãSì7nDAðùg·u{<úzoáiC&‘RÊVçÇTA¿Wb-ΟØ]2PÉ™Ð.8ÙËÍÙ.ò¯j|ƒz]÷ÞkZlü!½989Ÿðd¶aw¨É¾ ŽµQ
1ŸŒ¸9ŸTv2@&*•šíùAùÿÿOX€fήŽöfÎv(ÿ†ïbPendstream
 endobj
 707 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 40
 /LastChar 122
-/Widths 1354 0 R
-/BaseFont /ZFUKPF+NimbusMonL-ReguObli
+/Widths 1355 0 R
+/BaseFont /CVJLMQ+NimbusMonL-ReguObli
 /FontDescriptor 705 0 R
 >> endobj
 705 0 obj <<
 /Ascent 625
 /CapHeight 557
 /Descent -147
-/FontName /ZFUKPF+NimbusMonL-ReguObli
+/FontName /CVJLMQ+NimbusMonL-ReguObli
 /ItalicAngle -12
 /StemV 43
 /XHeight 426
@@ -5666,7 +5686,7 @@ endobj
 /CharSet (/parenleft/parenright/hyphen/a/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z)
 /FontFile 706 0 R
 >> endobj
-1354 0 obj
+1355 0 obj
 [600 600 0 0 0 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
 endobj
 637 0 obj <<
@@ -5679,7 +5699,7 @@ endobj
 stream
 xÚí¹UT¤]“%Œ»kቻ;îîîNâZ¸»»;…»»»;…»Z¸ÃÔûõt÷¬ž¹šé«ýy“ω±#Nì8çY¹’œXQ…^ÈÔÞØLÜÞÎ…ž™‰ ¦¬¡hdccd
 ´—¥W¶·5ü5³Ã‘“‹8™¹ííD\Ìxf¦Q3€™››Ž bïàá´°tPýå ¦¥¥ûOË?.cGþF:-ì~˜ÙØ;ØšÙ¹ü¥ø¿T13¸XšÌ6fE-)y	•„¼@ÂÌÎÌÉÈ èjl4ÈMÌìœÍ¨æöN›[LìíLÿlÍ™á/—3Ààì`füfænbæðDp0s²:;ÿ}NFv.{àbڙظšþSÀ_»¹ý¿
-rp²ÿëaûûK¦hïìâlâtpüͪ(*þouºX¹ü“ÛøØ›ÿõ4µ7qýgKÿÂþÒüE]Œ€vÎ3w—r›LÎ6Fsÿ%spþ«Wg ÅV@p2³0r2µ1svþKó—ûŸîüç>ÿËîl<þmÿ/¯ÿ¨èâlfcÎÇÌò7§‰ËßÜ@;8ÆFEÊÎÜÀÌôovSW‡Ç~˜9ý«ATÿÌõß"ŒLííl<¦fæpŒòö.S¨þïTføïù¿Aâÿÿ[äý÷¿jô¿âÿ×óü_©Å]mlälÍþø÷; øç’±ûß¼l6ÿ'ÿÿê©aöoEþi¤\Œþ¶BÈÎâ¯ôÜl\LÜÿÅîf¦Š@K€¹‘Íß^ýË®fgjæd´3û«é¿Ú	 gfbú/˜ª%ÐÄÚîŸæ³ÿdfgú_ëÿ+Ó¿ªgQ”W”¦ýßîUz›¿óeÀÌÁùoŠ'ÁEÕÃÁð?ÓiÈÙ›þÇâ>aa{w€=3€ž…‹õïdap³±úürÿ‹ˆù?×rF.N@w€ó_Ò¾™þÉý€Þ¡³3±7ýgvT\ŒìLÿŽÛþM\œþªü¯àïöÿ}ý¯Á73s73[ûeoÂl•ž•áR‡72%ª3ÐÇ>âPÚ¨ZTè_cßë—¾Ë]iø^ÂÐ4ÃóÙî±|æðq(Ms4Ö‡eCÙ›jvU€ïCJÝ_ˆºEÑÉI{Ȩ_Š˜q®íu½$»¡ÍÁ¤~´7¥¤¬_òE0ÓÉêsýDíOú£ÐƒìÑÉ×$­!³¥	­îçÙ9EÒéÓ#åÐøèÈpï
dÿ!mn,9ïDŠ(Ç\<mµ
+rp²ÿëaûûK¦hïìâlâtpüͪ(*þouºX¹ü“ÛøØ›ÿõ4µ7qýgKÿÂþÒüE]Œ€vÎ3w—r›LÎ6Fsÿ%spþ«Wg ÅV@p2³0r2µ1svþKó—ûŸîüç>ÿËîl<þmÿ/¯ÿ¨èâlfcÎÇÌò7§‰ËßÜ@;8ÆFEÊÎÜÀÌôovSW‡Ç~˜9ý«ATÿÌõß"ŒLííl<¦fæpŒòö.S¨þïTføïù¿Aâÿÿ[äý÷¿jô¿âÿ×óü_©Å]mlälÍþø÷; øç’±ûß¼l6ÿ'ÿÿê©aöoEþi¤\Œþ¶BÈÎâ¯ôÜl\LÜÿÅîf¦Š@K€¹‘Íß^ýË®fgjæd´3û«é¿Ú	 gfbú/˜ª%ÐÄÚîŸæ³ÿdfgú_ëÿ+Ó¿ªg”U”Ó’– ýßîUz›¿óeÀÌÁùoŠ'ÁEÕÃÁð?ÓiÈÙ›þÇâ>aa{w€=3€ž…‹õïdap³±úürÿ‹ˆù?×rF.N@w€ó_Ò¾™þÉý€Þ¡³3±7ýgvT\ŒìLÿŽÛþM\œþªü¯àïöÿ}ý¯Á73s73[ûeoÂl•ž•áR‡72%ª3ÐÇ>âPÚ¨ZTè_cßë—¾Ë]iø^ÂÐ4ÃóÙî±|æðq(Ms4Ö‡eCÙ›jvU€ïCJÝ_ˆºEÑÉI{Ȩ_Š˜q®íu½$»¡ÍÁ¤~´7¥¤¬_òE0ÓÉêsýDíOú£ÐƒìÑÉ×$­!³¥	­îçÙ9EÒéÓ#åÐøèÈpï
dÿ!mn,9ïDŠ(Ç\<mµ
 ±ªVõ¶ý^Nc_ñõiܬ槕Q¿ÑŠÔ+«ñïPYŸÌôZ#Ûõ½¼6SºßS7Cç0ÂþD¶X>ªO¯Æ¶aÕl¾JüÁøÒŠuwßùöüh¨ÁŽ7n-	ª}»›ËÏì¯ò[ùwµ gïèÕËä‡× †¸ºŽïÛ­IZR
» ˜Yâu#1¯›t,’‹¤×CMMW•M¬îÓ–$IÁ]•Ð}}™ß×(+X{—üÓHï=s]Ô½í<›Øáb57U‘Ct¸¹# ¹@
²KCúFúØì¸5Ö0ë#‚OXíg½FC'ØÐÀ"¤¹ú,ï6çš#±VEÿú4Í ÙTÙ	ƒ˜êççX}×¹F; yhȱ½ýx˜!:Á<œ?-p©yó>sd³aEG2 ‰iħØä¢_,Ì:ý¡ÒI“
 Èú€èç“.ª¡Ü^ó!Ozü(~”@½ð¤Ê¨JïŽ	÷(ù)I¡É’!Ë[í¿7O’0	™(Öê/Êó#?ŸòtssÕï“wÏgWWÂù;í
@@ -5751,23 +5771,23 @@ Pпܠ
 ªjDÒG@œ=ù¢0Vþ23qð8@R‚¢Sx†€ÀˆQšk>Ö˜IÛ»åÆnÕ@ Šœ+7ƒ¥	#xA&¶#A×÷“š
k‘ìÚIÍ!]i¿ƒ–A!’ª5•JN¾w¢O’	ˆvš·Ò‘*âô*,¥×¤Q*Þ=£•^¯ÄìP«Üé툘Ífó®U‰{™™®ºû¶®á·Rû™ÁØ	aûp"ë¼[÷—– ®k=¡_„ë¾´6÷g]Þs±ã¢V×/h_ëìË4J#gBó³Ä…¨Ýûí:½ôy­ã~ó•é«©W-ªuuàúàÒã£^N[pa*'õÖÀ+Z“XÁàæකÈ}†J~NZ_?ÿ}þiæxA‚ÂðòÎZÊ6š§Œu£a£ÊýDAEËÿŒåkd'‡Œ®2Õ؇¯
 V°î2»“u=œÕÏ"¨¡
¥}ŨRpÔG0Ò|Ëÿ°Á÷v¯×ã#Ði¹j3ÍTâè(3Z÷†]ö‰6$áHý.ù2rä"Šñ.Q}Œ[ô(~áa¼ô|·g7LÜëèi	GÕzBƒ¤ìò°ôÉy,£–¢€%ÝÞû.îcäG3*Ùºr¢ê.ûÝS²Z°¶¯Üi𥰛‰àò"ë8׊Ê[¬oœæiªÈtB!N²Ma3_#”Ö‘3?z25Q«û%Tb÷‹ºðƒS‰\	”Ë`DðÌø¹Õ"†Ò»K$šù‘ W»P-$Ô"taâ5í.§œi"2a îÎEg|鞢³‹O-,Œ'²Æ¤ùp|’Ì”‹Ò7rž´­‘€µ‘‹Üä!ðvƒŸÖß0ÕBöy\åqýXkÊ€XƒÆ;my»”(~aŸ›{á|±ob’ØÏÖ­Ùxœ=†¤…` Ö罦(h
ö˜85]‰„C¬…ù×UÎu×ÞÃ4]}+7ÄÝ Ú‰-¬ú‹O ›ë}KHE®r¹
çbÛŸÉwO0t©„oµÆuZ¶Rèt•qø’.ùã8M“ƽ7·ôº8m
[lC)¤ŸÙ¾X<‡ø¢ø¨7¢rLÚIQº¹RоR>„OôºˆzMЃ·:¨ “PäkæŽwS´RnBßÆÆ<9Ų|<ø{_À+¾>¡zZL¼³S©6v˜I
  ?0
-tâï¯tãq·˜þ?pÿ?Áÿ'LlÌŒœ\ìmœ¬áþ6½¯endstream
+tâï¯tãq·˜þ?pÿ?Áÿ'LlÌŒœ\ìmœ¬áþAÃendstream
 endobj
 638 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 40
 /LastChar 90
-/Widths 1355 0 R
-/BaseFont /DCPNPJ+URWPalladioL-Roma-Slant_167
+/Widths 1356 0 R
+/BaseFont /LPMYJG+URWPalladioL-Roma-Slant_167
 /FontDescriptor 636 0 R
 >> endobj
 636 0 obj <<
 /Ascent 715
 /CapHeight 680
 /Descent -282
-/FontName /DCPNPJ+URWPalladioL-Roma-Slant_167
+/FontName /LPMYJG+URWPalladioL-Roma-Slant_167
 /ItalicAngle -9
 /StemV 84
 /XHeight 469
@@ -5776,94 +5796,91 @@ endobj
 /CharSet (/parenleft/parenright/period/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/X/Y/Z)
 /FontFile 637 0 R
 >> endobj
-1355 0 obj
+1356 0 obj
 [333 333 0 0 0 0 250 0 0 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 778 611 709 774 611 556 763 832 337 0 726 611 946 831 786 604 786 668 525 613 778 722 0 667 667 667 ]
 endobj
 630 0 obj <<
 /Length1 1606
-/Length2 15226
+/Length2 15564
 /Length3 532
-/Length 16089     
+/Length 16423     
 /Filter /FlateDecode
 >>
 stream
-xÚí·ePeݲ%
-…»;ww(ܽpw6°qwwwww/ (ܽpw—ÂÝáÕwNß¾÷õ¯îûëÅ[+bÍÌœ#GæÈ9#ÉwaS;c „­3#3/@dcìâ$og+Ç bgm
-øk䀣 u9ƒìlÅŒœ¼
 )@h`e°ðððÀQDíì=AæÎj5e
::úÿ´ü0öøÏßN s[åßW µ½
ÐÖù/ÄÿñF àl˜¬QÅïZÒ
-’jI5€$Ðèhd
øîbl
2ÈL€¶N@€™#Àú߀‰­)èŸÒœÿb	;ŒNö@Ðßm@w ý?.z€=ÐÑääô÷r˜;Ù:ÿí³dkbíbú¿v3»²w´ûaó×÷컓³“‰#ÈÞð7ëw1‰ót¶0rþ'·è¯`gö7ÒÔÎÄ埒þåûó×ël²u8ÝÿÉe˜‚œì­<þæþfïú
'­ù2 8ÍM­NNaþbÿÓÿ¬ð¿Todooíñ¯ÝvÿŠúŸ@ÎN@k3F8Ö¿9Mœÿæ6ÙÂ1ý3(Ò¶fvæÛM]ìÿÃç
-tüWƒ¨ÿ™š¿$ŒLíl­=¦@38&;ç¿)Ôÿg*3þ÷‰üß ñ‹Àÿ-òþ߉û_5ú_ñÿíyþ¯Ð.ÖÖ
-F6àßàï
cüsÇü¿bl@Öÿ›èÿ¨ü7Ãÿˆ´³Ñß6Ûšÿ•‚™‘ùßF“Èhúälb03²þÛ£ÙÕlMŽÖ [à_-ÿÕF3óñ©Z€L¬lÿi:Ç¿]@[ÓÿÊü¯<ÿâÍ$.©¢*¯I÷_oÓE}ÿ«º³ª‡ý_bÿ£y;Óÿ¹øCDÄÎàÅÀÎ``åâpr³¸¹X|þ7ÙþÃòŸky#gG;@çoÉÌ,ÿ*ü¼ÿ¹Òû/0â¶&v¦ÿL‰Š³‘­éßÁúŸ†Ü&.ŽŽõü×Yÿ[ð¬ÿ5â@ ;ÐneÑ΄/Ø2=+ù;ohBL§¯‡b(ľì‡jq¡­]·_zø6O•á[]cÓ$ïÇ/…?öïû2´#=XÖTÝ©À‹2šÞBÔ
Êv.ºƒ@&ý2ÄŒSh¯Ëy¹-HmNfõƒ	%eýÒ7(ÂÉv6G˜ËG2×Bò{$_“´Æ8Ì”&0´ú¢?§”IÇT£ÃCƒÝ×_{÷ñérã`)ø\!)£ürñµÕª¼"h3Ç&¬±„N™Í»‡¤¹ï°8×ÂYÂù6ª†Ü|.°oŽ	Uà‡í”†H\ά={“fzüñÛwšÌ(;InjÚß1$“.]dþ¬²¡ó»ç§c!˜-ÖÅH»FÄäôæÇ€;Ãõ=Ä|Û.ÛE‘e	ë¼ŒPxÏNV?±W£¶Æx›5VB¹®u%GñèêÍà©Ne„/GçÈƬ÷v^8	%1ÿƒš1KPè½qݤA‰?ÇèñQÚ!©æ6ø$Þqs/ª A{øƒOÅзëðÉx~X¹vÿØïîYÍaWtM=#à„‚&æ¦Çå@ÀЫ®2
å‚+°ƒ~YqWRcŽÏ67H­ŽÓüÛÚá7ªù« Õ0–†¶_¼Œ¸F?‡ÚŠ‰½Ž ?B¡‰65Ôó½ø®
-ñ½¿Ý¡$ý6;›˜ ½S‘F‡‡9Lq®÷#7ùºÞAæOy«Æk™¬0\™òã)àÚŠ¯Põýè_°ÏÈ𸯪+WX½À4qW%¸3A	pÇ‚yçNјŠhÙFƒ´¼òàH«Qûv¡;±0p•]ßt’~xd,Š‹÷xÂÍ6m$ˆ¤bŽè›a»èýa–Qº ÅZCE{˜Í¸V>$zytgC¿ Ëûž~^üZ΢ë—'¿4vÌ¢€œQ(߈¼ÚóE$9>RÛòvJr—Ž!V•Qê-¦ 
ç]kˆ«#L¹)N[
-Y'L
-Ml%£:Tid„‡Í!³ÿ²|Ø=ðÐû})ñËHzÕøQ£ð·)k{U“›âí÷T£Â•¼hð-· ÚyX3ïIIìŸÐð¼íˆBÚþ#
-†{z¼*†ÆO0RÕ[|+uØ<»×xB–)ûµjÃñáÛTK!ëßP.GJ¦
šïHídÏ·Âó‡8ÍÈÝÑìᣮ¨¹)KÔ«£"	[ßáØÓz'f?r÷g‡ÏÁ­õûd„» Ë}áY‘’¡žRÞÃþÛÈžiuMÛqÁÞÚÖ:ÏÝu)âì¾
-´mg!™Õ[º±dúrTýÛ·àÑï;¾Sh4+mpæN#{•x9)Âv]²O_ÊÚ"¸g)ˬÀ	ó6ÌúäT¤q6`Ü,ÎÄÊ“Ê.ÆmRúuZ}
-u¯Ôeø9‰ùXg©v«½~ô¤™ÎbfÓ@ËZ€'púÎfjûµ+4Šð9µ?çyG Åš2Ã>öá¡èÓÍõ‹æ©íq½j]F4ÊQc	&ÚWÊ¥Œ!¤)Ô¡W;êíˆkúë¥|ÂO!xËl|Ê/"Ë ¥Y8Þg™t‹}1ü¸ê²áüs,écbDŠ‚<ÕÔ&0S™2(Ãmz\Ì#wÔJ$G”ûsuQ#JöõÖ1Œsoæˆ 	•X1K÷·XøZ°˜©T†fzUàÝô¤˜:%)=ÿ¢NýÌýßáB0$awϬ&8Ž÷SMÕ@: ÿ÷6²±‰ðJe Êq»‘€¿Cø# /ÒT
ÚÁû­B2cQ˜ãSŸ_1IãÛóù´P$O´›ä…™±<œBn|\©žêŒ.ymõ¶9ŠLrd¤¼]‰mæâ¥ËNÛ” CSÿ¤dá,šýÆWý2è5÷]ËÚló±Z°~ÔS£çDôJݬhö´þÀ†×Îåõ!ï뱲㹦ý’ëÊ²ŒGL"ÅEàcï/e$£+[>»lÛµ—JH¯V—丵^tú¨±6oðºä,ν«x‰B¡¸LE$Éz2¡8~´"r¨º\pyç³lðÒtR.—Èšqáp40i›­YÚ†
>þª""*`¦É eã¥R¶!¶;
-Ôw(ˆ)¸ôèg¾ÜFþRM–”T–VRƒú¡âÕ€9«\æÁ	r˜.°ׄZÎAÆØRöuaÓ^z¾A}É €1X•¢Ä<”BÅ2Ý)×BöÔÚó–7L}ƒ.DMZÖËçÒÌ¡sìÕzÇ<ï§PÙpK`Û¶—
-d„½-˜vNªÊ:&¬.U~øS}Oi²~FG´ÝÞÓXÒ€1Ó¯,»‡Oœ[ÑH'*‚ÏwÙç Ý;¾òk‰¯Ê¢NN„5S¢í}ùGs½HûzÅZ¨½B@0„¡ÒÒ¶Ðû´~¼øá4‡QÂYìôoPÇÀÐ1^È'¼þS&J–pa•K—h}%ãgÆ1Œ[g€¡w–¨ü±¦SZߪü¢Ee};ý°Ú÷‡O¿ÿ´™“œV{ï¿4êŸ1;cr§‹ª`*Æ*îòÐ<Àò`*̽ö=­Ë¦“îUn·„ûTÕLéÜkwÆüúWJÌÁ¶u˜²")aAö%ûýº¾6Ê Íkö£ï•·ØÃݾþXD?ãÈÑ ¯«K”бïk²Ÿí-á„Ñï­þL*‡BåÚI×ûöŸ¡½©c×üóFÞéKhØx_Û¸¹Cëw¦Ì|•5ß‹„ãßÏX8p®FyñûÉŽ?š¼!Û™û[ кN½ŽZ9ËÊNøâ¿‹ˆƒ·Õš¦Ãˆµ¬£¨é‘æ=à³9$¨Qo©}õ<Õ~'ù9:xö 	þ­CV´ß?G¤kívÚ6ü|<«ž×XK³ÿ\DŒúWÍ/’Ez©äügå=3p•7M<~¤
ìôŸ-—§æ'?%ʲØUû²æ&ì
-S–2¶ò¦,|Uº•¹åÿŒ ²]d§ûHÛ±^'Óàrê¥Ñ'Wží¼IëÛË­lžœ‹¯‡ýôÊ0àU\|¬¹.wÑ`7ÐÛå/—êâY쵚ûU¿ð½@'Ã\Û#ÿ¨tÓ"¥ÍSûã†ÖÑÖ9X³*¶?"D'Ö	ótÉ‘mtåÊù¦âÜÓ^Ê.ΡÁÕp¾iÏ€>°¹	ã¶i¸Xæªl“£(eUÜ"!÷{d?¼ÍÚVÊ-v+‰oy×ÄO!üÕ²«…ŽÝ›äÐÔ®¤cçÏÑûð1á°¾tùTÇÆ:Æ›’Ûô8™k‡ý½+]Qaÿ±ZYùîÔž/ùZ¨•b<Î·Ø!P‰ýl•Ÿ¶	ÙçÄ;S@gû•ÉH¦ƒ¦Õ®e†ìDe7#„
ÂŽpy¦#›±ÁR¹ŒÿƒuãþhËNqšVfÃî™qª†ætÝ€-« ½Lx:]Úñ¾¡oD`I¹¼ˆïÓ2œ&3¤Ÿ“’³ñWzøµö^––©ëLrH¶/±Ò~Ö…DDÏ7öØSb_O)9Á,­¦)ôü±8lÇz¿Ü*–\qßiSgb`ÑÞXpœõ
ú~0èu†£ÆBß^ ¨íHßÿó1p}PŠÇ!"ûÀ#š†Töƒvy†.ÁÅþh\Rœ—xF‘k¬^ºÏóômTkºe¡hèy¬$êUÇ—ÿ÷À…é#ôo#^qÚÂ!r$%¡é%2j¯ÓšuQ¨šm²cÁ©âj—¡«„èo6¸óø®†LãÑEP`þÜ°+	÷/†Cn(€¨³×v¶YÔÚð­‹¥mw4˜ž#¾ÝýpŽ:´B@f¤­P÷ySú6öâˆ'$m	K?ëë‚Šú÷ù7—3“ú\X¸>¬V°a;å˜ÔP€”fJÿ‰(OÍÕ"?-‚+Rûüe9oA[-wõ,NòµkEoãˆtúnÉ•Ãê»y+©2:³š[轕µØCNbå’ãi›Õ¤ºè´ò%©ê8»p$4
-ÿ¡QÁ{þ­
-Pä±\7Š‡òÝÐBÞz¾–ܶ<
-hÞãBÚ'¡ê{üŸ[gq«JNi9ª	J¡ö–”ÍÎBÚ&eš"¡„™Géùý¢à¬äñtºls5	O·±„vãá̇Õôw«¨@…úÈ;fÊ>Gé„b›žy
-0ũ㻢×JïØÄæv/éÏد¹Ci)ïiçOî‹Z%ãM÷Þß÷m”Α¨ûÃMðQº½›š¢tžVávjÚ.mOMè¥×¤ù—©b}‹Bq1Ò—º‡§Çòº
-®t·Té„Ã}5§¯kŸ1öÖ¥¼?Pe;ö•Pö‘rû0ï}Bϼ˜\ˆÉ6ù·ÒšÏ¹äçMI9!Èèm)L(ãÌSŠ›öž™{ÔˆV"X¡…-’?.ESö®žªAÝP! j#HA±}…KXžÌÕ§ÐÉMŠ[¤ã('©m»Ÿ>¾+­›™Q…ºCTmr9ðn«!dØ}û\>KdÚžïËeš»ùØã‚„À¹b¼ôd *Ç£GhU×¹­9â‹ ~c»iî'àŸ¿ñ«K¶B˜ËàêÅ©$s÷\ÉÚë>ˆÃzÍ:¡¤¡RÑH-@×_|eß·ˆ{
->3;J¦@ÝÀ¯ÓrZþ@)%È€Êz¤a¨ädèji|µ€)	eãCÊuÙ.ƒæqô~l»JöUþŽžØóáxf‘n#©[6ú<—¼FL¨Õ‚¢p¦áâþòþttÁo¬‚¡:ks_V]º¨ž*Yº‚ÖS,"ƒTæ{à':¨²Ãêﳓ+xòä½o»äß(!\Z,ÓræÁÚÉŸ ðµµV$n« BA†lmº'U'ž½R›~nØõãç":E›çÎy?ž‡
?CÑ<,ê‹DÜ(8Óv}å~õìòÙ¼ŸêGF¾nƒU„­]¢6¼óÈ¡@¦]¹:@¾"¹&~žûÔëâÈm!Êê½–B¿™—´¢´•®]jØM–ìHUUÃ;ù·‚jŒ[ó·oi´áPä-æÒãµb‰omÈSn,aV&d­ ü	_zFö~ð\ñz8¬+Do¸Ü5"ðˆ¬Š›îûRÆ÷Ù	€#‡Àž¿nÊ»‰Mï$üÞÐÈ£€3(J±j½ÉR&YK6Î毒ͮÉ$2)¡S{yv¨É/îje1Ù‰ñs‰Õð®[;±ÙžI´¢Eç^›6ŠÖn8¶XÅ|ºø|…Œž
-]éû.@U¥”¹7n0B¹TñÖ€•Ü’ü=²Øü;ApÊ|,êºJCåD…rÿ}œ_PHqÆ»LO…NEt"†‚©ÛAѲ‚÷&¾½&WáõÔ7j§qÝÄ´Öoºêe--Cª±G.y–æQ12Ò7C}Ϥ$)S¢›#qò8R|ﬗT%’„`Ô‡>{|ÓÑ(~‰M€ì¡öÔõ|µ÷•Ý RÙŸ¿°xðÆÜï$xÂ1
ùê”"B/J#_“ÕK`ô!™"WX¥ž]58áqA8Rkªk7bfRCèç`…oŽRÈeé'¶‚©&#É;°õCd€nzc¦}ϛ«ó~×€#\K"™qø$â~FÛŽ›–‰K¹Zð®=¿Í<ÍšQƒT¼hçîuÈÞ	Œ&©ò§=&—àÈjóAŸVËpý~‹wåhß\">ÿĺrÁI~¹8îÖ²Øeçmב[~_‡Õ)Úùá!¼Gâƪ̣}^jèÍeìGHj{FƒÏDI‰áž>ç;Ž;
:«^/lü²ÏÜ!*‚v5Bw®vªz‚/{¿É!Ä)Ý_Ò½,0‡Ä83ËqPA¨ÏÀB¤¬PA$.Z„^™ùà À_q\E¯§nT©E|i¢jHm¯©
-mO´ø$ZEZ»ß÷êSùâþqÆtd±ã±ïäœ1·+}pyÉi"¾!¼ÈÓ‹ÞBêI†¾y¨‹5Á·n¤l¬	î¹2íib’-þa/mBrZJ¨g“mˆêia1éØæŽÌQt¡ÓÆ˃¨
-¢j)ü™pÒŠb÷"…í¬LÅí^²0Ôô{k>—
¹§‚ˆàêÒ|%
ýˆëã_d;lEO㷳ߗœ×Rfå
-ZcÁ²Z!å5Zn;£°¤Êîž4Üb
-“â7+:¿ßå²p€‘ßTbºLJzù:˜cÇZŸQyØCV`ÔÖ .ý\ø£é¬—Ò8~û§vYg“ÕŒ1…·ÁÅzýãÚWÕºÌÚùYÞ‘G½	µq€¥Žh”G	;èXîÙ7š%›ŠK–YtÙ÷¿q;Â*ò¾¤ÈfRʽC@Óz†¾>ÑRKíóðdêZ+%{SÚ¯‘n¾€ûà3µ¨¯¹|Ï‚·#ø2òJ_×Kà?ew5²ò!msZYÝþ³Ûš6·—O,o|iVð”@DOXå¡gg'\ÔQUáÏ‹wƒ§ tÔи7uû]J8IÓ~«]Õgb+©‚±ë­õúZ÷0©ÝæöœÉgp£è½»Í¾÷QöÅÒ+*A¶3M{#ˆ2¡éŸ‹\®þK§Œæx'wÅw÷q‡Ø™³G›Is%ößÕlÕ×ÙYó$;ƒ"d™ˆÞ›3™×Vc:DŸ!H™ØºASöò;ªÄ‚3:¬§µˆ6· ¿+><Æögn% ãïcªKZ¬	ýÒEÓý°¡©C'We„‹ŒHìE¨¥XÖ{°jæX¬
-oöw¡‰Ç÷ LN(Ú–Ç•ë|¦ÙV0f†BckÔ/ÖözåÄò«ÎMüPC‘&§¤sâQOŸîì?`øá%
F€Ð=dGì¦[Ÿq»ê–Ÿæ5ÎS-ÇBÁ…OeÑÁyÞ'Ör8·w|­¥1Š×þ3Áòkl/ë²OKMêéòdËÖ0q{mo˜[7+À 
-u€2DZT‡ÿan<øF¢àƒK＃ÒÞxpÂä_µB…•’Ä5$(Z£½X÷˜,Çn=F„I1°Sk€/ô¿Ñû’-Ú%6©`Û/XwܸýŒPä°X{]‹{ÁõIê=/uµJLÒ	"nÏÖ9 áTôÍÔ €¿|"=ßäüTËKŸŒ9¿ª>Ì…RUC΢•ƒèÉ®#ÃÈm"æ%…gL3:Ö*‹¨þÑß·ŠËgó6¾OžÐZÔ_Å­iÃõÒš=ÛACز†é™ÑàØׂ‰Ëíþ¾¨?T
-ÊnQu}±”ÇËÂo¾ÀxÂO¦ßi“Ÿž„Z”ž¬ùáXßâjøLƒMw®ÝÉ¡þ‰à0߉òÐaàð1͈o®ŒKÔ2û%걓ºîöC·wÕ‹Þ«WI±á‰šæN&`­†[Ë~©à}ã‘ë!–{«-ƒÐKÜQ>µÓ™ÚHh[“+ÊäŠw˜Œ~š‘o;UK䊋íó¢/¯sö6†>ûþøM7f“wcåwÛƒS^‡ãIÔˆ·œ­‘‘O¡"è£á²N´(*–ñYaZÿnŽš
-/†¿oy7¤‰¾Ž¯‡öÛ“HlžI-Z“ß]IFØõÖ`/qæÑÍÓÆ_àä87£Œ	êliC9Úî |Lsñ€ÖãÓçjPO´ LÔOër‰ñ­w°D¸[¼Àºê{½mYübbžšÜ“sX¥Ïqf#<<Eq|ÑE§;¸¡Få¹úÒ5ơ̂܀@I³ÛÏX:B|Œ.É;¦®ËhˆÞ_ñ4cúHC[}\
Mg÷jT?)ß‹zYVÄzô.Ž»f6Ä!v³ó£¹tÒÛ°§*•$}»Êãæ“Ve*"v1pu'„Q°›·°jw(»ß–tJŠî±˜Ysé–葈çÿÌÙI8ï2òÍ‘¿Ã,RB¤¯)mE+:’­'¯Íƒ¨D®QŸíóºåïÆw¥M0$.„¨eǬýÃu‚ýý.òÑ
-¯)$QF!ËêbVqâ!Š–i× ÛÔáZ4z³2„«#µùjÆa0Ž¢”½¦wÝ̳
Mx¹c"ve·yäÒ0Ëdao†
˜’|¨äÊÎ	|ýªm¯;°”`È$ùúgH÷ôT¼‰K6lºæð°1I§Áü°¯Ì~δ¨ñ¬
&d‰tñ‚Üè>øŒº§ðTÍ”­µq¥|rüꆸ´åxùòr¿jÖÑy„æOä¬-d‘Òä[ºz@z6>"Ò(K)+è¸Ê]‚éÉëß-Z¿¹ùÁßP£«•O?.Ÿ7©`ñ§„nºn´ˆ©AÅ
-®K·¶M“‹PÐ-øeóù(,•ÐqšW×,׃ññ£™”¦£W…á觇²H•ª£ën“¼ºUÕq/ßíÇ%–Þqÿ	J†tù›á8îe	p©SíÊw¥N¶oéÑ!í3ày<Áév…‡~ñ¦g‰ûÓGÃPûÅ•'ëyçÅÙö°ê"б2¦¯ge&ü¿ˆh8#u­÷$å†7 ~g¤ ÌÓj7#)¸"ãbø=ËÈÓF7mõÏx|)Ê¦R+ËY'¢Æ‹f¯µ"­'›é*œCêþôêYßFÐÍÌ{4rO‘GÕÇ•-ŠÜŽf>>Ù£kïSë0N^6I”Ššwu~}Nè]Ä1â&ŽV—…
-é0;êÈÞšGû)¼ÕÝÛ•qòG­‚}¢v7~ýUÌØ{/ª//¶£@¢’BxP
?×㺽v/Ò"¢³¬É–²7~õ¥-°ú¾Yâb²4GáY±Þ\ÛêùÑò:u|?í¥LTj/Ïäœän”…xÞN[³Ö´Yg$×p‰¡ín,:ÆèÅ`¶é¶ËPÿ–ØUƒÙh|oätƒYGê9
-GZläÞ¢Åë6}oÛ,“Nxúœ½™§~ãIf7Ù,’y®KuT§Ä‹óˆÞˆ:‘¼	'³é~”*=Ï¥aæ½L
šá(ˆ#}AÀ·åÖ•INø™Õqy»±ýQÐBþtSè³í¸ÇZ[ÕáZ”DPà†&´xf ;áÿ´ÜU:óŽ|wS¢‘°µÃ;\¬¶W:[“e¹—Å4R{¤Ï5P‚OxfIˆõ$žˆÖÙyÏÅ+;S!ïuI‡b¨{
-Oùl_t>»ˆ„Q@·z×À!»Qqf¢Y Îë"Ìãì]/©¦pš¶¢þz¨´ «E¹f‘SÑ”,Y¸!µx·?q¼ÀRœh·×ÚâOÐ`8 Ž÷PÚÑ¡lŽ~ñ¢ª ”HÓVßQk6˜qØ `?'7Àw1²£;Äk§ÕùI…²­™e£šÀØà£ésÕYìÔ÷æÚÝÃv­ë\Z-þþªÐšPH‰›¡¶i)Pžs\Â,­!iӤʷüö%O»í»úI‡+mLcÛ3‚½¸/Pqñ¦Éz½¸s†EÐMšl¬,ÉTvßšøNÅ’ü€a+˜<òšO’ÄdäÒ”×3T§6Åw’cü]·yôZZGš-%(s‚š¸½€(ì5üýb›&‚Ÿ#)ïü{ë!ëúcàÙ¶±°M¨ØUO
-ÁÊýŠ{Eoa’¥VÖôJŠD¢VØ+çòêqgkSÃúæœÖJ!¾íѹ‚§š@.¯¡?4÷k¯ÆpHmÉKHÆ`ÅÀgç»C~\þëÔƱ
)m®ðrô©:ã.ÓŒ±þ(pôs°¶†Yi†u1`kîxÍræN6Ór§‘Ó¾‡‡8êaì%ª?áXhu*‹e²ö×VÒôbÝMcÚí.ä	Ü
SߟýŠw×ë±AV‚,“gBsEû&·9Ó3÷–òÎöÀ¥[Œ»ÆT*UD-.ô€]¨ô€–'OWsá€TO›¦õ`¡Š»Ù†ÖáÂuþ¾ñFl	©>ØNRȘa»CSÔ—Ÿ¶†ËÆÁdõÜBx½oÌ«·†)Ô›.hþ¬ng¬ûÛöVhNÁ4ýÔ¦zçŒi=÷·ZÁ¸ö‰ÝbáÂóû=™‰¡-í§ç)Cm=Úy«ôÇÅ“SwCðï—9C$~™¤9Ï…Û‡_ÚóWs¸	ù0.n' ’8_JùïMæ­üÝRÄbI’OîÚë;Ãwh¯“J¬J´Š^kû³ÅJŽm™ªó‘'i‹lÛüŠßGÀCÿçù#K‰}¢orL-–cƒ9MºNöÊ^âæYj—aíLY&.þˆf$Qžþjõ0Cñɇ\›€®ì³¼kÔ42uR0Ó…µöµ©k)¶¡)–—Í …‚‚Tuº—Æ6°…5ÚÅ(˳«mÀšÇÊõ™¶Ôî^H™¯Ì¯ò,µêiÝò¸:
-SþÅ•ù°?UÆh´ÛÆ~‹Ü­³µ´FŽ̽¨
÷`2±Í¾ø_ÑÛ¥¥†%º%B\aáPbs–’´¯xÛŠÍPßí"2¸'\sïa øçÑõØê
-ùôÀ®ß`&„jsJ·ÝqüÚy»©N¨ªÊ‚a
'±ð¾•ìýʤhö\êøÔ<{,üág`™ÁZ±Mãêà7G¤¢œ‚ñ¹ÍÃ5¼tÈŠµΔࢼ'}ÍÈž›¹cU{œœ”ñ’£Ñ8þ» *\þ:X)8ìÆäG4k·D«S ½MÑy“àJjYÕŽËýZ1“¼iy4‘€sÛK¹|(b:9½”—î“úÍ4$~<@‘KŠ3ZˆÑ,CÎŽ$&35hECª·µž,6÷	ÇϤm’V-,¬ägigiNwtÎ5Βؘák‘¡½M€ØîÍ{ýÐh®ŒòéZë…å‚+S¶-;
-Ûfãu¡ÀÐZKÏ¢ÊôG„“ ?î]¢ozNS¥•oNüÖA797mÄÚ¥âFËëŠò–M<§„+¶<ÿÁÑVxpÄ4éåq<òú4ßï,‘û’.	yQÅbˆ½¦k_<¸þì…Aã%y!'^êsÿûÎo&dQ;φÇ0ç6æ1¸Üv„Rô2¼Ÿ£O´ªýe¾/—Ȇ9”\ý²±±©æ»ßd$ºcƒð
-!üÂlŠÏY™Vß‚-#õÛ"òæ)ê§4|÷4û•¦Ç\£Ù.,u˜XÞçAO¯é8h‘$?³DUŽ$ÐN—ýÀôZO¾h¹)8’]íPlÒó!ÌÖ¦¾óí3„@ÍÿBkjû"qJº„‡›áûÛ>Ä£c¤ùÄþâÂnÆmp¥Z[ÆóžC|ø{}Í°†¡P®¦é§
-@á–ŸŽšó‘ŸqJB¬Í×H¬íÅ]¦mš_-Áµd‰[…©ÝG}kÂ'†¹ZñEïJ/2Ž¿I¢Û¼Œ;ÀJ?ЗXÒ²se¥[ñԆص–3—ñ>(ìí,¡’Ó7¿­o­Øc›ŒÆrOã·¨Ó½¹`­Ò^¼>¼aˆË;hŒ¹ÿÙÿå`@HZa½¥×¶9‘àÕâ¡[Ü·Å’Øß©UøgéQuz`@ÝD7… 6˜^³&s %qßÕ±%zs‹É«I)Œ—þ[~x4ir:ÿ•Ä5¿‡¼c@'dPí¼+Ê-ußvxØ€F½h	뼜Ž'éøbP¾DGÛR%F.ö¤Ä˜MXê‚ÛR¾’jÏú#ôF²X²¥;mIBuÃé[ï’r-v½Ç”À0[›{Ïf+zpl©‰`[B±P¯º—$I¦þ«ËOÔ4‹£¨mÑ–-¾±F¡mqšˆÁ†E°Xì´ïRbˆ¼mÊœ˜O6J„Gq?í5øÝã„É[Šóù‡1eÅìM÷jà…^*¶±*DƒÂû	—8¢¦Ã¡-ÁMw¡ui8mB†ÆÇ»'¥Òö·$!Ù4Pz5¯¸"©óvhh Ø@}T¯G[´Ÿ )k')$…=‹E¬Ÿçr[ý«›f^A½ïÌ÷L(T*ÇYð–®
ùm]L•ŸòõÝŽyؽmôßñ»»%8dP¨?Êt ÷–ôóÔ‚¿Å4ôýá$uþŒðÍÆ÷µUCö7*æzü˜*,Õ¡/pz÷Ì°sÉyaKr›—ðö¨c'ô
2}T¥>>U@pÌÅÙ½îou)ˆn©E{⪛{0HÅdh¦m6™ä3¥_ O$h›ôV…DoˆÊcºMëÂðbì¬ó[u¥“Zö¦®Wºc‘»f‘¬A¡é?ÞyÄ)»ØN¹³«_×<Éo|Ö‰CÀ)qf`Óí	à©[è—äÚrF^¾¼MUqz~CoÉÞŽT@G÷ûž®çªós8Ã/‚wéË›>Ÿ=¬züÀíµFô{»Gë§ò}¦+Øo u¥šd¢C¢"ÖËþµÑgÃü²™ø )|òžª°cØQ¤ôš}(]u¡dë¯:$í›»‡Ÿú979¹ý#LòÔ#a™Gãzç-ï c_[rC!Ð4æ{½ŸyÏŽ§«Íö'çUº]ùò\°dêü6ßcÒ’vúµ¤cÈ4ÑkºãN4Ò©æãó0/L—|“Y´	ó©Ãü­Ä¼«+baý[|¬ÞYóR‡ø}.œ·ÚÞ	’†¾¬¤_®Iu•ÀÛmÖÕÉ xÜJǤ›R3C¼ÒÝú2ʾµ³´–ŽŠ”%^mÙ¯]À¯UfDjøôB¾ˆë᪻`â?;‚w¸3‰×™?·NK~îöåÌ&Ð×aÇ5Õ6ŠtÎooõš¢lAr‘êǼéz:ž¼¨È“Åø¤Æl—5Ûï8G‘Ö_~EbÂcÂ|Óy }Ð×vÚ3ÀàoC¸D{¯YÎÞßÂù·™.Eá›eÌ&ù°bÌÇk(ñxsØm*š<7ªÂæÔ0ØZÒ«­pR±4RÔ_³¢yC",Ì$6䮄Åx={R³T{\^²“)âl\É<óè	‰Axèw±D53®óå¾õ%7a™
-‹˜>cîÕ‡¬òš¢úcÓÕVAcB8‰à–à3†(¿Ÿ->2$§‰#ϲf~µÉOR¢}Ì^Ô*ëT¦9Ï^°Q¦òÌ0Ò@§…×õ™Û¡f}O†kÞÜ9ìFÄ«òwÛÍbµËØq„ÂL™§ÇÙ宕NÔuKJL:˜Ü
õÚšöÀÎßMS“cãs~qÐeÅXYŒMੳAªeUBEãöíOWN¸’€9tê´«TÏ ›¡ùñd2ñ²ëó6ýmP_;¥Ò?n³s;}\E¿×|ؘщ`‡Z§œ˜²®@r[éëó¿‰ÊúR…Kðþ¢B‰|Æ—;*g–ýI´U’yÊл¯•D\ÄR­½›œ¨ŽGPlÀÿÒ³ïŒlÒ×6ïX®Ýe<”0D´ËŠBÖEžõ!ûŽ¶QËVnG±~ñTËóS\|Á	â­1–ZœFyÒâXývЩVéÅ_Òö”>§ò¤9AÜ%'–Fÿq>£f.ίN7^š"Á(ßxZê”Þä:§íw^üçúCgRNKܼvØKƒ»ª7håu7¬cîœ3úª³$!gÌÚÙ£h‚ŽMàBµÌú.ôÛ{ª±\+ƒ½íüTqhGÉWÈx§Ý?X¿
---˜TÎÁ?åשּׁ~Ig.äs#IR³1Þdà0säÐl„ë¤)wÜÔC‚5ZêD¡˜A|aK]¾öQŒ)ŠÑßÛ¥fÜ-6wâœÌn¿Ô‘ëZ¬×ñÂe²€KQÊÉ!qäl†ä Ã;¼Â`¯ˆ«Ýjƒ"àFd’(ñ¹%Ð¥åŸ¤­:ìKÐÙÖ»ûúj?ã0GLÝå/—‡ÕsÉmtèŠ7@F.°vš\õ`òƒ_¨à@ó+ß­'9/þ´îQöñ;*œî~¿ˆ\Ý‚°¥ù"@Ãw¥>£âÎ9sÄK’èe—©p¦ÑÌuqzžî-/”íÞÇyCO’V¶u˜n¼ø‘LȘãmí]…’aÛþ­FP´¶Õ…ØÚ7æwźôˆ%=³ÁÆ’m±UŧØÌýÔ†Çæ™Yne[BcÚ£´ºê«€šAB¶N—ýRÖµ`0¨¾Ö¬§Üx±±Õ\e äêò&½£Êixá>*ñ>:¡»_/P-Báé57#Ck¨ym¯”KO=áÒ[-9o${ ÅÊQ™Uß›³ôQßü³¿iyÜÇ	Ê `è“ÚP’ž{EÔ¦+çéÛo}ÙCC=ÑÒqÉu¯b¬Çæî¼@T``¥Ùݼ¼8Ô•z—Ó“Ênº¥OJðËOÔ5¨)!?ax}qç“,Šc¬éHbè¨éÇ­î7?ßƒ[~Ãõ…žQf¬dÜ;i	|›PjPJ­ô±n9øwÅ÷÷|·Õ+ÑíÔ˜Kdž˜„KŒÍ^§s|ÔS°@Ã?åÝŠãeÙùÖ™õC©¢70c5ò¥Ò5Ÿ¼irù:ÂçXJ&d8݉²ý:ͨƒ]À„¯W"é&Õ3Kß/ͽìü1˜5Î#bŸfÌØ7ñ$ú#ב¾_öfÌfÍÅ›-”í=ò{Óqó/ êsTDõùù¢ïÆÖ_ÍÏPHŸÍVÜÓûŨãú{Úë 
ì†4Ó Ç}K«bÙ“¾ 'Ï+Ó¬;=A÷ßéZq<ª_6§VsL{Óë£?$£\ëY
1XHB«Å8Ç÷ÏD¥)Å„ëù¨àAb ’¦„ê7­È‚F8Âhï[ž±wœèßsÃ|H{ÒÊ6kô¡gKE÷ÂU‚?ÍâÍÁì«o¹mHl8‰bÆ©Dú£ð8p]áâzÒ#y\²JØÃ÷@yÊŃeŽYIi1ù°Íù×û=°ÕØÁN0Vn#ΦŠ{qšpX²dãûÁÐuƒû®§tD‰ëš½¤&â4Nü8ë»&\uþf«ÑOì_õbÊ8Ûb0pÏòkÃÀwÈJ±£ßÀ·¹$±ñk'o	gà©È½£ÿ™Nù|:ŽÕ€¨Ö2ß,ßÆX@§¶ò‹@¯‘“<; aQ§*¢êŒmš'
Ò
-«ñh²°þ;f&õÏýtYPXÉ(ÄÑ—îÿ*ìRâ͋MI.riAÛ³eBapX,&L˜”FÄqOÕi/zÌ-JîÙŽX!|½ôÔ{/¥Êl“”2êL¦›$ôéy¶r×òètA3È׸„–MT•˹#“Ÿ_«ê±C˜Ä%3(ØBN®fMݱd[ï0i®§¬Þe˜nùÃ,2†•³>Q~Eó“l¤Ñ‡d¥K
-È	¿X¤ô	á€S¥M†kh_v.ÊZ°XY–×~dŠZ£þq z3„=pÔÍ*SÈá£.rYÎ8xz¡ªm:è«íƒÂfkl®õ3V°yÇݪ"|pA´q+K¯ìñÄ5ÄÆòX”ñ3³S“K¸8”Xgúy6VœOÉÒÀn‹|@aµ»§Õÿþ\1-óò$jô½·Yâ6IÞåQˆÿ¨Û.†î†!ÿ"	Žíë½#kÒŸ@nüšÂ.MV5âÒžpɾT	“L$*jsK€kU3P"¢÷ÇÇ‚“\e,Ѷ™ßUeÅATIˆ¼Š#DRÏãþfž‡ïDŒ4ùä;¬«"_u´©+E¸8å´•È.a«MçeÉ™¸m»ÝbîBß_S¨—,ò5žL(Áœ½¼«lè„OÞÐë³,­ÜV"éˆeÛæÅ—¶‡~,¡¸ŸÆü€¾µ¦gq8¿¯Z‹—Å}á/Å'laÿ†SÙq³t‡º¶^H·âœNwÌútaES«¬¾lfœêð~,¯±Ni`—…ÏgCž@2|§ãÓ>ú6.ûW˜ï>µ½Ø“M¿+Ÿ
$g;µÆñGïÞ—ÆøE×®Ú§qkERãÒÆc{…ŽZ²ÊZd;_Pº·t‡Èû/QOûIàÏg»–%E:)‰7‰‹zz÷Ÿt¸ZúŠ
-É9û×ÖN¨Ó©Þ¶Gn‚‰å”÷,Œó¹ñ:Ÿ5Å=©x¹=Z©¥…»Qò‚Gc]qŒð_¿³—«º'í(åDZþ´î€J®­‚Iç'«_ßÂ:ŸÇHjDõlÝå„,©qØ`G¾¬†\È@éø¦‚œ—éܪðX¢ÈQ<Ñi8ºÄ|#ñ°Åò­õ›O(m£mŸ8½7¸r¯já—"Tày¨
Zì|AúßPqéí
[ÈÃù3Vìlî¾
™VÉlb¼¤.ÛžF
ûoŸJ¶ôËñdË&æfƒicÕÆð+wŸzH_e«ï?ž†éw¿*¦‡½þbž_’‰OÁiÏ‘+nRÛLžy‹TÏ}ƒö¿‡§#k=|œµÉ?£òønž:¯ž;]ÚâõPÐ2™¬	ÓxØêì4ÕLGõFöŽv2ÄШó$œ²í«!¿¯û[¦9Ó}ÝhHç8E7õÙÖË];#tø³;ÚçQ¤ÉTà¹BKÈhHËœ¦}3è¨.F˜Q8)IO ‡ùÿòûÿþ?`b
4rt¶³1r´‚û`d‘endstream
+xÚí·ep\Ͳ%*F‹™[ÌÌÌK3´¸-h133³d1£–e1³,fff¶èù;gî܉ûæ×ÌýõâuDGìÊÌZ¹2WVuojò/êÌâæ`S‹Ï`{fv6€2ÈÎÔÕY	l¯È,¶5ü5r#QSK:Y]@`{) ‹…@Û eaàà°óóó#Q$ÁžN +k¦š6=##ÓZþ	˜zþ‡çïNg•=€æ…-ØÁÎÂÞå/ÄÿñFu€‹µÀdkTù¢+§, “QÖÈXØ[8m_\MmAfE™…½³=Àì°ý÷`¶7ýSš3Ë_,qgàì`aú»ÍÂÃÌÂáÀÁÂÉäìü÷rX9í]þöÀÙ›ÙºšÿCà¯Ýü/BNà¿v}Á¾€]œÍœ@.€¿Y¿H}þ7Ok Ë?¹AÝ°åßHs°™ë?%ýË÷æ¯×²w¸Xx¸ü“ËÔ`rv°zþÍýÌÁ	ô/®Î {«ÿdÀp²°:™ÛZ8;ÿ…ù‹ýOwþ³NÀÿR=ÐÁÁÖó_»ÁÿŠúŸ@.ζ–,Hìsš¹üÍm²GbýgPäì-Áv¶ÛÍ]þÃçfáô¯Ñý33ôIÍÁö¶žsK$Ve°Ëß”ºÿ3•YþûDþoø¿EàÿyÿïÄý¯ý/‡øÿö<ÿWèÏ®¶¶Ê@»¿ðïð÷†ÿÜ1ÿ¯X ÈÖóý_µ-þÍð"çüÛq{«¿R°±°ýÛrþò°0ÿr1³Xmÿöè_vM{s'[½Å_-ÿÕF3;ÛñiXƒÌlìÿi:÷¿]öæÿ•ù_yþÅ›USUYWMñ¿Þ¦ÿŠúòWu
O‡¿ÄþGJ`óÿ¹øCBìðfæâ0sðòxøØ|¼ì¾ÿ›lÿ‚aÿϵÐÅ	äÐÿ[2û¿
+ÿßÿ\þi{3°ù?S¢î´7ÿ;XÿÓðÛÌÕÉ鯞ÿ:ëþõ¿FÜÂÂÃÂiyl&ò5#;Óå;^Þด~o7;ô`¨CY£Fqa@-¸Ë?#b‹¿Êäµ.”¥é·Àû/Ïù‡·=y†ýán\[Ú®4‹‹b_JúžBŒuš6^Æý V£2”ÌSíïË9ÅM=6­ýíqU5£ÒW8’ßmœN—ô”n…ØT¨~fé
ñ8íèM˜ß‹NNi’hûG†º®a{öˆsã©Ý`Ph¢s‰Dõ4«¼#æ²FÇmqÅNÙ¬ºåøîpyV#Ø#׫Ý}/ðnŽTHÔ‘‡Àªƒä®g6N^A=ÉÓÝ„ýIm;M–4ä75moØ2É—®ò'ÆÄ+œèGÂù¸Ÿ,¾ÆʹEÆ~ëÉ…tAê;|ˆÚ*ÛFD—c躌T~ËIÑ:vФ³ÅVy1UE¿®u£B÷ììÉä¯NcA.ÇâÎÁùîã2Gnu‚‘9C\ä³~ݬMC4Ëâù^Ú.£é>ð,ݾ{/©¨ÍpÐ(¨nâ×yðd:7¤V»'1Ñ5£3䦥c´¸€VÖÁÙð§é/˜xו¤£_ðµ3-©ìȈbqÏ 	ÚçkÖñX	­ÑÎ]m¿¯ÔC°×_pþÒ`!þl-&ó9„ƒ'ÝÐÖÊGñ¼*$òºCOž°<§¸S—ÃK@F8HuùîOe»ÖN@u“«)Œø5Ey¨2äÏ-_À»™P¡á÷Þ36o=–™éy_;XW®¼rc>í¡A|g†è‹ðÆ—&¡=Y?¼…‰,úõÊ“;½FSèÂ`|¾ÿ*ç{ÓqÆÁ¡©$áã1ç”U°(ªºŠ_¦ý‚Ï»efén .G
-Ã]PËVxù äåá->Ó¼lœÀ[ÆyñKmx»F¼Òâè»2Zf¡RSÚJ7”DJS”Þ×ÛI™QFæ8
.Ù×Ø‚Vü7ÝAÞöpµ¦$=Y4üpYdL©åÌê0Õáa~bLǬ¾S˜ò!;¬ S,¾g¬Å$¨áŒª'ÈÃq¡IÛOf7Å[oiÀÂå¼ÈM÷àÚ9DKŸß2x?á‘°ÛPÄô†•Mv
ÔMLŸd;ª7—ëðøw®±	žZ§îÕj%DlÑ.®‹ô‡®¡_—Lÿ¸£+œo&…‡äò˜ZR¹/`: G_Ññ©Ð” jUDG‘°´¼!q¥÷ü~˜yÏÝ›:K‚´5ê•ï„)÷Cæ@È„yÉúEl¡ye¦×µ7mŇ<øèÙêsC?wÕ¥J¿sù)3´ž…fUoÄUP)Òöm‰hßBƼm[ûMbÒ/·"Y9ïV~Kwžä8þ)k䛡)³$É[·ìUT—Ã_Gp·>“*O.»³KíÓoñ-üÕµ\—éïx(åk›­Ñ¥ùòÞn>ƒ“C¯`
™Èã7“¥çß¦Ü !èÜöœç‰™PhΆøØKˆÞoÄ8Û'™w¨¹Ëû¢{Ù H‡+šäP©˜:Šfœ®l\‡Uíd¸-­`˜ú84ùÉG~ýCiM3ÝÚé>Û¬«XšÊäýªÓŽçäHÆ×HŽ6ÙÔ*2]™: Ïg~TƯxØFªHšûs
cA;VáåÖ)‚gwú8ƒL%×`B*b5DÊÜ.S§+œ6ènê·7„
“ð&Šþ÷éû¿ÃõÉ„œMÚ#«šø(Á_#MuŸj"'ïux}9&êÓ­±÷íz"Ñ6Ic`7aŒ¹&¼£Ïk…Læ‚8÷5Ž‘°J²¶Ðóù”XŒ»Ì…¥©’ò§Ü¥øRCiªÚê-+tù”¨(%p‰},ÎÂ¥ëv뤨cS¯p?ŒLá¦Ã:¬Q|¦Ç±Á×Ú«ÑZˆ>Œsàó7¬Jƒì®ô¾ ú—Ž¥µAŸëÑvÊ£Ù¦½’ë~_šLÊÌGRý…‘#¨2ò‘åMßέÚöKUÔ›K*‚ñZoF#Œ8»Wdƒ*v—žOÂ$±°Š
+GÖ"òCùý0G|ÿ~	Eƒ^¤Š¼óNd9FhY×K4ø$z„ô–l=“zß
‰ñL	uˆ ó‘…ÙTæ-è­ö­mê}2j^C¦i¨Û¨_)22jrªšpêÞmÈû03jež< Ç©’~‡1¸¥ohØ›j~®œÚC‹Ï72‰ŒWdipd1pÍ÷†ËuÑ-ºkÊë'…à1’—óyu¾1:õè¾áœ÷Q«¯»'rn9ȱ ÞL¹$×AŠe‘T—ª=¼C¨H¾¥6Ù>ˆc¡Øoíj¯Ek#XU–<"ÆÏm-0É~ïW„œïpÍÂ{´Ã
+XÔ’]•EŸ:~ú$®“³àà'|0’ëMÑÛ#ÕœH«â
+26xB|,-m
»Oï#LJw!éŸÁ˸ð!µ÷^†~ 1:g¡g‹V¹f"ñJ~¯dùÈps;ò{Iñ·¿%NlöeÑ:†Fò“¨Õþv»oûÖ“6>z-<ôÉXÄÄ#„måãû¾=ié—Ø ¦óV$žðvÆÎMŒ5"@4áT4{E[X£‹0¸M¾ŒØ¸((Œû½IHC¶Öšg H5¯¡kRä=q:&jÒmja½NõÞÈŽœ}Ê@
+µ+Hö|“è\½²8Ÿ§Êþ.àiQK¿)!E÷«æù“lJ ѳˆÚ®%¤ú«¡0j¿v€^ÆÏæËÓ@«ãŸŸË²¹D5zs”gÇ”DS37ó&­ýÔ»Ôø”N†18/ûs2|åÀ—Gɦô<†©”L)•gÛ¯rFö¦JƒËg —âë!Ã2lGduW_[ÞËLÄu¬6¥Ëźv]å}P‚à©®Ð+Ýu)ò4OÜ1Û @´ÃTÇ®Hí
Ë¡2Ju <]rç¯Aß„ôA<£zÁ9Åßè	´]nÚòûá÷ínÂùìê/–x+[©K9T6É©ü¹n³·TsKÅÝKZCßtˆRI~5ïèbáõ$;6µ©êƒ¸{ÞÇ×/Ÿê89FRs›‡yÒâÀx_
+y3dP”÷«ÕÔî.Amù2/…º©¦|hHí"•ØxÏ6ùé0ÝHÎ\qÓŒö°¬@ùblúpó4å±úNf('´ÉÒo„ö”ú¯jeÂØë÷‡›`•e,xùlo¤g–M¸úÓ5cÎXÜ‚Œ2ñ©ix'("cÈÑ’r%yàÇ×ú¬Ð>ž†_×z»Ù¾º¾nÓ)¡9~dª{ÙýÔÆÐõÐÝB\q§d~^²Š¢ÙºM“Xëù£ñxN†¿Ü+]=5Šµœ`ýù2Ðà#âS.Þ¼tŠý#–ñ1F
+zpe~¸
+LŠ3®CÜ/¯W‹D58ÇÂú­KÌÁÕ#²|¢Ã1ºO¦ÞtøvªÙ?cɲ``>püÔ-Vµµ¥Ü3n&>Ê©±î
8úò²ð'ðÆJ½»çÙëfV“£ZS\E“‹I}ï¥vA^ Ñµ“8 ŽJÞ¦ «kõ²õ}¿ØÃÛ¡ø6ƒneÅ]‹ãþâ1îá+	ÂuØ×5ñ
z“ü°ZsLF/õ$Že<"û‘wlcbŠ†O8ž’N0uebØÓrô¦?%³mÆ~$ú·`&1©j#3¡|07ìž—	‘u(Öœ±«Ù„XpÔ¿UJ‘tç›Æ#ñ[@Ëþ'.lÈ¿KgǪ¥­œ²„i¡NcØN›V¯¯Õ^²”y­mÄ×ÊŽ) ›öBåÄ!fšs5‹ NÆŒ	•º®ñ Û߾˰(kÐíp¦^mÚ·y¾êi—$E»j“÷¨~êØ‹$zŸf--Fd	¼6›§—_IA”Tª¸mÈ›"Ý;;ÀNJ”søôÚùã7JªIJ
Ÿ,Ì N|Ë^"¿®òeŒìébxšuÕŽB(dò#1C#i>b‡êd¨…ÅeD?Ù"¾]´|1:æÄa	šŽ8¬†È³úc‚èL^QYU'‚6ý‹…ïûšÜkòdC	…<` GeK+ª›95|‡^Î%Âq¾HŽ©èA«I_GŽêÎ9Ç)îi†oHpÁ:N{-÷Ïü3šÊtâ¦AùC©“ƒÝìZnsH½ô‘/VdÂ`h<™5º‘ÖIƒŽxPzŸH^©^Kâ=Ãie]M¹«–U|àùüy.¯º¹%’:Qnü
+h¡?°šuÍ'˧”uþ$o¸©<®†?7D#mÞSx|håY#YEòÉ3|êq1†¦gåTî†ö	‰Þ'YøCŽAX¤Ä¼ËÌ0#FmùÜäèÑFîròÚÖû©¡£»Òºéi
¸;&×}ŸÖæ?RKCg)€,ûó=Å,+w_ˆãP$7ì?Ý™(j	¦‘ºÕu®€[î„"¸	I¥¼B7³ªw%äB;Ñéhé5àdÑA}Ã
‡Ü¡VÌ6Jj€ÐHAUrÞçìƒÎÝôÄNù7…TçMÔ€Ð"ÝJ£ØXð?ÇÿŒ±37),“–u³X}~~š±¤©{3ÌÞ›êS¾ýIÖNL)!(PЄ?­VÚçxsãnÛX$;ÿÀ½r%
+“ÊŽ@]uéZïŒp	´é‚¨l‚„"Öõ‹v%=ÅW‘â©ŽÝ9ÔøõÎKM|xSüI(ÌÏè‰Xih° 3FbýƦAgµCk…
P{l}’˜WÃŒ÷皧ç¡D
+÷ÜbÉ3ýìäHô«.mBzFë‚IÿÍ™ð°›>.3%+Ö=Ã9H÷´ýi!ùÈîŽÒIr¾ÃÎÛ“´
+ºj1â™ä·
õÞÎt*çY™ºû½L3`*0¹ibs.W­»š„”øöÒj9ë÷ý™Hb+	bÙP{ÂÅêÛ±[)›Zƒ©hY­˜Ú*~ŒŽZ™èÈÉŸNðNFmVüjÃè?Q®€ž õh7è‘2`U5Ì×Çé=Ò…ùˆÎ³.XÇ´ ³ñå"Neÿ)vxj³V 7s¡7[ÉEPn¼
Ù'.6ìÓ»ª6`ÓËÏö‰:ìI¬,¶Ç g:}Ã#òͼ»Ó/ŠÜTd~eŸ‘ÇRh¼Ÿ h¯ÈO¬‡JUÈ¢Q|ƒ†gð{yb “Ýã$Ì2°UMñì¬ü!«ýùKÈäÓé’¹ÀG>MQë8AŠEáŸLïø+õoºÌ…Á϶4{Ÿ¼8mß¾;°fÉã!ë§ñ	î}Ûu?­¡ýbíÇ-$r´sI§%=­4 ¼z°éUË¡Þ€IÆ̼ÏfGã™ÌFö½`ôzXwí{­G¸ìÎжodž!1»w½o#\¥W´¢œgÐ:@è2±©ß‹\ÞTáKçÌ	vvÎ*oÚocŽqÓgv¿­ÈU™¹&ª9«¯s²çÈ·$(³P|6¦³®mFõI?BQ³ð‚'”¶5ÈD§õ9NkQìnAþW‚ê„,m©.|ªø,>G´—Úµ¸ãFÝæ{დ&èÎnjŸ.2ßaðàã<9î!šéØâÔq+|¸ÞÄÆC߂׳xàš·—¯óYgZ ؘMm1 l3ËÇÉ”3W\š„á£ÌN)f©¥£ŸÄ?<¸~Ö##Jꀰ]4'¼¦[ß1pu?×_gŽÿ©–{¾JùCMr`.@à‰£ÉýM$_wq”ú­ïL´üÏÛ¶ìã«ÝTyÊ×–pi=„[wÀ:] tzt;Pø 7r=IôÁµU 1¯Û¸´'’$åW­Xa¥Y
9º£îHÏ>î=û‘{7$91hrÅ4Õ›bݺðyƒŽ™ù±í‚cÛψN¬ˆËÑÓæzPŒÒiDþÝëÒ@·Ä,ƒ8òölAËÔñƒXï)ADjˆ-â—’ŸöõÒ7s^ÑΛ¶'t¾Tħhy?æwç¡IÔ)[¿ªò¾Ž%#G•utßÈÄ­ÊÒٜߓ¶¼îú;Ý>¬´-}R„aú¯6Ð ž‚IFV{$ÞµhÒR[€ÆÏ~GõÂÆ…MÚN¨¯JxRÙD?.°ŸˆÞR˜¶[•¦~Ã-Èý®y—ç^Ûä­ÿHGÌp©Ý)bœDr[mG{ê3sûšg&ü¨ŒOÒµü%鹶æñˆÀ¸{ÕƒÕgXI½î…‘îA)b«	…XËu©ìsã™ë)•{«'…𩑬+²|r»#­Ä¾&W’Õð ë4:ß~²–Ü‚7>®×›©¼ÎÅÇYüìË£AìÁú2_ë(³s^»Óqô°¢,ƒ/©%©oº ‰¯
+è½þ²I²(:ŽåYyÊèi–Ž–0A¸€pi'´‰©N°›AèI¢F!Ï,”³	ˆ-8ÊXR 1J÷Š;ÐC–uxó4Žýx;%Þ˜9€@—#g¢ÈÐL„#b%Øriþ\
êŽEˆþi[þ¹Dzó
b;	)Ó>€0¨®úÞpK¨˜Œ¿&÷øQõcŒ
HH¨Ý­"M„ ¹ î|‡4Øà¨6û½t+ë&70[Ÿ[Æòö#Ž‘„È»S掵ó2º]à×{ý¨êàf/o}ÓÙ½&íOšÂ·â‚öe©nÃK§K;²PðÌÜH.£Üâ©zeyïŽÚ¶ôo›2u	p,wÝ1I4â†õ-¢æúŽÐ¢~IÑ=.+
+G.ã"*ÙÜÉ’Tây'Ðï›ÒN‘*
+SdhifÑ¡\ØwªÚ<èJ´Ša­™Þ€è[á."7†D²BèZ.œÚÞ#âÄ›Ä{²ŽØç2jWˆ:ècOI̬(p½AGp»[Ñ2Æ1Âò a¬HöÆ‹¥0´ñ($ºjΪáu_Opdì<Éå¶U¨Ôxãе~†ÕÚÁ$2cAþ®ž«0+Ú«ç`п˜hÈ"‡=Ôö+=•îEåUÿ
_spЬ_úÉê<]ü—åιqP[ƒ¼ï?º“ĵ”‹zÆéc˜ü¬cêˆ<ÏÚ}çQ<´²Xú”§ºrŸÂ³>dühWeL©³Cq¬tIò)U!œ™õ1T›XL¶û¯a8LÃ#2Æ\-µù'Þ¹•è>©MM$QïxõÕÈvû.¹!uQÄâFÛÒ±,•DlöžŽ™al–òÛž¢bªêw(´ˆrˆ‹Œ°‰bBš÷®—m!ýŸŠ¯\‚«íçEL8ÝûkH/íãèö[Ñ~`¥‰é)¦S\H6‹œ©Í²ÿºW½…á¯^	¦ƒ7$«98Ôke•¿.›O†èW¾“CD%Z‡L¨ý™Ñ²Q“íD8Yaú2ì(ïÄuvñQrSän@ôÊ-{Ûõ‚;ß(=y=kÛæ1™çä¿òINãtá›õò°Œÿ1{¼X‹ü8µî¢Ûw¨üÿœe]ãUBÂåê
³Þµÿ}Oí¥‘¥PfçFóä뎲gaÏýêÏ}Šqz{Ç!f©Oˆž˜5vj“_éÊM ÅÙØ°Dƒ-Œ‚¨Óz(w¡;´o§híæ¦Q¸¾6Ö@7Ÿyì3bBVüoeë_ø%Œ{[ðu#E8Ú´Œ«[ô¹Ÿ
+ºÄ¿ì¾°†§‘8M1Xæz2¡<¾ÿ  ÿŽÝ£Î|øÓSM¢JÃI›c§II˦ê¨Gðöý×ð¨ï=S®üÕdŒà²„_¼Ôعvù‹j§PFuhÛ4d^ H¸ðÀ?Áü,ioêpn¯¸òx-ï¼8ÇQK>N޼˜ßyóò£ŒTüÖ›àùzPþ8™' â²Üê{Å´ëQºµ•Œ6{×Ø£grƒ?eÿ¯nm¹þÊD£ï:ò×3òãBÄÚ.¨]¶»2ŠCëð‰Y©hû³çz?P•ÝÐpýŸÎå•¢€¦M›}3žPEY!´šeßÖHéc¸*@-¨k)–úÊç0AÞÝk["Y™Š@T%#HÓ·5{“Ž¸úË£ë¤ñanéãJ“×Ñø™)—Q±s56`.'\¤uKô¶Ð@‘c’‰sÁ+ó¯B.w•©Up´Â•É…Ï-·ÈÇøÛ:Ú‘~õ­Ç)oÐÙ(È%,%_Ö;Ÿ+ƒòµ†KuÛ¢ÃJ	
©hc&ÀMxÍÕõ¦³ˆ³}Ͼ³ø‡]P¹!„N%LÖ¼‹w5áA,lõDC¬ON»›/¥ô~¤©F—[
+¢‚‘ïƒÆº]6¶Š±+ÁVοm)PÎö„iT5
+™¥ŽF~7ß­wðö¼)­µÐœ«"8~y1_)úôPµœšÚ„‹F)#6/¶>K¯IÑ"ÚCPŸqW#2ÈÁu†–À3¡‚E¸É³ï`]´1ÂSÿ:.Ž°sh+ùÅYXyr#Ы934´žÙ?æ¹4ˆCƒéTm‡˜“#Ø,6HÉwÔ[ +»ý¹3ÉŽÀ­¹Hî.šýÊ’ïŽ)ã
+OˆËr…º'+¡mb˜“Ò€›W»S	¥pÁžôö½~xe2}ÑMS¿>iFv ñöße֗¤JÍ‚*ÙåDÍePþ±^Sb"•zéäç«™æîõ•œí“ò
+Èl´GÓB5xÖ-,mÒp~Óì£Ó¨œ+ôüÛ€skŽ©¡¥E6©5w|]Úöf4ºáb>BÆ‹×ô,ê¾¥Î÷S]׫j²‡Õ{µ®³´j.’‰]ËÃ7ÕCwéh„Û Vó³c5öVÕVåqý,{ÍNâw¦p%ضœ/ŸtòÇä—I¡&¤ã ‘Yà…6	Õ?gZ®Ø\…Ÿzüýˆ:ìQÃèä´›Žó¶XwѧñºÇrÒR.™@sÌZ¸¶×®úöô²îåXé£2Q?ç˜B©MH5^˜ªËUØh†ÁE‚Í‘?Ùæ.’¬K$<Üa›nôÜÖ}“f4#Çsœ'C’—ž9ü“ehÖjVæWb…¥{Hºk©±~…üÒ7óä;W‘§S‘G“°Ã\Á¨®±ê–,ý…ª/ÞâZ²Ÿ¼P»Ÿ×M|OS_h_½Mò¬Î¢ORØÑVk|”†
¾6â­"+^ ±ôÕŽÉ{dþs\ãyÊQ\=’¨M®u½X—‘¶Ðƒ¯m…`"æCíG]®8¦¤–çô¬Hÿ!»Z›24ÔËøÒ•i¢50¹x7)¤Å“?αý#D¨(³ÖøyÖiñL5J.›x*ø^ù¶2øHQüÆí›
­òZ‚¤ºœ£–S¹ÃÞx+Ås*›‹Ý¢m?\aÿ(®¾=LÚÇr
+ðC»Ü“`î5ñ,¥1»}~`–C–Z Ð
ä5æÊ’ƒàr¿ªn‚ÐT8jTÔj¢éaqgšý¥¯ÿSmþÇQåÄ!šeѪò®±<¿÷v»ýÓ-m·l$k>‘Ð@Ý!Mõû½×8•ˆÉ8Ž8*Í	Kþ‡aãŸrÛ8…øí­þ ÿnrù ÄýÔsõö’ŽÇ0kâŽ5È¥Cžœ©ßÌ4΃z²~–ÄÛtJKËØÉ&
M¤XT6ÌCF¬‡1ï¬_¼V`bèÂŒòÄH÷Œ¢=¡(ò`¦ùšwÕd¨¢á2¼¥}7ÈÇœ2
+ÆOO6Žg¥ÀFipûP½õ"œÀ«þúµ†)˜Uš™…„™–Ñ(×~P ô§ì±=¨km`¦‹0›nÉ»“L`Èø4öŽ1®€xM&…«u"³¿5*™'såÀmý[9ó:Õ…ìÅWÆÚ1Ýóä	“ˆÈðRàÏ$<6Yà~oMݲݪî^Ó¾Îóg™VyÄ[´Ý^ìMgŠçú¶0 r(©Oº¹,§­)w쵉O×$Üí¾‡ŒÇ¾77BÏÜLW¶0P­á†(¯ˆÆˆ(¾Zÿ}QœÉ™Ø~ÒÅ|Çí%S°¡cD#R®jôµ_Ö
¡lÃÔeœ|A:dðÆLôŸ=LЀÈp2ÎÇÅÌ£(™™Ó"ÖüüQ‹vÖþûך°†
+NP¦¾ç¾Mu KÎX¥mç®»÷õã\Õ=K¹³4ZS Qï$~WèáÃÝo“xûÐúƒÞ_X=Ô/´¢TI}zÔðÂÿ©éͲ/ལû¾çÂÏ	bð9Þt?vš¿ÇÑnì-¾—'Z¥Nä}¯É¢÷½‡”mD,NqDÒ(‘ pûaï@ùÚÖ’ÀÙ‚&Oj xÅØÍèR­BÁMø'›K &a Š”œ¼¥STÎDú÷Ƀ¤9qvÅ{¬Ós"c©L'4(輟Û(Fäá“ŒÉÖ»‚56h»XÒ‘ó;[ÔG,zÚÁ,jWxú_<¤~Q YV‰Mh×…Ïë-¬8MFÄ>£X9^'E¾÷Ò 'w7¹V¿(•\²:/„§ÃÆ¿’·è Z¿æòëöŠ0ê³µlZ%ª¶æŒªGXz”¦6³§·ŽDl„ΆCßðŠ\/”-;nƒÒ½ÎÃ3ñì©q*t†ÂuuvDC¦ˆŠ¸ýP›ÀùƒpܦÙÂwÚ?\…í(Ÿœ¨¦Û»Ý‘w„gc5‹q@1õw0⤵w‚~‚Ïj5â–š©µ»¬ÃÊØx„È(ø9×t)¬†ý¹‡´}“žªÂÆ(É2Àˆ³¶¥=*úp-_ܯ܋¿âu~àåMÛ†	‚ôKï}Æé÷B „=ŽWõb‡Ó™̾j"ˆ¾·µ’*{5ñNÔ8Lþ.}Mhò~„(ZÏ•}A½f{ÕŒ«¬_­ÆE{´Uc¹Ú%4¼qr;)™¶ð… &ZEÕºÉzs"ˆuCþh¼ÂˆIØ­O{pŠòê5ÐûŽþød³DâR+}|^›$qÌsÑ0§¹i0à&ë}•bSÅUFu*ôÎSg‚÷á|ŒÝÚ…­ó’‰"(¯!¿oCŒ€ðç”C`S©(ÏËUOÜ 4}³†éaXÔV¹•ŸÆ`,‚«(91„‚‰Ç&I.ÈœY]>«ÄŸlŽ#$Uü&]11•*,[ŒÅÁÂ-y=dšÝÒs)°°!4S¨îñúØ·P<úä€eçOæôxí@|M? ÓCS(‡n%Uõ·Ë˜€ÔÚIߪ§ôaåè)
+ jPÄJã­	”m`4X9Ù**è
+°G:xá÷‘"ñ2Š^â`¦i`ë£ès2ÝΰR´*c©*î“^x^¡¶ow]÷Ò2Üy|Ýšéo aç׆rYÕ‚E&¾VÔ¦+DFm%j¯DpŒç)}åÇ`#®É]ÅŒwËX–„ÏBâŒÝÇê‘ÂÜÿÚA/üÓK–`Ü‹›fŒHز’Tšäw|4‰TÞÏ‹5|^«ÔØØ‹y¿‡m,té¡h¸
ÖEøè´?I3ZÜ¿â²Uß#0&Yh0È‚’»·û 6ícvÀ{ûZýƒYah
¦¸$߀½-“%;v’>‰f›–Þ³9k =ÔÈñ<½®UÇj+>ï¬ã]×xé‘ÇCÖ,i7OùkN…CÑDÕ’o¾V/‹‰åõ†±Õu÷„Ç@2bÕ¡»#ÒaÃÛ~¨¥­öY¢¥ˆØ9Ì›ÅuùñÃÆ8¿ƒüç2ýä3A³—‰ÏŸFM9úÝ8›„TÖÌðÄìÑpå¾ÖË´N>»)ym7‡)zjì÷"¬¤©0=ž};[J®ÀR²ñ5X¥šHË.«Êî_&ÿõ& ®5=Ú©}A™4SÛŸ»gñšhÚÆK.@?:×üž*»©oqÅ"æ¼ßôücjÓ_ 6_)téɺ#ôµ<Õ8¡#;O ôyøƪÇ¢#mgCœ·òd9\"äÞMTrÞvO'­‚´Xñé‘,™à=Ü]ö–ùãÀá—ÃT$mL£NÖ•Hó•`Hý”þÝuFEi	Åܼ™&…Bºð¡b?1j:æàedƒÄù„ã%ÎVDea—ÆSÞ¯ÙÞõá
+˜ÔÔ³´‰Aq^	JåŠkSÕD…-–©Ÿê¤Çيَ߮—ÌÓéqP
+á·)””£ºJ	bzÖ¸¡0ö³?諾Kd\…â]Ò–zEd7¶ÔRš?c飣_Z{UB*bl³å®ÝçRwºû†³£lßžØÝ2ä횥ø@g‡¤Ÿs"iƒ½Q¤-ݬ̃zc,öUWh§m3cMKÕ	W*ú	‚)á'>›C)0b¼Ö.èûAxè÷œž2ç`£,KH˜Ä;êÍקSõœÛìŠX¨…ŸøÃ÷O'n‹ëï‹'nÿh(oí½–«_ÿ>ós{lêšék@úC¸iþd&V*ânm§É<Ÿ‘]	Ãh,POódJÅsï;|NÔwI	ÜÐŒL=¼èÈâU#ܯèû!²òz6Oø7™W…½oÏãÑZÎTV€cêÇXÆ]«òÞixC5ÁËÇC£úÓ?tDtîbÐ4;ô†¨îö9üGÇGH“¨ôâ›FµÝ…ïŠP-;™åöUº{íKÆ®]ÆYŒ{$ÈÎü¤¾å0Pø¸Ç5Nâ*3¤›Á¦åLo,G½¼³xÏô†É}D[ËÛW|çWˆ'ß	O(ößV8ë"zF!ØZÉ)|[@ƒ‰­¢¶}ï£QÚ
-§ü¶E!Á[TyZ‰Ä»Âxx’ãV&éºÅÀÉxAÕÎg/,˜àÀgÔž”Ù¿f‹lÌê‚Dc_GØÕÜv/om\y˜$¥¬n‹ýÎSõÅzuwsÉA—CŒÒrý‘UçÓ"É!
ÔºY™ÔÉ.”¬j‚B¿ÖL.åRW
ȸ¤ÔÝK˜tÜ
+´†2Šàc"Ì‚cÚ*ÕWzèîz$%zuÕDÜjåïKjÀ,‰¶zÛ)Áa4¸09v€έ†
ÄŒv)­îh?uáï<ì07¾t6ü˜¨«¨Å¬½¤òóáR>-×tÔì¨Ëìsúß5_ú6rhRSF‰É禮5'ª¾¦%œpPFSØöÊJô0}9ÉQÍf+Ë \th™3é(qäK‘99>Ú³¹¬H"b÷ÈÕÐÓ¤R¾)Hgðxª.tþI5ê‹œ´‡¾›ïïßÌñïÞ2ªMû¼ª1Ê,ñ:qªwq†¦NêNì²~ß×üÚdÙAÙ=¦…aæKâA<"PLå84bYÂ]@4=p8Z‘¨™æ‰¥ÁÝÜoÍךÔqXÚ™ã†0Qá`ÑZFŽ°*1B³}õ¿Ì\Í«Iu6&áT<+Vý¨F?Þr?L2¼†Àþb$©?'sŒ9$yå ô%_SáS÷a§û…™3µÝæ3pÖ'Èc5¼›=WÏ4·µÚûÔ
=`B#Øgì@Ó‚åÇr¹í£B°)0	f0ïp
©ô)ƽY®KÛZpï„4S•_` f¾``F:JˆE:Ô6‘(cþÎM4)ÇfMÇÏ€»SÝ?-4e~J_ê=ÖUvEà”Â7o…eóTê.A20¸‡äÉí¢Í† zUU.aé	Wà(\CßÏR£„[P…Èœ[Ðì#=Ô bþ»®5µÊò\©Ø˜’÷Žªöæ†h…9ýÔí7NráÇÔQsrN´ì|8ýÕ3r½âÄg=²ÃßÞƒÅXMÕ“¤5{¥û×Àqj®/~_?œPÈÁT;Ú&hçÉcw•" öo²YL¶@òÛ;3ºNS¶üÁ2sßPºÏ5žÐœâ5õ½wæ-忳}þeWˆ0¬ÚLNQõ`¦í Ü
‘k8æ¬9V1ê®ÂžŠî3,y-ÊuI7~ç^äö|ùà
+
	Ôìÿm¦§óyc–1ù¤»éÂlK;¶î­ÎA$¨¶âv	ð¨jCíúJÁÕQœƒSÑäǦ0`)ÿ1‘}õë9céÀÈÎ'úåÍÃʳǯ(ÓÎÒצÊ€7âHïR&N·ÿ;P yíCÀG––Ø«m†eU)÷Fhó||ÿÀ­‹CÝÕ³‡´ÿÆl©†uxˆ~ÒpEÈÅGE"A"ŒFdÔ·Ò9Þ;nÖ_ãNÄø;ŒG°³
+“¸0ÆvJ¦à˜b(
+!‰ªASƹLº&çû<ÃG$^Ù5'	µWŽÕ±ð­&ww´â­F㾋A«‡•c†Ümò˜¥ŸÚ RÔ]®Ÿ(ÝõM‹U4=kNq~ñC[Ðz&IoË< ÎçßüR<ð=±1\¯çS‚Ìá-¨áMcc€4£
+	öåJQÛÚ|ŠŽZ §º„#áÏ…ðï–5)pC†ÁÎÐõ~sñ94¾ïw›8̧Ÿ˜¥ÊÍ›y›@æ‹.òÈ3Bm}¦"p&s™HY;ñ#Œd¶~Îöósÿûºeô¦[ÉÜäØñdp$õO
Š'þ ¹ÑëJËo«ü,žز³Ð|Äç¸tïõ-ÅYœ8.fw%W*máßéòK5…Ø0öT¥®¤ë¿jà·|AoÖ|dŠ¶	çrr~ÙX—)a0ŠUHxj¥jæhcÈQùy¿µNxÄHë×¹¯X1ê)À€§øK¢#Ì‚æ¸Â\Ä9;ýù¸]%«,G»FKY¬"ûû™öÔ°83«R–)±œèÞO\=Tê?g±	c„ÜXmDT;ÔÌíxPÂJ9•?eM;Š†7,×ÿyFᬡlDH'jœhH¢ýf‰ƒÖ‚bL€L;êy[è"ï»’¶Ô2UÐå﹩†‘]LFÅS«ÝÈ—½¨®
òqþ& FtÉ?&ŸºâÎÕì-P*<ÖnÏKÖìÖ\¬Âq¸b¸œU¯ßi+³ÚîúþG|~ꬰ®¿:äCÛ½8dþ‡7Ìð˜é”zÊŸîÏõGf&Â=²"Põçz´¨T{ID-%i´ää©"©æ×sd;{+Ách!µ
µ‚+Íi¯ÙœÝC\os£Än»Ýò™Wæ5œZ3ÊIñüWÆŠ*ÆCØz;‘¯¶4 ¶²ä”xå¬Ô%«ýÆ¥Ô“º¦NTÖ0êbñˆ—ÕÓs½¨k¹ãÊsK¯øqu1*ŒuõYÃ3Å~kF#ÔdjÎðàLÆúà÷ÿø¯‘>®è³ù"àÔÛÎÌ°÷H krZìo§ØûvŽ{_<(ÆÀÀB7«½¬Øû¾$[;xõr:©·tw‚N'š
ÿ‹ØRHZéÎ˨±¶À)4ß¹Ÿ—£xJ-^ST”¸ñÇ	GÇî•ÑEõhïɵo¸›0‰2J[p»=¬Q"¬Ò±1ÛëLÆ+xö}ÆLÇ€'º°±	·Æq hþÁ(/ ¦¸|µÑ#®úí¶BßáTw8­j·‡|®¦ýeˆŠ9“íÿòƒôÿüÀÌÖèä¶:Ù ý?”íendstream
 endobj
 631 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 34
 /LastChar 125
-/Widths 1356 0 R
-/BaseFont /EGSTMX+NimbusMonL-Bold
+/Widths 1357 0 R
+/BaseFont /UQNYRK+NimbusMonL-Bold
 /FontDescriptor 629 0 R
 >> endobj
 629 0 obj <<
 /Ascent 624
 /CapHeight 552
 /Descent -126
-/FontName /EGSTMX+NimbusMonL-Bold
+/FontName /UQNYRK+NimbusMonL-Bold
 /ItalicAngle 0
 /StemV 101
 /XHeight 439
 /FontBBox [-43 -278 681 871]
 /Flags 4
-/CharSet (/quotedbl/hyphen/period/slash/zero/one/two/five/six/seven/eight/semicolon/A/B/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright)
+/CharSet (/quotedbl/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/semicolon/A/B/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright)
 /FontFile 630 0 R
 >> endobj
-1356 0 obj
-[600 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 0 0 600 600 600 600 0 0 600 0 0 0 0 0 600 600 0 0 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
+1357 0 obj
+[600 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 0 0 600 0 0 0 0 0 600 600 0 0 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
 endobj
 627 0 obj <<
 /Length1 1612
@@ -5875,7 +5892,7 @@ endobj
 stream
 xÚ¬·c”fÝÒ%š¶Yé'UiVÚ¶m?iÛ¶]i³Ò¶mÛ¨´Ué¼õžÓÝ_sûþéûýØcìkÆŒ˜±ÖØ›œXA™NÐÄÎ(fgëLÇDÏȳ°1rq’µ³•¡Sš¹þYáÈÉ…†Îv¶"†Î@.€:Ð 403˜899áÈÂvöŽfæÎJU%u*Úÿ²ü0òøŸž¿;,Ìlßÿ¾¸­íìm€¶Î!þ¯7*gs ÀÔ–WД”PŠË©Ķ@GCk€‚‹‘µ…1@ÆÂh뤘Ú9¬ÿ½ÛÙšXüSšý_,A'€!ÀÉhlñwÐÝhÿ‹`t´±prúû°p˜9Ú:ÿí³ÀÂÖØÚÅäí¦vÿ"dïh÷7Âæ¯ï/˜‚“³“±£…½3àoV±ót67tþ'·“Å_7ÀÎôo¤‰±Ë?%ýË÷æ¯×ÙÐÂÖ	àtwþ'—`bádomèñ7÷_0{G‹Ñpq²°5û/´G ™¡£‰5ÐÉé/Ì_ìºó_uþ·ê
íí­=þµÛî_Qÿ‹ƒ…³ÐÚ”Ž‰ùoNc翹Í,láþI[S;ã¿í&.öÿÓç
 tüWƒ(ÿ™ª¿$Mìl­=&@S89;ç¿)”ÿw*Óÿ÷‰üß ñ‹Àÿ-òþÿ÷?5úßñÿßóüŸÐb.ÖÖr†6àßàï
cüsÇX:þ¿Â
m,¬=þþ3Pøo’ÿ8’Ά›!hköWFzÆ-œÄ,Ü&
-ÎÆæSCë¿ú—]ÕÖèhmaü«è¿š	 cbdüŸŠ¹…±•í?­gý·hkòŸäÿŠô/êÊ’BBBÂ4ÿy§þ+Já¯öÎ*ö‰ýRdíLþ×â!!;w€ÝßHÇüƒÀö7!“Ïÿ!Û¿`˜þk-kèìháÐþ[2#Ó¿
+ÎÆæSCë¿ú—]ÕÖèhmaü«è¿š	 cbdüŸŠ¹…±•í?­gý·hkòŸäÿŠô/êJ²¢Zjj4ÿy§þ+Já¯öÎ*ö‰ýRdíLþ×â!!;w€ÝßHÇüƒÀö7!“Ïÿ!Û¿`˜þk-kèìháÐþ[2#Ó¿
 ÿÏ­tÿFÔÖØÎäŸYQv6´5ù;^ÿËðÛØÅÑñ¯ªÿ:ñþŸë
:è4†[[¶3æ¶LËLw®ÅΞÑîïe±/mP)*ð¯¶ëñKßå¬0x¯	¡oœæúlóX:³ÿ8”¢þ=Ú‹eMÑ“
 ¼ÊÇ÷!¥ê+@ÝúÞÁNó;A¯1ý\=ÚëzQfB‹Qí÷Þ¤¢’^É;ÁtÇG˜ë?Tþ¤®þdOöH¾Æ?ëã0;QAÐjÏο'üy¢ê¹…ì;ģɉƒ%çv…@üåïƒÇ¯¥ZáA•Þ„€wÛ~ýI¤Þí¥—GN†Ki#óª`–¿nÛ.óž™ÞÎÏ“$ë(ÑzX©u3?Å#˜4Í9—ûµáB.ê„ÍÓ„?Ô7kE4“	]O8üvCÙïîUkSMýÚ‡”»02£ØYZïÖuHÎH7áR‰$ÜjïD"$m|/Ë·K|ZT7âí質9—1ÉÕu¬Íü¦@ÖvŠyÚÄVhØx+20%3Ôt£%7!AZ|®èÑá{åÚG–PîóÄ¥¡
_•öÀÐXªÚÙ"³ ò'y´»¸
¹Ío)8[”Ì—3	!œ,ž	Ëh!k> endobj
 626 0 obj <<
 /Ascent 625
 /CapHeight 557
 /Descent -147
-/FontName /SIBBBC+NimbusMonL-Regu
+/FontName /RMEZVV+NimbusMonL-Regu
 /ItalicAngle 0
 /StemV 41
 /XHeight 426
@@ -5972,7 +5989,7 @@ endobj
 /CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright)
 /FontFile 627 0 R
 >> endobj
-1357 0 obj
+1358 0 obj
 [600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
 endobj
 621 0 obj <<
@@ -5985,7 +6002,7 @@ endobj
 stream
 xÚ¬zSx¥]·eœTlcÇv%©Ø¶íìضmÛ¨Šm£b£bÛ6»¾ÿïÓ§ŸÓ}Õ}.ö~Þ5Çœcb¬µö¾xɉ”éM쌀bv¶ÎôÌL\U%uCkkC;zIgCkÀ_3,9¹°#ÐÐÙÂÎVÄÐÈPšD€Æ3''',9@ØÎÞÃÑÂÌÜ@õ—ƒš––î?-ÿ¸Œ<þùédaf øûà
 ´¶³·Ú:ÿ¥øTÎæ@€©…5 ,¯ ))' —SˆmŽ›Pp1²¶0ÈXm€ÔS;G€õ¿c;[‹ZsbøË%è08Ù-þ†Ýöÿ@t{ £…“Óßg€…ÀÌÑÐÖùïœí¶ÆÖ.&ÿð×nj÷¯‚ìíþzØüÅþ’)Ø99;;ZØ;þfUûwÎæ†Îÿäv²øìLÿzšØ»üÓÒ¿°¿4QgC['€3ÐÝùŸ\F@€‰…“½µ¡ÇßÜÉì-þU†‹“…­ÙV@pš:šXœþÒüåþg:ÿÙ'àëÞÐÞÞÚã_Ñvÿòú_5X8;­M`™Yþæ4vþ›ÛÌ–ñŸ­"ikj`fú·ÝÄÅþ?0W ã¿DõÏž¡þ[„¡‰­µÀh
-Ë(gçü7%€êÿMe†ÿ>‘ÿ$þoø¿EÞÿ?qÿ«FÿÛ!þÿ=Ïÿ•ZÌÅÚZÎÐø¯ ÀÜ1À?—Œ…ñÿánhcaíñø¯žêÀW©4s±6tü¯ð¿émÍþ*BÏÉÀöo«…“˜…;ÐDÁÂÙØ`jhýwVÿ²«Úš­-l5ý×8ôÌLLÿS1·0¶²ýgølÿ†€¶&ÿµü¿2ý«xF-a5AQÚÿó^ý—ŸÂ_ýU<ì€ÿ™D]ÖÎä-þa²sxÑ3s0èY™Øþ»¿ó;³Ïÿ%㿈˜ÿs-kèìháÐfb`bbüýþÏ®tÿ¨­±É?;FÙÙÐÖäï&û_†`cGÇ¿ÚþëÜÿmú?ÖÿÚî@ ;ÐveÑΘ;Ø2=+ù+ohBD»¿—|(ÄþWƒJq¡µ]_zø6g…Á{MCã×g›ÇŸSû})šƒ‘^LkÊžTàe¾)u_!ÊEíA £Þ/„Œ3õh¯«™--v&µƒ	E%½ŸïPS¬Ž0WOÔþ¤®…þèdöˆ¾ÆiõqÈ ¨µE§gIÇO”¿G‡‡{n ûöñhs㾑s»B PDù;äâñk©–‹V6½8mN¨Œ Ávìòø›½ä´“[¬{[Ëû^¬jÄî
Öæð¡'¦E½à3õ%­µK$cÿŒæ^55`wzý´æ]ŠÛê{ÌFx9].òn1[Em™QBÏ•[ï¹öضé3MºÔí¡v»ùV¹\¢ ³*2mjVöˆ¨pz/’]6r
w™ÇR‚I%Poýpc75ÈÔ'¶ÈhÀƒW7JUϳ`K¡$¥ÀsÎ<Ä7:^ƒÉXÖë}†¿?Gæ;¦D»Ëc|y´—GðCK”Ï?eñ!AÊ¥c£VÖnPW±6HãÊQ9+–hh8©SfŠŸ0gÒËÑÍÁýh7F(Í¡7öؽŽa¸Z®/„y®I­1‚ÐÖÊ®kZºíRø»ÓÐð±‰ÌN²NNÆnôâT7%ÿÑ'ϳ7i"Å
+Ë(gçü7%€êÿMe†ÿ>‘ÿ$þoø¿EÞÿ?qÿ«FÿÛ!þÿ=Ïÿ•ZÌÅÚZÎÐø¯ ÀÜ1À?—Œ…ñÿánhcaíñø¯žêÀW©4s±6tü¯ð¿émÍþ*BÏÉÀöo«…“˜…;ÐDÁÂÙØ`jhýwVÿ²«Úš­-l5ý×8ôÌLLÿS1·0¶²ýgølÿ†€¶&ÿµü¿2ý«xFM5ui
YÚÿó^ý—ŸÂ_ýU<ì€ÿ™D]ÖÎä-þa²sxÑ3s0èY™Øþ»¿ó;³Ïÿ%㿈˜ÿs-kèìháÐfb`bbüýþÏ®tÿ¨­±É?;FÙÙÐÖäï&û_†`cGÇ¿ÚþëÜÿmú?ÖÿÚî@ ;ÐveÑΘ;Ø2=+ù+ohBD»¿—|(ÄþWƒJq¡µ]_zø6g…Á{MCã×g›ÇŸSû})šƒ‘^LkÊžTàe¾)u_!ÊEíA £Þ/„Œ3õh¯«™--v&µƒ	E%½ŸïPS¬Ž0WOÔþ¤®…þèdöˆ¾ÆiõqÈ ¨µE§gIÇO”¿G‡‡{n ûöñhs㾑s»B PDù;äâñk©–‹V6½8mN¨Œ Ávìòø›½ä´“[¬{[Ëû^¬jÄî
Öæð¡'¦E½à3õ%­µK$cÿŒæ^55`wzý´æ]ŠÛê{ÌFx9].òn1[Em™QBÏ•[ï¹öضé3MºÔí¡v»ùV¹\¢ ³*2mjVöˆ¨pz/’]6r
w™ÇR‚I%Poýpc75ÈÔ'¶ÈhÀƒW7JUϳ`K¡$¥ÀsÎ<Ä7:^ƒÉXÖë}†¿?Gæ;¦D»Ëc|y´—GðCK”Ï?eñ!AÊ¥c£VÖnPW±6HãÊQ9+–hh8©SfŠŸ0gÒËÑÍÁýh7F(Í¡7öؽŽa¸Z®/„y®I­1‚ÐÖÊ®kZºíRø»ÓÐð±‰ÌN²NNÆnôâT7%ÿÑ'ϳ7i"Å
 HkÑò¶ xÀΙsTºÜºíF¥$_2à¤ÝéØæú¢úÆÒ†êéÓ÷j%ôÜvk†Êœæ%¢d` ;ÝSêdù/áÉ]‘¶S¡¼ÀËÒKa÷Ï
ëö³‘#&[K^˜µ+»UTƒdak¦“Ÿ–fUX©u¢¸5ÐJçCL8KÔR®<‚öwm.¦LË‚&ØwLCœ¾a!~6]íeîkZ77º?ž†,˜ˆÁóñ0a£%Æà
 
 \P3ÏØ©®â%ª«Q¶°sy1*õŸƒð3›Wž®õ;7 K³y²mÇZÉh\HÐçãîäÑ|Àÿ´_˜D®á!)?¬oöër$q0>°±ÏO„…£b{m㔿/£HŽç,Û»MEr2ï©Åèg(ãw„†Ó¤,DûJ.pW£?W؃ð›'HÂMcÕ‹~[5
j´iÝ "£õëÈbýN¿”òà–`˜ä§×ÛÉ™ÍeÒÔ“Ç먄lŸyú¿ýw¬ª±›ä»~¤J!“A=ÐÃé8êâ N1&ƒ¨8#vŠ:ÚQ™¡ù 0
RÛ¤T(þ×ût„Í$þbwF˜ß®
7)ÒZ¥ëî±´X¾;dãQ¡ÅC…sNÏÚ‘!jCù‚#XÎäüÃ_Ä÷
 €mK1”£»ãß:¹Õ˜z_#å*’Ðs,b½“o&‰ð]ÎÎì†Ò¬¦{˜±ãxÂZ©–\å.ÉÉq™5í—]Í_ãÓ~wX~˜½UÖ"bg¬%Ì—ÊÉbÙ¶Õ¾VÂ3a¾$þ—ì!íL;ENLãÖ[µô(ÁzŠþÐÞÂ
:\¦oŽìÿÞÉðdþÌn¤j’Pïn‰“Ì{:}*PDvŸw*[ð@9‚»pR¸ÿÍ‹°E²(oh~÷ƒ¸hkå……DÛ–‡[ÒÆ¥oÖ™ziUèɉ±-Ïòk^Mï•ôÌ,öêf¬”ñx”ŸGS6»æÐ>²+5XÛ•½åfìÔm·ë×®þv*¦Øp	ëÔ,ÆêWàÅ{+"‹ÜV¦Å—iÂÿÆ6ë,Y¶ÍSßl£ÐãìÖH”þœÙ¶‚;»£:Jb†öÿcÂ2üâ'
í½dn”»†õ¥ÂJz]è°^kSâ…v‡Æ¤>fÊýQÌ’Ñ飺˜N•½º%ÞAäÙiÁO…Ûoñ­¢/ÝvÙŸHMpÿdÓ.š8yиæâ<·ûÌTêüÈÏöé]øÝYØzÔ0óYJöÊVêôøÿ¦/=¢W"ýÓ:Cè¡Êà^+ósZ…íôqÜvOø$ÕiÚøVýq${zìxŽÊ«Q‘c²ârÞQ¨Uz™F`Ô4ùjþ1gæ\xEŠ	„ûɘÄEÕ¬«‰~*U;³Ù ¿É›
 Ô0a¸­¦û[ßÅräÛ%Ó\qŸž]£÷Àëð|O-FêkÞ‹³€'‰Qö.ÊÂTqëÚĵ¦Îš)RžcÀ¾ôßØDã“V¶¢Ååž5yÔLùR„wOƒùͳ¬¯ãƲ¹ûx¥óuj2a™	dêMèaÁxö³]&e9õ};ªÄqÜm–íʳì $j´’V¢_yŸ¹6€W3‚èíRõѹc§EsšN1}œÇ‹”Çžácž!\°­1£,,ᄬ¨\XMÔ›ÖÁ€DÊŸ&ë«~9F=Þ'KJk®©YGŽ¿¸éís¬zÖÃÔcü„Xnú°à¬KNT‡E}Í®¶ˆjYMr5†Ò™NgeƒËÝ
˪òÒ •õ¼š3÷1¨vypæËj6µ}åI_ói­EÅÎq¸'½ šþñ+„žb2ä÷R…‚¶~UÞci„eù‹Pz©k!ïÊ×2oˆáûv)³!>­ZJ®‰ÙGj]ÙîWðH:‘”·Y«äMŽ˜‚Ïéì©qîmuëO#/3K®ÈíöiEpë×3ä‡ÔO@â0¡á‹5!³ÑŒ¯
Ü8ßï;*UbÊS”ßÖq—2,Â#h=ÕMx'üÁROª…ÙB!É<Áq	ݘ87¥3üB$ò:ÿÕzÆOE:óP¶%õŠkÄ´{@æÿíÿ€ÿ
-ÀÝÏói<ÐÿiŒö?o¤ª¥endstream
+ÀÝÏói<ÐÿiŒö?ѪÒendstream
 endobj
 622 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 2
 /LastChar 151
-/Widths 1358 0 R
-/BaseFont /ZCVAEP+URWPalladioL-Ital
+/Widths 1359 0 R
+/BaseFont /YVWKXM+URWPalladioL-Ital
 /FontDescriptor 620 0 R
 >> endobj
 620 0 obj <<
 /Ascent 722
 /CapHeight 693
 /Descent -261
-/FontName /ZCVAEP+URWPalladioL-Ital
+/FontName /YVWKXM+URWPalladioL-Ital
 /ItalicAngle -9.5
 /StemV 78
 /XHeight 482
@@ -6093,41 +6110,42 @@ endobj
 /CharSet (/fi/parenleft/parenright/comma/hyphen/period/one/two/three/four/five/six/seven/eight/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/W/X/Z/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash)
 /FontFile 621 0 R
 >> endobj
-1358 0 obj
+1359 0 obj
 [528 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 333 0 0 250 333 250 0 0 500 500 500 500 500 500 500 500 0 250 0 0 0 0 0 0 722 611 667 778 611 556 722 778 333 0 667 556 944 778 778 611 778 667 556 611 778 0 944 722 0 667 0 0 0 0 0 0 444 463 407 500 389 278 500 500 278 0 444 278 778 556 444 500 463 389 389 333 556 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ]
 endobj
 611 0 obj <<
 /Length1 862
 /Length2 1251
 /Length3 532
-/Length 1860      
+/Length 1862      
 /Filter /FlateDecode
 >>
 stream
-xÚíUkTgnõJÀ+Å€€¸
-æ2@	Š&X4•;*(R’É’LP
-A@0¨P¹TZ)­`åb°¢àY#BAn¬\uÝôØ¥?wíÙ™?ó>Ïó½ß3ÏûóY˜yùèl$vEDHi€‹»ïA€D2ÎÂÂ…!	í‚$0
A€.å  ;Ð(dÕg¸ a‘(ŸË“V.Ÿ-ˆºFù,H¸C,Äz° à‹°ø°$’ÐÀga…ðÅ0³‰8Ø|–†¹|Ž´àˆ)â €ÃÌ–†½£"`TŒ™¬0“Ÿ˜E6"Dl˜ƒ#y Ø^0æä¿ajysW©@à	Ú/¦ô'ò‘oˆ0L*QÀaèh¹Ô^2ç³ùRár–)|]ÄÀ´#’m©K_ìÊ—Ál/¾„Å8@/â°ˆ½Ü
-ߢ}ï>÷ƒn6oçºHzA|‘d_dß«kð}¥„òe@™H&ƒ˜{ß}.ÛìaóE\€Bµ …"qØ	Â**
|–°sL"Š	¶À¢9p·0VÐ ±ø(K³¦&Y`—*@
-Æ2‡ÿ‘)†B,XsþÛ¾…—†þ·Çp}``+T,€Ä¼EøÏÁ1ˆ,š@qŽöØ€ =àà@=öoB–Ea‘dñlbñ¿«9|ld0,ƒY¸ž.„å”’[•TóÅù;?|DÒyÙZ¡éÑnò¯‰Éã³ùRÏy›q%%#Eª«'øP¥á—,§Súè£t´¯¦Šõ/^M-,óÏŒ£6»}ñ‘	©òU¯m,G˜Šð§ó¿QÓÑGg¿Ý²µgjKl«Þ9¶šqè|Ãì@—îzkŸ“Öæz.h÷¸Ùÿ¤cóDMlîí¬ñÛ÷ݘ^x±kª¥’ã¬<Í<Ær"”Jïazó=µê¨!{n­gZc€ì©iŠy²Åóß2ÙtjŒqôo·Â´ñwSFÓ‹¦¿öÔÁ5š2®÷ßQ$ÞP‘2âv7˜º™´>²å½ÚØjã!ÿ„K°]qi¸Æ¨-äñþ_*Áä7jí¥1/Ê ÐüêÓ]O£Â¿¯Û>»Ÿ~Œ¸·êôÁg%u
-Ý®:Pǽ—Œ—:íZ©wéÕy
ïÄ(	?4f×ÞugwÉ£8ázFß}íXK÷„\_k¥7
¿FÑ1—w:˜X~uàseÙjq±Õqñ¥¸ÑZßQ°òfG'ø@=–~8;†9ÁL5Èá^‹‡qä8ÇJë¦õòZƒîê³rE¯ž©vŸ*3Ê@i&¯ñ9gtg2ÒÒ½=¼ý÷jÅnÊMô|®Ñô¾(VŠœÝ6º)~ÔO“Ä<Ñòr`ÜfR<æ«K»ÔYâŸll	_ªw¶›Îצ—]«f*‘춛ÿ‹û:yIY¼¨É”sÿ0;ðûÄ÷ëC?E[Žk!·ödMÇ»,å=WyÖ:U•šš{Ç»C"pΨ<±Mµê)þ¦mPÇ¡=(¦á±™GÂGͼ´ô=ËäWœtãã…žÛ&Ê|FWèxhö?+”S¢ê§^éઞÍÛvM|¬{9ßgøÔ¶Ÿ4kiËwÕûØA¦ªöox“qày;Ã0ç“пéÏøk^…çÎÒW{Ê{—qæ5È~þþ—Á’‰ðµy×n)®)ˆ®„–ñ–¾[…öTåчªë7F¥õ7,å$ÕmÊþø3™ì€’\¿‹?j<#YWÔV+ºkç’ƒÄóaÐ=e姴9”óÌu¬Üi¢¢$€ö¹ïž_c©ÎIú‹¿Ÿ"½Ièz¡UÛ"3)õcT&ONë´¼Ùì•Ù6è9` Ÿµ±fPªVI÷4€TÇ}ÆÛvqf/ü&sl^3æ§LˆvÔóá6¸à¬?Ö{úóݦ¯yyÏŽkE'+†
-ø„5÷Õ+ÔšÓ&a´ûŠÀòQbmAê…_=v¨’“æ"6å
^o(ßq —ÙäÛüÐáøº™ÆW	Vêo3*½ÌWšõÎWŒ-CEšüþH’­¥ýîᆄküóÂøúöp¯þÙNiv}N|¶‡âJ9ãI	Räßb§W†/ꎾ,îZG™´V×ÞùkŠóÑÎ5ÓwïÁ)uòQ7õŠhí^#ý»®¥#ú-ó5ìÍ·GœCé×t¤Á‚VíŸçå‡AÂ!¿Ü4íi»u	ˆYvZàXWþVCã5Y&»IA>¬qÿ„úpf³÷€ýØdž×x˜)T>áFŸ7ûñ›¨#êá€Õá#¿ô6ªkkœîèLò‹q3Ÿm“%ŸQM®ßÞÖE8±#Ëó1ódï—·3Z}³
-•‰e1ìö:;4ö ´ûX–Vœ—¿:¨'§œóù?|pÿoð?Ñ»º!T‚!4÷/Œþgendstream
+xÚíUkTgnõJÀ+Õ€€¸æ2M°h*—*¦2$“d ÉÀ$Á*¸@…¢ˆ*J+¥õ‚.¸\V¨LAÉ ðöÚRL%8:zc0¤@PÙH3ÐÃXJÒ*ƒI£2é‚#àF«1D$V«¼?›1–Æ>$ü …–â=øBù¬P“–DN¯°Æba™‚€á+€X„È”iG™o`2úcrÜ°
+7ù€[ 2‰ÀBÅÅ÷‚q'ÿ
S³›û(%H:Ý~&¥?ñ‘¨ß*Pi´Rc€*€1Ùli0üÆœ,@”ÒÙ,GI>K&’À	t#S]éoD`QðÅ€’Èá–	f[Áã›1B	å†ngmvy;×’!2ÅVu4Pß«gjð}§„!* ŒJ¦RA\ˆ¿ï¾x³6ûBÆGˆLÐèî„aš€Ÿ ¼¢ñ €È°
+€U¸c
+Y†*ð%Í@ˆb„鱂®…`|	ÌŸžšbš}CÐJž9üˆJÃ1âÃXøGØõ-üfèïqw‡°÷žð£äH.žÿ›ªâI4€äáŽÿº}Ï¿	ùJƒeŠ™³‰Çÿ®"øÈ`Xó	m(ß3%2·j_yÂ'oþðÅìES…±Ã´>äbB"ØD?±Å^¤(é/ÒŸ?¨%F鬾ä{±ÄÎYgøøj´Øòôùô²C{éuäö ¢:9]3ï•‹S?G³ýhþ7zföðø·+WwŒ®Ll²8!0°COÖNt·™/v<ìì°ŒÑqÊ´ëÃ¥Du×ãÛ+†/&æ^]˺q×—Ã%Ê}ÒtB/óˆQhü'ŒÕé\¶ô±îô»­“Ô…©žØ¥9¤:>k*S¥'ØÄÿv=Ú”x+m £hìë3BûJ×MmÊU=%sïÆZ;_Û¦‡®â—Ëš\ü5Ÿˆ¨Ý®sÎô]´nŽ|´í—J0õµÁtYiÂó2(*ÿBŽÝ†'q1ß׬ØFÌØCÞ\utÇÓ’­y[ÍÐrÝïÌfþ-&é4?åùqÍEñÁ
+±wЭ¥íæÆ’‡{¥XX÷õÞBFäóÊ$£¡·{ÿ•hš™ƒ¦•aëôÕö—œ¹eóåÅ«–Ê‹ÏìHfÞÛ
V^»Ý
+Þ7fìÌNàsÒ—äˆ.'Áê^JçúÅšê%íŽk´v¦÷ô‡â–èì5ŠpDxÌ|<ó@—ç¿%d³IâÎúÜ^ï™ÑØù¼üi)z|ÍÀò¤`ã>ÎÁÆÝC.#òÁ sæ™Ö’T'5|æ’—ÛX¾)«ìøBG‡f7_c‡œÞÚ*.Ø—%ŽI;ñ‡‰Ý¿¿¸0’ôS¼sÏ	z}SÖXbŸŸõáRñ3}@µgU©=¹Ãc‘ÒKðÂ4)ÍúyOˆ×\Ão‡nºO³‹I<´+fÀžkbP¦9çiž”$5Š}—Ó¦2Û¢†¢²ÿY¡•5ÚÒ?åf€ó:V¬Ù0ü±ùÙüÀ¾#k~2Òœ•ß]Ø*¿?ZµméëÌíÏZØV9ŸDýÍr<Äø2&wrW¯q¿!@Ó©=Kø0¯Võƒô÷¿ô”Ç,Ì»|]{YKö!55Þ»^èN×í~0¬¿Rqu@y隧“†¢¿AÛ–tì ¬$7øôÆ5ÿœaգʺÚöêÉÔðnùT4tGWù)s>õ,÷®(	c~´é×DºBx˜õüïG(¯“Ûž›T7ªlKƒÙ•©#£Åf¯Wp5÷t/ÑL¸8³iUó”›êI@ºÇú{6k6'Ný¦òhX0¬KŽ÷°Õzœ?¶xòó­úõ¯ÄyO÷›Ä§j{ÙÄäaw
sÆ£¶ÑÌ»Z^ù¹º ýÔ¯þë
+ô©û&c—çõ\©-_·=—SÔð€±ÑxÝËäU†o3+¹síŠ:§Š+öÊÞ"c~×GÅêÒ.¿+R?“?ôyaÒ¥–n×D«2ûRNR¶¿ö\5óq	ZÒèfQF,j?+o[ÇÙ6]¸Ä»ù×4¯Ý­ÆnÝÓj
+4¾†9ñ¦Ö–·nû”ö[6N]¬o¸ÑïÙúl¦Œ4™þ<¥	­ã¤Ðàܦcn‹’Qûì¼Á¶üÕV6²l7R„’0btÝ$ñ1ýÁøŠ-Ýîƒ#YLV^ÝNŽT÷XÒþÇoâvúÂæÇôÿÒÙ`e¨®Þuôvë¾à_‡‰fUê1ýÈâµÍm¤ƒë²qw~Éö=froBk67¥,AÐYã†%îP¶ïÉ
+4éЈóç‡wä”?° þ‡áÿ
þ'àW7„)P)„Eþ5&þ{endstream
 endobj
 612 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1359 0 R
+/Encoding 1360 0 R
 /FirstChar 13
 /LastChar 110
-/Widths 1360 0 R
-/BaseFont /AKTMYL+CMSY10
+/Widths 1361 0 R
+/BaseFont /ZPZVAK+CMSY10
 /FontDescriptor 610 0 R
 >> endobj
 610 0 obj <<
 /Ascent 750
 /CapHeight 683
 /Descent -194
-/FontName /AKTMYL+CMSY10
+/FontName /ZPZVAK+CMSY10
 /ItalicAngle -14.035
 /StemV 85
 /XHeight 431
@@ -6136,10 +6154,10 @@ endobj
 /CharSet (/circlecopyrt/bullet/braceleft/braceright/bar/backslash)
 /FontFile 611 0 R
 >> endobj
-1360 0 obj
+1361 0 obj
 [1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ]
 endobj
-1359 0 obj <<
+1360 0 obj <<
 /Type /Encoding
 /Differences [ 0 /.notdef 13/circlecopyrt 14/.notdef 15/bullet 16/.notdef 102/braceleft/braceright 104/.notdef 106/bar 107/.notdef 110/backslash 111/.notdef]
 >> endobj
@@ -6151,7 +6169,7 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚ¬ºc”¤]°%\]ª.Û¶mÛ¶mÛ¶m»Ëv—mÛúú}ïܹ³î̯ùæG®õœˆ8;vÄ>'Öz2“˜@N‘šßÈÖÀXÄÖƉšž†Ž ¬ *§oe¥odn+E­`k­økf†"&t0Öw2·µÒw2樄Œ
zvvv(b€ ­»ƒ¹©™€ì/9%%ÕYþ	¸ÿ§çïNGsSÉßc+[;kc§¿ÿ×NfÆs+c€ ¬œº¸Œ(€LTF jlcì os6°27H™Û8“LlVÿ±ÚÚ™ÿSš#Í_,~G€>ÀÑÎØÐüï6c7Cc»\T;cksGÇ¿ÏsG€©ƒ¾Óß8ÙÌm­œþ!ð×nbû/!;Û¿Ö}Áäl
Ì휳Ê	‰üO'3}§r;šÿulMþFÙ:ÿSÒ¿¾¿0½Núæ6Ž'c7§rŒÌí¬ôÝÿæþfç`þ/
gGsÓÿb@p06Õw0²2vtüóûŸîüW€ÿ¥z};;+÷wÛþõ?9˜;9[™Ð@Ñ3üÍièô7·©¹
í?GEÜÆÄ@O÷v#g»ÿô¹;üÛ ²Îù_úF¶6Vî#c(Z[§¿)dÿw*Óü¿ùÿÄÿOþ"ïÿ?qÿ»FÿË%þÿ{Ÿÿ;´ˆ³••Œ¾µñ¿›ÿ9cR€†ŒÍÿ­omnåþŠÿÆÿAòÿ#î¤ÿ·ü6¦å £¡û£¹£ˆ¹›±‘œ¹“¡ÀDßêoŸþµ+Û;X™ÛÿÕóßV¨ééèþ›OÉÌÜÐÒæŸÆ3ÿ‡ËØÆè¿sÿ+Ñ¿ÌiåD¤$de)ÿ÷™úoœÜ_í”ÜíþRû¥HÛýÏÅ?(¶nOjz5ãß+Ç@`gbôþ?düˆþ¿ÖÒúNænÍ¿eÓÑÿ[üÿøü×Jû¿ÁÛÚýsZômŒþ°ÿiøÇmèìàðW×ïüߢÿsýïQ76v36„ZýckÈd‘–™îT‡ž;<)¤ù»d8Ø®´Q©¨À¯Æ¶×7-l‡½Rï£6˜¦išã«Ý}éÌîó@‚âp´ÍŠ´7Åø*Ç›ˆ¼¿q“¤“•ò0€V§6ý\5ÊózQjTƒ…NåpwR^A§äwº“Ñòú™ÜÈ¥ÀåדœajC,jBR]áÙ9IâÉóéàØÈðPï-Xÿ6eNìObNPX’H?ûl^
å
+xÚ¬ºc”¤]°%\]ª.Û¶mÛ¶mÛ¶m»Ëv—mÛúú}ïܹ³î̯ùæG®õœˆ8;vÄ>'Öz2“˜@N‘šßÈÖÀXÄÖƉšž†Ž ¬ *§oe¥odn+E­`k­økf†"&t0Öw2·µÒw2樄Œ
zvvv(b€ ­»ƒ¹©™€ì/9%%ÕYþ	¸ÿ§çïNGsSÉßc+[;kc§¿ÿ×NfÆs+c€ ¬œº¸Œ(€LTF jlcì os6°27H™Û8“LlVÿ±ÚÚ™ÿSš#Í_,~G€>ÀÑÎØÐüï6c7Cc»\T;cksGÇ¿ÏsG€©ƒ¾Óß8ÙÌm­œþ!ð×nbû/!;Û¿Ö}Áäl
Ì휳Ê	‰üO'3}§r;šÿulMþFÙ:ÿSÒ¿¾¿0½Núæ6Ž'c7§rŒÌí¬ôÝÿæþfç`þ/
gGsÓÿb@p06Õw0²2vtüóûŸîüW€ÿ¥z};;+÷wÛþõ?9˜;9[™Ð@Ñ3üÍièô7·©¹
í?GEÜÆÄ@O÷v#g»ÿô¹;üÛ ²Îù_úF¶6Vî#c(Z[§¿)dÿw*Óü¿ùÿÄÿOþ"ïÿ?qÿ»FÿË%þÿ{Ÿÿ;´ˆ³••Œ¾µñ¿›ÿ9cR€†ŒÍÿ­omnåþŠÿÆÿAòÿ#î¤ÿ·ü6¦å £¡û£¹£ˆ¹›±‘œ¹“¡ÀDßêoŸþµ+Û;X™ÛÿÕóßV¨ééèþ›OÉÌÜÐÒæŸÆ3ÿ‡ËØÆè¿sÿ+Ñ¿ÌiÕTT”äd(ÿ÷™úoœÜ_í”ÜíþRû¥HÛýÏÅ?(¶nOjz5ãß+Ç@`gbôþ?düˆþ¿ÖÒúNænÍ¿eÓÑÿ[üÿøü×Jû¿ÁÛÚýsZômŒþ°ÿiøÇmèìàðW×ïüߢÿsýïQ76v36„ZýckÈd‘–™îT‡ž;<)¤ù»d8Ø®´Q©¨À¯Æ¶×7-l‡½Rï£6˜¦išã«Ý}éÌîó@‚âp´ÍŠ´7Åø*Ç›ˆ¼¿q“¤“•ò0€V§6ý\5ÊózQjTƒ…NåpwR^A§äwº“Ñòú™ÜÈ¥ÀåדœajC,jBR]áÙ9IâÉóéàØÈðPï-Xÿ6eNìObNPX’H?ûl^
å
 áªV•¶½^MV‘µO	Y'¬àÌæçåß‘Š”+‹1.ðñ€Lÿ/ú}jõá­ú^N«I-®„”Y”Лˆ³'•©•˜6´šM¼7Ñ”oõ·1·mŒ—'=Ufì1K±w;9<ô~Š§
 §Õ|¬½#W¯Ÿžª"*š>ïwü†©‰5Ì€ zÑ·õ„Üî_?F#ØhzÝ•¥‘´”˜”€ë¾¬	ÓèDaÜ”ðÜÖ–x¼°ô3ã	4vˆ_Põ…°?2Ö„ô˜Ûγ¸Í;œ,f'+@³ñVÁ¶yÅæÉv(ˆÞ‰žší7Gfì qðª}-W)¨Æ/“^íe…ö§éßk‰òŒ*(|‘ÿ²Æ)æýdà€P>Œ,U‘à‹D¡"w("Z³°QºD£xyÛ.Õ„þ0ŠÖ.¹ 'Æ6h¬NÒµ¹žˆÍ&2§SWäåÂ]*¸NÕÏý=â×µª!Æ’ûY™­ N‹50º3êèºfEp»%…Z‘˜æj¤§kÜ\}–Ê€}—}Í’P«¨s}ò#U7ÉHÁ…€¬ðk´¾ëÜFµÐ<¸iβµõt.4N?”7Å{©v‹A1¼Ñ°¬)æßD7ìÝjÞä¤S,À8õ©ÔI‘Èüíç–(ª!ÝZõ&N|ú,~E¼ð K¯JëŽs/)#QcH—â¬öÛ#ŒŸKnõâpÉËÁ!=ÙØXñýâÜõÞÀuä¢\&Ê
 5@Uc„7VC¨ªNxÉßaëŽÃÈÝ»T¼E	uFB¾j5̘ò»–…P¢ììËM{ÁoÇÂ	Žïe›`¯ÇÁÍ°UÜíëšøɃœ›­ú´
Le€rØ»·#ú©ÞJúì—ÓU>ƒñË!+ìxàpÚ|mŽ¨-ZÆ
@@ -6262,23 +6280,23 @@ D
 »³eI?´1k½š¹†N´ÑúU~^òù–sæòñÒ¤¾O—ô2N®#,ëÞ>¥¯»úþ‡UÅQÅ?c"xè	ÓKm¨òôÉÁ˜AÍç|ú¨ÜX±ýé°­Ž˜åDSZM©*,üèô^X䢨èxp{MäÜŽ	]æ2bþh7îä§ðkü<ºö.£`ùLˆ¸¡lv ¿w§óß;±w˜xS(¯†N¦51àô›¼KÃ|…RJæÙÊ7ÎðÔÔÊä †öç!êß+ïùßæÃ[Åu;r+ØåKœê0«Ú&-‰_ëRKØì¹ß¸Øë^”&6b]Aœdî2Æö4»»§ß:Ó¿}ÅÞbRžß©;aìÿ^ñ}³´àýk»DÐ"<‘í}†]H¡¥¥04(8¤\Ê/‰´ÝKãñ°cÛÁ¼ ®åÿŸ\S»‹Y]ß/Õá‚vµö 9x‰D>bÁ^Veüåà“é;YèQôÿo£×éÐ[w˜ž5ä]vŒ:YÃVðÏàš3kãÒ˜’¯ÄqY6®¡D=ןvÒØåiª_Xß&åw¯ýÐx•ªk?õå’jªcª@ÀÇ:Ø»–%¢îåq¶˜¢5%­)ÙüMí7Åî‚e¿°0˜Ì!0õÎrWØb®oƒ …)mJ§HyŽI*§räƒ" £
$X÷”P[‰@î„ë(”º<ª”sx`!­"Läã4Âf¡LƒÞ}j!%«›Þ¿}¿òs(3Ç©¶m€úéЃ„³ØÐè" kµªô	ùñ ß#›Ú¡ð…
îÉ‘òkge8„ÛŽGNþÌ €_ÑA„Ì]ø+£Vú4}§×:‡Î5ûìƒd?¤£³¢xÃ,£qš+žÐúûªûQªº½‡¡lQ?:òOæpiƒ%v€E`£¹·aBÈ
 i­³^jm˜3²÷¾ÏO3Ò¤÷/v¨+¿©¨ÇE÷ÕÖõCD¶Ù+Å2áÃ3ÊWœ-CÃR*ݤ¸é9¼d<‘[ºþþ¢9Žxu¨öúi$•EáyZ¼
 –t0¼=Æ&A™_Ü39õM䮩Ôø¨ˆõgF‘¶@1Bz*¢·ù.
-4:o€Íg¿€t2+,dÇ@w¾/-¡ ækÎû’lä*Øè!ª|¥3‘µ¤ü…ÖãÔcÀ¿7ûlSî°ü/ûÁÿ	©¹±³«ƒ½±³-Üÿ'š¼endstream
+4:o€Íg¿€t2+,dÇ@w¾/-¡ ækÎû’lä*Øè!ª|¥3‘µ¤ü…ÖãÔcÀ¿7ûlSî°ü/ûÁÿ	©¹±³«ƒ½±³-Üÿqœèendstream
 endobj
 604 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 2
 /LastChar 216
-/Widths 1361 0 R
-/BaseFont /PFLJOO+URWPalladioL-Roma
+/Widths 1362 0 R
+/BaseFont /XVVTPN+URWPalladioL-Roma
 /FontDescriptor 602 0 R
 >> endobj
 602 0 obj <<
 /Ascent 715
 /CapHeight 680
 /Descent -282
-/FontName /PFLJOO+URWPalladioL-Roma
+/FontName /XVVTPN+URWPalladioL-Roma
 /ItalicAngle 0
 /StemV 84
 /XHeight 469
@@ -6287,7 +6305,7 @@ endobj
 /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash/Oslash)
 /FontFile 603 0 R
 >> endobj
-1361 0 obj
+1362 0 obj
 [605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 0 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 ]
 endobj
 600 0 obj <<
@@ -6299,7 +6317,7 @@ endobj
 >>
 stream
 xÚ¬zceß³eÙ¶ë–m£Ë¶mÛ¶mWuÙ¶mÛ6»Œ®.×ôïÿ4ñf>ͼ'âìÌÜ+WæʽãÞˆCF¤ L'hbod*foçBÇDÏÈ
PURW0´±14±´—¡²·1ü5³Á‘	;™ºXÚÛ‰º˜rÔMM"¦Æff@ØÞÁÓÉÒÜÂ@ùƒŠ††ö¿,ÿ„Œ<ÿÃów§³¥¹€üï‹›©½ƒ­©Ë_ˆÿçʦ¦S€™¥)@X^ASRN@).§
-7µ3u2´(¸ÙXd,MíœM©föN›[ŒííL,ÿ)Í™þ/– 3Ààì`jlùw›©‡±©Ã?.Z€ƒ©“­¥³óßw€¥3ÀÜÉÐÎåo\ì–vÆ6®&ÿøk7³ÿ!'û¿¶}Áì]œ,\³*ˆˆýOC—r;[þuìÍþFšØ»þSÒ¿|aþz]-íœ.¦.ÿä22˜X:;ØzþÍýÌÁÉò_4\-íÌÿ‹-ÀÉÔÜÐÉÄÆÔÙù/Ì_ìºó_uþ·ê
l<ÿµÛþ_QÿÉÁÒÅÙÔÆŒ†‰ùoNc—¿¹Í-í`þI;3{ã¿ÙM\þÃçfêô¯Qþ33TIšØÛÙxLLÍ`äì]þ¦Pþ¿©Lÿ?'òÿ€Äÿ#ÿÈûÿ'î×è;Äÿ¿çù¿C‹¹ÚØÈÚšþkà?î€àŸKæÿ6´µ´ñü¿…ÿ÷HuÓãøC‘t1üÛA;ó¿b0Ò3þ›ÑÒYÌÒÃÔDÁÒÅØ`fhó·Kÿ²«Ú™˜:ÙXÚ™þUó_Ð112þ7ŸŠ…¥±µÝ?mgû7—©É§þW gPWT“£ù?oÔÅ)üUÞEÅÓá/µ¯DÖÞä?ÿ 	Ù{¼é˜Ø˜t,ŒLÜ_>\,l¾ÿ—Œÿbú¯µ¬¡‹“¥@ûoÙwþSü¿?ÿµÒýo0¢vÆö&ÿÌŠ²‹¡ÉßñúOÃ?ncW'§¿ªþëÄÿ-ú?ÖÿtSSSc˜U{cž«ŒŸ™.õ˜y£Ó"ÚƒýL £¡eM*Å…µö}þû\Uu¡ôͳÜ_ž+¿>¥¨OÆû1l(úÒLo
+7µ3u2´(¸ÙXd,MíœM©föN›[ŒííL,ÿ)Í™þ/– 3Ààì`jlùw›©‡±©Ã?.Z€ƒ©“­¥³óßw€¥3ÀÜÉÐÎåo\ì–vÆ6®&ÿøk7³ÿ!'û¿¶}Áì]œ,\³*ˆˆýOC—r;[þuìÍþFšØ»þSÒ¿|aþz]-íœ.¦.ÿä22˜X:;ØzþÍýÌÁÉò_4\-íÌÿ‹-ÀÉÔÜÐÉÄÆÔÙù/Ì_ìºó_uþ·ê
l<ÿµÛþ_QÿÉÁÒÅÙÔÆŒ†‰ùoNc—¿¹Í-í`þI;3{ã¿ÙM\þÃçfêô¯Qþ33TIšØÛÙxLLÍ`äì]þ¦Pþ¿©Lÿ?'òÿ€Äÿ#ÿÈûÿ'î×è;Äÿ¿çù¿C‹¹ÚØÈÚšþkà?î€àŸKæÿ6´µ´ñü¿…ÿ÷HuÓãøC‘t1üÛA;ó¿b0Ò3þ›ÑÒYÌÒÃÔDÁÒÅØ`fhó·Kÿ²«Ú™˜:ÙXÚ™þUó_Ð112þ7ŸŠ…¥±µÝ?mgû7—©É§þW g”W‘U¦ù?oÔÅ)üUÞEÅÓá/µ¯DÖÞä?ÿ 	Ù{¼é˜Ø˜t,ŒLÜ_>\,l¾ÿ—Œÿbú¯µ¬¡‹“¥@ûoÙwþSü¿?ÿµÒýo0¢vÆö&ÿÌŠ²‹¡ÉßñúOÃ?ncW'§¿ªþëÄÿ-ú?ÖÿtSSSc˜U{cž«ŒŸ™.õ˜y£Ó"ÚƒýL £¡eM*Å…µö}þû\Uu¡ôͳÜ_ž+¿>¥¨OÆû1l(úÒLo
 ð|I¨
 ‘wÈ»8hN‚ôÊà3/Õc¼o—eöÀ´ØÕN¦•ôJ? ðg»Xœ nÿP¸ ‘>; ø§7Æ£w#5¡Ôýº$O>ÿóL1<16:Òw>pŒK“MÆãOà˜‹Ë¯¥Z)ZÝL~Ó‘mÂ{ôÔ*’»RÆ¢)ï0=ã½Ég—\"nsYâ‚{s’?ËçžiE«vY«Ôè€9¡ÇΗ©5{ý‰÷r=Fa‘ŠÚòBLÖÔ—J|‚íuÿáq™ßx&™å2‹r&G-H.‹Û"]pYÝÝÝÜÝé&èJtfRÅÝEÇN¦÷å»Íà¨	x'YÓŸ6töà‡­ã•c7éË#ÖñJÝ5ÛÁ+cÃú:v{y)ŽË4øö¢·—ÇØé½V,ã³Î3ê
 "+0TjêkÉ™”“Œ†yF¶6mœæ
¹{¯ òÙ¼¾žÐbâB¥}ÁŒn’Eötµ•tqx‰xͤ¡"„³úï¯È÷ñ#£Àó©hÆ<‚Ê&1¥útö¦I0ÕˆT¦YR0ÐC²åôÉz‘g‘Ú¢ö!¯9dÌnžîƒƒ³úëg0.›™c˜	Šöh‘ïZd¡{yz©J‰™™I‡\®\ñù¿¹
@@ -6406,23 +6424,23 @@ L
 6_mŠq'2~‹Ò=aFŠ†þÐœ²?Ç	¯Z¡._|;l[×OX˜àJÁ+QGýiÜZÉP&Yyf2—<²è•rŒGÜ75·ïá3òŽÃ#z‡FF⨾ãúF4þN¸ü5àcíÚ6P·¡“eä	è‡Ék¢œu_KŸ¥°L‹*·éñ0MH¼CrœT>Ü㇟x FÿàRÂB_!äµi¨NÙ%$hâ]tÞ‰¢èÛîûs¶¼ª=nù<ü¨òÁËY©ÞØîƒQKñ™ÆýgF==ˆ3šöùsCì¶G’Ð!YŠ
WaðŠ	+·Yà¾]ˆh‘!{â#iŽ»¤"”¯ùù4bwËZ¨Xà2&£‘.¿l=b,	¢,ÙlÔúAœ¦Gôì©5W0!ÒãBîV\Êå6ÔÔëߥåíýŽá;RЭ$øžv(Ó@ÃICM«Çv¹Ì_§/#	È
 ÙÌÑ‚§õ±Á¿2å6ôw’ä{0ëó¬+/6A3C¿X	¬Ÿ?ö¹¤Ñ<ÛˆUëœ"¸¢R2ìú6ÉOôi¦Æ·:+tÝ•;¯–fnÎÇ
-¥0©jT™¶„qÚ]¡ÁÂ'DY¸
ö.g¬Âñ¨û;AJÒ´á¿ÔÍ­[ßÇHûaA@Ôñ ?ÍJµAì»tI•%[Ø­$Òð³"ɾs™ÿ?÷€ÿS;sc7G{c[¸ÿ
­“endstream
+¥0©jT™¶„qÚ]¡ÁÂ'DY¸
ö.g¬Âñ¨û;AJÒ´á¿ÔÍ­[ßÇHûaA@Ôñ ?ÍJµAì»tI•%[Ø­$Òð³"ɾs™ÿ?÷€ÿS;sc7G{c[¸ÿ OŽendstream
 endobj
 601 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1347 0 R
+/Encoding 1348 0 R
 /FirstChar 2
 /LastChar 151
-/Widths 1362 0 R
-/BaseFont /WEGQVN+URWPalladioL-Bold
+/Widths 1363 0 R
+/BaseFont /IOWDMS+URWPalladioL-Bold
 /FontDescriptor 599 0 R
 >> endobj
 599 0 obj <<
 /Ascent 708
 /CapHeight 672
 /Descent -266
-/FontName /WEGQVN+URWPalladioL-Bold
+/FontName /IOWDMS+URWPalladioL-Bold
 /ItalicAngle 0
 /StemV 123
 /XHeight 471
@@ -6431,117 +6449,117 @@ endobj
 /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash)
 /FontFile 600 0 R
 >> endobj
-1362 0 obj
+1363 0 obj
 [611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 0 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 0 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ]
 endobj
 605 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1363 0 R
+/Parent 1364 0 R
 /Kids [594 0 R 607 0 R 614 0 R 633 0 R 650 0 R 661 0 R]
 >> endobj
 676 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1363 0 R
+/Parent 1364 0 R
 /Kids [668 0 R 678 0 R 683 0 R 691 0 R 702 0 R 710 0 R]
 >> endobj
 721 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1363 0 R
+/Parent 1364 0 R
 /Kids [717 0 R 724 0 R 731 0 R 743 0 R 753 0 R 758 0 R]
 >> endobj
 769 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1363 0 R
+/Parent 1364 0 R
 /Kids [762 0 R 771 0 R 781 0 R 789 0 R 797 0 R 807 0 R]
 >> endobj
 822 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1363 0 R
+/Parent 1364 0 R
 /Kids [816 0 R 824 0 R 828 0 R 838 0 R 844 0 R 852 0 R]
 >> endobj
 867 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1363 0 R
-/Kids [859 0 R 869 0 R 883 0 R 890 0 R 894 0 R 900 0 R]
+/Parent 1364 0 R
+/Kids [859 0 R 869 0 R 882 0 R 889 0 R 894 0 R 900 0 R]
 >> endobj
 913 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1364 0 R
+/Parent 1365 0 R
 /Kids [906 0 R 915 0 R 922 0 R 926 0 R 931 0 R 937 0 R]
 >> endobj
-950 0 obj <<
+948 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1364 0 R
-/Kids [943 0 R 953 0 R 959 0 R 967 0 R 976 0 R 984 0 R]
+/Parent 1365 0 R
+/Kids [943 0 R 950 0 R 959 0 R 967 0 R 976 0 R 981 0 R]
 >> endobj
 991 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1364 0 R
-/Kids [988 0 R 993 0 R 1001 0 R 1007 0 R 1015 0 R 1022 0 R]
+/Parent 1365 0 R
+/Kids [988 0 R 993 0 R 999 0 R 1007 0 R 1012 0 R 1020 0 R]
 >> endobj
-1035 0 obj <<
+1032 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1364 0 R
-/Kids [1028 0 R 1038 0 R 1043 0 R 1052 0 R 1057 0 R 1061 0 R]
+/Parent 1365 0 R
+/Kids [1027 0 R 1034 0 R 1043 0 R 1048 0 R 1057 0 R 1062 0 R]
 >> endobj
-1072 0 obj <<
+1069 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1364 0 R
-/Kids [1065 0 R 1074 0 R 1086 0 R 1096 0 R 1112 0 R 1124 0 R]
+/Parent 1365 0 R
+/Kids [1066 0 R 1071 0 R 1079 0 R 1091 0 R 1101 0 R 1117 0 R]
 >> endobj
-1136 0 obj <<
+1134 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1364 0 R
-/Kids [1130 0 R 1138 0 R 1149 0 R 1161 0 R 1171 0 R 1177 0 R]
+/Parent 1365 0 R
+/Kids [1129 0 R 1136 0 R 1143 0 R 1154 0 R 1165 0 R 1176 0 R]
 >> endobj
-1188 0 obj <<
+1189 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1365 0 R
-/Kids [1181 0 R 1190 0 R 1200 0 R 1211 0 R 1215 0 R 1222 0 R]
+/Parent 1366 0 R
+/Kids [1182 0 R 1191 0 R 1201 0 R 1212 0 R 1216 0 R 1223 0 R]
 >> endobj
-1278 0 obj <<
+1279 0 obj <<
 /Type /Pages
 /Count 3
-/Parent 1365 0 R
-/Kids [1231 0 R 1280 0 R 1338 0 R]
+/Parent 1366 0 R
+/Kids [1232 0 R 1281 0 R 1339 0 R]
 >> endobj
-1363 0 obj <<
+1364 0 obj <<
 /Type /Pages
 /Count 36
-/Parent 1366 0 R
+/Parent 1367 0 R
 /Kids [605 0 R 676 0 R 721 0 R 769 0 R 822 0 R 867 0 R]
 >> endobj
-1364 0 obj <<
+1365 0 obj <<
 /Type /Pages
 /Count 36
-/Parent 1366 0 R
-/Kids [913 0 R 950 0 R 991 0 R 1035 0 R 1072 0 R 1136 0 R]
+/Parent 1367 0 R
+/Kids [913 0 R 948 0 R 991 0 R 1032 0 R 1069 0 R 1134 0 R]
 >> endobj
-1365 0 obj <<
+1366 0 obj <<
 /Type /Pages
 /Count 9
-/Parent 1366 0 R
-/Kids [1188 0 R 1278 0 R]
+/Parent 1367 0 R
+/Kids [1189 0 R 1279 0 R]
 >> endobj
-1366 0 obj <<
+1367 0 obj <<
 /Type /Pages
 /Count 81
-/Kids [1363 0 R 1364 0 R 1365 0 R]
+/Kids [1364 0 R 1365 0 R 1366 0 R]
 >> endobj
-1367 0 obj <<
+1368 0 obj <<
 /Type /Outlines
 /First 7 0 R
 /Last 559 0 R
@@ -6607,7 +6625,7 @@ endobj
 559 0 obj <<
 /Title 560 0 R
 /A 557 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 539 0 R
 /First 563 0 R
 /Last 579 0 R
@@ -6643,7 +6661,7 @@ endobj
 539 0 obj <<
 /Title 540 0 R
 /A 537 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 515 0 R
 /Next 559 0 R
 /First 543 0 R
@@ -6687,7 +6705,7 @@ endobj
 515 0 obj <<
 /Title 516 0 R
 /A 513 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 243 0 R
 /Next 539 0 R
 /First 519 0 R
@@ -7174,7 +7192,7 @@ endobj
 243 0 obj <<
 /Title 244 0 R
 /A 241 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 231 0 R
 /Next 515 0 R
 /First 247 0 R
@@ -7196,7 +7214,7 @@ endobj
 231 0 obj <<
 /Title 232 0 R
 /A 229 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 131 0 R
 /Next 243 0 R
 /First 235 0 R
@@ -7378,7 +7396,7 @@ endobj
 131 0 obj <<
 /Title 132 0 R
 /A 129 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 91 0 R
 /Next 231 0 R
 /First 135 0 R
@@ -7452,7 +7470,7 @@ endobj
 91 0 obj <<
 /Title 92 0 R
 /A 89 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 67 0 R
 /Next 131 0 R
 /First 95 0 R
@@ -7495,7 +7513,7 @@ endobj
 67 0 obj <<
 /Title 68 0 R
 /A 65 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Prev 7 0 R
 /Next 91 0 R
 /First 71 0 R
@@ -7604,1417 +7622,1418 @@ endobj
 7 0 obj <<
 /Title 8 0 R
 /A 5 0 R
-/Parent 1367 0 R
+/Parent 1368 0 R
 /Next 67 0 R
 /First 11 0 R
 /Last 23 0 R
 /Count -4
 >> endobj
-1368 0 obj <<
-/Names [(Access_Control_Lists) 1185 0 R (Bv9ARM.ch01) 617 0 R (Bv9ARM.ch02) 671 0 R (Bv9ARM.ch03) 686 0 R (Bv9ARM.ch04) 734 0 R (Bv9ARM.ch05) 819 0 R (Bv9ARM.ch06) 831 0 R (Bv9ARM.ch07) 1184 0 R (Bv9ARM.ch08) 1203 0 R (Bv9ARM.ch09) 1218 0 R (Configuration_File_Grammar) 855 0 R (DNSSEC) 787 0 R (Doc-Start) 598 0 R (Setting_TTLs) 1152 0 R (access_control) 970 0 R (acl) 863 0 R (address_match_lists) 836 0 R (admin_tools) 708 0 R (appendix.A) 558 0 R (bibliography) 1234 0 R (boolean_options) 740 0 R (builtin) 1031 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 514 0 R (chapter.8) 538 0 R (cite.RFC1034) 1244 0 R (cite.RFC1035) 1246 0 R (cite.RFC1101) 1302 0 R (cite.RFC1123) 1304 0 R (cite.RFC1183) 1286 0 R (cite.RFC1464) 1322 0 R (cite.RFC1535) 1273 0 R (cite.RFC1536) 1275 0 R (cite.RFC1537) 1312 0 R (cite.RFC1591) 1306 0 R (cite.RFC1706) 1288 0 R (cite.RFC1712) 1336 0 R (cite.RFC1713) 1324 0 R (cite.RFC1794) 1326 0 R (cite.RFC1876) 1290 0 R (cite.RFC1886) 1265 0 R (cite.RFC1912) 1314 0 R (cite.RFC1982) 1277 0 R (cite.RFC1995) 1251 0 R (cite.RFC1996) 1253 0 R (cite.RFC2010) 1316 0 R (cite.RFC2052) 1292 0 R (cite.RFC2065) 1267 0 R (cite.RFC2136) 1255 0 R (cite.RFC2137) 1269 0 R (cite.RFC2163) 1294 0 R (cite.RFC2168) 1296 0 R (cite.RFC2181) 1257 0 R (cite.RFC2219) 1318 0 R (cite.RFC2230) 1298 0 R (cite.RFC2240) 1328 0 R (cite.RFC2308) 1259 0 R (cite.RFC2317) 1308 0 R (cite.RFC2345) 1330 0 R (cite.RFC2352) 1332 0 R (cite.RFC2845) 1261 0 R (cite.RFC974) 1248 0 R (cite.id2492088) 1345 0 R (configuration_file_elements) 832 0 R (controls_statement_definition_and_usage) 722 0 R (diagnostic_tools) 659 0 R (dynamic_update) 738 0 R (dynamic_update_policies) 779 0 R (dynamic_update_security) 974 0 R (historical_dns_information) 1225 0 R (id2465952) 643 0 R (id2466044) 619 0 R (id2466730) 623 0 R (id2466739) 624 0 R (id2466914) 639 0 R (id2467034) 618 0 R (id2467398) 641 0 R (id2467418) 642 0 R (id2467442) 996 0 R (id2467458) 997 0 R (id2467559) 999 0 R (id2467742) 646 0 R (id2467817) 653 0 R (id2467840) 656 0 R (id2467861) 657 0 R (id2467880) 658 0 R (id2467977) 664 0 R (id2468009) 665 0 R (id2468035) 666 0 R (id2468135) 672 0 R (id2468160) 673 0 R (id2468170) 674 0 R (id2468184) 675 0 R (id2468193) 681 0 R (id2468224) 688 0 R (id2468240) 689 0 R (id2468330) 694 0 R (id2468346) 695 0 R (id2468613) 698 0 R (id2468618) 699 0 R (id2469880) 727 0 R (id2469892) 728 0 R (id2470305) 749 0 R (id2470322) 750 0 R (id2470869) 766 0 R (id2470885) 767 0 R (id2470919) 768 0 R (id2470935) 774 0 R (id2470944) 775 0 R (id2470983) 776 0 R (id2471035) 777 0 R (id2471147) 784 0 R (id2471161) 785 0 R (id2471210) 786 0 R (id2471413) 792 0 R (id2471480) 793 0 R (id2471623) 794 0 R (id2471692) 810 0 R (id2471819) 812 0 R (id2471840) 813 0 R (id2471940) 820 0 R (id2472078) 833 0 R (id2472779) 841 0 R (id2472806) 842 0 R (id2472968) 847 0 R (id2472983) 848 0 R (id2473012) 849 0 R (id2473089) 856 0 R (id2473658) 862 0 R (id2473700) 864 0 R (id2473827) 866 0 R (id2474104) 874 0 R (id2474121) 875 0 R (id2474144) 876 0 R (id2474167) 877 0 R (id2474238) 886 0 R (id2474433) 887 0 R (id2474553) 888 0 R (id2475111) 903 0 R (id2475571) 909 0 R (id2475643) 910 0 R (id2475774) 918 0 R (id2475818) 919 0 R (id2475833) 920 0 R (id2477449) 940 0 R (id2478728) 962 0 R (id2478778) 964 0 R (id2478957) 973 0 R (id2479114) 979 0 R (id2482008) 1005 0 R (id2482414) 1019 0 R (id2482881) 1033 0 R (id2483577) 1048 0 R (id2483627) 1049 0 R (id2483712) 1055 0 R (id2484997) 1068 0 R (id2485003) 1069 0 R (id2485008) 1070 0 R (id2485309) 1077 0 R (id2485477) 1078 0 R (id2486444) 1115 0 R (id2486603) 1117 0 R (id2486621) 1118 0 R (id2486643) 1121 0 R (id2486782) 1127 0 R (id2487433) 1133 0 R (id2487542) 1135 0 R (id2487563) 1141 0 R (id2487921) 1143 0 R (id2488036) 1145 0 R (id2488054) 1146 0 R (id2488359) 1153 0 R (id2488465) 1155 0 R (id2488478) 1156 0 R (id2488570) 1158 0 R (id2488589) 1159 0 R (id2488645) 1167 0 R (id2488708) 1168 0 R (id2488739) 1169 0 R (id2488800) 1174 0 R (id2489197) 1196 0 R (id2489410) 1197 0 R (id2489467) 1198 0 R (id2489606) 1204 0 R (id2489611) 1205 0 R (id2489623) 1206 0 R (id2489640) 1207 0 R (id2489702) 1219 0 R (id2489707) 1220 0 R (id2490045) 1226 0 R (id2490357) 1228 0 R (id2490633) 1240 0 R (id2490635) 1242 0 R (id2490644) 1247 0 R (id2490667) 1243 0 R (id2490691) 1245 0 R (id2490728) 1256 0 R (id2490754) 1258 0 R (id2490779) 1250 0 R (id2490804) 1252 0 R (id2490827) 1254 0 R (id2490883) 1260 0 R (id2490944) 1263 0 R (id2490958) 1264 0 R (id2490997) 1266 0 R (id2491036) 1268 0 R (id2491064) 1271 0 R (id2491073) 1272 0 R (id2491098) 1274 0 R (id2491165) 1276 0 R (id2491202) 1284 0 R (id2491207) 1285 0 R (id2491265) 1287 0 R (id2491302) 1295 0 R (id2491337) 1289 0 R (id2491392) 1291 0 R (id2491431) 1293 0 R (id2491458) 1297 0 R (id2491484) 1300 0 R (id2491492) 1301 0 R (id2491517) 1303 0 R (id2491541) 1305 0 R (id2491562) 1307 0 R (id2491677) 1310 0 R (id2491685) 1311 0 R (id2491710) 1313 0 R (id2491737) 1315 0 R (id2491773) 1317 0 R (id2491813) 1320 0 R (id2491833) 1321 0 R (id2491856) 1323 0 R (id2491880) 1325 0 R (id2491905) 1327 0 R (id2491927) 1329 0 R (id2491973) 1331 0 R (id2491997) 1334 0 R (id2492004) 1335 0 R (id2492076) 1342 0 R (id2492086) 1344 0 R (id2492088) 1346 0 R (incremental_zone_transfers) 746 0 R (internet_drafts) 1341 0 R (ipv6addresses) 814 0 R (journal) 739 0 R (lwresd) 821 0 R (notify) 735 0 R (options) 929 0 R (page.1) 597 0 R (page.10) 693 0 R (page.11) 704 0 R (page.12) 712 0 R (page.13) 719 0 R (page.14) 726 0 R (page.15) 733 0 R (page.16) 745 0 R (page.17) 755 0 R (page.18) 760 0 R (page.19) 764 0 R (page.2) 609 0 R (page.20) 773 0 R (page.21) 783 0 R (page.22) 791 0 R (page.23) 799 0 R (page.24) 809 0 R (page.25) 818 0 R (page.26) 826 0 R (page.27) 830 0 R (page.28) 840 0 R (page.29) 846 0 R (page.3) 616 0 R (page.30) 854 0 R (page.31) 861 0 R (page.32) 871 0 R (page.33) 885 0 R (page.34) 892 0 R (page.35) 896 0 R (page.36) 902 0 R (page.37) 908 0 R (page.38) 917 0 R (page.39) 924 0 R (page.4) 635 0 R (page.40) 928 0 R (page.41) 933 0 R (page.42) 939 0 R (page.43) 945 0 R (page.44) 955 0 R (page.45) 961 0 R (page.46) 969 0 R (page.47) 978 0 R (page.48) 986 0 R (page.49) 990 0 R (page.5) 652 0 R (page.50) 995 0 R (page.51) 1003 0 R (page.52) 1009 0 R (page.53) 1017 0 R (page.54) 1024 0 R (page.55) 1030 0 R (page.56) 1040 0 R (page.57) 1045 0 R (page.58) 1054 0 R (page.59) 1059 0 R (page.6) 663 0 R (page.60) 1063 0 R (page.61) 1067 0 R (page.62) 1076 0 R (page.63) 1088 0 R (page.64) 1098 0 R (page.65) 1114 0 R (page.66) 1126 0 R (page.67) 1132 0 R (page.68) 1140 0 R (page.69) 1151 0 R (page.7) 670 0 R (page.70) 1163 0 R (page.71) 1173 0 R (page.72) 1179 0 R (page.73) 1183 0 R (page.74) 1192 0 R (page.75) 1202 0 R (page.76) 1213 0 R (page.77) 1217 0 R (page.78) 1224 0 R (page.79) 1233 0 R (page.8) 680 0 R (page.80) 1282 0 R (page.81) 1340 0 R (page.9) 685 0 R (proposed_standards) 751 0 R (rfcs) 648 0 R (rndc) 881 0 R (rrset_ordering) 700 0 R (sample_configuration) 687 0 R (section*.1) 1239 0 R (section*.10) 1333 0 R (section*.11) 1343 0 R (section*.2) 1241 0 R (section*.3) 1249 0 R (section*.4) 1262 0 R (section*.5) 1270 0 R (section*.6) 1283 0 R (section*.7) 1299 0 R (section*.8) 1309 0 R (section*.9) 1319 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 466 0 R (section.7.1) 518 0 R (section.7.2) 522 0 R (section.7.3) 534 0 R (section.8.1) 542 0 R (section.8.2) 550 0 R (section.8.3) 554 0 R (section.A.1) 562 0 R (section.A.2) 570 0 R (section.A.3) 578 0 R (server_statement_definition_and_usage) 951 0 R (server_statement_grammar) 1041 0 R (statsfile) 935 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 418 0 R (subsection.6.2.18) 422 0 R (subsection.6.2.19) 426 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 430 0 R (subsection.6.2.21) 434 0 R (subsection.6.2.22) 438 0 R (subsection.6.2.23) 442 0 R (subsection.6.2.24) 446 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 470 0 R (subsection.6.3.2) 482 0 R (subsection.6.3.3) 486 0 R (subsection.6.3.4) 490 0 R (subsection.6.3.5) 494 0 R (subsection.6.3.6) 510 0 R (subsection.7.2.1) 526 0 R (subsection.7.2.2) 530 0 R (subsection.8.1.1) 546 0 R (subsection.A.1.1) 566 0 R (subsection.A.2.1) 574 0 R (subsection.A.3.1) 582 0 R (subsection.A.3.2) 586 0 R (subsection.A.3.3) 590 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 450 0 R (subsubsection.6.2.24.2) 454 0 R (subsubsection.6.2.24.3) 458 0 R (subsubsection.6.2.24.4) 462 0 R (subsubsection.6.3.1.1) 474 0 R (subsubsection.6.3.1.2) 478 0 R (subsubsection.6.3.5.1) 498 0 R (subsubsection.6.3.5.2) 502 0 R (subsubsection.6.3.5.3) 506 0 R (table.1.1) 625 0 R (table.1.2) 640 0 R (table.3.1) 696 0 R (table.3.2) 729 0 R (table.6.1) 834 0 R (table.6.10) 1122 0 R (table.6.11) 1128 0 R (table.6.12) 1134 0 R (table.6.13) 1142 0 R (table.6.14) 1144 0 R (table.6.15) 1147 0 R (table.6.16) 1154 0 R (table.6.17) 1157 0 R (table.6.18) 1175 0 R (table.6.2) 857 0 R (table.6.3) 865 0 R (table.6.4) 904 0 R (table.6.5) 941 0 R (table.6.6) 1020 0 R (table.6.7) 1034 0 R (table.6.8) 1071 0 R (table.6.9) 1116 0 R (table.A.1) 1227 0 R (table.A.2) 1229 0 R (the_category_phrase) 898 0 R (the_sortlist_statement) 1011 0 R (topology) 1010 0 R (tsig) 765 0 R (tuning) 1025 0 R (types_of_resource_records_and_when_to_use_them) 647 0 R (view_statement_grammar) 1036 0 R (zone_statement_grammar) 965 0 R (zone_transfers) 741 0 R]
-/Limits [(Access_Control_Lists) (zone_transfers)]
->> endobj
 1369 0 obj <<
-/Kids [1368 0 R]
+/Names [(Access_Control_Lists) 1186 0 R (Bv9ARM.ch01) 617 0 R (Bv9ARM.ch02) 671 0 R (Bv9ARM.ch03) 686 0 R (Bv9ARM.ch04) 734 0 R (Bv9ARM.ch05) 819 0 R (Bv9ARM.ch06) 831 0 R (Bv9ARM.ch07) 1185 0 R (Bv9ARM.ch08) 1204 0 R (Bv9ARM.ch09) 1219 0 R (Configuration_File_Grammar) 855 0 R (DNSSEC) 787 0 R (Doc-Start) 598 0 R (Setting_TTLs) 1157 0 R (access_control) 970 0 R (acl) 863 0 R (address_match_lists) 836 0 R (admin_tools) 708 0 R (appendix.A) 558 0 R (bibliography) 1235 0 R (boolean_options) 740 0 R (builtin) 1037 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 514 0 R (chapter.8) 538 0 R (cite.RFC1034) 1245 0 R (cite.RFC1035) 1247 0 R (cite.RFC1101) 1303 0 R (cite.RFC1123) 1305 0 R (cite.RFC1183) 1287 0 R (cite.RFC1464) 1323 0 R (cite.RFC1535) 1274 0 R (cite.RFC1536) 1276 0 R (cite.RFC1537) 1313 0 R (cite.RFC1591) 1307 0 R (cite.RFC1706) 1289 0 R (cite.RFC1712) 1337 0 R (cite.RFC1713) 1325 0 R (cite.RFC1794) 1327 0 R (cite.RFC1876) 1291 0 R (cite.RFC1886) 1266 0 R (cite.RFC1912) 1315 0 R (cite.RFC1982) 1278 0 R (cite.RFC1995) 1252 0 R (cite.RFC1996) 1254 0 R (cite.RFC2010) 1317 0 R (cite.RFC2052) 1293 0 R (cite.RFC2065) 1268 0 R (cite.RFC2136) 1256 0 R (cite.RFC2137) 1270 0 R (cite.RFC2163) 1295 0 R (cite.RFC2168) 1297 0 R (cite.RFC2181) 1258 0 R (cite.RFC2219) 1319 0 R (cite.RFC2230) 1299 0 R (cite.RFC2240) 1329 0 R (cite.RFC2308) 1260 0 R (cite.RFC2317) 1309 0 R (cite.RFC2345) 1331 0 R (cite.RFC2352) 1333 0 R (cite.RFC2845) 1262 0 R (cite.RFC974) 1249 0 R (cite.id2492414) 1346 0 R (configuration_file_elements) 832 0 R (controls_statement_definition_and_usage) 722 0 R (diagnostic_tools) 659 0 R (dynamic_update) 738 0 R (dynamic_update_policies) 779 0 R (dynamic_update_security) 974 0 R (historical_dns_information) 1226 0 R (id2465952) 643 0 R (id2466044) 619 0 R (id2466730) 623 0 R (id2466739) 624 0 R (id2466914) 639 0 R (id2467034) 618 0 R (id2467398) 641 0 R (id2467418) 642 0 R (id2467653) 841 0 R (id2467680) 842 0 R (id2467742) 646 0 R (id2467817) 653 0 R (id2467840) 656 0 R (id2467861) 657 0 R (id2467880) 658 0 R (id2467977) 664 0 R (id2468009) 665 0 R (id2468035) 666 0 R (id2468135) 672 0 R (id2468160) 673 0 R (id2468170) 674 0 R (id2468184) 675 0 R (id2468193) 681 0 R (id2468224) 688 0 R (id2468240) 689 0 R (id2468330) 694 0 R (id2468346) 695 0 R (id2468613) 698 0 R (id2468618) 699 0 R (id2469880) 727 0 R (id2469892) 728 0 R (id2470373) 749 0 R (id2470390) 750 0 R (id2470869) 766 0 R (id2470885) 767 0 R (id2470987) 768 0 R (id2471003) 774 0 R (id2471012) 775 0 R (id2471051) 776 0 R (id2471104) 777 0 R (id2471216) 784 0 R (id2471229) 785 0 R (id2471278) 786 0 R (id2471345) 792 0 R (id2471480) 793 0 R (id2471623) 794 0 R (id2471692) 810 0 R (id2471751) 812 0 R (id2471771) 813 0 R (id2471872) 820 0 R (id2472010) 833 0 R (id2474941) 847 0 R (id2474956) 848 0 R (id2474985) 849 0 R (id2475062) 856 0 R (id2475495) 862 0 R (id2475537) 864 0 R (id2475800) 866 0 R (id2476077) 874 0 R (id2476094) 875 0 R (id2476117) 876 0 R (id2476140) 877 0 R (id2476212) 886 0 R (id2476338) 887 0 R (id2476458) 892 0 R (id2477084) 903 0 R (id2477544) 909 0 R (id2477617) 910 0 R (id2477816) 918 0 R (id2477860) 919 0 R (id2477943) 920 0 R (id2479510) 940 0 R (id2480721) 962 0 R (id2480771) 964 0 R (id2481018) 973 0 R (id2481944) 996 0 R (id2482005) 1002 0 R (id2482106) 1004 0 R (id2482384) 1010 0 R (id2482722) 1024 0 R (id2483393) 1039 0 R (id2484021) 1053 0 R (id2484071) 1054 0 R (id2484155) 1060 0 R (id2485373) 1074 0 R (id2485380) 1075 0 R (id2485384) 1076 0 R (id2485686) 1082 0 R (id2485717) 1083 0 R (id2486684) 1120 0 R (id2486912) 1122 0 R (id2486930) 1123 0 R (id2486951) 1126 0 R (id2487091) 1132 0 R (id2487760) 1139 0 R (id2487868) 1141 0 R (id2487890) 1146 0 R (id2488110) 1148 0 R (id2488226) 1150 0 R (id2488244) 1151 0 R (id2488617) 1158 0 R (id2488723) 1160 0 R (id2488737) 1161 0 R (id2488828) 1163 0 R (id2488848) 1168 0 R (id2488903) 1172 0 R (id2489034) 1173 0 R (id2489065) 1174 0 R (id2489194) 1179 0 R (id2489729) 1197 0 R (id2489804) 1198 0 R (id2489862) 1199 0 R (id2489932) 1205 0 R (id2489938) 1206 0 R (id2489949) 1207 0 R (id2489966) 1208 0 R (id2490028) 1220 0 R (id2490034) 1221 0 R (id2490235) 1227 0 R (id2490547) 1229 0 R (id2490823) 1241 0 R (id2490825) 1243 0 R (id2490834) 1248 0 R (id2490925) 1244 0 R (id2490949) 1246 0 R (id2490986) 1257 0 R (id2491012) 1259 0 R (id2491037) 1251 0 R (id2491062) 1253 0 R (id2491085) 1255 0 R (id2491141) 1261 0 R (id2491202) 1264 0 R (id2491217) 1265 0 R (id2491255) 1267 0 R (id2491294) 1269 0 R (id2491322) 1272 0 R (id2491331) 1273 0 R (id2491356) 1275 0 R (id2491424) 1277 0 R (id2491460) 1285 0 R (id2491465) 1286 0 R (id2491523) 1288 0 R (id2491628) 1296 0 R (id2491664) 1290 0 R (id2491786) 1292 0 R (id2491826) 1294 0 R (id2491852) 1298 0 R (id2491879) 1301 0 R (id2491886) 1302 0 R (id2491912) 1304 0 R (id2491936) 1306 0 R (id2491957) 1308 0 R (id2492004) 1311 0 R (id2492011) 1312 0 R (id2492037) 1314 0 R (id2492064) 1316 0 R (id2492100) 1318 0 R (id2492139) 1321 0 R (id2492160) 1322 0 R (id2492182) 1324 0 R (id2492206) 1326 0 R (id2492231) 1328 0 R (id2492253) 1330 0 R (id2492299) 1332 0 R (id2492324) 1335 0 R (id2492330) 1336 0 R (id2492403) 1343 0 R (id2492412) 1345 0 R (id2492414) 1347 0 R (incremental_zone_transfers) 746 0 R (internet_drafts) 1342 0 R (ipv6addresses) 814 0 R (journal) 739 0 R (lwresd) 821 0 R (notify) 735 0 R (options) 929 0 R (page.1) 597 0 R (page.10) 693 0 R (page.11) 704 0 R (page.12) 712 0 R (page.13) 719 0 R (page.14) 726 0 R (page.15) 733 0 R (page.16) 745 0 R (page.17) 755 0 R (page.18) 760 0 R (page.19) 764 0 R (page.2) 609 0 R (page.20) 773 0 R (page.21) 783 0 R (page.22) 791 0 R (page.23) 799 0 R (page.24) 809 0 R (page.25) 818 0 R (page.26) 826 0 R (page.27) 830 0 R (page.28) 840 0 R (page.29) 846 0 R (page.3) 616 0 R (page.30) 854 0 R (page.31) 861 0 R (page.32) 871 0 R (page.33) 884 0 R (page.34) 891 0 R (page.35) 896 0 R (page.36) 902 0 R (page.37) 908 0 R (page.38) 917 0 R (page.39) 924 0 R (page.4) 635 0 R (page.40) 928 0 R (page.41) 933 0 R (page.42) 939 0 R (page.43) 945 0 R (page.44) 952 0 R (page.45) 961 0 R (page.46) 969 0 R (page.47) 978 0 R (page.48) 983 0 R (page.49) 990 0 R (page.5) 652 0 R (page.50) 995 0 R (page.51) 1001 0 R (page.52) 1009 0 R (page.53) 1014 0 R (page.54) 1022 0 R (page.55) 1029 0 R (page.56) 1036 0 R (page.57) 1045 0 R (page.58) 1050 0 R (page.59) 1059 0 R (page.6) 663 0 R (page.60) 1064 0 R (page.61) 1068 0 R (page.62) 1073 0 R (page.63) 1081 0 R (page.64) 1093 0 R (page.65) 1103 0 R (page.66) 1119 0 R (page.67) 1131 0 R (page.68) 1138 0 R (page.69) 1145 0 R (page.7) 670 0 R (page.70) 1156 0 R (page.71) 1167 0 R (page.72) 1178 0 R (page.73) 1184 0 R (page.74) 1193 0 R (page.75) 1203 0 R (page.76) 1214 0 R (page.77) 1218 0 R (page.78) 1225 0 R (page.79) 1234 0 R (page.8) 680 0 R (page.80) 1283 0 R (page.81) 1341 0 R (page.9) 685 0 R (proposed_standards) 751 0 R (query_address) 979 0 R (rfcs) 648 0 R (rndc) 880 0 R (rrset_ordering) 700 0 R (sample_configuration) 687 0 R (section*.1) 1240 0 R (section*.10) 1334 0 R (section*.11) 1344 0 R (section*.2) 1242 0 R (section*.3) 1250 0 R (section*.4) 1263 0 R (section*.5) 1271 0 R (section*.6) 1284 0 R (section*.7) 1300 0 R (section*.8) 1310 0 R (section*.9) 1320 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 466 0 R (section.7.1) 518 0 R (section.7.2) 522 0 R (section.7.3) 534 0 R (section.8.1) 542 0 R (section.8.2) 550 0 R (section.8.3) 554 0 R (section.A.1) 562 0 R (section.A.2) 570 0 R (section.A.3) 578 0 R (server_statement_definition_and_usage) 957 0 R (server_statement_grammar) 1046 0 R (statsfile) 935 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 418 0 R (subsection.6.2.18) 422 0 R (subsection.6.2.19) 426 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 430 0 R (subsection.6.2.21) 434 0 R (subsection.6.2.22) 438 0 R (subsection.6.2.23) 442 0 R (subsection.6.2.24) 446 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 470 0 R (subsection.6.3.2) 482 0 R (subsection.6.3.3) 486 0 R (subsection.6.3.4) 490 0 R (subsection.6.3.5) 494 0 R (subsection.6.3.6) 510 0 R (subsection.7.2.1) 526 0 R (subsection.7.2.2) 530 0 R (subsection.8.1.1) 546 0 R (subsection.A.1.1) 566 0 R (subsection.A.2.1) 574 0 R (subsection.A.3.1) 582 0 R (subsection.A.3.2) 586 0 R (subsection.A.3.3) 590 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 450 0 R (subsubsection.6.2.24.2) 454 0 R (subsubsection.6.2.24.3) 458 0 R (subsubsection.6.2.24.4) 462 0 R (subsubsection.6.3.1.1) 474 0 R (subsubsection.6.3.1.2) 478 0 R (subsubsection.6.3.5.1) 498 0 R (subsubsection.6.3.5.2) 502 0 R (subsubsection.6.3.5.3) 506 0 R (table.1.1) 625 0 R (table.1.2) 640 0 R (table.3.1) 696 0 R (table.3.2) 729 0 R (table.6.1) 834 0 R (table.6.10) 1127 0 R (table.6.11) 1133 0 R (table.6.12) 1140 0 R (table.6.13) 1147 0 R (table.6.14) 1149 0 R (table.6.15) 1152 0 R (table.6.16) 1159 0 R (table.6.17) 1162 0 R (table.6.18) 1180 0 R (table.6.2) 857 0 R (table.6.3) 865 0 R (table.6.4) 904 0 R (table.6.5) 941 0 R (table.6.6) 1025 0 R (table.6.7) 1040 0 R (table.6.8) 1077 0 R (table.6.9) 1121 0 R (table.A.1) 1228 0 R (table.A.2) 1230 0 R (the_category_phrase) 898 0 R (the_sortlist_statement) 1016 0 R (topology) 1015 0 R (tsig) 765 0 R (tuning) 1030 0 R (types_of_resource_records_and_when_to_use_them) 647 0 R (view_statement_grammar) 1041 0 R (zone_statement_grammar) 965 0 R (zone_transfers) 741 0 R]
+/Limits [(Access_Control_Lists) (zone_transfers)]
 >> endobj
 1370 0 obj <<
-/Dests 1369 0 R
+/Kids [1369 0 R]
 >> endobj
 1371 0 obj <<
+/Dests 1370 0 R
+>> endobj
+1372 0 obj <<
 /Type /Catalog
-/Pages 1366 0 R
-/Outlines 1367 0 R
-/Names 1370 0 R
+/Pages 1367 0 R
+/Outlines 1368 0 R
+/Names 1371 0 R
 /PageMode /UseOutlines 
 /OpenAction 593 0 R
 >> endobj
-1372 0 obj <<
+1373 0 obj <<
 /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords()
-/CreationDate (D:20080527222349Z)
+/CreationDate (D:20081024022700Z)
 /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4)
 >> endobj
 xref
-0 1373
+0 1374
 0000000001 65535 f 
 0000000002 00000 f 
 0000000003 00000 f 
 0000000004 00000 f 
 0000000000 00000 f 
 0000000009 00000 n 
-0000018969 00000 n 
-0000491721 00000 n 
+0000018967 00000 n 
+0000496151 00000 n 
 0000000054 00000 n 
 0000000086 00000 n 
-0000019093 00000 n 
-0000491649 00000 n 
+0000019091 00000 n 
+0000496079 00000 n 
 0000000133 00000 n 
 0000000173 00000 n 
-0000019218 00000 n 
-0000491563 00000 n 
+0000019216 00000 n 
+0000495993 00000 n 
 0000000221 00000 n 
 0000000273 00000 n 
-0000019343 00000 n 
-0000491477 00000 n 
+0000019341 00000 n 
+0000495907 00000 n 
 0000000321 00000 n 
 0000000377 00000 n 
-0000023633 00000 n 
-0000491367 00000 n 
+0000023631 00000 n 
+0000495797 00000 n 
 0000000425 00000 n 
 0000000478 00000 n 
-0000023758 00000 n 
-0000491293 00000 n 
+0000023756 00000 n 
+0000495723 00000 n 
 0000000531 00000 n 
 0000000572 00000 n 
-0000023883 00000 n 
-0000491206 00000 n 
+0000023881 00000 n 
+0000495636 00000 n 
 0000000625 00000 n 
 0000000674 00000 n 
-0000024008 00000 n 
-0000491119 00000 n 
+0000024006 00000 n 
+0000495549 00000 n 
 0000000727 00000 n 
 0000000757 00000 n 
-0000028318 00000 n 
-0000490995 00000 n 
+0000028316 00000 n 
+0000495425 00000 n 
 0000000810 00000 n 
 0000000861 00000 n 
-0000028443 00000 n 
-0000490921 00000 n 
+0000028441 00000 n 
+0000495351 00000 n 
 0000000919 00000 n 
 0000000964 00000 n 
-0000028568 00000 n 
-0000490834 00000 n 
+0000028566 00000 n 
+0000495264 00000 n 
 0000001022 00000 n 
 0000001062 00000 n 
-0000028693 00000 n 
-0000490760 00000 n 
+0000028691 00000 n 
+0000495190 00000 n 
 0000001120 00000 n 
 0000001162 00000 n 
-0000031606 00000 n 
-0000490636 00000 n 
+0000031604 00000 n 
+0000495066 00000 n 
 0000001215 00000 n 
 0000001260 00000 n 
-0000031731 00000 n 
-0000490575 00000 n 
+0000031729 00000 n 
+0000495005 00000 n 
 0000001318 00000 n 
 0000001355 00000 n 
-0000031856 00000 n 
-0000490501 00000 n 
+0000031854 00000 n 
+0000494931 00000 n 
 0000001408 00000 n 
 0000001463 00000 n 
-0000034244 00000 n 
-0000490376 00000 n 
+0000034242 00000 n 
+0000494806 00000 n 
 0000001509 00000 n 
 0000001556 00000 n 
-0000034369 00000 n 
-0000490302 00000 n 
+0000034367 00000 n 
+0000494732 00000 n 
 0000001604 00000 n 
 0000001648 00000 n 
-0000034494 00000 n 
-0000490215 00000 n 
+0000034492 00000 n 
+0000494645 00000 n 
 0000001696 00000 n 
 0000001735 00000 n 
-0000034617 00000 n 
-0000490128 00000 n 
+0000034615 00000 n 
+0000494558 00000 n 
 0000001783 00000 n 
 0000001825 00000 n 
-0000034741 00000 n 
-0000490041 00000 n 
+0000034739 00000 n 
+0000494471 00000 n 
 0000001873 00000 n 
 0000001936 00000 n 
-0000035777 00000 n 
-0000489967 00000 n 
+0000035820 00000 n 
+0000494397 00000 n 
 0000001984 00000 n 
 0000002034 00000 n 
-0000037455 00000 n 
-0000489839 00000 n 
+0000037498 00000 n 
+0000494269 00000 n 
 0000002080 00000 n 
 0000002126 00000 n 
-0000037579 00000 n 
-0000489726 00000 n 
+0000037622 00000 n 
+0000494156 00000 n 
 0000002174 00000 n 
 0000002218 00000 n 
-0000037704 00000 n 
-0000489650 00000 n 
+0000037747 00000 n 
+0000494080 00000 n 
 0000002271 00000 n 
 0000002323 00000 n 
-0000037829 00000 n 
-0000489573 00000 n 
+0000037872 00000 n 
+0000494003 00000 n 
 0000002377 00000 n 
 0000002436 00000 n 
-0000040461 00000 n 
-0000489482 00000 n 
+0000040504 00000 n 
+0000493912 00000 n 
 0000002485 00000 n 
 0000002523 00000 n 
-0000040712 00000 n 
-0000489365 00000 n 
+0000040755 00000 n 
+0000493795 00000 n 
 0000002572 00000 n 
 0000002618 00000 n 
-0000040838 00000 n 
-0000489247 00000 n 
+0000040881 00000 n 
+0000493677 00000 n 
 0000002672 00000 n 
 0000002739 00000 n 
-0000044023 00000 n 
-0000489168 00000 n 
+0000044066 00000 n 
+0000493598 00000 n 
 0000002798 00000 n 
 0000002842 00000 n 
-0000044149 00000 n 
-0000489089 00000 n 
+0000044192 00000 n 
+0000493519 00000 n 
 0000002901 00000 n 
 0000002949 00000 n 
-0000054288 00000 n 
-0000489010 00000 n 
+0000054331 00000 n 
+0000493440 00000 n 
 0000003003 00000 n 
 0000003036 00000 n 
-0000057561 00000 n 
-0000488878 00000 n 
+0000057604 00000 n 
+0000493308 00000 n 
 0000003083 00000 n 
 0000003126 00000 n 
-0000057687 00000 n 
-0000488799 00000 n 
+0000057730 00000 n 
+0000493229 00000 n 
 0000003175 00000 n 
 0000003205 00000 n 
-0000057813 00000 n 
-0000488667 00000 n 
+0000057856 00000 n 
+0000493097 00000 n 
 0000003254 00000 n 
 0000003292 00000 n 
-0000057938 00000 n 
-0000488602 00000 n 
+0000057981 00000 n 
+0000493032 00000 n 
 0000003346 00000 n 
 0000003388 00000 n 
-0000062257 00000 n 
-0000488509 00000 n 
+0000062300 00000 n 
+0000492939 00000 n 
 0000003437 00000 n 
 0000003496 00000 n 
-0000062383 00000 n 
-0000488377 00000 n 
+0000062426 00000 n 
+0000492807 00000 n 
 0000003545 00000 n 
 0000003578 00000 n 
-0000062509 00000 n 
-0000488312 00000 n 
+0000062552 00000 n 
+0000492742 00000 n 
 0000003632 00000 n 
 0000003681 00000 n 
-0000069370 00000 n 
-0000488180 00000 n 
+0000069413 00000 n 
+0000492610 00000 n 
 0000003730 00000 n 
 0000003758 00000 n 
-0000069496 00000 n 
-0000488062 00000 n 
+0000069539 00000 n 
+0000492492 00000 n 
 0000003812 00000 n 
 0000003881 00000 n 
-0000069621 00000 n 
-0000487983 00000 n 
+0000069664 00000 n 
+0000492413 00000 n 
 0000003940 00000 n 
 0000003988 00000 n 
-0000069747 00000 n 
-0000487904 00000 n 
+0000069790 00000 n 
+0000492334 00000 n 
 0000004047 00000 n 
 0000004092 00000 n 
-0000072749 00000 n 
-0000487811 00000 n 
+0000072792 00000 n 
+0000492241 00000 n 
 0000004146 00000 n 
 0000004214 00000 n 
-0000072875 00000 n 
-0000487718 00000 n 
+0000072918 00000 n 
+0000492148 00000 n 
 0000004268 00000 n 
 0000004338 00000 n 
-0000073001 00000 n 
-0000487625 00000 n 
+0000073044 00000 n 
+0000492055 00000 n 
 0000004392 00000 n 
 0000004455 00000 n 
-0000073127 00000 n 
-0000487532 00000 n 
+0000073170 00000 n 
+0000491962 00000 n 
 0000004509 00000 n 
 0000004564 00000 n 
-0000076860 00000 n 
-0000487453 00000 n 
+0000076903 00000 n 
+0000491883 00000 n 
 0000004618 00000 n 
 0000004650 00000 n 
-0000076986 00000 n 
-0000487360 00000 n 
+0000077029 00000 n 
+0000491790 00000 n 
 0000004699 00000 n 
 0000004727 00000 n 
-0000077111 00000 n 
-0000487267 00000 n 
+0000077154 00000 n 
+0000491697 00000 n 
 0000004776 00000 n 
 0000004808 00000 n 
-0000077237 00000 n 
-0000487135 00000 n 
+0000077280 00000 n 
+0000491565 00000 n 
 0000004857 00000 n 
 0000004887 00000 n 
-0000080688 00000 n 
-0000487056 00000 n 
+0000080731 00000 n 
+0000491486 00000 n 
 0000004941 00000 n 
 0000004982 00000 n 
-0000080813 00000 n 
-0000486963 00000 n 
+0000080856 00000 n 
+0000491393 00000 n 
 0000005036 00000 n 
 0000005078 00000 n 
-0000080939 00000 n 
-0000486884 00000 n 
+0000080982 00000 n 
+0000491314 00000 n 
 0000005132 00000 n 
 0000005177 00000 n 
-0000088379 00000 n 
-0000486766 00000 n 
+0000088422 00000 n 
+0000491196 00000 n 
 0000005226 00000 n 
 0000005272 00000 n 
-0000088505 00000 n 
-0000486687 00000 n 
+0000088548 00000 n 
+0000491117 00000 n 
 0000005326 00000 n 
 0000005386 00000 n 
-0000088631 00000 n 
-0000486608 00000 n 
+0000088674 00000 n 
+0000491038 00000 n 
 0000005440 00000 n 
 0000005509 00000 n 
-0000091066 00000 n 
-0000486475 00000 n 
+0000091109 00000 n 
+0000490905 00000 n 
 0000005556 00000 n 
 0000005609 00000 n 
-0000091192 00000 n 
-0000486396 00000 n 
+0000091235 00000 n 
+0000490826 00000 n 
 0000005658 00000 n 
 0000005714 00000 n 
-0000091318 00000 n 
-0000486317 00000 n 
+0000091361 00000 n 
+0000490747 00000 n 
 0000005763 00000 n 
 0000005812 00000 n 
-0000095439 00000 n 
-0000486184 00000 n 
+0000095482 00000 n 
+0000490614 00000 n 
 0000005859 00000 n 
 0000005911 00000 n 
-0000095565 00000 n 
-0000486066 00000 n 
+0000095608 00000 n 
+0000490496 00000 n 
 0000005960 00000 n 
 0000006011 00000 n 
-0000099709 00000 n 
-0000485948 00000 n 
+0000100168 00000 n 
+0000490378 00000 n 
 0000006065 00000 n 
 0000006110 00000 n 
-0000099834 00000 n 
-0000485869 00000 n 
+0000100294 00000 n 
+0000490299 00000 n 
 0000006169 00000 n 
 0000006203 00000 n 
-0000099959 00000 n 
-0000485790 00000 n 
+0000100420 00000 n 
+0000490220 00000 n 
 0000006262 00000 n 
 0000006310 00000 n 
-0000103241 00000 n 
-0000485672 00000 n 
+0000103776 00000 n 
+0000490102 00000 n 
 0000006364 00000 n 
 0000006404 00000 n 
-0000103367 00000 n 
-0000485593 00000 n 
+0000103901 00000 n 
+0000490023 00000 n 
 0000006463 00000 n 
 0000006497 00000 n 
-0000103493 00000 n 
-0000485514 00000 n 
+0000104027 00000 n 
+0000489944 00000 n 
 0000006556 00000 n 
 0000006604 00000 n 
-0000107219 00000 n 
-0000485381 00000 n 
+0000107896 00000 n 
+0000489811 00000 n 
 0000006653 00000 n 
 0000006703 00000 n 
-0000111057 00000 n 
-0000485302 00000 n 
+0000111407 00000 n 
+0000489732 00000 n 
 0000006757 00000 n 
 0000006804 00000 n 
-0000111183 00000 n 
-0000485209 00000 n 
+0000111533 00000 n 
+0000489639 00000 n 
 0000006858 00000 n 
 0000006918 00000 n 
-0000111433 00000 n 
-0000485116 00000 n 
+0000111785 00000 n 
+0000489546 00000 n 
 0000006972 00000 n 
 0000007024 00000 n 
-0000111559 00000 n 
-0000485023 00000 n 
+0000111911 00000 n 
+0000489453 00000 n 
 0000007078 00000 n 
 0000007143 00000 n 
-0000116189 00000 n 
-0000484930 00000 n 
+0000116539 00000 n 
+0000489360 00000 n 
 0000007197 00000 n 
 0000007248 00000 n 
-0000116315 00000 n 
-0000484837 00000 n 
+0000116665 00000 n 
+0000489267 00000 n 
 0000007302 00000 n 
 0000007366 00000 n 
-0000116441 00000 n 
-0000484744 00000 n 
+0000116791 00000 n 
+0000489174 00000 n 
 0000007420 00000 n 
 0000007467 00000 n 
-0000116567 00000 n 
-0000484651 00000 n 
+0000116917 00000 n 
+0000489081 00000 n 
 0000007521 00000 n 
 0000007581 00000 n 
-0000119509 00000 n 
-0000484558 00000 n 
+0000120093 00000 n 
+0000488988 00000 n 
 0000007635 00000 n 
 0000007686 00000 n 
-0000119635 00000 n 
-0000484426 00000 n 
+0000120219 00000 n 
+0000488856 00000 n 
 0000007741 00000 n 
 0000007806 00000 n 
-0000119761 00000 n 
-0000484347 00000 n 
+0000124842 00000 n 
+0000488777 00000 n 
 0000007866 00000 n 
 0000007913 00000 n 
-0000130170 00000 n 
-0000484268 00000 n 
+0000131000 00000 n 
+0000488698 00000 n 
 0000007973 00000 n 
 0000008021 00000 n 
-0000133886 00000 n 
-0000484175 00000 n 
+0000134715 00000 n 
+0000488605 00000 n 
 0000008076 00000 n 
 0000008126 00000 n 
-0000134012 00000 n 
-0000484082 00000 n 
+0000134841 00000 n 
+0000488512 00000 n 
 0000008181 00000 n 
 0000008244 00000 n 
-0000135742 00000 n 
-0000483989 00000 n 
+0000136571 00000 n 
+0000488419 00000 n 
 0000008299 00000 n 
 0000008351 00000 n 
-0000135868 00000 n 
-0000483896 00000 n 
+0000136697 00000 n 
+0000488326 00000 n 
 0000008406 00000 n 
 0000008471 00000 n 
-0000135994 00000 n 
-0000483803 00000 n 
+0000136823 00000 n 
+0000488233 00000 n 
 0000008526 00000 n 
 0000008578 00000 n 
-0000141175 00000 n 
-0000483670 00000 n 
+0000141832 00000 n 
+0000488100 00000 n 
 0000008633 00000 n 
 0000008698 00000 n 
-0000145209 00000 n 
-0000483591 00000 n 
+0000149873 00000 n 
+0000488021 00000 n 
 0000008758 00000 n 
 0000008802 00000 n 
-0000162726 00000 n 
-0000483498 00000 n 
+0000163494 00000 n 
+0000487928 00000 n 
 0000008862 00000 n 
 0000008901 00000 n 
-0000162852 00000 n 
-0000483405 00000 n 
+0000163620 00000 n 
+0000487835 00000 n 
 0000008961 00000 n 
 0000009008 00000 n 
-0000166993 00000 n 
-0000483312 00000 n 
+0000167817 00000 n 
+0000487742 00000 n 
 0000009068 00000 n 
 0000009111 00000 n 
-0000167119 00000 n 
-0000483219 00000 n 
+0000167942 00000 n 
+0000487649 00000 n 
 0000009171 00000 n 
 0000009210 00000 n 
-0000170296 00000 n 
-0000483126 00000 n 
+0000171164 00000 n 
+0000487556 00000 n 
 0000009270 00000 n 
 0000009312 00000 n 
-0000173827 00000 n 
-0000483033 00000 n 
+0000174647 00000 n 
+0000487463 00000 n 
 0000009372 00000 n 
 0000009415 00000 n 
-0000181413 00000 n 
-0000482940 00000 n 
+0000182087 00000 n 
+0000487370 00000 n 
 0000009475 00000 n 
-0000009522 00000 n 
-0000181539 00000 n 
-0000482847 00000 n 
-0000009582 00000 n 
-0000009643 00000 n 
-0000181665 00000 n 
-0000482754 00000 n 
-0000009704 00000 n 
-0000009756 00000 n 
-0000185582 00000 n 
-0000482661 00000 n 
-0000009817 00000 n 
-0000009870 00000 n 
-0000189915 00000 n 
-0000482568 00000 n 
-0000009931 00000 n 
-0000009969 00000 n 
-0000190044 00000 n 
-0000482475 00000 n 
-0000010030 00000 n 
-0000010082 00000 n 
-0000192946 00000 n 
-0000482382 00000 n 
-0000010143 00000 n 
-0000010187 00000 n 
-0000196692 00000 n 
-0000482289 00000 n 
-0000010248 00000 n 
-0000010284 00000 n 
-0000200657 00000 n 
-0000482196 00000 n 
-0000010345 00000 n 
-0000010408 00000 n 
-0000200786 00000 n 
-0000482117 00000 n 
-0000010469 00000 n 
-0000010518 00000 n 
-0000204307 00000 n 
-0000482024 00000 n 
-0000010573 00000 n 
-0000010624 00000 n 
-0000204434 00000 n 
-0000481931 00000 n 
-0000010679 00000 n 
-0000010743 00000 n 
-0000208561 00000 n 
-0000481838 00000 n 
-0000010798 00000 n 
-0000010855 00000 n 
-0000208688 00000 n 
-0000481745 00000 n 
-0000010910 00000 n 
-0000010980 00000 n 
-0000208816 00000 n 
-0000481652 00000 n 
-0000011035 00000 n 
-0000011084 00000 n 
-0000212235 00000 n 
-0000481559 00000 n 
-0000011139 00000 n 
-0000011201 00000 n 
-0000213812 00000 n 
-0000481466 00000 n 
-0000011256 00000 n 
-0000011305 00000 n 
-0000218667 00000 n 
-0000481348 00000 n 
-0000011360 00000 n 
-0000011422 00000 n 
-0000218796 00000 n 
-0000481269 00000 n 
-0000011482 00000 n 
-0000011521 00000 n 
-0000223747 00000 n 
-0000481176 00000 n 
-0000011581 00000 n 
-0000011615 00000 n 
-0000223876 00000 n 
-0000481083 00000 n 
-0000011675 00000 n 
-0000011716 00000 n 
-0000234063 00000 n 
-0000481004 00000 n 
-0000011776 00000 n 
-0000011828 00000 n 
-0000238234 00000 n 
-0000480886 00000 n 
-0000011877 00000 n 
-0000011910 00000 n 
-0000238363 00000 n 
-0000480768 00000 n 
-0000011964 00000 n 
-0000012036 00000 n 
-0000238491 00000 n 
-0000480689 00000 n 
-0000012095 00000 n 
-0000012139 00000 n 
-0000246225 00000 n 
-0000480610 00000 n 
-0000012198 00000 n 
-0000012251 00000 n 
-0000249809 00000 n 
-0000480517 00000 n 
-0000012305 00000 n 
-0000012355 00000 n 
-0000253169 00000 n 
-0000480424 00000 n 
-0000012409 00000 n 
-0000012447 00000 n 
-0000253427 00000 n 
-0000480331 00000 n 
-0000012501 00000 n 
-0000012550 00000 n 
-0000253685 00000 n 
-0000480199 00000 n 
-0000012604 00000 n 
-0000012656 00000 n 
-0000253814 00000 n 
-0000480120 00000 n 
-0000012715 00000 n 
-0000012767 00000 n 
-0000256695 00000 n 
-0000480027 00000 n 
-0000012826 00000 n 
-0000012879 00000 n 
-0000256824 00000 n 
-0000479948 00000 n 
-0000012938 00000 n 
-0000012987 00000 n 
-0000256953 00000 n 
-0000479869 00000 n 
-0000013041 00000 n 
-0000013121 00000 n 
-0000262822 00000 n 
-0000479736 00000 n 
-0000013168 00000 n 
-0000013220 00000 n 
-0000262951 00000 n 
-0000479657 00000 n 
-0000013269 00000 n 
-0000013313 00000 n 
-0000266684 00000 n 
-0000479525 00000 n 
-0000013362 00000 n 
-0000013424 00000 n 
-0000266813 00000 n 
-0000479446 00000 n 
-0000013478 00000 n 
-0000013526 00000 n 
-0000266942 00000 n 
-0000479367 00000 n 
-0000013580 00000 n 
-0000013631 00000 n 
-0000267071 00000 n 
-0000479288 00000 n 
-0000013680 00000 n 
-0000013727 00000 n 
-0000269988 00000 n 
-0000479155 00000 n 
-0000013774 00000 n 
-0000013811 00000 n 
-0000270117 00000 n 
-0000479037 00000 n 
-0000013860 00000 n 
-0000013899 00000 n 
-0000270246 00000 n 
-0000478972 00000 n 
-0000013953 00000 n 
-0000014031 00000 n 
-0000270375 00000 n 
-0000478879 00000 n 
-0000014080 00000 n 
-0000014147 00000 n 
-0000270504 00000 n 
-0000478800 00000 n 
-0000014196 00000 n 
-0000014241 00000 n 
-0000273998 00000 n 
-0000478681 00000 n 
-0000014289 00000 n 
-0000014321 00000 n 
-0000274127 00000 n 
-0000478563 00000 n 
-0000014370 00000 n 
-0000014409 00000 n 
-0000274256 00000 n 
-0000478498 00000 n 
-0000014463 00000 n 
-0000014524 00000 n 
-0000277755 00000 n 
-0000478366 00000 n 
-0000014573 00000 n 
-0000014630 00000 n 
-0000277884 00000 n 
-0000478301 00000 n 
-0000014684 00000 n 
-0000014733 00000 n 
-0000282071 00000 n 
-0000478183 00000 n 
-0000014782 00000 n 
-0000014844 00000 n 
-0000282200 00000 n 
-0000478104 00000 n 
-0000014898 00000 n 
-0000014953 00000 n 
-0000292815 00000 n 
-0000478011 00000 n 
-0000015007 00000 n 
-0000015048 00000 n 
-0000292944 00000 n 
-0000477932 00000 n 
-0000015102 00000 n 
-0000015154 00000 n 
-0000015507 00000 n 
-0000015755 00000 n 
-0000015207 00000 n 
-0000015629 00000 n 
-0000015692 00000 n 
-0000474773 00000 n 
-0000449109 00000 n 
-0000474599 00000 n 
-0000447921 00000 n 
-0000421761 00000 n 
-0000447747 00000 n 
-0000475778 00000 n 
-0000016419 00000 n 
-0000016234 00000 n 
-0000015840 00000 n 
-0000016356 00000 n 
-0000421076 00000 n 
-0000418932 00000 n 
-0000420912 00000 n 
-0000019594 00000 n 
-0000018784 00000 n 
-0000016504 00000 n 
-0000018906 00000 n 
-0000019030 00000 n 
-0000019155 00000 n 
-0000019280 00000 n 
-0000418078 00000 n 
-0000397720 00000 n 
-0000417904 00000 n 
-0000019405 00000 n 
-0000019468 00000 n 
-0000019531 00000 n 
-0000396771 00000 n 
-0000377019 00000 n 
-0000396598 00000 n 
-0000376292 00000 n 
-0000359908 00000 n 
-0000376119 00000 n 
-0000024132 00000 n 
-0000022950 00000 n 
-0000019718 00000 n 
-0000023444 00000 n 
-0000359373 00000 n 
-0000342456 00000 n 
-0000359189 00000 n 
-0000023507 00000 n 
-0000023570 00000 n 
-0000023695 00000 n 
-0000023820 00000 n 
-0000023945 00000 n 
-0000023100 00000 n 
-0000023293 00000 n 
-0000024070 00000 n 
-0000238427 00000 n 
-0000282264 00000 n 
-0000028818 00000 n 
-0000027783 00000 n 
-0000024256 00000 n 
-0000028255 00000 n 
-0000028380 00000 n 
-0000027933 00000 n 
-0000028095 00000 n 
-0000028505 00000 n 
-0000028630 00000 n 
-0000028755 00000 n 
-0000044086 00000 n 
-0000031980 00000 n 
-0000031421 00000 n 
-0000028942 00000 n 
-0000031543 00000 n 
-0000031668 00000 n 
-0000031793 00000 n 
-0000031917 00000 n 
-0000034866 00000 n 
-0000034059 00000 n 
-0000032091 00000 n 
-0000034181 00000 n 
-0000034306 00000 n 
-0000034431 00000 n 
-0000034556 00000 n 
-0000034678 00000 n 
-0000034803 00000 n 
-0000475896 00000 n 
-0000035902 00000 n 
-0000035592 00000 n 
-0000034951 00000 n 
-0000035714 00000 n 
-0000035839 00000 n 
-0000037955 00000 n 
-0000037270 00000 n 
-0000036000 00000 n 
-0000037392 00000 n 
-0000037517 00000 n 
-0000037641 00000 n 
-0000037766 00000 n 
-0000037892 00000 n 
-0000040964 00000 n 
-0000040097 00000 n 
-0000038053 00000 n 
-0000040398 00000 n 
-0000040524 00000 n 
-0000040587 00000 n 
-0000040649 00000 n 
-0000040239 00000 n 
-0000040775 00000 n 
-0000040901 00000 n 
-0000193010 00000 n 
-0000044275 00000 n 
-0000043838 00000 n 
-0000041075 00000 n 
-0000043960 00000 n 
-0000341929 00000 n 
-0000332620 00000 n 
-0000341752 00000 n 
-0000044212 00000 n 
-0000047975 00000 n 
-0000047790 00000 n 
-0000044399 00000 n 
-0000047912 00000 n 
-0000332177 00000 n 
-0000325378 00000 n 
-0000332000 00000 n 
-0000052340 00000 n 
-0000051949 00000 n 
-0000048138 00000 n 
-0000052277 00000 n 
-0000052091 00000 n 
-0000476014 00000 n 
-0000111622 00000 n 
-0000054540 00000 n 
-0000054103 00000 n 
-0000052477 00000 n 
-0000054225 00000 n 
-0000054351 00000 n 
-0000054414 00000 n 
-0000054477 00000 n 
-0000058064 00000 n 
-0000057026 00000 n 
-0000054664 00000 n 
-0000057498 00000 n 
-0000057624 00000 n 
-0000057750 00000 n 
-0000057176 00000 n 
-0000057337 00000 n 
-0000057875 00000 n 
-0000058001 00000 n 
-0000145272 00000 n 
-0000173890 00000 n 
-0000062635 00000 n 
-0000061718 00000 n 
-0000058162 00000 n 
-0000062194 00000 n 
-0000062320 00000 n 
-0000061868 00000 n 
-0000062033 00000 n 
-0000062446 00000 n 
-0000062572 00000 n 
-0000283043 00000 n 
-0000065550 00000 n 
-0000065178 00000 n 
-0000062785 00000 n 
-0000065487 00000 n 
-0000065320 00000 n 
-0000066735 00000 n 
-0000066550 00000 n 
-0000065674 00000 n 
-0000066672 00000 n 
-0000069873 00000 n 
-0000069185 00000 n 
-0000066833 00000 n 
-0000069307 00000 n 
-0000069433 00000 n 
-0000069559 00000 n 
-0000069684 00000 n 
-0000069810 00000 n 
-0000476132 00000 n 
-0000073253 00000 n 
-0000072376 00000 n 
-0000070010 00000 n 
-0000072686 00000 n 
-0000072812 00000 n 
-0000072938 00000 n 
-0000073064 00000 n 
-0000073190 00000 n 
-0000072518 00000 n 
-0000234127 00000 n 
-0000077362 00000 n 
-0000076675 00000 n 
-0000073390 00000 n 
-0000076797 00000 n 
-0000076923 00000 n 
-0000077049 00000 n 
-0000077174 00000 n 
-0000077299 00000 n 
-0000081063 00000 n 
-0000080503 00000 n 
-0000077486 00000 n 
-0000080625 00000 n 
-0000080750 00000 n 
-0000080876 00000 n 
-0000081000 00000 n 
-0000084064 00000 n 
-0000085763 00000 n 
-0000083942 00000 n 
-0000081187 00000 n 
-0000085700 00000 n 
-0000324543 00000 n 
-0000315683 00000 n 
-0000324371 00000 n 
-0000085532 00000 n 
-0000085589 00000 n 
-0000085678 00000 n 
-0000088757 00000 n 
-0000088015 00000 n 
-0000085915 00000 n 
-0000088316 00000 n 
-0000088442 00000 n 
-0000088157 00000 n 
-0000088568 00000 n 
-0000088694 00000 n 
-0000277948 00000 n 
-0000091444 00000 n 
-0000090881 00000 n 
-0000088881 00000 n 
-0000091003 00000 n 
-0000091129 00000 n 
-0000091255 00000 n 
-0000091381 00000 n 
-0000476250 00000 n 
-0000091876 00000 n 
-0000091691 00000 n 
-0000091542 00000 n 
-0000091813 00000 n 
-0000095816 00000 n 
-0000095068 00000 n 
-0000091917 00000 n 
-0000095376 00000 n 
-0000095502 00000 n 
-0000095627 00000 n 
-0000095690 00000 n 
-0000095753 00000 n 
-0000095210 00000 n 
-0000099772 00000 n 
-0000100085 00000 n 
-0000099524 00000 n 
-0000095914 00000 n 
-0000099646 00000 n 
-0000099896 00000 n 
-0000100022 00000 n 
-0000103619 00000 n 
-0000103056 00000 n 
-0000100222 00000 n 
-0000103178 00000 n 
-0000103304 00000 n 
-0000103430 00000 n 
-0000103556 00000 n 
-0000106231 00000 n 
-0000107470 00000 n 
-0000106109 00000 n 
-0000103730 00000 n 
-0000107156 00000 n 
-0000107282 00000 n 
-0000107345 00000 n 
-0000107408 00000 n 
-0000111685 00000 n 
-0000110872 00000 n 
-0000107622 00000 n 
-0000110994 00000 n 
-0000111120 00000 n 
-0000111244 00000 n 
-0000111307 00000 n 
-0000111370 00000 n 
-0000111496 00000 n 
-0000476368 00000 n 
-0000116693 00000 n 
-0000115127 00000 n 
-0000111796 00000 n 
-0000116126 00000 n 
-0000115301 00000 n 
-0000115451 00000 n 
-0000116252 00000 n 
-0000116378 00000 n 
-0000116504 00000 n 
-0000116630 00000 n 
-0000115609 00000 n 
-0000115760 00000 n 
-0000115944 00000 n 
-0000293458 00000 n 
-0000119887 00000 n 
-0000119324 00000 n 
-0000116830 00000 n 
-0000119446 00000 n 
-0000119572 00000 n 
-0000119698 00000 n 
-0000119824 00000 n 
-0000124398 00000 n 
-0000124213 00000 n 
-0000120024 00000 n 
-0000124335 00000 n 
-0000127433 00000 n 
-0000127063 00000 n 
-0000124509 00000 n 
-0000127370 00000 n 
-0000127205 00000 n 
-0000130233 00000 n 
-0000130422 00000 n 
-0000129985 00000 n 
-0000127544 00000 n 
-0000130107 00000 n 
-0000130296 00000 n 
-0000130359 00000 n 
-0000134138 00000 n 
-0000133370 00000 n 
-0000130533 00000 n 
-0000133823 00000 n 
-0000133949 00000 n 
-0000134075 00000 n 
-0000133520 00000 n 
-0000133671 00000 n 
-0000476486 00000 n 
-0000136120 00000 n 
-0000135557 00000 n 
-0000134249 00000 n 
-0000135679 00000 n 
-0000135805 00000 n 
-0000135931 00000 n 
-0000136057 00000 n 
-0000137666 00000 n 
-0000137481 00000 n 
-0000136231 00000 n 
-0000137603 00000 n 
-0000141301 00000 n 
-0000140990 00000 n 
-0000137764 00000 n 
-0000141112 00000 n 
-0000141238 00000 n 
-0000145334 00000 n 
-0000144849 00000 n 
-0000141425 00000 n 
-0000145146 00000 n 
-0000144991 00000 n 
-0000200850 00000 n 
-0000149374 00000 n 
-0000149063 00000 n 
-0000145458 00000 n 
-0000149185 00000 n 
-0000149248 00000 n 
-0000149311 00000 n 
-0000153964 00000 n 
-0000153073 00000 n 
-0000149485 00000 n 
-0000153901 00000 n 
-0000153239 00000 n 
-0000153392 00000 n 
-0000153548 00000 n 
-0000153730 00000 n 
-0000476604 00000 n 
-0000204498 00000 n 
-0000158684 00000 n 
-0000158103 00000 n 
-0000154129 00000 n 
-0000158621 00000 n 
-0000158253 00000 n 
-0000158437 00000 n 
-0000162978 00000 n 
-0000162353 00000 n 
-0000158821 00000 n 
-0000162663 00000 n 
-0000162789 00000 n 
-0000162495 00000 n 
-0000162915 00000 n 
-0000213876 00000 n 
-0000167245 00000 n 
-0000166445 00000 n 
-0000163102 00000 n 
-0000166930 00000 n 
-0000167056 00000 n 
-0000166595 00000 n 
-0000166760 00000 n 
-0000167182 00000 n 
-0000267134 00000 n 
-0000170422 00000 n 
-0000170111 00000 n 
-0000167369 00000 n 
-0000170233 00000 n 
-0000170359 00000 n 
-0000315157 00000 n 
-0000307266 00000 n 
-0000314984 00000 n 
-0000173953 00000 n 
-0000173642 00000 n 
-0000170587 00000 n 
-0000173764 00000 n 
-0000177876 00000 n 
-0000177691 00000 n 
-0000174105 00000 n 
-0000177813 00000 n 
-0000476722 00000 n 
-0000181791 00000 n 
-0000181035 00000 n 
-0000178041 00000 n 
-0000181350 00000 n 
-0000181476 00000 n 
-0000181602 00000 n 
-0000181177 00000 n 
-0000181728 00000 n 
-0000185711 00000 n 
-0000185216 00000 n 
-0000181943 00000 n 
-0000185517 00000 n 
-0000185362 00000 n 
-0000185646 00000 n 
-0000190172 00000 n 
-0000189378 00000 n 
-0000185864 00000 n 
-0000189850 00000 n 
-0000189979 00000 n 
-0000190107 00000 n 
-0000189533 00000 n 
-0000189695 00000 n 
-0000193204 00000 n 
-0000192566 00000 n 
-0000190338 00000 n 
-0000192881 00000 n 
-0000192712 00000 n 
-0000193074 00000 n 
-0000193139 00000 n 
-0000196820 00000 n 
-0000196319 00000 n 
-0000193316 00000 n 
-0000196627 00000 n 
-0000196756 00000 n 
-0000196465 00000 n 
-0000201044 00000 n 
-0000200277 00000 n 
-0000196999 00000 n 
-0000200592 00000 n 
-0000200721 00000 n 
-0000200424 00000 n 
-0000200914 00000 n 
-0000200979 00000 n 
-0000476844 00000 n 
-0000208880 00000 n 
-0000204561 00000 n 
-0000204116 00000 n 
-0000201156 00000 n 
-0000204242 00000 n 
-0000204371 00000 n 
-0000208945 00000 n 
-0000207865 00000 n 
-0000204673 00000 n 
-0000208496 00000 n 
-0000208030 00000 n 
-0000208181 00000 n 
-0000208623 00000 n 
-0000208751 00000 n 
-0000208342 00000 n 
-0000212363 00000 n 
-0000212044 00000 n 
-0000209057 00000 n 
-0000212170 00000 n 
-0000212299 00000 n 
-0000213940 00000 n 
-0000213621 00000 n 
-0000212475 00000 n 
-0000213747 00000 n 
-0000215316 00000 n 
-0000215125 00000 n 
-0000214052 00000 n 
-0000215251 00000 n 
-0000219053 00000 n 
-0000218476 00000 n 
-0000215415 00000 n 
-0000218602 00000 n 
-0000218731 00000 n 
-0000218860 00000 n 
-0000218925 00000 n 
-0000218990 00000 n 
-0000476969 00000 n 
-0000224005 00000 n 
-0000222503 00000 n 
-0000219165 00000 n 
-0000223682 00000 n 
-0000223811 00000 n 
-0000223940 00000 n 
-0000222695 00000 n 
-0000222857 00000 n 
-0000223019 00000 n 
-0000223181 00000 n 
-0000223352 00000 n 
-0000223522 00000 n 
-0000228825 00000 n 
-0000227596 00000 n 
-0000224117 00000 n 
-0000228760 00000 n 
-0000227788 00000 n 
-0000227951 00000 n 
-0000228113 00000 n 
-0000228275 00000 n 
-0000228435 00000 n 
-0000228597 00000 n 
-0000234191 00000 n 
-0000231832 00000 n 
-0000228950 00000 n 
-0000233998 00000 n 
-0000232078 00000 n 
-0000232231 00000 n 
-0000232393 00000 n 
-0000232555 00000 n 
-0000232717 00000 n 
-0000232879 00000 n 
-0000233041 00000 n 
-0000233203 00000 n 
-0000233365 00000 n 
-0000233519 00000 n 
-0000233680 00000 n 
-0000233835 00000 n 
-0000238748 00000 n 
-0000237551 00000 n 
-0000234316 00000 n 
-0000238039 00000 n 
-0000238104 00000 n 
-0000238169 00000 n 
-0000238298 00000 n 
-0000238555 00000 n 
-0000237707 00000 n 
-0000237877 00000 n 
-0000238620 00000 n 
-0000238684 00000 n 
-0000242343 00000 n 
-0000242022 00000 n 
-0000238873 00000 n 
-0000242148 00000 n 
-0000242213 00000 n 
-0000242278 00000 n 
-0000246354 00000 n 
-0000245904 00000 n 
-0000242442 00000 n 
-0000246030 00000 n 
-0000246095 00000 n 
-0000246160 00000 n 
-0000246289 00000 n 
-0000477094 00000 n 
-0000250068 00000 n 
-0000249358 00000 n 
-0000246479 00000 n 
-0000249484 00000 n 
-0000249549 00000 n 
-0000249614 00000 n 
-0000249679 00000 n 
-0000249744 00000 n 
-0000249873 00000 n 
-0000249938 00000 n 
-0000250003 00000 n 
-0000253941 00000 n 
-0000252978 00000 n 
-0000250193 00000 n 
-0000253104 00000 n 
-0000253233 00000 n 
-0000253298 00000 n 
-0000253363 00000 n 
-0000253491 00000 n 
-0000253555 00000 n 
-0000253620 00000 n 
-0000253749 00000 n 
-0000253877 00000 n 
-0000257082 00000 n 
-0000256504 00000 n 
-0000254133 00000 n 
-0000256630 00000 n 
-0000306911 00000 n 
-0000304913 00000 n 
-0000306746 00000 n 
-0000256759 00000 n 
-0000256888 00000 n 
-0000257017 00000 n 
-0000260045 00000 n 
-0000259724 00000 n 
-0000257275 00000 n 
-0000259850 00000 n 
-0000259915 00000 n 
-0000259980 00000 n 
-0000260498 00000 n 
-0000260307 00000 n 
-0000260157 00000 n 
-0000260433 00000 n 
-0000263079 00000 n 
-0000262171 00000 n 
-0000260540 00000 n 
-0000262757 00000 n 
-0000262886 00000 n 
-0000263015 00000 n 
-0000262327 00000 n 
-0000262542 00000 n 
-0000477219 00000 n 
-0000267198 00000 n 
-0000266493 00000 n 
-0000263205 00000 n 
-0000266619 00000 n 
-0000304592 00000 n 
-0000295379 00000 n 
-0000304406 00000 n 
-0000266748 00000 n 
-0000266877 00000 n 
-0000267006 00000 n 
-0000270632 00000 n 
-0000269406 00000 n 
-0000267363 00000 n 
-0000269923 00000 n 
-0000270052 00000 n 
-0000270181 00000 n 
-0000270310 00000 n 
-0000270439 00000 n 
-0000270568 00000 n 
-0000269562 00000 n 
-0000269734 00000 n 
-0000271086 00000 n 
+0000009518 00000 n 
+0000186262 00000 n 
+0000487277 00000 n 
+0000009578 00000 n 
+0000009639 00000 n 
+0000186388 00000 n 
+0000487184 00000 n 
+0000009700 00000 n 
+0000009752 00000 n 
+0000189933 00000 n 
+0000487091 00000 n 
+0000009813 00000 n 
+0000009866 00000 n 
+0000194265 00000 n 
+0000486998 00000 n 
+0000009927 00000 n 
+0000009965 00000 n 
+0000194394 00000 n 
+0000486905 00000 n 
+0000010026 00000 n 
+0000010078 00000 n 
+0000197310 00000 n 
+0000486812 00000 n 
+0000010139 00000 n 
+0000010183 00000 n 
+0000201070 00000 n 
+0000486719 00000 n 
+0000010244 00000 n 
+0000010280 00000 n 
+0000205027 00000 n 
+0000486626 00000 n 
+0000010341 00000 n 
+0000010404 00000 n 
+0000205156 00000 n 
+0000486547 00000 n 
+0000010465 00000 n 
+0000010514 00000 n 
+0000208684 00000 n 
+0000486454 00000 n 
+0000010569 00000 n 
+0000010620 00000 n 
+0000208811 00000 n 
+0000486361 00000 n 
+0000010675 00000 n 
+0000010739 00000 n 
+0000212942 00000 n 
+0000486268 00000 n 
+0000010794 00000 n 
+0000010851 00000 n 
+0000213069 00000 n 
+0000486175 00000 n 
+0000010906 00000 n 
+0000010976 00000 n 
+0000213197 00000 n 
+0000486082 00000 n 
+0000011031 00000 n 
+0000011080 00000 n 
+0000216622 00000 n 
+0000485989 00000 n 
+0000011135 00000 n 
+0000011197 00000 n 
+0000218198 00000 n 
+0000485896 00000 n 
+0000011252 00000 n 
+0000011301 00000 n 
+0000223055 00000 n 
+0000485778 00000 n 
+0000011356 00000 n 
+0000011418 00000 n 
+0000223184 00000 n 
+0000485699 00000 n 
+0000011478 00000 n 
+0000011517 00000 n 
+0000228140 00000 n 
+0000485606 00000 n 
+0000011577 00000 n 
+0000011611 00000 n 
+0000228269 00000 n 
+0000485513 00000 n 
+0000011671 00000 n 
+0000011712 00000 n 
+0000238431 00000 n 
+0000485434 00000 n 
+0000011772 00000 n 
+0000011824 00000 n 
+0000242597 00000 n 
+0000485316 00000 n 
+0000011873 00000 n 
+0000011906 00000 n 
+0000242726 00000 n 
+0000485198 00000 n 
+0000011960 00000 n 
+0000012032 00000 n 
+0000242854 00000 n 
+0000485119 00000 n 
+0000012091 00000 n 
+0000012135 00000 n 
+0000250575 00000 n 
+0000485040 00000 n 
+0000012194 00000 n 
+0000012247 00000 n 
+0000254137 00000 n 
+0000484947 00000 n 
+0000012301 00000 n 
+0000012351 00000 n 
+0000257570 00000 n 
+0000484854 00000 n 
+0000012405 00000 n 
+0000012443 00000 n 
+0000257829 00000 n 
+0000484761 00000 n 
+0000012497 00000 n 
+0000012546 00000 n 
+0000258088 00000 n 
+0000484629 00000 n 
+0000012600 00000 n 
+0000012652 00000 n 
+0000260962 00000 n 
+0000484550 00000 n 
+0000012711 00000 n 
+0000012763 00000 n 
+0000261091 00000 n 
+0000484457 00000 n 
+0000012822 00000 n 
+0000012875 00000 n 
+0000261220 00000 n 
+0000484378 00000 n 
+0000012934 00000 n 
+0000012983 00000 n 
+0000261349 00000 n 
+0000484299 00000 n 
+0000013037 00000 n 
+0000013117 00000 n 
+0000266904 00000 n 
+0000484166 00000 n 
+0000013164 00000 n 
+0000013216 00000 n 
+0000267033 00000 n 
+0000484087 00000 n 
+0000013265 00000 n 
+0000013309 00000 n 
+0000270766 00000 n 
+0000483955 00000 n 
+0000013358 00000 n 
+0000013420 00000 n 
 0000270895 00000 n 
-0000270745 00000 n 
-0000271021 00000 n 
-0000274385 00000 n 
-0000273807 00000 n 
-0000271128 00000 n 
-0000273933 00000 n 
-0000274062 00000 n 
-0000274191 00000 n 
-0000274320 00000 n 
-0000278271 00000 n 
-0000277564 00000 n 
-0000274471 00000 n 
-0000277690 00000 n 
-0000277819 00000 n 
-0000278012 00000 n 
-0000278077 00000 n 
-0000278141 00000 n 
-0000278206 00000 n 
-0000284925 00000 n 
-0000281125 00000 n 
-0000278397 00000 n 
-0000282006 00000 n 
-0000282135 00000 n 
-0000281299 00000 n 
-0000281478 00000 n 
-0000281655 00000 n 
-0000281830 00000 n 
-0000282328 00000 n 
-0000282393 00000 n 
-0000282458 00000 n 
-0000282523 00000 n 
-0000282588 00000 n 
-0000282653 00000 n 
-0000282718 00000 n 
-0000282783 00000 n 
-0000282848 00000 n 
-0000282913 00000 n 
-0000282978 00000 n 
-0000283107 00000 n 
-0000283172 00000 n 
-0000283237 00000 n 
-0000283302 00000 n 
-0000283367 00000 n 
-0000283432 00000 n 
-0000283497 00000 n 
-0000283562 00000 n 
-0000283627 00000 n 
-0000283692 00000 n 
-0000283757 00000 n 
-0000283822 00000 n 
-0000283887 00000 n 
-0000283952 00000 n 
-0000284017 00000 n 
-0000284082 00000 n 
-0000284147 00000 n 
-0000284212 00000 n 
-0000284277 00000 n 
-0000284342 00000 n 
-0000284407 00000 n 
-0000284472 00000 n 
-0000284537 00000 n 
-0000284602 00000 n 
-0000284667 00000 n 
-0000284732 00000 n 
-0000284797 00000 n 
-0000284861 00000 n 
-0000477344 00000 n 
-0000291436 00000 n 
-0000287741 00000 n 
-0000285077 00000 n 
-0000287867 00000 n 
-0000287932 00000 n 
-0000287997 00000 n 
-0000288062 00000 n 
-0000288127 00000 n 
-0000288192 00000 n 
-0000288257 00000 n 
-0000288322 00000 n 
-0000288386 00000 n 
-0000288451 00000 n 
-0000288516 00000 n 
-0000288581 00000 n 
-0000288646 00000 n 
-0000288711 00000 n 
-0000288776 00000 n 
-0000288841 00000 n 
-0000288905 00000 n 
-0000288970 00000 n 
-0000289035 00000 n 
-0000289100 00000 n 
-0000289165 00000 n 
-0000289230 00000 n 
-0000289295 00000 n 
-0000289360 00000 n 
-0000289425 00000 n 
-0000289490 00000 n 
-0000289555 00000 n 
-0000289620 00000 n 
-0000289685 00000 n 
-0000289750 00000 n 
-0000289815 00000 n 
-0000289880 00000 n 
-0000289945 00000 n 
-0000290010 00000 n 
-0000290075 00000 n 
-0000290140 00000 n 
-0000290205 00000 n 
-0000290270 00000 n 
-0000290335 00000 n 
-0000290400 00000 n 
-0000290465 00000 n 
-0000290530 00000 n 
-0000290595 00000 n 
-0000290660 00000 n 
-0000290725 00000 n 
-0000290790 00000 n 
-0000290855 00000 n 
-0000290920 00000 n 
-0000290985 00000 n 
-0000291050 00000 n 
-0000291115 00000 n 
-0000291180 00000 n 
-0000291244 00000 n 
-0000291308 00000 n 
-0000291372 00000 n 
-0000293333 00000 n 
-0000292624 00000 n 
-0000291548 00000 n 
-0000292750 00000 n 
-0000292879 00000 n 
-0000293008 00000 n 
-0000293073 00000 n 
-0000293138 00000 n 
-0000293203 00000 n 
-0000293268 00000 n 
-0000293490 00000 n 
-0000304834 00000 n 
-0000307158 00000 n 
-0000307127 00000 n 
-0000315432 00000 n 
-0000324948 00000 n 
-0000332419 00000 n 
-0000342215 00000 n 
-0000359713 00000 n 
-0000376700 00000 n 
-0000397339 00000 n 
-0000418482 00000 n 
-0000421563 00000 n 
-0000421333 00000 n 
-0000448482 00000 n 
-0000475292 00000 n 
-0000477442 00000 n 
-0000477562 00000 n 
-0000477685 00000 n 
-0000477774 00000 n 
-0000477856 00000 n 
-0000491831 00000 n 
-0000503879 00000 n 
-0000503920 00000 n 
-0000503960 00000 n 
-0000504094 00000 n 
+0000483876 00000 n 
+0000013474 00000 n 
+0000013522 00000 n 
+0000271024 00000 n 
+0000483797 00000 n 
+0000013576 00000 n 
+0000013627 00000 n 
+0000271153 00000 n 
+0000483718 00000 n 
+0000013676 00000 n 
+0000013723 00000 n 
+0000274070 00000 n 
+0000483585 00000 n 
+0000013770 00000 n 
+0000013807 00000 n 
+0000274199 00000 n 
+0000483467 00000 n 
+0000013856 00000 n 
+0000013895 00000 n 
+0000274328 00000 n 
+0000483402 00000 n 
+0000013949 00000 n 
+0000014027 00000 n 
+0000274457 00000 n 
+0000483309 00000 n 
+0000014076 00000 n 
+0000014143 00000 n 
+0000274586 00000 n 
+0000483230 00000 n 
+0000014192 00000 n 
+0000014237 00000 n 
+0000278080 00000 n 
+0000483111 00000 n 
+0000014285 00000 n 
+0000014317 00000 n 
+0000278209 00000 n 
+0000482993 00000 n 
+0000014366 00000 n 
+0000014405 00000 n 
+0000278338 00000 n 
+0000482928 00000 n 
+0000014459 00000 n 
+0000014520 00000 n 
+0000281837 00000 n 
+0000482796 00000 n 
+0000014569 00000 n 
+0000014626 00000 n 
+0000281966 00000 n 
+0000482731 00000 n 
+0000014680 00000 n 
+0000014729 00000 n 
+0000286153 00000 n 
+0000482613 00000 n 
+0000014778 00000 n 
+0000014840 00000 n 
+0000286282 00000 n 
+0000482534 00000 n 
+0000014894 00000 n 
+0000014949 00000 n 
+0000296897 00000 n 
+0000482441 00000 n 
+0000015003 00000 n 
+0000015044 00000 n 
+0000297026 00000 n 
+0000482362 00000 n 
+0000015098 00000 n 
+0000015150 00000 n 
+0000015505 00000 n 
+0000015753 00000 n 
+0000015203 00000 n 
+0000015627 00000 n 
+0000015690 00000 n 
+0000479204 00000 n 
+0000453540 00000 n 
+0000479030 00000 n 
+0000452352 00000 n 
+0000426192 00000 n 
+0000452178 00000 n 
+0000480209 00000 n 
+0000016417 00000 n 
+0000016232 00000 n 
+0000015838 00000 n 
+0000016354 00000 n 
+0000425507 00000 n 
+0000423361 00000 n 
+0000425343 00000 n 
+0000019592 00000 n 
+0000018782 00000 n 
+0000016502 00000 n 
+0000018904 00000 n 
+0000019028 00000 n 
+0000019153 00000 n 
+0000019278 00000 n 
+0000422507 00000 n 
+0000402149 00000 n 
+0000422333 00000 n 
+0000019403 00000 n 
+0000019466 00000 n 
+0000019529 00000 n 
+0000401200 00000 n 
+0000381448 00000 n 
+0000401027 00000 n 
+0000380706 00000 n 
+0000363988 00000 n 
+0000380533 00000 n 
+0000024130 00000 n 
+0000022948 00000 n 
+0000019716 00000 n 
+0000023442 00000 n 
+0000363453 00000 n 
+0000346536 00000 n 
+0000363269 00000 n 
+0000023505 00000 n 
+0000023568 00000 n 
+0000023693 00000 n 
+0000023818 00000 n 
+0000023943 00000 n 
+0000023098 00000 n 
+0000023291 00000 n 
+0000024068 00000 n 
+0000242790 00000 n 
+0000286346 00000 n 
+0000028816 00000 n 
+0000027781 00000 n 
+0000024254 00000 n 
+0000028253 00000 n 
+0000028378 00000 n 
+0000027931 00000 n 
+0000028093 00000 n 
+0000028503 00000 n 
+0000028628 00000 n 
+0000028753 00000 n 
+0000044129 00000 n 
+0000031978 00000 n 
+0000031419 00000 n 
+0000028940 00000 n 
+0000031541 00000 n 
+0000031666 00000 n 
+0000031791 00000 n 
+0000031915 00000 n 
+0000034864 00000 n 
+0000034057 00000 n 
+0000032089 00000 n 
+0000034179 00000 n 
+0000034304 00000 n 
+0000034429 00000 n 
+0000034554 00000 n 
+0000034676 00000 n 
+0000034801 00000 n 
+0000480327 00000 n 
+0000035945 00000 n 
+0000035635 00000 n 
+0000034949 00000 n 
+0000035757 00000 n 
+0000035882 00000 n 
+0000037998 00000 n 
+0000037313 00000 n 
+0000036043 00000 n 
+0000037435 00000 n 
+0000037560 00000 n 
+0000037684 00000 n 
+0000037809 00000 n 
+0000037935 00000 n 
+0000041007 00000 n 
+0000040140 00000 n 
+0000038096 00000 n 
+0000040441 00000 n 
+0000040567 00000 n 
+0000040630 00000 n 
+0000040692 00000 n 
+0000040282 00000 n 
+0000040818 00000 n 
+0000040944 00000 n 
+0000197374 00000 n 
+0000044318 00000 n 
+0000043881 00000 n 
+0000041118 00000 n 
+0000044003 00000 n 
+0000346009 00000 n 
+0000336700 00000 n 
+0000345832 00000 n 
+0000044255 00000 n 
+0000048018 00000 n 
+0000047833 00000 n 
+0000044442 00000 n 
+0000047955 00000 n 
+0000336257 00000 n 
+0000329458 00000 n 
+0000336080 00000 n 
+0000052383 00000 n 
+0000051992 00000 n 
+0000048181 00000 n 
+0000052320 00000 n 
+0000052134 00000 n 
+0000480445 00000 n 
+0000111974 00000 n 
+0000054583 00000 n 
+0000054146 00000 n 
+0000052520 00000 n 
+0000054268 00000 n 
+0000054394 00000 n 
+0000054457 00000 n 
+0000054520 00000 n 
+0000058107 00000 n 
+0000057069 00000 n 
+0000054707 00000 n 
+0000057541 00000 n 
+0000057667 00000 n 
+0000057793 00000 n 
+0000057219 00000 n 
+0000057380 00000 n 
+0000057918 00000 n 
+0000058044 00000 n 
+0000149936 00000 n 
+0000174710 00000 n 
+0000062678 00000 n 
+0000061761 00000 n 
+0000058205 00000 n 
+0000062237 00000 n 
+0000062363 00000 n 
+0000061911 00000 n 
+0000062076 00000 n 
+0000062489 00000 n 
+0000062615 00000 n 
+0000287125 00000 n 
+0000065593 00000 n 
+0000065221 00000 n 
+0000062828 00000 n 
+0000065530 00000 n 
+0000065363 00000 n 
+0000066778 00000 n 
+0000066593 00000 n 
+0000065717 00000 n 
+0000066715 00000 n 
+0000069916 00000 n 
+0000069228 00000 n 
+0000066876 00000 n 
+0000069350 00000 n 
+0000069476 00000 n 
+0000069602 00000 n 
+0000069727 00000 n 
+0000069853 00000 n 
+0000480563 00000 n 
+0000073296 00000 n 
+0000072419 00000 n 
+0000070053 00000 n 
+0000072729 00000 n 
+0000072855 00000 n 
+0000072981 00000 n 
+0000073107 00000 n 
+0000073233 00000 n 
+0000072561 00000 n 
+0000238495 00000 n 
+0000077405 00000 n 
+0000076718 00000 n 
+0000073433 00000 n 
+0000076840 00000 n 
+0000076966 00000 n 
+0000077092 00000 n 
+0000077217 00000 n 
+0000077342 00000 n 
+0000081106 00000 n 
+0000080546 00000 n 
+0000077529 00000 n 
+0000080668 00000 n 
+0000080793 00000 n 
+0000080919 00000 n 
+0000081043 00000 n 
+0000084107 00000 n 
+0000085806 00000 n 
+0000083985 00000 n 
+0000081230 00000 n 
+0000085743 00000 n 
+0000328623 00000 n 
+0000319765 00000 n 
+0000328451 00000 n 
+0000085575 00000 n 
+0000085632 00000 n 
+0000085721 00000 n 
+0000088800 00000 n 
+0000088058 00000 n 
+0000085958 00000 n 
+0000088359 00000 n 
+0000088485 00000 n 
+0000088200 00000 n 
+0000088611 00000 n 
+0000088737 00000 n 
+0000282030 00000 n 
+0000091487 00000 n 
+0000090924 00000 n 
+0000088924 00000 n 
+0000091046 00000 n 
+0000091172 00000 n 
+0000091298 00000 n 
+0000091424 00000 n 
+0000480681 00000 n 
+0000091919 00000 n 
+0000091734 00000 n 
+0000091585 00000 n 
+0000091856 00000 n 
+0000095859 00000 n 
+0000095111 00000 n 
+0000091960 00000 n 
+0000095419 00000 n 
+0000095545 00000 n 
+0000095670 00000 n 
+0000095733 00000 n 
+0000095796 00000 n 
+0000095253 00000 n 
+0000100231 00000 n 
+0000100546 00000 n 
+0000099983 00000 n 
+0000095957 00000 n 
+0000100105 00000 n 
+0000100357 00000 n 
+0000100483 00000 n 
+0000104153 00000 n 
+0000103591 00000 n 
+0000100670 00000 n 
+0000103713 00000 n 
+0000103838 00000 n 
+0000103964 00000 n 
+0000104090 00000 n 
+0000106908 00000 n 
+0000108148 00000 n 
+0000106786 00000 n 
+0000104277 00000 n 
+0000107833 00000 n 
+0000107959 00000 n 
+0000108022 00000 n 
+0000108085 00000 n 
+0000112037 00000 n 
+0000111222 00000 n 
+0000108300 00000 n 
+0000111344 00000 n 
+0000111470 00000 n 
+0000111596 00000 n 
+0000111659 00000 n 
+0000111722 00000 n 
+0000111848 00000 n 
+0000480799 00000 n 
+0000117041 00000 n 
+0000115670 00000 n 
+0000112148 00000 n 
+0000116476 00000 n 
+0000115836 00000 n 
+0000115986 00000 n 
+0000116602 00000 n 
+0000116728 00000 n 
+0000116854 00000 n 
+0000116980 00000 n 
+0000116144 00000 n 
+0000116293 00000 n 
+0000297540 00000 n 
+0000120344 00000 n 
+0000119702 00000 n 
+0000117178 00000 n 
+0000120030 00000 n 
+0000119844 00000 n 
+0000120156 00000 n 
+0000120282 00000 n 
+0000124968 00000 n 
+0000124657 00000 n 
+0000120468 00000 n 
+0000124779 00000 n 
+0000124905 00000 n 
+0000128122 00000 n 
+0000127751 00000 n 
+0000125092 00000 n 
+0000128059 00000 n 
+0000127893 00000 n 
+0000131063 00000 n 
+0000131251 00000 n 
+0000130815 00000 n 
+0000128233 00000 n 
+0000130937 00000 n 
+0000131126 00000 n 
+0000131188 00000 n 
+0000134967 00000 n 
+0000134199 00000 n 
+0000131362 00000 n 
+0000134652 00000 n 
+0000134778 00000 n 
+0000134904 00000 n 
+0000134349 00000 n 
+0000134500 00000 n 
+0000480917 00000 n 
+0000136949 00000 n 
+0000136386 00000 n 
+0000135078 00000 n 
+0000136508 00000 n 
+0000136634 00000 n 
+0000136760 00000 n 
+0000136886 00000 n 
+0000138488 00000 n 
+0000138303 00000 n 
+0000137060 00000 n 
+0000138425 00000 n 
+0000141958 00000 n 
+0000141647 00000 n 
+0000138586 00000 n 
+0000141769 00000 n 
+0000141895 00000 n 
+0000146033 00000 n 
+0000145673 00000 n 
+0000142082 00000 n 
+0000145970 00000 n 
+0000145815 00000 n 
+0000205220 00000 n 
+0000150125 00000 n 
+0000149688 00000 n 
+0000146157 00000 n 
+0000149810 00000 n 
+0000149999 00000 n 
+0000150062 00000 n 
+0000154198 00000 n 
+0000153679 00000 n 
+0000150236 00000 n 
+0000154135 00000 n 
+0000153829 00000 n 
+0000153981 00000 n 
+0000481035 00000 n 
+0000159353 00000 n 
+0000158402 00000 n 
+0000154363 00000 n 
+0000159290 00000 n 
+0000158568 00000 n 
+0000158752 00000 n 
+0000158925 00000 n 
+0000159107 00000 n 
+0000208875 00000 n 
+0000163746 00000 n 
+0000163121 00000 n 
+0000159503 00000 n 
+0000163431 00000 n 
+0000163557 00000 n 
+0000163263 00000 n 
+0000163683 00000 n 
+0000218262 00000 n 
+0000168067 00000 n 
+0000167269 00000 n 
+0000163870 00000 n 
+0000167754 00000 n 
+0000167879 00000 n 
+0000167419 00000 n 
+0000167584 00000 n 
+0000168004 00000 n 
+0000271216 00000 n 
+0000171290 00000 n 
+0000170979 00000 n 
+0000168191 00000 n 
+0000171101 00000 n 
+0000171227 00000 n 
+0000174773 00000 n 
+0000174462 00000 n 
+0000171401 00000 n 
+0000174584 00000 n 
+0000319239 00000 n 
+0000311348 00000 n 
+0000319066 00000 n 
+0000178624 00000 n 
+0000178439 00000 n 
+0000174938 00000 n 
+0000178561 00000 n 
+0000481153 00000 n 
+0000182213 00000 n 
+0000181722 00000 n 
+0000178735 00000 n 
+0000182024 00000 n 
+0000182150 00000 n 
+0000181864 00000 n 
+0000186515 00000 n 
+0000185715 00000 n 
+0000182378 00000 n 
+0000186198 00000 n 
+0000186325 00000 n 
+0000185868 00000 n 
+0000186451 00000 n 
+0000186043 00000 n 
+0000190062 00000 n 
+0000189743 00000 n 
+0000186626 00000 n 
+0000189868 00000 n 
+0000189997 00000 n 
+0000194522 00000 n 
+0000193727 00000 n 
+0000190215 00000 n 
+0000194200 00000 n 
+0000194329 00000 n 
+0000194457 00000 n 
+0000193882 00000 n 
+0000194044 00000 n 
+0000197568 00000 n 
+0000196929 00000 n 
+0000194688 00000 n 
+0000197245 00000 n 
+0000197075 00000 n 
+0000197438 00000 n 
+0000197503 00000 n 
+0000201198 00000 n 
+0000200697 00000 n 
+0000197680 00000 n 
+0000201005 00000 n 
+0000201134 00000 n 
+0000200844 00000 n 
+0000481274 00000 n 
+0000205414 00000 n 
+0000204649 00000 n 
+0000201377 00000 n 
+0000204962 00000 n 
+0000205091 00000 n 
+0000204796 00000 n 
+0000205284 00000 n 
+0000205349 00000 n 
+0000213261 00000 n 
+0000208938 00000 n 
+0000208493 00000 n 
+0000205526 00000 n 
+0000208619 00000 n 
+0000208748 00000 n 
+0000213326 00000 n 
+0000212249 00000 n 
+0000209050 00000 n 
+0000212877 00000 n 
+0000212414 00000 n 
+0000212564 00000 n 
+0000213004 00000 n 
+0000213132 00000 n 
+0000212723 00000 n 
+0000216750 00000 n 
+0000216431 00000 n 
+0000213438 00000 n 
+0000216557 00000 n 
+0000216686 00000 n 
+0000218326 00000 n 
+0000218007 00000 n 
+0000216862 00000 n 
+0000218133 00000 n 
+0000219706 00000 n 
+0000219515 00000 n 
+0000218438 00000 n 
+0000219641 00000 n 
+0000481399 00000 n 
+0000223441 00000 n 
+0000222864 00000 n 
+0000219805 00000 n 
+0000222990 00000 n 
+0000223119 00000 n 
+0000223248 00000 n 
+0000223313 00000 n 
+0000223378 00000 n 
+0000228398 00000 n 
+0000226897 00000 n 
+0000223553 00000 n 
+0000228075 00000 n 
+0000228204 00000 n 
+0000228333 00000 n 
+0000227089 00000 n 
+0000227251 00000 n 
+0000227413 00000 n 
+0000227575 00000 n 
+0000227745 00000 n 
+0000227915 00000 n 
+0000233202 00000 n 
+0000231975 00000 n 
+0000228510 00000 n 
+0000233137 00000 n 
+0000232167 00000 n 
+0000232328 00000 n 
+0000232490 00000 n 
+0000232652 00000 n 
+0000232812 00000 n 
+0000232974 00000 n 
+0000238559 00000 n 
+0000236211 00000 n 
+0000233327 00000 n 
+0000238366 00000 n 
+0000236457 00000 n 
+0000236611 00000 n 
+0000236773 00000 n 
+0000236935 00000 n 
+0000237095 00000 n 
+0000237255 00000 n 
+0000237417 00000 n 
+0000237577 00000 n 
+0000237736 00000 n 
+0000237889 00000 n 
+0000238052 00000 n 
+0000238203 00000 n 
+0000243111 00000 n 
+0000241915 00000 n 
+0000238684 00000 n 
+0000242402 00000 n 
+0000242467 00000 n 
+0000242532 00000 n 
+0000242661 00000 n 
+0000242918 00000 n 
+0000242071 00000 n 
+0000242241 00000 n 
+0000242983 00000 n 
+0000243047 00000 n 
+0000246703 00000 n 
+0000246382 00000 n 
+0000243236 00000 n 
+0000246508 00000 n 
+0000246573 00000 n 
+0000246638 00000 n 
+0000481524 00000 n 
+0000250703 00000 n 
+0000250255 00000 n 
+0000246802 00000 n 
+0000250381 00000 n 
+0000250446 00000 n 
+0000250510 00000 n 
+0000250638 00000 n 
+0000254396 00000 n 
+0000253687 00000 n 
+0000250828 00000 n 
+0000253813 00000 n 
+0000253878 00000 n 
+0000253942 00000 n 
+0000254007 00000 n 
+0000254072 00000 n 
+0000254201 00000 n 
+0000254266 00000 n 
+0000254331 00000 n 
+0000258217 00000 n 
+0000257379 00000 n 
+0000254521 00000 n 
+0000257505 00000 n 
+0000257634 00000 n 
+0000257699 00000 n 
+0000257764 00000 n 
+0000257893 00000 n 
+0000257958 00000 n 
+0000258023 00000 n 
+0000258152 00000 n 
+0000261478 00000 n 
+0000260771 00000 n 
+0000258396 00000 n 
+0000260897 00000 n 
+0000261026 00000 n 
+0000310993 00000 n 
+0000308995 00000 n 
+0000310828 00000 n 
+0000261155 00000 n 
+0000261284 00000 n 
+0000261413 00000 n 
+0000264497 00000 n 
+0000264176 00000 n 
+0000261671 00000 n 
+0000264302 00000 n 
+0000264367 00000 n 
+0000264432 00000 n 
+0000267161 00000 n 
+0000266253 00000 n 
+0000264622 00000 n 
+0000266839 00000 n 
+0000266968 00000 n 
+0000267097 00000 n 
+0000266409 00000 n 
+0000266624 00000 n 
+0000481649 00000 n 
+0000271280 00000 n 
+0000270575 00000 n 
+0000267287 00000 n 
+0000270701 00000 n 
+0000308674 00000 n 
+0000299461 00000 n 
+0000308488 00000 n 
+0000270830 00000 n 
+0000270959 00000 n 
+0000271088 00000 n 
+0000274714 00000 n 
+0000273488 00000 n 
+0000271445 00000 n 
+0000274005 00000 n 
+0000274134 00000 n 
+0000274263 00000 n 
+0000274392 00000 n 
+0000274521 00000 n 
+0000274650 00000 n 
+0000273644 00000 n 
+0000273816 00000 n 
+0000275168 00000 n 
+0000274977 00000 n 
+0000274827 00000 n 
+0000275103 00000 n 
+0000278467 00000 n 
+0000277889 00000 n 
+0000275210 00000 n 
+0000278015 00000 n 
+0000278144 00000 n 
+0000278273 00000 n 
+0000278402 00000 n 
+0000282353 00000 n 
+0000281646 00000 n 
+0000278553 00000 n 
+0000281772 00000 n 
+0000281901 00000 n 
+0000282094 00000 n 
+0000282159 00000 n 
+0000282223 00000 n 
+0000282288 00000 n 
+0000289007 00000 n 
+0000285207 00000 n 
+0000282479 00000 n 
+0000286088 00000 n 
+0000286217 00000 n 
+0000285381 00000 n 
+0000285560 00000 n 
+0000285737 00000 n 
+0000285912 00000 n 
+0000286410 00000 n 
+0000286475 00000 n 
+0000286540 00000 n 
+0000286605 00000 n 
+0000286670 00000 n 
+0000286735 00000 n 
+0000286800 00000 n 
+0000286865 00000 n 
+0000286930 00000 n 
+0000286995 00000 n 
+0000287060 00000 n 
+0000287189 00000 n 
+0000287254 00000 n 
+0000287319 00000 n 
+0000287384 00000 n 
+0000287449 00000 n 
+0000287514 00000 n 
+0000287579 00000 n 
+0000287644 00000 n 
+0000287709 00000 n 
+0000287774 00000 n 
+0000287839 00000 n 
+0000287904 00000 n 
+0000287969 00000 n 
+0000288034 00000 n 
+0000288099 00000 n 
+0000288164 00000 n 
+0000288229 00000 n 
+0000288294 00000 n 
+0000288359 00000 n 
+0000288424 00000 n 
+0000288489 00000 n 
+0000288554 00000 n 
+0000288619 00000 n 
+0000288684 00000 n 
+0000288749 00000 n 
+0000288814 00000 n 
+0000288879 00000 n 
+0000288943 00000 n 
+0000481774 00000 n 
+0000295518 00000 n 
+0000291823 00000 n 
+0000289159 00000 n 
+0000291949 00000 n 
+0000292014 00000 n 
+0000292079 00000 n 
+0000292144 00000 n 
+0000292209 00000 n 
+0000292274 00000 n 
+0000292339 00000 n 
+0000292404 00000 n 
+0000292468 00000 n 
+0000292533 00000 n 
+0000292598 00000 n 
+0000292663 00000 n 
+0000292728 00000 n 
+0000292793 00000 n 
+0000292858 00000 n 
+0000292923 00000 n 
+0000292987 00000 n 
+0000293052 00000 n 
+0000293117 00000 n 
+0000293182 00000 n 
+0000293247 00000 n 
+0000293312 00000 n 
+0000293377 00000 n 
+0000293442 00000 n 
+0000293507 00000 n 
+0000293572 00000 n 
+0000293637 00000 n 
+0000293702 00000 n 
+0000293767 00000 n 
+0000293832 00000 n 
+0000293897 00000 n 
+0000293962 00000 n 
+0000294027 00000 n 
+0000294092 00000 n 
+0000294157 00000 n 
+0000294222 00000 n 
+0000294287 00000 n 
+0000294352 00000 n 
+0000294417 00000 n 
+0000294482 00000 n 
+0000294547 00000 n 
+0000294612 00000 n 
+0000294677 00000 n 
+0000294742 00000 n 
+0000294807 00000 n 
+0000294872 00000 n 
+0000294937 00000 n 
+0000295002 00000 n 
+0000295067 00000 n 
+0000295132 00000 n 
+0000295197 00000 n 
+0000295262 00000 n 
+0000295326 00000 n 
+0000295390 00000 n 
+0000295454 00000 n 
+0000297415 00000 n 
+0000296706 00000 n 
+0000295630 00000 n 
+0000296832 00000 n 
+0000296961 00000 n 
+0000297090 00000 n 
+0000297155 00000 n 
+0000297220 00000 n 
+0000297285 00000 n 
+0000297350 00000 n 
+0000297572 00000 n 
+0000308916 00000 n 
+0000311240 00000 n 
+0000311209 00000 n 
+0000319514 00000 n 
+0000329028 00000 n 
+0000336499 00000 n 
+0000346295 00000 n 
+0000363793 00000 n 
+0000381125 00000 n 
+0000401768 00000 n 
+0000422911 00000 n 
+0000425994 00000 n 
+0000425764 00000 n 
+0000452913 00000 n 
+0000479723 00000 n 
+0000481872 00000 n 
+0000481992 00000 n 
+0000482115 00000 n 
+0000482204 00000 n 
+0000482286 00000 n 
+0000496261 00000 n 
+0000508315 00000 n 
+0000508356 00000 n 
+0000508396 00000 n 
+0000508530 00000 n 
 trailer
 <<
-/Size 1373
-/Root 1371 0 R
-/Info 1372 0 R
-/ID [<01CCFD1E5FBF13DF94A8F939D2FB9838> <01CCFD1E5FBF13DF94A8F939D2FB9838>]
+/Size 1374
+/Root 1372 0 R
+/Info 1373 0 R
+/ID [<849C0367ACB409D7EBB4F8D7A4BA6CDD> <849C0367ACB409D7EBB4F8D7A4BA6CDD>]
 >>
 startxref
-504352
+508788
 %%EOF
diff --git a/doc/misc/options b/doc/misc/options
index a1bcf779a3bf0..792b7986f21fb 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -19,7 +19,8 @@ key  {
 logging {
         category  { ; ... };
         channel  {
-                file ;
+                file  [ versions ( "unlimited" |  )
+                    ] [ size  ];
                 null;
                 print-category ;
                 print-severity ;
@@ -38,8 +39,8 @@ lwres {
         view  ;
 };
 
-masters  [ port  ] { (  |  [port
-    ] |  [port ] ) [ key  ]; ... };
+masters  [ port  ] { (  |  [ port
+     ] |  [ port  ] ) [ key  ]; ... };
 
 options {
         additional-from-auth ;
@@ -56,8 +57,8 @@ options {
         alt-transfer-source-v6 (  | * ) [ port (  |
             * ) ];
         auth-nxdomain ; // default changed
-        avoid-v4-udp-ports { ; ... };
-        avoid-v6-udp-ports { ; ... };
+        avoid-v4-udp-ports { ; ... };
+        avoid-v6-udp-ports { ; ... };
         blackhole { ; ... };
         cache-file ;
         check-names ( master | slave | response ) ( fail | warn | ignore );
@@ -71,9 +72,9 @@ options {
         dnssec-enable ;
         dnssec-lookaside  trust-anchor ;
         dnssec-must-be-secure  ;
-        dual-stack-servers [ port  ] { (  [port
-            ] |  [port ] | 
-            [port ] ); ... };
+        dual-stack-servers [ port  ] { (  [ port
+             ] |  [ port  ] |
+             [ port  ] ); ... };
         dump-file ;
         edns-udp-size ;
         fake-iquery ; // obsolete
@@ -130,6 +131,7 @@ options {
         recursion ;
         recursive-clients ;
         request-ixfr ;
+        reserved-sockets ;
         rfc2308-type1 ; // not yet implemented
         root-delegation-only [ exclude { ; ... } ];
         rrset-order { [ class  ] [ type  ] [ name
@@ -159,6 +161,8 @@ options {
         use-alt-transfer-source ;
         use-id-pool ; // obsolete
         use-ixfr ;
+        use-v4-udp-ports { ; ... };
+        use-v6-udp-ports { ; ... };
         version (  | none );
         zone-statistics ;
 };
@@ -201,9 +205,9 @@ view   {
         dnssec-enable ;
         dnssec-lookaside  trust-anchor ;
         dnssec-must-be-secure  ;
-        dual-stack-servers [ port  ] { (  [port
-            ] |  [port ] | 
-            [port ] ); ... };
+        dual-stack-servers [ port  ] { (  [ port
+             ] |  [ port  ] |
+             [ port  ] ); ... };
         edns-udp-size ;
         fetch-glue ; // obsolete
         forward ( first | only );
@@ -298,9 +302,9 @@ view   {
                 ixfr-tmp-file ; // obsolete
                 key-directory ;
                 maintain-ixfr-base ; // obsolete
-                masters [ port  ] { (  | 
-                    [port ] |  [port ] ) [
-                    key  ]; ... };
+                masters [ port  ] { (  |  [
+                    port  ] |  [ port  ] )
+                    [ key  ]; ... };
                 max-ixfr-log-size ; // obsolete
                 max-journal-size ;
                 max-refresh-time ;
@@ -359,9 +363,9 @@ zone   {
         ixfr-tmp-file ; // obsolete
         key-directory ;
         maintain-ixfr-base ; // obsolete
-        masters [ port  ] { (  |  [port
-            ] |  [port ] ) [ key 
-            ]; ... };
+        masters [ port  ] { (  |  [ port
+             ] |  [ port  ] ) [ key
+             ]; ... };
         max-ixfr-log-size ; // obsolete
         max-journal-size ;
         max-refresh-time ;
diff --git a/doc/rfc/index b/doc/rfc/index
index 990d4a90be042..fea5f71819287 100644
--- a/doc/rfc/index
+++ b/doc/rfc/index
@@ -9,7 +9,7 @@
 1183:	New DNS RR Definitions (AFSDB, RP, X25, ISDN and RT)
 1348:	DNS NSAP RRs
 1535:	A Security Problem and Proposed Correction
-	   With Widely Deployed DNS Software
+	 With Widely Deployed DNS Software
 1536:	Common DNS Implementation Errors and Suggested Fixes
 1537:	Common DNS Data File Configuration Errors
 1591:	Domain Name System Structure and Delegation
@@ -63,6 +63,7 @@
 2931:	DNS Request and Transaction Signatures ( SIG(0)s )
 3007:	Secure Domain Name System (DNS) Dynamic Update
 3008:	Domain Name System Security (DNSSEC) Signing Authority
+3056:	Connection of IPv6 Domains via IPv4 Clouds
 3071:	Reflections on the DNS, RFC 1591, and Categories of Domains
 3090:	DNS Security Extension Clarification on Zone Status
 3110:	RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)
@@ -81,17 +82,17 @@
 3490:	Internationalizing Domain Names In Applications (IDNA)
 3491:	Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)
 3492:	Punycode:A Bootstring encoding of Unicode for
-	  Internationalized Domain Names in Applications (IDNA)
+	 Internationalized Domain Names in Applications (IDNA)
 3493:	Basic Socket Interface Extensions for IPv6
 3513:	Internet Protocol Version 6 (IPv6) Addressing Architecture
 3596:	DNS Extensions to Support IP Version 6
 3597:	Handling of Unknown DNS Resource Record (RR) Types
 3645:	Generic Security Service Algorithm for
-	  Secret Key Transaction Authentication for DNS (GSS-TSIG)
+	 Secret Key Transaction Authentication for DNS (GSS-TSIG)
 3655:	Redefinition of DNS Authenticated Data (AD) bit
 3658:	Delegation Signer (DS) Resource Record (RR)
 3757:	Domain Name System KEY (DNSKEY) Resource Record (RR)
-	  Secure Entry Point (SEP) Flag
+	 Secure Entry Point (SEP) Flag
 3833:	Threat Analysis of the Domain Name System (DNS)
 3845:	DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format
 3901:	DNS IPv6 Transport Operational Guidelines
@@ -112,3 +113,7 @@
 4470:	Minimally Covering NSEC Records and DNSSEC On-line Signing
 4634:	US Secure Hash Algorithms (SHA and HMAC-SHA)
 4641:	DNSSEC Operational Practices
+4648:	The Base16, Base32, and Base64 Data Encodings
+4701:	A DNS Resource Record (RR) for Encoding
+         Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)
+5155:	DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
diff --git a/doc/rfc/rfc4648.txt b/doc/rfc/rfc4648.txt
new file mode 100644
index 0000000000000..c7599b4330cb8
--- /dev/null
+++ b/doc/rfc/rfc4648.txt
@@ -0,0 +1,1011 @@
+
+
+
+
+
+
+Network Working Group                                       S. Josefsson
+Request for Comments: 4648                                           SJD
+Obsoletes: 3548                                             October 2006
+Category: Standards Track
+
+
+             The Base16, Base32, and Base64 Data Encodings
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2006).
+
+Abstract
+
+   This document describes the commonly used base 64, base 32, and base
+   16 encoding schemes.  It also discusses the use of line-feeds in
+   encoded data, use of padding in encoded data, use of non-alphabet
+   characters in encoded data, use of different encoding alphabets, and
+   canonical encodings.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 1]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+Table of Contents
+
+   1. Introduction ....................................................3
+   2. Conventions Used in This Document ...............................3
+   3. Implementation Discrepancies ....................................3
+      3.1. Line Feeds in Encoded Data .................................3
+      3.2. Padding of Encoded Data ....................................4
+      3.3. Interpretation of Non-Alphabet Characters in Encoded Data ..4
+      3.4. Choosing the Alphabet ......................................4
+      3.5. Canonical Encoding .........................................5
+   4. Base 64 Encoding ................................................5
+   5. Base 64 Encoding with URL and Filename Safe Alphabet ............7
+   6. Base 32 Encoding ................................................8
+   7. Base 32 Encoding with Extended Hex Alphabet ....................10
+   8. Base 16 Encoding ...............................................10
+   9. Illustrations and Examples .....................................11
+   10. Test Vectors ..................................................12
+   11. ISO C99 Implementation of Base64 ..............................14
+   12. Security Considerations .......................................14
+   13. Changes Since RFC 3548 ........................................15
+   14. Acknowledgements ..............................................15
+   15. Copying Conditions ............................................15
+   16. References ....................................................16
+      16.1. Normative References .....................................16
+      16.2. Informative References ...................................16
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 2]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+1.  Introduction
+
+   Base encoding of data is used in many situations to store or transfer
+   data in environments that, perhaps for legacy reasons, are restricted
+   to US-ASCII [1] data.  Base encoding can also be used in new
+   applications that do not have legacy restrictions, simply because it
+   makes it possible to manipulate objects with text editors.
+
+   In the past, different applications have had different requirements
+   and thus sometimes implemented base encodings in slightly different
+   ways.  Today, protocol specifications sometimes use base encodings in
+   general, and "base64" in particular, without a precise description or
+   reference.  Multipurpose Internet Mail Extensions (MIME) [4] is often
+   used as a reference for base64 without considering the consequences
+   for line-wrapping or non-alphabet characters.  The purpose of this
+   specification is to establish common alphabet and encoding
+   considerations.  This will hopefully reduce ambiguity in other
+   documents, leading to better interoperability.
+
+2.  Conventions Used in This Document
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [2].
+
+3.  Implementation Discrepancies
+
+   Here we discuss the discrepancies between base encoding
+   implementations in the past and, where appropriate, mandate a
+   specific recommended behavior for the future.
+
+3.1.  Line Feeds in Encoded Data
+
+   MIME [4] is often used as a reference for base 64 encoding.  However,
+   MIME does not define "base 64" per se, but rather a "base 64 Content-
+   Transfer-Encoding" for use within MIME.  As such, MIME enforces a
+   limit on line length of base 64-encoded data to 76 characters.  MIME
+   inherits the encoding from Privacy Enhanced Mail (PEM) [3], stating
+   that it is "virtually identical"; however, PEM uses a line length of
+   64 characters.  The MIME and PEM limits are both due to limits within
+   SMTP.
+
+   Implementations MUST NOT add line feeds to base-encoded data unless
+   the specification referring to this document explicitly directs base
+   encoders to add line feeds after a specific number of characters.
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 3]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+3.2.  Padding of Encoded Data
+
+   In some circumstances, the use of padding ("=") in base-encoded data
+   is not required or used.  In the general case, when assumptions about
+   the size of transported data cannot be made, padding is required to
+   yield correct decoded data.
+
+   Implementations MUST include appropriate pad characters at the end of
+   encoded data unless the specification referring to this document
+   explicitly states otherwise.
+
+   The base64 and base32 alphabets use padding, as described below in
+   sections 4 and 6, but the base16 alphabet does not need it; see
+   section 8.
+
+3.3.  Interpretation of Non-Alphabet Characters in Encoded Data
+
+   Base encodings use a specific, reduced alphabet to encode binary
+   data.  Non-alphabet characters could exist within base-encoded data,
+   caused by data corruption or by design.  Non-alphabet characters may
+   be exploited as a "covert channel", where non-protocol data can be
+   sent for nefarious purposes.  Non-alphabet characters might also be
+   sent in order to exploit implementation errors leading to, e.g.,
+   buffer overflow attacks.
+
+   Implementations MUST reject the encoded data if it contains
+   characters outside the base alphabet when interpreting base-encoded
+   data, unless the specification referring to this document explicitly
+   states otherwise.  Such specifications may instead state, as MIME
+   does, that characters outside the base encoding alphabet should
+   simply be ignored when interpreting data ("be liberal in what you
+   accept").  Note that this means that any adjacent carriage return/
+   line feed (CRLF) characters constitute "non-alphabet characters" and
+   are ignored.  Furthermore, such specifications MAY ignore the pad
+   character, "=", treating it as non-alphabet data, if it is present
+   before the end of the encoded data.  If more than the allowed number
+   of pad characters is found at the end of the string (e.g., a base 64
+   string terminated with "==="), the excess pad characters MAY also be
+   ignored.
+
+3.4.  Choosing the Alphabet
+
+   Different applications have different requirements on the characters
+   in the alphabet.  Here are a few requirements that determine which
+   alphabet should be used:
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 4]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   o  Handled by humans.  The characters "0" and "O" are easily
+      confused, as are "1", "l", and "I".  In the base32 alphabet below,
+      where 0 (zero) and 1 (one) are not present, a decoder may
+      interpret 0 as O, and 1 as I or L depending on case.  (However, by
+      default it should not; see previous section.)
+
+   o  Encoded into structures that mandate other requirements.  For base
+      16 and base 32, this determines the use of upper- or lowercase
+      alphabets.  For base 64, the non-alphanumeric characters (in
+      particular, "/") may be problematic in file names and URLs.
+
+   o  Used as identifiers.  Certain characters, notably "+" and "/" in
+      the base 64 alphabet, are treated as word-breaks by legacy text
+      search/index tools.
+
+   There is no universally accepted alphabet that fulfills all the
+   requirements.  For an example of a highly specialized variant, see
+   IMAP [8].  In this document, we document and name some currently used
+   alphabets.
+
+3.5.  Canonical Encoding
+
+   The padding step in base 64 and base 32 encoding can, if improperly
+   implemented, lead to non-significant alterations of the encoded data.
+   For example, if the input is only one octet for a base 64 encoding,
+   then all six bits of the first symbol are used, but only the first
+   two bits of the next symbol are used.  These pad bits MUST be set to
+   zero by conforming encoders, which is described in the descriptions
+   on padding below.  If this property do not hold, there is no
+   canonical representation of base-encoded data, and multiple base-
+   encoded strings can be decoded to the same binary data.  If this
+   property (and others discussed in this document) holds, a canonical
+   encoding is guaranteed.
+
+   In some environments, the alteration is critical and therefore
+   decoders MAY chose to reject an encoding if the pad bits have not
+   been set to zero.  The specification referring to this may mandate a
+   specific behaviour.
+
+4.  Base 64 Encoding
+
+   The following description of base 64 is derived from [3], [4], [5],
+   and [6].  This encoding may be referred to as "base64".
+
+   The Base 64 encoding is designed to represent arbitrary sequences of
+   octets in a form that allows the use of both upper- and lowercase
+   letters but that need not be human readable.
+
+
+
+
+Josefsson                   Standards Track                     [Page 5]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   A 65-character subset of US-ASCII is used, enabling 6 bits to be
+   represented per printable character.  (The extra 65th character, "=",
+   is used to signify a special processing function.)
+
+   The encoding process represents 24-bit groups of input bits as output
+   strings of 4 encoded characters.  Proceeding from left to right, a
+   24-bit input group is formed by concatenating 3 8-bit input groups.
+   These 24 bits are then treated as 4 concatenated 6-bit groups, each
+   of which is translated into a single character in the base 64
+   alphabet.
+
+   Each 6-bit group is used as an index into an array of 64 printable
+   characters.  The character referenced by the index is placed in the
+   output string.
+
+                      Table 1: The Base 64 Alphabet
+
+     Value Encoding  Value Encoding  Value Encoding  Value Encoding
+         0 A            17 R            34 i            51 z
+         1 B            18 S            35 j            52 0
+         2 C            19 T            36 k            53 1
+         3 D            20 U            37 l            54 2
+         4 E            21 V            38 m            55 3
+         5 F            22 W            39 n            56 4
+         6 G            23 X            40 o            57 5
+         7 H            24 Y            41 p            58 6
+         8 I            25 Z            42 q            59 7
+         9 J            26 a            43 r            60 8
+        10 K            27 b            44 s            61 9
+        11 L            28 c            45 t            62 +
+        12 M            29 d            46 u            63 /
+        13 N            30 e            47 v
+        14 O            31 f            48 w         (pad) =
+        15 P            32 g            49 x
+        16 Q            33 h            50 y
+
+   Special processing is performed if fewer than 24 bits are available
+   at the end of the data being encoded.  A full encoding quantum is
+   always completed at the end of a quantity.  When fewer than 24 input
+   bits are available in an input group, bits with value zero are added
+   (on the right) to form an integral number of 6-bit groups.  Padding
+   at the end of the data is performed using the '=' character.  Since
+   all base 64 input is an integral number of octets, only the following
+   cases can arise:
+
+   (1) The final quantum of encoding input is an integral multiple of 24
+       bits; here, the final unit of encoded output will be an integral
+       multiple of 4 characters with no "=" padding.
+
+
+
+Josefsson                   Standards Track                     [Page 6]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   (2) The final quantum of encoding input is exactly 8 bits; here, the
+       final unit of encoded output will be two characters followed by
+       two "=" padding characters.
+
+   (3) The final quantum of encoding input is exactly 16 bits; here, the
+       final unit of encoded output will be three characters followed by
+       one "=" padding character.
+
+5.  Base 64 Encoding with URL and Filename Safe Alphabet
+
+   The Base 64 encoding with an URL and filename safe alphabet has been
+   used in [12].
+
+   An alternative alphabet has been suggested that would use "~" as the
+   63rd character.  Since the "~" character has special meaning in some
+   file system environments, the encoding described in this section is
+   recommended instead.  The remaining unreserved URI character is ".",
+   but some file system environments do not permit multiple "." in a
+   filename, thus making the "." character unattractive as well.
+
+   The pad character "=" is typically percent-encoded when used in an
+   URI [9], but if the data length is known implicitly, this can be
+   avoided by skipping the padding; see section 3.2.
+
+   This encoding may be referred to as "base64url".  This encoding
+   should not be regarded as the same as the "base64" encoding and
+   should not be referred to as only "base64".  Unless clarified
+   otherwise, "base64" refers to the base 64 in the previous section.
+
+   This encoding is technically identical to the previous one, except
+   for the 62:nd and 63:rd alphabet character, as indicated in Table 2.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 7]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+         Table 2: The "URL and Filename safe" Base 64 Alphabet
+
+     Value Encoding  Value Encoding  Value Encoding  Value Encoding
+         0 A            17 R            34 i            51 z
+         1 B            18 S            35 j            52 0
+         2 C            19 T            36 k            53 1
+         3 D            20 U            37 l            54 2
+         4 E            21 V            38 m            55 3
+         5 F            22 W            39 n            56 4
+         6 G            23 X            40 o            57 5
+         7 H            24 Y            41 p            58 6
+         8 I            25 Z            42 q            59 7
+         9 J            26 a            43 r            60 8
+        10 K            27 b            44 s            61 9
+        11 L            28 c            45 t            62 - (minus)
+        12 M            29 d            46 u            63 _
+        13 N            30 e            47 v           (underline)
+        14 O            31 f            48 w
+        15 P            32 g            49 x
+        16 Q            33 h            50 y         (pad) =
+
+6.  Base 32 Encoding
+
+   The following description of base 32 is derived from [11] (with
+   corrections).  This encoding may be referred to as "base32".
+
+   The Base 32 encoding is designed to represent arbitrary sequences of
+   octets in a form that needs to be case insensitive but that need not
+   be human readable.
+
+   A 33-character subset of US-ASCII is used, enabling 5 bits to be
+   represented per printable character.  (The extra 33rd character, "=",
+   is used to signify a special processing function.)
+
+   The encoding process represents 40-bit groups of input bits as output
+   strings of 8 encoded characters.  Proceeding from left to right, a
+   40-bit input group is formed by concatenating 5 8bit input groups.
+   These 40 bits are then treated as 8 concatenated 5-bit groups, each
+   of which is translated into a single character in the base 32
+   alphabet.  When a bit stream is encoded via the base 32 encoding, the
+   bit stream must be presumed to be ordered with the most-significant-
+   bit first.  That is, the first bit in the stream will be the high-
+   order bit in the first 8bit byte, the eighth bit will be the low-
+   order bit in the first 8bit byte, and so on.
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 8]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   Each 5-bit group is used as an index into an array of 32 printable
+   characters.  The character referenced by the index is placed in the
+   output string.  These characters, identified in Table 3, below, are
+   selected from US-ASCII digits and uppercase letters.
+
+                     Table 3: The Base 32 Alphabet
+
+     Value Encoding  Value Encoding  Value Encoding  Value Encoding
+         0 A             9 J            18 S            27 3
+         1 B            10 K            19 T            28 4
+         2 C            11 L            20 U            29 5
+         3 D            12 M            21 V            30 6
+         4 E            13 N            22 W            31 7
+         5 F            14 O            23 X
+         6 G            15 P            24 Y         (pad) =
+         7 H            16 Q            25 Z
+         8 I            17 R            26 2
+
+   Special processing is performed if fewer than 40 bits are available
+   at the end of the data being encoded.  A full encoding quantum is
+   always completed at the end of a body.  When fewer than 40 input bits
+   are available in an input group, bits with value zero are added (on
+   the right) to form an integral number of 5-bit groups.  Padding at
+   the end of the data is performed using the "=" character.  Since all
+   base 32 input is an integral number of octets, only the following
+   cases can arise:
+
+   (1) The final quantum of encoding input is an integral multiple of 40
+       bits; here, the final unit of encoded output will be an integral
+       multiple of 8 characters with no "=" padding.
+
+   (2) The final quantum of encoding input is exactly 8 bits; here, the
+       final unit of encoded output will be two characters followed by
+       six "=" padding characters.
+
+   (3) The final quantum of encoding input is exactly 16 bits; here, the
+       final unit of encoded output will be four characters followed by
+       four "=" padding characters.
+
+   (4) The final quantum of encoding input is exactly 24 bits; here, the
+       final unit of encoded output will be five characters followed by
+       three "=" padding characters.
+
+   (5) The final quantum of encoding input is exactly 32 bits; here, the
+       final unit of encoded output will be seven characters followed by
+       one "=" padding character.
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 9]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+7.  Base 32 Encoding with Extended Hex Alphabet
+
+   The following description of base 32 is derived from [7].  This
+   encoding may be referred to as "base32hex".  This encoding should not
+   be regarded as the same as the "base32" encoding and should not be
+   referred to as only "base32".  This encoding is used by, e.g.,
+   NextSECure3 (NSEC3) [10].
+
+   One property with this alphabet, which the base64 and base32
+   alphabets lack, is that encoded data maintains its sort order when
+   the encoded data is compared bit-wise.
+
+   This encoding is identical to the previous one, except for the
+   alphabet.  The new alphabet is found in Table 4.
+
+                 Table 4: The "Extended Hex" Base 32 Alphabet
+
+         Value Encoding  Value Encoding  Value Encoding  Value Encoding
+             0 0             9 9            18 I            27 R
+             1 1            10 A            19 J            28 S
+             2 2            11 B            20 K            29 T
+             3 3            12 C            21 L            30 U
+             4 4            13 D            22 M            31 V
+             5 5            14 E            23 N
+             6 6            15 F            24 O         (pad) =
+             7 7            16 G            25 P
+             8 8            17 H            26 Q
+
+8.  Base 16 Encoding
+
+   The following description is original but analogous to previous
+   descriptions.  Essentially, Base 16 encoding is the standard case-
+   insensitive hex encoding and may be referred to as "base16" or "hex".
+
+   A 16-character subset of US-ASCII is used, enabling 4 bits to be
+   represented per printable character.
+
+   The encoding process represents 8-bit groups (octets) of input bits
+   as output strings of 2 encoded characters.  Proceeding from left to
+   right, an 8-bit input is taken from the input data.  These 8 bits are
+   then treated as 2 concatenated 4-bit groups, each of which is
+   translated into a single character in the base 16 alphabet.
+
+   Each 4-bit group is used as an index into an array of 16 printable
+   characters.  The character referenced by the index is placed in the
+   output string.
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 10]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+                         Table 5: The Base 16 Alphabet
+
+         Value Encoding  Value Encoding  Value Encoding  Value Encoding
+             0 0             4 4             8 8            12 C
+             1 1             5 5             9 9            13 D
+             2 2             6 6            10 A            14 E
+             3 3             7 7            11 B            15 F
+
+   Unlike base 32 and base 64, no special padding is necessary since a
+   full code word is always available.
+
+9.  Illustrations and Examples
+
+   To translate between binary and a base encoding, the input is stored
+   in a structure, and the output is extracted.  The case for base 64 is
+   displayed in the following figure, borrowed from [5].
+
+            +--first octet--+-second octet--+--third octet--+
+            |7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|
+            +-----------+---+-------+-------+---+-----------+
+            |5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|
+            +--1.index--+--2.index--+--3.index--+--4.index--+
+
+   The case for base 32 is shown in the following figure, borrowed from
+   [7].  Each successive character in a base-32 value represents 5
+   successive bits of the underlying octet sequence.  Thus, each group
+   of 8 characters represents a sequence of 5 octets (40 bits).
+
+                        1          2          3
+             01234567 89012345 67890123 45678901 23456789
+            +--------+--------+--------+--------+--------+
+            |< 1 >< 2| >< 3 ><|.4 >< 5.|>< 6 ><.|7 >< 8 >|
+            +--------+--------+--------+--------+--------+
+                                                    <===> 8th character
+                                              <====> 7th character
+                                         <===> 6th character
+                                   <====> 5th character
+                             <====> 4th character
+                        <===> 3rd character
+                  <====> 2nd character
+             <===> 1st character
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 11]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   The following example of Base64 data is from [5], with corrections.
+
+      Input data:  0x14fb9c03d97e
+      Hex:     1   4    f   b    9   c     | 0   3    d   9    7   e
+      8-bit:   00010100 11111011 10011100  | 00000011 11011001 01111110
+      6-bit:   000101 001111 101110 011100 | 000000 111101 100101 111110
+      Decimal: 5      15     46     28       0      61     37     62
+      Output:  F      P      u      c        A      9      l      +
+
+      Input data:  0x14fb9c03d9
+      Hex:     1   4    f   b    9   c     | 0   3    d   9
+      8-bit:   00010100 11111011 10011100  | 00000011 11011001
+                                                      pad with 00
+      6-bit:   000101 001111 101110 011100 | 000000 111101 100100
+      Decimal: 5      15     46     28       0      61     36
+                                                         pad with =
+      Output:  F      P      u      c        A      9      k      =
+
+      Input data:  0x14fb9c03
+      Hex:     1   4    f   b    9   c     | 0   3
+      8-bit:   00010100 11111011 10011100  | 00000011
+                                             pad with 0000
+      6-bit:   000101 001111 101110 011100 | 000000 110000
+      Decimal: 5      15     46     28       0      48
+                                                  pad with =      =
+      Output:  F      P      u      c        A      w      =      =
+
+10.  Test Vectors
+
+   BASE64("") = ""
+
+   BASE64("f") = "Zg=="
+
+   BASE64("fo") = "Zm8="
+
+   BASE64("foo") = "Zm9v"
+
+   BASE64("foob") = "Zm9vYg=="
+
+   BASE64("fooba") = "Zm9vYmE="
+
+   BASE64("foobar") = "Zm9vYmFy"
+
+   BASE32("") = ""
+
+   BASE32("f") = "MY======"
+
+   BASE32("fo") = "MZXQ===="
+
+
+
+Josefsson                   Standards Track                    [Page 12]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   BASE32("foo") = "MZXW6==="
+
+   BASE32("foob") = "MZXW6YQ="
+
+   BASE32("fooba") = "MZXW6YTB"
+
+   BASE32("foobar") = "MZXW6YTBOI======"
+
+   BASE32-HEX("") = ""
+
+   BASE32-HEX("f") = "CO======"
+
+   BASE32-HEX("fo") = "CPNG===="
+
+   BASE32-HEX("foo") = "CPNMU==="
+
+   BASE32-HEX("foob") = "CPNMUOG="
+
+   BASE32-HEX("fooba") = "CPNMUOJ1"
+
+   BASE32-HEX("foobar") = "CPNMUOJ1E8======"
+
+   BASE16("") = ""
+
+   BASE16("f") = "66"
+
+   BASE16("fo") = "666F"
+
+   BASE16("foo") = "666F6F"
+
+   BASE16("foob") = "666F6F62"
+
+   BASE16("fooba") = "666F6F6261"
+
+   BASE16("foobar") = "666F6F626172"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 13]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+11.  ISO C99 Implementation of Base64
+
+   An ISO C99 implementation of Base64 encoding and decoding that is
+   believed to follow all recommendations in this RFC is available from:
+
+      http://josefsson.org/base-encoding/
+
+   This code is not normative.
+
+   The code could not be included in this RFC for procedural reasons
+   (RFC 3978 section 5.4).
+
+12.  Security Considerations
+
+   When base encoding and decoding is implemented, care should be taken
+   not to introduce vulnerabilities to buffer overflow attacks, or other
+   attacks on the implementation.  A decoder should not break on invalid
+   input including, e.g., embedded NUL characters (ASCII 0).
+
+   If non-alphabet characters are ignored, instead of causing rejection
+   of the entire encoding (as recommended), a covert channel that can be
+   used to "leak" information is made possible.  The ignored characters
+   could also be used for other nefarious purposes, such as to avoid a
+   string equality comparison or to trigger implementation bugs.  The
+   implications of ignoring non-alphabet characters should be understood
+   in applications that do not follow the recommended practice.
+   Similarly, when the base 16 and base 32 alphabets are handled case
+   insensitively, alteration of case can be used to leak information or
+   make string equality comparisons fail.
+
+   When padding is used, there are some non-significant bits that
+   warrant security concerns, as they may be abused to leak information
+   or used to bypass string equality comparisons or to trigger
+   implementation problems.
+
+   Base encoding visually hides otherwise easily recognized information,
+   such as passwords, but does not provide any computational
+   confidentiality.  This has been known to cause security incidents
+   when, e.g., a user reports details of a network protocol exchange
+   (perhaps to illustrate some other problem) and accidentally reveals
+   the password because she is unaware that the base encoding does not
+   protect the password.
+
+   Base encoding adds no entropy to the plaintext, but it does increase
+   the amount of plaintext available and provide a signature for
+   cryptanalysis in the form of a characteristic probability
+   distribution.
+
+
+
+
+Josefsson                   Standards Track                    [Page 14]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+13.  Changes Since RFC 3548
+
+   Added the "base32 extended hex alphabet", needed to preserve sort
+   order of encoded data.
+
+   Referenced IMAP for the special Base64 encoding used there.
+
+   Fixed the example copied from RFC 2440.
+
+   Added security consideration about providing a signature for
+   cryptoanalysis.
+
+   Added test vectors.
+
+   Fixed typos.
+
+14.  Acknowledgements
+
+   Several people offered comments and/or suggestions, including John E.
+   Hadstate, Tony Hansen, Gordon Mohr, John Myers, Chris Newman, and
+   Andrew Sieber.  Text used in this document are based on earlier RFCs
+   describing specific uses of various base encodings.  The author
+   acknowledges the RSA Laboratories for supporting the work that led to
+   this document.
+
+   This revised version is based in parts on comments and/or suggestions
+   made by Roy Arends, Eric Blake, Brian E Carpenter, Elwyn Davies, Bill
+   Fenner, Sam Hartman, Ted Hardie, Per Hygum, Jelte Jansen, Clement
+   Kent, Tero Kivinen, Paul Kwiatkowski, and Ben Laurie.
+
+15.  Copying Conditions
+
+   Copyright (c) 2000-2006 Simon Josefsson
+
+   Regarding the abstract and sections 1, 3, 8, 10, 12, 13, and 14 of
+   this document, that were written by Simon Josefsson ("the author",
+   for the remainder of this section), the author makes no guarantees
+   and is not responsible for any damage resulting from its use.  The
+   author grants irrevocable permission to anyone to use, modify, and
+   distribute it in any way that does not diminish the rights of anyone
+   else to use, modify, and distribute it, provided that redistributed
+   derivative works do not contain misleading author or version
+   information and do not falsely purport to be IETF RFC documents.
+   Derivative works need not be licensed under similar terms.
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 15]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+16.  References
+
+16.1.  Normative References
+
+   [1]   Cerf, V., "ASCII format for network interchange", RFC 20,
+         October 1969.
+
+   [2]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
+         Levels", BCP 14, RFC 2119, March 1997.
+
+16.2.  Informative References
+
+   [3]   Linn, J., "Privacy Enhancement for Internet Electronic Mail:
+         Part I: Message Encryption and Authentication Procedures", RFC
+         1421, February 1993.
+
+   [4]   Freed, N. and N. Borenstein, "Multipurpose Internet Mail
+         Extensions (MIME) Part One: Format of Internet Message Bodies",
+         RFC 2045, November 1996.
+
+   [5]   Callas, J., Donnerhacke, L., Finney, H., and R. Thayer,
+         "OpenPGP Message Format", RFC 2440, November 1998.
+
+   [6]   Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+         "DNS Security Introduction and Requirements", RFC 4033, March
+         2005.
+
+   [7]   Klyne, G. and L. Masinter, "Identifying Composite Media
+         Features", RFC 2938, September 2000.
+
+   [8]   Crispin, M., "INTERNET MESSAGE ACCESS PROTOCOL - VERSION
+         4rev1", RFC 3501, March 2003.
+
+   [9]   Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
+         Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986,
+         January 2005.
+
+   [10]  Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNSSEC Hash
+         Authenticated Denial of Existence", Work in Progress, June
+         2006.
+
+   [11]  Myers, J., "SASL GSSAPI mechanisms", Work in Progress, May
+         2000.
+
+   [12]  Wilcox-O'Hearn, B., "Post to P2P-hackers mailing list",
+         http://zgp.org/pipermail/p2p-hackers/2001-September/
+         000315.html, September 2001.
+
+
+
+
+Josefsson                   Standards Track                    [Page 16]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+Author's Address
+
+   Simon Josefsson
+   SJD
+   EMail: simon@josefsson.org
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 17]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+Full Copyright Statement
+
+   Copyright (C) The Internet Society (2006).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
+   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
+   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
+   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is provided by the IETF
+   Administrative Support Activity (IASA).
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 18]
+
diff --git a/doc/rfc/rfc4701.txt b/doc/rfc/rfc4701.txt
new file mode 100644
index 0000000000000..03e3c54376f4b
--- /dev/null
+++ b/doc/rfc/rfc4701.txt
@@ -0,0 +1,675 @@
+
+
+
+
+
+
+Network Working Group                                           M. Stapp
+Request for Comments: 4701                           Cisco Systems, Inc.
+Category: Standards Track                                       T. Lemon
+                                                           Nominum, Inc.
+                                                           A. Gustafsson
+                                          Araneus Information Systems Oy
+                                                            October 2006
+
+
+                A DNS Resource Record (RR) for Encoding
+   Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2006).
+
+Abstract
+
+   It is possible for Dynamic Host Configuration Protocol (DHCP) clients
+   to attempt to update the same DNS Fully Qualified Domain Name (FQDN)
+   or to update a DNS FQDN that has been added to the DNS for another
+   purpose as they obtain DHCP leases.  Whether the DHCP server or the
+   clients themselves perform the DNS updates, conflicts can arise.  To
+   resolve such conflicts, RFC 4703 proposes storing client identifiers
+   in the DNS to unambiguously associate domain names with the DHCP
+   clients to which they refer.  This memo defines a distinct Resource
+   Record (RR) type for this purpose for use by DHCP clients and
+   servers:  the "DHCID" RR.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 1]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+Table of Contents
+
+   1. Introduction ....................................................3
+   2. Terminology .....................................................3
+   3. The DHCID RR ....................................................3
+      3.1. DHCID RDATA Format .........................................3
+      3.2. DHCID Presentation Format ..................................4
+      3.3. The DHCID RR Identifier Type Codes .........................4
+      3.4. The DHCID RR Digest Type Code ..............................4
+      3.5. Computation of the RDATA ...................................5
+           3.5.1. Using the Client's DUID .............................5
+           3.5.2. Using the Client Identifier Option ..................6
+           3.5.3. Using the Client's htype and chaddr .................6
+      3.6. Examples ...................................................6
+           3.6.1. Example 1 ...........................................6
+           3.6.2. Example 2 ...........................................7
+           3.6.3. Example 3 ...........................................7
+   4. Use of the DHCID RR .............................................8
+   5. Updater Behavior ................................................8
+   6. Security Considerations .........................................8
+   7. IANA Considerations .............................................9
+   8. Acknowledgements ................................................9
+   9. References ......................................................9
+      9.1. Normative References .......................................9
+      9.2. Informative References ....................................10
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 2]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+1.  Introduction
+
+   A set of procedures to allow DHCP [7] [11] clients and servers to
+   automatically update the DNS ([3], [4]) is proposed in [1].
+
+   Conflicts can arise if multiple DHCP clients wish to use the same DNS
+   name or a DHCP client attempts to use a name added for another
+   purpose.  To resolve such conflicts, [1] proposes storing client
+   identifiers in the DNS to unambiguously associate domain names with
+   the DHCP clients using them.  In the interest of clarity, it is
+   preferable for this DHCP information to use a distinct RR type.  This
+   memo defines a distinct RR for this purpose for use by DHCP clients
+   or servers: the "DHCID" RR.
+
+   In order to obscure potentially sensitive client identifying
+   information, the data stored is the result of a one-way SHA-256 hash
+   computation.  The hash includes information from the DHCP client's
+   message as well as the domain name itself, so that the data stored in
+   the DHCID RR will be dependent on both the client identification used
+   in the DHCP protocol interaction and the domain name.  This means
+   that the DHCID RDATA will vary if a single client is associated over
+   time with more than one name.  This makes it difficult to 'track' a
+   client as it is associated with various domain names.
+
+2.  Terminology
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [2].
+
+3.  The DHCID RR
+
+   The DHCID RR is defined with mnemonic DHCID and type code 49.  The
+   DHCID RR is only defined in the IN class.  DHCID RRs cause no
+   additional section processing.
+
+3.1.  DHCID RDATA Format
+
+   The RDATA section of a DHCID RR in transmission contains RDLENGTH
+   octets of binary data.  The format of this data and its
+   interpretation by DHCP servers and clients are described below.
+
+   DNS software should consider the RDATA section to be opaque.  DHCP
+   clients or servers use the DHCID RR to associate a DHCP client's
+   identity with a DNS name, so that multiple DHCP clients and servers
+   may deterministically perform dynamic DNS updates to the same zone.
+   From the updater's perspective, the DHCID resource record RDATA
+   consists of a 2-octet identifier type, in network byte order,
+
+
+
+Stapp, et al.               Standards Track                     [Page 3]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+   followed by a 1-octet digest type, followed by one or more octets
+   representing the actual identifier:
+
+           < 2 octets >    Identifier type code
+           < 1 octet >     Digest type code
+           < n octets >    Digest (length depends on digest type)
+
+3.2.  DHCID Presentation Format
+
+   In DNS master files, the RDATA is represented as a single block in
+   base-64 encoding identical to that used for representing binary data
+   in [8], Section 3.  The data may be divided up into any number of
+   white-space-separated substrings, down to single base-64 digits,
+   which are concatenated to form the complete RDATA.  These substrings
+   can span lines using the standard parentheses.
+
+3.3.  The DHCID RR Identifier Type Codes
+
+   The DHCID RR Identifier Type Code specifies what data from the DHCP
+   client's request was used as input into the hash function.  The
+   identifier type codes are defined in a registry maintained by IANA,
+   as specified in Section 7.  The initial list of assigned values for
+   the identifier type code and that type's identifier is:
+
+
+   +------------------+------------------------------------------------+
+   |  Identifier Type | Identifier                                     |
+   |       Code       |                                                |
+   +------------------+------------------------------------------------+
+   |      0x0000      | The 1-octet 'htype' followed by 'hlen' octets  |
+   |                  | of 'chaddr' from a DHCPv4 client's DHCPREQUEST |
+   |                  | [7].                                           |
+   |      0x0001      | The data octets (i.e., the Type and            |
+   |                  | Client-Identifier fields) from a DHCPv4        |
+   |                  | client's Client Identifier option [10].        |
+   |      0x0002      | The client's DUID (i.e., the data octets of a  |
+   |                  | DHCPv6 client's Client Identifier option [11]  |
+   |                  | or the DUID field from a DHCPv4 client's       |
+   |                  | Client Identifier option [6]).                 |
+   |  0x0003 - 0xfffe | Undefined; available to be assigned by IANA.   |
+   |      0xffff      | Undefined; RESERVED.                           |
+   +------------------+------------------------------------------------+
+
+3.4.  The DHCID RR Digest Type Code
+
+   The DHCID RR Digest Type Code is an identifier for the digest
+   algorithm used.  The digest is calculated over an identifier and the
+   canonical FQDN as described in the next section.
+
+
+
+Stapp, et al.               Standards Track                     [Page 4]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+   The digest type codes are defined in a registry maintained by IANA,
+   as specified in Section 7.  The initial list of assigned values for
+   the digest type codes is: value 0 is reserved, and value 1 is
+   SHA-256.  Reserving other types requires IETF standards action.
+   Defining new values will also require IETF standards action to
+   document how DNS updaters are to deal with multiple digest types.
+
+3.5.  Computation of the RDATA
+
+   The DHCID RDATA is formed by concatenating the 2-octet identifier
+   type code with variable-length data.
+
+   The RDATA for all type codes other than 0xffff, which is reserved for
+   future expansion, is formed by concatenating the 2-octet identifier
+   type code, the 1-octet digest type code, and the digest value (32
+   octets for SHA-256).
+
+       < identifier-type > < digest-type > < digest >
+
+   The input to the digest hash function is defined to be:
+
+       digest = SHA-256(< identifier > < FQDN >)
+
+   The FQDN is represented in the buffer in the canonical wire format as
+   described in [9], Section 6.2.  The identifier type code and the
+   identifier are related as specified in Section 3.3: the identifier
+   type code describes the source of the identifier.
+
+   A DHCPv4 updater uses the 0x0002 type code if a Client Identifier
+   option is present in the DHCPv4 messages and it is encoded as
+   specified in [6].  Otherwise, the updater uses 0x0001 if a Client
+   Identifier option is present, and 0x0000 if not.
+
+   A DHCPv6 updater always uses the 0x0002 type code.
+
+3.5.1.  Using the Client's DUID
+
+   When the updater is using the Client's DUID (either from a DHCPv6
+   Client Identifier option or from a portion of the DHCPv4 Client
+   Identifier option encoded as specified in [6]), the first two octets
+   of the DHCID RR MUST be 0x0002, in network byte order.  The third
+   octet is the digest type code (1 for SHA-256).  The rest of the DHCID
+   RR MUST contain the results of computing the SHA-256 hash across the
+   octets of the DUID followed by the FQDN.
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 5]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+3.5.2.  Using the Client Identifier Option
+
+   When the updater is using the DHCPv4 Client Identifier option sent by
+   the client in its DHCPREQUEST message, the first two octets of the
+   DHCID RR MUST be 0x0001, in network byte order.  The third octet is
+   the digest type code (1 for SHA-256).  The rest of the DHCID RR MUST
+   contain the results of computing the SHA-256 hash across the data
+   octets (i.e., the Type and Client-Identifier fields) of the option,
+   followed by the FQDN.
+
+3.5.3.  Using the Client's htype and chaddr
+
+   When the updater is using the client's link-layer address as the
+   identifier, the first two octets of the DHCID RDATA MUST be zero.
+   The third octet is the digest type code (1 for SHA-256).  To generate
+   the rest of the resource record, the updater computes a one-way hash
+   using the SHA-256 algorithm across a buffer containing the client's
+   network hardware type, link-layer address, and the FQDN data.
+   Specifically, the first octet of the buffer contains the network
+   hardware type as it appeared in the DHCP 'htype' field of the
+   client's DHCPREQUEST message.  All of the significant octets of the
+   'chaddr' field in the client's DHCPREQUEST message follow, in the
+   same order in which the octets appear in the DHCPREQUEST message.
+   The number of significant octets in the 'chaddr' field is specified
+   in the 'hlen' field of the DHCPREQUEST message.  The FQDN data, as
+   specified above, follows.
+
+3.6.  Examples
+
+3.6.1.  Example 1
+
+   A DHCP server allocates the IPv6 address 2001:DB8::1234:5678 to a
+   client that included the DHCPv6 client-identifier option data 00:01:
+   00:06:41:2d:f1:66:01:02:03:04:05:06 in its DHCPv6 request.  The
+   server updates the name "chi6.example.com" on the client's behalf and
+   uses the DHCP client identifier option data as input in forming a
+   DHCID RR.  The DHCID RDATA is formed by setting the two type octets
+   to the value 0x0002, the 1-octet digest type to 1 for SHA-256, and
+   performing a SHA-256 hash computation across a buffer containing the
+   14 octets from the client-id option and the FQDN (represented as
+   specified in Section 3.5).
+
+     chi6.example.com.     AAAA    2001:DB8::1234:5678
+     chi6.example.com.     DHCID   ( AAIBY2/AuCccgoJbsaxcQc9TUapptP69l
+                                     OjxfNuVAA2kjEA= )
+
+   If the DHCID RR type is not supported, the RDATA would be encoded
+   [13] as:
+
+
+
+Stapp, et al.               Standards Track                     [Page 6]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+     \# 35 ( 000201636fc0b8271c82825bb1ac5c41cf5351aa69b4febd94e8f17cd
+             b95000da48c40 )
+
+3.6.2.  Example 2
+
+   A DHCP server allocates the IPv4 address 192.0.2.2 to a client that
+   included the DHCP client-identifier option data 01:07:08:09:0a:0b:0c
+   in its DHCP request.  The server updates the name "chi.example.com"
+   on the client's behalf and uses the DHCP client identifier option
+   data as input in forming a DHCID RR.  The DHCID RDATA is formed by
+   setting the two type octets to the value 0x0001, the 1-octet digest
+   type to 1 for SHA-256, and performing a SHA-256 hash computation
+   across a buffer containing the seven octets from the client-id option
+   and the FQDN (represented as specified in Section 3.5).
+
+     chi.example.com.      A       192.0.2.2
+     chi.example.com.      DHCID   ( AAEBOSD+XR3Os/0LozeXVqcNc7FwCfQdW
+                                     L3b/NaiUDlW2No= )
+
+   If the DHCID RR type is not supported, the RDATA would be encoded
+   [13] as:
+
+     \# 35 ( 0001013920fe5d1dceb3fd0ba3379756a70d73b17009f41d58bddbfcd
+             6a2503956d8da )
+
+3.6.3.  Example 3
+
+   A DHCP server allocating the IPv4 address 192.0.2.3 to a client with
+   the Ethernet MAC address 01:02:03:04:05:06 using domain name
+   "client.example.com" uses the client's link-layer address to identify
+   the client.  The DHCID RDATA is composed by setting the two type
+   octets to zero, the 1-octet digest type to 1 for SHA-256, and
+   performing an SHA-256 hash computation across a buffer containing the
+   1-octet 'htype' value for Ethernet, 0x01, followed by the six octets
+   of the Ethernet MAC address, and the domain name (represented as
+   specified in Section 3.5).
+
+     client.example.com.   A       192.0.2.3
+     client.example.com.   DHCID   ( AAABxLmlskllE0MVjd57zHcWmEH3pCQ6V
+                                     ytcKD//7es/deY= )
+
+   If the DHCID RR type is not supported, the RDATA would be encoded
+   [13] as:
+
+     \# 35 ( 000001c4b9a5b249651343158dde7bcc77169841f7a4243a572b5c283
+             fffedeb3f75e6 )
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 7]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+4.  Use of the DHCID RR
+
+   This RR MUST NOT be used for any purpose other than that detailed in
+   [1].  Although this RR contains data that is opaque to DNS servers,
+   the data must be consistent across all entities that update and
+   interpret this record.  Therefore, new data formats may only be
+   defined through actions of the DHC Working Group, as a result of
+   revising [1].
+
+5.  Updater Behavior
+
+   The data in the DHCID RR allows updaters to determine whether more
+   than one DHCP client desires to use a particular FQDN.  This allows
+   site administrators to establish policy about DNS updates.  The DHCID
+   RR does not establish any policy itself.
+
+   Updaters use data from a DHCP client's request and the domain name
+   that the client desires to use to compute a client identity hash, and
+   then compare that hash to the data in any DHCID RRs on the name that
+   they wish to associate with the client's IP address.  If an updater
+   discovers DHCID RRs whose RDATA does not match the client identity
+   that they have computed, the updater SHOULD conclude that a different
+   client is currently associated with the name in question.  The
+   updater SHOULD then proceed according to the site's administrative
+   policy.  That policy might dictate that a different name be selected,
+   or it might permit the updater to continue.
+
+6.  Security Considerations
+
+   The DHCID record as such does not introduce any new security problems
+   into the DNS.  In order to obscure the client's identity information,
+   a one-way hash is used.  Further, in order to make it difficult to
+   'track' a client by examining the names associated with a particular
+   hash value, the FQDN is included in the hash computation.  Thus, the
+   RDATA is dependent on both the DHCP client identification data and on
+   each FQDN associated with the client.
+
+   However, it should be noted that an attacker that has some knowledge,
+   such as of MAC addresses commonly used in DHCP client identification
+   data, may be able to discover the client's DHCP identify by using a
+   brute-force attack.  Even without any additional knowledge, the
+   number of unknown bits used in computing the hash is typically only
+   48 to 80.
+
+   Administrators should be wary of permitting unsecured DNS updates to
+   zones, whether or not they are exposed to the global Internet.  Both
+   DHCP clients and servers SHOULD use some form of update
+   authentication (e.g., [12]) when performing DNS updates.
+
+
+
+Stapp, et al.               Standards Track                     [Page 8]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+7.  IANA Considerations
+
+   IANA has allocated a DNS RR type number for the DHCID record type.
+
+   This specification defines a new number-space for the 2-octet
+   identifier type codes associated with the DHCID RR.  IANA has
+   established a registry of the values for this number-space.  Three
+   initial values are assigned in Section 3.3, and the value 0xFFFF is
+   reserved for future use.  New DHCID RR identifier type codes are
+   assigned through Standards Action, as defined in [5].
+
+   This specification defines a new number-space for the 1-octet digest
+   type codes associated with the DHCID RR.  IANA has established a
+   registry of the values for this number-space.  Two initial values are
+   assigned in Section 3.4.  New DHCID RR digest type codes are assigned
+   through Standards Action, as defined in [5].
+
+8.  Acknowledgements
+
+   Many thanks to Harald Alvestrand, Ralph Droms, Olafur Gudmundsson,
+   Sam Hartman, Josh Littlefield, Pekka Savola, and especially Bernie
+   Volz for their review and suggestions.
+
+9.  References
+
+9.1.  Normative References
+
+   [1]  Stapp, M. and B. Volz, "Resolution of Fully Qualified Domain
+        Name (FQDN) Conflicts among Dynamic Host Configuration Protocol
+        (DHCP) Clients", RFC 4703, October 2006.
+
+   [2]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
+        Levels", BCP 14, RFC 2119, March 1997.
+
+   [3]  Mockapetris, P., "Domain names - concepts and facilities",
+        STD 13, RFC 1034, November 1987.
+
+   [4]  Mockapetris, P., "Domain names - implementation and
+        specification", STD 13, RFC 1035, November 1987.
+
+   [5]  Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA
+        Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
+
+   [6]  Lemon, T. and B. Sommerfeld, "Node-specific Client Identifiers
+        for Dynamic Host Configuration Protocol Version Four (DHCPv4)",
+        RFC 4361, February 2006.
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 9]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+9.2.  Informative References
+
+   [7]   Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
+         March 1997.
+
+   [8]   Josefsson, S., "The Base16, Base32, and Base64 Data Encodings",
+         RFC 3548, July 2003.
+
+   [9]   Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+         "Resource Records for the DNS Security Extensions", RFC 4034,
+         March 2005.
+
+   [10]  Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
+         Extensions", RFC 2132, March 1997.
+
+   [11]  Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., and M.
+         Carney, "Dynamic Host Configuration Protocol for IPv6
+         (DHCPv6)", RFC 3315, July 2003.
+
+   [12]  Vixie, P., Gudmundsson, O., Eastlake, D., and B. Wellington,
+         "Secret Key Transaction Authentication for DNS (TSIG)",
+         RFC 2845, May 2000.
+
+   [13]  Gustafsson, A., "Handling of Unknown DNS Resource Record (RR)
+         Types", RFC 3597, September 2003.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                    [Page 10]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+Authors' Addresses
+
+   Mark Stapp
+   Cisco Systems, Inc.
+   1414 Massachusetts Ave.
+   Boxborough, MA  01719
+   USA
+
+   Phone: 978.936.1535
+   EMail: mjs@cisco.com
+
+
+   Ted Lemon
+   Nominum, Inc.
+   950 Charter St.
+   Redwood City, CA  94063
+   USA
+
+   EMail: mellon@nominum.com
+
+
+   Andreas Gustafsson
+   Araneus Information Systems Oy
+   Ulappakatu 1
+   02320 Espoo
+   Finland
+
+   EMail: gson@araneus.fi
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                    [Page 11]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+Full Copyright Statement
+
+   Copyright (C) The Internet Society (2006).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
+   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
+   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
+   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is provided by the IETF
+   Administrative Support Activity (IASA).
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                    [Page 12]
+
diff --git a/doc/rfc/rfc5155.txt b/doc/rfc/rfc5155.txt
new file mode 100644
index 0000000000000..d4b729761925a
--- /dev/null
+++ b/doc/rfc/rfc5155.txt
@@ -0,0 +1,2915 @@
+
+
+
+
+
+
+Network Working Group                                          B. Laurie
+Request for Comments: 5155                                     G. Sisson
+Category: Standards Track                                      R. Arends
+                                                                 Nominet
+                                                               D. Blacka
+                                                          VeriSign, Inc.
+                                                              March 2008
+
+
+     DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Abstract
+
+   The Domain Name System Security (DNSSEC) Extensions introduced the
+   NSEC resource record (RR) for authenticated denial of existence.
+   This document introduces an alternative resource record, NSEC3, which
+   similarly provides authenticated denial of existence.  However, it
+   also provides measures against zone enumeration and permits gradual
+   expansion of delegation-centric zones.
+
+Table of Contents
+
+   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
+     1.1.  Rationale  . . . . . . . . . . . . . . . . . . . . . . . .  4
+     1.2.  Requirements . . . . . . . . . . . . . . . . . . . . . . .  4
+     1.3.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  5
+   2.  Backwards Compatibility  . . . . . . . . . . . . . . . . . . .  6
+   3.  The NSEC3 Resource Record  . . . . . . . . . . . . . . . . . .  7
+     3.1.  RDATA Fields . . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.1.  Hash Algorithm . . . . . . . . . . . . . . . . . . . .  8
+       3.1.2.  Flags  . . . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.3.  Iterations . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.4.  Salt Length  . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.5.  Salt . . . . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.6.  Hash Length  . . . . . . . . . . . . . . . . . . . . .  9
+       3.1.7.  Next Hashed Owner Name . . . . . . . . . . . . . . . .  9
+       3.1.8.  Type Bit Maps  . . . . . . . . . . . . . . . . . . . .  9
+     3.2.  NSEC3 RDATA Wire Format  . . . . . . . . . . . . . . . . .  9
+       3.2.1.  Type Bit Maps Encoding . . . . . . . . . . . . . . . . 10
+     3.3.  Presentation Format  . . . . . . . . . . . . . . . . . . . 11
+
+
+
+Laurie, et al.              Standards Track                     [Page 1]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   4.  The NSEC3PARAM Resource Record . . . . . . . . . . . . . . . . 12
+     4.1.  RDATA Fields . . . . . . . . . . . . . . . . . . . . . . . 12
+       4.1.1.  Hash Algorithm . . . . . . . . . . . . . . . . . . . . 12
+       4.1.2.  Flag Fields  . . . . . . . . . . . . . . . . . . . . . 12
+       4.1.3.  Iterations . . . . . . . . . . . . . . . . . . . . . . 13
+       4.1.4.  Salt Length  . . . . . . . . . . . . . . . . . . . . . 13
+       4.1.5.  Salt . . . . . . . . . . . . . . . . . . . . . . . . . 13
+     4.2.  NSEC3PARAM RDATA Wire Format . . . . . . . . . . . . . . . 13
+     4.3.  Presentation Format  . . . . . . . . . . . . . . . . . . . 14
+   5.  Calculation of the Hash  . . . . . . . . . . . . . . . . . . . 14
+   6.  Opt-Out  . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
+   7.  Authoritative Server Considerations  . . . . . . . . . . . . . 16
+     7.1.  Zone Signing . . . . . . . . . . . . . . . . . . . . . . . 16
+     7.2.  Zone Serving . . . . . . . . . . . . . . . . . . . . . . . 17
+       7.2.1.  Closest Encloser Proof . . . . . . . . . . . . . . . . 18
+       7.2.2.  Name Error Responses . . . . . . . . . . . . . . . . . 19
+       7.2.3.  No Data Responses, QTYPE is not DS . . . . . . . . . . 19
+       7.2.4.  No Data Responses, QTYPE is DS . . . . . . . . . . . . 19
+       7.2.5.  Wildcard No Data Responses . . . . . . . . . . . . . . 19
+       7.2.6.  Wildcard Answer Responses  . . . . . . . . . . . . . . 20
+       7.2.7.  Referrals to Unsigned Subzones . . . . . . . . . . . . 20
+       7.2.8.  Responding to Queries for NSEC3 Owner Names  . . . . . 20
+       7.2.9.  Server Response to a Run-Time Collision  . . . . . . . 21
+     7.3.  Secondary Servers  . . . . . . . . . . . . . . . . . . . . 21
+     7.4.  Zones Using Unknown Hash Algorithms  . . . . . . . . . . . 21
+     7.5.  Dynamic Update . . . . . . . . . . . . . . . . . . . . . . 21
+   8.  Validator Considerations . . . . . . . . . . . . . . . . . . . 23
+     8.1.  Responses with Unknown Hash Types  . . . . . . . . . . . . 23
+     8.2.  Verifying NSEC3 RRs  . . . . . . . . . . . . . . . . . . . 23
+     8.3.  Closest Encloser Proof . . . . . . . . . . . . . . . . . . 23
+     8.4.  Validating Name Error Responses  . . . . . . . . . . . . . 24
+     8.5.  Validating No Data Responses, QTYPE is not DS  . . . . . . 24
+     8.6.  Validating No Data Responses, QTYPE is DS  . . . . . . . . 24
+     8.7.  Validating Wildcard No Data Responses  . . . . . . . . . . 25
+     8.8.  Validating Wildcard Answer Responses . . . . . . . . . . . 25
+     8.9.  Validating Referrals to Unsigned Subzones  . . . . . . . . 25
+   9.  Resolver Considerations  . . . . . . . . . . . . . . . . . . . 26
+     9.1.  NSEC3 Resource Record Caching  . . . . . . . . . . . . . . 26
+     9.2.  Use of the AD Bit  . . . . . . . . . . . . . . . . . . . . 26
+   10. Special Considerations . . . . . . . . . . . . . . . . . . . . 26
+     10.1. Domain Name Length Restrictions  . . . . . . . . . . . . . 26
+     10.2. DNAME at the Zone Apex . . . . . . . . . . . . . . . . . . 27
+     10.3. Iterations . . . . . . . . . . . . . . . . . . . . . . . . 27
+     10.4. Transitioning a Signed Zone from NSEC to NSEC3 . . . . . . 28
+     10.5. Transitioning a Signed Zone from NSEC3 to NSEC . . . . . . 28
+   11. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 29
+   12. Security Considerations  . . . . . . . . . . . . . . . . . . . 30
+     12.1. Hashing Considerations . . . . . . . . . . . . . . . . . . 30
+
+
+
+Laurie, et al.              Standards Track                     [Page 2]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+       12.1.1. Dictionary Attacks . . . . . . . . . . . . . . . . . . 30
+       12.1.2. Collisions . . . . . . . . . . . . . . . . . . . . . . 31
+       12.1.3. Transitioning to a New Hash Algorithm  . . . . . . . . 31
+       12.1.4. Using High Iteration Values  . . . . . . . . . . . . . 31
+     12.2. Opt-Out Considerations . . . . . . . . . . . . . . . . . . 32
+     12.3. Other Considerations . . . . . . . . . . . . . . . . . . . 33
+   13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 33
+     13.1. Normative References . . . . . . . . . . . . . . . . . . . 33
+     13.2. Informative References . . . . . . . . . . . . . . . . . . 34
+   Appendix A.  Example Zone  . . . . . . . . . . . . . . . . . . . . 35
+   Appendix B.  Example Responses . . . . . . . . . . . . . . . . . . 40
+     B.1.  Name Error . . . . . . . . . . . . . . . . . . . . . . . . 40
+     B.2.  No Data Error  . . . . . . . . . . . . . . . . . . . . . . 42
+       B.2.1.  No Data Error, Empty Non-Terminal  . . . . . . . . . . 43
+     B.3.  Referral to an Opt-Out Unsigned Zone . . . . . . . . . . . 44
+     B.4.  Wildcard Expansion . . . . . . . . . . . . . . . . . . . . 45
+     B.5.  Wildcard No Data Error . . . . . . . . . . . . . . . . . . 46
+     B.6.  DS Child Zone No Data Error  . . . . . . . . . . . . . . . 48
+   Appendix C.  Special Considerations  . . . . . . . . . . . . . . . 48
+     C.1.  Salting  . . . . . . . . . . . . . . . . . . . . . . . . . 49
+     C.2.  Hash Collision . . . . . . . . . . . . . . . . . . . . . . 49
+       C.2.1.  Avoiding Hash Collisions During Generation . . . . . . 50
+       C.2.2.  Second Preimage Requirement Analysis . . . . . . . . . 50
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 3]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+1.  Introduction
+
+1.1.  Rationale
+
+   The DNS Security Extensions included the NSEC RR to provide
+   authenticated denial of existence.  Though the NSEC RR meets the
+   requirements for authenticated denial of existence, it introduces a
+   side-effect in that the contents of a zone can be enumerated.  This
+   property introduces undesired policy issues.
+
+   The enumeration is enabled by the set of NSEC records that exists
+   inside a signed zone.  An NSEC record lists two names that are
+   ordered canonically, in order to show that nothing exists between the
+   two names.  The complete set of NSEC records lists all the names in a
+   zone.  It is trivial to enumerate the content of a zone by querying
+   for names that do not exist.
+
+   An enumerated zone can be used, for example, as a source of probable
+   e-mail addresses for spam, or as a key for multiple WHOIS queries to
+   reveal registrant data that many registries may have legal
+   obligations to protect.  Many registries therefore prohibit the
+   copying of their zone data; however, the use of NSEC RRs renders
+   these policies unenforceable.
+
+   A second problem is that the cost to cryptographically secure
+   delegations to unsigned zones is high, relative to the perceived
+   security benefit, in two cases: large, delegation-centric zones, and
+   zones where insecure delegations will be updated rapidly.  In these
+   cases, the costs of maintaining the NSEC RR chain may be extremely
+   high and use of the "Opt-Out" convention may be more appropriate (for
+   these unsecured zones).
+
+   This document presents the NSEC3 Resource Record which can be used as
+   an alternative to NSEC to mitigate these issues.
+
+   Earlier work to address these issues include [DNSEXT-NO], [RFC4956],
+   and [DNSEXT-NSEC2v2].
+
+1.2.  Requirements
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119].
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 4]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+1.3.  Terminology
+
+   The reader is assumed to be familiar with the basic DNS and DNSSEC
+   concepts described in [RFC1034], [RFC1035], [RFC4033], [RFC4034],
+   [RFC4035], and subsequent RFCs that update them: [RFC2136],
+   [RFC2181], and [RFC2308].
+
+   The following terminology is used throughout this document:
+
+   Zone enumeration:  the practice of discovering the full content of a
+      zone via successive queries.  Zone enumeration was non-trivial
+      prior to the introduction of DNSSEC.
+
+   Original owner name:  the owner name corresponding to a hashed owner
+      name.
+
+   Hashed owner name:  the owner name created after applying the hash
+      function to an owner name.
+
+   Hash order:  the order in which hashed owner names are arranged
+      according to their numerical value, treating the leftmost (lowest
+      numbered) octet as the most significant octet.  Note that this
+      order is the same as the canonical DNS name order specified in
+      [RFC4034], when the hashed owner names are in base32, encoded with
+      an Extended Hex Alphabet [RFC4648].
+
+   Empty non-terminal:  a domain name that owns no resource records, but
+      has one or more subdomains that do.
+
+   Delegation:  an NS RRSet with a name different from the current zone
+      apex (non-zone-apex), signifying a delegation to a child zone.
+
+   Secure delegation:  a name containing a delegation (NS RRSet) and a
+      signed DS RRSet, signifying a delegation to a signed child zone.
+
+   Insecure delegation:  a name containing a delegation (NS RRSet), but
+      lacking a DS RRSet, signifying a delegation to an unsigned child
+      zone.
+
+   Opt-Out NSEC3 resource record:  an NSEC3 resource record that has the
+      Opt-Out flag set to 1.
+
+   Opt-Out zone:  a zone with at least one Opt-Out NSEC3 RR.
+
+   Closest encloser:  the longest existing ancestor of a name.  See also
+      Section 3.3.1 of [RFC4592].
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 5]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Closest provable encloser:  the longest ancestor of a name that can
+      be proven to exist.  Note that this is only different from the
+      closest encloser in an Opt-Out zone.
+
+   Next closer name:  the name one label longer than the closest
+      provable encloser of a name.
+
+   Base32:  the "Base 32 Encoding with Extended Hex Alphabet" as
+      specified in [RFC4648].  Note that trailing padding characters
+      ("=") are not used in the NSEC3 specification.
+
+   To cover:  An NSEC3 RR is said to "cover" a name if the hash of the
+      name or "next closer" name falls between the owner name and the
+      next hashed owner name of the NSEC3.  In other words, if it proves
+      the nonexistence of the name, either directly or by proving the
+      nonexistence of an ancestor of the name.
+
+   To match:  An NSEC3 RR is said to "match" a name if the owner name of
+      the NSEC3 RR is the same as the hashed owner name of that name.
+
+2.  Backwards Compatibility
+
+   This specification describes a protocol change that is not generally
+   backwards compatible with [RFC4033], [RFC4034], and [RFC4035].  In
+   particular, security-aware resolvers that are unaware of this
+   specification (NSEC3-unaware resolvers) may fail to validate the
+   responses introduced by this document.
+
+   In order to aid deployment, this specification uses a signaling
+   technique to prevent NSEC3-unaware resolvers from attempting to
+   validate responses from NSEC3-signed zones.
+
+   This specification allocates two new DNSKEY algorithm identifiers for
+   this purpose.  Algorithm 6, DSA-NSEC3-SHA1 is an alias for algorithm
+   3, DSA.  Algorithm 7, RSASHA1-NSEC3-SHA1 is an alias for algorithm 5,
+   RSASHA1.  These are not new algorithms, they are additional
+   identifiers for the existing algorithms.
+
+   Zones signed according to this specification MUST only use these
+   algorithm identifiers for their DNSKEY RRs.  Because these new
+   identifiers will be unknown algorithms to existing, NSEC3-unaware
+   resolvers, those resolvers will then treat responses from the NSEC3
+   signed zone as insecure, as detailed in Section 5.2 of [RFC4035].
+
+   These algorithm identifiers are used with the NSEC3 hash algorithm
+   SHA1.  Using other NSEC3 hash algorithms requires allocation of a new
+   alias (see Section 12.1.3).
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 6]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Security aware resolvers that are aware of this specification MUST
+   recognize the new algorithm identifiers and treat them as equivalent
+   to the algorithms that they alias.
+
+   A methodology for transitioning from a DNSSEC signed zone to a zone
+   signed using NSEC3 is discussed in Section 10.4.
+
+3.  The NSEC3 Resource Record
+
+   The NSEC3 Resource Record (RR) provides authenticated denial of
+   existence for DNS Resource Record Sets.
+
+   The NSEC3 RR lists RR types present at the original owner name of the
+   NSEC3 RR.  It includes the next hashed owner name in the hash order
+   of the zone.  The complete set of NSEC3 RRs in a zone indicates which
+   RRSets exist for the original owner name of the RR and form a chain
+   of hashed owner names in the zone.  This information is used to
+   provide authenticated denial of existence for DNS data.  To provide
+   protection against zone enumeration, the owner names used in the
+   NSEC3 RR are cryptographic hashes of the original owner name
+   prepended as a single label to the name of the zone.  The NSEC3 RR
+   indicates which hash function is used to construct the hash, which
+   salt is used, and how many iterations of the hash function are
+   performed over the original owner name.  The hashing technique is
+   described fully in Section 5.
+
+   Hashed owner names of unsigned delegations may be excluded from the
+   chain.  An NSEC3 RR whose span covers the hash of an owner name or
+   "next closer" name of an unsigned delegation is referred to as an
+   Opt-Out NSEC3 RR and is indicated by the presence of a flag.
+
+   The owner name for the NSEC3 RR is the base32 encoding of the hashed
+   owner name prepended as a single label to the name of the zone.
+
+   The type value for the NSEC3 RR is 50.
+
+   The NSEC3 RR RDATA format is class independent and is described
+   below.
+
+   The class MUST be the same as the class of the original owner name.
+
+   The NSEC3 RR SHOULD have the same TTL value as the SOA minimum TTL
+   field.  This is in the spirit of negative caching [RFC2308].
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 7]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+3.1.  RDATA Fields
+
+3.1.1.  Hash Algorithm
+
+   The Hash Algorithm field identifies the cryptographic hash algorithm
+   used to construct the hash-value.
+
+   The values for this field are defined in the NSEC3 hash algorithm
+   registry defined in Section 11.
+
+3.1.2.  Flags
+
+   The Flags field contains 8 one-bit flags that can be used to indicate
+   different processing.  All undefined flags must be zero.  The only
+   flag defined by this specification is the Opt-Out flag.
+
+3.1.2.1.  Opt-Out Flag
+
+   If the Opt-Out flag is set, the NSEC3 record covers zero or more
+   unsigned delegations.
+
+   If the Opt-Out flag is clear, the NSEC3 record covers zero unsigned
+   delegations.
+
+   The Opt-Out Flag indicates whether this NSEC3 RR may cover unsigned
+   delegations.  It is the least significant bit in the Flags field.
+   See Section 6 for details about the use of this flag.
+
+3.1.3.  Iterations
+
+   The Iterations field defines the number of additional times the hash
+   function has been performed.  More iterations result in greater
+   resiliency of the hash value against dictionary attacks, but at a
+   higher computational cost for both the server and resolver.  See
+   Section 5 for details of the use of this field, and Section 10.3 for
+   limitations on the value.
+
+3.1.4.  Salt Length
+
+   The Salt Length field defines the length of the Salt field in octets,
+   ranging in value from 0 to 255.
+
+3.1.5.  Salt
+
+   The Salt field is appended to the original owner name before hashing
+   in order to defend against pre-calculated dictionary attacks.  See
+   Section 5 for details on how the salt is used.
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 8]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+3.1.6.  Hash Length
+
+   The Hash Length field defines the length of the Next Hashed Owner
+   Name field, ranging in value from 1 to 255 octets.
+
+3.1.7.  Next Hashed Owner Name
+
+   The Next Hashed Owner Name field contains the next hashed owner name
+   in hash order.  This value is in binary format.  Given the ordered
+   set of all hashed owner names, the Next Hashed Owner Name field
+   contains the hash of an owner name that immediately follows the owner
+   name of the given NSEC3 RR.  The value of the Next Hashed Owner Name
+   field in the last NSEC3 RR in the zone is the same as the hashed
+   owner name of the first NSEC3 RR in the zone in hash order.  Note
+   that, unlike the owner name of the NSEC3 RR, the value of this field
+   does not contain the appended zone name.
+
+3.1.8.  Type Bit Maps
+
+   The Type Bit Maps field identifies the RRSet types that exist at the
+   original owner name of the NSEC3 RR.
+
+3.2.  NSEC3 RDATA Wire Format
+
+   The RDATA of the NSEC3 RR is as shown below:
+
+                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
+    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |   Hash Alg.   |     Flags     |          Iterations           |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |  Salt Length  |                     Salt                      /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |  Hash Length  |             Next Hashed Owner Name            /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   /                         Type Bit Maps                         /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+   Hash Algorithm is a single octet.
+
+   Flags field is a single octet, the Opt-Out flag is the least
+   significant bit, as shown below:
+
+    0 1 2 3 4 5 6 7
+   +-+-+-+-+-+-+-+-+
+   |             |O|
+   +-+-+-+-+-+-+-+-+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 9]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Iterations is represented as a 16-bit unsigned integer, with the most
+   significant bit first.
+
+   Salt Length is represented as an unsigned octet.  Salt Length
+   represents the length of the Salt field in octets.  If the value is
+   zero, the following Salt field is omitted.
+
+   Salt, if present, is encoded as a sequence of binary octets.  The
+   length of this field is determined by the preceding Salt Length
+   field.
+
+   Hash Length is represented as an unsigned octet.  Hash Length
+   represents the length of the Next Hashed Owner Name field in octets.
+
+   The next hashed owner name is not base32 encoded, unlike the owner
+   name of the NSEC3 RR.  It is the unmodified binary hash value.  It
+   does not include the name of the containing zone.  The length of this
+   field is determined by the preceding Hash Length field.
+
+3.2.1.  Type Bit Maps Encoding
+
+   The encoding of the Type Bit Maps field is the same as that used by
+   the NSEC RR, described in [RFC4034].  It is explained and clarified
+   here for clarity.
+
+   The RR type space is split into 256 window blocks, each representing
+   the low-order 8 bits of the 16-bit RR type space.  Each block that
+   has at least one active RR type is encoded using a single octet
+   window number (from 0 to 255), a single octet bitmap length (from 1
+   to 32) indicating the number of octets used for the bitmap of the
+   window block, and up to 32 octets (256 bits) of bitmap.
+
+   Blocks are present in the NSEC3 RR RDATA in increasing numerical
+   order.
+
+      Type Bit Maps Field = ( Window Block # | Bitmap Length | Bitmap )+
+
+      where "|" denotes concatenation.
+
+   Each bitmap encodes the low-order 8 bits of RR types within the
+   window block, in network bit order.  The first bit is bit 0.  For
+   window block 0, bit 1 corresponds to RR type 1 (A), bit 2 corresponds
+   to RR type 2 (NS), and so forth.  For window block 1, bit 1
+   corresponds to RR type 257, bit 2 to RR type 258.  If a bit is set to
+   1, it indicates that an RRSet of that type is present for the
+   original owner name of the NSEC3 RR.  If a bit is set to 0, it
+   indicates that no RRSet of that type is present for the original
+   owner name of the NSEC3 RR.
+
+
+
+Laurie, et al.              Standards Track                    [Page 10]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Since bit 0 in window block 0 refers to the non-existing RR type 0,
+   it MUST be set to 0.  After verification, the validator MUST ignore
+   the value of bit 0 in window block 0.
+
+   Bits representing Meta-TYPEs or QTYPEs as specified in Section 3.1 of
+   [RFC2929] or within the range reserved for assignment only to QTYPEs
+   and Meta-TYPEs MUST be set to 0, since they do not appear in zone
+   data.  If encountered, they must be ignored upon reading.
+
+   Blocks with no types present MUST NOT be included.  Trailing zero
+   octets in the bitmap MUST be omitted.  The length of the bitmap of
+   each block is determined by the type code with the largest numerical
+   value, within that block, among the set of RR types present at the
+   original owner name of the NSEC3 RR.  Trailing octets not specified
+   MUST be interpreted as zero octets.
+
+3.3.  Presentation Format
+
+   The presentation format of the RDATA portion is as follows:
+
+   o  The Hash Algorithm field is represented as an unsigned decimal
+      integer.  The value has a maximum of 255.
+
+   o  The Flags field is represented as an unsigned decimal integer.
+      The value has a maximum of 255.
+
+   o  The Iterations field is represented as an unsigned decimal
+      integer.  The value is between 0 and 65535, inclusive.
+
+   o  The Salt Length field is not represented.
+
+   o  The Salt field is represented as a sequence of case-insensitive
+      hexadecimal digits.  Whitespace is not allowed within the
+      sequence.  The Salt field is represented as "-" (without the
+      quotes) when the Salt Length field has a value of 0.
+
+   o  The Hash Length field is not represented.
+
+   o  The Next Hashed Owner Name field is represented as an unpadded
+      sequence of case-insensitive base32 digits, without whitespace.
+
+   o  The Type Bit Maps field is represented as a sequence of RR type
+      mnemonics.  When the mnemonic is not known, the TYPE
+      representation as described in Section 5 of [RFC3597] MUST be
+      used.
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 11]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+4.  The NSEC3PARAM Resource Record
+
+   The NSEC3PARAM RR contains the NSEC3 parameters (hash algorithm,
+   flags, iterations, and salt) needed by authoritative servers to
+   calculate hashed owner names.  The presence of an NSEC3PARAM RR at a
+   zone apex indicates that the specified parameters may be used by
+   authoritative servers to choose an appropriate set of NSEC3 RRs for
+   negative responses.  The NSEC3PARAM RR is not used by validators or
+   resolvers.
+
+   If an NSEC3PARAM RR is present at the apex of a zone with a Flags
+   field value of zero, then there MUST be an NSEC3 RR using the same
+   hash algorithm, iterations, and salt parameters present at every
+   hashed owner name in the zone.  That is, the zone MUST contain a
+   complete set of NSEC3 RRs with the same hash algorithm, iterations,
+   and salt parameters.
+
+   The owner name for the NSEC3PARAM RR is the name of the zone apex.
+
+   The type value for the NSEC3PARAM RR is 51.
+
+   The NSEC3PARAM RR RDATA format is class independent and is described
+   below.
+
+   The class MUST be the same as the NSEC3 RRs to which this RR refers.
+
+4.1.  RDATA Fields
+
+   The RDATA for this RR mirrors the first four fields in the NSEC3 RR.
+
+4.1.1.  Hash Algorithm
+
+   The Hash Algorithm field identifies the cryptographic hash algorithm
+   used to construct the hash-value.
+
+   The acceptable values are the same as the corresponding field in the
+   NSEC3 RR.
+
+4.1.2.  Flag Fields
+
+   The Opt-Out flag is not used and is set to zero.
+
+   All other flags are reserved for future use, and must be zero.
+
+   NSEC3PARAM RRs with a Flags field value other than zero MUST be
+   ignored.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 12]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+4.1.3.  Iterations
+
+   The Iterations field defines the number of additional times the hash
+   is performed.
+
+   Its acceptable values are the same as the corresponding field in the
+   NSEC3 RR.
+
+4.1.4.  Salt Length
+
+   The Salt Length field defines the length of the salt in octets,
+   ranging in value from 0 to 255.
+
+4.1.5.  Salt
+
+   The Salt field is appended to the original owner name before hashing.
+
+4.2.  NSEC3PARAM RDATA Wire Format
+
+   The RDATA of the NSEC3PARAM RR is as shown below:
+
+                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
+    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |   Hash Alg.   |     Flags     |          Iterations           |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |  Salt Length  |                     Salt                      /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+   Hash Algorithm is a single octet.
+
+   Flags field is a single octet.
+
+   Iterations is represented as a 16-bit unsigned integer, with the most
+   significant bit first.
+
+   Salt Length is represented as an unsigned octet.  Salt Length
+   represents the length of the following Salt field in octets.  If the
+   value is zero, the Salt field is omitted.
+
+   Salt, if present, is encoded as a sequence of binary octets.  The
+   length of this field is determined by the preceding Salt Length
+   field.
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 13]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+4.3.  Presentation Format
+
+   The presentation format of the RDATA portion is as follows:
+
+   o  The Hash Algorithm field is represented as an unsigned decimal
+      integer.  The value has a maximum of 255.
+
+   o  The Flags field is represented as an unsigned decimal integer.
+      The value has a maximum value of 255.
+
+   o  The Iterations field is represented as an unsigned decimal
+      integer.  The value is between 0 and 65535, inclusive.
+
+   o  The Salt Length field is not represented.
+
+   o  The Salt field is represented as a sequence of case-insensitive
+      hexadecimal digits.  Whitespace is not allowed within the
+      sequence.  This field is represented as "-" (without the quotes)
+      when the Salt Length field is zero.
+
+5.  Calculation of the Hash
+
+   The hash calculation uses three of the NSEC3 RDATA fields: Hash
+   Algorithm, Salt, and Iterations.
+
+   Define H(x) to be the hash of x using the Hash Algorithm selected by
+   the NSEC3 RR, k to be the number of Iterations, and || to indicate
+   concatenation.  Then define:
+
+      IH(salt, x, 0) = H(x || salt), and
+
+      IH(salt, x, k) = H(IH(salt, x, k-1) || salt), if k > 0
+
+   Then the calculated hash of an owner name is
+
+      IH(salt, owner name, iterations),
+
+   where the owner name is in the canonical form, defined as:
+
+   The wire format of the owner name where:
+
+   1.  The owner name is fully expanded (no DNS name compression) and
+       fully qualified;
+
+   2.  All uppercase US-ASCII letters are replaced by the corresponding
+       lowercase US-ASCII letters;
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 14]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   3.  If the owner name is a wildcard name, the owner name is in its
+       original unexpanded form, including the "*" label (no wildcard
+       substitution);
+
+   This form is as defined in Section 6.2 of [RFC4034].
+
+   The method to calculate the Hash is based on [RFC2898].
+
+6.  Opt-Out
+
+   In this specification, as in [RFC4033], [RFC4034] and [RFC4035], NS
+   RRSets at delegation points are not signed and may be accompanied by
+   a DS RRSet.  With the Opt-Out bit clear, the security status of the
+   child zone is determined by the presence or absence of this DS RRSet,
+   cryptographically proven by the signed NSEC3 RR at the hashed owner
+   name of the delegation.  Setting the Opt-Out flag modifies this by
+   allowing insecure delegations to exist within the signed zone without
+   a corresponding NSEC3 RR at the hashed owner name of the delegation.
+
+   An Opt-Out NSEC3 RR is said to cover a delegation if the hash of the
+   owner name or "next closer" name of the delegation is between the
+   owner name of the NSEC3 RR and the next hashed owner name.
+
+   An Opt-Out NSEC3 RR does not assert the existence or non-existence of
+   the insecure delegations that it may cover.  This allows for the
+   addition or removal of these delegations without recalculating or re-
+   signing RRs in the NSEC3 RR chain.  However, Opt-Out NSEC3 RRs do
+   assert the (non)existence of other, authoritative RRSets.
+
+   An Opt-Out NSEC3 RR MAY have the same original owner name as an
+   insecure delegation.  In this case, the delegation is proven insecure
+   by the lack of a DS bit in the type map and the signed NSEC3 RR does
+   assert the existence of the delegation.
+
+   Zones using Opt-Out MAY contain a mixture of Opt-Out NSEC3 RRs and
+   non-Opt-Out NSEC3 RRs.  If an NSEC3 RR is not Opt-Out, there MUST NOT
+   be any hashed owner names of insecure delegations (nor any other RRs)
+   between it and the name indicated by the next hashed owner name in
+   the NSEC3 RDATA.  If it is Opt-Out, it MUST only cover hashed owner
+   names or hashed "next closer" names of insecure delegations.
+
+   The effects of the Opt-Out flag on signing, serving, and validating
+   responses are covered in following sections.
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 15]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+7.  Authoritative Server Considerations
+
+7.1.  Zone Signing
+
+   Zones using NSEC3 must satisfy the following properties:
+
+   o  Each owner name within the zone that owns authoritative RRSets
+      MUST have a corresponding NSEC3 RR.  Owner names that correspond
+      to unsigned delegations MAY have a corresponding NSEC3 RR.
+      However, if there is not a corresponding NSEC3 RR, there MUST be
+      an Opt-Out NSEC3 RR that covers the "next closer" name to the
+      delegation.  Other non-authoritative RRs are not represented by
+      NSEC3 RRs.
+
+   o  Each empty non-terminal MUST have a corresponding NSEC3 RR, unless
+      the empty non-terminal is only derived from an insecure delegation
+      covered by an Opt-Out NSEC3 RR.
+
+   o  The TTL value for any NSEC3 RR SHOULD be the same as the minimum
+      TTL value field in the zone SOA RR.
+
+   o  The Type Bit Maps field of every NSEC3 RR in a signed zone MUST
+      indicate the presence of all types present at the original owner
+      name, except for the types solely contributed by an NSEC3 RR
+      itself.  Note that this means that the NSEC3 type itself will
+      never be present in the Type Bit Maps.
+
+   The following steps describe a method of proper construction of NSEC3
+   RRs.  This is not the only such possible method.
+
+   1.  Select the hash algorithm and the values for salt and iterations.
+
+   2.  For each unique original owner name in the zone add an NSEC3 RR.
+
+       *  If Opt-Out is being used, owner names of unsigned delegations
+          MAY be excluded.
+
+       *  The owner name of the NSEC3 RR is the hash of the original
+          owner name, prepended as a single label to the zone name.
+
+       *  The Next Hashed Owner Name field is left blank for the moment.
+
+       *  If Opt-Out is being used, set the Opt-Out bit to one.
+
+       *  For collision detection purposes, optionally keep track of the
+          original owner name with the NSEC3 RR.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 16]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+       *  Additionally, for collision detection purposes, optionally
+          create an additional NSEC3 RR corresponding to the original
+          owner name with the asterisk label prepended (i.e., as if a
+          wildcard existed as a child of this owner name) and keep track
+          of this original owner name.  Mark this NSEC3 RR as temporary.
+
+   3.  For each RRSet at the original owner name, set the corresponding
+       bit in the Type Bit Maps field.
+
+   4.  If the difference in number of labels between the apex and the
+       original owner name is greater than 1, additional NSEC3 RRs need
+       to be added for every empty non-terminal between the apex and the
+       original owner name.  This process may generate NSEC3 RRs with
+       duplicate hashed owner names.  Optionally, for collision
+       detection, track the original owner names of these NSEC3 RRs and
+       create temporary NSEC3 RRs for wildcard collisions in a similar
+       fashion to step 1.
+
+   5.  Sort the set of NSEC3 RRs into hash order.
+
+   6.  Combine NSEC3 RRs with identical hashed owner names by replacing
+       them with a single NSEC3 RR with the Type Bit Maps field
+       consisting of the union of the types represented by the set of
+       NSEC3 RRs.  If the original owner name was tracked, then
+       collisions may be detected when combining, as all of the matching
+       NSEC3 RRs should have the same original owner name.  Discard any
+       possible temporary NSEC3 RRs.
+
+   7.  In each NSEC3 RR, insert the next hashed owner name by using the
+       value of the next NSEC3 RR in hash order.  The next hashed owner
+       name of the last NSEC3 RR in the zone contains the value of the
+       hashed owner name of the first NSEC3 RR in the hash order.
+
+   8.  Finally, add an NSEC3PARAM RR with the same Hash Algorithm,
+       Iterations, and Salt fields to the zone apex.
+
+   If a hash collision is detected, then a new salt has to be chosen,
+   and the signing process restarted.
+
+7.2.  Zone Serving
+
+   This specification modifies DNSSEC-enabled DNS responses generated by
+   authoritative servers.  In particular, it replaces the use of NSEC
+   RRs in such responses with NSEC3 RRs.
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 17]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   In the following response cases, the NSEC RRs dictated by DNSSEC
+   [RFC4035] are replaced with NSEC3 RRs that prove the same facts.
+   Responses that would not contain NSEC RRs are unchanged by this
+   specification.
+
+   When returning responses containing multiple NSEC3 RRs, all of the
+   NSEC3 RRs MUST use the same hash algorithm, iteration, and salt
+   values.  The Flags field value MUST be either zero or one.
+
+7.2.1.  Closest Encloser Proof
+
+   For many NSEC3 responses a proof of the closest encloser is required.
+   This is a proof that some ancestor of the QNAME is the closest
+   encloser of QNAME.
+
+   This proof consists of (up to) two different NSEC3 RRs:
+
+   o  An NSEC3 RR that matches the closest (provable) encloser.
+
+   o  An NSEC3 RR that covers the "next closer" name to the closest
+      encloser.
+
+   The first NSEC3 RR essentially proposes a possible closest encloser,
+   and proves that the particular encloser does, in fact, exist.  The
+   second NSEC3 RR proves that the possible closest encloser is the
+   closest, and proves that the QNAME (and any ancestors between QNAME
+   and the closest encloser) does not exist.
+
+   These NSEC3 RRs are collectively referred to as the "closest encloser
+   proof" in the subsequent descriptions.
+
+   For example, the closest encloser proof for the nonexistent
+   "alpha.beta.gamma.example." owner name might prove that
+   "gamma.example." is the closest encloser.  This response would
+   contain the NSEC3 RR that matches "gamma.example.", and would also
+   contain the NSEC3 RR that covers "beta.gamma.example." (which is the
+   "next closer" name).
+
+   It is possible, when using Opt-Out (Section 6), to not be able to
+   prove the actual closest encloser because it is, or is part of an
+   insecure delegation covered by an Opt-Out span.  In this case,
+   instead of proving the actual closest encloser, the closest provable
+   encloser is used.  That is, the closest enclosing authoritative name
+   is used instead.  In this case, the set of NSEC3 RRs used for this
+   proof is referred to as the "closest provable encloser proof".
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 18]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+7.2.2.  Name Error Responses
+
+   To prove the nonexistence of QNAME, a closest encloser proof and an
+   NSEC3 RR covering the (nonexistent) wildcard RR at the closest
+   encloser MUST be included in the response.  This collection of (up
+   to) three NSEC3 RRs proves both that QNAME does not exist and that a
+   wildcard that could have matched QNAME also does not exist.
+
+   For example, if "gamma.example." is the closest provable encloser to
+   QNAME, then an NSEC3 RR covering "*.gamma.example." is included in
+   the authority section of the response.
+
+7.2.3.  No Data Responses, QTYPE is not DS
+
+   The server MUST include the NSEC3 RR that matches QNAME.  This NSEC3
+   RR MUST NOT have the bits corresponding to either the QTYPE or CNAME
+   set in its Type Bit Maps field.
+
+7.2.4.  No Data Responses, QTYPE is DS
+
+   If there is an NSEC3 RR that matches QNAME, the server MUST return it
+   in the response.  The bits corresponding with DS and CNAME MUST NOT
+   be set in the Type Bit Maps field of this NSEC3 RR.
+
+   If no NSEC3 RR matches QNAME, the server MUST return a closest
+   provable encloser proof for QNAME.  The NSEC3 RR that covers the
+   "next closer" name MUST have the Opt-Out bit set (note that this is
+   true by definition -- if the Opt-Out bit is not set, something has
+   gone wrong).
+
+   If a server is authoritative for both sides of a zone cut at QNAME,
+   the server MUST return the proof from the parent side of the zone
+   cut.
+
+7.2.5.  Wildcard No Data Responses
+
+   If there is a wildcard match for QNAME, but QTYPE is not present at
+   that name, the response MUST include a closest encloser proof for
+   QNAME and MUST include the NSEC3 RR that matches the wildcard.  This
+   combination proves both that QNAME itself does not exist and that a
+   wildcard that matches QNAME does exist.  Note that the closest
+   encloser to QNAME MUST be the immediate ancestor of the wildcard RR
+   (if this is not the case, then something has gone wrong).
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 19]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+7.2.6.  Wildcard Answer Responses
+
+   If there is a wildcard match for QNAME and QTYPE, then, in addition
+   to the expanded wildcard RRSet returned in the answer section of the
+   response, proof that the wildcard match was valid must be returned.
+
+   This proof is accomplished by proving that both QNAME does not exist
+   and that the closest encloser of the QNAME and the immediate ancestor
+   of the wildcard are the same (i.e., the correct wildcard matched).
+
+   To this end, the NSEC3 RR that covers the "next closer" name of the
+   immediate ancestor of the wildcard MUST be returned.  It is not
+   necessary to return an NSEC3 RR that matches the closest encloser, as
+   the existence of this closest encloser is proven by the presence of
+   the expanded wildcard in the response.
+
+7.2.7.  Referrals to Unsigned Subzones
+
+   If there is an NSEC3 RR that matches the delegation name, then that
+   NSEC3 RR MUST be included in the response.  The DS bit in the type
+   bit maps of the NSEC3 RR MUST NOT be set.
+
+   If the zone is Opt-Out, then there may not be an NSEC3 RR
+   corresponding to the delegation.  In this case, the closest provable
+   encloser proof MUST be included in the response.  The included NSEC3
+   RR that covers the "next closer" name for the delegation MUST have
+   the Opt-Out flag set to one.  (Note that this will be the case unless
+   something has gone wrong).
+
+7.2.8.  Responding to Queries for NSEC3 Owner Names
+
+   The owner names of NSEC3 RRs are not represented in the NSEC3 RR
+   chain like other owner names.  As a result, each NSEC3 owner name is
+   covered by another NSEC3 RR, effectively negating the existence of
+   the NSEC3 RR.  This is a paradox, since the existence of an NSEC3 RR
+   can be proven by its RRSIG RRSet.
+
+   If the following conditions are all true:
+
+   o  the QNAME equals the owner name of an existing NSEC3 RR, and
+
+   o  no RR types exist at the QNAME, nor at any descendant of QNAME,
+
+   then the response MUST be constructed as a Name Error response
+   (Section 7.2.2).  Or, in other words, the authoritative name server
+   will act as if the owner name of the NSEC3 RR did not exist.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 20]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Note that NSEC3 RRs are returned as a result of an AXFR or IXFR
+   query.
+
+7.2.9.  Server Response to a Run-Time Collision
+
+   If the hash of a non-existing QNAME collides with the owner name of
+   an existing NSEC3 RR, then the server will be unable to return a
+   response that proves that QNAME does not exist.  In this case, the
+   server MUST return a response with an RCODE of 2 (server failure).
+
+   Note that with the hash algorithm specified in this document, SHA-1,
+   such collisions are highly unlikely.
+
+7.3.  Secondary Servers
+
+   Secondary servers (and perhaps other entities) need to reliably
+   determine which NSEC3 parameters (i.e., hash, salt, and iterations)
+   are present at every hashed owner name, in order to be able to choose
+   an appropriate set of NSEC3 RRs for negative responses.  This is
+   indicated by an NSEC3PARAM RR present at the zone apex.
+
+   If there are multiple NSEC3PARAM RRs present, there are multiple
+   valid NSEC3 chains present.  The server must choose one of them, but
+   may use any criteria to do so.
+
+7.4.  Zones Using Unknown Hash Algorithms
+
+   Zones that are signed according to this specification, but are using
+   an unrecognized NSEC3 hash algorithm value, cannot be effectively
+   served.  Such zones SHOULD be rejected when loading.  Servers SHOULD
+   respond with RCODE=2 (server failure) responses when handling queries
+   that would fall under such zones.
+
+7.5.  Dynamic Update
+
+   A zone signed using NSEC3 may accept dynamic updates [RFC2136].
+   However, NSEC3 introduces some special considerations for dynamic
+   updates.
+
+   Adding and removing names in a zone MUST account for the creation or
+   removal of empty non-terminals.
+
+   o  When removing a name with a corresponding NSEC3 RR, any NSEC3 RRs
+      corresponding to empty non-terminals created by that name MUST be
+      removed.  Note that more than one name may be asserting the
+      existence of a particular empty non-terminal.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 21]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   o  When adding a name that requires adding an NSEC3 RR, NSEC3 RRs
+      MUST also be added for any empty non-terminals that are created.
+      That is, if there is not an existing NSEC3 RR matching an empty
+      non-terminal, it must be created and added.
+
+   The presence of Opt-Out in a zone means that some additions or
+   delegations of names will not require changes to the NSEC3 RRs in a
+   zone.
+
+   o  When removing a delegation RRSet, if that delegation does not have
+      a matching NSEC3 RR, then it was opted out.  In this case, nothing
+      further needs to be done.
+
+   o  When adding a delegation RRSet, if the "next closer" name of the
+      delegation is covered by an existing Opt-Out NSEC3 RR, then the
+      delegation MAY be added without modifying the NSEC3 RRs in the
+      zone.
+
+   The presence of Opt-Out in a zone means that when adding or removing
+   NSEC3 RRs, the value of the Opt-Out flag that should be set in new or
+   modified NSEC3 RRs is ambiguous.  Servers SHOULD follow this set of
+   basic rules to resolve the ambiguity.
+
+   The central concept to these rules is that the state of the Opt-Out
+   flag of the covering NSEC3 RR is preserved.
+
+   o  When removing an NSEC3 RR, the value of the Opt-Out flag for the
+      previous NSEC3 RR (the one whose next hashed owner name is
+      modified) should not be changed.
+
+   o  When adding an NSEC3 RR, the value of the Opt-Out flag is set to
+      the value of the Opt-Out flag of the NSEC3 RR that previously
+      covered the owner name of the NSEC3 RR.  That is, the now previous
+      NSEC3 RR.
+
+   If the zone in question is consistent with its use of the Opt-Out
+   flag (that is, all NSEC3 RRs in the zone have the same value for the
+   flag) then these rules will retain that consistency.  If the zone is
+   not consistent in the use of the flag (i.e., a partially Opt-Out
+   zone), then these rules will not retain the same pattern of use of
+   the Opt-Out flag.
+
+   For zones that partially use the Opt-Out flag, if there is a logical
+   pattern for that use, the pattern could be maintained by using a
+   local policy on the server.
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 22]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+8.  Validator Considerations
+
+8.1.  Responses with Unknown Hash Types
+
+   A validator MUST ignore NSEC3 RRs with unknown hash types.  The
+   practical result of this is that responses containing only such NSEC3
+   RRs will generally be considered bogus.
+
+8.2.  Verifying NSEC3 RRs
+
+   A validator MUST ignore NSEC3 RRs with a Flag fields value other than
+   zero or one.
+
+   A validator MAY treat a response as bogus if the response contains
+   NSEC3 RRs that contain different values for hash algorithm,
+   iterations, or salt from each other for that zone.
+
+8.3.  Closest Encloser Proof
+
+   In order to verify a closest encloser proof, the validator MUST find
+   the longest name, X, such that
+
+   o  X is an ancestor of QNAME that is matched by an NSEC3 RR present
+      in the response.  This is a candidate for the closest encloser,
+      and
+
+   o  The name one label longer than X (but still an ancestor of -- or
+      equal to -- QNAME) is covered by an NSEC3 RR present in the
+      response.
+
+   One possible algorithm for verifying this proof is as follows:
+
+   1.  Set SNAME=QNAME.  Clear the flag.
+
+   2.  Check whether SNAME exists:
+
+       *  If there is no NSEC3 RR in the response that matches SNAME
+          (i.e., an NSEC3 RR whose owner name is the same as the hash of
+          SNAME, prepended as a single label to the zone name), clear
+          the flag.
+
+       *  If there is an NSEC3 RR in the response that covers SNAME, set
+          the flag.
+
+       *  If there is a matching NSEC3 RR in the response and the flag
+          was set, then the proof is complete, and SNAME is the closest
+          encloser.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 23]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+       *  If there is a matching NSEC3 RR in the response, but the flag
+          is not set, then the response is bogus.
+
+   3.  Truncate SNAME by one label from the left, go to step 2.
+
+   Once the closest encloser has been discovered, the validator MUST
+   check that the NSEC3 RR that has the closest encloser as the original
+   owner name is from the proper zone.  The DNAME type bit must not be
+   set and the NS type bit may only be set if the SOA type bit is set.
+   If this is not the case, it would be an indication that an attacker
+   is using them to falsely deny the existence of RRs for which the
+   server is not authoritative.
+
+   In the following descriptions, the phrase "a closest (provable)
+   encloser proof for X" means that the algorithm above (or an
+   equivalent algorithm) proves that X does not exist by proving that an
+   ancestor of X is its closest encloser.
+
+8.4.  Validating Name Error Responses
+
+   A validator MUST verify that there is a closest encloser proof for
+   QNAME present in the response and that there is an NSEC3 RR that
+   covers the wildcard at the closest encloser (i.e., the name formed by
+   prepending the asterisk label to the closest encloser).
+
+8.5.  Validating No Data Responses, QTYPE is not DS
+
+   The validator MUST verify that an NSEC3 RR that matches QNAME is
+   present and that both the QTYPE and the CNAME type are not set in its
+   Type Bit Maps field.
+
+   Note that this test also covers the case where the NSEC3 RR exists
+   because it corresponds to an empty non-terminal, in which case the
+   NSEC3 RR will have an empty Type Bit Maps field.
+
+8.6.  Validating No Data Responses, QTYPE is DS
+
+   If there is an NSEC3 RR that matches QNAME present in the response,
+   then that NSEC3 RR MUST NOT have the bits corresponding to DS and
+   CNAME set in its Type Bit Maps field.
+
+   If there is no such NSEC3 RR, then the validator MUST verify that a
+   closest provable encloser proof for QNAME is present in the response,
+   and that the NSEC3 RR that covers the "next closer" name has the Opt-
+   Out bit set.
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 24]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+8.7.  Validating Wildcard No Data Responses
+
+   The validator MUST verify a closest encloser proof for QNAME and MUST
+   find an NSEC3 RR present in the response that matches the wildcard
+   name generated by prepending the asterisk label to the closest
+   encloser.  Furthermore, the bits corresponding to both QTYPE and
+   CNAME MUST NOT be set in the wildcard matching NSEC3 RR.
+
+8.8.  Validating Wildcard Answer Responses
+
+   The verified wildcard answer RRSet in the response provides the
+   validator with a (candidate) closest encloser for QNAME.  This
+   closest encloser is the immediate ancestor to the generating
+   wildcard.
+
+   Validators MUST verify that there is an NSEC3 RR that covers the
+   "next closer" name to QNAME present in the response.  This proves
+   that QNAME itself did not exist and that the correct wildcard was
+   used to generate the response.
+
+8.9.  Validating Referrals to Unsigned Subzones
+
+   The delegation name in a referral is the owner name of the NS RRSet
+   present in the authority section of the referral response.
+
+   If there is an NSEC3 RR present in the response that matches the
+   delegation name, then the validator MUST ensure that the NS bit is
+   set and that the DS bit is not set in the Type Bit Maps field of the
+   NSEC3 RR.  The validator MUST also ensure that the NSEC3 RR is from
+   the correct (i.e., parent) zone.  This is done by ensuring that the
+   SOA bit is not set in the Type Bit Maps field of this NSEC3 RR.
+
+   Note that the presence of an NS bit implies the absence of a DNAME
+   bit, so there is no need to check for the DNAME bit in the Type Bit
+   Maps field of the NSEC3 RR.
+
+   If there is no NSEC3 RR present that matches the delegation name,
+   then the validator MUST verify a closest provable encloser proof for
+   the delegation name.  The validator MUST verify that the Opt-Out bit
+   is set in the NSEC3 RR that covers the "next closer" name to the
+   delegation name.
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 25]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+9.  Resolver Considerations
+
+9.1.  NSEC3 Resource Record Caching
+
+   Caching resolvers MUST be able to retrieve the appropriate NSEC3 RRs
+   when returning responses that contain them.  In DNSSEC [RFC4035], in
+   many cases it is possible to find the correct NSEC RR to return in a
+   response by name (e.g., when returning a referral, the NSEC RR will
+   always have the same owner name as the delegation).  With this
+   specification, that will not be true, nor will a cache be able to
+   calculate the name(s) of the appropriate NSEC3 RR(s).
+   Implementations may need to use new methods for caching and
+   retrieving NSEC3 RRs.
+
+9.2.  Use of the AD Bit
+
+   The AD bit, as defined by [RFC4035], MUST NOT be set when returning a
+   response containing a closest (provable) encloser proof in which the
+   NSEC3 RR that covers the "next closer" name has the Opt-Out bit set.
+
+   This rule is based on what this closest encloser proof actually
+   proves: names that would be covered by the Opt-Out NSEC3 RR may or
+   may not exist as insecure delegations.  As such, not all the data in
+   responses containing such closest encloser proofs will have been
+   cryptographically verified, so the AD bit cannot be set.
+
+10.  Special Considerations
+
+10.1.  Domain Name Length Restrictions
+
+   Zones signed using this specification have additional domain name
+   length restrictions imposed upon them.  In particular, zones with
+   names that, when converted into hashed owner names exceed the 255
+   octet length limit imposed by [RFC1035], cannot use this
+   specification.
+
+   The actual maximum length of a domain name in a particular zone
+   depends on both the length of the zone name (versus the whole domain
+   name) and the particular hash function used.
+
+   As an example, SHA-1 produces a hash of 160 bits.  The base-32
+   encoding of 160 bits results in 32 characters.  The 32 characters are
+   prepended to the name of the zone as a single label, which includes a
+   length field of a single octet.  The maximum length of the zone name,
+   when using SHA-1, is 222 octets (255 - 33).
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 26]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+10.2.  DNAME at the Zone Apex
+
+   The DNAME specification in Section 3 of [RFC2672] has a 'no-
+   descendants' limitation.  If a DNAME RR is present at node N, there
+   MUST be no data at any descendant of N.
+
+   If N is the apex of the zone, there will be NSEC3 and RRSIG types
+   present at descendants of N.  This specification updates the DNAME
+   specification to allow NSEC3 and RRSIG types at descendants of the
+   apex regardless of the existence of DNAME at the apex.
+
+10.3.  Iterations
+
+   Setting the number of iterations used allows the zone owner to choose
+   the cost of computing a hash, and therefore the cost of generating a
+   dictionary.  Note that this is distinct from the effect of salt,
+   which prevents the use of a single precomputed dictionary for all
+   time.
+
+   Obviously the number of iterations also affects the zone owner's cost
+   of signing and serving the zone as well as the validator's cost of
+   verifying responses from the zone.  We therefore impose an upper
+   limit on the number of iterations.  We base this on the number of
+   iterations that approximates the cost of verifying an RRSet.
+
+   The limits, therefore, are based on the size of the smallest zone
+   signing key, rounded up to the nearest table value (or rounded down
+   if the key is larger than the largest table value).
+
+   A zone owner MUST NOT use a value higher than shown in the table
+   below for iterations for the given key size.  A resolver MAY treat a
+   response with a higher value as insecure, after the validator has
+   verified that the signature over the NSEC3 RR is correct.
+
+                         +----------+------------+
+                         | Key Size | Iterations |
+                         +----------+------------+
+                         | 1024     | 150        |
+                         | 2048     | 500        |
+                         | 4096     | 2,500      |
+                         +----------+------------+
+
+   This table is based on an approximation of the ratio between the cost
+   of an SHA-1 calculation and the cost of an RSA verification for keys
+   of size 1024 bits (150 to 1), 2048 bits (500 to 1), and 4096 bits
+   (2500 to 1).
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 27]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   The ratio between SHA-1 calculation and DSA verification is higher
+   (1500 to 1 for keys of size 1024).  A higher iteration count degrades
+   performance, while DSA verification is already more expensive than
+   RSA for the same key size.  Therefore the values in the table MUST be
+   used independent of the key algorithm.
+
+10.4.  Transitioning a Signed Zone from NSEC to NSEC3
+
+   When transitioning an already signed and trusted zone to this
+   specification, care must be taken to prevent client validation
+   failures during the process.
+
+   The basic procedure is as follows:
+
+   1.  Transition all DNSKEYs to DNSKEYs using the algorithm aliases
+       described in Section 2.  The actual method for safely and
+       securely changing the DNSKEY RRSet of the zone is outside the
+       scope of this specification.  However, the end result MUST be
+       that all DS RRs in the parent use the specified algorithm
+       aliases.
+
+       After this transition is complete, all NSEC3-unaware clients will
+       treat the zone as insecure.  At this point, the authoritative
+       server still returns negative and wildcard responses that contain
+       NSEC RRs.
+
+   2.  Add signed NSEC3 RRs to the zone, either incrementally or all at
+       once.  If adding incrementally, then the last RRSet added MUST be
+       the NSEC3PARAM RRSet.
+
+   3.  Upon the addition of the NSEC3PARAM RRSet, the server switches to
+       serving negative and wildcard responses with NSEC3 RRs according
+       to this specification.
+
+   4.  Remove the NSEC RRs either incrementally or all at once.
+
+10.5.  Transitioning a Signed Zone from NSEC3 to NSEC
+
+   To safely transition back to a DNSSEC [RFC4035] signed zone, simply
+   reverse the procedure above:
+
+   1.  Add NSEC RRs incrementally or all at once.
+
+   2.  Remove the NSEC3PARAM RRSet.  This will signal the server to use
+       the NSEC RRs for negative and wildcard responses.
+
+   3.  Remove the NSEC3 RRs either incrementally or all at once.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 28]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   4.  Transition all of the DNSKEYs to DNSSEC algorithm identifiers.
+       After this transition is complete, all NSEC3-unaware clients will
+       treat the zone as secure.
+
+11.  IANA Considerations
+
+   Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm
+   parameter, this document does not define a particular mechanism for
+   safely transitioning from one NSEC3 hash algorithm to another.  When
+   specifying a new hash algorithm for use with NSEC3, a transition
+   mechanism MUST also be defined.
+
+   This document updates the IANA registry "DOMAIN NAME SYSTEM
+   PARAMETERS" (http://www.iana.org/assignments/dns-parameters) in sub-
+   registry "TYPES", by defining two new types.  Section 3 defines the
+   NSEC3 RR type 50.  Section 4 defines the NSEC3PARAM RR type 51.
+
+   This document updates the IANA registry "DNS SECURITY ALGORITHM
+   NUMBERS -- per [RFC4035]"
+   (http://www.iana.org/assignments/dns-sec-alg-numbers).  Section 2
+   defines the aliases DSA-NSEC3-SHA1 (6) and RSASHA1-NSEC3-SHA1 (7) for
+   respectively existing registrations DSA and RSASHA1 in combination
+   with NSEC3 hash algorithm SHA1.
+
+   Since these algorithm numbers are aliases for existing DNSKEY
+   algorithm numbers, the flags that exist for the original algorithm
+   are valid for the alias algorithm.
+
+   This document creates a new IANA registry for NSEC3 flags.  This
+   registry is named "DNSSEC NSEC3 Flags".  The initial contents of this
+   registry are:
+
+     0   1   2   3   4   5   6   7
+   +---+---+---+---+---+---+---+---+
+   |   |   |   |   |   |   |   |Opt|
+   |   |   |   |   |   |   |   |Out|
+   +---+---+---+---+---+---+---+---+
+
+      bit 7 is the Opt-Out flag.
+
+      bits 0 - 6 are available for assignment.
+
+   Assignment of additional NSEC3 Flags in this registry requires IETF
+   Standards Action [RFC2434].
+
+   This document creates a new IANA registry for NSEC3PARAM flags.  This
+   registry is named "DNSSEC NSEC3PARAM Flags".  The initial contents of
+   this registry are:
+
+
+
+Laurie, et al.              Standards Track                    [Page 29]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+     0   1   2   3   4   5   6   7
+   +---+---+---+---+---+---+---+---+
+   |   |   |   |   |   |   |   | 0 |
+   +---+---+---+---+---+---+---+---+
+
+      bit 7 is reserved and must be 0.
+
+      bits 0 - 6 are available for assignment.
+
+   Assignment of additional NSEC3PARAM Flags in this registry requires
+   IETF Standards Action [RFC2434].
+
+   Finally, this document creates a new IANA registry for NSEC3 hash
+   algorithms.  This registry is named "DNSSEC NSEC3 Hash Algorithms".
+   The initial contents of this registry are:
+
+      0 is Reserved.
+
+      1 is SHA-1.
+
+      2-255 Available for assignment.
+
+   Assignment of additional NSEC3 hash algorithms in this registry
+   requires IETF Standards Action [RFC2434].
+
+12.  Security Considerations
+
+12.1.  Hashing Considerations
+
+12.1.1.  Dictionary Attacks
+
+   The NSEC3 RRs are still susceptible to dictionary attacks (i.e., the
+   attacker retrieves all the NSEC3 RRs, then calculates the hashes of
+   all likely domain names, comparing against the hashes found in the
+   NSEC3 RRs, and thus enumerating the zone).  These are substantially
+   more expensive than enumerating the original NSEC RRs would have
+   been, and in any case, such an attack could also be used directly
+   against the name server itself by performing queries for all likely
+   names, though this would obviously be more detectable.  The expense
+   of this off-line attack can be chosen by setting the number of
+   iterations in the NSEC3 RR.
+
+   Zones are also susceptible to a pre-calculated dictionary attack --
+   that is, a list of hashes for all likely names is computed once, then
+   NSEC3 RR is scanned periodically and compared against the precomputed
+   hashes.  This attack is prevented by changing the salt on a regular
+   basis.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 30]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   The salt SHOULD be at least 64 bits long and unpredictable, so that
+   an attacker cannot anticipate the value of the salt and compute the
+   next set of dictionaries before the zone is published.
+
+12.1.2.  Collisions
+
+   Hash collisions between QNAME and the owner name of an NSEC3 RR may
+   occur.  When they do, it will be impossible to prove the non-
+   existence of the colliding QNAME.  However, with SHA-1, this is
+   highly unlikely (on the order of 1 in 2^160).  Note that DNSSEC
+   already relies on the presumption that a cryptographic hash function
+   is second pre-image resistant, since these hash functions are used
+   for generating and validating signatures and DS RRs.
+
+12.1.3.  Transitioning to a New Hash Algorithm
+
+   Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm
+   parameter, this document does not define a particular mechanism for
+   safely transitioning from one NSEC3 hash algorithm to another.  When
+   specifying a new hash algorithm for use with NSEC3, a transition
+   mechanism MUST also be defined.  It is possible that the only
+   practical and palatable transition mechanisms may require an
+   intermediate transition to an insecure state, or to a state that uses
+   NSEC records instead of NSEC3.
+
+12.1.4.  Using High Iteration Values
+
+   Since validators should treat responses containing NSEC3 RRs with
+   high iteration values as insecure, presence of just one signed NSEC3
+   RR with a high iteration value in a zone provides attackers with a
+   possible downgrade attack.
+
+   The attack is simply to remove any existing NSEC3 RRs from a
+   response, and replace or add a single (or multiple) NSEC3 RR that
+   uses a high iterations value to the response.  Validators will then
+   be forced to treat the response as insecure.  This attack would be
+   effective only when all of following conditions are met:
+
+   o  There is at least one signed NSEC3 RR that uses a high iterations
+      value present in the zone.
+
+   o  The attacker has access to one or more of these NSEC3 RRs.  This
+      is trivially true when the NSEC3 RRs with high iteration values
+      are being returned in typical responses, but may also be true if
+      the attacker can access the zone via AXFR or IXFR queries, or any
+      other methodology.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 31]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Using a high number of iterations also introduces an additional
+   denial-of-service opportunity against servers, since servers must
+   calculate several hashes per negative or wildcard response.
+
+12.2.  Opt-Out Considerations
+
+   The Opt-Out Flag (O) allows for unsigned names, in the form of
+   delegations to unsigned zones, to exist within an otherwise signed
+   zone.  All unsigned names are, by definition, insecure, and their
+   validity or existence cannot be cryptographically proven.
+
+   In general:
+
+   o  Resource records with unsigned names (whether existing or not)
+      suffer from the same vulnerabilities as RRs in an unsigned zone.
+      These vulnerabilities are described in more detail in [RFC3833]
+      (note in particular Section 2.3, "Name Chaining" and Section 2.6,
+      "Authenticated Denial of Domain Names").
+
+   o  Resource records with signed names have the same security whether
+      or not Opt-Out is used.
+
+   Note that with or without Opt-Out, an insecure delegation may be
+   undetectably altered by an attacker.  Because of this, the primary
+   difference in security when using Opt-Out is the loss of the ability
+   to prove the existence or nonexistence of an insecure delegation
+   within the span of an Opt-Out NSEC3 RR.
+
+   In particular, this means that a malicious entity may be able to
+   insert or delete RRs with unsigned names.  These RRs are normally NS
+   RRs, but this also includes signed wildcard expansions (while the
+   wildcard RR itself is signed, its expanded name is an unsigned name).
+
+   Note that being able to add a delegation is functionally equivalent
+   to being able to add any RR type: an attacker merely has to forge a
+   delegation to name server under his/her control and place whatever
+   RRs needed at the subzone apex.
+
+   While in particular cases, this issue may not present a significant
+   security problem, in general it should not be lightly dismissed.
+   Therefore, it is strongly RECOMMENDED that Opt-Out be used sparingly.
+   In particular, zone signing tools SHOULD NOT default to using Opt-
+   Out, and MAY choose to not support Opt-Out at all.
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 32]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+12.3.  Other Considerations
+
+   Walking the NSEC3 RRs will reveal the total number of RRs in the zone
+   (plus empty non-terminals), and also what types there are.  This
+   could be mitigated by adding dummy entries, but certainly an upper
+   limit can always be found.
+
+13.  References
+
+13.1.  Normative References
+
+   [RFC1034]         Mockapetris, P., "Domain names - concepts and
+                     facilities", STD 13, RFC 1034, November 1987.
+
+   [RFC1035]         Mockapetris, P., "Domain names - implementation and
+                     specification", STD 13, RFC 1035, November 1987.
+
+   [RFC2119]         Bradner, S., "Key words for use in RFCs to Indicate
+                     Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+   [RFC2136]         Vixie, P., Thomson, S., Rekhter, Y., and J. Bound,
+                     "Dynamic Updates in the Domain Name System (DNS
+                     UPDATE)", RFC 2136, April 1997.
+
+   [RFC2181]         Elz, R. and R. Bush, "Clarifications to the DNS
+                     Specification", RFC 2181, July 1997.
+
+   [RFC2308]         Andrews, M., "Negative Caching of DNS Queries (DNS
+                     NCACHE)", RFC 2308, March 1998.
+
+   [RFC2434]         Narten, T. and H. Alvestrand, "Guidelines for
+                     Writing an IANA Considerations Section in RFCs",
+                     BCP 26, RFC 2434, October 1998.
+
+   [RFC2929]         Eastlake, D., Brunner-Williams, E., and B. Manning,
+                     "Domain Name System (DNS) IANA Considerations",
+                     BCP 42, RFC 2929, September 2000.
+
+   [RFC3597]         Gustafsson, A., "Handling of Unknown DNS Resource
+                     Record (RR) Types", RFC 3597, September 2003.
+
+   [RFC4033]         Arends, R., Austein, R., Larson, M., Massey, D.,
+                     and S. Rose, "DNS Security Introduction and
+                     Requirements", RFC 4033, March 2005.
+
+   [RFC4034]         Arends, R., Austein, R., Larson, M., Massey, D.,
+                     and S. Rose, "Resource Records for the DNS Security
+                     Extensions", RFC 4034, March 2005.
+
+
+
+Laurie, et al.              Standards Track                    [Page 33]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   [RFC4035]         Arends, R., Austein, R., Larson, M., Massey, D.,
+                     and S. Rose, "Protocol Modifications for the DNS
+                     Security Extensions", RFC 4035, March 2005.
+
+   [RFC4648]         Josefsson, S., "The Base16, Base32, and Base64 Data
+                     Encodings", RFC 4648, October 2006.
+
+13.2.  Informative References
+
+   [DNSEXT-NO]       Josefsson, S., "Authenticating Denial of Existence
+                     in DNS with Minimum Disclosure", Work in Progress,
+                     July 2000.
+
+   [DNSEXT-NSEC2v2]  Laurie, B., "DNSSEC NSEC2 Owner and RDATA Format",
+                     Work in Progress, December 2004.
+
+   [RFC2672]         Crawford, M., "Non-Terminal DNS Name Redirection",
+                     RFC 2672, August 1999.
+
+   [RFC2898]         Kaliski, B., "PKCS #5: Password-Based Cryptography
+                     Specification Version 2.0", RFC 2898,
+                     September 2000.
+
+   [RFC3833]         Atkins, D. and R. Austein, "Threat Analysis of the
+                     Domain Name System (DNS)", RFC 3833, August 2004.
+
+   [RFC4592]         Lewis, E., "The Role of Wildcards in the Domain
+                     Name System", RFC 4592, July 2006.
+
+   [RFC4956]         Arends, R., Kosters, M., and D. Blacka, "DNS
+                     Security (DNSSEC) Opt-In", RFC 4956, July 2007.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 34]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+Appendix A.  Example Zone
+
+   This is a zone showing its NSEC3 RRs.  They can also be used as test
+   vectors for the hash algorithm.
+
+   The overall TTL and class are specified in the SOA RR, and are
+   subsequently omitted for clarity.
+
+   The zone is preceded by a list that contains the hashes of the
+   original ownernames.
+
+   ; H(example)       = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
+   ; H(a.example)     = 35mthgpgcu1qg68fab165klnsnk3dpvl
+   ; H(ai.example)    = gjeqe526plbf1g8mklp59enfd789njgi
+   ; H(ns1.example)   = 2t7b4g4vsa5smi47k61mv5bv1a22bojr
+   ; H(ns2.example)   = q04jkcevqvmu85r014c7dkba38o0ji5r
+   ; H(w.example)     = k8udemvp1j2f7eg6jebps17vp3n8i58h
+   ; H(*.w.example)   = r53bq7cc2uvmubfu5ocmm6pers9tk9en
+   ; H(x.w.example)   = b4um86eghhds6nea196smvmlo4ors995
+   ; H(y.w.example)   = ji6neoaepv8b5o6k4ev33abha8ht9fgc
+   ; H(x.y.w.example) = 2vptu5timamqttgl4luu9kg21e0aor3s
+   ; H(xx.example)    = t644ebqk9bibcna874givr6joj62mlhv
+   ; H(2t7b4g4vsa5smi47k61mv5bv1a22bojr.example)
+   ;                  = kohar7mbb8dc2ce8a9qvl8hon4k53uhi
+   example. 3600  IN SOA  ns1.example. bugs.x.w.example. 1 3600 300 (
+                          3600000 3600 )
+                  RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                          q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                          VI2LmKusbZsT0Q== )
+                  NS      ns1.example.
+                  NS      ns2.example.
+                  RRSIG   NS 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ
+                          qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv
+                          CnMXjtz6SyObxA== )
+                  MX      1 xx.example.
+                  RRSIG   MX 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          GgQ1A9xs47k42VPvpL/a1BWUz/6XsnHkjotw
+                          9So8MQtZtl2wJBsnOQsaoHrRCrRbyriEl/GZ
+                          n9Mto/Kx+wBo+w== )
+                  DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU (
+                          sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h
+                          TY4hHn9npWFRw5BYubE= )
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 35]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ (
+                          j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9
+                          AbsUdblMFin8CVF3n4s= )
+                  RRSIG   DNSKEY 7 1 3600 20150420235959 (
+                          20051021000000 12708 example.
+                          AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31
+                          uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm
+                          MGQZf3bH+QsCtg== )
+                  NSEC3PARAM 1 0 12 aabbccdd
+                  RRSIG   NSEC3PARAM 7 1 3600 20150420235959 (
+                          20051021000000 40430 example.
+                          C1Gl8tPZNtnjlrYWDeeUV/sGLCyy/IHie2re
+                          rN05XSA3Pq0U3+4VvGWYWdUMfflOdxqnXHwJ
+                          TLQsjlkynhG6Cg== )
+   0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                          2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                          SOA NSEC3PARAM RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                          IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                          BOCXJZMnpuwhpA== )
+   2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. A 192.0.2.127
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          h6c++bzhRuWWt2bykN6mjaTNBcXNq5UuL5Ed
+                          K+iDP4eY8I0kSiKaCjg3tC1SQkeloMeub2GW
+                          k8p6xHMPZumXlw== )
+                  NSEC3   1 1 12 aabbccdd (
+                          2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN
+                          4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq
+                          NI6mRk/r1dOSUw== )
+   2vptu5timamqttgl4luu9kg21e0aor3s.example. NSEC3 1 1 12 aabbccdd (
+                          35mthgpgcu1qg68fab165klnsnk3dpvl MX RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          KL1V2oFYghNV0Hm7Tf2vpJjM6l+0g1JCcVYG
+                          VfI0lKrhPmTsOA96cLEACgo1x8I7kApJX+ob
+                          TuktZ+sdsZPY1w== )
+   35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
+                          b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 36]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ
+                          Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ
+                          XtAIR3chwgW+SA== )
+   a.example.     NS      ns1.a.example.
+                  NS      ns2.a.example.
+                  DS      58470 5 1 (
+                          3079F1593EBAD6DC121E202A8B766A6A4837206C )
+                  RRSIG   DS 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          XacFcQVHLVzdoc45EJhN616zQ4mEXtE8FzUh
+                          M2KWjfy1VfRKD9r1MeVGwwoukOKgJxBPFsWo
+                          o722vZ4UZ2dIdA== )
+   ns1.a.example. A       192.0.2.5
+   ns2.a.example. A       192.0.2.6
+   ai.example.    A       192.0.2.9
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F
+                          tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+
+                          rznEn8sQ64UdqA== )
+                  HINFO   "KLH-10" "ITS"
+                  RRSIG   HINFO 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          Yi42uOq43eyO6qXHNvwwfFnIustWgV5urFcx
+                          enkLvs6pKRh00VBjODmf3Z4nMO7IOl6nHSQ1
+                          v0wLHpEZG7Xj2w== )
+                  AAAA    2001:db8:0:0:0:0:f00:baa9
+                  RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W
+                          uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG
+                          cHueLuXkMjBArQ== )
+   b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd (
+                          gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh
+                          5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3
+                          pOv0TSTyiTxIZg== )
+   c.example.     NS      ns1.c.example.
+                  NS      ns2.c.example.
+   ns1.c.example. A       192.0.2.7
+   ns2.c.example. A       192.0.2.8
+   gjeqe526plbf1g8mklp59enfd789njgi.example. NSEC3 1 1 12 aabbccdd (
+                          ji6neoaepv8b5o6k4ev33abha8ht9fgc HINFO A AAAA
+                          RRSIG )
+
+
+
+Laurie, et al.              Standards Track                    [Page 37]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          IVnezTJ9iqblFF97vPSmfXZ5Zozngx3KX3by
+                          LTZC4QBH2dFWhf6scrGFZB980AfCxoD9qbbK
+                          Dy+rdGIeRSVNyw== )
+   ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd (
+                          k8udemvp1j2f7eg6jebps17vp3n8i58h )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7
+                          2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0
+                          MpzVSKfTwx4uYA== )
+   k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd (
+                          kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK
+                          S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt
+                          Otx7w9WfcIg62A== )
+   kohar7mbb8dc2ce8a9qvl8hon4k53uhi.example. NSEC3 1 1 12 aabbccdd (
+                          q04jkcevqvmu85r014c7dkba38o0ji5r A RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          VrDXs2uVW21N08SyQIz88zml+y4ZCInTwgDr
+                          6zz43yAg+LFERjOrj3Ojct51ac7Dp4eZbf9F
+                          QJazmASFKGxGXg== )
+   ns1.example.   A       192.0.2.1
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          bu6kx73n6XEunoVGuRfAgY7EF/AJqHy7hj0j
+                          kiqJjB0dOrx3wuz9SaBeGfqWIdn/uta3SavN
+                          4FRvZR9SCFHF5Q== )
+   ns2.example.   A       192.0.2.2
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          ktQ3TqE0CfRfki0Rb/Ip5BM0VnxelbuejCC4
+                          zpLbFKA/7eD7UNAwxMgxJPtbdST+syjYSJaj
+                          4IHfeX6n8vfoGA== )
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
+                          r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3
+                          ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN
+                          NlkxWcLsIlMmUg== )
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 38]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd (
+                          t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C
+                          ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+
+                          HF1FWKW7RIJdtQ== )
+   t644ebqk9bibcna874givr6joj62mlhv.example. NSEC3 1 1 12 aabbccdd (
+                          0p9mhaveqvm6t7vbl5lop2u3t2rp3tom HINFO A AAAA
+                          RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          RAjGECB8P7O+F4Pa4Dx3tC0M+Z3KmlLKImca
+                          fb9XWwx+NWUNz7NBEDBQHivIyKPVDkChcePI
+                          X1xPl1ATNa+8Dw== )
+   *.w.example.   MX      1 ai.example.
+                  RRSIG   MX 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb
+                          9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM
+                          ivEBP6+4KS3ldA== )
+   x.w.example.   MX      1 xx.example.
+                  RRSIG   MX 7 3 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          IrK3tq/tHFIBF0scHiE/1IwMAvckS/55hAVv
+                          QyxTFbkAdDloP3NbZzu+yoSsr3b3OX6qbBpY
+                          7WCtwwekLKRAwQ== )
+   x.y.w.example. MX      1 xx.example.
+                  RRSIG   MX 7 4 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          MqSt5HqJIN8+SLlzTOImrh5h9Xa6gDvAW/Gn
+                          nbdPc6Z7nXvCpLPJj/5lCwx3VuzVOjkbvXze
+                          8/8Ccl2Zn2hbug== )
+   xx.example.    A       192.0.2.10
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          T35hBWEZ017VC5u2c4OriKyVn/pu+fVK4AlX
+                          YOxJ6iQylfV2HQIKjv6b7DzINB3aF/wjJqgX
+                          pQvhq+Ac6+ZiFg== )
+                  HINFO   "KLH-10" "TOPS-20"
+                  RRSIG   HINFO 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          KimG+rDd+7VA1zRsu0ITNAQUTRlpnsmqWrih
+                          FRnU+bRa93v2e5oFNFYCs3Rqgv62K93N7AhW
+                          6Jfqj/8NzWjvKg== )
+                  AAAA    2001:db8:0:0:0:0:f00:baaa
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 39]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          IXBcXORITNwd8h3gNwyxtYFvAupS/CYWufVe
+                          uBUX0O25ivBCULjZjpDxFSxfohb/KA7YRdxE
+                          NzYfMItpILl/Xw== )
+
+Appendix B.  Example Responses
+
+   The examples in this section show response messages using the signed
+   zone example in Appendix A.
+
+B.1.  Name Error
+
+   An authoritative name error.  The NSEC3 RRs prove that the name does
+   not exist and that there is no wildcard RR that should have been
+   expanded.
+
+;; Header: QR AA DO RCODE=3
+;;
+;; Question
+a.c.x.w.example.         IN A
+
+;; Answer
+;; (empty)
+
+;; Authority
+
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                       3600000 3600 )
+example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                       40430 example.
+                       Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                       q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                       VI2LmKusbZsT0Q== )
+
+;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
+;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh
+
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                       2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                       SOA NSEC3PARAM RRSIG )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                       IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                       BOCXJZMnpuwhpA== )
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 40]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+;; NSEC3 RR that matches the closest encloser (x.w.example)
+;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995
+
+b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd (
+                       gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh
+                       5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3
+                       pOv0TSTyiTxIZg== )
+
+;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
+;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m
+
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
+                       b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ
+                       Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ
+                       XtAIR3chwgW+SA== )
+
+;; Additional
+;; (empty)
+
+   The query returned three NSEC3 RRs that prove that the requested data
+   does not exist and that no wildcard expansion applies.  The negative
+   response is authenticated by verifying the NSEC3 RRs.  The
+   corresponding RRSIGs indicate that the NSEC3 RRs are signed by an
+   "example" DNSKEY of algorithm 7 and with key tag 40430.  The resolver
+   needs the corresponding DNSKEY RR in order to authenticate this
+   answer.
+
+   One of the owner names of the NSEC3 RRs matches the closest encloser.
+   One of the NSEC3 RRs prove that there exists no longer name.  One of
+   the NSEC3 RRs prove that there exists no wildcard RRSets that should
+   have been expanded.  The closest encloser can be found by applying
+   the algorithm in Section 8.3.
+
+   In the above example, the name 'x.w.example' hashes to
+   'b4um86eghhds6nea196smvmlo4ors995'.  This indicates that this might
+   be the closest encloser.  To prove that 'c.x.w.example' and
+   '*.x.w.example' do not exist, these names are hashed to,
+   respectively, '0va5bpr2ou0vk0lbqeeljri88laipsfh' and
+   '92pqneegtaue7pjatc3l3qnk738c6v5m'.  The first and last NSEC3 RRs
+   prove that these hashed owner names do not exist.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 41]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.2.  No Data Error
+
+   A "no data" response.  The NSEC3 RR proves that the name exists and
+   that the requested RR type does not.
+
+;; Header: QR AA DO RCODE=0
+;;
+;; Question
+ns1.example.        IN MX
+
+;; Answer
+;; (empty)
+
+;; Authority
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                       3600000 3600 )
+example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                       40430 example.
+                       Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                       q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                       VI2LmKusbZsT0Q== )
+
+;; NSEC3 RR matches the QNAME and shows that the MX type bit is not set.
+
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd (
+                       2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN
+                       4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq
+                       NI6mRk/r1dOSUw== )
+;; Additional
+;; (empty)
+
+   The query returned an NSEC3 RR that proves that the requested name
+   exists ("ns1.example." hashes to "2t7b4g4vsa5smi47k61mv5bv1a22bojr"),
+   but the requested RR type does not exist (type MX is absent in the
+   type code list of the NSEC3 RR), and was not a CNAME (type CNAME is
+   also absent in the type code list of the NSEC3 RR).
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 42]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.2.1.  No Data Error, Empty Non-Terminal
+
+   A "no data" response because of an empty non-terminal.  The NSEC3 RR
+   proves that the name exists and that the requested RR type does not.
+
+ ;; Header: QR AA DO RCODE=0
+ ;;
+ ;; Question
+ y.w.example.        IN A
+
+ ;; Answer
+ ;; (empty)
+
+ ;; Authority
+ example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                        3600000 3600 )
+ example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                        40430 example.
+                        Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                        q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                        VI2LmKusbZsT0Q== )
+
+ ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set.
+
+ ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd (
+                        k8udemvp1j2f7eg6jebps17vp3n8i58h )
+ ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 7 2 3600 (
+                        20150420235959 20051021000000 40430 example.
+                        gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7
+                        2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0
+                        MpzVSKfTwx4uYA== )
+
+ ;; Additional
+ ;; (empty)
+
+   The query returned an NSEC3 RR that proves that the requested name
+   exists ("y.w.example." hashes to "ji6neoaepv8b5o6k4ev33abha8ht9fgc"),
+   but the requested RR type does not exist (Type A is absent in the
+   Type Bit Maps field of the NSEC3 RR).  Note that, unlike an empty
+   non-terminal proof using NSECs, this is identical to a No Data Error.
+   This example is solely mentioned to be complete.
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 43]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.3.  Referral to an Opt-Out Unsigned Zone
+
+   The NSEC3 RRs prove that nothing for this delegation was signed.
+   There is no proof that the unsigned delegation exists.
+
+   ;; Header: QR DO RCODE=0
+   ;;
+   ;; Question
+   mc.c.example.       IN MX
+
+   ;; Answer
+   ;; (empty)
+
+   ;; Authority
+   c.example.     NS      ns1.c.example.
+                  NS      ns2.c.example.
+
+   ;; NSEC3 RR that covers the "next closer" name (c.example)
+   ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
+
+   35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
+                          b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
+   35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ
+                          Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ
+                          XtAIR3chwgW+SA== )
+
+   ;; NSEC3 RR that matches the closest encloser (example)
+   ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
+
+   0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                          2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                          SOA NSEC3PARAM RRSIG )
+   0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                          IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                          BOCXJZMnpuwhpA== )
+
+   ;; Additional
+   ns1.c.example. A       192.0.2.7
+   ns2.c.example. A       192.0.2.8
+
+   The query returned a referral to the unsigned "c.example." zone.  The
+   response contains the closest provable encloser of "c.example" to be
+   "example", since the hash of "c.example"
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 44]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   ("4g6p9u5gvfshp30pqecj98b3maqbn1ck") is covered by the first NSEC3 RR
+   and its Opt-Out bit is set.
+
+B.4.  Wildcard Expansion
+
+   A query that was answered with a response containing a wildcard
+   expansion.  The label count in the RRSIG RRSet in the answer section
+   indicates that a wildcard RRSet was expanded to produce this
+   response, and the NSEC3 RR proves that no "next closer" name exists
+   in the zone.
+
+   ;; Header: QR AA DO RCODE=0
+   ;;
+   ;; Question
+   a.z.w.example. IN MX
+
+   ;; Answer
+   a.z.w.example. MX      1 ai.example.
+   a.z.w.example. RRSIG   MX 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb
+                          9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM
+                          ivEBP6+4KS3ldA== )
+
+   ;; Authority
+   example.       NS      ns1.example.
+   example.       NS      ns2.example.
+   example.       RRSIG   NS 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ
+                          qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv
+                          CnMXjtz6SyObxA== )
+
+   ;; NSEC3 RR that covers the "next closer" name (z.w.example)
+   ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
+
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
+                          r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3
+                          ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN
+                          NlkxWcLsIlMmUg== )
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 45]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   ;; Additional
+   ai.example.    A       192.0.2.9
+   ai.example.    RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F
+                          tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+
+                          rznEn8sQ64UdqA== )
+   ai.example.    AAAA    2001:db8:0:0:0:0:f00:baa9
+   ai.example.    RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W
+                          uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG
+                          cHueLuXkMjBArQ== )
+
+   The query returned an answer that was produced as a result of a
+   wildcard expansion.  The answer section contains a wildcard RRSet
+   expanded as it would be in a traditional DNS response.  The RRSIG
+   Labels field value of 2 indicates that the answer is the result of a
+   wildcard expansion, as the "a.z.w.example" name contains 4 labels.
+   This also shows that "w.example" exists, so there is no need for an
+   NSEC3 RR that matches the closest encloser.
+
+   The NSEC3 RR proves that no closer match could have been used to
+   answer this query.
+
+B.5.  Wildcard No Data Error
+
+   A "no data" response for a name covered by a wildcard.  The NSEC3 RRs
+   prove that the matching wildcard name does not have any RRs of the
+   requested type and that no closer match exists in the zone.
+
+   ;; Header: QR AA DO RCODE=0
+   ;;
+   ;; Question
+   a.z.w.example.      IN AAAA
+
+   ;; Answer
+   ;; (empty)
+
+   ;; Authority
+   example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                          3600000 3600 )
+   example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                          q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                          VI2LmKusbZsT0Q== )
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 46]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   ;; NSEC3 RR that matches the closest encloser (w.example)
+   ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h
+
+   k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd (
+                          kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
+   k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK
+                          S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt
+                          Otx7w9WfcIg62A== )
+
+   ;; NSEC3 RR that covers the "next closer" name (z.w.example)
+   ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
+
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
+                          r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3
+                          ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN
+                          NlkxWcLsIlMmUg== )
+
+   ;; NSEC3 RR that matches a wildcard at the closest encloser.
+   ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en
+
+   r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd (
+                          t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
+   r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C
+                          ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+
+                          HF1FWKW7RIJdtQ== )
+
+   ;; Additional
+   ;; (empty)
+
+   The query returned the NSEC3 RRs that prove that the requested data
+   does not exist and no wildcard RR applies.
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 47]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.6.  DS Child Zone No Data Error
+
+   A "no data" response for a QTYPE=DS query that was mistakenly sent to
+   a name server for the child zone.
+
+;; Header: QR AA DO RCODE=0
+;;
+;; Question
+example.            IN DS
+
+;; Answer
+;; (empty)
+
+;; Authority
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                       3600000 3600 )
+example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                       40430 example.
+                       Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                       q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                       VI2LmKusbZsT0Q== )
+
+;; NSEC3 RR matches the QNAME and shows that the DS type bit is not set.
+
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                       2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                       SOA NSEC3PARAM RRSIG )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600
+                       20150420235959 20051021000000 40430 example.
+                       OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                       IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                       BOCXJZMnpuwhpA== )
+
+;; Additional
+;; (empty)
+
+   The query returned an NSEC3 RR showing that the requested was
+   answered by the server authoritative for the zone "example".  The
+   NSEC3 RR indicates the presence of an SOA RR, showing that this NSEC3
+   RR is from the apex of the child, not from the zone cut of the
+   parent.  Queries for the "example" DS RRSet should be sent to the
+   parent servers (which are in this case the root servers).
+
+Appendix C.  Special Considerations
+
+   The following paragraphs clarify specific behavior and explain
+   special considerations for implementations.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 48]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+C.1.  Salting
+
+   Augmenting original owner names with salt before hashing increases
+   the cost of a dictionary of pre-generated hash-values.  For every bit
+   of salt, the cost of a precomputed dictionary doubles (because there
+   must be an entry for each word combined with each possible salt
+   value).  The NSEC3 RR can use a maximum of 2040 bits (255 octets) of
+   salt, multiplying the cost by 2^2040.  This means that an attacker
+   must, in practice, recompute the dictionary each time the salt is
+   changed.
+
+   Including a salt, regardless of size, does not affect the cost of
+   constructing NSEC3 RRs.  It does increase the size of the NSEC3 RR.
+
+   There MUST be at least one complete set of NSEC3 RRs for the zone
+   using the same salt value.
+
+   The salt SHOULD be changed periodically to prevent pre-computation
+   using a single salt.  It is RECOMMENDED that the salt be changed for
+   every re-signing.
+
+   Note that this could cause a resolver to see RRs with different salt
+   values for the same zone.  This is harmless, since each RR stands
+   alone (that is, it denies the set of owner names whose hashes, using
+   the salt in the NSEC3 RR, fall between the two hashes in the NSEC3
+   RR) -- it is only the server that needs a complete set of NSEC3 RRs
+   with the same salt in order to be able to answer every possible
+   query.
+
+   There is no prohibition with having NSEC3 RRs with different salts
+   within the same zone.  However, in order for authoritative servers to
+   be able to consistently find covering NSEC3 RRs, the authoritative
+   server MUST choose a single set of parameters (algorithm, salt, and
+   iterations) to use when selecting NSEC3 RRs.
+
+C.2.  Hash Collision
+
+   Hash collisions occur when different messages have the same hash
+   value.  The expected number of domain names needed to give a 1 in 2
+   chance of a single collision is about 2^(n/2) for a hash of length n
+   bits (i.e., 2^80 for SHA-1).  Though this probability is extremely
+   low, the following paragraphs deal with avoiding collisions and
+   assessing possible damage in the event of an attack using hash
+   collisions.
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 49]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+C.2.1.  Avoiding Hash Collisions During Generation
+
+   During generation of NSEC3 RRs, hash values are supposedly unique.
+   In the (academic) case of a collision occurring, an alternative salt
+   MUST be chosen and all hash values MUST be regenerated.
+
+C.2.2.  Second Preimage Requirement Analysis
+
+   A cryptographic hash function has a second-preimage resistance
+   property.  The second-preimage resistance property means that it is
+   computationally infeasible to find another message with the same hash
+   value as a given message, i.e., given preimage X, to find a second
+   preimage X' != X such that hash(X) = hash(X').  The work factor for
+   finding a second preimage is of the order of 2^160 for SHA-1.  To
+   mount an attack using an existing NSEC3 RR, an adversary needs to
+   find a second preimage.
+
+   Assuming an adversary is capable of mounting such an extreme attack,
+   the actual damage is that a response message can be generated that
+   claims that a certain QNAME (i.e., the second pre-image) does exist,
+   while in reality QNAME does not exist (a false positive), which will
+   either cause a security-aware resolver to re-query for the non-
+   existent name, or to fail the initial query.  Note that the adversary
+   can't mount this attack on an existing name, but only on a name that
+   the adversary can't choose and that does not yet exist.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 50]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+Authors' Addresses
+
+   Ben Laurie
+   Nominet
+   17 Perryn Road
+   London  W3 7LR
+   England
+
+   Phone: +44 20 8735 0686
+   EMail: ben@links.org
+
+
+   Geoffrey Sisson
+   Nominet
+   Minerva House
+   Edmund Halley Road
+   Oxford Science Park
+   Oxford  OX4 4DQ
+   UNITED KINGDOM
+
+   Phone: +44 1865 332211
+   EMail: geoff-s@panix.com
+
+
+   Roy Arends
+   Nominet
+   Minerva House
+   Edmund Halley Road
+   Oxford Science Park
+   Oxford  OX4 4DQ
+   UNITED KINGDOM
+
+   Phone: +44 1865 332211
+   EMail: roy@nominet.org.uk
+
+
+   David Blacka
+   VeriSign, Inc.
+   21355 Ridgetop Circle
+   Dulles, VA  20166
+   US
+
+   Phone: +1 703 948 3200
+   EMail: davidb@verisign.com
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 51]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+Full Copyright Statement
+
+   Copyright (C) The IETF Trust (2008).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
+   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
+   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 52]
+
diff --git a/lib/bind/api b/lib/bind/api
index d4b1ecd36b2ba..7ffeba810f243 100644
--- a/lib/bind/api
+++ b/lib/bind/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 4
-LIBREVISION = 9
-LIBAGE = 0
+LIBINTERFACE = 5
+LIBREVISION = 2
+LIBAGE = 1
diff --git a/lib/bind/bsd/Makefile.in b/lib/bind/bsd/Makefile.in
index dd7b616e482d0..998cd637e2b11 100644
--- a/lib/bind/bsd/Makefile.in
+++ b/lib/bind/bsd/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:13:22 marka Exp $
+# $Id: Makefile.in,v 1.6.206.3 2008/04/28 23:45:35 tbox Exp $
 
 srcdir=         @srcdir@
 VPATH =         @srcdir@
@@ -34,6 +34,6 @@ SRCS=	daemon.c ftruncate.c gettimeofday.c mktemp.c putenv.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/bsd/strerror.c b/lib/bind/bsd/strerror.c
index d13adbb03b4df..5fba248f36247 100644
--- a/lib/bind/bsd/strerror.c
+++ b/lib/bind/bsd/strerror.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strerror.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strerror.c,v 1.3.2.1 2001/11/02 17:45:31 gson Exp $";
+static const char rcsid[] = "$Id: strerror.c,v 1.3.2.1.10.1 2008/04/28 04:25:42 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -60,12 +60,14 @@ isc_strerror(int num) {
 	static char ebuf[40] = UPREFIX;		/* 64-bit number + slop */
 	u_int errnum;
 	char *p, *t;
+#ifndef USE_SYSERROR_LIST
 	const char *ret;
+#endif
 	char tmp[40];
 
 	errnum = num;				/* convert to unsigned */
 #ifdef USE_SYSERROR_LIST
-	if (errnum < sys_nerr)
+	if (errnum < (u_int)sys_nerr)
 		return (sys_errlist[errnum]);
 #else
 #undef strerror
diff --git a/lib/bind/bsd/strtoul.c b/lib/bind/bsd/strtoul.c
index d110f30943dfa..0741fc5504a3d 100644
--- a/lib/bind/bsd/strtoul.c
+++ b/lib/bind/bsd/strtoul.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strtoul.c,v 1.1.2.1 2003/06/27 03:51:35 marka Exp $";
+static const char rcsid[] = "$Id: strtoul.c,v 1.1.2.1.4.1 2008/04/28 04:25:42 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -70,7 +70,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 	 * See strtol for comments as to the logic used.
 	 */
 	do {
-		c = *(unsigned char *)s++;
+		c = *(const unsigned char *)s++;
 	} while (isspace(c));
 	if (c == '-') {
 		neg = 1;
@@ -87,7 +87,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 		base = c == '0' ? 8 : 10;
 	cutoff = (u_long)ULONG_MAX / (u_long)base;
 	cutlim = (u_long)ULONG_MAX % (u_long)base;
-	for (acc = 0, any = 0;; c = *(unsigned char*)s++) {
+	for (acc = 0, any = 0;; c = *(const unsigned char*)s++) {
 		if (isdigit(c))
 			c -= '0';
 		else if (isalpha(c))
@@ -96,7 +96,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 			break;
 		if (c >= base)
 			break;
-		if (any < 0 || acc > cutoff || acc == cutoff && c > cutlim)
+		if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim))
 			any = -1;
 		else {
 			any = 1;
@@ -110,7 +110,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 	} else if (neg)
 		acc = -acc;
 	if (endptr != 0)
-		*endptr = (char *)(any ? s - 1 : nptr);
+		DE_CONST((any ? s - 1 : nptr), *endptr);
 	return (acc);
 }
 
diff --git a/lib/bind/configure.in b/lib/bind/configure.in
index 4b752f93f1e1e..5115dc8eabfdd 100644
--- a/lib/bind/configure.in
+++ b/lib/bind/configure.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-AC_REVISION($Revision: 1.83.2.5.2.38.2.1 $)
+AC_REVISION($Revision: 1.83.2.5.2.42 $)
 
 AC_INIT(resolv/herror.c)
 AC_PREREQ(2.13)
@@ -169,7 +169,7 @@ AC_PROG_CC
 AC_HEADER_STDC
 
 
-AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/timers.h stropts.h)
+AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/timers.h stropts.h memory.h)
 
 AC_C_CONST
 AC_C_INLINE
@@ -461,6 +461,7 @@ AC_SUBST(WANT_THREADS_OBJS)
 AC_CHECK_FUNC(strlcat, AC_DEFINE(HAVE_STRLCAT))
 AC_CHECK_FUNC(memmove, AC_DEFINE(HAVE_MEMMOVE))
 AC_CHECK_FUNC(memchr, AC_DEFINE(HAVE_MEMCHR))
+AC_CHECK_FUNC(strtoul, , AC_DEFINE(NEED_STRTOUL))
 
 AC_CHECK_FUNC(if_nametoindex,
 	[USE_IFNAMELINKID="#define USE_IFNAMELINKID 1"],
@@ -490,6 +491,16 @@ AC_CHECK_FUNC(strerror, [NEED_STRERROR="#undef NEED_STRERROR"],
 [NEED_STRERROR="#define NEED_STRERROR 1"])
 AC_SUBST(NEED_STRERROR)
 
+if test -n "$NEED_STRERROR"
+then
+	AC_MSG_CHECKING([for extern char * sys_errlist[]])
+	AC_TRY_LINK([ extern int sys_nerr; extern char *sys_errlist[]; ],
+		    [ const char *p = sys_errlist[0]; ],
+		    AC_MSG_RESULT(yes)
+		    AC_DEFINE(USE_SYSERROR_LIST),
+		    AC_MSG_RESULT(no))
+fi
+
 #
 # flockfile is usually provided by pthreads, but we may want to use it
 # even if compiled with --disable-threads.
@@ -666,6 +677,14 @@ AC_SUBST(PURIFY)
 #
 # GNU libtool support
 #
+case $host in
+sunos*)
+    # Just set the maximum command line length for sunos as it otherwise
+    # takes a exceptionally long time to work it out. Required for libtool.
+    lt_cv_sys_max_cmd_len=4096;
+    ;;
+esac
+
 AC_ARG_WITH(libtool,
 	    [  --with-libtool	use GNU libtool (following indented options supported)],
 	    use_libtool="$withval", use_libtool="no")
@@ -1050,6 +1069,7 @@ case "$host" in
 	*-qnx*)		PORT_DIR="port/qnx";;
 	*-rhapsody*)	PORT_DIR="port/rhapsody";;
 	*-sunos4*)
+			AC_DEFINE(NEED_SUN4PROTOS)
 			PORT_NONBLOCK="#define PORT_NONBLOCK O_NDELAY"
 			PORT_DIR="port/sunos";;
 	*-solaris2.[[01234]])
@@ -1246,6 +1266,38 @@ found_rt_iflist
 AC_CHECK_FUNC(strsep,
 	[ISC_PLATFORM_NEEDSTRSEP="#undef ISC_PLATFORM_NEEDSTRSEP"],
 	[ISC_PLATFORM_NEEDSTRSEP="#define ISC_PLATFORM_NEEDSTRSEP 1"])
+
+
+AC_MSG_CHECKING(for char *sprintf)
+AC_TRY_COMPILE([
+#include 
+],
+[ char buf[2]; return(*sprintf(buf,"x"));],
+AC_DEFINE(SPRINTF_CHAR)
+AC_MSG_RESULT(yes)
+,
+AC_MSG_RESULT(no)
+)
+
+AC_MSG_CHECKING(for char *vsprintf)
+case $host in
+*sunos4*) # not decared in any header file.
+AC_DEFINE(VSPRINTF_CHAR)
+AC_MSG_RESULT(yes)
+;;
+*)
+AC_TRY_COMPILE([
+#include 
+],
+[ char buf[2]; return(*vsprintf(buf,"x"));],
+AC_DEFINE(VSPRINTF_CHAR)
+AC_MSG_RESULT(yes)
+,
+AC_MSG_RESULT(no)
+)
+;;
+esac
+
 AC_CHECK_FUNC(vsnprintf,
 	[ISC_PLATFORM_NEEDVSNPRINTF="#undef ISC_PLATFORM_NEEDVSNPRINTF"],
 	[ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS print.$O"
@@ -1256,12 +1308,7 @@ AC_SUBST(ISC_PLATFORM_NEEDVSNPRINTF)
 
 AC_SUBST(ISC_EXTRA_OBJS)
 AC_SUBST(ISC_EXTRA_SRCS)
-AC_CHECK_FUNC(strerror,
-	[USE_SYSERROR_LIST="#undef USE_SYSERROR_LIST"],
-	[USE_SYSERROR_LIST="#define USE_SYSERROR_LIST 1"])
-AC_SUBST(USE_SYSERROR_LIST)
 
-#
 # Determine the printf format characters to use when printing
 # values of type isc_int64_t.  We make the assumption that platforms
 # where a "long long" is the same size as a "long" (e.g., Alpha/OSF1)
@@ -2590,7 +2637,7 @@ case "$host" in
 	*-solaris2.9)
 		hack_shutup_in6addr_init_macros=yes
 		;;
-	*-solaris2.1[0-9])
+	*-solaris2.1[[0-9]])
 		hack_shutup_in6addr_init_macros=yes
 		;;
 esac
diff --git a/lib/bind/dst/Makefile.in b/lib/bind/dst/Makefile.in
index 8b306591708ea..dbc0265669fdb 100644
--- a/lib/bind/dst/Makefile.in
+++ b/lib/bind/dst/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.5.206.1 2004/03/06 08:13:22 marka Exp $
+# $Id: Makefile.in,v 1.5.206.3 2008/04/28 23:45:35 tbox Exp $
  
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -26,7 +26,7 @@ TARGETS= ${OBJS}
 
 CRYPTFLAGS=     -DCYLINK_DSS -DHMAC_MD5 -DUSE_MD5 -DDNSSAFE
 
-CINCLUDES= -I.. -I${srcdir}/../include ${CRYPTINCL}
+CINCLUDES= -I.. -I../include -I${srcdir}/../include ${CRYPTINCL}
 CDEFINES= ${CRYPTFLAGS}
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/dst/dst_api.c b/lib/bind/dst/dst_api.c
index c1313075aeeec..f2bf7d2667710 100644
--- a/lib/bind/dst/dst_api.c
+++ b/lib/bind/dst/dst_api.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.4.2.6.8.6 2007/09/24 17:26:10 each Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/dst_api.c,v 1.4.2.6.8.6 2007/09/24 17:26:10 each Exp $";
 #endif
 
 /*
diff --git a/lib/bind/dst/hmac_link.c b/lib/bind/dst/hmac_link.c
index efad2583f666b..6656226473146 100644
--- a/lib/bind/dst/hmac_link.c
+++ b/lib/bind/dst/hmac_link.c
@@ -1,6 +1,6 @@
 #ifdef HMAC_MD5
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.2.2.1.4.4 2007/09/24 17:26:10 each Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.2.2.1.4.4 2007/09/24 17:26:10 each Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
diff --git a/lib/bind/dst/support.c b/lib/bind/dst/support.c
index 8fe3cdb4780d8..8bcc4e0e6df15 100644
--- a/lib/bind/dst/support.c
+++ b/lib/bind/dst/support.c
@@ -1,4 +1,4 @@
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/support.c,v 1.2.2.1.10.2 2005/10/11 00:48:14 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/support.c,v 1.2.2.1.10.2 2005/10/11 00:48:14 marka Exp $";
 
 
 /*
diff --git a/lib/bind/include/arpa/nameser.h b/lib/bind/include/arpa/nameser.h
index 23db49871dcfa..ab297a14c7967 100644
--- a/lib/bind/include/arpa/nameser.h
+++ b/lib/bind/include/arpa/nameser.h
@@ -49,7 +49,7 @@
  */
 
 /*
- *	$Id: nameser.h,v 1.2.2.4.4.1 2004/03/09 08:33:30 marka Exp $
+ *	$Id: nameser.h,v 1.2.2.4.4.2 2008/04/28 05:46:51 marka Exp $
  */
 
 #ifndef _ARPA_NAMESER_H_
@@ -430,9 +430,10 @@ typedef enum __ns_cert_types {
 #define NS_NXT_MAX 127
 
 /*
- * EDNS0 extended flags, host order.
+ * EDNS0 extended flags and option codes, host order.
  */
 #define NS_OPT_DNSSEC_OK	0x8000U
+#define NS_OPT_NSID		3
 
 /*
  * Inline versions of get/put short/long.  Pointer is advanced.
diff --git a/lib/bind/include/isc/assertions.h b/lib/bind/include/isc/assertions.h
index 9a9b9dec98559..4b3335368e871 100644
--- a/lib/bind/include/isc/assertions.h
+++ b/lib/bind/include/isc/assertions.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: assertions.h,v 1.1.206.1 2004/03/09 08:33:30 marka Exp $
+ * $Id: assertions.h,v 1.1.206.2 2008/10/15 03:57:45 marka Exp $
  */
 
 #ifndef ASSERTIONS_H
@@ -29,18 +29,19 @@ typedef enum {
 typedef void (*assertion_failure_callback)(const char *, int, assertion_type,
 					   const char *, int);
 
+/* coverity[+kill] */
 extern assertion_failure_callback __assertion_failed;
 void set_assertion_failure_callback(assertion_failure_callback f);
 const char *assertion_type_to_text(assertion_type type);
 
-#ifdef CHECK_ALL
+#if defined(CHECK_ALL) || defined(__COVERITY__)
 #define CHECK_REQUIRE		1
 #define CHECK_ENSURE		1
 #define CHECK_INSIST		1
 #define CHECK_INVARIANT		1
 #endif
 
-#ifdef CHECK_NONE
+#if defined(CHECK_NONE) && !defined(__COVERITY__)
 #define CHECK_REQUIRE		0
 #define CHECK_ENSURE		0
 #define CHECK_INSIST		0
diff --git a/lib/bind/include/isc/misc.h b/lib/bind/include/isc/misc.h
index b08b02d2890e2..a391974c18cad 100644
--- a/lib/bind/include/isc/misc.h
+++ b/lib/bind/include/isc/misc.h
@@ -16,13 +16,14 @@
  */
 
 /*
- * $Id: misc.h,v 1.2.2.1.4.1 2004/03/09 08:33:31 marka Exp $
+ * $Id: misc.h,v 1.2.2.1.4.2 2008/04/28 04:25:42 marka Exp $
  */
 
 #ifndef _ISC_MISC_H
 #define _ISC_MISC_H
 
 #include 
+#include 
 
 #define	bitncmp		__bitncmp
 /*#define isc_movefile	__isc_movefile */
diff --git a/lib/bind/include/resolv.h b/lib/bind/include/resolv.h
index 87a95200bb952..0a1c7f26102b6 100644
--- a/lib/bind/include/resolv.h
+++ b/lib/bind/include/resolv.h
@@ -50,7 +50,7 @@
 
 /*
  *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
- *	$Id: resolv.h,v 1.7.2.11.4.3 2005/08/25 04:44:13 marka Exp $
+ *	$Id: resolv.h,v 1.7.2.11.4.4 2008/04/28 05:46:51 marka Exp $
  */
 
 #ifndef _RESOLV_H_
@@ -252,6 +252,7 @@ union res_sockaddr_union {
 #define	RES_NOCHECKNAME	0x00008000	/* do not check names for sanity. */
 #define	RES_KEEPTSIG	0x00010000	/* do not strip TSIG records */
 #define	RES_BLAST	0x00020000	/* blast all recursive servers */
+#define	RES_NSID	0x00040000	/*%< request name server ID */
 #define RES_NOTLDQUERY	0x00100000	/* don't unqualified name as a tld */
 #define RES_USE_DNSSEC	0x00200000	/* use DNSSEC using OK bit in OPT */
 /* #define RES_DEBUG2	0x00400000 */	/* nslookup internal */
@@ -398,6 +399,7 @@ extern const struct res_sym __p_rcode_syms[];
 #define sym_ntos		__sym_ntos
 #define sym_ston		__sym_ston
 #define res_nopt		__res_nopt
+#define res_nopt_rdata       	__res_nopt_rdata
 #define res_ndestroy		__res_ndestroy
 #define	res_nametoclass		__res_nametoclass
 #define	res_nametotype		__res_nametotype
@@ -484,6 +486,8 @@ int		res_findzonecut2 __P((res_state, const char *, ns_class, int,
 				      union res_sockaddr_union *, int));
 void		res_nclose __P((res_state));
 int		res_nopt __P((res_state, int, u_char *, int, int));
+int		res_nopt_rdata __P((res_state, int, u_char *, int, u_char *,
+				    u_short, u_short, u_char *));
 void		res_send_setqhook __P((res_send_qhook));
 void		res_send_setrhook __P((res_send_rhook));
 int		__res_vinit __P((res_state, int));
diff --git a/lib/bind/inet/Makefile.in b/lib/bind/inet/Makefile.in
index 96698fde7f8bf..9f79b92431548 100644
--- a/lib/bind/inet/Makefile.in
+++ b/lib/bind/inet/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/06 08:13:23 marka Exp $
+# $Id: Makefile.in,v 1.4.206.3 2008/04/28 23:45:35 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -30,6 +30,6 @@ SRCS=	inet_addr.c inet_cidr_ntop.c inet_cidr_pton.c inet_data.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/inet/inet_net_pton.c b/lib/bind/inet/inet_net_pton.c
index abecfc79cd2c8..6a67379c0e65d 100644
--- a/lib/bind/inet/inet_net_pton.c
+++ b/lib/bind/inet/inet_net_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.2 2004/03/17 00:29:47 marka Exp $";
+static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.3 2008/08/26 04:50:32 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -133,11 +133,11 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
 			INSIST(n >= 0 && n <= 9);
 			bits *= 10;
 			bits += n;
+			if (bits > 32)
+				goto enoent;
 		} while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch));
 		if (ch != '\0')
 			goto enoent;
-		if (bits > 32)
-			goto emsgsize;
 	}
 
 	/* Firey death and destruction unless we prefetched EOS. */
diff --git a/lib/bind/irs/Makefile.in b/lib/bind/irs/Makefile.in
index 9695435ba66fd..ba0092b9ae367 100644
--- a/lib/bind/irs/Makefile.in
+++ b/lib/bind/irs/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.7.206.3 2004/12/07 00:38:35 marka Exp $
+# $Id: Makefile.in,v 1.7.206.5 2008/04/28 23:45:35 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -65,6 +65,6 @@ WANT_IRS_THREADSGR_OBJS=getgrent_r.@O@
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/irs/dns_ho.c b/lib/bind/irs/dns_ho.c
index b1bd5f01e6794..d942ae1be64f5 100644
--- a/lib/bind/irs/dns_ho.c
+++ b/lib/bind/irs/dns_ho.c
@@ -52,7 +52,7 @@
 /* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_ho.c,v 1.5.2.7.4.9 2006/12/07 04:00:08 marka Exp $";
+static const char rcsid[] = "$Id: dns_ho.c,v 1.5.2.7.4.10 2008/09/24 06:04:13 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -962,7 +962,7 @@ gethostans(struct irs_ho *this,
 					}
 					if (m == 0)
 						continue;
-					if (hap < &pvt->h_addr_ptrs[MAXADDRS-1])
+					if (hap < &pvt->h_addr_ptrs[MAXADDRS])
 						hap++;
 					*hap = NULL;
 					bp += m;
@@ -984,9 +984,10 @@ gethostans(struct irs_ho *this,
 			*ap = NULL;
 			*hap = NULL;
 
-			if (pvt->res->nsort && haveanswer > 1 && qtype == T_A)
+			if (pvt->res->nsort && hap != pvt->h_addr_ptrs &&
+			    qtype == T_A)
 				addrsort(pvt->res, pvt->h_addr_ptrs,
-					 haveanswer);
+					 hap - pvt->h_addr_ptrs);
 			if (pvt->host.h_name == NULL) {
 				n = strlen(qname) + 1;	/* for the \0 */
 				if (n > (ep - bp) || n >= MAXHOSTNAMELEN)
@@ -1053,7 +1054,7 @@ add_hostent(struct pvt *pvt, char *bp, char **hap, struct addrinfo *ai)
 	/* Avoid overflows. */
 	if (bp + addrlen > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1])
 		return(-1);
-	if (hap >= &pvt->h_addr_ptrs[MAXADDRS-1])
+	if (hap >= &pvt->h_addr_ptrs[MAXADDRS])
 		return(0); /* fail, but not treat it as an error. */
 
 	/* Suppress duplicates. */
diff --git a/lib/bind/irs/irp.c b/lib/bind/irs/irp.c
index 649079c31f1c2..4ddf2d883f0a3 100644
--- a/lib/bind/irs/irp.c
+++ b/lib/bind/irs/irp.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.4 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.5 2008/04/28 04:25:42 marka Exp $";
 #endif
 
 /* Imports */
@@ -48,6 +48,12 @@ static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.4 2006/03/10 00:17:21 marka
 
 #include "port_after.h"
 
+#ifdef VSPRINTF_CHAR
+# define VSPRINTF(x) strlen(vsprintf/**/x)
+#else
+# define VSPRINTF(x) ((size_t)vsprintf x)
+#endif
+
 /* Forward. */
 
 static void		irp_close(struct irs_acc *);
@@ -541,7 +547,7 @@ irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...) {
 	}
 
 	va_start(ap, fmt);
-	todo = vsprintf(buffer, fmt, ap);
+	todo = VSPRINTF((buffer, fmt, ap));
 	va_end(ap);
 	if (todo > (int)sizeof(buffer) - 3) {
 		syslog(LOG_CRIT, "memory overrun in irs_irp_send_command()");
diff --git a/lib/bind/isc/Makefile.in b/lib/bind/isc/Makefile.in
index d8e8889ab385b..b03a9f2c0e9c2 100644
--- a/lib/bind/isc/Makefile.in
+++ b/lib/bind/isc/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:13:23 marka Exp $
+# $Id: Makefile.in,v 1.6.206.3 2008/04/28 23:45:35 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -30,6 +30,6 @@ SRCS=	assertions.c base64.c bitncmp.c ctl_clnt.c ctl_p.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/isc/assertions.c b/lib/bind/isc/assertions.c
index f1fb2efe95700..264670e1075e1 100644
--- a/lib/bind/isc/assertions.c
+++ b/lib/bind/isc/assertions.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: assertions.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $";
+static const char rcsid[] = "$Id: assertions.c,v 1.1.206.2 2008/10/15 03:57:45 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -78,6 +78,7 @@ assertion_type_to_text(assertion_type type) {
  * Private.
  */
 
+/* coverity[+kill] */
 static void
 default_assertion_failed(const char *file, int line, assertion_type type,
 			 const char *cond, int print_errno)
diff --git a/lib/bind/isc/bitncmp.c b/lib/bind/isc/bitncmp.c
index fcff9f71ed3f3..35b570b45fb02 100644
--- a/lib/bind/isc/bitncmp.c
+++ b/lib/bind/isc/bitncmp.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: bitncmp.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $";
+static const char rcsid[] = "$Id: bitncmp.c,v 1.1.206.2 2008/05/12 00:20:16 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -48,7 +48,7 @@ bitncmp(const void *l, const void *r, int n) {
 
 	b = n / 8;
 	x = memcmp(l, r, b);
-	if (x)
+	if (x || (n % 8) == 0)
 		return (x);
 
 	lb = ((const u_char *)l)[b];
diff --git a/lib/bind/isc/ctl_clnt.c b/lib/bind/isc/ctl_clnt.c
index ddb2efbe660eb..d921b559c8758 100644
--- a/lib/bind/isc/ctl_clnt.c
+++ b/lib/bind/isc/ctl_clnt.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.4 2007/05/18 06:25:17 marka Exp $";
+static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.5 2008/04/28 04:25:42 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -38,6 +38,9 @@ static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.4 2007/05/18 06:25:17 m
 #include 
 #include 
 #include 
+#ifdef HAVE_MEMORY_H
+#include 
+#endif
 
 #include 
 #include 
diff --git a/lib/bind/isc/ctl_srvr.c b/lib/bind/isc/ctl_srvr.c
index 0d1b53dfef088..11d39c719275d 100644
--- a/lib/bind/isc/ctl_srvr.c
+++ b/lib/bind/isc/ctl_srvr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.4 2006/12/07 04:52:50 marka Exp $";
+static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.5 2008/04/28 04:25:42 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -40,6 +40,9 @@ static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.4 2006/12/07 04:52:50 m
 #include 
 #include 
 #include 
+#ifdef HAVE_MEMORY_H
+#include 
+#endif
 
 #include 
 #include 
diff --git a/lib/bind/nameser/Makefile.in b/lib/bind/nameser/Makefile.in
index aa4bc6cf6b4b7..b7b7bc7bad02c 100644
--- a/lib/bind/nameser/Makefile.in
+++ b/lib/bind/nameser/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/15 01:02:45 marka Exp $
+# $Id: Makefile.in,v 1.4.206.3 2008/04/28 23:45:35 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -26,6 +26,6 @@ SRCS=	ns_date.c ns_name.c ns_netint.c ns_parse.c ns_print.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/port_after.h.in b/lib/bind/port_after.h.in
index 162535ee5067a..8ee135bcdde6e 100644
--- a/lib/bind/port_after.h.in
+++ b/lib/bind/port_after.h.in
@@ -22,6 +22,10 @@
 @NEED_DAEMON@
 @NEED_STRSEP@
 @NEED_STRERROR@
+#ifdef NEED_STRERROR
+const char *isc_strerror(int);
+#define strerror isc_strerror
+#endif
 @HAS_INET6_STRUCTS@
 @HAVE_SIN6_SCOPE_ID@
 @NEED_IN6ADDR_ANY@
@@ -30,7 +34,6 @@
 @NEED_GETTIMEOFDAY@
 @HAVE_STRNDUP@
 @USE_FIONBIO_IOCTL@
-@USE_SYSERROR_LIST@
 @INNETGR_ARGS@
 @SETNETGRENT_ARGS@
 @USE_IFNAMELINKID@
@@ -419,4 +422,80 @@ setnetgrent_r(const char *netgroup, NGR_R_ENT_ARGS);
 NGR_R_SET_RETURN
 setnetgrent_r(const char *netgroup);
 #endif
+
+#ifdef NEED_STRTOUL
+unsigned long strtoul(const char *, char **, int);
+#endif
+
+#ifdef NEED_SUN4PROTOS
+#include 
+#ifndef __SIZE_TYPE__
+#define __SIZE_TYPE__ int
+#endif
+struct sockaddr;
+struct iovec;
+struct timeval;
+struct timezone;
+int fprintf(FILE *, const char *, ...);
+int getsockname(int, struct sockaddr *, int *);
+int getpeername(int, struct sockaddr *, int *);
+int socket(int, int, int);
+int connect(int, const struct sockaddr *, int);
+int writev(int, struct iovec *, int);
+int readv(int, struct iovec *, int);
+int send(int, const char *, int, int);
+void bzero(char *, int);
+int recvfrom(int, char *, int, int, struct sockaddr *, int *);
+int syslog(int, const char *, ... );
+int printf(const char *, ...);
+__SIZE_TYPE__ fread(void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *);
+__SIZE_TYPE__ fwrite(const void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *);
+int fclose(FILE *);
+int ungetc(int, FILE *);
+int scanf(const char *, ...);
+int sscanf(const char *, const char *, ... );
+int tolower(int);
+int toupper(int);
+int strcasecmp(const char *, const char *);
+int strncasecmp(const char *, const char *, int);
+int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
+#ifdef gettimeofday
+#undef gettimeofday
+int gettimeofday(struct timeval *, struct timezone *);
+#define gettimeofday isc__gettimeofday
+#else
+int gettimeofday(struct timeval *, struct timezone *);
+#endif
+long strtol(const char*, char **, int);
+int fseek(FILE *, long, int);
+int setsockopt(int, int, int, const char *, int);
+int bind(int, const struct sockaddr *, int);
+void bcopy(char *, char *, int);
+int fputc(char, FILE *);
+int listen(int, int);
+int accept(int, struct sockaddr *, int *);
+int getsockopt(int, int, int, char *, int *);
+int vfprintf(FILE *, const char *, va_list);
+int fflush(FILE *);
+int fgetc(FILE *);
+int fputs(const char *, FILE *);
+int fchown(int, int, int);
+void setbuf(FILE *, char *);
+int gethostname(char *, int);
+int rename(const char *, const char *);
+time_t time(time_t *);
+int fscanf(FILE *, const char *, ...);
+int sscanf(const char *, const char *, ...);
+int ioctl(int, int, caddr_t);
+void perror(const char *);
+
+#if !defined(__USE_FIXED_PROTOTYPES__) && !defined(__cplusplus) && !defined(__STRICT_ANSI__)
+/*
+ * 'gcc -ansi' changes the prototype for vsprintf().
+ * Use this prototype when 'gcc -ansi' is not in effect.
+ */
+char *vsprintf(char *, const char *, va_list);
+#endif
+#endif 
+
 #endif
diff --git a/lib/bind/resolv/Makefile.in b/lib/bind/resolv/Makefile.in
index a235fbc7a5e39..06ceb96aeaea5 100644
--- a/lib/bind/resolv/Makefile.in
+++ b/lib/bind/resolv/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.3.206.3 2005/07/29 00:13:09 marka Exp $
+# $Id: Makefile.in,v 1.3.206.5 2008/04/28 23:45:35 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -28,7 +28,7 @@ SRCS=	herror.c mtctxres.c res_comp.c res_data.c res_debug.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 CWARNINGS=
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/resolv/res_debug.c b/lib/bind/resolv/res_debug.c
index 8dda12c5e81cd..4c3cc7530fa78 100644
--- a/lib/bind/resolv/res_debug.c
+++ b/lib/bind/resolv/res_debug.c
@@ -95,7 +95,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_debug.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_debug.c,v 1.3.2.5.4.6 2005/07/28 07:43:22 marka Exp $";
+static const char rcsid[] = "$Id: res_debug.c,v 1.3.2.5.4.7 2008/04/28 05:46:51 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -189,10 +189,56 @@ do_section(const res_state statp,
 				p_type(ns_rr_type(rr)),
 				p_class(ns_rr_class(rr)));
 		else if (section == ns_s_ar && ns_rr_type(rr) == ns_t_opt) {
+			u_int16_t optcode, optlen, rdatalen = ns_rr_rdlen(rr);
 			u_int32_t ttl = ns_rr_ttl(rr);
+
 			fprintf(file,
 				"; EDNS: version: %u, udp=%u, flags=%04x\n",
 				(ttl>>16)&0xff, ns_rr_class(rr), ttl&0xffff);
+
+			while (rdatalen >= 4) {
+				const u_char *cp = ns_rr_rdata(rr);
+				int i;
+
+				GETSHORT(optcode, cp);
+				GETSHORT(optlen, cp);
+
+				if (optcode == NS_OPT_NSID) {
+					fputs("; NSID: ", file);
+					if (optlen == 0) {
+						fputs("; NSID\n", file);
+					} else {
+						fputs("; NSID: ", file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%02x ",
+								cp[i]);
+						fputs(" (",file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%c",
+								isprint(cp[i])?
+								cp[i] : '.');
+						fputs(")\n", file);
+					}
+				} else {
+					if (optlen == 0) {
+						fprintf(file, "; OPT=%u\n",
+							optcode);
+					} else {
+						fprintf(file, "; OPT=%u: ",
+							optcode);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%02x ",
+								cp[i]);
+						fputs(" (",file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%c",
+								isprint(cp[i]) ?
+									cp[i] : '.');
+						fputs(")\n", file);
+					}
+				}
+				rdatalen -= 4 + optlen;
+			}
 		} else {
 			n = ns_sprintrr(handle, &rr, NULL, NULL,
 					buf, buflen);
@@ -204,7 +250,7 @@ do_section(const res_state statp,
 						buf = malloc(buflen += 1024);
 					if (buf == NULL) {
 						fprintf(file,
-				              ";; memory allocation failure\n");
+					      ";; memory allocation failure\n");
 					      return;
 					}
 					continue;
@@ -380,7 +426,7 @@ const struct res_sym __p_default_section_syms[] = {
 	{ns_s_an,	"ANSWER",	(char *)0},
 	{ns_s_ns,	"AUTHORITY",	(char *)0},
 	{ns_s_ar,	"ADDITIONAL",	(char *)0},
-	{0,             (char *)0,	(char *)0}
+	{0,		(char *)0,	(char *)0}
 };
 
 const struct res_sym __p_update_section_syms[] = {
@@ -388,7 +434,7 @@ const struct res_sym __p_update_section_syms[] = {
 	{S_PREREQ,	"PREREQUISITE",	(char *)0},
 	{S_UPDATE,	"UPDATE",	(char *)0},
 	{S_ADDT,	"ADDITIONAL",	(char *)0},
-	{0,             (char *)0,	(char *)0}
+	{0,		(char *)0,	(char *)0}
 };
 
 const struct res_sym __p_key_syms[] = {
@@ -616,6 +662,7 @@ p_option(u_long option) {
 	case RES_USE_INET6:	return "inet6";
 #ifdef RES_USE_EDNS0	/* KAME extension */
 	case RES_USE_EDNS0:	return "edns0";
+	case RES_NSID:		return "nsid";
 #endif
 #ifdef RES_USE_DNAME
 	case RES_USE_DNAME:	return "dname";
diff --git a/lib/bind/resolv/res_mkquery.c b/lib/bind/resolv/res_mkquery.c
index 89000edf6ad42..0e450e9b53040 100644
--- a/lib/bind/resolv/res_mkquery.c
+++ b/lib/bind/resolv/res_mkquery.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_mkquery.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_mkquery.c,v 1.1.2.2.4.2 2004/03/16 12:34:18 marka Exp $";
+static const char rcsid[] = "$Id: res_mkquery.c,v 1.1.2.2.4.3 2008/04/28 05:46:51 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -203,9 +203,6 @@ res_nmkquery(res_state statp,
 
 #ifdef RES_USE_EDNS0
 /* attach OPT pseudo-RR, as documented in RFC2671 (EDNS0). */
-#ifndef T_OPT
-#define T_OPT	41
-#endif
 
 int
 res_nopt(res_state statp,
@@ -230,14 +227,14 @@ res_nopt(res_state statp,
 	if ((ep - cp) < 1 + RRFIXEDSZ)
 		return (-1);
 
-	*cp++ = 0;	/* "." */
-
-	ns_put16(T_OPT, cp);	/* TYPE */
+	*cp++ = 0;				/*%< "." */
+	ns_put16(ns_t_opt, cp);			/*%< TYPE */
 	cp += INT16SZ;
-	ns_put16(anslen & 0xffff, cp);	/* CLASS = UDP payload size */
+	ns_put16(anslen & 0xffff, cp);		/*%< CLASS = UDP payload size */
 	cp += INT16SZ;
-	*cp++ = NOERROR;	/* extended RCODE */
-	*cp++ = 0;		/* EDNS version */
+	*cp++ = NOERROR;			/*%< extended RCODE */
+	*cp++ = 0;				/*%< EDNS version */
+
 	if (statp->options & RES_USE_DNSSEC) {
 #ifdef DEBUG
 		if (statp->options & RES_DEBUG)
@@ -247,10 +244,60 @@ res_nopt(res_state statp,
 	}
 	ns_put16(flags, cp);
 	cp += INT16SZ;
-	ns_put16(0, cp);	/* RDLEN */
+
+	ns_put16(0, cp);			/*%< RDLEN */
 	cp += INT16SZ;
+
 	hp->arcount = htons(ntohs(hp->arcount) + 1);
 
 	return (cp - buf);
 }
+
+/*
+ * Construct variable data (RDATA) block for OPT psuedo-RR, append it
+ * to the buffer, then update the RDLEN field (previously set to zero by
+ * res_nopt()) with the new RDATA length.
+ */
+int
+res_nopt_rdata(res_state statp,
+	  int n0,	 	/*%< current offset in buffer */
+	  u_char *buf,	 	/*%< buffer to put query */
+	  int buflen,		/*%< size of buffer */
+	  u_char *rdata,	/*%< ptr to start of opt rdata */
+	  u_short code,		/*%< OPTION-CODE */
+	  u_short len,		/*%< OPTION-LENGTH */
+	  u_char *data)		/*%< OPTION_DATA */
+{
+	register u_char *cp, *ep;
+
+#ifdef DEBUG
+	if ((statp->options & RES_DEBUG) != 0U)
+		printf(";; res_nopt_rdata()\n");
+#endif
+
+	cp = buf + n0;
+	ep = buf + buflen;
+
+	if ((ep - cp) < (4 + len))
+		return (-1);
+
+	if (rdata < (buf + 2) || rdata >= ep)
+		return (-1);
+
+	ns_put16(code, cp);
+	cp += INT16SZ;
+
+	ns_put16(len, cp);
+	cp += INT16SZ;
+
+	memcpy(cp, data, len);
+	cp += len;
+
+	len = cp - rdata;
+	ns_put16(len, rdata - 2);	/* Update RDLEN field */
+
+	return (cp - buf);
+}
 #endif
+
+/*! \file */
diff --git a/lib/bind/resolv/res_query.c b/lib/bind/resolv/res_query.c
index 5156ce84c0861..6855b73f12c03 100644
--- a/lib/bind/resolv/res_query.c
+++ b/lib/bind/resolv/res_query.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_query.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.2 2004/03/16 12:34:19 marka Exp $";
+static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.3 2008/04/28 05:46:51 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -116,8 +116,9 @@ res_nquery(res_state statp,
 {
 	u_char buf[MAXPACKET];
 	HEADER *hp = (HEADER *) answer;
-	int n;
 	u_int oflags;
+	u_char *rdata;
+	int n;
 
 	oflags = statp->_flags;
 
@@ -133,8 +134,14 @@ again:
 			 buf, sizeof(buf));
 #ifdef RES_USE_EDNS0
 	if (n > 0 && (statp->_flags & RES_F_EDNS0ERR) == 0 &&
-	    (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC)) != 0U)
+	    (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC|RES_NSID))) {
 		n = res_nopt(statp, n, buf, sizeof(buf), anslen);
+		rdata = &buf[n];
+		if (n > 0 && (statp->options & RES_NSID) != 0U) {
+			n = res_nopt_rdata(statp, n, buf, sizeof(buf), rdata,
+					   NS_OPT_NSID, 0, NULL);
+		}
+	}
 #endif
 	if (n <= 0) {
 #ifdef DEBUG
@@ -144,6 +151,7 @@ again:
 		RES_SET_H_ERRNO(statp, NO_RECOVERY);
 		return (n);
 	}
+
 	n = res_nsend(statp, buf, n, answer, anslen);
 	if (n < 0) {
 #ifdef RES_USE_EDNS0
diff --git a/lib/bind9/api b/lib/bind9/api
index cff58c8ed232f..1bdcb768ee2c2 100644
--- a/lib/bind9/api
+++ b/lib/bind9/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 0
-LIBREVISION = 10
+LIBREVISION = 11
 LIBAGE = 0
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index fe9836ca4b429..4aaa37e38b66e 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.c,v 1.37.6.39 2007/12/14 01:28:26 marka Exp $ */
+/* $Id: check.c,v 1.37.6.41 2008/04/28 23:45:35 tbox Exp $ */
 
 #include 
 
@@ -213,13 +213,24 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
 }
 
 static isc_result_t
-check_forward(const cfg_obj_t *options, isc_log_t *logctx) {
+check_forward(const cfg_obj_t *options,  const cfg_obj_t *global,
+	      isc_log_t *logctx)
+{
 	const cfg_obj_t *forward = NULL;
 	const cfg_obj_t *forwarders = NULL;
 
 	(void)cfg_map_get(options, "forward", &forward);
 	(void)cfg_map_get(options, "forwarders", &forwarders);
 
+	if (forwarders != NULL && global != NULL) {
+		const char *file = cfg_obj_file(global);
+		unsigned int line = cfg_obj_line(global);
+		cfg_obj_log(forwarders, logctx, ISC_LOG_ERROR,
+			    "forwarders declared in root zone and "
+			    "in general configuration: %s:%u",
+			    file, line);
+		return (ISC_R_FAILURE);
+	}
 	if (forward != NULL && forwarders == NULL) {
 		cfg_obj_log(forward, logctx, ISC_LOG_ERROR,
 			    "no matching 'forwarders' statement");
@@ -400,8 +411,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 	(void)cfg_map_get(options, "preferred-glue", &obj);
 	if (obj != NULL) {
 		const char *str;
-                str = cfg_obj_asstring(obj);
-                if (strcasecmp(str, "a") != 0 &&
+		str = cfg_obj_asstring(obj);
+		if (strcasecmp(str, "a") != 0 &&
 		    strcasecmp(str, "aaaa") != 0 &&
 		    strcasecmp(str, "none") != 0)
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
@@ -430,7 +441,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 				isc_buffer_add(&b, strlen(str));
 				tresult = dns_name_fromtext(name, &b,
 							   dns_rootname,
-                                                           ISC_FALSE, NULL);
+							   ISC_FALSE, NULL);
 				if (tresult != ISC_R_SUCCESS) {
 					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 						    "bad domain name '%s'",
@@ -440,7 +451,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 			}
 		}
 	}
-       
+
 	/*
 	 * Set supported DNSSEC algorithms.
 	 */
@@ -586,7 +597,7 @@ get_masters_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret)
 
 static isc_result_t
 validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config,
-	         isc_uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx)
+		 isc_uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx)
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
@@ -608,7 +619,7 @@ validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config,
  newlist:
 	list = cfg_tuple_get(obj, "addresses");
 	element = cfg_list_first(list);
- resume:	
+ resume:
 	for ( ;
 	     element != NULL;
 	     element = cfg_list_next(element))
@@ -693,9 +704,9 @@ typedef struct {
 } optionstable;
 
 static isc_result_t
-check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
-	       isc_symtab_t *symtab, dns_rdataclass_t defclass,
-	       isc_log_t *logctx, isc_mem_t *mctx)
+check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
+	       const cfg_obj_t *config, isc_symtab_t *symtab,
+	       dns_rdataclass_t defclass, isc_log_t *logctx, isc_mem_t *mctx)
 {
 	const char *zname;
 	const char *typestr;
@@ -708,6 +719,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	dns_rdataclass_t zclass;
 	dns_fixedname_t fixedname;
 	isc_buffer_t b;
+	isc_boolean_t root = ISC_FALSE;
 
 	static optionstable options[] = {
 	{ "allow-query", MASTERZONE | SLAVEZONE | STUBZONE },
@@ -817,7 +829,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	isc_buffer_init(&b, zname, strlen(zname));
 	isc_buffer_add(&b, strlen(zname));
 	tresult = dns_name_fromtext(dns_fixedname_name(&fixedname), &b,
-				   dns_rootname, ISC_TRUE, NULL);
+				    dns_rootname, ISC_TRUE, NULL);
 	if (tresult != ISC_R_SUCCESS) {
 		cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR,
 			    "zone '%s': is not a valid name", zname);
@@ -832,6 +844,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 				    "previous definition: %s:%u", logctx, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
+		if (dns_name_equal(dns_fixedname_name(&fixedname),
+				   dns_rootname))
+			root = ISC_TRUE;
 	}
 
 	/*
@@ -938,7 +953,18 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	/*
 	 * Check that forwarding is reasonable.
 	 */
-	if (check_forward(zoptions, logctx) != ISC_R_SUCCESS)
+	obj = NULL;
+	if (root) {
+		if (voptions != NULL)
+			(void)cfg_map_get(voptions, "forwarders", &obj);
+		if (obj == NULL) {
+			const cfg_obj_t *options = NULL;
+			(void)cfg_map_get(config, "options", &options);
+			if (options != NULL)
+				(void)cfg_map_get(options, "forwarders", &obj);
+		}
+	}
+	if (check_forward(zoptions, obj, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
 	/*
@@ -968,7 +994,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	
+
 	return (result);
 }
 
@@ -977,7 +1003,7 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 	const cfg_obj_t *algobj = NULL;
 	const cfg_obj_t *secretobj = NULL;
 	const char *keyname = cfg_obj_asstring(cfg_map_getname(key));
-	
+
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
 	if (secretobj == NULL || algobj == NULL) {
@@ -1094,9 +1120,9 @@ check_servers(const cfg_obj_t *servers, isc_log_t *logctx) {
 	}
 	return (result);
 }
-		
+
 static isc_result_t
-check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	       dns_rdataclass_t vclass, isc_log_t *logctx, isc_mem_t *mctx)
 {
 	const cfg_obj_t *servers = NULL;
@@ -1116,8 +1142,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (tresult != ISC_R_SUCCESS)
 		return (ISC_R_NOMEMORY);
 
-	if (vconfig != NULL)
-		(void)cfg_map_get(vconfig, "zone", &zones);
+	if (voptions != NULL)
+		(void)cfg_map_get(voptions, "zone", &zones);
 	else
 		(void)cfg_map_get(config, "zone", &zones);
 
@@ -1128,7 +1154,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		isc_result_t tresult;
 		const cfg_obj_t *zone = cfg_listelt_value(element);
 
-		tresult = check_zoneconf(zone, config, symtab, vclass,
+		tresult = check_zoneconf(zone, voptions, config, symtab, vclass,
 					 logctx, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
@@ -1152,10 +1178,10 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		isc_symtab_destroy(&symtab);
 		return (tresult);
 	}
-	
-	if (vconfig != NULL) {
+
+	if (voptions != NULL) {
 		keys = NULL;
-		(void)cfg_map_get(vconfig, "key", &keys);
+		(void)cfg_map_get(voptions, "key", &keys);
 		tresult = check_keylist(keys, symtab, logctx);
 		if (tresult == ISC_R_EXISTS)
 			result = ISC_R_FAILURE;
@@ -1170,47 +1196,48 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	/*
 	 * Check that forwarding is reasonable.
 	 */
-	if (vconfig == NULL) {
+	if (voptions == NULL) {
 		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
-			if (check_forward(options, logctx) != ISC_R_SUCCESS)
+			if (check_forward(options, NULL,
+					  logctx) != ISC_R_SUCCESS)
 				result = ISC_R_FAILURE;
 	} else {
-		if (check_forward(vconfig, logctx) != ISC_R_SUCCESS)
+		if (check_forward(voptions, NULL, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 	/*
 	 * Check that dual-stack-servers is reasonable.
 	 */
-	if (vconfig == NULL) {
+	if (voptions == NULL) {
 		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
 			if (check_dual_stack(options, logctx) != ISC_R_SUCCESS)
 				result = ISC_R_FAILURE;
 	} else {
-		if (check_dual_stack(vconfig, logctx) != ISC_R_SUCCESS)
+		if (check_dual_stack(voptions, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 
 	/*
 	 * Check that rrset-order is reasonable.
 	 */
-	if (vconfig != NULL) {
-		if (check_order(vconfig, logctx) != ISC_R_SUCCESS)
+	if (voptions != NULL) {
+		if (check_order(voptions, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 
-	if (vconfig != NULL) {
-		(void)cfg_map_get(vconfig, "server", &servers);
+	if (voptions != NULL) {
+		(void)cfg_map_get(voptions, "server", &servers);
 		if (servers != NULL &&
 		    check_servers(servers, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 
-	if (vconfig != NULL)
-		tresult = check_options(vconfig, logctx, mctx);
+	if (voptions != NULL)
+		tresult = check_options(voptions, logctx, mctx);
 	else
 		tresult = check_options(config, logctx, mctx);
 	if (tresult != ISC_R_SUCCESS)
@@ -1249,7 +1276,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 	    check_servers(servers, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
-	if (options != NULL && 
+	if (options != NULL &&
 	    check_order(options, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
@@ -1311,7 +1338,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 				const char *file;
 				unsigned int line;
 				RUNTIME_CHECK(isc_symtab_lookup(symtab, key,
-				           vclass, &symvalue) == ISC_R_SUCCESS);
+					   vclass, &symvalue) == ISC_R_SUCCESS);
 				file = cfg_obj_file(symvalue.as_cpointer);
 				line = cfg_obj_line(symvalue.as_cpointer);
 				cfg_obj_log(view, logctx, ISC_LOG_ERROR,
@@ -1351,8 +1378,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 		}
 	}
 
-        tresult = cfg_map_get(config, "acl", &acls);
-        if (tresult == ISC_R_SUCCESS) {
+	tresult = cfg_map_get(config, "acl", &acls);
+	if (tresult == ISC_R_SUCCESS) {
 		const cfg_listelt_t *elt;
 		const cfg_listelt_t *elt2;
 		const char *aclname;
@@ -1371,7 +1398,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 					cfg_obj_log(acl, logctx, ISC_LOG_ERROR,
 						    "attempt to redefine "
 						    "builtin acl '%s'",
-				    		    aclname);
+						    aclname);
 					result = ISC_R_FAILURE;
 					break;
 				}
@@ -1401,8 +1428,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 		}
 	}
 
-        tresult = cfg_map_get(config, "kal", &kals);
-        if (tresult == ISC_R_SUCCESS) {
+	tresult = cfg_map_get(config, "kal", &kals);
+	if (tresult == ISC_R_SUCCESS) {
 		const cfg_listelt_t *elt;
 		const cfg_listelt_t *elt2;
 		const char *aclname;
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index a6c6d8b1de2c3..49f60ecbf8875 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: adb.c,v 1.181.2.11.2.34 2008/04/03 06:07:11 tbox Exp $ */
+/* $Id: adb.c,v 1.181.2.11.2.41 2008/10/17 03:34:53 marka Exp $ */
 
 /*
  * Implementation notes
@@ -116,6 +116,7 @@ struct dns_adb {
 
 	isc_mutex_t			lock;
 	isc_mutex_t			reflock; /* Covers irefcnt, erefcnt */
+	isc_mutex_t			overmemlock; /*%< Covers overmem */
 	isc_mem_t		       *mctx;
 	dns_view_t		       *view;
 	isc_timermgr_t		       *timermgr;
@@ -488,6 +489,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	isc_boolean_t new_addresses_added;
 	dns_rdatatype_t rdtype;
 	unsigned int findoptions;
+	dns_adbnamehooklist_t *hookhead;
 
 	INSIST(DNS_ADBNAME_VALID(adbname));
 	adb = adbname->adb;
@@ -512,10 +514,12 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 			INSIST(rdata.length == 4);
 			memcpy(&ina.s_addr, rdata.data, 4);
 			isc_sockaddr_fromin(&sockaddr, &ina, 0);
+			hookhead = &adbname->v4;
 		} else {
 			INSIST(rdata.length == 16);
 			memcpy(in6a.s6_addr, rdata.data, 16);
 			isc_sockaddr_fromin6(&sockaddr, &in6a, 0);
+			hookhead = &adbname->v6;
 		}
 
 		INSIST(nh == NULL);
@@ -544,7 +548,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 
 			link_entry(adb, addr_bucket, entry);
 		} else {
-			for (anh = ISC_LIST_HEAD(adbname->v4);
+			for (anh = ISC_LIST_HEAD(*hookhead);
 			     anh != NULL;
 			     anh = ISC_LIST_NEXT(anh, plink))
 				if (anh->entry == foundentry)
@@ -557,12 +561,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		}
 
 		new_addresses_added = ISC_TRUE;
-		if (nh != NULL) {
-			if (rdtype == dns_rdatatype_a)
-				ISC_LIST_APPEND(adbname->v4, nh, plink);
-			else
-				ISC_LIST_APPEND(adbname->v6, nh, plink);
-		}
+		if (nh != NULL)
+			ISC_LIST_APPEND(*hookhead, nh, plink);
 		nh = NULL;
 		result = dns_rdataset_next(rdataset);
 	}
@@ -1731,8 +1731,11 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *zone,
 			bucket = entry->lock_bucket;
 			LOCK(&adb->entrylocks[bucket]);
 
-			if (entry_is_bad_for_zone(adb, entry, zone, now))
+			if (!FIND_RETURNLAME(find)
+			    && entry_is_bad_for_zone(adb, entry, zone, now)) {
+				find->options |= DNS_ADBFIND_LAMEPRUNED;
 				goto nextv6;
+			}
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
 			if (addrinfo == NULL) {
 				find->partial_result |= DNS_ADBFIND_INET6;
@@ -1765,13 +1768,16 @@ shutdown_task(isc_task_t *task, isc_event_t *ev) {
 	adb = ev->ev_arg;
 	INSIST(DNS_ADB_VALID(adb));
 
+	/*
+	 * Wait for lock around check_exit() call to be released.
+	 */
+	LOCK(&adb->lock);
 	/*
 	 * Kill the timer, and then the ADB itself.  Note that this implies
 	 * that this task was the one scheduled to get timer events.  If
 	 * this is not true (and it is unfortunate there is no way to INSIST()
 	 * this) badness will occur.
 	 */
-	LOCK(&adb->lock);
 	isc_timer_detach(&adb->timer);
 	UNLOCK(&adb->lock);
 	isc_event_free(&ev);
@@ -1983,6 +1989,7 @@ destroy(dns_adb_t *adb) {
 	DESTROYLOCK(&adb->reflock);
 	DESTROYLOCK(&adb->lock);
 	DESTROYLOCK(&adb->mplock);
+	DESTROYLOCK(&adb->overmemlock);
 
 	isc_mem_putanddetach(&adb->mctx, adb, sizeof(dns_adb_t));
 }
@@ -2053,6 +2060,10 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 	if (result != ISC_R_SUCCESS)
 		goto fail0d;
 
+	result = isc_mutex_init(&adb->overmemlock);
+	if (result != ISC_R_SUCCESS)
+		goto fail0e;
+
 	/*
 	 * Initialize the bucket locks for names and elements.
 	 * May as well initialize the list heads, too.
@@ -2155,6 +2166,8 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 	if (adb->afmp != NULL)
 		isc_mempool_destroy(&adb->afmp);
 
+	DESTROYLOCK(&adb->overmemlock);
+ fail0e:
 	DESTROYLOCK(&adb->reflock);
  fail0d:
 	DESTROYLOCK(&adb->mplock);
@@ -3122,8 +3135,10 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 		address_type = DNS_ADBFIND_INET6;
 		fetch = name->fetch_aaaa;
 		name->fetch_aaaa = NULL;
-	}
-	INSIST(address_type != 0);
+	} else
+		fetch = NULL;
+
+	INSIST(address_type != 0 && fetch != NULL);
 
 	dns_resolver_destroyfetch(&fetch->fetch);
 	dev->fetch = NULL;
@@ -3570,12 +3585,21 @@ water(void *arg, int mark) {
 	DP(ISC_LOG_DEBUG(1),
 	   "adb reached %s water mark", overmem ? "high" : "low");
 
-	adb->overmem = overmem;
-	if (overmem) {
-		isc_interval_set(&interval, 0, 1);
-		(void)isc_timer_reset(adb->timer, isc_timertype_once, NULL,
-				      &interval, ISC_TRUE);
+	/*
+	 * We can't use adb->lock as there is potential for water
+	 * to be called when adb->lock is held.
+	 */
+	LOCK(&adb->overmemlock);
+	if (adb->overmem != overmem) {
+		adb->overmem = overmem;
+		if (overmem) {
+			isc_interval_set(&interval, 0, 1);
+			(void)isc_timer_reset(adb->timer, isc_timertype_once,
+					      NULL, &interval, ISC_TRUE);
+		}
+		isc_mem_waterack(adb->mctx, mark);
 	}
+	UNLOCK(&adb->overmemlock);
 }
 
 void
diff --git a/lib/dns/api b/lib/dns/api
index efe79b507c4ae..6bbd1729bc153 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 25
-LIBREVISION = 1
+LIBINTERFACE = 26
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index f45af90d08d3b..1212a73212a7b 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.c,v 1.45.2.4.8.15 2006/08/01 01:07:05 marka Exp $ */
+/* $Id: cache.c,v 1.45.2.4.8.17 2008/04/28 23:45:37 tbox Exp $ */
 
 #include 
 
@@ -466,7 +466,7 @@ dns_cache_setcleaninginterval(dns_cache_t *cache, unsigned int t) {
 					 isc_timertype_ticker,
 					 NULL, &interval, ISC_FALSE);
 	}
-	if (result != ISC_R_SUCCESS)	
+	if (result != ISC_R_SUCCESS)
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 			      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
 			      "could not set cache cleaning interval: %s",
@@ -558,7 +558,7 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
 			result = ISC_R_NOMEMORY;
 			goto cleanup;
 		}
-		
+
 		cleaner->overmem_event =
 			isc_event_allocate(cache->mctx, cleaner,
 					   DNS_EVENT_CACHEOVERMEM,
@@ -596,7 +596,7 @@ begin_cleaning(cache_cleaner_t *cleaner) {
 
 	/*
 	 * Create an iterator, if it does not already exist, and
-         * position it at the beginning of the cache.
+	 * position it at the beginning of the cache.
 	 */
 	if (cleaner->iterator == NULL)
 		result = dns_db_createiterator(cleaner->cache->db, ISC_FALSE,
@@ -635,7 +635,7 @@ begin_cleaning(cache_cleaner_t *cleaner) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 			      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
 			      "begin cache cleaning, mem inuse %lu",
-		            (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
+			    (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
 		cleaner->state = cleaner_s_busy;
 		isc_task_send(cleaner->task, &cleaner->resched_event);
 	}
@@ -695,7 +695,7 @@ static void
 overmem_cleaning_action(isc_task_t *task, isc_event_t *event) {
 	cache_cleaner_t *cleaner = event->ev_arg;
 	isc_boolean_t want_cleaning = ISC_FALSE;
-	
+
 	UNUSED(task);
 
 	INSIST(task == cleaner->task);
@@ -908,9 +908,12 @@ water(void *arg, int mark) {
 	REQUIRE(VALID_CACHE(cache));
 
 	LOCK(&cache->cleaner.lock);
-	
-	dns_db_overmem(cache->db, overmem);
-	cache->cleaner.overmem = overmem;
+
+	if (overmem != cache->cleaner.overmem) {
+		dns_db_overmem(cache->db, overmem);
+		cache->cleaner.overmem = overmem;
+		isc_mem_waterack(cache->mctx, mark);
+	}
 
 	if (cache->cleaner.overmem_event != NULL)
 		isc_task_send(cache->cleaner.task,
@@ -1034,7 +1037,7 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
 	dns_rdatasetiter_t *iter = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_db_t *db = NULL;
-	
+
 	LOCK(&cache->lock);
 	if (cache->db != NULL)
 		dns_db_attach(cache->db, &db);
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 02a2f188d08ce..8fef86c36ffe0 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -15,17 +15,19 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.c,v 1.101.2.6.2.21.4.5 2008/07/23 23:16:26 marka Exp $ */
+/* $Id: dispatch.c,v 1.101.2.6.2.36 2008/09/04 00:25:40 jinmei Exp $ */
 
 #include 
 
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -44,13 +46,8 @@
 
 typedef ISC_LIST(dns_dispentry_t)	dns_displist_t;
 
-typedef struct dns_qid {
-	unsigned int	magic;
-	unsigned int	qid_nbuckets;	/* hash table size */
-	unsigned int	qid_increment;	/* id increment on collision */
-	isc_mutex_t	lock;
-	dns_displist_t	*qid_table;	/* the table itself */
-} dns_qid_t;
+typedef struct dispsocket dispsocket_t;
+typedef ISC_LIST(dispsocket_t)		dispsocketlist_t;
 
 /* ARC4 Random generator state */
 typedef struct arc4ctx {
@@ -58,14 +55,26 @@ typedef struct arc4ctx {
 	isc_uint8_t	j;
 	isc_uint8_t	s[256];
 	int		count;
+	isc_entropy_t	*entropy;	/* entropy source for ARC4 */
+	isc_mutex_t	*lock;
 } arc4ctx_t;
 
+typedef struct dns_qid {
+	unsigned int	magic;
+	unsigned int	qid_nbuckets;	/* hash table size */
+	unsigned int	qid_increment;	/* id increment on collision */
+	isc_mutex_t	lock;
+	dns_displist_t	*qid_table;	/* the table itself */
+	dispsocketlist_t *sock_table;	/* socket table */
+} dns_qid_t;
+
 struct dns_dispatchmgr {
 	/* Unlocked. */
 	unsigned int			magic;
 	isc_mem_t		       *mctx;
 	dns_acl_t		       *blackhole;
 	dns_portlist_t		       *portlist;
+	isc_entropy_t		       *entropy; /* entropy source */
 
 	/* Locked by "lock". */
 	isc_mutex_t			lock;
@@ -74,7 +83,7 @@ struct dns_dispatchmgr {
 
 	/* Locked by arc4_lock. */
 	isc_mutex_t			arc4_lock;
-	arc4ctx_t			arc4ctx;    /*%< ARC4 context for QID */
+	arc4ctx_t			arc4ctx;    /* ARC4 context for QID */
 
 	/* locked by buffer lock */
 	dns_qid_t			*qid;
@@ -89,8 +98,27 @@ struct dns_dispatchmgr {
 	isc_mempool_t		       *rpool;	/* memory pool for replies */
 	isc_mempool_t		       *dpool;  /* dispatch allocations */
 	isc_mempool_t		       *bpool;	/* memory pool for buffers */
+	isc_mempool_t		       *spool;	/* memory pool for dispsocs */
 
-	isc_entropy_t		       *entropy; /* entropy source */
+	/*
+	 * Locked by qid->lock if qid exists; otherwise, can be used without
+	 * being locked.
+	 * Memory footprint considerations: this is a simple implementation of
+	 * available ports, i.e., an ordered array of the actual port numbers.
+	 * This will require about 256KB of memory in the worst case (128KB for
+	 * each of IPv4 and IPv6).  We could reduce it by representing it as a
+	 * more sophisticated way such as a list (or array) of ranges that are
+	 * searched to identify a specific port.  Our decision here is the saved
+	 * memory isn't worth the implementation complexity, considering the
+	 * fact that the whole BIND9 process (which is mainly named) already
+	 * requires a pretty large memory footprint.  We may, however, have to
+	 * revisit the decision when we want to use it as a separate module for
+	 * an environment where memory requirement is severer.
+	 */
+	in_port_t	*v4ports;	/* available ports for IPv4 */
+	unsigned int	nv4ports;	/* # of available ports for IPv4 */
+	in_port_t	*v6ports;	/* available ports for IPv4 */
+	unsigned int	nv6ports;	/* # of available ports for IPv4 */
 };
 
 #define MGR_SHUTTINGDOWN		0x00000001U
@@ -109,17 +137,65 @@ struct dns_dispentry {
 	isc_taskaction_t		action;
 	void			       *arg;
 	isc_boolean_t			item_out;
+	dispsocket_t			*dispsocket;
 	ISC_LIST(dns_dispatchevent_t)	items;
 	ISC_LINK(dns_dispentry_t)	link;
 };
 
+/*
+ * Maximum number of dispatch sockets that can be pooled for reuse.  The
+ * appropriate value may vary, but experiments have shown a busy caching server
+ * may need more than 1000 sockets concurrently opened.  The maximum allowable
+ * number of dispatch sockets (per manager) will be set to the double of this
+ * value.
+ */
+#ifndef DNS_DISPATCH_POOLSOCKS
+#define DNS_DISPATCH_POOLSOCKS			2048
+#endif
+
+/*
+ * Quota to control the number of dispatch sockets.  If a dispatch has more
+ * than the quota of sockets, new queries will purge oldest ones, so that
+ * a massive number of outstanding queries won't prevent subsequent queries
+ * (especially if the older ones take longer time and result in timeout).
+ */
+#ifndef DNS_DISPATCH_SOCKSQUOTA
+#define DNS_DISPATCH_SOCKSQUOTA			3072
+#endif
+
+struct dispsocket {
+	unsigned int			magic;
+	isc_socket_t			*socket;
+	dns_dispatch_t			*disp;
+	isc_sockaddr_t			host;
+	in_port_t			localport;
+	dns_dispentry_t			*resp;
+	isc_task_t			*task;
+	ISC_LINK(dispsocket_t)		link;
+	unsigned int			bucket;
+	ISC_LINK(dispsocket_t)		blink;
+};
+
 #define INVALID_BUCKET		(0xffffdead)
 
+/*
+ * Number of tasks for each dispatch that use separate sockets for different
+ * transactions.  This must be a power of 2 as it will divide 32 bit numbers
+ * to get an uniformly random tasks selection.  See get_dispsocket().
+ */
+#define MAX_INTERNAL_TASKS	64
+
 struct dns_dispatch {
 	/* Unlocked. */
 	unsigned int		magic;		/* magic */
 	dns_dispatchmgr_t      *mgr;		/* dispatch manager */
-	isc_task_t	       *task;		/* internal task */
+	int			ntasks;
+	/*
+	 * internal task buckets.  We use multiple tasks to distribute various
+	 * socket events well when using separate dispatch sockets.  We use the
+	 * 1st task (task[0]) for internal control events.
+	 */
+	isc_task_t	       *task[MAX_INTERNAL_TASKS];
 	isc_socket_t	       *socket;		/* isc socket attached to */
 	isc_sockaddr_t		local;		/* local address */
 	in_port_t		localport;	/* local UDP port */
@@ -141,10 +217,14 @@ struct dns_dispatch {
 				tcpmsg_valid : 1,
 				recv_pending : 1; /* is a recv() pending? */
 	isc_result_t		shutdown_why;
+	ISC_LIST(dispsocket_t)	activesockets;
+	ISC_LIST(dispsocket_t)	inactivesockets;
+	unsigned int		nsockets;
 	unsigned int		requests;	/* how many requests we have */
 	unsigned int		tcpbuffers;	/* allocated buffers */
 	dns_tcpmsg_t		tcpmsg;		/* for tcp streams */
 	dns_qid_t		*qid;
+	arc4ctx_t		arc4ctx;	/* for QID/UDP port num */
 };
 
 #define QID_MAGIC		ISC_MAGIC('Q', 'i', 'd', ' ')
@@ -153,6 +233,9 @@ struct dns_dispatch {
 #define RESPONSE_MAGIC		ISC_MAGIC('D', 'r', 's', 'p')
 #define VALID_RESPONSE(e)	ISC_MAGIC_VALID((e), RESPONSE_MAGIC)
 
+#define DISPSOCK_MAGIC		ISC_MAGIC('D', 's', 'o', 'c')
+#define VALID_DISPSOCK(e)	ISC_MAGIC_VALID((e), DISPSOCK_MAGIC)
+
 #define DISPATCH_MAGIC		ISC_MAGIC('D', 'i', 's', 'p')
 #define VALID_DISPATCH(e)	ISC_MAGIC_VALID((e), DISPATCH_MAGIC)
 
@@ -161,16 +244,33 @@ struct dns_dispatch {
 
 #define DNS_QID(disp) ((disp)->socktype == isc_sockettype_tcp) ? \
 		       (disp)->qid : (disp)->mgr->qid
+#define DISP_ARC4CTX(disp) ((disp)->socktype == isc_sockettype_udp) ? \
+			(&(disp)->arc4ctx) : (&(disp)->mgr->arc4ctx)
+
+/*
+ * Locking a query port buffer is a bit tricky.  We access the buffer without
+ * locking until qid is created.  Technically, there is a possibility of race
+ * between the creation of qid and access to the port buffer; in practice,
+ * however, this should be safe because qid isn't created until the first
+ * dispatch is created and there should be no contending situation until then.
+ */
+#define PORTBUFLOCK(mgr) if ((mgr)->qid != NULL) LOCK(&((mgr)->qid->lock))
+#define PORTBUFUNLOCK(mgr) if ((mgr)->qid != NULL) UNLOCK((&(mgr)->qid->lock))
+
 /*
  * Statics.
  */
-static dns_dispentry_t *bucket_search(dns_qid_t *, isc_sockaddr_t *,
-				      dns_messageid_t, in_port_t, unsigned int);
+static dns_dispentry_t *entry_search(dns_qid_t *, isc_sockaddr_t *,
+				     dns_messageid_t, in_port_t, unsigned int);
 static isc_boolean_t destroy_disp_ok(dns_dispatch_t *);
 static void destroy_disp(isc_task_t *task, isc_event_t *event);
-static void udp_recv(isc_task_t *, isc_event_t *);
+static void destroy_dispsocket(dns_dispatch_t *, dispsocket_t **);
+static void deactivate_dispsocket(dns_dispatch_t *, dispsocket_t *);
+static void udp_exrecv(isc_task_t *, isc_event_t *);
+static void udp_shrecv(isc_task_t *, isc_event_t *);
+static void udp_recv(isc_event_t *, dns_dispatch_t *, dispsocket_t *);
 static void tcp_recv(isc_task_t *, isc_event_t *);
-static void startrecv(dns_dispatch_t *);
+static isc_result_t startrecv(dns_dispatch_t *, dispsocket_t *);
 static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t,
 			     in_port_t);
 static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len);
@@ -182,6 +282,11 @@ static dns_dispentry_t *linear_first(dns_qid_t *disp);
 static dns_dispentry_t *linear_next(dns_qid_t *disp,
 				    dns_dispentry_t *resp);
 static void dispatch_free(dns_dispatch_t **dispp);
+static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
+				  dns_dispatch_t *disp,
+				  isc_socketmgr_t *sockmgr,
+				  isc_sockaddr_t *localaddr,
+				  isc_socket_t **sockp);
 static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 				       isc_socketmgr_t *sockmgr,
 				       isc_taskmgr_t *taskmgr,
@@ -192,8 +297,13 @@ static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr);
 static void destroy_mgr(dns_dispatchmgr_t **mgrp);
 static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-				 unsigned int increment, dns_qid_t **qidp);
+				 unsigned int increment, dns_qid_t **qidp,
+				 isc_boolean_t needaddrtable);
 static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
+static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
+				unsigned int options, isc_socket_t **sockp);
+static isc_boolean_t portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
+				   isc_sockaddr_t *sockaddrp);
 
 #define LVL(x) ISC_LOG_DEBUG(x)
 
@@ -296,13 +406,15 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp,
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 static void
-dispatch_arc4init(arc4ctx_t *actx) {
+dispatch_arc4init(arc4ctx_t *actx, isc_entropy_t *entropy, isc_mutex_t *lock) {
 	int n;
 	for (n = 0; n < 256; n++)
 		actx->s[n] = n;
 	actx->i = 0;
 	actx->j = 0;
 	actx->count = 0;
+	actx->entropy = entropy; /* don't have to attach */
+	actx->lock = lock;
 }
 
 static void
@@ -346,7 +458,7 @@ dispatch_arc4get16(arc4ctx_t *actx) {
 }
 
 static void
-dispatch_arc4stir(dns_dispatchmgr_t *mgr) {
+dispatch_arc4stir(arc4ctx_t *actx) {
 	int i;
 	union {
 		unsigned char rnd[128];
@@ -354,51 +466,55 @@ dispatch_arc4stir(dns_dispatchmgr_t *mgr) {
 	} rnd;
 	isc_result_t result;
 
-	if (mgr->entropy != NULL) {
+	if (actx->entropy != NULL) {
 		/*
 		 * We accept any quality of random data to avoid blocking.
 		 */
-		result = isc_entropy_getdata(mgr->entropy, rnd.rnd,
+		result = isc_entropy_getdata(actx->entropy, rnd.rnd,
 					     sizeof(rnd), NULL, 0);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	} else {
 		for (i = 0; i < 32; i++)
 			isc_random_get(&rnd.rnd32[i]);
 	}
-	dispatch_arc4addrandom(&mgr->arc4ctx, rnd.rnd, sizeof(rnd.rnd));
+	dispatch_arc4addrandom(actx, rnd.rnd, sizeof(rnd.rnd));
 
 	/*
 	 * Discard early keystream, as per recommendations in:
 	 * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
 	 */
 	for (i = 0; i < 256; i++)
-		(void)dispatch_arc4get8(&mgr->arc4ctx);
+		(void)dispatch_arc4get8(actx);
 
 	/*
 	 * Derived from OpenBSD's implementation.  The rationale is not clear,
 	 * but should be conservative enough in safety, and reasonably large
 	 * for efficiency.
 	 */
-	mgr->arc4ctx.count = 1600000;
+	actx->count = 1600000;
 }
 
 static isc_uint16_t
-dispatch_arc4random(dns_dispatchmgr_t *mgr) {
+dispatch_arc4random(arc4ctx_t *actx) {
 	isc_uint16_t result;
 
-	LOCK(&mgr->arc4_lock);
-	mgr->arc4ctx.count -= sizeof(isc_uint16_t);
-	if (mgr->arc4ctx.count <= 0)
-		dispatch_arc4stir(mgr);
-	result = dispatch_arc4get16(&mgr->arc4ctx);
-	UNLOCK(&mgr->arc4_lock);
+	if (actx->lock != NULL)
+		LOCK(actx->lock);
+
+	actx->count -= sizeof(isc_uint16_t);
+	if (actx->count <= 0)
+		dispatch_arc4stir(actx);
+	result = dispatch_arc4get16(actx);
+
+	if (actx->lock != NULL)
+		UNLOCK(actx->lock);
+
 	return (result);
 }
 
 static isc_uint16_t
-dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) {
+dispatch_arc4uniformrandom(arc4ctx_t *actx, isc_uint16_t upper_bound) {
 	isc_uint16_t min, r;
-	/* The caller must hold the manager lock. */
 
 	if (upper_bound < 2)
 		return (0);
@@ -420,7 +536,7 @@ dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) {
 	 * to re-roll.
 	 */
 	for (;;) {
-		r = dispatch_arc4random(mgr);
+		r = dispatch_arc4random(actx);
 		if (r >= min)
 			break;
 	}
@@ -503,13 +619,15 @@ destroy_disp_ok(dns_dispatch_t *disp)
 	if (disp->recv_pending != 0)
 		return (ISC_FALSE);
 
+	if (!ISC_LIST_EMPTY(disp->activesockets))
+		return (ISC_FALSE);
+
 	if (disp->shutting_down == 0)
 		return (ISC_FALSE);
 
 	return (ISC_TRUE);
 }
 
-
 /*
  * Called when refcount reaches 0 (and safe to destroy).
  *
@@ -521,6 +639,8 @@ destroy_disp(isc_task_t *task, isc_event_t *event) {
 	dns_dispatch_t *disp;
 	dns_dispatchmgr_t *mgr;
 	isc_boolean_t killmgr;
+	dispsocket_t *dispsocket;
+	int i;
 
 	INSIST(event->ev_type == DNS_EVENT_DISPATCHCONTROL);
 
@@ -534,10 +654,16 @@ destroy_disp(isc_task_t *task, isc_event_t *event) {
 
 	dispatch_log(disp, LVL(90),
 		     "shutting down; detaching from sock %p, task %p",
-		     disp->socket, disp->task);
+		     disp->socket, disp->task[0]); /* XXXX */
 
-	isc_socket_detach(&disp->socket);
-	isc_task_detach(&disp->task);
+	if (disp->socket != NULL)
+		isc_socket_detach(&disp->socket);
+	while ((dispsocket = ISC_LIST_HEAD(disp->inactivesockets)) != NULL) {
+		ISC_LIST_UNLINK(disp->inactivesockets, dispsocket, link);
+		destroy_dispsocket(disp, &dispsocket);
+	}
+	for (i = 0; i < disp->ntasks; i++)
+		isc_task_detach(&disp->task[i]);
 	isc_event_free(&event);
 
 	dispatch_free(&disp);
@@ -548,14 +674,210 @@ destroy_disp(isc_task_t *task, isc_event_t *event) {
 		destroy_mgr(&mgr);
 }
 
+/*
+ * Find a dispsocket for socket address 'dest', and port number 'port'.
+ * Return NULL if no such entry exists.
+ */
+static dispsocket_t *
+socket_search(dns_qid_t *qid, isc_sockaddr_t *dest, in_port_t port,
+	      unsigned int bucket)
+{
+	dispsocket_t *dispsock;
+
+	REQUIRE(bucket < qid->qid_nbuckets);
+
+	dispsock = ISC_LIST_HEAD(qid->sock_table[bucket]);
+
+	while (dispsock != NULL) {
+		if (isc_sockaddr_equal(dest, &dispsock->host) &&
+		    dispsock->localport == port)
+			return (dispsock);
+		dispsock = ISC_LIST_NEXT(dispsock, blink);
+	}
+
+	return (NULL);
+}
 
 /*
- * Find an entry for query ID 'id' and socket address 'dest' in 'qid'.
+ * Make a new socket for a single dispatch with a random port number.
+ * The caller must hold the disp->lock and qid->lock.
+ */
+static isc_result_t
+get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+	       isc_socketmgr_t *sockmgr, dns_qid_t *qid,
+	       dispsocket_t **dispsockp, in_port_t *portp)
+{
+	int i;
+	isc_uint32_t r;
+	dns_dispatchmgr_t *mgr = disp->mgr;
+	isc_socket_t *sock = NULL;
+	isc_result_t result = ISC_R_FAILURE;
+	in_port_t port;
+	isc_sockaddr_t localaddr;
+	unsigned int bucket = 0;
+	dispsocket_t *dispsock;
+	unsigned int nports;
+	in_port_t *ports;
+
+	if (isc_sockaddr_pf(&disp->local) == AF_INET) {
+		nports = disp->mgr->nv4ports;
+		ports = disp->mgr->v4ports;
+	} else {
+		nports = disp->mgr->nv6ports;
+		ports = disp->mgr->v6ports;
+	}
+	if (nports == 0)
+		return (ISC_R_ADDRNOTAVAIL);
+
+	dispsock = ISC_LIST_HEAD(disp->inactivesockets);
+	if (dispsock != NULL) {
+		ISC_LIST_UNLINK(disp->inactivesockets, dispsock, link);
+		sock = dispsock->socket;
+		dispsock->socket = NULL;
+	} else {
+		dispsock = isc_mempool_get(mgr->spool);
+		if (dispsock == NULL)
+			return (ISC_R_NOMEMORY);
+
+		disp->nsockets++;
+		dispsock->socket = NULL;
+		dispsock->disp = disp;
+		dispsock->resp = NULL;
+		isc_random_get(&r);
+		dispsock->task = NULL;
+		isc_task_attach(disp->task[r % disp->ntasks], &dispsock->task);
+		ISC_LINK_INIT(dispsock, link);
+		ISC_LINK_INIT(dispsock, blink);
+		dispsock->magic = DISPSOCK_MAGIC;
+	}
+
+	/*
+	 * Pick up a random UDP port and open a new socket with it.  Avoid
+	 * choosing ports that share the same destination because it will be
+	 * very likely to fail in bind(2) or connect(2).
+	 */
+	localaddr = disp->local;
+	for (i = 0; i < 64; i++) {
+		port = ports[dispatch_arc4uniformrandom(DISP_ARC4CTX(disp),
+							nports)];
+		isc_sockaddr_setport(&localaddr, port);
+
+		bucket = dns_hash(qid, dest, 0, port);
+		if (socket_search(qid, dest, port, bucket) != NULL)
+			continue;
+
+		result = open_socket(sockmgr, &localaddr, 0, &sock);
+		if (result == ISC_R_SUCCESS || result != ISC_R_ADDRINUSE)
+			break;
+	}
+
+	if (result == ISC_R_SUCCESS) {
+		dispsock->socket = sock;
+		dispsock->host = *dest;
+		dispsock->localport = port;
+		dispsock->bucket = bucket;
+		ISC_LIST_APPEND(qid->sock_table[bucket], dispsock, blink);
+		*dispsockp = dispsock;
+		*portp = port;
+	} else {
+		/*
+		 * We could keep it in the inactive list, but since this should
+		 * be an exceptional case and might be resource shortage, we'd
+		 * rather destroy it.
+		 */
+		if (sock != NULL)
+			isc_socket_detach(&sock);
+		destroy_dispsocket(disp, &dispsock);
+	}
+
+	return (result);
+}
+
+/*
+ * Destroy a dedicated dispatch socket.
+ */
+static void
+destroy_dispsocket(dns_dispatch_t *disp, dispsocket_t **dispsockp) {
+	dispsocket_t *dispsock;
+	dns_qid_t *qid;
+
+	/*
+	 * The dispatch must be locked.
+	 */
+
+	REQUIRE(dispsockp != NULL && *dispsockp != NULL);
+	dispsock = *dispsockp;
+	REQUIRE(!ISC_LINK_LINKED(dispsock, link));
+
+	disp->nsockets--;
+	dispsock->magic = 0;
+	if (dispsock->socket != NULL)
+		isc_socket_detach(&dispsock->socket);
+	if (ISC_LINK_LINKED(dispsock, blink)) {
+		qid = DNS_QID(disp);
+		LOCK(&qid->lock);
+		ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock,
+				blink);
+		UNLOCK(&qid->lock);
+	}
+	if (dispsock->task != NULL)
+		isc_task_detach(&dispsock->task);
+	isc_mempool_put(disp->mgr->spool, dispsock);
+
+	*dispsockp = NULL;
+}
+
+/*
+ * Deactivate a dedicated dispatch socket.  Move it to the inactive list for
+ * future reuse unless the total number of sockets are exceeding the maximum.
+ */
+static void
+deactivate_dispsocket(dns_dispatch_t *disp, dispsocket_t *dispsock) {
+	isc_result_t result;
+	dns_qid_t *qid;
+
+	/*
+	 * The dispatch must be locked.
+	 */
+	ISC_LIST_UNLINK(disp->activesockets, dispsock, link);
+	if (dispsock->resp != NULL) {
+		INSIST(dispsock->resp->dispsocket == dispsock);
+		dispsock->resp->dispsocket = NULL;
+	}
+
+	if (disp->nsockets > DNS_DISPATCH_POOLSOCKS)
+		destroy_dispsocket(disp, &dispsock);
+	else {
+		result = isc_socket_close(dispsock->socket);
+
+		qid = DNS_QID(disp);
+		LOCK(&qid->lock);
+		ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock,
+				blink);
+		UNLOCK(&qid->lock);
+
+		if (result == ISC_R_SUCCESS)
+			ISC_LIST_APPEND(disp->inactivesockets, dispsock, link);
+		else {
+			/*
+			 * If the underlying system does not allow this
+			 * optimization, destroy this temporary structure (and
+			 * create a new one for a new transaction).
+			 */
+			INSIST(result == ISC_R_NOTIMPLEMENTED);
+			destroy_dispsocket(disp, &dispsock);
+		}
+	}
+}
+
+/*
+ * Find an entry for query ID 'id', socket address 'dest', and port number
+ * 'port'.
  * Return NULL if no such entry exists.
  */
 static dns_dispentry_t *
-bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
-	      in_port_t port, unsigned int bucket)
+entry_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
+	     in_port_t port, unsigned int bucket)
 {
 	dns_dispentry_t *res;
 
@@ -564,7 +886,7 @@ bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
 	res = ISC_LIST_HEAD(qid->qid_table[bucket]);
 
 	while (res != NULL) {
-		if ((res->id == id) && isc_sockaddr_equal(dest, &res->host) &&
+		if (res->id == id && isc_sockaddr_equal(dest, &res->host) &&
 		    res->port == port) {
 			return (res);
 		}
@@ -638,6 +960,26 @@ allocate_event(dns_dispatch_t *disp) {
 	return (ev);
 }
 
+static void
+udp_exrecv(isc_task_t *task, isc_event_t *ev) {
+	dispsocket_t *dispsock = ev->ev_arg;
+
+	UNUSED(task);
+
+	REQUIRE(VALID_DISPSOCK(dispsock));
+	udp_recv(ev, dispsock->disp, dispsock);
+}
+
+static void
+udp_shrecv(isc_task_t *task, isc_event_t *ev) {
+	dns_dispatch_t *disp = ev->ev_arg;
+
+	UNUSED(task);
+
+	REQUIRE(VALID_DISPATCH(disp));
+	udp_recv(ev, disp, NULL);
+}
+
 /*
  * General flow:
  *
@@ -653,14 +995,13 @@ allocate_event(dns_dispatch_t *disp) {
  *	restart.
  */
 static void
-udp_recv(isc_task_t *task, isc_event_t *ev_in) {
+udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 	isc_socketevent_t *ev = (isc_socketevent_t *)ev_in;
-	dns_dispatch_t *disp = ev_in->ev_arg;
 	dns_messageid_t id;
 	isc_result_t dres;
 	isc_buffer_t source;
 	unsigned int flags;
-	dns_dispentry_t *resp;
+	dns_dispentry_t *resp = NULL;
 	dns_dispatchevent_t *rev;
 	unsigned int bucket;
 	isc_boolean_t killit;
@@ -669,8 +1010,8 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	dns_qid_t *qid;
 	isc_netaddr_t netaddr;
 	int match;
-
-	UNUSED(task);
+	int result;
+	isc_boolean_t qidlocked = ISC_FALSE;
 
 	LOCK(&disp->lock);
 
@@ -681,7 +1022,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		     "got packet: requests %d, buffers %d, recvs %d",
 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
 
-	if (ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
+	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
 		/*
 		 * Unless the receive event was imported from a listening
 		 * interface, in which case the event type is
@@ -691,6 +1032,19 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		disp->recv_pending = 0;
 	}
 
+	if (dispsock != NULL &&
+	    (ev->result == ISC_R_CANCELED || dispsock->resp == NULL)) {
+		/*
+		 * dispsock->resp can be NULL if this transaction was canceled
+		 * just after receiving a response.  Since this socket is
+		 * exclusively used and there should be at most one receive
+		 * event the canceled event should have been no effect.  So
+		 * we can (and should) deactivate the socket right now.
+		 */
+		deactivate_dispsocket(disp, dispsock);
+		dispsock = NULL;
+	}
+
 	if (disp->shutting_down) {
 		/*
 		 * This dispatcher is shutting down.
@@ -703,12 +1057,32 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		killit = destroy_disp_ok(disp);
 		UNLOCK(&disp->lock);
 		if (killit)
-			isc_task_send(disp->task, &disp->ctlevent);
+			isc_task_send(disp->task[0], &disp->ctlevent);
 
 		return;
 	}
 
-	if (ev->result != ISC_R_SUCCESS) {
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+		if (dispsock != NULL) {
+			resp = dispsock->resp;
+			id = resp->id;
+			if (ev->result != ISC_R_SUCCESS) {
+				/*
+				 * This is most likely a network error on a
+				 * connected socket.  It makes no sense to
+				 * check the address or parse the packet, but it
+				 * will help to return the error to the caller.
+				 */
+				goto sendresponse;
+			}
+		} else {
+			free_buffer(disp, ev->region.base, ev->region.length);
+
+			UNLOCK(&disp->lock);
+			isc_event_free(&ev_in);
+			return;
+		}
+	} else if (ev->result != ISC_R_SUCCESS) {
 		free_buffer(disp, ev->region.base, ev->region.length);
 
 		if (ev->result != ISC_R_CANCELED)
@@ -769,15 +1143,29 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		goto restart;
 	}
 
-	/* response */
-	bucket = dns_hash(qid, &ev->address, id, disp->localport);
-	LOCK(&qid->lock);
-	resp = bucket_search(qid, &ev->address, id, disp->localport, bucket);
-	dispatch_log(disp, LVL(90),
-		     "search for response in bucket %d: %s",
-		     bucket, (resp == NULL ? "not found" : "found"));
-
+	/*
+	 * Search for the corresponding response.  If we are using an exclusive
+	 * socket, we've already identified it and we can skip the search; but
+	 * the ID and the address must match the expected ones.
+	 */
 	if (resp == NULL) {
+		bucket = dns_hash(qid, &ev->address, id, disp->localport);
+		LOCK(&qid->lock);
+		qidlocked = ISC_TRUE;
+		resp = entry_search(qid, &ev->address, id, disp->localport,
+				    bucket);
+		dispatch_log(disp, LVL(90),
+			     "search for response in bucket %d: %s",
+			     bucket, (resp == NULL ? "not found" : "found"));
+
+		if (resp == NULL) {
+			free_buffer(disp, ev->region.base, ev->region.length);
+			goto unlock;
+		}
+	} else if (resp->id != id || !isc_sockaddr_equal(&ev->address,
+							 &resp->host)) {
+		dispatch_log(disp, LVL(90),
+			     "response to an exclusive socket doesn't match");
 		free_buffer(disp, ev->region.base, ev->region.length);
 		goto unlock;
 	}
@@ -825,6 +1213,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		}
 	}
 
+  sendresponse:
 	queue_response = resp->item_out;
 	rev = allocate_event(resp->disp);
 	if (rev == NULL) {
@@ -839,7 +1228,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	 */
 	isc_buffer_init(&rev->buffer, ev->region.base, ev->region.length);
 	isc_buffer_add(&rev->buffer, ev->n);
-	rev->result = ISC_R_SUCCESS;
+	rev->result = ev->result;
 	rev->id = id;
 	rev->addr = ev->address;
 	rev->pktinfo = ev->pktinfo;
@@ -858,14 +1247,23 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		isc_task_send(resp->task, ISC_EVENT_PTR(&rev));
 	}
  unlock:
-	UNLOCK(&qid->lock);
+	if (qidlocked)
+		UNLOCK(&qid->lock);
 
 	/*
 	 * Restart recv() to get the next packet.
 	 */
  restart:
-	startrecv(disp);
-
+	result = startrecv(disp, dispsock);
+	if (result != ISC_R_SUCCESS && dispsock != NULL) {
+		/*
+		 * XXX: wired. There seems to be no recovery process other than
+		 * deactivate this socket anyway (since we cannot start
+		 * receiving, we won't be able to receive a cancel event
+		 * from the user).
+		 */
+		deactivate_dispsocket(disp, dispsock);
+	}
 	UNLOCK(&disp->lock);
 
 	isc_event_free(&ev_in);
@@ -965,7 +1363,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		killit = destroy_disp_ok(disp);
 		UNLOCK(&disp->lock);
 		if (killit)
-			isc_task_send(disp->task, &disp->ctlevent);
+			isc_task_send(disp->task[0], &disp->ctlevent);
 		return;
 	}
 
@@ -1008,8 +1406,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	 */
 	bucket = dns_hash(qid, &tcpmsg->address, id, disp->localport);
 	LOCK(&qid->lock);
-	resp = bucket_search(qid, &tcpmsg->address, id, disp->localport,
-			     bucket);
+	resp = entry_search(qid, &tcpmsg->address, id, disp->localport, bucket);
 	dispatch_log(disp, LVL(90),
 		     "search for response in bucket %d: %s",
 		     bucket, (resp == NULL ? "not found" : "found"));
@@ -1050,7 +1447,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	 * Restart recv() to get the next packet.
 	 */
  restart:
-	startrecv(disp);
+	(void)startrecv(disp, NULL);
 
 	UNLOCK(&disp->lock);
 
@@ -1060,22 +1457,33 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 /*
  * disp must be locked.
  */
-static void
-startrecv(dns_dispatch_t *disp) {
+static isc_result_t
+startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
 	isc_result_t res;
 	isc_region_t region;
+	isc_socket_t *socket;
 
 	if (disp->shutting_down == 1)
-		return;
+		return (ISC_R_SUCCESS);
 
 	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
-		return;
+		return (ISC_R_SUCCESS);
 
-	if (disp->recv_pending != 0)
-		return;
+	if (disp->recv_pending != 0 && dispsock == NULL)
+		return (ISC_R_SUCCESS);
 
 	if (disp->mgr->buffers >= disp->mgr->maxbuffers)
-		return;
+		return (ISC_R_NOMEMORY);
+
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
+	    dispsock == NULL)
+		return (ISC_R_SUCCESS);
+
+	if (dispsock != NULL)
+		socket = dispsock->socket;
+	else
+		socket = disp->socket;
+	INSIST(socket != NULL);
 
 	switch (disp->socktype) {
 		/*
@@ -1085,33 +1493,45 @@ startrecv(dns_dispatch_t *disp) {
 		region.length = disp->mgr->buffersize;
 		region.base = allocate_udp_buffer(disp);
 		if (region.base == NULL)
-			return;
-		res = isc_socket_recv(disp->socket, ®ion, 1,
-				      disp->task, udp_recv, disp);
-		if (res != ISC_R_SUCCESS) {
-			free_buffer(disp, region.base, region.length);
-			disp->shutdown_why = res;
-			disp->shutting_down = 1;
-			do_cancel(disp);
-			return;
+			return (ISC_R_NOMEMORY);
+		if (dispsock != NULL) {
+			res = isc_socket_recv(socket, ®ion, 1,
+					      dispsock->task, udp_exrecv,
+					      dispsock);
+			if (res != ISC_R_SUCCESS) {
+				free_buffer(disp, region.base, region.length);
+				return (res);
+			}
+		} else {
+			res = isc_socket_recv(socket, ®ion, 1,
+					      disp->task[0], udp_shrecv, disp);
+			if (res != ISC_R_SUCCESS) {
+				free_buffer(disp, region.base, region.length);
+				disp->shutdown_why = res;
+				disp->shutting_down = 1;
+				do_cancel(disp);
+				return (ISC_R_SUCCESS); /* recover by cancel */
+			}
+			INSIST(disp->recv_pending == 0);
+			disp->recv_pending = 1;
 		}
-		INSIST(disp->recv_pending == 0);
-		disp->recv_pending = 1;
 		break;
 
 	case isc_sockettype_tcp:
-		res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task,
+		res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task[0],
 					     tcp_recv, disp);
 		if (res != ISC_R_SUCCESS) {
 			disp->shutdown_why = res;
 			disp->shutting_down = 1;
 			do_cancel(disp);
-			return;
+			return (ISC_R_SUCCESS); /* recover by cancel */
 		}
 		INSIST(disp->recv_pending == 0);
 		disp->recv_pending = 1;
 		break;
 	}
+
+	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -1164,6 +1584,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 	isc_mempool_destroy(&mgr->rpool);
 	isc_mempool_destroy(&mgr->dpool);
 	isc_mempool_destroy(&mgr->bpool);
+	isc_mempool_destroy(&mgr->spool);
 
 	DESTROYLOCK(&mgr->pool_lock);
 
@@ -1177,32 +1598,46 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 	if (mgr->blackhole != NULL)
 		dns_acl_detach(&mgr->blackhole);
 
-	if (mgr->portlist != NULL)
-		dns_portlist_detach(&mgr->portlist);
-
+	if (mgr->v4ports != NULL) {
+		isc_mem_put(mctx, mgr->v4ports,
+			    mgr->nv4ports * sizeof(in_port_t));
+	}
+	if (mgr->v6ports != NULL) {
+		isc_mem_put(mctx, mgr->v6ports,
+			    mgr->nv6ports * sizeof(in_port_t));
+	}
 	isc_mem_put(mctx, mgr, sizeof(dns_dispatchmgr_t));
 	isc_mem_detach(&mctx);
 }
 
 static isc_result_t
-create_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
-	      unsigned int options, isc_socket_t **sockp)
+open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
+	    unsigned int options, isc_socket_t **sockp)
 {
 	isc_socket_t *sock;
 	isc_result_t result;
 
-	sock = NULL;
-	result = isc_socket_create(mgr, isc_sockaddr_pf(local),
-				   isc_sockettype_udp, &sock);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	sock = *sockp;
+	if (sock == NULL) {
+		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
+					   isc_sockettype_udp, &sock);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	} else {
+		result = isc_socket_open(sock);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	}
 
 #ifndef ISC_ALLOW_MAPPED
 	isc_socket_ipv6only(sock, ISC_TRUE);
 #endif
 	result = isc_socket_bind(sock, local, options);
 	if (result != ISC_R_SUCCESS) {
-		isc_socket_detach(&sock);
+		if (*sockp == NULL)
+			isc_socket_detach(&sock);
+		else
+			isc_socket_close(sock);
 		return (result);
 	}
 
@@ -1210,6 +1645,24 @@ create_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
 	return (ISC_R_SUCCESS);
 }
 
+/*
+ * Create a temporary port list to set the initial default set of dispatch
+ * ports: [1024, 65535].  This is almost meaningless as the application will
+ * normally set the ports explicitly, but is provided to fill some minor corner
+ * cases.
+ */
+static isc_result_t
+create_default_portset(isc_mem_t *mctx, isc_portset_t **portsetp) {
+	isc_result_t result;
+
+	result = isc_portset_create(mctx, portsetp);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_portset_addrange(*portsetp, 1024, 65535);
+
+	return (ISC_R_SUCCESS);
+}
+
 /*
  * Publics.
  */
@@ -1220,6 +1673,8 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 {
 	dns_dispatchmgr_t *mgr;
 	isc_result_t result;
+	isc_portset_t *v4portset = NULL;
+	isc_portset_t *v6portset = NULL;
 
 	REQUIRE(mctx != NULL);
 	REQUIRE(mgrp != NULL && *mgrp == NULL);
@@ -1232,7 +1687,6 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 	isc_mem_attach(mctx, &mgr->mctx);
 
 	mgr->blackhole = NULL;
-	mgr->portlist = NULL;
 
 	result = isc_mutex_init(&mgr->lock);
 	if (result != ISC_R_SUCCESS)
@@ -1287,20 +1741,43 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 	mgr->buffersize = 0;
 	mgr->maxbuffers = 0;
 	mgr->bpool = NULL;
+	mgr->spool = NULL;
 	mgr->entropy = NULL;
 	mgr->qid = NULL;
 	mgr->state = 0;
 	ISC_LIST_INIT(mgr->list);
+	mgr->v4ports = NULL;
+	mgr->v6ports = NULL;
+	mgr->nv4ports = 0;
+	mgr->nv6ports = 0;
 	mgr->magic = DNS_DISPATCHMGR_MAGIC;
 
+	result = create_default_portset(mctx, &v4portset);
+	if (result == ISC_R_SUCCESS) {
+		result = create_default_portset(mctx, &v6portset);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_dispatchmgr_setavailports(mgr,
+							       v4portset,
+							       v6portset);
+		}
+	}
+	if (v4portset != NULL)
+		isc_portset_destroy(mctx, &v4portset);
+	if (v6portset != NULL)
+		isc_portset_destroy(mctx, &v6portset);
+	if (result != ISC_R_SUCCESS)
+		goto kill_dpool;
+
 	if (entropy != NULL)
 		isc_entropy_attach(entropy, &mgr->entropy);
 
-	dispatch_arc4init(&mgr->arc4ctx);
+	dispatch_arc4init(&mgr->arc4ctx, mgr->entropy, &mgr->arc4_lock);
 
 	*mgrp = mgr;
 	return (ISC_R_SUCCESS);
 
+ kill_dpool:
+	isc_mempool_destroy(&mgr->dpool);
  kill_rpool:
 	isc_mempool_destroy(&mgr->rpool);
  kill_epool:
@@ -1339,22 +1816,88 @@ dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr,
 				 dns_portlist_t *portlist)
 {
 	REQUIRE(VALID_DISPATCHMGR(mgr));
-	if (mgr->portlist != NULL)
-		dns_portlist_detach(&mgr->portlist);
-	if (portlist != NULL)
-		dns_portlist_attach(portlist, &mgr->portlist);
+	UNUSED(portlist);
+
+	/* This function is deprecated: use dns_dispatchmgr_setavailports(). */
+	return;
 }
 
 dns_portlist_t *
 dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr) {
 	REQUIRE(VALID_DISPATCHMGR(mgr));
-	return (mgr->portlist);
+	return (NULL);		/* this function is deprecated */
+}
+
+isc_result_t
+dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
+			      isc_portset_t *v6portset)
+{
+	in_port_t *v4ports, *v6ports, p;
+	unsigned int nv4ports, nv6ports, i4, i6;
+
+	REQUIRE(VALID_DISPATCHMGR(mgr));
+
+	nv4ports = isc_portset_nports(v4portset);
+	nv6ports = isc_portset_nports(v6portset);
+
+	v4ports = NULL;
+	if (nv4ports != 0) {
+		v4ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv4ports);
+		if (v4ports == NULL)
+			return (ISC_R_NOMEMORY);
+	}
+	v6ports = NULL;
+	if (nv6ports != 0) {
+		v6ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv6ports);
+		if (v6ports == NULL) {
+			if (v4ports != NULL) {
+				isc_mem_put(mgr->mctx, v4ports,
+					    sizeof(in_port_t) *
+					    isc_portset_nports(v4portset));
+			}
+			return (ISC_R_NOMEMORY);
+		}
+	}
+
+	p = 0;
+	i4 = 0;
+	i6 = 0;
+	do {
+		if (isc_portset_isset(v4portset, p)) {
+			INSIST(i4 < nv4ports);
+			v4ports[i4++] = p;
+		}
+		if (isc_portset_isset(v6portset, p)) {
+			INSIST(i6 < nv6ports);
+			v6ports[i6++] = p;
+		}
+	} while (p++ < 65535);
+	INSIST(i4 == nv4ports && i6 == nv6ports);
+
+	PORTBUFLOCK(mgr);
+	if (mgr->v4ports != NULL) {
+		isc_mem_put(mgr->mctx, mgr->v4ports,
+			    mgr->nv4ports * sizeof(in_port_t));
+	}
+	mgr->v4ports = v4ports;
+	mgr->nv4ports = nv4ports;
+
+	if (mgr->v6ports != NULL) {
+		isc_mem_put(mgr->mctx, mgr->v6ports,
+			    mgr->nv6ports * sizeof(in_port_t));
+	}
+	mgr->v6ports = v6ports;
+	mgr->nv6ports = nv6ports;
+	PORTBUFUNLOCK(mgr);
+
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
-			unsigned int buffersize, unsigned int maxbuffers,
-			unsigned int buckets, unsigned int increment)
+		       unsigned int buffersize, unsigned int maxbuffers,
+		       unsigned int maxrequests, unsigned int buckets,
+		       unsigned int increment)
 {
 	isc_result_t result;
 
@@ -1381,24 +1924,39 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
 		maxbuffers = 8;
 
 	LOCK(&mgr->buffer_lock);
+
+	/* Create or adjust buffer pool */
 	if (mgr->bpool != NULL) {
 		isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
 		mgr->maxbuffers = maxbuffers;
+	} else {
+		result = isc_mempool_create(mgr->mctx, buffersize, &mgr->bpool);
+		if (result != ISC_R_SUCCESS) {
+			UNLOCK(&mgr->buffer_lock);
+			return (result);
+		}
+		isc_mempool_setname(mgr->bpool, "dispmgr_bpool");
+		isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
+		isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock);
+	}
+
+	/* Create or adjust socket pool */
+	if (mgr->spool != NULL) {
+		isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2);
 		UNLOCK(&mgr->buffer_lock);
 		return (ISC_R_SUCCESS);
 	}
-
-	if (isc_mempool_create(mgr->mctx, buffersize,
-			       &mgr->bpool) != ISC_R_SUCCESS) {
+	result = isc_mempool_create(mgr->mctx, sizeof(dispsocket_t),
+				    &mgr->spool);
+	if (result != ISC_R_SUCCESS) {
 		UNLOCK(&mgr->buffer_lock);
-		return (ISC_R_NOMEMORY);
+		goto cleanup;
 	}
+	isc_mempool_setname(mgr->spool, "dispmgr_spool");
+	isc_mempool_setmaxalloc(mgr->spool, maxrequests);
+	isc_mempool_associatelock(mgr->spool, &mgr->pool_lock);
 
-	isc_mempool_setname(mgr->bpool, "dispmgr_bpool");
-	isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
-	isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock);
-
-	result = qid_allocate(mgr, buckets, increment, &mgr->qid);
+	result = qid_allocate(mgr, buckets, increment, &mgr->qid, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1409,8 +1967,10 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
 
  cleanup:
 	isc_mempool_destroy(&mgr->bpool);
+	if (mgr->spool != NULL)
+		isc_mempool_destroy(&mgr->spool);
 	UNLOCK(&mgr->buffer_lock);
-	return (ISC_R_NOMEMORY);
+	return (result);
 }
 
 void
@@ -1436,30 +1996,56 @@ dns_dispatchmgr_destroy(dns_dispatchmgr_t **mgrp) {
 		destroy_mgr(&mgr);
 }
 
+static int
+port_cmp(const void *key, const void *ent) {
+	in_port_t p1 = *(const in_port_t *)key;
+	in_port_t p2 = *(const in_port_t *)ent;
+
+	if (p1 < p2)
+		return (-1);
+	else if (p1 == p2)
+		return (0);
+	else
+		return (1);
+}
+
 static isc_boolean_t
-blacklisted(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
-	    isc_sockaddr_t *sockaddrp)
+portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
+	      isc_sockaddr_t *sockaddrp)
 {
 	isc_sockaddr_t sockaddr;
 	isc_result_t result;
+	in_port_t *ports, port;
+	unsigned int nports;
+	isc_boolean_t available = ISC_FALSE;
 
 	REQUIRE(sock != NULL || sockaddrp != NULL);
 
-	if (mgr->portlist == NULL)
-		return (ISC_FALSE);
-
+	PORTBUFLOCK(mgr);
 	if (sock != NULL) {
 		sockaddrp = &sockaddr;
 		result = isc_socket_getsockname(sock, sockaddrp);
 		if (result != ISC_R_SUCCESS)
-			return (ISC_FALSE);
+			goto unlock;
 	}
 
-	if (mgr->portlist != NULL &&
-	    dns_portlist_match(mgr->portlist, isc_sockaddr_pf(sockaddrp),
-			       isc_sockaddr_getport(sockaddrp)))
-		return (ISC_TRUE);
-	return (ISC_FALSE);
+	if (isc_sockaddr_pf(sockaddrp) == AF_INET) {
+		ports = mgr->v4ports;
+		nports = mgr->nv4ports;
+	} else {
+		ports = mgr->v6ports;
+		nports = mgr->nv6ports;
+	}
+	if (ports == NULL)
+		goto unlock;
+
+	port = isc_sockaddr_getport(sockaddrp);
+	if (bsearch(&port, ports, nports, sizeof(in_port_t), port_cmp) != NULL)
+		available = ISC_TRUE;
+
+unlock:
+	PORTBUFUNLOCK(mgr);
+	return (available);
 }
 
 #define ATTRMATCH(_a1, _a2, _mask) (((_a1) & (_mask)) == ((_a2) & (_mask)))
@@ -1469,17 +2055,20 @@ local_addr_match(dns_dispatch_t *disp, isc_sockaddr_t *addr) {
 	isc_sockaddr_t sockaddr;
 	isc_result_t result;
 
+	REQUIRE(disp->socket != NULL);
+
 	if (addr == NULL)
 		return (ISC_TRUE);
 
 	/*
-	 * Don't match wildcard ports against newly blacklisted ports.
+	 * Don't match wildcard ports unless the port is available in the
+	 * current configuration.
 	 */
-	if (disp->mgr->portlist != NULL &&
-	    isc_sockaddr_getport(addr) == 0 &&
+	if (isc_sockaddr_getport(addr) == 0 &&
 	    isc_sockaddr_getport(&disp->local) == 0 &&
-	    blacklisted(disp->mgr, disp->socket, NULL))
+	    !portavailable(disp->mgr, disp->socket, NULL)) {
 		return (ISC_FALSE);
+	}
 
 	/*
 	 * Check if we match the binding .
@@ -1521,10 +2110,10 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local,
 	isc_result_t result;
 
 	/*
-	 * Make certain that we will not match a private dispatch.
+	 * Make certain that we will not match a private or exclusive dispatch.
 	 */
-	attributes &= ~DNS_DISPATCHATTR_PRIVATE;
-	mask |= DNS_DISPATCHATTR_PRIVATE;
+	attributes &= ~(DNS_DISPATCHATTR_PRIVATE|DNS_DISPATCHATTR_EXCLUSIVE);
+	mask |= (DNS_DISPATCHATTR_PRIVATE|DNS_DISPATCHATTR_EXCLUSIVE);
 
 	disp = ISC_LIST_HEAD(mgr->list);
 	while (disp != NULL) {
@@ -1551,7 +2140,8 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local,
 
 static isc_result_t
 qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-	     unsigned int increment, dns_qid_t **qidp)
+	     unsigned int increment, dns_qid_t **qidp,
+	     isc_boolean_t needsocktable)
 {
 	dns_qid_t *qid;
 	unsigned int i;
@@ -1572,16 +2162,35 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 		return (ISC_R_NOMEMORY);
 	}
 
+	qid->sock_table = NULL;
+	if (needsocktable) {
+		qid->sock_table = isc_mem_get(mgr->mctx, buckets *
+					      sizeof(dispsocketlist_t));
+		if (qid->sock_table == NULL) {
+			isc_mem_put(mgr->mctx, qid, sizeof(*qid));
+			isc_mem_put(mgr->mctx, qid->qid_table,
+				    buckets * sizeof(dns_displist_t));
+			return (ISC_R_NOMEMORY);
+		}
+	}
+
 	if (isc_mutex_init(&qid->lock) != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_mutex_init failed");
+		if (qid->sock_table != NULL) {
+			isc_mem_put(mgr->mctx, qid->sock_table,
+				    buckets * sizeof(dispsocketlist_t));
+		}
 		isc_mem_put(mgr->mctx, qid->qid_table,
 			    buckets * sizeof(dns_displist_t));
 		isc_mem_put(mgr->mctx, qid, sizeof(*qid));
 		return (ISC_R_UNEXPECTED);
 	}
 
-	for (i = 0; i < buckets; i++)
+	for (i = 0; i < buckets; i++) {
 		ISC_LIST_INIT(qid->qid_table[i]);
+		if (qid->sock_table != NULL)
+			ISC_LIST_INIT(qid->sock_table[i]);
+	}
 
 	qid->qid_nbuckets = buckets;
 	qid->qid_increment = increment;
@@ -1603,6 +2212,10 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) {
 	qid->magic = 0;
 	isc_mem_put(mctx, qid->qid_table,
 		    qid->qid_nbuckets * sizeof(dns_displist_t));
+	if (qid->sock_table != NULL) {
+		isc_mem_put(mctx, qid->sock_table,
+			    qid->qid_nbuckets * sizeof(dispsocketlist_t));
+	}
 	DESTROYLOCK(&qid->lock);
 	isc_mem_put(mctx, qid, sizeof(*qid));
 }
@@ -1646,6 +2259,10 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
 	disp->requests = 0;
 	disp->tcpbuffers = 0;
 	disp->qid = NULL;
+	ISC_LIST_INIT(disp->activesockets);
+	ISC_LIST_INIT(disp->inactivesockets);
+	disp->nsockets = 0;
+	dispatch_arc4init(&disp->arc4ctx, mgr->entropy, NULL);
 
 	if (isc_mutex_init(&disp->lock) != ISC_R_SUCCESS) {
 		res = ISC_R_UNEXPECTED;
@@ -1700,6 +2317,8 @@ dispatch_free(dns_dispatch_t **dispp)
 	INSIST(disp->tcpbuffers == 0);
 	INSIST(disp->requests == 0);
 	INSIST(disp->recv_pending == 0);
+	INSIST(ISC_LIST_EMPTY(disp->activesockets));
+	INSIST(ISC_LIST_EMPTY(disp->inactivesockets));
 
 	isc_mempool_put(mgr->epool, disp->failsafe_ev);
 	disp->failsafe_ev = NULL;
@@ -1745,7 +2364,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 		return (result);
 	}
 
-	result = qid_allocate(mgr, buckets, increment, &disp->qid);
+	result = qid_allocate(mgr, buckets, increment, &disp->qid, ISC_FALSE);
 	if (result != ISC_R_SUCCESS)
 		goto deallocate_dispatch;
 
@@ -1753,8 +2372,9 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 	disp->socket = NULL;
 	isc_socket_attach(sock, &disp->socket);
 
-	disp->task = NULL;
-	result = isc_task_create(taskmgr, 0, &disp->task);
+	disp->ntasks = 1;
+	disp->task[0] = NULL;
+	result = isc_task_create(taskmgr, 0, &disp->task[0]);
 	if (result != ISC_R_SUCCESS)
 		goto kill_socket;
 
@@ -1767,7 +2387,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 		goto kill_task;
 	}
 
-	isc_task_setname(disp->task, "tcpdispatch", disp);
+	isc_task_setname(disp->task[0], "tcpdispatch", disp);
 
 	dns_tcpmsg_init(mgr->mctx, disp->socket, &disp->tcpmsg);
 	disp->tcpmsg_valid = 1;
@@ -1781,7 +2401,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 	UNLOCK(&mgr->lock);
 
 	mgr_log(mgr, LVL(90), "created TCP dispatcher %p", disp);
-	dispatch_log(disp, LVL(90), "created task %p", disp->task);
+	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]);
 
 	*dispp = disp;
 
@@ -1791,7 +2411,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 	 * Error returns.
 	 */
  kill_task:
-	isc_task_detach(&disp->task);
+	isc_task_detach(&disp->task[0]);
  kill_socket:
 	isc_socket_detach(&disp->socket);
  deallocate_dispatch:
@@ -1826,13 +2446,13 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	REQUIRE((attributes & DNS_DISPATCHATTR_TCP) == 0);
 
 	result = dns_dispatchmgr_setudp(mgr, buffersize, maxbuffers,
-					buckets, increment);
+					maxrequests, buckets, increment);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
 	LOCK(&mgr->lock);
 
-	if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) {
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
 		REQUIRE(isc_sockaddr_getport(localaddr) == 0);
 		goto createudp;
 	}
@@ -1853,7 +2473,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		{
 			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
 			if (disp->recv_pending != 0)
-				isc_socket_cancel(disp->socket, disp->task,
+				isc_socket_cancel(disp->socket, disp->task[0],
 						  ISC_SOCKCANCEL_RECV);
 		}
 
@@ -1889,6 +2509,101 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 #define DNS_DISPATCH_HELD 20U
 #endif
 
+static isc_result_t
+get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
+	      isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr,
+	      isc_socket_t **sockp)
+{
+	unsigned int i, j;
+	isc_socket_t *held[DNS_DISPATCH_HELD];
+	isc_sockaddr_t localaddr_bound;
+	isc_socket_t *sock = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_boolean_t anyport;
+
+	INSIST(sockp != NULL && *sockp == NULL);
+
+	localaddr_bound = *localaddr;
+	anyport = ISC_TF(isc_sockaddr_getport(localaddr) == 0);
+
+	if (anyport) {
+		unsigned int nports;
+		in_port_t *ports;
+
+		/*
+		 * If no port is specified, we first try to pick up a random
+		 * port by ourselves.
+		 */
+		if (isc_sockaddr_pf(&disp->local) == AF_INET) {
+			nports = disp->mgr->nv4ports;
+			ports = disp->mgr->v4ports;
+		} else {
+			nports = disp->mgr->nv6ports;
+			ports = disp->mgr->v6ports;
+		}
+		if (nports == 0)
+			return (ISC_R_ADDRNOTAVAIL);
+
+		for (i = 0; i < 1024; i++) {
+			in_port_t prt;
+
+			prt = ports[dispatch_arc4uniformrandom(
+					DISP_ARC4CTX(disp),
+					nports)];
+			isc_sockaddr_setport(&localaddr_bound, prt);
+			result = open_socket(sockmgr, &localaddr_bound,
+					     0, &sock);
+			if (result == ISC_R_SUCCESS ||
+			    result != ISC_R_ADDRINUSE) {
+				disp->localport = prt;
+				*sockp = sock;
+				return (result);
+			}
+		}
+
+		/*
+		 * If this fails 1024 times, we then ask the kernel for
+		 * choosing one.
+		 */
+	}
+
+	memset(held, 0, sizeof(held));
+	i = 0;
+
+	for (j = 0; j < 0xffffU; j++) {
+		result = open_socket(sockmgr, localaddr, 0, &sock);
+		if (result != ISC_R_SUCCESS)
+			goto end;
+		else if (!anyport)
+			break;
+		else if (portavailable(mgr, sock, NULL))
+			break;
+		if (held[i] != NULL)
+			isc_socket_detach(&held[i]);
+		held[i++] = sock;
+		sock = NULL;
+		if (i == DNS_DISPATCH_HELD)
+			i = 0;
+	}
+	if (j == 0xffffU) {
+		mgr_log(mgr, ISC_LOG_ERROR,
+			"avoid-v%s-udp-ports: unable to allocate "
+			"an available port",
+			isc_sockaddr_pf(localaddr) == AF_INET ? "4" : "6");
+		result = ISC_R_FAILURE;
+		goto end;
+	}
+	*sockp = sock;
+
+end:
+	for (i = 0; i < DNS_DISPATCH_HELD; i++) {
+		if (held[i] != NULL)
+			isc_socket_detach(&held[i]);
+	}
+
+	return (result);
+}
+
 static isc_result_t
 dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		   isc_taskmgr_t *taskmgr,
@@ -1900,10 +2615,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	isc_result_t result;
 	dns_dispatch_t *disp;
 	isc_socket_t *sock = NULL;
-	isc_socket_t *held[DNS_DISPATCH_HELD];
-	unsigned int i = 0, j = 0, k = 0;
-	isc_sockaddr_t localaddr_bound;
-	in_port_t localport = 0;
+	int i = 0;
 
 	/*
 	 * dispatch_allocate() checks mgr for us.
@@ -1913,67 +2625,46 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	/*
-	 * Try to allocate a socket that is not on the blacklist.
-	 * Hold up to DNS_DISPATCH_HELD sockets to prevent the OS
-	 * from returning the same port to us too quickly.
-	 */
-	memset(held, 0, sizeof(held));
-	localaddr_bound = *localaddr;
- getsocket:
-	if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) {
-		in_port_t prt;
-
-		/* XXX: should the range be configurable? */
-		prt = 1024 + dispatch_arc4uniformrandom(mgr, 65535 - 1023);
-		isc_sockaddr_setport(&localaddr_bound, prt);
-		if (blacklisted(mgr, NULL, &localaddr_bound)) {
-			if (++k == 1024)
-				attributes &= ~DNS_DISPATCHATTR_RANDOMPORT;
-			goto getsocket;
-		}
-		result = create_socket(sockmgr, &localaddr_bound, 0, &sock);
-		if (result == ISC_R_ADDRINUSE) {
-			if (++k == 1024)
-				attributes &= ~DNS_DISPATCHATTR_RANDOMPORT;
-			goto getsocket;
-		}
-		localport = prt;
-	} else
-		result = create_socket(sockmgr, localaddr,
-				       ISC_SOCKET_REUSEADDRESS, &sock);
-	if (result != ISC_R_SUCCESS)
-		goto deallocate_dispatch;
-	if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) == 0 &&
-	    isc_sockaddr_getport(localaddr) == 0 &&
-	    blacklisted(mgr, sock, NULL))
-	{
-		if (held[i] != NULL)
-			isc_socket_detach(&held[i]);
-		held[i++] = sock;
-		sock = NULL;
-		if (i == DNS_DISPATCH_HELD)
-			i = 0;
-		if (j++ == 0xffffU) {
-			mgr_log(mgr, ISC_LOG_ERROR, "avoid-v%s-udp-ports: "
-				"unable to allocate a non-blacklisted port",
-				isc_sockaddr_pf(localaddr) == AF_INET ?
-					"4" : "6");
-			result = ISC_R_FAILURE;
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
+		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock);
+		if (result != ISC_R_SUCCESS)
 			goto deallocate_dispatch;
+	} else {
+		isc_sockaddr_t sa_any;
+
+		/*
+		 * For dispatches using exclusive sockets with a specific
+		 * source address, we only check if the specified address is
+		 * available on the system.  Query sockets will be created later
+		 * on demand.
+		 */
+		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
+		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
+			result = open_socket(sockmgr, localaddr, 0, &sock);
+			if (sock != NULL)
+				isc_socket_detach(&sock);
+			if (result != ISC_R_SUCCESS)
+				goto deallocate_dispatch;
 		}
-		goto getsocket;
 	}
-
 	disp->socktype = isc_sockettype_udp;
 	disp->socket = sock;
 	disp->local = *localaddr;
-	disp->localport = localport;
 
-	disp->task = NULL;
-	result = isc_task_create(taskmgr, 0, &disp->task);
-	if (result != ISC_R_SUCCESS)
-		goto kill_socket;
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+		disp->ntasks = MAX_INTERNAL_TASKS;
+	else
+		disp->ntasks = 1;
+	for (i = 0; i < disp->ntasks; i++) {
+		disp->task[i] = NULL;
+		result = isc_task_create(taskmgr, 0, &disp->task[i]);
+		if (result != ISC_R_SUCCESS) {
+			while (--i >= 0)
+				isc_task_destroy(&disp->task[i]);
+			goto kill_socket;
+		}
+		isc_task_setname(disp->task[i], "udpdispatch", disp);
+	}
 
 	disp->ctlevent = isc_event_allocate(mgr->mctx, disp,
 					    DNS_EVENT_DISPATCHCONTROL,
@@ -1984,8 +2675,6 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		goto kill_task;
 	}
 
-	isc_task_setname(disp->task, "udpdispatch", disp);
-
 	attributes &= ~DNS_DISPATCHATTR_TCP;
 	attributes |= DNS_DISPATCHATTR_UDP;
 	disp->attributes = attributes;
@@ -1996,26 +2685,25 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	ISC_LIST_APPEND(mgr->list, disp, link);
 
 	mgr_log(mgr, LVL(90), "created UDP dispatcher %p", disp);
-	dispatch_log(disp, LVL(90), "created task %p", disp->task);
-	dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
+	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]); /* XXX */
+	if (disp->socket != NULL)
+		dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
 
 	*dispp = disp;
-
-	goto cleanheld;
+	return (result);
 
 	/*
 	 * Error returns.
 	 */
  kill_task:
-	isc_task_detach(&disp->task);
+	for (i = 0; i < disp->ntasks; i++)
+		isc_task_detach(&disp->task[i]);
  kill_socket:
-	isc_socket_detach(&disp->socket);
+	if (disp->socket != NULL)
+		isc_socket_detach(&disp->socket);
  deallocate_dispatch:
 	dispatch_free(&disp);
- cleanheld:
-	for (i = 0; i < DNS_DISPATCH_HELD; i++)
-		if (held[i] != NULL)
-			isc_socket_detach(&held[i]);
+
 	return (result);
 }
 
@@ -2041,6 +2729,7 @@ dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp) {
 void
 dns_dispatch_detach(dns_dispatch_t **dispp) {
 	dns_dispatch_t *disp;
+	dispsocket_t *dispsock;
 	isc_boolean_t killit;
 
 	REQUIRE(dispp != NULL && VALID_DISPATCH(*dispp));
@@ -2055,8 +2744,14 @@ dns_dispatch_detach(dns_dispatch_t **dispp) {
 	killit = ISC_FALSE;
 	if (disp->refcount == 0) {
 		if (disp->recv_pending > 0)
-			isc_socket_cancel(disp->socket, disp->task,
+			isc_socket_cancel(disp->socket, disp->task[0],
+					  ISC_SOCKCANCEL_RECV);
+		for (dispsock = ISC_LIST_HEAD(disp->activesockets);
+		     dispsock != NULL;
+		     dispsock = ISC_LIST_NEXT(dispsock, link)) {
+			isc_socket_cancel(dispsock->socket, dispsock->task,
 					  ISC_SOCKCANCEL_RECV);
+		}
 		disp->shutting_down = 1;
 	}
 
@@ -2065,26 +2760,32 @@ dns_dispatch_detach(dns_dispatch_t **dispp) {
 	killit = destroy_disp_ok(disp);
 	UNLOCK(&disp->lock);
 	if (killit)
-		isc_task_send(disp->task, &disp->ctlevent);
+		isc_task_send(disp->task[0], &disp->ctlevent);
 }
 
 isc_result_t
-dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
-			 isc_task_t *task, isc_taskaction_t action, void *arg,
-			 dns_messageid_t *idp, dns_dispentry_t **resp)
+dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+			  isc_task_t *task, isc_taskaction_t action, void *arg,
+			  dns_messageid_t *idp, dns_dispentry_t **resp,
+			  isc_socketmgr_t *sockmgr)
 {
 	dns_dispentry_t *res;
 	unsigned int bucket;
+	in_port_t localport = 0;
 	dns_messageid_t id;
 	int i;
 	isc_boolean_t ok;
 	dns_qid_t *qid;
+	dispsocket_t *dispsocket = NULL;
+	isc_result_t result;
 
 	REQUIRE(VALID_DISPATCH(disp));
 	REQUIRE(task != NULL);
 	REQUIRE(dest != NULL);
 	REQUIRE(resp != NULL && *resp == NULL);
 	REQUIRE(idp != NULL);
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+		REQUIRE(sockmgr != NULL);
 
 	LOCK(&disp->lock);
 
@@ -2098,23 +2799,75 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 		return (ISC_R_QUOTA);
 	}
 
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
+	    disp->nsockets > DNS_DISPATCH_SOCKSQUOTA) {
+		dispsocket_t *oldestsocket;
+		dns_dispentry_t *oldestresp;
+		dns_dispatchevent_t *rev;
+
+		/*
+		 * Kill oldest outstanding query if the number of sockets
+		 * exceeds the quota to keep the room for new queries.
+		 */
+		oldestsocket = ISC_LIST_HEAD(disp->activesockets);
+		oldestresp = oldestsocket->resp;
+		if (oldestresp != NULL && !oldestresp->item_out) {
+			rev = allocate_event(oldestresp->disp);
+			if (rev != NULL) {
+				rev->buffer.base = NULL;
+				rev->result = ISC_R_CANCELED;
+				rev->id = oldestresp->id;
+				ISC_EVENT_INIT(rev, sizeof(*rev), 0,
+					       NULL, DNS_EVENT_DISPATCH,
+					       oldestresp->action,
+					       oldestresp->arg, oldestresp,
+					       NULL, NULL);
+				oldestresp->item_out = ISC_TRUE;
+				isc_task_send(oldestresp->task,
+					      ISC_EVENT_PTR(&rev));
+			}
+		}
+
+		/*
+		 * Move this entry to the tail so that it won't (easily) be
+		 * examined before actually being canceled.
+		 */
+		ISC_LIST_UNLINK(disp->activesockets, oldestsocket, link);
+		ISC_LIST_APPEND(disp->activesockets, oldestsocket, link);
+	}
+
+	qid = DNS_QID(disp);
+	LOCK(&qid->lock);
+
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+		/*
+		 * Get a separate UDP socket with a random port number.
+		 */
+		result = get_dispsocket(disp, dest, sockmgr, qid, &dispsocket,
+					&localport);
+		if (result != ISC_R_SUCCESS) {
+			UNLOCK(&qid->lock);
+			UNLOCK(&disp->lock);
+			return (result);
+		}
+	} else {
+		localport = disp->localport;
+	}
+
 	/*
 	 * Try somewhat hard to find an unique ID.
 	 */
-	id = (dns_messageid_t)dispatch_arc4random(disp->mgr);
-	qid = DNS_QID(disp);
-	LOCK(&qid->lock);
-	bucket = dns_hash(qid, dest, id, disp->localport);
+	id = (dns_messageid_t)dispatch_arc4random(DISP_ARC4CTX(disp));
+	bucket = dns_hash(qid, dest, id, localport);
 	ok = ISC_FALSE;
 	for (i = 0; i < 64; i++) {
-		if (bucket_search(qid, dest, id, disp->localport, bucket) ==
-		    NULL) {
+		if (entry_search(qid, dest, id, localport, bucket) == NULL) {
 			ok = ISC_TRUE;
 			break;
 		}
 		id += qid->qid_increment;
 		id &= 0x0000ffff;
-		bucket = dns_hash(qid, dest, id, disp->localport);
+		bucket = dns_hash(qid, dest, id, localport);
 	}
 
 	if (!ok) {
@@ -2127,6 +2880,8 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 	if (res == NULL) {
 		UNLOCK(&qid->lock);
 		UNLOCK(&disp->lock);
+		if (dispsocket != NULL)
+			destroy_dispsocket(disp, &dispsocket);
 		return (ISC_R_NOMEMORY);
 	}
 
@@ -2136,11 +2891,14 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 	isc_task_attach(task, &res->task);
 	res->disp = disp;
 	res->id = id;
-	res->port = disp->localport;
+	res->port = localport;
 	res->bucket = bucket;
 	res->host = *dest;
 	res->action = action;
 	res->arg = arg;
+	res->dispsocket = dispsocket;
+	if (dispsocket != NULL)
+		dispsocket->resp = res;
 	res->item_out = ISC_FALSE;
 	ISC_LIST_INIT(res->items);
 	ISC_LINK_INIT(res, link);
@@ -2152,27 +2910,62 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 		    "attached to task %p", res->task);
 
 	if (((disp->attributes & DNS_DISPATCHATTR_UDP) != 0) ||
-	    ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0))
-		startrecv(disp);
+	    ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0)) {
+		result = startrecv(disp, dispsocket);
+		if (result != ISC_R_SUCCESS) {
+			LOCK(&qid->lock);
+			ISC_LIST_UNLINK(qid->qid_table[bucket], res, link);
+			UNLOCK(&qid->lock);
+
+			if (dispsocket != NULL)
+				destroy_dispsocket(disp, &dispsocket);
+
+			disp->refcount--;
+			disp->requests--;
+
+			UNLOCK(&disp->lock);
+			isc_task_detach(&res->task);
+			isc_mempool_put(disp->mgr->rpool, res);
+			return (result);
+		}
+	}
+
+	if (dispsocket != NULL)
+		ISC_LIST_APPEND(disp->activesockets, dispsocket, link);
 
 	UNLOCK(&disp->lock);
 
 	*idp = id;
 	*resp = res;
 
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+		INSIST(res->dispsocket != NULL);
+
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+			 isc_task_t *task, isc_taskaction_t action, void *arg,
+			 dns_messageid_t *idp, dns_dispentry_t **resp)
+{
+	REQUIRE(VALID_DISPATCH(disp));
+	REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0);
+
+	return (dns_dispatch_addresponse2(disp, dest, task, action, arg,
+					  idp, resp, NULL));
+}
+
 void
 dns_dispatch_starttcp(dns_dispatch_t *disp) {
 
 	REQUIRE(VALID_DISPATCH(disp));
 
-	dispatch_log(disp, LVL(90), "starttcp %p", disp->task);
+	dispatch_log(disp, LVL(90), "starttcp %p", disp->task[0]);
 
 	LOCK(&disp->lock);
 	disp->attributes |= DNS_DISPATCHATTR_CONNECTED;
-	startrecv(disp);
+	(void)startrecv(disp, NULL);
 	UNLOCK(&disp->lock);
 }
 
@@ -2183,6 +2976,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	dns_dispatchmgr_t *mgr;
 	dns_dispatch_t *disp;
 	dns_dispentry_t *res;
+	dispsocket_t *dispsock;
 	dns_dispatchevent_t *ev;
 	unsigned int bucket;
 	isc_boolean_t killit;
@@ -2220,8 +3014,14 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	killit = ISC_FALSE;
 	if (disp->refcount == 0) {
 		if (disp->recv_pending > 0)
-			isc_socket_cancel(disp->socket, disp->task,
+			isc_socket_cancel(disp->socket, disp->task[0],
+					  ISC_SOCKCANCEL_RECV);
+		for (dispsock = ISC_LIST_HEAD(disp->activesockets);
+		     dispsock != NULL;
+		     dispsock = ISC_LIST_NEXT(dispsock, link)) {
+			isc_socket_cancel(dispsock->socket, dispsock->task,
 					  ISC_SOCKCANCEL_RECV);
+		}
 		disp->shutting_down = 1;
 	}
 
@@ -2257,6 +3057,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	request_log(disp, res, LVL(90), "detaching from task %p", res->task);
 	isc_task_detach(&res->task);
 
+	if (res->dispsocket != NULL) {
+		isc_socket_cancel(res->dispsocket->socket,
+				  res->dispsocket->task, ISC_SOCKCANCEL_RECV);
+		res->dispsocket->resp = NULL;
+	}
+
 	/*
 	 * Free any buffered requests as well
 	 */
@@ -2273,12 +3079,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	if (disp->shutting_down == 1)
 		do_cancel(disp);
 	else
-		startrecv(disp);
+		(void)startrecv(disp, NULL);
 
 	killit = destroy_disp_ok(disp);
 	UNLOCK(&disp->lock);
 	if (killit)
-		isc_task_send(disp->task, &disp->ctlevent);
+		isc_task_send(disp->task[0], &disp->ctlevent);
 }
 
 static void
@@ -2293,13 +3099,15 @@ do_cancel(dns_dispatch_t *disp) {
 	qid = DNS_QID(disp);
 
 	/*
-	 * Search for the first response handler without packets outstanding.
+	 * Search for the first response handler without packets outstanding
+	 * unless a specific hander is given.
 	 */
 	LOCK(&qid->lock);
 	for (resp = linear_first(qid);
-	     resp != NULL && resp->item_out != ISC_FALSE;
+	     resp != NULL && resp->item_out;
 	     /* Empty. */)
 		resp = linear_next(qid, resp);
+
 	/*
 	 * No one to send the cancel event to, so nothing to do.
 	 */
@@ -2332,6 +3140,16 @@ dns_dispatch_getsocket(dns_dispatch_t *disp) {
 	return (disp->socket);
 }
 
+isc_socket_t *
+dns_dispatch_getentrysocket(dns_dispentry_t *resp) {
+	REQUIRE(VALID_RESPONSE(resp));
+
+	if (resp->dispsocket != NULL)
+		return (resp->dispsocket->socket);
+	else
+		return (NULL);
+}
+
 isc_result_t
 dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp) {
 
@@ -2365,11 +3183,27 @@ dns_dispatch_cancel(dns_dispatch_t *disp) {
 	return;
 }
 
+unsigned int
+dns_dispatch_getattributes(dns_dispatch_t *disp) {
+	REQUIRE(VALID_DISPATCH(disp));
+
+	/*
+	 * We don't bother locking disp here; it's the caller's responsibility
+	 * to use only non volatile flags.
+	 */
+	return (disp->attributes);
+}
+
 void
 dns_dispatch_changeattributes(dns_dispatch_t *disp,
 			      unsigned int attributes, unsigned int mask)
 {
 	REQUIRE(VALID_DISPATCH(disp));
+	/* Exclusive attribute can only be set on creation */
+	REQUIRE((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0);
+	/* Also, a dispatch with randomport specified cannot start listening */
+	REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0 ||
+		(attributes & DNS_DISPATCHATTR_NOLISTEN) == 0);
 
 	/* XXXMLG
 	 * Should check for valid attributes here!
@@ -2381,13 +3215,13 @@ dns_dispatch_changeattributes(dns_dispatch_t *disp,
 		if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0 &&
 		    (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) {
 			disp->attributes &= ~DNS_DISPATCHATTR_NOLISTEN;
-			startrecv(disp);
+			(void)startrecv(disp, NULL);
 		} else if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN)
 			   == 0 &&
 			   (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) {
 			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
 			if (disp->recv_pending != 0)
-				isc_socket_cancel(disp->socket, disp->task,
+				isc_socket_cancel(disp->socket, disp->task[0],
 						  ISC_SOCKCANCEL_RECV);
 		}
 	}
@@ -2411,7 +3245,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	INSIST(sevent->n <= disp->mgr->buffersize);
 	newsevent = (isc_socketevent_t *)
 		    isc_event_allocate(disp->mgr->mctx, NULL,
-				      DNS_EVENT_IMPORTRECVDONE, udp_recv,
+				      DNS_EVENT_IMPORTRECVDONE, udp_shrecv,
 				      disp, sizeof(isc_socketevent_t));
 	if (newsevent == NULL)
 		return;
@@ -2431,7 +3265,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	newsevent->pktinfo = sevent->pktinfo;
 	newsevent->attributes = sevent->attributes;
 
-	isc_task_send(disp->task, ISC_EVENT_PTR(&newsevent));
+	isc_task_send(disp->task[0], ISC_EVENT_PTR(&newsevent));
 }
 
 #if 0
diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
index e3495aaa361f2..041e2b6acb012 100644
--- a/lib/dns/include/dns/dispatch.h
+++ b/lib/dns/include/dns/dispatch.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.h,v 1.45.2.2.4.5.4.2 2008/07/23 07:28:11 tbox Exp $ */
+/* $Id: dispatch.h,v 1.45.2.2.4.9 2008/06/25 23:45:37 tbox Exp $ */
 
 #ifndef DNS_DISPATCH_H
 #define DNS_DISPATCH_H 1
@@ -104,7 +104,7 @@ struct dns_dispatchevent {
  *	The dispatcher is a TCP or UDP socket.
  *
  * _IPV4, _IPV6
- *	The dispatcher uses an ipv4 or ipv6 socket.
+ *	The dispatcher uses an IPv4 or IPv6 socket.
  *
  * _NOLISTEN
  *	The dispatcher should not listen on the socket.
@@ -114,7 +114,12 @@ struct dns_dispatchevent {
  *	accept replies from them.
  *
  * _RANDOMPORT
- *	Allocate UDP port randomly.
+ *	Previously used to indicate that the port of a dispatch UDP must be
+ *	chosen randomly.  This behavior now always applies and the attribute
+ *	is obsoleted.
+ *
+ * _EXCLUSIVE
+ *	A separate socket will be used on-demand for each transaction.
  */
 #define DNS_DISPATCHATTR_PRIVATE	0x00000001U
 #define DNS_DISPATCHATTR_TCP		0x00000002U
@@ -124,7 +129,8 @@ struct dns_dispatchevent {
 #define DNS_DISPATCHATTR_NOLISTEN	0x00000020U
 #define DNS_DISPATCHATTR_MAKEQUERY	0x00000040U
 #define DNS_DISPATCHATTR_CONNECTED	0x00000080U
-#define DNS_DISPATCHATTR_RANDOMPORT	0x00000100U
+/*#define DNS_DISPATCHATTR_RANDOMPORT	0x00000100U*/
+#define DNS_DISPATCHATTR_EXCLUSIVE	0x00000200U
 
 isc_result_t
 dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
@@ -187,24 +193,32 @@ void
 dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr,
 				 dns_portlist_t *portlist);
 /*
- * Sets a list of UDP ports that won't be used when creating a udp
- * dispatch with a wildcard port.
+ * This function is deprecated.  Use dns_dispatchmgr_setavailports() instead.
  *
  * Requires:
  *	mgr is a valid dispatchmgr
- *	portlist to be NULL or a valid port list.
  */
 
 dns_portlist_t *
 dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr);
 /*
- * Return the current port list.
+ * This function is deprecated and always returns NULL.
  *
  * Requires:
  *	mgr is a valid dispatchmgr
  */
 
-
+isc_result_t
+dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
+			      isc_portset_t *v6portset);
+/*
+ * Sets a list of UDP ports that can be used for outgoing UDP messages.
+ *
+ * Requires:
+ *	mgr is a valid dispatchmgr
+ *	v4portset is NULL or a valid port set
+ *	v6portset is NULL or a valid port set
+ */
 
 isc_result_t
 dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
@@ -316,6 +330,12 @@ dns_dispatch_starttcp(dns_dispatch_t *disp);
  *	'disp' is valid.
  */
 
+isc_result_t
+dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+			  isc_task_t *task, isc_taskaction_t action, void *arg,
+			  isc_uint16_t *idp, dns_dispentry_t **resp,
+			  isc_socketmgr_t *sockmgr);
+
 isc_result_t
 dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 			 isc_task_t *task, isc_taskaction_t action, void *arg,
@@ -339,6 +359,10 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
  *
  *	"resp" be non-NULL and *resp be NULL
  *
+ *\li	"sockmgr" be NULL or a valid socket manager.  If 'disp' has
+ *	the DNS_DISPATCHATTR_EXCLUSIVE attribute, this must not be NULL,
+ *	which also means dns_dispatch_addresponse() cannot be used.
+ *
  * Ensures:
  *
  *	 is a unique tuple.  That means incoming messages
@@ -369,6 +393,8 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
  * 	argument to dns_dispatch_addresponse() when allocating '*resp'.
  */
 
+isc_socket_t *
+dns_dispatch_getentrysocket(dns_dispentry_t *resp);
 
 isc_socket_t *
 dns_dispatch_getsocket(dns_dispatch_t *disp);
@@ -406,6 +432,16 @@ dns_dispatch_cancel(dns_dispatch_t *disp);
  *	disp is valid.
  */
 
+unsigned int
+dns_dispatch_getattributes(dns_dispatch_t *disp);
+/*
+ * Return the attributes (DNS_DISPATCHATTR_xxx) of this dispatch.  Only the
+ * non-changeable attributes are expected to be referenced by the caller.
+ *
+ * Requires:
+ *\li	disp is valid.
+ */
+
 void
 dns_dispatch_changeattributes(dns_dispatch_t *disp,
 			      unsigned int attributes, unsigned int mask);
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index b7e81f7ccec79..910e01ed44bd1 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.c,v 1.77.2.1.10.22 2007/09/07 05:25:37 marka Exp $ */
+/* $Id: journal.c,v 1.77.2.1.10.24 2008/09/25 04:01:06 tbox Exp $ */
 
 #include 
 
@@ -71,7 +71,7 @@ static isc_boolean_t bind8_compat = ISC_TRUE; /* XXX config */
 	} while (0)
 
 #define CHECK(op) \
-     	do { result = (op); 					\
+	do { result = (op); 					\
 		if (result != ISC_R_SUCCESS) goto failure; 	\
 	} while (0)
 
@@ -113,11 +113,11 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 	dns_rdataset_init(&rdataset);
 	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_soa, 0,
 				     (isc_stdtime_t)0, &rdataset, NULL);
- 	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS)
 		goto freenode;
 
 	result = dns_rdataset_first(&rdataset);
- 	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS)
 		goto freenode;
 
 	dns_rdataset_current(&rdataset, &rdata);
@@ -680,7 +680,7 @@ dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write,
 	int namelen;
 	char backup[1024];
 	size_t n;
-	
+
 	result = journal_open(mctx, filename, write, write, journalp);
 	if (result == ISC_R_NOTFOUND) {
 		namelen = strlen(filename);
@@ -1372,7 +1372,7 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) {
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "journal open failure: %s: %s",
-			      isc_result_totext(result), j->filename);
+			      isc_result_totext(result), filename);
 		return (result);
 	}
 
@@ -1410,9 +1410,9 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) {
 		if (n_soa == 3)
 			n_soa = 1;
 		if (n_soa == 0) {
-		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
-					 "%s: journal file corrupt: missing "
-					 "initial SOA", j->filename);
+			isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
+				      "%s: journal file corrupt: missing "
+				      "initial SOA", j->filename);
 			FAIL(ISC_R_UNEXPECTED);
 		}
 		CHECK(dns_difftuple_create(diff.mctx, n_soa == 1 ?
@@ -1988,7 +1988,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 		dns_journal_destroy(&j);
 		return (ISC_R_SUCCESS);
 	}
-		
+
 	if (DNS_SERIAL_GT(j->header.begin.serial, serial) ||
 	    DNS_SERIAL_GT(serial, j->header.end.serial)) {
 		dns_journal_destroy(&j);
@@ -2012,7 +2012,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 	}
 
 	CHECK(journal_open(mctx, newname, ISC_TRUE, ISC_TRUE, &new));
-	
+
 	/*
 	 * Remove overhead so space test below can succeed.
 	 */
@@ -2070,7 +2070,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 			result = ISC_R_NOMEMORY;
 			goto failure;
 		}
-	
+
 		CHECK(journal_seek(j, best_guess.offset));
 		CHECK(journal_seek(new, indexend));
 		for (i = 0; i < copy_length; i += size) {
@@ -2143,7 +2143,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 			goto failure;
 		}
 	}
-		
+
 	dns_journal_destroy(&j);
 	result = ISC_R_SUCCESS;
 
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 0f4716d583d97..ed0834ac574da 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.c,v 1.56.2.5.2.15 2006/03/10 00:17:21 marka Exp $ */
+/* $Id: masterdump.c,v 1.56.2.5.2.17 2008/08/13 23:45:33 tbox Exp $ */
 
 #include 
 
@@ -173,7 +173,7 @@ struct dns_dumpctx {
 	char 			*tmpfile;
 };
 
-#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) 
+#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
 
 /*
  * Output tabs and spaces to go from column '*current' to
@@ -920,13 +920,13 @@ dns_dumpctx_detach(dns_dumpctx_t **dctxp) {
 
 dns_dbversion_t *
 dns_dumpctx_version(dns_dumpctx_t *dctx) {
-        REQUIRE(DNS_DCTX_VALID(dctx));
+	REQUIRE(DNS_DCTX_VALID(dctx));
 	return (dctx->version);
 }
 
 dns_db_t *
 dns_dumpctx_db(dns_dumpctx_t *dctx) {
-        REQUIRE(DNS_DCTX_VALID(dctx));
+	REQUIRE(DNS_DCTX_VALID(dctx));
 	return (dctx->db);
 }
 
@@ -1159,13 +1159,12 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 		result = dns_dbiterator_next(dctx->dbiter);
 	}
 
-	if (dctx->nodes != 0 && result == ISC_R_SUCCESS) {
-		result = dns_dbiterator_pause(dctx->dbiter);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	if (dctx->nodes != 0 && result == ISC_R_SUCCESS)
 		result = DNS_R_CONTINUE;
-	} else if (result == ISC_R_NOMORE)
+	else if (result == ISC_R_NOMORE)
 		result = ISC_R_SUCCESS;
  fail:
+	RUNTIME_CHECK(dns_dbiterator_pause(dctx->dbiter) == ISC_R_SUCCESS);
 	isc_mem_put(dctx->mctx, buffer.base, buffer.length);
 	return (result);
 }
@@ -1419,10 +1418,10 @@ dns_master_dumpnode(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 
 isc_result_t
 dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags,
-                       unsigned int ttl_column, unsigned int class_column,
-                       unsigned int type_column, unsigned int rdata_column,
-                       unsigned int line_length, unsigned int tab_width,
-                       isc_mem_t *mctx)
+		       unsigned int ttl_column, unsigned int class_column,
+		       unsigned int type_column, unsigned int rdata_column,
+		       unsigned int line_length, unsigned int tab_width,
+		       isc_mem_t *mctx)
 {
 	dns_master_style_t *style;
 
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 915f587871542..5eacad02f9284 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.194.2.10.2.28.4.2 2008/07/28 23:47:49 tbox Exp $ */
+/* $Id: message.c,v 1.194.2.10.2.30 2008/07/28 23:45:48 tbox Exp $ */
 
 /***
  *** Imports
diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index df731e45a47df..fbfcfbad35ad3 100644
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.1.4.7 2007/08/28 07:19:13 tbox Exp $ */
+/* $Id: openssldsa_link.c,v 1.1.4.8 2008/12/24 00:21:45 marka Exp $ */
 
 #ifdef OPENSSL
 
@@ -133,7 +133,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
 	status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa);
 	DSA_SIG_free(dsasig);
-	if (status == 0)
+	if (status != 1)
 		return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index c33913ce3d07b..765d9ed2a575c 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.1.4.9 2006/11/07 21:28:40 marka Exp $
+ * $Id: opensslrsa_link.c,v 1.1.4.10 2008/12/24 00:21:45 marka Exp $
  */
 #ifdef OPENSSL
 
@@ -246,7 +246,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 
 	status = RSA_verify(type, digest, digestlen, sig->base,
 			    RSA_size(rsa), rsa);
-	if (status == 0)
+	if (status != 1)
 		return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 46c317d262bce..14d5ea73849f5 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.115.2.2.2.17 2008/04/03 00:17:07 each Exp $ */
+/* $Id: rbt.c,v 1.115.2.2.2.18 2008/04/18 19:03:00 each Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -2048,10 +2048,6 @@ dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum,
 		node = LEFT(node);
 		goto traverse;
 	}
-	if (RIGHT(node) != NULL) {
-		node = RIGHT(node);
-		goto traverse;
-	}
 	if (DOWN(node) != NULL) {
 		node = DOWN(node);
 		goto traverse;
@@ -2068,14 +2064,15 @@ dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum,
 	node->magic = 0;
 #endif
 	parent = PARENT(node);
+	if (RIGHT(node) != NULL)
+		PARENT(RIGHT(node)) = parent;
 	if (parent != NULL) {
 		if (LEFT(parent) == node)
-			LEFT(parent) = NULL;
+			LEFT(parent) = RIGHT(node);
 		else if (DOWN(parent) == node)
-			DOWN(parent) = NULL;
-		else if (RIGHT(parent) == node)
-			RIGHT(parent) = NULL;
-	}
+			DOWN(parent) = RIGHT(node);
+	} else
+		parent = RIGHT(node);
 	isc_mem_put(rbt->mctx, node, NODE_SIZE(node));
 	rbt->nodecount--;
 	node = parent;
diff --git a/lib/dns/rdata/generic/nsec_47.c b/lib/dns/rdata/generic/nsec_47.c
index 74b7806c7e112..307cac89e0811 100644
--- a/lib/dns/rdata/generic/nsec_47.c
+++ b/lib/dns/rdata/generic/nsec_47.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec_47.c,v 1.7.2.1 2004/03/08 02:08:03 marka Exp $ */
+/* $Id: nsec_47.c,v 1.7.2.3 2008/07/15 23:45:44 tbox Exp $ */
 
 /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
 
-/* draft-ietf-dnsext-nsec-rdata-01.txt */
+/* RFC 3845 */
 
 #ifndef RDATA_GENERIC_NSEC_47_C
 #define RDATA_GENERIC_NSEC_47_C
@@ -255,7 +255,7 @@ fromstruct_nsec(ARGS_FROMSTRUCT) {
 		window = nsec->typebits[i];
 		len = nsec->typebits[i+1];
 		i += 2;
-		INSIST(first || window > lastwindow); 
+		INSIST(first || window > lastwindow);
 		INSIST(len > 0 && len <= 32);
 		INSIST(i + len <= nsec->len);
 		INSIST(nsec->typebits[i + len - 1] != 0);
diff --git a/lib/dns/rdata/generic/nsec_47.h b/lib/dns/rdata/generic/nsec_47.h
index d76a25cc43db5..0070bfc6e456c 100644
--- a/lib/dns/rdata/generic/nsec_47.h
+++ b/lib/dns/rdata/generic/nsec_47.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -18,9 +18,10 @@
 #ifndef GENERIC_NSEC_47_H
 #define GENERIC_NSEC_47_H 1
 
-/* $Id: nsec_47.h,v 1.4.2.1 2004/03/08 02:08:03 marka Exp $ */
+/* $Id: nsec_47.h,v 1.4.2.3 2008/07/15 23:45:44 tbox Exp $ */
 
-/* draft-ietf-dnsext-nsec-rdata-01.txt */
+/*!
+ * \brief Per RFC 3845 */
 
 typedef struct dns_rdata_nsec {
 	dns_rdatacommon_t	common;
diff --git a/lib/dns/rdata/generic/txt_16.c b/lib/dns/rdata/generic/txt_16.c
index 625fa2be8e7c0..eb511ba859f52 100644
--- a/lib/dns/rdata/generic/txt_16.c
+++ b/lib/dns/rdata/generic/txt_16.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: txt_16.c,v 1.37.12.7 2007/08/28 07:19:15 tbox Exp $ */
+/* $Id: txt_16.c,v 1.37.12.9 2008/04/28 23:45:37 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 15:40:00 PST 2000 by bwelling */
 
@@ -142,7 +142,7 @@ fromstruct_txt(ARGS_FROMSTRUCT) {
 	while (region.length > 0) {
 		length = uint8_fromregion(®ion);
 		isc_region_consume(®ion, 1);
-		if (region.length <= length)
+		if (region.length < length)
 			return (ISC_R_UNEXPECTEDEND);
 		isc_region_consume(®ion, length);
 	}
diff --git a/lib/dns/rdata/in_1/naptr_35.c b/lib/dns/rdata/in_1/naptr_35.c
index f3c93c7c03d9f..fc6ee8cad9d17 100644
--- a/lib/dns/rdata/in_1/naptr_35.c
+++ b/lib/dns/rdata/in_1/naptr_35.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: naptr_35.c,v 1.43.2.1.2.3 2004/03/06 08:14:17 marka Exp $ */
+/* $Id: naptr_35.c,v 1.43.2.1.2.5 2008/04/28 23:45:37 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
@@ -154,7 +154,7 @@ totext_in_naptr(ARGS_TOTEXT) {
 
 static inline isc_result_t
 fromwire_in_naptr(ARGS_FROMWIRE) {
-        dns_name_t name;
+	dns_name_t name;
 	isc_region_t sr;
 
 	REQUIRE(type == 35);
@@ -165,7 +165,7 @@ fromwire_in_naptr(ARGS_FROMWIRE) {
 
 	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
 
-        dns_name_init(&name, NULL);
+	dns_name_init(&name, NULL);
 
 	/*
 	 * Order, preference.
@@ -321,8 +321,8 @@ fromstruct_in_naptr(ARGS_FROMSTRUCT) {
 	REQUIRE(naptr->common.rdtype == type);
 	REQUIRE(naptr->common.rdclass == rdclass);
 	REQUIRE(naptr->flags != NULL || naptr->flags_len == 0);
-	REQUIRE(naptr->service != NULL && naptr->service_len == 0);
-	REQUIRE(naptr->regexp != NULL && naptr->regexp_len == 0);
+	REQUIRE(naptr->service != NULL || naptr->service_len == 0);
+	REQUIRE(naptr->regexp != NULL || naptr->regexp_len == 0);
 
 	UNUSED(type);
 	UNUSED(rdclass);
diff --git a/lib/dns/request.c b/lib/dns/request.c
index 6fe7b114ab047..cbc6714af454f 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: request.c,v 1.64.2.1.10.12.4.2 2008/07/23 07:28:11 tbox Exp $ */
+/* $Id: request.c,v 1.64.2.1.10.15 2008/07/22 04:00:37 marka Exp $ */
 
 #include 
 
@@ -119,6 +119,7 @@ static isc_result_t req_render(dns_message_t *message, isc_buffer_t **buffer,
 static void req_senddone(isc_task_t *task, isc_event_t *event);
 static void req_response(isc_task_t *task, isc_event_t *event);
 static void req_timeout(isc_task_t *task, isc_event_t *event);
+static isc_socket_t * req_getsocket(dns_request_t *request);
 static void req_connected(isc_task_t *task, isc_event_t *event);
 static void req_sendevent(dns_request_t *request, isc_result_t result);
 static void req_cancel(dns_request_t *request);
@@ -144,6 +145,7 @@ dns_requestmgr_create(isc_mem_t *mctx,
 	isc_socket_t *socket;
 	isc_result_t result;
 	int i;
+	unsigned int dispattr;
 
 	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_create");
 
@@ -152,13 +154,14 @@ dns_requestmgr_create(isc_mem_t *mctx,
 	REQUIRE(socketmgr != NULL);
 	REQUIRE(taskmgr != NULL);
 	REQUIRE(dispatchmgr != NULL);
+	UNUSED(socket);
 	if (dispatchv4 != NULL) {
-		socket = dns_dispatch_getsocket(dispatchv4);
-		REQUIRE(isc_socket_gettype(socket) == isc_sockettype_udp);
+		dispattr = dns_dispatch_getattributes(dispatchv4);
+		REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0);
 	}
 	if (dispatchv6 != NULL) {
-		socket = dns_dispatch_getsocket(dispatchv6);
-		REQUIRE(isc_socket_gettype(socket) == isc_sockettype_udp);
+		dispattr = dns_dispatch_getattributes(dispatchv6);
+		REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0);
 	}
 
 	requestmgr = isc_mem_get(mctx, sizeof(*requestmgr));
@@ -423,12 +426,19 @@ req_send(dns_request_t *request, isc_task_t *task, isc_sockaddr_t *address) {
 	isc_region_t r;
 	isc_socket_t *socket;
 	isc_result_t result;
+	unsigned int dispattr;
 
 	req_log(ISC_LOG_DEBUG(3), "req_send: request %p", request);
 
 	REQUIRE(VALID_REQUEST(request));
-	socket = dns_dispatch_getsocket(request->dispatch);
+	dispattr = dns_dispatch_getattributes(request->dispatch);
+	socket = req_getsocket(request);
 	isc_buffer_usedregion(request->query, &r);
+	/*
+	 * We could connect the socket when we are using an exclusive dispatch
+	 * as we do in resolver.c, but we prefer implementation simplicity
+	 * at this moment.
+	 */
 	result = isc_socket_sendto(socket, &r, task, req_senddone,
 				  request, address, NULL);
 	if (result == ISC_R_SUCCESS)
@@ -740,14 +750,16 @@ dns_request_createraw3(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	socket = dns_dispatch_getsocket(request->dispatch);
-	INSIST(socket != NULL);
-	result = dns_dispatch_addresponse(request->dispatch, destaddr, task,
-					  req_response, request, &id,
-					  &request->dispentry);
+	result = dns_dispatch_addresponse2(request->dispatch, destaddr, task,
+					   req_response, request, &id,
+					   &request->dispentry,
+					   requestmgr->socketmgr);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
+	socket = req_getsocket(request);
+	INSIST(socket != NULL);
+
 	result = isc_buffer_allocate(mctx, &request->query,
 				     r.length + (tcp ? 2 : 0));
 	if (result != ISC_R_SUCCESS)
@@ -933,13 +945,14 @@ dns_request_createvia3(dns_requestmgr_t *requestmgr, dns_message_t *message,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	socket = dns_dispatch_getsocket(request->dispatch);
-	INSIST(socket != NULL);
-	result = dns_dispatch_addresponse(request->dispatch, destaddr, task,
-					  req_response, request, &id,
-					  &request->dispentry);
+	result = dns_dispatch_addresponse2(request->dispatch, destaddr, task,
+					   req_response, request, &id,
+					   &request->dispentry,
+					   requestmgr->socketmgr);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
+	socket = req_getsocket(request);
+	INSIST(socket != NULL);
 
 	message->id = id;
 	if (setkey) {
@@ -1224,6 +1237,21 @@ dns_request_destroy(dns_request_t **requestp) {
  *** Private: request.
  ***/
 
+static isc_socket_t *
+req_getsocket(dns_request_t *request) {
+	unsigned int dispattr;
+	isc_socket_t *socket;
+
+	dispattr = dns_dispatch_getattributes(request->dispatch);
+	if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+		INSIST(request->dispentry != NULL);
+		socket = dns_dispatch_getentrysocket(request->dispentry);
+	} else
+		socket = dns_dispatch_getsocket(request->dispatch);
+
+	return (socket);
+}
+
 static void
 req_connected(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
@@ -1423,6 +1451,7 @@ req_destroy(dns_request_t *request) {
 static void
 req_cancel(dns_request_t *request) {
 	isc_socket_t *socket;
+	unsigned int dispattr;
 
 	REQUIRE(VALID_REQUEST(request));
 
@@ -1435,16 +1464,23 @@ req_cancel(dns_request_t *request) {
 
 	if (request->timer != NULL)
 		isc_timer_detach(&request->timer);
+	dispattr = dns_dispatch_getattributes(request->dispatch);
+	socket = NULL;
+	if (DNS_REQUEST_CONNECTING(request) || DNS_REQUEST_SENDING(request)) {
+		if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+			if (request->dispentry != NULL) {
+				socket = dns_dispatch_getentrysocket(
+					request->dispentry);
+			}
+		} else
+			socket = dns_dispatch_getsocket(request->dispatch);
+		if (DNS_REQUEST_CONNECTING(request) && socket != NULL)
+			isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_CONNECT);
+		if (DNS_REQUEST_SENDING(request) && socket != NULL)
+			isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND);
+	}
 	if (request->dispentry != NULL)
 		dns_dispatch_removeresponse(&request->dispentry, NULL);
-	if (DNS_REQUEST_CONNECTING(request)) {
-		socket = dns_dispatch_getsocket(request->dispatch);
-		isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_CONNECT);
-	}
-	if (DNS_REQUEST_SENDING(request)) {
-		socket = dns_dispatch_getsocket(request->dispatch);
-		isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND);
-	}
 	dns_dispatch_detach(&request->dispatch);
 }
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 602dcf5f9632f..3a02ba798e736 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.218.2.18.4.77.2.3 2008/07/24 05:00:46 jinmei Exp $ */
+/* $Id: resolver.c,v 1.218.2.18.4.85 2008/10/17 22:03:37 jinmei Exp $ */
 
 #include 
 
@@ -119,6 +119,7 @@ typedef struct query {
 	isc_mem_t *			mctx;
 	dns_dispatchmgr_t *		dispatchmgr;
 	dns_dispatch_t *		dispatch;
+	isc_boolean_t			exclusivesocket;
 	dns_adbaddrinfo_t *		addrinfo;
 	isc_socket_t *			tcpsocket;
 	isc_time_t			start;
@@ -301,7 +302,9 @@ struct dns_resolver {
 	unsigned int			options;
 	dns_dispatchmgr_t *		dispatchmgr;
 	dns_dispatch_t *		dispatchv4;
+	isc_boolean_t			exclusivev4;
 	dns_dispatch_t *		dispatchv6;
+	isc_boolean_t			exclusivev6;
 	unsigned int			nbuckets;
 	fctxbucket_t *			buckets;
 	isc_uint32_t			lame_ttl;
@@ -360,6 +363,8 @@ static isc_result_t ncache_adderesult(dns_message_t *message,
 				      isc_result_t *eresultp);
 static void validated(isc_task_t *task, isc_event_t *event);
 static void maybe_destroy(fetchctx_t *fctx);
+static void add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
+		    isc_result_t reason);
 
 static isc_result_t
 valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
@@ -549,6 +554,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 	unsigned int factor;
 	dns_adbfind_t *find;
 	dns_adbaddrinfo_t *addrinfo;
+	isc_socket_t *socket;
 
 	query = *queryp;
 	fctx = query->fctx;
@@ -631,35 +637,48 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 							   0, factor);
 	}
 
-	if (query->dispentry != NULL)
-		dns_dispatch_removeresponse(&query->dispentry, deventp);
-
-	ISC_LIST_UNLINK(fctx->queries, query, link);
-
-	if (query->tsig != NULL)
-		isc_buffer_free(&query->tsig);
-
-	if (query->tsigkey != NULL)
-		dns_tsigkey_detach(&query->tsigkey);
-
 	/*
 	 * Check for any outstanding socket events.  If they exist, cancel
 	 * them and let the event handlers finish the cleanup.  The resolver
 	 * only needs to worry about managing the connect and send events;
 	 * the dispatcher manages the recv events.
 	 */
-	if (RESQUERY_CONNECTING(query))
+	if (RESQUERY_CONNECTING(query)) {
 		/*
 		 * Cancel the connect.
 		 */
-		isc_socket_cancel(query->tcpsocket, NULL,
-				  ISC_SOCKCANCEL_CONNECT);
-	else if (RESQUERY_SENDING(query))
+		if (query->tcpsocket != NULL) {
+			isc_socket_cancel(query->tcpsocket, NULL,
+					  ISC_SOCKCANCEL_CONNECT);
+		} else if (query->dispentry != NULL) {
+			INSIST(query->exclusivesocket);
+			socket = dns_dispatch_getentrysocket(query->dispentry);
+			if (socket != NULL)
+				isc_socket_cancel(socket, NULL,
+						  ISC_SOCKCANCEL_CONNECT);
+		}
+	} else if (RESQUERY_SENDING(query)) {
 		/*
 		 * Cancel the pending send.
 		 */
-		isc_socket_cancel(dns_dispatch_getsocket(query->dispatch),
-				  NULL, ISC_SOCKCANCEL_SEND);
+		if (query->exclusivesocket && query->dispentry != NULL)
+			socket = dns_dispatch_getentrysocket(query->dispentry);
+		else
+			socket = dns_dispatch_getsocket(query->dispatch);
+		if (socket != NULL)
+			isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND);
+	}
+
+	if (query->dispentry != NULL)
+		dns_dispatch_removeresponse(&query->dispentry, deventp);
+
+	ISC_LIST_UNLINK(fctx->queries, query, link);
+
+	if (query->tsig != NULL)
+		isc_buffer_free(&query->tsig);
+
+	if (query->tsigkey != NULL)
+		dns_tsigkey_detach(&query->tsigkey);
 
 	if (query->dispatch != NULL)
 		dns_dispatch_detach(&query->dispatch);
@@ -824,43 +843,25 @@ fctx_done(fetchctx_t *fctx, isc_result_t result) {
 }
 
 static void
-resquery_senddone(isc_task_t *task, isc_event_t *event) {
+process_sendevent(resquery_t *query, isc_event_t *event) {
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
-	resquery_t *query = event->ev_arg;
 	isc_boolean_t retry = ISC_FALSE;
 	isc_result_t result;
 	fetchctx_t *fctx;
 
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
-
-	QTRACE("senddone");
-
-	/*
-	 * XXXRTH
-	 *
-	 * Currently we don't wait for the senddone event before retrying
-	 * a query.  This means that if we get really behind, we may end
-	 * up doing extra work!
-	 */
-
-	UNUSED(task);
-
-	INSIST(RESQUERY_SENDING(query));
-
-	query->sends--;
 	fctx = query->fctx;
 
 	if (RESQUERY_CANCELED(query)) {
-		if (query->sends == 0) {
+		if (query->sends == 0 && query->connects == 0) {
 			/*
 			 * This query was canceled while the
-			 * isc_socket_sendto() was in progress.
+			 * isc_socket_sendto/connect() was in progress.
 			 */
 			if (query->tcpsocket != NULL)
 				isc_socket_detach(&query->tcpsocket);
 			resquery_destroy(&query);
 		}
-	} else
+	} else {
 		switch (sevent->result) {
 		case ISC_R_SUCCESS:
 			break;
@@ -874,6 +875,7 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 			/*
 			 * No route to remote.
 			 */
+			add_bad(fctx, query->addrinfo, sevent->result);
 			fctx_cancelquery(&query, NULL, NULL, ISC_TRUE);
 			retry = ISC_TRUE;
 			break;
@@ -882,6 +884,7 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 			fctx_cancelquery(&query, NULL, NULL, ISC_FALSE);
 			break;
 		}
+	}
 
 	isc_event_free(&event);
 
@@ -899,6 +902,48 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 	}
 }
 
+static void
+resquery_udpconnected(isc_task_t *task, isc_event_t *event) {
+	resquery_t *query = event->ev_arg;
+
+	REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
+
+	QTRACE("udpconnected");
+
+	UNUSED(task);
+
+	INSIST(RESQUERY_CONNECTING(query));
+
+	query->connects--;
+
+	process_sendevent(query, event);
+}
+
+static void
+resquery_senddone(isc_task_t *task, isc_event_t *event) {
+	resquery_t *query = event->ev_arg;
+
+	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
+
+	QTRACE("senddone");
+
+	/*
+	 * XXXRTH
+	 *
+	 * Currently we don't wait for the senddone event before retrying
+	 * a query.  This means that if we get really behind, we may end
+	 * up doing extra work!
+	 */
+
+	UNUSED(task);
+
+	INSIST(RESQUERY_SENDING(query));
+
+	query->sends--;
+
+	process_sendevent(query, event);
+}
+
 static inline isc_result_t
 fctx_addopt(dns_message_t *message, dns_resolver_t *res) {
 	dns_rdataset_t *rdataset;
@@ -1029,6 +1074,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	 */
 	query->dispatchmgr = res->dispatchmgr;
 	query->dispatch = NULL;
+	query->exclusivesocket = ISC_FALSE;
 	query->tcpsocket = NULL;
 	if ((query->options & DNS_FETCHOPT_TCP) != 0) {
 		isc_sockaddr_t addr;
@@ -1070,50 +1116,21 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		 * A dispatch will be created once the connect succeeds.
 		 */
 	} else {
-		isc_sockaddr_t localaddr;
-		unsigned int attrs, attrmask;
-		dns_dispatch_t *disp_base;
-
-		attrs = 0;
-		attrs |= DNS_DISPATCHATTR_UDP;
-		attrs |= DNS_DISPATCHATTR_RANDOMPORT;
-
-		attrmask = 0;
-		attrmask |= DNS_DISPATCHATTR_UDP;
-		attrmask |= DNS_DISPATCHATTR_TCP;
-		attrmask |= DNS_DISPATCHATTR_IPV4;
-		attrmask |= DNS_DISPATCHATTR_IPV6;
-
 		switch (isc_sockaddr_pf(&addrinfo->sockaddr)) {
-		case AF_INET:
-			disp_base = res->dispatchv4;
-			attrs |= DNS_DISPATCHATTR_IPV4;
+		case PF_INET:
+			dns_dispatch_attach(res->dispatchv4,
+					    &query->dispatch);
+			query->exclusivesocket = res->exclusivev4;
 			break;
-		case AF_INET6:
-			disp_base = res->dispatchv6;
-			attrs |= DNS_DISPATCHATTR_IPV6;
+		case PF_INET6:
+			dns_dispatch_attach(res->dispatchv6,
+					    &query->dispatch);
+			query->exclusivesocket = res->exclusivev6;
 			break;
 		default:
 			result = ISC_R_NOTIMPLEMENTED;
 			goto cleanup_query;
 		}
-
-		result = dns_dispatch_getlocaladdress(disp_base, &localaddr);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup_query;
-		if (isc_sockaddr_getport(&localaddr) == 0) {
-			result = dns_dispatch_getudp(res->dispatchmgr,
-						     res->socketmgr,
-						     res->taskmgr,
-						     &localaddr,
-						     4096, 1000, 32768,
-						     16411, 16433,
-						     attrs, attrmask,
-						     &query->dispatch);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup_query;
-		} else
-			dns_dispatch_attach(disp_base, &query->dispatch);
 		/*
 		 * We should always have a valid dispatcher here.  If we
 		 * don't support a protocol family, then its dispatcher
@@ -1224,13 +1241,14 @@ resquery_send(resquery_t *query) {
 	/*
 	 * Get a query id from the dispatch.
 	 */
-	result = dns_dispatch_addresponse(query->dispatch,
-					  &query->addrinfo->sockaddr,
-					  task,
-					  resquery_response,
-					  query,
-					  &query->id,
-					  &query->dispentry);
+	result = dns_dispatch_addresponse2(query->dispatch,
+					   &query->addrinfo->sockaddr,
+					   task,
+					   resquery_response,
+					   query,
+					   &query->id,
+					   &query->dispentry,
+					   res->socketmgr);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_temps;
 
@@ -1412,12 +1430,24 @@ resquery_send(resquery_t *query) {
 	 */
 	dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
 
-	socket = dns_dispatch_getsocket(query->dispatch);
+	if (query->exclusivesocket)
+		socket = dns_dispatch_getentrysocket(query->dispentry);
+	else
+		socket = dns_dispatch_getsocket(query->dispatch);
 	/*
 	 * Send the query!
 	 */
-	if ((query->options & DNS_FETCHOPT_TCP) == 0)
+	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
 		address = &query->addrinfo->sockaddr;
+		if (query->exclusivesocket) {
+			result = isc_socket_connect(socket, address, task,
+						    resquery_udpconnected,
+						    query);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup_message;
+			query->connects++;
+		}
+	}
 	isc_buffer_usedregion(buffer, &r);
 
 	/*
@@ -1740,7 +1770,7 @@ add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_result_t reason) {
 		return;
 
 	if (reason == DNS_R_UNEXPECTEDRCODE &&
-	    fctx->rmessage->opcode == dns_rcode_servfail &&
+	    fctx->rmessage->rcode == dns_rcode_servfail &&
 	    ISFORWARDER(addrinfo))
 		return;
 
@@ -2026,6 +2056,13 @@ fctx_getaddresses(fetchctx_t *fctx) {
 	}
 
 	while (sa != NULL) {
+		if ((isc_sockaddr_pf(sa) == AF_INET &&
+			 fctx->res->dispatchv4 == NULL) ||
+		    (isc_sockaddr_pf(sa) == AF_INET6 &&
+			fctx->res->dispatchv6 == NULL)) {
+				sa = ISC_LIST_NEXT(sa, link);
+				continue;
+		}
 		ai = NULL;
 		result = dns_adb_findaddrinfo(fctx->adb,
 					      sa, &ai, 0);  /* XXXMLG */
@@ -5315,6 +5352,19 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * There's no hope for this query.
 			 */
 			keep_trying = ISC_TRUE;
+
+			/*
+			 * If this is a network error on an exclusive query
+			 * socket, mark the server as bad so that we won't try
+			 * it for this fetch again.
+			 */
+			if (query->exclusivesocket &&
+			    (devent->result == ISC_R_HOSTUNREACH ||
+			     devent->result == ISC_R_NETUNREACH ||
+			     devent->result == ISC_R_CONNREFUSED ||
+			     devent->result == ISC_R_CANCELED)) {
+				    broken_server = devent->result;
+			}
 		}
 		goto done;
 	}
@@ -5465,12 +5515,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (message->rcode != dns_rcode_noerror &&
 	    message->rcode != dns_rcode_nxdomain) {
-		if ((message->rcode == dns_rcode_formerr ||
-		     message->rcode == dns_rcode_notimp ||
-		     message->rcode == dns_rcode_servfail) &&
+		if (((message->rcode == dns_rcode_formerr ||
+		     message->rcode == dns_rcode_notimp) ||
+		    (message->rcode == dns_rcode_servfail &&
+		     dns_message_getopt(message) == NULL)) &&
 		    (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 			/*
 			 * It's very likely they don't like EDNS0.
+			 * If the response code is SERVFAIL, also check if the
+			 * response contains an OPT RR and don't cache the
+			 * failure since it can be returned for various other
+			 * reasons.
 			 *
 			 * XXXRTH  We should check if the question
 			 *	   we're asking requires EDNS0, and
@@ -5936,6 +5991,7 @@ dns_resolver_create(dns_view_t *view,
 	isc_result_t result = ISC_R_SUCCESS;
 	unsigned int i, buckets_created = 0;
 	char name[16];
+	unsigned dispattr;
 
 	/*
 	 * Create a resolver.
@@ -5991,11 +6047,20 @@ dns_resolver_create(dns_view_t *view,
 	}
 
 	res->dispatchv4 = NULL;
-	if (dispatchv4 != NULL)
+	if (dispatchv4 != NULL) {
 		dns_dispatch_attach(dispatchv4, &res->dispatchv4);
+		dispattr = dns_dispatch_getattributes(dispatchv4);
+		res->exclusivev4 =
+			ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0);
+	}
+
 	res->dispatchv6 = NULL;
-	if (dispatchv6 != NULL)
+	if (dispatchv6 != NULL) {
 		dns_dispatch_attach(dispatchv6, &res->dispatchv6);
+		dispattr = dns_dispatch_getattributes(dispatchv6);
+		res->exclusivev6 =
+			ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0);
+	}
 
 	res->references = 1;
 	res->exiting = ISC_FALSE;
@@ -6253,12 +6318,12 @@ dns_resolver_shutdown(dns_resolver_t *res) {
 			     fctx != NULL;
 			     fctx = ISC_LIST_NEXT(fctx, link))
 				fctx_shutdown(fctx);
-			if (res->dispatchv4 != NULL) {
+			if (res->dispatchv4 != NULL && !res->exclusivev4) {
 				sock = dns_dispatch_getsocket(res->dispatchv4);
 				isc_socket_cancel(sock, res->buckets[i].task,
 						  ISC_SOCKCANCEL_ALL);
 			}
-			if (res->dispatchv6 != NULL) {
+			if (res->dispatchv6 != NULL && !res->exclusivev6) {
 				sock = dns_dispatch_getsocket(res->dispatchv6);
 				isc_socket_cancel(sock, res->buckets[i].task,
 						  ISC_SOCKCANCEL_ALL);
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index a32892f3b7d62..7c7aae1f17ec7 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.91.2.5.8.40 2008/02/19 17:10:55 each Exp $ */
+/* $Id: validator.c,v 1.91.2.5.8.41 2008/08/21 04:59:16 marka Exp $ */
 
 #include 
 
@@ -974,6 +974,7 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
 	} else if (result != ISC_R_SUCCESS &&
 		   result != DNS_R_NCACHENXDOMAIN &&
 		   result != DNS_R_NCACHENXRRSET &&
+		   result != DNS_R_EMPTYNAME &&
 		   result != DNS_R_NXRRSET &&
 		   result != ISC_R_NOTFOUND) {
 		goto  notfound;
@@ -1231,6 +1232,7 @@ get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) {
 		return (DNS_R_WAIT);
 	} else if (result ==  DNS_R_NCACHENXDOMAIN ||
 		   result == DNS_R_NCACHENXRRSET ||
+		   result == DNS_R_EMPTYNAME ||
 		   result == DNS_R_NXDOMAIN ||
 		   result == DNS_R_NXRRSET)
 	{
@@ -1791,8 +1793,9 @@ validatezonekey(dns_validator_t *val) {
 			if (result != ISC_R_SUCCESS)
 				return (result);
 			return (DNS_R_WAIT);
-		 } else if (result ==  DNS_R_NCACHENXDOMAIN ||
+		} else if (result ==  DNS_R_NCACHENXDOMAIN ||
 			   result == DNS_R_NCACHENXRRSET ||
+			   result == DNS_R_EMPTYNAME ||
 			   result == DNS_R_NXDOMAIN ||
 			   result == DNS_R_NXRRSET)
 		{
@@ -2420,6 +2423,7 @@ finddlvsep(dns_validator_t *val, isc_boolean_t resume) {
 		}
 		if (result != DNS_R_NXRRSET &&
 		    result != DNS_R_NXDOMAIN &&
+		    result != DNS_R_EMPTYNAME &&
 		    result != DNS_R_NCACHENXRRSET &&
 		    result != DNS_R_NCACHENXDOMAIN)
 			return (result);
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 90b7e938b3cb7..21effb6284a94 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.c,v 1.103.2.5.2.17 2007/08/28 07:19:14 tbox Exp $ */
+/* $Id: view.c,v 1.103.2.5.2.19 2008/06/17 23:45:32 tbox Exp $ */
 
 #include 
 
@@ -298,7 +298,7 @@ destroy(dns_view_t *view) {
 			name = ISC_LIST_HEAD(view->rootexclude[i]);
 			while (name != NULL) {
 				ISC_LIST_UNLINK(view->rootexclude[i],
-					 	name, link);
+						name, link);
 				dns_name_free(name, view->mctx);
 				isc_mem_put(view->mctx, name, sizeof(*name));
 				name = ISC_LIST_HEAD(view->rootexclude[i]);
@@ -822,17 +822,6 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	}
 
  cleanup:
-	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		/*
-		 * We don't care about any DNSSEC proof data in these cases.
-		 */
-		if (dns_rdataset_isassociated(rdataset))
-			dns_rdataset_disassociate(rdataset);
-		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset))
-			dns_rdataset_disassociate(sigrdataset);
-	}
-
 	if (dns_rdataset_isassociated(&zrdataset)) {
 		dns_rdataset_disassociate(&zrdataset);
 		if (dns_rdataset_isassociated(&zsigrdataset))
@@ -912,7 +901,7 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 isc_result_t
 dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		     isc_stdtime_t now, unsigned int options,
-		     isc_boolean_t use_hints, 
+		     isc_boolean_t use_hints,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
 {
 	return(dns_view_findzonecut2(view, name, fname, now, options,
@@ -1320,7 +1309,7 @@ dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name) {
 	return (ISC_TRUE);
 }
 
-void 
+void
 dns_view_setrootdelonly(dns_view_t *view, isc_boolean_t value) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	view->rootdelonly = value;
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 0e7a487b10574..ca2d8570d49e4 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.124.2.4.2.21.4.5 2008/07/28 23:47:49 tbox Exp $ */
+/* $Id: xfrin.c,v 1.124.2.4.2.28 2008/09/25 04:16:12 marka Exp $ */
 
 #include 
 
@@ -424,6 +424,10 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, isc_uint32_t ttl,
 {
 	isc_result_t result;
 
+	if (rdata->type == dns_rdatatype_none ||
+	    dns_rdatatype_ismeta(rdata->type))
+		FAIL(DNS_R_FORMERR);
+
  redo:
 	switch (xfr->state) {
 	case XFRST_SOAQUERY:
diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
index 7e53510c507db..78a820d767aa8 100644
--- a/lib/isc/Makefile.in
+++ b/lib/isc/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.71.2.2.2.8 2004/07/20 07:01:58 marka Exp $
+# $Id: Makefile.in,v 1.71.2.2.2.10 2008/06/25 23:45:37 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -55,7 +55,7 @@ OBJS =		@ISC_EXTRA_OBJS@ \
 		hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ \
 		lex.@O@ lfsr.@O@ lib.@O@ log.@O@ md5.@O@ \
 		mem.@O@ mutexblock.@O@ netaddr.@O@ netscope.@O@ ondestroy.@O@ \
-		parseint.@O@ quota.@O@ random.@O@ \
+		parseint.@O@ portset.@O@ quota.@O@ random.@O@ \
 		ratelimiter.@O@ region.@O@ result.@O@ rwlock.@O@ \
 		serial.@O@ sha1.@O@ sockaddr.@O@ string.@O@ strtoul.@O@ \
 		symtab.@O@ task.@O@ taskpool.@O@ timer.@O@ version.@O@ \
@@ -68,7 +68,7 @@ SRCS =		@ISC_EXTRA_SRCS@ \
 		heap.c hex.c hmacmd5.c \
 		lex.c lfsr.c lib.c log.c \
 		md5.c mem.c mutexblock.c netaddr.c netscope.c ondestroy.c \
-		parseint.c quota.c random.c \
+		parseint.c portset.c quota.c random.c \
 		ratelimiter.c result.c rwlock.c \
 		serial.c sha1.c sockaddr.c string.c strtoul.c symtab.c \
 		task.c taskpool.c timer.c version.c
diff --git a/lib/isc/api b/lib/isc/api
index a8be9070823bf..00b7f9242ef56 100644
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 14
-LIBREVISION = 0
+LIBINTERFACE = 15
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/lib/isc/assertions.c b/lib/isc/assertions.c
index 94c6732fd8bd1..ce4ea83c850ab 100644
--- a/lib/isc/assertions.c
+++ b/lib/isc/assertions.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: assertions.c,v 1.16.206.1 2004/03/06 08:14:27 marka Exp $ */
+/* $Id: assertions.c,v 1.16.206.3 2008/10/15 23:45:34 tbox Exp $ */
 
 #include 
 
@@ -28,7 +28,7 @@
 /*
  * Forward.
  */
-
+/* coverity[+kill] */
 static void
 default_callback(const char *, int, isc_assertiontype_t, const char *);
 
diff --git a/lib/isc/include/isc/assertions.h b/lib/isc/include/isc/assertions.h
index 6091de9a63389..b6f68a6dfd5b1 100644
--- a/lib/isc/include/isc/assertions.h
+++ b/lib/isc/include/isc/assertions.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: assertions.h,v 1.17.206.1 2004/03/06 08:14:38 marka Exp $
+ * $Id: assertions.h,v 1.17.206.3 2008/10/15 23:45:34 tbox Exp $
  */
 
 #ifndef ISC_ASSERTIONS_H
@@ -37,6 +37,7 @@ typedef enum {
 typedef void (*isc_assertioncallback_t)(const char *, int, isc_assertiontype_t,
 					const char *);
 
+/* coverity[+kill] */
 LIBISC_EXTERNAL_DATA extern isc_assertioncallback_t isc_assertion_failed;
 
 void
@@ -45,14 +46,14 @@ isc_assertion_setcallback(isc_assertioncallback_t);
 const char *
 isc_assertion_typetotext(isc_assertiontype_t type);
 
-#ifdef ISC_CHECK_ALL
+#if defined(ISC_CHECK_ALL) || defined(__COVERITY__)
 #define ISC_CHECK_REQUIRE		1
 #define ISC_CHECK_ENSURE		1
 #define ISC_CHECK_INSIST		1
 #define ISC_CHECK_INVARIANT		1
 #endif
 
-#ifdef ISC_CHECK_NONE
+#if defined(ISC_CHECK_NONE) && !defined(__COVERITY__)
 #define ISC_CHECK_REQUIRE		0
 #define ISC_CHECK_ENSURE		0
 #define ISC_CHECK_INSIST		0
diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h
index bb94f5236b571..979407d89c1c3 100644
--- a/lib/isc/include/isc/mem.h
+++ b/lib/isc/include/isc/mem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.h,v 1.54.12.7 2007/08/28 07:19:15 tbox Exp $ */
+/* $Id: mem.h,v 1.54.12.9 2008/04/28 23:45:38 tbox Exp $ */
 
 #ifndef ISC_MEM_H
 #define ISC_MEM_H 1
@@ -170,11 +170,11 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
 #define isc_mempool_put(c, p)	isc__mempool_put((c), (p) _ISC_MEM_FILELINE)
 #endif
 
-isc_result_t 
+isc_result_t
 isc_mem_create(size_t max_size, size_t target_size,
 	       isc_mem_t **mctxp);
 
-isc_result_t 
+isc_result_t
 isc_mem_createx(size_t max_size, size_t target_size,
 		isc_memalloc_t memalloc, isc_memfree_t memfree,
 		void *arg, isc_mem_t **mctxp);
@@ -203,9 +203,9 @@ isc_mem_createx(size_t max_size, size_t target_size,
  * Requires:
  * mctxp != NULL && *mctxp == NULL */
 
-void 
+void
 isc_mem_attach(isc_mem_t *, isc_mem_t **);
-void 
+void
 isc_mem_detach(isc_mem_t **);
 /*
  * Attach to / detach from a memory context.
@@ -213,20 +213,20 @@ isc_mem_detach(isc_mem_t **);
  * This is intended for applications that use multiple memory contexts
  * in such a way that it is not obvious when the last allocations from
  * a given context has been freed and destroying the context is safe.
- * 
+ *
  * Most applications do not need to call these functions as they can
  * simply create a single memory context at the beginning of main()
  * and destroy it at the end of main(), thereby guaranteeing that it
  * is not destroyed while there are outstanding allocations.
  */
 
-void 
+void
 isc_mem_destroy(isc_mem_t **);
 /*
  * Destroy a memory context.
  */
 
-isc_result_t 
+isc_result_t
 isc_mem_ondestroy(isc_mem_t *ctx,
 		  isc_task_t *task,
 		  isc_event_t **event);
@@ -235,13 +235,13 @@ isc_mem_ondestroy(isc_mem_t *ctx,
  * been successfully destroyed.
  */
 
-void 
+void
 isc_mem_stats(isc_mem_t *mctx, FILE *out);
 /*
  * Print memory usage statistics for 'mctx' on the stream 'out'.
  */
 
-void 
+void
 isc_mem_setdestroycheck(isc_mem_t *mctx,
 			isc_boolean_t on);
 /*
@@ -249,9 +249,9 @@ isc_mem_setdestroycheck(isc_mem_t *mctx,
  * destroyed and abort the program if any are present.
  */
 
-void 
+void
 isc_mem_setquota(isc_mem_t *, size_t);
-size_t 
+size_t
 isc_mem_getquota(isc_mem_t *);
 /*
  * Set/get the memory quota of 'mctx'.  This is a hard limit
@@ -259,7 +259,7 @@ isc_mem_getquota(isc_mem_t *);
  * if it is exceeded, allocations will fail.
  */
 
-size_t 
+size_t
 isc_mem_inuse(isc_mem_t *mctx);
 /*
  * Get an estimate of the number of memory in use in 'mctx', in bytes.
@@ -271,10 +271,28 @@ void
 isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
 		 size_t hiwater, size_t lowater);
 /*
- * Set high and low water marks for this memory context.  When the memory
- * usage of 'mctx' exceeds 'hiwater', '(water)(water_arg, ISC_MEM_HIWATER)'
- * will be called.  When the usage drops below 'lowater', 'water' will
- * again be called, this time with ISC_MEM_LOWATER.
+ * Set high and low water marks for this memory context.
+ * When the memory usage of 'mctx' exceeds 'hiwater',
+ * '(water)(water_arg, #ISC_MEM_HIWATER)' will be called.  'water' needs to
+ * call isc_mem_waterack() with #ISC_MEM_HIWATER to acknowlege the state
+ * change.  'water' may be called multiple times.
+ *
+ * When the usage drops below 'lowater', 'water' will again be called, this
+ * time with #ISC_MEM_LOWATER.  'water' need to calls isc_mem_waterack() with
+ * #ISC_MEM_LOWATER to acknowlege the change.
+ *
+ *	static void
+ *	water(void *arg, int mark) {
+ *		struct foo *foo = arg;
+ *
+ *		LOCK(&foo->marklock);
+ *		if (foo->mark != mark) {
+ *			foo->mark = mark;
+ *			....
+ *			isc_mem_waterack(foo->mctx, mark);
+ *		}
+ *		UNLOCK(&foo->marklock);
+ *	}
  *
  * If 'water' is NULL then 'water_arg', 'hi_water' and 'lo_water' are
  * ignored and the state is reset.
@@ -285,6 +303,12 @@ isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
  *	hi_water >= lo_water
  */
 
+void
+isc_mem_waterack(isc_mem_t *ctx, int mark);
+/*%<
+ * Called to acknowledge changes in signalled by calls to 'water'.
+ */
+
 /*
  * Memory pools
  */
@@ -429,22 +453,22 @@ isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit);
 /*
  * Pseudo-private functions for use via macros.  Do not call directly.
  */
-void *		
+void *
 isc__mem_get(isc_mem_t *, size_t _ISC_MEM_FLARG);
-void 		
+void
 isc__mem_putanddetach(isc_mem_t **, void *,
 				      size_t _ISC_MEM_FLARG);
-void 		
+void
 isc__mem_put(isc_mem_t *, void *, size_t _ISC_MEM_FLARG);
-void *		
+void *
 isc__mem_allocate(isc_mem_t *, size_t _ISC_MEM_FLARG);
-void		
+void
 isc__mem_free(isc_mem_t *, void * _ISC_MEM_FLARG);
-char *		
+char *
 isc__mem_strdup(isc_mem_t *, const char *_ISC_MEM_FLARG);
-void *		
+void *
 isc__mempool_get(isc_mempool_t * _ISC_MEM_FLARG);
-void 		
+void
 isc__mempool_put(isc_mempool_t *, void * _ISC_MEM_FLARG);
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/msgs.h b/lib/isc/include/isc/msgs.h
index 967005bf35317..584edcbd881c4 100644
--- a/lib/isc/include/isc/msgs.h
+++ b/lib/isc/include/isc/msgs.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: msgs.h,v 1.5.2.2.8.3 2004/03/06 08:14:44 marka Exp $ */
+/* $Id: msgs.h,v 1.5.2.2.8.5 2008/08/08 06:27:25 tbox Exp $ */
 
 #ifndef ISC_MSGS_H
 #define ISC_MSGS_H 1
@@ -146,7 +146,9 @@
 #define ISC_MSG_ACCEPTRETURNED 1418 /* accept() returned %d/%s */
 #define ISC_MSG_TOOMANYFDS     1419 /* %s: too many open file descriptors */
 #define ISC_MSG_ZEROPORT       1420 /* dropping source port zero packet */
-#define ISC_MSG_FILTER	       1420 /* setsockopt(SO_ACCEPTFILTER): %s */
+#define ISC_MSG_FILTER	       1421 /* setsockopt(SO_ACCEPTFILTER): %s */
+
+#define ISC_MSG_TOOMANYHANDLES 1422 /*%< %s: too many open WSA event handles: %s */
 
 #define ISC_MSG_AWAKE	       1502 /* "awake" */
 #define ISC_MSG_WORKING	       1503 /* "working" */
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
index 9c4edabb5facc..d1877931d4252 100644
--- a/lib/isc/include/isc/platform.h.in
+++ b/lib/isc/include/isc/platform.h.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: platform.h.in,v 1.24.2.1.10.13 2007/09/13 23:45:58 tbox Exp $ */
+/* $Id: platform.h.in,v 1.24.2.1.10.15 2008/06/25 23:45:37 tbox Exp $ */
 
 #ifndef ISC_PLATFORM_H
 #define ISC_PLATFORM_H 1
@@ -142,6 +142,21 @@
  *** Printing.
  ***/
 
+/*! \brief
+ * Define if the system supports kqueue multiplexing
+ */
+@ISC_PLATFORM_HAVEKQUEUE@
+
+/*! \brief
+ * Define if the system supports epoll multiplexing
+ */
+@ISC_PLATFORM_HAVEEPOLL@
+
+/*! \brief
+ * Define if the system supports /dev/poll multiplexing
+ */
+@ISC_PLATFORM_HAVEDEVPOLL@
+
 /*
  * If this system needs vsnprintf() and snprintf(), ISC_PLATFORM_NEEDVSNPRINTF
  * will be defined.
diff --git a/lib/isc/include/isc/portset.h b/lib/isc/include/isc/portset.h
new file mode 100644
index 0000000000000..60cbb790cbe8a
--- /dev/null
+++ b/lib/isc/include/isc/portset.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: portset.h,v 1.3.6.2 2008/06/25 23:45:37 tbox Exp $ */
+
+/*! \file isc/portset.h
+ * \brief Transport Protocol Port Manipuration Module
+ *
+ * This module provides simple utilities to handle a set of transport protocol
+ * (UDP or TCP) port numbers, e.g., for creating an ACL list.  An isc_portset_t
+ * object is an opaque instance of a port set, for which the user can add or
+ * remove a specific port or a range of consecutive ports.  This object is
+ * expected to be used as a temporary work space only, and does not protect
+ * simultaneous access from multiple threads.  Therefore it must not be stored
+ * in a place that can be accessed from multiple threads.
+ */
+
+#ifndef ISC_PORTSET_H
+#define ISC_PORTSET_H 1
+
+/***
+ ***	Imports
+ ***/
+
+#include 
+
+/***
+ *** Functions
+ ***/
+
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp);
+/*%<
+ * Create a port set and initialize it as an empty set.
+ *
+ * Requires:
+ *\li	'mctx' to be valid.
+ *\li	'portsetp' to be non NULL and '*portsetp' to be NULL;
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ */
+
+void
+isc_portset_destroy(isc_mem_t *mctx, isc_portset_t **portsetp);
+/*%<
+ * Destroy a port set.
+ *
+ * Requires:
+ *\li	'mctx' to be valid and must be the same context given when the port set
+ *       was created.
+ *\li	'*portsetp' to be a valid set.
+ */
+
+isc_boolean_t
+isc_portset_isset(isc_portset_t *portset, in_port_t port);
+/*%<
+ * Test whether the given port is stored in the portset.
+ *
+ * Requires:
+ *\li	'portset' to be a valid set.
+ *
+ * Returns
+ * \li	#ISC_TRUE if the port is found, ISC_FALSE otherwise.
+ */
+
+unsigned int
+isc_portset_nports(isc_portset_t *portset);
+/*%<
+ * Provides the number of ports stored in the given portset.
+ *
+ * Requires:
+ *\li	'portset' to be a valid set.
+ *
+ * Returns
+ * \li	the number of ports stored in portset.
+ */
+
+void
+isc_portset_add(isc_portset_t *portset, in_port_t port);
+/*%<
+ * Add the given port to the portset.  The port may or may not be stored in
+ * the portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ */
+
+void
+isc_portset_remove(isc_portset_t *portset, in_port_t port);
+/*%<
+ * Remove the given port to the portset.  The port may or may not be stored in
+ * the portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ */
+
+void
+isc_portset_addrange(isc_portset_t *portset, in_port_t port_lo,
+		     in_port_t port_hi);
+/*%<
+ * Add a subset of [port_lo, port_hi] (inclusive) to the portset.  Ports in the
+ * subset may or may not be stored in portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ *\li	port_lo <= port_hi
+ */
+
+void
+isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo,
+			in_port_t port_hi);
+/*%<
+ * Subtract a subset of [port_lo, port_hi] (inclusive) from the portset.  Ports
+ * in the subset may or may not be stored in portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ *\li	port_lo <= port_hi
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif	/* ISC_NETADDR_H */
diff --git a/lib/isc/include/isc/resource.h b/lib/isc/include/isc/resource.h
index 1d4cb3023a4a3..fbd9e287ae849 100644
--- a/lib/isc/include/isc/resource.h
+++ b/lib/isc/include/isc/resource.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resource.h,v 1.4.206.1.34.2 2008/07/23 23:47:49 tbox Exp $ */
+/* $Id: resource.h,v 1.4.206.3 2008/08/01 23:45:29 tbox Exp $ */
 
 #ifndef ISC_RESOURCE_H
 #define ISC_RESOURCE_H 1
@@ -80,16 +80,13 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value);
  */
 
 isc_result_t
-isc_resource_curlimit(isc_resource_t resource, isc_resourcevalue_t *value);
-/*
- * Get the current limit on a resource.
- *
- * Requires:
- *	'resource' is a valid member of the isc_resource_t enumeration.
+isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value);
+/*%<
+ * Same as isc_resource_getlimit(), but returns the current (soft) limit.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success.
- *	ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
+ *\li	#ISC_R_SUCCESS		Success.
+ *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/socket.h b/lib/isc/include/isc/socket.h
index 0537a0d6693bf..73ffb2daffd91 100644
--- a/lib/isc/include/isc/socket.h
+++ b/lib/isc/include/isc/socket.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.h,v 1.54.12.7.4.4 2008/07/23 23:16:27 marka Exp $ */
+/* $Id: socket.h,v 1.54.12.16 2008/09/11 06:14:46 each Exp $ */
 
 #ifndef ISC_SOCKET_H
 #define ISC_SOCKET_H 1
@@ -103,6 +103,7 @@ struct isc_socketevent {
 	isc_time_t		timestamp;	/* timestamp of packet recv */
 	struct in6_pktinfo	pktinfo;	/* ipv6 pktinfo */
 	isc_uint32_t		attributes;	/* see below */
+	isc_eventdestructor_t	destroy;	/* original destructor */
 };
 
 typedef struct isc_socket_newconnev isc_socket_newconnev_t;
@@ -311,9 +312,54 @@ isc_socket_detach(isc_socket_t **socketp);
  *		All resources used by the socket have been freed
  */
 
+isc_result_t
+isc_socket_open(isc_socket_t *sock);
+/*
+ * Open a new socket file descriptor of the given socket structure.  It simply
+ * opens a new descriptor; all of the other parameters including the socket
+ * type are inherited from the existing socket.  This function is provided to
+ * avoid overhead of destroying and creating sockets when many short-lived
+ * sockets are frequently opened and closed.  When the efficiency is not an
+ * issue, it should be safer to detach the unused socket and re-create a new
+ * one.  This optimization may not be available for some systems, in which
+ * case this function will return ISC_R_NOTIMPLEMENTED and must not be used.
+ *
+ * Requires:
+ *
+ * \li	there must be no other reference to this socket.
+ *
+ * \li	'socket' is a valid and previously closed by isc_socket_close()
+ *
+ * Returns:
+ *	Same as isc_socket_create().
+ * \li	ISC_R_NOTIMPLEMENTED
+ */
+
+isc_result_t
+isc_socket_close(isc_socket_t *sock);
+/*
+ * Close a socket file descriptor of the given socket structure.  This function
+ * is provided as an alternative to destroying an unused socket when overhead
+ * destroying/re-creating sockets can be significant, and is expected to be
+ * used with isc_socket_open().  This optimization may not be available for some
+ * systems, in which case this function will return ISC_R_NOTIMPLEMENTED and
+ * must not be used.
+ *
+ * Requires:
+ *
+ * \li	The socket must have a valid descriptor.
+ *
+ * \li	There must be no other reference to this socket.
+ *
+ * \li	There must be no pending I/O requests.
+ *
+ * Returns:
+ * \li	#ISC_R_NOTIMPLEMENTED
+ */
+
 isc_result_t
 isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *addressp,
-		unsigned int reuseaddr);
+		unsigned int options);
 /*
  * Bind 'socket' to '*addressp'.
  *
@@ -624,6 +670,7 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region,
  *	ISC_R_INPROGRESS
  *	ISC_R_NOMEMORY
  *	ISC_R_UNEXPECTED
+ *	ISC_R_NOTIMPLEMENTED
  *
  * Event results:
  *
@@ -634,8 +681,14 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region,
 
 isc_result_t
 isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp);
+
+isc_result_t
+isc_socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp,
+		      unsigned int maxsocks);
 /*
- * Create a socket manager.
+ * Create a socket manager.  If "maxsocks" is non-zero, it specifies the
+ * maximum number of sockets that the created manager should handle.
+ * isc_socketmgr_create() is equivalent of isc_socketmgr_create2() with
  *
  * Notes:
  *
@@ -658,6 +711,22 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp);
  *	ISC_R_UNEXPECTED
  */
 
+isc_result_t
+isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp);
+/*%<
+ * Returns in "*nsockp" the maximum number of sockets this manager may open.
+ *
+ * Requires:
+ *
+ *\li	'*manager' is a valid isc_socketmgr_t.
+ *\li	'nsockp' is not NULL.
+ *
+ * Returns:
+ *
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOTIMPLEMENTED
+ */
+
 void
 isc_socketmgr_destroy(isc_socketmgr_t **managerp);
 /*
diff --git a/lib/isc/include/isc/timer.h b/lib/isc/include/isc/timer.h
index 9d4cc00000a83..4b39c6220b609 100644
--- a/lib/isc/include/isc/timer.h
+++ b/lib/isc/include/isc/timer.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.h,v 1.28.12.9.4.2 2008/07/24 23:47:44 tbox Exp $ */
+/* $Id: timer.h,v 1.28.12.11 2008/06/25 23:45:37 tbox Exp $ */
 
 #ifndef ISC_TIMER_H
 #define ISC_TIMER_H 1
diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
index fad77da99e7be..d5f010092889e 100644
--- a/lib/isc/include/isc/types.h
+++ b/lib/isc/include/isc/types.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: types.h,v 1.32.2.3.2.1 2004/03/06 08:14:50 marka Exp $ */
+/* $Id: types.h,v 1.32.2.3.2.3 2008/06/25 23:45:37 tbox Exp $ */
 
 #ifndef ISC_TYPES_H
 #define ISC_TYPES_H 1
@@ -66,6 +66,7 @@ typedef struct isc_mempool		isc_mempool_t;
 typedef struct isc_msgcat		isc_msgcat_t;
 typedef struct isc_ondestroy		isc_ondestroy_t;
 typedef struct isc_netaddr		isc_netaddr_t;
+typedef struct isc_portset		isc_portset_t;
 typedef struct isc_quota		isc_quota_t;
 typedef struct isc_random		isc_random_t;
 typedef struct isc_ratelimiter		isc_ratelimiter_t;
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index 8bfe967295c9b..69f6cab9ea7b5 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.c,v 1.98.2.7.2.12 2007/11/26 23:45:51 tbox Exp $ */
+/* $Id: mem.c,v 1.98.2.7.2.14 2008/04/28 23:45:37 tbox Exp $ */
 
 #include 
 
@@ -604,7 +604,7 @@ mem_get(isc_mem_t *ctx, size_t size) {
 
 	ret = (ctx->memalloc)(ctx->arg, size);
 	if (ret == NULL)
-		ctx->memalloc_failures++;	
+		ctx->memalloc_failures++;
 
 #if ISC_MEM_FILL
 	if (ret != NULL)
@@ -1036,7 +1036,6 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) {
 	ADD_TRACE(ctx, ptr, size, file, line);
 	if (ctx->hi_water != 0U && !ctx->hi_called &&
 	    ctx->inuse > ctx->hi_water) {
-		ctx->hi_called = ISC_TRUE;
 		call_water = ISC_TRUE;
 	}
 	if (ctx->inuse > ctx->maxinuse) {
@@ -1078,10 +1077,8 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 	 * when the context was pushed over hi_water but then had
 	 * isc_mem_setwater() called with 0 for hi_water and lo_water.
 	 */
-	if (ctx->hi_called && 
+	if (ctx->hi_called &&
 	    (ctx->inuse < ctx->lo_water || ctx->lo_water == 0U)) {
-		ctx->hi_called = ISC_FALSE;
-
 		if (ctx->water != NULL)
 			call_water = ISC_TRUE;
 	}
@@ -1091,6 +1088,18 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 		(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER);
 }
 
+void
+isc_mem_waterack(isc_mem_t *ctx, int flag) {
+	REQUIRE(VALID_CONTEXT(ctx));
+
+	LOCK(&ctx->lock);
+	if (flag == ISC_MEM_LOWATER)
+		ctx->hi_called = ISC_FALSE;
+	else if (flag == ISC_MEM_HIWATER)
+		ctx->hi_called = ISC_TRUE;
+	UNLOCK(&ctx->lock);
+}
+
 #if ISC_MEM_TRACKLINES
 static void
 print_active(isc_mem_t *mctx, FILE *out) {
@@ -1110,7 +1119,7 @@ print_active(isc_mem_t *mctx, FILE *out) {
 					"\tptr %p size %u file %s line %u\n");
 		for (i = 0; i <= mctx->max_size; i++) {
 			dl = ISC_LIST_HEAD(mctx->debuglist[i]);
-			
+
 			if (dl != NULL)
 				found = ISC_TRUE;
 
diff --git a/lib/isc/portset.c b/lib/isc/portset.c
new file mode 100644
index 0000000000000..90e95968fc3b6
--- /dev/null
+++ b/lib/isc/portset.c
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: portset.c,v 1.4.2.1 2008/06/25 00:03:29 jinmei Exp $ */
+
+/*! \file */
+
+#include 
+
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#define ISC_PORTSET_BUFSIZE (65536 / (sizeof(isc_uint32_t) * 8))
+
+/*%
+ * Internal representation of portset.  It's an array of 32-bit integers, each
+ * bit corresponding to a single port in the ascending order.  For example,
+ * the second most significant bit of buf[0] corresponds to port 1.
+ */
+struct isc_portset {
+	unsigned int nports;	/*%< number of ports in the set */
+	isc_uint32_t buf[ISC_PORTSET_BUFSIZE];
+};
+
+static inline isc_boolean_t
+portset_isset(isc_portset_t *portset, in_port_t port) {
+	return (ISC_TF((portset->buf[port >> 5] & (1 << (port & 31))) != 0));
+}
+
+static inline void
+portset_add(isc_portset_t *portset, in_port_t port) {
+	if (!portset_isset(portset, port)) {
+		portset->nports++;
+		portset->buf[port >> 5] |= (1 << (port & 31));
+	}
+}
+
+static inline void
+portset_remove(isc_portset_t *portset, in_port_t port) {
+	if (portset_isset(portset, port)) {
+		portset->nports--;
+		portset->buf[port >> 5] &= ~(1 << (port & 31));
+	}
+}
+
+isc_result_t
+isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp) {
+	isc_portset_t *portset;
+
+	REQUIRE(portsetp != NULL && *portsetp == NULL);
+
+	portset = isc_mem_get(mctx, sizeof(*portset));
+	if (portset == NULL)
+		return (ISC_R_NOMEMORY);
+
+	/* Make the set 'empty' by default */
+	memset(portset, 0, sizeof(*portset));
+	*portsetp = portset;
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+isc_portset_destroy(isc_mem_t *mctx, isc_portset_t **portsetp) {
+	isc_portset_t *portset;
+
+	REQUIRE(portsetp != NULL);
+	portset = *portsetp;
+
+	isc_mem_put(mctx, portset, sizeof(*portset));
+}
+
+isc_boolean_t
+isc_portset_isset(isc_portset_t *portset, in_port_t port) {
+	REQUIRE(portset != NULL);
+
+	return (portset_isset(portset, port));
+}
+
+unsigned int
+isc_portset_nports(isc_portset_t *portset) {
+	REQUIRE(portset != NULL);
+
+	return (portset->nports);
+}
+
+void
+isc_portset_add(isc_portset_t *portset, in_port_t port) {
+	REQUIRE(portset != NULL);
+
+	portset_add(portset, port);
+}
+
+void
+isc_portset_remove(isc_portset_t *portset, in_port_t port) {
+	portset_remove(portset, port);
+}
+
+void
+isc_portset_addrange(isc_portset_t *portset, in_port_t port_lo,
+		     in_port_t port_hi)
+{
+	in_port_t p;
+
+	REQUIRE(portset != NULL);
+	REQUIRE(port_lo <= port_hi);
+
+	p = port_lo;
+	do {
+		portset_add(portset, p);
+	} while (p++ < port_hi);
+}
+
+void
+isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo,
+			in_port_t port_hi)
+{
+	in_port_t p;
+
+	REQUIRE(portset != NULL);
+	REQUIRE(port_lo <= port_hi);
+
+	p = port_lo;
+	do {
+		portset_remove(portset, p);
+	} while (p++ < port_hi);
+}
diff --git a/lib/isc/print.c b/lib/isc/print.c
index ee50b29e5d6d1..e4e4a709f7c47 100644
--- a/lib/isc/print.c
+++ b/lib/isc/print.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print.c,v 1.22.2.3.2.4 2006/04/17 18:27:20 explorer Exp $ */
+/* $Id: print.c,v 1.22.2.3.2.6 2008/04/28 23:45:38 tbox Exp $ */
 
 /*! \file */
 
@@ -246,8 +246,24 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 						head = "";
 					tmpui = tmpi;
 				}
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "u",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lu",
+						(unsigned long)tmpui);
+				else {
+					unsigned long mid;
+					unsigned long lo;
+					unsigned long hi;
+					lo = tmpui % 1000000000;
+					tmpui /= 1000000000;
+					mid = tmpui % 1000000000;
+					hi = tmpui / 1000000000;
+					if (hi != 0)
+						sprintf(buf, "%lu", hi);
+					else
+						buf[0] = '\n';
+					sprintf(buf + strlen(buf), "%lu", mid);
+					sprintf(buf + strlen(buf), "%lu", lo);
+				}
 				goto printint;
 			case 'o':
 				if (q)
@@ -256,10 +272,29 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					tmpui = va_arg(ap, long int);
 				else
 					tmpui = va_arg(ap, int);
-				sprintf(buf,
-					alt ? "%#" ISC_PRINT_QUADFORMAT "o"
-					    : "%" ISC_PRINT_QUADFORMAT "o",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, alt ?  "%#lo" : "%lo",
+						(unsigned long)tmpui);
+				else {
+					unsigned long mid;
+					unsigned long lo;
+					unsigned long hi;
+					lo = tmpui % 010000000000;
+					tmpui /= 010000000000;
+					mid = tmpui % 010000000000;
+					hi = tmpui / 010000000000;
+					if (hi != 0) {
+						sprintf(buf,
+							alt ?  "%#lo" : "%lo",
+							hi);
+						sprintf(buf + strlen(buf),
+							"%lo", mid);
+					} else
+						sprintf(buf,
+							alt ?  "%#lo" : "%lo",
+							mid);
+					sprintf(buf + strlen(buf), "%lo", lo);
+				}
 				goto printint;
 			case 'u':
 				if (q)
@@ -268,8 +303,24 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					tmpui = va_arg(ap, unsigned long int);
 				else
 					tmpui = va_arg(ap, unsigned int);
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "u",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lu",
+						(unsigned long)tmpui);
+				else {
+					unsigned long mid;
+					unsigned long lo;
+					unsigned long hi;
+					lo = tmpui % 1000000000;
+					tmpui /= 1000000000;
+					mid = tmpui % 1000000000;
+					hi = tmpui / 1000000000;
+					if (hi != 0)
+						sprintf(buf, "%lu", hi);
+					else
+						buf[0] = '\n';
+					sprintf(buf + strlen(buf), "%lu", mid);
+					sprintf(buf + strlen(buf), "%lu", lo);
+				}
 				goto printint;
 			case 'x':
 				if (q)
@@ -283,8 +334,15 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					if (precision > 2)
 						precision -= 2;
 				}
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "x",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lx",
+						(unsigned long)tmpui);
+				else {
+					unsigned long hi = tmpui>>32;
+					unsigned long lo = tmpui & 0xffffffff;
+					sprintf(buf, "%lx", hi);
+					sprintf(buf + strlen(buf), "%lx", lo);
+				}
 				goto printint;
 			case 'X':
 				if (q)
@@ -298,8 +356,15 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					if (precision > 2)
 						precision -= 2;
 				}
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "X",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lX",
+						(unsigned long)tmpui);
+				else  {
+					unsigned long hi = tmpui>>32;
+					unsigned long lo = tmpui & 0xffffffff;
+					sprintf(buf, "%lX", hi);
+					sprintf(buf + strlen(buf), "%lX", lo);
+				}
 				goto printint;
 			printint:
 				if (precision != 0 || width != 0) {
diff --git a/lib/isc/pthreads/mutex.c b/lib/isc/pthreads/mutex.c
index 17cca53fc6a72..ef7db0de9709d 100644
--- a/lib/isc/pthreads/mutex.c
+++ b/lib/isc/pthreads/mutex.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutex.c,v 1.6.26.8 2007/08/28 07:19:17 tbox Exp $ */
+/* $Id: mutex.c,v 1.6.26.10 2008/04/04 23:45:32 tbox Exp $ */
 
 #include 
 
@@ -31,23 +31,23 @@
 /* Operations on timevals; adapted from FreeBSD's sys/time.h */
 #define timevalclear(tvp)      ((tvp)->tv_sec = (tvp)->tv_usec = 0)
 #define timevaladd(vvp, uvp)                                            \
-        do {                                                            \
-                (vvp)->tv_sec += (uvp)->tv_sec;                         \
-                (vvp)->tv_usec += (uvp)->tv_usec;                       \
-                if ((vvp)->tv_usec >= 1000000) {                        \
-                        (vvp)->tv_sec++;                                \
-                        (vvp)->tv_usec -= 1000000;                      \
-                }                                                       \
-        } while (0)
+	do {                                                            \
+		(vvp)->tv_sec += (uvp)->tv_sec;                         \
+		(vvp)->tv_usec += (uvp)->tv_usec;                       \
+		if ((vvp)->tv_usec >= 1000000) {                        \
+			(vvp)->tv_sec++;                                \
+			(vvp)->tv_usec -= 1000000;                      \
+		}                                                       \
+	} while (0)
 #define timevalsub(vvp, uvp)                                            \
-        do {                                                            \
-                (vvp)->tv_sec -= (uvp)->tv_sec;                         \
-                (vvp)->tv_usec -= (uvp)->tv_usec;                       \
-                if ((vvp)->tv_usec < 0) {                               \
-                        (vvp)->tv_sec--;                                \
-                        (vvp)->tv_usec += 1000000;                      \
-                }                                                       \
-        } while (0)
+	do {                                                            \
+		(vvp)->tv_sec -= (uvp)->tv_sec;                         \
+		(vvp)->tv_usec -= (uvp)->tv_usec;                       \
+		if ((vvp)->tv_usec < 0) {                               \
+			(vvp)->tv_sec--;                                \
+			(vvp)->tv_usec += 1000000;                      \
+		}                                                       \
+	} while (0)
 
 #define ISC_MUTEX_MAX_LOCKERS 32
 
@@ -70,8 +70,11 @@ struct isc_mutexstats {
 	isc_mutexlocker_t	lockers[ISC_MUTEX_MAX_LOCKERS];
 };
 
-#define TABLESIZE (8 * 1024)
-static isc_mutexstats_t stats[TABLESIZE];
+#ifndef ISC_MUTEX_PROFTABLESIZE
+#define ISC_MUTEX_PROFTABLESIZE (16 * 1024)
+#endif
+static isc_mutexstats_t stats[ISC_MUTEX_PROFTABLESIZE];
+static int stats_next = 0;
 static isc_boolean_t stats_init = ISC_FALSE;
 static pthread_mutex_t statslock = PTHREAD_MUTEX_INITIALIZER;
 
@@ -85,21 +88,19 @@ isc_mutex_init_profile(isc_mutex_t *mp, const char *file, int line) {
 
 	RUNTIME_CHECK(pthread_mutex_lock(&statslock) == 0);
 
-	if (stats_init == ISC_FALSE) {
-		for (i = 0; i < TABLESIZE; i++) {
-			stats[i].file = NULL;
-		}
+	if (stats_init == ISC_FALSE)
 		stats_init = ISC_TRUE;
-	}
 
-	mp->stats = NULL;
-	for (i = 0; i < TABLESIZE; i++) {
-		if (stats[i].file == NULL) {
-			mp->stats = &stats[i];
-			break;
-		}
-	}
-	RUNTIME_CHECK(mp->stats != NULL);
+	/*
+	 * If all statistics entries have been used, give up and trigger an
+	 * assertion failure.  There would be no other way to deal with this
+	 * because we'd like to keep record of all locks for the purpose of
+	 * debugging and the number of necessary locks is unpredictable.
+	 * If this failure is triggered while debugging, named should be
+	 * rebuilt with an increased ISC_MUTEX_PROFTABLESIZE.
+	 */
+	RUNTIME_CHECK(stats_next < ISC_MUTEX_PROFTABLESIZE);
+	mp->stats = &stats[stats_next++];
 
 	RUNTIME_CHECK(pthread_mutex_unlock(&statslock) == 0);
 
@@ -186,10 +187,9 @@ void
 isc_mutex_statsprofile(FILE *fp) {
 	isc_mutexlocker_t *locker;
 	int i, j;
+
 	fprintf(fp, "Mutex stats (in us)\n");
-	for (i = 0; i < TABLESIZE; i++) {
-		if (stats[i].file == NULL)
-			continue;
+	for (i = 0; i < stats_next; i++) {
 		fprintf(fp, "%-12s %4d: %10u  %lu.%06lu %lu.%06lu\n",
 			stats[i].file, stats[i].line, stats[i].count,
 			stats[i].locked_total.tv_sec,
@@ -225,7 +225,7 @@ isc_mutex_init_errcheck(isc_mutex_t *mp)
 
 	if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK) != 0)
 		return ISC_R_UNEXPECTED;
-  
+
 	if (pthread_mutex_init(mp, &attr) != 0)
 		return ISC_R_UNEXPECTED;
 
diff --git a/lib/isc/timer.c b/lib/isc/timer.c
index 990f2943cd6cf..75508563ca1df 100644
--- a/lib/isc/timer.c
+++ b/lib/isc/timer.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.c,v 1.64.12.17.4.3 2008/07/29 18:34:29 jinmei Exp $ */
+/* $Id: timer.c,v 1.64.12.20 2008/08/22 05:59:24 marka Exp $ */
 
 #include 
 
diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
index 382e445ead5c9..daf4b2f495e76 100644
--- a/lib/isc/unix/app.c
+++ b/lib/isc/unix/app.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: app.c,v 1.43.2.3.8.8.4.1 2008/07/29 04:43:57 each Exp $ */
+/* $Id: app.c,v 1.43.2.3.8.11 2008/10/15 03:41:17 marka Exp $ */
 
 #include 
 
@@ -28,6 +28,9 @@
 #include 
 #include 
 #include 
+#ifdef HAVE_EPOLL
+#include 
+#endif
 
 #include 
 #include 
@@ -295,14 +298,13 @@ isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
  * Event loop for nonthreaded programs.
  */
 static isc_result_t
-evloop() {
+evloop(void) {
 	isc_result_t result;
 	while (!want_shutdown) {
 		int n;
 		isc_time_t when, now;
 		struct timeval tv, *tvp;
-		fd_set *readfds, *writefds;
-		int maxfd;
+		isc_socketwait_t *swait;
 		isc_boolean_t readytasks;
 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
 
@@ -329,8 +331,8 @@ evloop() {
 			}
 		}
 
-		isc__socketmgr_getfdsets(&readfds, &writefds, &maxfd);
-		n = select(maxfd, readfds, writefds, NULL, tvp);
+		swait = NULL;
+		n = isc__socketmgr_waitevents(tvp, &swait);
 
 		if (n == 0 || call_timer_dispatch) {
 			/*
@@ -350,8 +352,7 @@ evloop() {
 			isc__timermgr_dispatch();
 		}
 		if (n > 0)
-			(void)isc__socketmgr_dispatch(readfds, writefds,
-						      maxfd);
+			(void)isc__socketmgr_dispatch(swait);
 		(void)isc__taskmgr_dispatch();
 
 		if (want_reload) {
@@ -432,10 +433,10 @@ isc_app_run(void) {
 #ifdef ISC_PLATFORM_USETHREADS
 	sigset_t sset;
 	char strbuf[ISC_STRERRORSIZE];
-#endif /* ISC_PLATFORM_USETHREADS */
 #ifdef HAVE_SIGWAIT
 	int sig;
 #endif
+#endif /* ISC_PLATFORM_USETHREADS */
 
 #ifdef HAVE_LINUXTHREADS
 	REQUIRE(main_thread == pthread_self());
diff --git a/lib/isc/unix/include/isc/net.h b/lib/isc/unix/include/isc/net.h
index f1a015f5bb1d7..01c808fea611e 100644
--- a/lib/isc/unix/include/isc/net.h
+++ b/lib/isc/unix/include/isc/net.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.h,v 1.31.2.2.10.8 2004/04/29 01:31:23 marka Exp $ */
+/* $Id: net.h,v 1.31.2.2.10.10 2008/06/25 23:45:37 tbox Exp $ */
 
 #ifndef ISC_NET_H
 #define ISC_NET_H 1
@@ -101,7 +101,7 @@
 /*
  * Required for some pre RFC2133 implementations.
  * IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT were added in
- * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt.  
+ * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt.
  * If 's6_addr' is defined then assume that there is a union and three
  * levels otherwise assume two levels required.
  */
@@ -303,6 +303,23 @@ isc_net_enableipv4(void);
 void
 isc_net_enableipv6(void);
 
+isc_result_t
+isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high);
+/*
+ * Returns system's default range of ephemeral UDP ports, if defined.
+ * If the range is not available or unknown, ISC_NET_PORTRANGELOW and
+ * ISC_NET_PORTRANGEHIGH will be returned.
+ *
+ * Requires:
+ *
+ *\li	'low' and 'high' must be non NULL.
+ *
+ * Returns:
+ *
+ *\li	*low and *high will be the ports specifying the low and high ends of
+ *	the range.
+ */
+
 #ifdef ISC_PLATFORM_NEEDNTOP
 const char *
 isc_net_ntop(int af, const void *src, char *dst, size_t size);
diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c
index 42cadec7d7617..cd3abc64ed00e 100644
--- a/lib/isc/unix/net.c
+++ b/lib/isc/unix/net.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,10 +15,19 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.c,v 1.22.2.2.10.11 2007/09/13 23:45:58 tbox Exp $ */
+/* $Id: net.c,v 1.22.2.2.10.15 2008/07/04 23:45:39 tbox Exp $ */
 
 #include 
 
+#include 
+
+#if defined(HAVE_SYS_SYSCTL_H)
+#if defined(HAVE_SYS_PARAM_H)
+#include 
+#endif
+#include 
+#endif
+
 #include 
 #include 
 
@@ -30,6 +39,59 @@
 #include 
 #include 
 
+/*
+ * Definitions about UDP port range specification.  This is a total mess of
+ * portability variants: some use sysctl (but the sysctl names vary), some use
+ * system-specific interfaces, some have the same interface for IPv4 and IPv6,
+ * some separate them, etc...
+ */
+
+/*
+ * The last resort defaults: use all non well known port space
+ */
+#ifndef ISC_NET_PORTRANGELOW
+#define ISC_NET_PORTRANGELOW 1024
+#endif	/* ISC_NET_PORTRANGELOW */
+#ifndef ISC_NET_PORTRANGEHIGH
+#define ISC_NET_PORTRANGEHIGH 65535
+#endif	/* ISC_NET_PORTRANGEHIGH */
+
+#ifdef HAVE_SYSCTLBYNAME
+
+/*
+ * sysctl variants
+ */
+#if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
+#define USE_SYSCTL_PORTRANGE
+#define SYSCTL_V4PORTRANGE_LOW	"net.inet.ip.portrange.hifirst"
+#define SYSCTL_V4PORTRANGE_HIGH	"net.inet.ip.portrange.hilast"
+#define SYSCTL_V6PORTRANGE_LOW	"net.inet.ip.portrange.hifirst"
+#define SYSCTL_V6PORTRANGE_HIGH	"net.inet.ip.portrange.hilast"
+#endif
+
+#ifdef __NetBSD__
+#define USE_SYSCTL_PORTRANGE
+#define SYSCTL_V4PORTRANGE_LOW	"net.inet.ip.anonportmin"
+#define SYSCTL_V4PORTRANGE_HIGH	"net.inet.ip.anonportmax"
+#define SYSCTL_V6PORTRANGE_LOW	"net.inet6.ip6.anonportmin"
+#define SYSCTL_V6PORTRANGE_HIGH	"net.inet6.ip6.anonportmax"
+#endif
+
+#else /* !HAVE_SYSCTLBYNAME */
+
+#ifdef __OpenBSD__
+#define USE_SYSCTL_PORTRANGE
+#define SYSCTL_V4PORTRANGE_LOW	{ CTL_NET, PF_INET, IPPROTO_IP, \
+				  IPCTL_IPPORT_HIFIRSTAUTO }
+#define SYSCTL_V4PORTRANGE_HIGH	{ CTL_NET, PF_INET, IPPROTO_IP, \
+				  IPCTL_IPPORT_HILASTAUTO }
+/* Same for IPv6 */
+#define SYSCTL_V6PORTRANGE_LOW	SYSCTL_V4PORTRANGE_LOW
+#define SYSCTL_V6PORTRANGE_HIGH	SYSCTL_V4PORTRANGE_HIGH
+#endif
+
+#endif /* HAVE_SYSCTLBYNAME */
+
 #if defined(ISC_PLATFORM_HAVEIPV6)
 # if defined(ISC_PLATFORM_NEEDIN6ADDRANY)
 const struct in6_addr isc_net_in6addrany = IN6ADDR_ANY_INIT;
@@ -328,6 +390,101 @@ isc_net_probe_ipv6pktinfo(void) {
 	return (ipv6pktinfo_result);
 }
 
+#if defined(USE_SYSCTL_PORTRANGE)
+#if defined(HAVE_SYSCTLBYNAME)
+static isc_result_t
+getudpportrange_sysctl(int af, in_port_t *low, in_port_t *high) {
+	int port_low, port_high;
+	size_t portlen;
+	const char *sysctlname_lowport, *sysctlname_hiport;
+
+	if (af == AF_INET) {
+		sysctlname_lowport = SYSCTL_V4PORTRANGE_LOW;
+		sysctlname_hiport = SYSCTL_V4PORTRANGE_HIGH;
+	} else {
+		sysctlname_lowport = SYSCTL_V6PORTRANGE_LOW;
+		sysctlname_hiport = SYSCTL_V6PORTRANGE_HIGH;
+	}
+	portlen = sizeof(portlen);
+	if (sysctlbyname(sysctlname_lowport, &port_low, &portlen,
+			 NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+	portlen = sizeof(portlen);
+	if (sysctlbyname(sysctlname_hiport, &port_high, &portlen,
+			 NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+	if ((port_low & ~0xffff) != 0 || (port_high & ~0xffff) != 0)
+		return (ISC_R_RANGE);
+
+	*low = (in_port_t)port_low;
+	*high = (in_port_t)port_high;
+
+	return (ISC_R_SUCCESS);
+}
+#else /* !HAVE_SYSCTLBYNAME */
+static isc_result_t
+getudpportrange_sysctl(int af, in_port_t *low, in_port_t *high) {
+	int mib_lo4[4] = SYSCTL_V4PORTRANGE_LOW;
+	int mib_hi4[4] = SYSCTL_V4PORTRANGE_HIGH;
+	int mib_lo6[4] = SYSCTL_V6PORTRANGE_LOW;
+	int mib_hi6[4] = SYSCTL_V6PORTRANGE_HIGH;
+	int *mib_lo, *mib_hi, miblen;
+	int port_low, port_high;
+	size_t portlen;
+
+	if (af == AF_INET) {
+		mib_lo = mib_lo4;
+		mib_hi = mib_hi4;
+		miblen = sizeof(mib_lo4) / sizeof(mib_lo4[0]);
+	} else {
+		mib_lo = mib_lo6;
+		mib_hi = mib_hi6;
+		miblen = sizeof(mib_lo6) / sizeof(mib_lo6[0]);
+	}
+
+	portlen = sizeof(portlen);
+	if (sysctl(mib_lo, miblen, &port_low, &portlen, NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+
+	portlen = sizeof(portlen);
+	if (sysctl(mib_hi, miblen, &port_high, &portlen, NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+
+	if ((port_low & ~0xffff) != 0 || (port_high & ~0xffff) != 0)
+		return (ISC_R_RANGE);
+
+	*low = (in_port_t) port_low;
+	*high = (in_port_t) port_high;
+
+	return (ISC_R_SUCCESS);
+}
+#endif /* HAVE_SYSCTLBYNAME */
+#endif /* USE_SYSCTL_PORTRANGE */
+
+isc_result_t
+isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high) {
+	int result = ISC_R_FAILURE;
+
+	REQUIRE(low != NULL && high != NULL);
+
+#if defined(USE_SYSCTL_PORTRANGE)
+	result = getudpportrange_sysctl(af, low, high);
+#else
+	UNUSED(af);
+#endif
+
+	if (result != ISC_R_SUCCESS) {
+		*low = ISC_NET_PORTRANGELOW;
+		*high = ISC_NET_PORTRANGEHIGH;
+	}
+
+	return (ISC_R_SUCCESS);	/* we currently never fail in this function */
+}
+
 void
 isc_net_disableipv4(void) {
 	initialize();
diff --git a/lib/isc/unix/resource.c b/lib/isc/unix/resource.c
index a6280b7477e8a..dac9fcaa6c08c 100644
--- a/lib/isc/unix/resource.c
+++ b/lib/isc/unix/resource.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resource.c,v 1.11.206.3.4.3 2008/07/28 22:45:53 marka Exp $ */
+/* $Id: resource.c,v 1.11.206.7 2008/08/05 07:23:56 marka Exp $ */
 
 #include 
 
@@ -32,7 +32,7 @@
 #include 	/* To get the large NR_OPEN. */
 #endif
 
-#ifdef __hpux
+#if defined(__hpux) && defined(HAVE_SYS_DYNTUNE_H)
 #include 
 #endif
 
@@ -170,7 +170,7 @@ isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) {
 		if (unixresult == 0)
 			return (ISC_R_SUCCESS);
 	}
-#elif defined(__hpux)
+#elif defined(__hpux) && defined(HAVE_SYS_DYNTUNE_H)
 	if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) {
 		uint64_t maxfiles;
 		if (gettune("maxfiles_lim", &maxfiles) == 0) {
@@ -210,7 +210,7 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
 }
 
 isc_result_t
-isc_resource_curlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
+isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
 	int unixresult;
 	int unixresource;
 	struct rlimit rl;
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 3ee796c24bbaa..1508487945beb 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.207.2.19.2.35.4.6 2008/07/29 04:43:57 each Exp $ */
+/* $Id: socket.c,v 1.207.2.19.2.62 2008/11/20 00:07:38 jinmei Exp $ */
 
 #include 
 
@@ -52,20 +52,66 @@
 #include 
 #include 
 
+#ifdef ISC_PLATFORM_HAVESYSUNH
+#include 
+#endif
+#ifdef ISC_PLATFORM_HAVEKQUEUE
+#include 
+#endif
+#ifdef ISC_PLATFORM_HAVEEPOLL
+#include 
+#endif
+#ifdef ISC_PLATFORM_HAVEDEVPOLL
+#include 
+#endif
+
 #include "errno2result.h"
 
 #ifndef ISC_PLATFORM_USETHREADS
 #include "socket_p.h"
 #endif /* ISC_PLATFORM_USETHREADS */
 
-#if defined(SO_BSDCOMPAT) && defined(__linux__)
-#include 
-#endif
+/*
+ * Choose the most preferable multiplex method.
+ */
+#ifdef ISC_PLATFORM_HAVEKQUEUE
+#define USE_KQUEUE
+#elif defined (ISC_PLATFORM_HAVEEPOLL)
+#define USE_EPOLL
+#elif defined (ISC_PLATFORM_HAVEDEVPOLL)
+#define USE_DEVPOLL
+typedef struct {
+	unsigned int want_read : 1,
+		want_write : 1;
+} pollinfo_t;
+#else
+#define USE_SELECT
+#endif	/* ISC_PLATFORM_HAVEKQUEUE */
 
-/*%
- * Max number of open sockets.  In the vast majority of cases the default size  
- * of FD_SETSIZE should be fine, and this constant should be increased only
- * when absolutely necessary and possible, i.e., the server is exhausting all   
+#ifndef ISC_PLATFORM_USETHREADS
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+struct isc_socketwait {
+	int nevents;
+};
+#elif defined (USE_SELECT)
+struct isc_socketwait {
+	fd_set *readset;
+	fd_set *writeset;
+	int nfds;
+	int maxfd;
+};
+#endif	/* USE_KQUEUE */
+#endif /* !ISC_PLATFORM_USETHREADS */
+
+/*
+ * Maximum number of allowable open sockets.  This is also the maximum
+ * allowable socket file descriptor.
+ *
+ * Care should be taken before modifying this value for select():
+ * The API standard doesn't ensure select() accept more than (the system default
+ * of) FD_SETSIZE descriptors, and the default size should in fact be fine in
+ * the vast majority of cases.  This constant should therefore be increased only
+ * when absolutely necessary and possible, i.e., the server is exhausting all
  * available file descriptors (up to FD_SETSIZE) and the select() function
  * and FD_xxx macros support larger values than FD_SETSIZE (which may not
  * always by true, but we keep using some of them to ensure as much
@@ -76,21 +122,79 @@
  * As a special note, this value shouldn't have to be touched if
  * this is a build for an authoritative only DNS server.
  */
-
-#ifndef ISC_SOCKET_FDSETSIZE
-#define ISC_SOCKET_FDSETSIZE FD_SETSIZE
-#endif
-
+#ifndef ISC_SOCKET_MAXSOCKETS
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+#define ISC_SOCKET_MAXSOCKETS 4096
+#elif defined(USE_SELECT)
+#define ISC_SOCKET_MAXSOCKETS FD_SETSIZE
+#endif	/* USE_KQUEUE... */
+#endif	/* ISC_SOCKET_MAXSOCKETS */
+
+#ifdef USE_SELECT
 /*%
- * Mac OS X needs a special definition to support larger values in select()
+ * Mac OS X needs a special definition to support larger values in select().
+ * We always define this because a larger value can be specified run-time.
  */
-#if ISC_SOCKET_FDSETSIZE > FD_SETSIZE
 #ifdef __APPLE__
 #define _DARWIN_UNLIMITED_SELECT
 #endif	/* __APPLE__ */
+#endif	/* USE_SELECT */
+
+#ifdef ISC_SOCKET_USE_POLLWATCH
+/*
+ * If this macro is defined, enable workaround for a Solaris /dev/poll kernel
+ * bug: DP_POLL ioctl could keep sleeping even if socket I/O is possible for
+ * some of the specified FD.  The idea is based on the observation that it's
+ * likely for a busy server to keep receiving packets.  It specifically works
+ * as follows: the socket watcher is first initialized with the state of
+ * "poll_idle".  While it's in the idle state it keeps sleeping until a socket
+ * event occurs.  When it wakes up for a socket I/O event, it moves to the
+ * poll_active state, and sets the poll timeout to a short period
+ * (ISC_SOCKET_POLLWATCH_TIMEOUT msec).  If timeout occurs in this state, the
+ * watcher goes to the poll_checking state with the same timeout period.
+ * In this state, the watcher tries to detect whether this is a break
+ * during intermittent events or the kernel bug is triggered.  If the next
+ * polling reports an event within the short period, the previous timeout is
+ * likely to be a kernel bug, and so the watcher goes back to the active state.
+ * Otherwise, it moves to the idle state again.
+ *
+ * It's not clear whether this is a thread-related bug, but since we've only
+ * seen this with threads, this workaround is used only when enabling threads.
+ */
+
+typedef enum { poll_idle, poll_active, poll_checking } pollstate_t;
+
+#ifndef ISC_SOCKET_POLLWATCH_TIMEOUT
+#define ISC_SOCKET_POLLWATCH_TIMEOUT 10
+#endif	/* ISC_SOCKET_POLLWATCH_TIMEOUT */
+#endif	/* ISC_SOCKET_USE_POLLWATCH */
+
+/*
+ * Size of per-FD lock buckets.
+ */
+#ifdef ISC_PLATFORM_USETHREADS
+#define FDLOCK_COUNT		1024
+#define FDLOCK_ID(fd)		((fd) % FDLOCK_COUNT)
+#else
+#define FDLOCK_COUNT		1
+#define FDLOCK_ID(fd)		0
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+/*
+ * Maximum number of events communicated with the kernel.  There should normally
+ * be no need for having a large number.
+ */
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+#ifndef ISC_SOCKET_MAXEVENTS
+#define ISC_SOCKET_MAXEVENTS	64
+#endif
 #endif
 
-/*%
+#if defined(SO_BSDCOMPAT) && defined(__linux__)
+#include 
+#endif
+
+/*
  * Some systems define the socket length argument as an int, some as size_t,
  * some as socklen_t.  This is here so it can be easily changed if needed.
  */
@@ -218,22 +322,50 @@ struct isc_socketmgr {
 	unsigned int		magic;
 	isc_mem_t	       *mctx;
 	isc_mutex_t		lock;
+	isc_mutex_t		*fdlock;
+#ifdef USE_KQUEUE
+	int			kqueue_fd;
+	int			nevents;
+	struct kevent		*events;
+#endif	/* USE_KQUEUE */
+#ifdef USE_EPOLL
+	int			epoll_fd;
+	int			nevents;
+	struct epoll_event	*events;
+#endif	/* USE_EPOLL */
+#ifdef USE_DEVPOLL
+	int			devpoll_fd;
+	int			nevents;
+	struct pollfd		*events;
+#endif	/* USE_DEVPOLL */
+#ifdef USE_SELECT
 	int			fd_bufsize;
-	int			fdsize;
+#endif	/* USE_SELECT */
+	unsigned int		maxsocks;
+#ifdef ISC_PLATFORM_USETHREADS
+	int			pipe_fds[2];
+#endif
+
+	/* Locked by fdlock. */
+	isc_socket_t	       **fds;
+	int			*fdstate;
+#ifdef USE_DEVPOLL
+	pollinfo_t		*fdpollinfo;
+#endif
+
 	/* Locked by manager lock. */
 	ISC_LIST(isc_socket_t)	socklist;
+#ifdef USE_SELECT
 	fd_set			*read_fds;
 	fd_set			*read_fds_copy;
 	fd_set			*write_fds;
 	fd_set			*write_fds_copy;
-	isc_socket_t	       **fds;
-	int			*fdstate;
 	int			maxfd;
-	int			reserved; 	/* unlocked */
+#endif	/* USE_SELECT */
+	int			reserved;	/* unlocked */
 #ifdef ISC_PLATFORM_USETHREADS
 	isc_thread_t		watcher;
 	isc_condition_t		shutdown_ok;
-	int			pipe_fds[2];
 #else /* ISC_PLATFORM_USETHREADS */
 	unsigned int		refs;
 #endif /* ISC_PLATFORM_USETHREADS */
@@ -272,8 +404,9 @@ static void build_msghdr_send(isc_socket_t *, isc_socketevent_t *,
 			      struct msghdr *, struct iovec *, size_t *);
 static void build_msghdr_recv(isc_socket_t *, isc_socketevent_t *,
 			      struct msghdr *, struct iovec *, size_t *);
-static void cleanup_fdsets(isc_socketmgr_t *, isc_mem_t *);
-static isc_result_t create_fdsets(isc_socketmgr_t *, isc_mem_t *);
+#ifdef ISC_PLATFORM_USETHREADS
+static isc_boolean_t process_ctlfd(isc_socketmgr_t *manager);
+#endif
 
 #define SELECT_POKE_SHUTDOWN		(-1)
 #define SELECT_POKE_NOTHING		(-2)
@@ -342,9 +475,195 @@ socket_log(isc_socket_t *sock, isc_sockaddr_t *address,
 	}
 }
 
+#if defined(_AIX) && defined(ISC_NET_BSD44MSGHDR) && \
+    defined(USE_CMSG) && defined(IPV6_RECVPKTINFO)
+/*
+ * AIX has a kernel bug where IPV6_RECVPKTINFO gets cleared by
+ * setting IPV6_V6ONLY.
+ */
+static void
+FIX_IPV6_RECVPKTINFO(isc_socket_t *sock)
+{
+	char strbuf[ISC_STRERRORSIZE];
+	int on = 1;
+
+	if (sock->pf != AF_INET6 || sock->type != isc_sockettype_udp)
+		return;
+
+	if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
+		       (void *)&on, sizeof(on)) < 0) {
+
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "setsockopt(%d, IPV6_RECVPKTINFO) "
+				 "%s: %s", sock->fd,
+				 isc_msgcat_get(isc_msgcat,
+						ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED,
+						"failed"),
+				 strbuf);
+	}
+}
+#else
+#define FIX_IPV6_RECVPKTINFO(sock) (void)0
+#endif
+
+static inline isc_result_t
+watch_fd(isc_socketmgr_t *manager, int fd, int msg) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+#ifdef USE_KQUEUE
+	struct kevent evchange;
+
+	memset(&evchange, 0, sizeof(evchange));
+	if (msg == SELECT_POKE_READ)
+		evchange.filter = EVFILT_READ;
+	else
+		evchange.filter = EVFILT_WRITE;
+	evchange.flags = EV_ADD;
+	evchange.ident = fd;
+	if (kevent(manager->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0)
+		result = isc__errno2result(errno);
+
+	return (result);
+#elif defined(USE_EPOLL)
+	struct epoll_event event;
+
+	if (msg == SELECT_POKE_READ)
+		event.events = EPOLLIN;
+	else
+		event.events = EPOLLOUT;
+	event.data.fd = fd;
+	if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_ADD, fd, &event) == -1 &&
+	    errno != EEXIST) {
+		result = isc__errno2result(errno);
+	}
+
+	return (result);
+#elif defined(USE_DEVPOLL)
+	struct pollfd pfd;
+	int lockid = FDLOCK_ID(fd);
+
+	memset(&pfd, 0, sizeof(pfd));
+	if (msg == SELECT_POKE_READ)
+		pfd.events = POLLIN;
+	else
+		pfd.events = POLLOUT;
+	pfd.fd = fd;
+	pfd.revents = 0;
+	LOCK(&manager->fdlock[lockid]);
+	if (write(manager->devpoll_fd, &pfd, sizeof(pfd)) == -1)
+		result = isc__errno2result(errno);
+	else {
+		if (msg == SELECT_POKE_READ)
+			manager->fdpollinfo[fd].want_read = 1;
+		else
+			manager->fdpollinfo[fd].want_write = 1;
+	}
+	UNLOCK(&manager->fdlock[lockid]);
+
+	return (result);
+#elif defined(USE_SELECT)
+	LOCK(&manager->lock);
+	if (msg == SELECT_POKE_READ)
+		FD_SET(fd, manager->read_fds);
+	if (msg == SELECT_POKE_WRITE)
+		FD_SET(fd, manager->write_fds);
+	UNLOCK(&manager->lock);
+
+	return (result);
+#endif
+}
+
+static inline isc_result_t
+unwatch_fd(isc_socketmgr_t *manager, int fd, int msg) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+#ifdef USE_KQUEUE
+	struct kevent evchange;
+
+	memset(&evchange, 0, sizeof(evchange));
+	if (msg == SELECT_POKE_READ)
+		evchange.filter = EVFILT_READ;
+	else
+		evchange.filter = EVFILT_WRITE;
+	evchange.flags = EV_DELETE;
+	evchange.ident = fd;
+	if (kevent(manager->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0)
+		result = isc__errno2result(errno);
+
+	return (result);
+#elif defined(USE_EPOLL)
+	struct epoll_event event;
+
+	if (msg == SELECT_POKE_READ)
+		event.events = EPOLLIN;
+	else
+		event.events = EPOLLOUT;
+	event.data.fd = fd;
+	if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_DEL, fd, &event) == -1 &&
+	    errno != ENOENT) {
+		char strbuf[ISC_STRERRORSIZE];
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "epoll_ctl(DEL), %d: %s", fd, strbuf);
+		result = ISC_R_UNEXPECTED;
+	}
+	return (result);
+#elif defined(USE_DEVPOLL)
+	struct pollfd pfds[2];
+	size_t writelen = sizeof(pfds[0]);
+	int lockid = FDLOCK_ID(fd);
+
+	memset(pfds, 0, sizeof(pfds));
+	pfds[0].events = POLLREMOVE;
+	pfds[0].fd = fd;
+
+	/*
+	 * Canceling read or write polling via /dev/poll is tricky.  Since it
+	 * only provides a way of canceling per FD, we may need to re-poll the
+	 * socket for the other operation.
+	 */
+	LOCK(&manager->fdlock[lockid]);
+	if (msg == SELECT_POKE_READ &&
+	    manager->fdpollinfo[fd].want_write == 1) {
+		pfds[1].events = POLLOUT;
+		pfds[1].fd = fd;
+		writelen += sizeof(pfds[1]);
+	}
+	if (msg == SELECT_POKE_WRITE &&
+	    manager->fdpollinfo[fd].want_read == 1) {
+		pfds[1].events = POLLIN;
+		pfds[1].fd = fd;
+		writelen += sizeof(pfds[1]);
+	}
+
+	if (write(manager->devpoll_fd, pfds, writelen) == -1)
+		result = isc__errno2result(errno);
+	else {
+		if (msg == SELECT_POKE_READ)
+			manager->fdpollinfo[fd].want_read = 0;
+		else
+			manager->fdpollinfo[fd].want_write = 0;
+	}
+	UNLOCK(&manager->fdlock[lockid]);
+
+	return (result);
+#elif defined(USE_SELECT)
+	LOCK(&manager->lock);
+	if (msg == SELECT_POKE_READ)
+		FD_CLR(fd, manager->read_fds);
+	else if (msg == SELECT_POKE_WRITE)
+		FD_CLR(fd, manager->write_fds);
+	UNLOCK(&manager->lock);
+
+	return (result);
+#endif
+}
+
 static void
 wakeup_socket(isc_socketmgr_t *manager, int fd, int msg) {
-	isc_socket_t *sock;
+	isc_result_t result;
+	int lockid = FDLOCK_ID(fd);
 
 	/*
 	 * This is a wakeup on a socket.  If the socket is not in the
@@ -352,27 +671,54 @@ wakeup_socket(isc_socketmgr_t *manager, int fd, int msg) {
 	 * or writes.
 	 */
 
-	INSIST(fd >= 0 && fd < manager->fdsize);
+	INSIST(fd >= 0 && fd < (int)manager->maxsocks);
 
-	if (manager->fdstate[fd] == CLOSE_PENDING) {
+	if (msg == SELECT_POKE_CLOSE) {
+		/* No one should be updating fdstate, so no need to lock it */
+		INSIST(manager->fdstate[fd] == CLOSE_PENDING);
 		manager->fdstate[fd] = CLOSED;
-		FD_CLR(fd, manager->read_fds);
-		FD_CLR(fd, manager->write_fds);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
 		(void)close(fd);
 		return;
 	}
-	if (manager->fdstate[fd] != MANAGED)
-		return;
 
-	sock = manager->fds[fd];
+	LOCK(&manager->fdlock[lockid]);
+	if (manager->fdstate[fd] == CLOSE_PENDING) {
+		UNLOCK(&manager->fdlock[lockid]);
+		/*
+		 * We accept (and ignore) any error from unwatch_fd() as we are
+		 * closing the socket, hoping it doesn't leave dangling state in
+		 * the kernel.
+		 * Note that unwatch_fd() must be called after releasing the
+		 * fdlock; otherwise it could cause deadlock due to a lock order
+		 * reversal.
+		 */
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+		return;
+	}
+	if (manager->fdstate[fd] != MANAGED) {
+		UNLOCK(&manager->fdlock[lockid]);
+		return;
+	}
+	UNLOCK(&manager->fdlock[lockid]);
 
 	/*
 	 * Set requested bit.
 	 */
-	if (msg == SELECT_POKE_READ)
-		FD_SET(sock->fd, manager->read_fds);
-	if (msg == SELECT_POKE_WRITE)
-		FD_SET(sock->fd, manager->write_fds);
+	result = watch_fd(manager, fd, msg);
+	if (result != ISC_R_SUCCESS) {
+		/*
+		 * XXXJT: what should we do?  Ignoring the failure of watching
+		 * a socket will make the application dysfunctional, but there
+		 * seems to be no reasonable recovery process.
+		 */
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+			      "failed to start watching FD (%d): %s",
+			      fd, isc_result_totext(result));
+	}
 }
 
 #ifdef ISC_PLATFORM_USETHREADS
@@ -667,7 +1013,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev,
 
 	memset(msg, 0, sizeof(*msg));
 
-	if (sock->type == isc_sockettype_udp) {
+	if (!sock->connected) {
 		msg->msg_name = (void *)&dev->address.type.sa;
 		msg->msg_namelen = dev->address.length;
 	} else {
@@ -941,15 +1287,17 @@ dump_msg(struct msghdr *msg) {
 	unsigned int i;
 
 	printf("MSGHDR %p\n", msg);
-	printf("\tname %p, namelen %d\n", msg->msg_name, msg->msg_namelen);
-	printf("\tiov %p, iovlen %d\n", msg->msg_iov, msg->msg_iovlen);
+	printf("\tname %p, namelen %ld\n", msg->msg_name,
+	       (long) msg->msg_namelen);
+	printf("\tiov %p, iovlen %ld\n", msg->msg_iov,
+	       (long) msg->msg_iovlen);
 	for (i = 0; i < (unsigned int)msg->msg_iovlen; i++)
-		printf("\t\t%d\tbase %p, len %d\n", i,
+		printf("\t\t%d\tbase %p, len %ld\n", i,
 		       msg->msg_iov[i].iov_base,
-		       msg->msg_iov[i].iov_len);
+		       (long) msg->msg_iov[i].iov_len);
 #ifdef ISC_NET_BSD44MSGHDR
-	printf("\tcontrol %p, controllen %d\n", msg->msg_control,
-	       msg->msg_controllen);
+	printf("\tcontrol %p, controllen %ld\n", msg->msg_control,
+	       (long) msg->msg_controllen);
 #endif
 }
 #endif
@@ -1017,6 +1365,14 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 		/* HPUX 11.11 can return EADDRNOTAVAIL. */
 		SOFT_OR_HARD(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL);
 		ALWAYS_HARD(ENOBUFS, ISC_R_NORESOURCES);
+		/*
+		 * HPUX returns EPROTO and EINVAL on receiving some ICMP/ICMPv6
+		 * errors.
+		 */
+#ifdef EPROTO
+		SOFT_OR_HARD(EPROTO, ISC_R_HOSTUNREACH);
+#endif
+		SOFT_OR_HARD(EINVAL, ISC_R_HOSTUNREACH);
 
 #undef SOFT_OR_HARD
 #undef ALWAYS_HARD
@@ -1221,8 +1577,55 @@ doio_send(isc_socket_t *sock, isc_socketevent_t *dev) {
  * Caller must ensure that the socket is not locked and no external
  * references exist.
  */
+static void
+closesocket(isc_socketmgr_t *manager, isc_sockettype_t type, int fd) {
+	int lockid = FDLOCK_ID(fd);
+
+	UNUSED(type);
+
+	/*
+	 * No one has this socket open, so the watcher doesn't have to be
+	 * poked, and the socket doesn't have to be locked.
+	 */
+	LOCK(&manager->fdlock[lockid]);
+	manager->fds[fd] = NULL;
+	manager->fdstate[fd] = CLOSE_PENDING;
+	UNLOCK(&manager->fdlock[lockid]);
+	select_poke(manager, fd, SELECT_POKE_CLOSE);
+
+	/*
+	 * update manager->maxfd here (XXX: this should be implemented more
+	 * efficiently)
+	 */
+#ifdef USE_SELECT
+	LOCK(&manager->lock);
+	if (manager->maxfd == fd) {
+		int i;
+
+		manager->maxfd = 0;
+		for (i = fd - 1; i >= 0; i--) {
+			lockid = FDLOCK_ID(i);
+
+			LOCK(&manager->fdlock[lockid]);
+			if (manager->fdstate[i] == MANAGED) {
+				manager->maxfd = i;
+				UNLOCK(&manager->fdlock[lockid]);
+				break;
+			}
+			UNLOCK(&manager->fdlock[lockid]);
+		}
+#ifdef ISC_PLATFORM_USETHREADS
+		if (manager->maxfd < manager->pipe_fds[0])
+			manager->maxfd = manager->pipe_fds[0];
+#endif
+	}
+	UNLOCK(&manager->lock);
+#endif	/* USE_SELECT */
+}
+
 static void
 destroy(isc_socket_t **sockp) {
+	int fd;
 	isc_socket_t *sock = *sockp;
 	isc_socketmgr_t *manager = sock->manager;
 
@@ -1233,17 +1636,16 @@ destroy(isc_socket_t **sockp) {
 	INSIST(ISC_LIST_EMPTY(sock->recv_list));
 	INSIST(ISC_LIST_EMPTY(sock->send_list));
 	INSIST(sock->connect_ev == NULL);
-	REQUIRE(sock->fd >= 0 && sock->fd < (int)manager->fdsize);
+	REQUIRE(sock->fd == -1 || sock->fd < (int)manager->maxsocks);
+
+	if (sock->fd >= 0) {
+		fd = sock->fd;
+		sock->fd = -1;
+		closesocket(manager, sock->type, fd);
+	}
 
 	LOCK(&manager->lock);
 
-	/*
-	 * No one has this socket open, so the watcher doesn't have to be
-	 * poked, and the socket doesn't have to be locked.
-	 */
-	manager->fds[sock->fd] = NULL;
-	manager->fdstate[sock->fd] = CLOSE_PENDING;
-	select_poke(manager, sock->fd, SELECT_POKE_CLOSE);
 	ISC_LIST_UNLINK(manager->socklist, sock, link);
 
 #ifdef ISC_PLATFORM_USETHREADS
@@ -1251,10 +1653,6 @@ destroy(isc_socket_t **sockp) {
 		SIGNAL(&manager->shutdown_ok);
 #endif /* ISC_PLATFORM_USETHREADS */
 
-	/*
-	 * XXX should reset manager->maxfd here
-	 */
-
 	UNLOCK(&manager->lock);
 
 	free_socket(sockp);
@@ -1446,40 +1844,22 @@ clear_bsdcompat(void) {
 }
 #endif
 
-/*%
- * Create a new 'type' socket managed by 'manager'.  Events
- * will be posted to 'task' and when dispatched 'action' will be
- * called with 'arg' as the arg value.  The new socket is returned
- * in 'socketp'.
- */
-isc_result_t
-isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-		  isc_socket_t **socketp)
-{
-	isc_socket_t *sock = NULL;
-	isc_result_t ret;
-#if defined(USE_CMSG) || defined(SO_BSDCOMPAT)
-	int on = 1;
-#endif
+static isc_result_t
+opensocket(isc_socketmgr_t *manager, isc_socket_t *sock) {
 	char strbuf[ISC_STRERRORSIZE];
 	const char *err = "socket";
 	int tries = 0;
+#if defined(USE_CMSG) || defined(SO_BSDCOMPAT)
+	int on = 1;
+#endif
 
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(socketp != NULL && *socketp == NULL);
-
-	ret = allocate_socket(manager, type, &sock);
-	if (ret != ISC_R_SUCCESS)
-		return (ret);
-
-	sock->pf = pf;
  again:
-	switch (type) {
+	switch (sock->type) {
 	case isc_sockettype_udp:
-		sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
+		sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
 		break;
 	case isc_sockettype_tcp:
-		sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
+		sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
 		break;
 	}
 	if (sock->fd == -1 && errno == EINTR && tries++ < 42)
@@ -1489,7 +1869,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	/*
 	 * Leave a space for stdio and TCP to work in.
 	 */
-	if (manager->reserved != 0 && type == isc_sockettype_udp &&
+	if (manager->reserved != 0 && sock->type == isc_sockettype_udp &&
 	    sock->fd >= 0 && sock->fd < manager->reserved) {
 		int new, tmp;
 		new = fcntl(sock->fd, F_DUPFD, manager->reserved);
@@ -1509,23 +1889,28 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 #endif
 
-	if (sock->fd >= (int)manager->fdsize) {
+	if (sock->fd >= (int)manager->maxsocks) {
 		(void)close(sock->fd);
 		isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL,
 			       ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
 			       isc_msgcat, ISC_MSGSET_SOCKET,
 			       ISC_MSG_TOOMANYFDS,
-			       "%s: too many open file descriptors", "socket");
-		free_socket(&sock);
+			       "socket: file descriptor exceeds limit (%d/%u)",
+			       sock->fd, manager->maxsocks);
 		return (ISC_R_NORESOURCES);
 	}
 
 	if (sock->fd < 0) {
-		free_socket(&sock);
-
 		switch (errno) {
 		case EMFILE:
 		case ENFILE:
+			isc__strerror(errno, strbuf, sizeof(strbuf));
+			isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+				       ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+				       isc_msgcat, ISC_MSGSET_SOCKET,
+				       ISC_MSG_TOOMANYFDS,
+				       "%s: %s", err, strbuf);
+			/* fallthrough */
 		case ENOBUFS:
 			return (ISC_R_NORESOURCES);
 
@@ -1554,7 +1939,6 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 
 	if (make_nonblock(sock->fd) != ISC_R_SUCCESS) {
 		(void)close(sock->fd);
-		free_socket(&sock);
 		return (ISC_R_UNEXPECTED);
 	}
 
@@ -1562,7 +1946,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	RUNTIME_CHECK(isc_once_do(&bsdcompat_once,
 				  clear_bsdcompat) == ISC_R_SUCCESS);
 	if (bsdcompat && setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT,
-				    (void *)&on, sizeof(on)) < 0) {
+		       (void *)&on, sizeof(on)) < 0) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "setsockopt(%d, SO_BSDCOMPAT) %s: %s",
@@ -1588,9 +1972,10 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 #endif
 
-#if defined(USE_CMSG)
-	if (type == isc_sockettype_udp) {
+#if defined(USE_CMSG) || defined(SO_RCVBUF)
+	if (sock->type == isc_sockettype_udp) {
 
+#if defined(USE_CMSG)
 #if defined(SO_TIMESTAMP)
 		if (setsockopt(sock->fd, SOL_SOCKET, SO_TIMESTAMP,
 			       (void *)&on, sizeof(on)) < 0
@@ -1609,7 +1994,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #endif /* SO_TIMESTAMP */
 
 #if defined(ISC_PLATFORM_HAVEIPV6)
-		if (pf == AF_INET6 && sock->recvcmsgbuflen == 0U) {
+		if (sock->pf == AF_INET6 && sock->recvcmsgbuflen == 0U) {
 			/*
 			 * Warn explicitly because this anomaly can be hidden
 			 * in usual operation (and unexpectedly appear later).
@@ -1621,7 +2006,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #ifdef ISC_PLATFORM_HAVEIN6PKTINFO
 #ifdef IPV6_RECVPKTINFO
 		/* RFC 3542 */
-		if ((pf == AF_INET6)
+		if ((sock->pf == AF_INET6)
 		    && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
 				   (void *)&on, sizeof(on)) < 0)) {
 			isc__strerror(errno, strbuf, sizeof(strbuf));
@@ -1636,7 +2021,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 		}
 #else
 		/* RFC 2292 */
-		if ((pf == AF_INET6)
+		if ((sock->pf == AF_INET6)
 		    && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_PKTINFO,
 				   (void *)&on, sizeof(on)) < 0)) {
 			isc__strerror(errno, strbuf, sizeof(strbuf));
@@ -1653,33 +2038,93 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #endif /* ISC_PLATFORM_HAVEIN6PKTINFO */
 #ifdef IPV6_USE_MIN_MTU        /* RFC 3542, not too common yet*/
 		/* use minimum MTU */
-		if (pf == AF_INET6) {
+		if (sock->pf == AF_INET6) {
 			(void)setsockopt(sock->fd, IPPROTO_IPV6,
 					 IPV6_USE_MIN_MTU,
 					 (void *)&on, sizeof(on));
 		}
 #endif
 #endif /* ISC_PLATFORM_HAVEIPV6 */
+#endif /* defined(USE_CMSG) */
 
+#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
+		/*
+		 * Turn off Path MTU discovery on IPv4/UDP sockets.
+		 */
+		if (sock->pf == AF_INET) {
+			int action = IP_PMTUDISC_DONT;
+			(void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER,
+					 &action, sizeof(action));
+		}
+#endif
+#if defined(IP_DONTFRAG)
+		/*
+		 * Turn off Path MTU discovery on IPv4/UDP sockets.
+		 */
+		if (sock->pf == AF_INET) {
+			int off = 0;
+			(void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG,
+					 &off, sizeof(off));
+		}
+#endif
 	}
-#endif /* USE_CMSG */
-
-	sock->references = 1;
-	*socketp = sock;
+#endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */
 
-	LOCK(&manager->lock);
+	return (ISC_R_SUCCESS);
+}
 
-	/*
+/*
+ * Create a new 'type' socket managed by 'manager'.  Events
+ * will be posted to 'task' and when dispatched 'action' will be
+ * called with 'arg' as the arg value.  The new socket is returned
+ * in 'socketp'.
+ */
+isc_result_t
+isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
+		  isc_socket_t **socketp)
+{
+	isc_socket_t *sock = NULL;
+	isc_result_t result;
+	int lockid;
+
+	REQUIRE(VALID_MANAGER(manager));
+	REQUIRE(socketp != NULL && *socketp == NULL);
+
+	result = allocate_socket(manager, type, &sock);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	sock->pf = pf;
+	result = opensocket(manager, sock);
+	if (result != ISC_R_SUCCESS) {
+		free_socket(&sock);
+		return (result);
+	}
+
+	sock->references = 1;
+	*socketp = sock;
+
+	/*
 	 * Note we don't have to lock the socket like we normally would because
 	 * there are no external references to it yet.
 	 */
 
+	lockid = FDLOCK_ID(sock->fd);
+	LOCK(&manager->fdlock[lockid]);
 	manager->fds[sock->fd] = sock;
 	manager->fdstate[sock->fd] = MANAGED;
+#ifdef USE_DEVPOLL
+	INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 &&
+	       sock->manager->fdpollinfo[sock->fd].want_write == 0);
+#endif
+	UNLOCK(&manager->fdlock[lockid]);
+
+	LOCK(&manager->lock);
 	ISC_LIST_APPEND(manager->socklist, sock, link);
+#ifdef USE_SELECT
 	if (manager->maxfd < sock->fd)
 		manager->maxfd = sock->fd;
-
+#endif
 	UNLOCK(&manager->lock);
 
 	socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
@@ -1688,6 +2133,48 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_socket_open(isc_socket_t *sock) {
+	isc_result_t result;
+
+	REQUIRE(VALID_SOCKET(sock));
+
+	LOCK(&sock->lock);
+	REQUIRE(sock->references == 1);
+	UNLOCK(&sock->lock);
+	/*
+	 * We don't need to retain the lock hereafter, since no one else has
+	 * this socket.
+	 */
+	REQUIRE(sock->fd == -1);
+
+	result = opensocket(sock->manager, sock);
+	if (result != ISC_R_SUCCESS)
+		sock->fd = -1;
+
+	if (result == ISC_R_SUCCESS) {
+		int lockid = FDLOCK_ID(sock->fd);
+
+		LOCK(&sock->manager->fdlock[lockid]);
+		sock->manager->fds[sock->fd] = sock;
+		sock->manager->fdstate[sock->fd] = MANAGED;
+#ifdef USE_DEVPOLL
+		INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 &&
+		       sock->manager->fdpollinfo[sock->fd].want_write == 0);
+#endif
+		UNLOCK(&sock->manager->fdlock[lockid]);
+
+#ifdef USE_SELECT
+		LOCK(&sock->manager->lock);
+		if (sock->manager->maxfd < sock->fd)
+			sock->manager->maxfd = sock->fd;
+		UNLOCK(&sock->manager->lock);
+#endif
+	}
+
+	return (result);
+}
+
 /*
  * Attach to a socket.  Caller must explicitly detach when it is done.
  */
@@ -1729,6 +2216,44 @@ isc_socket_detach(isc_socket_t **socketp) {
 	*socketp = NULL;
 }
 
+isc_result_t
+isc_socket_close(isc_socket_t *sock) {
+	int fd;
+
+	REQUIRE(VALID_SOCKET(sock));
+
+	LOCK(&sock->lock);
+	REQUIRE(sock->references == 1);
+	UNLOCK(&sock->lock);
+	/*
+	 * We don't need to retain the lock hereafter, since no one else has
+	 * this socket.
+	 */
+
+	REQUIRE(sock->fd >= 0 && sock->fd < (int)sock->manager->maxsocks);
+
+	INSIST(!sock->connecting);
+	INSIST(!sock->pending_recv);
+	INSIST(!sock->pending_send);
+	INSIST(!sock->pending_accept);
+	INSIST(ISC_LIST_EMPTY(sock->recv_list));
+	INSIST(ISC_LIST_EMPTY(sock->send_list));
+	INSIST(ISC_LIST_EMPTY(sock->accept_list));
+	INSIST(sock->connect_ev == NULL);
+
+	fd = sock->fd;
+	sock->fd = -1;
+	sock->listener = 0;
+	sock->connected = 0;
+	sock->connecting = 0;
+	sock->bound = 0;
+	isc_sockaddr_any(&sock->address);
+
+	closesocket(sock->manager, sock->type, fd);
+
+	return (ISC_R_SUCCESS);
+}
+
 /*
  * I/O is possible on a given socket.  Schedule an event to this task that
  * will call an internal function to do the I/O.  This will charge the
@@ -2041,13 +2566,14 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 					 sock->pf);
 			(void)close(fd);
 			goto soft_error;
-		} else if (fd >= (int)manager->fdsize) {
+		} else if (fd >= (int)manager->maxsocks) {
 			isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL,
 				       ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
 				       isc_msgcat, ISC_MSGSET_SOCKET,
 				       ISC_MSG_TOOMANYFDS,
-				       "%s: too many open file descriptors",
-				       "accept");
+				       "accept: "
+				       "file descriptor exceeds limit (%d/%u)",
+				       fd, manager->maxsocks);
 			(void)close(fd);
 			goto soft_error;
 		}
@@ -2081,6 +2607,13 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 	 * -1 means the new socket didn't happen.
 	 */
 	if (fd != -1) {
+		int lockid = FDLOCK_ID(fd);
+
+		LOCK(&manager->fdlock[lockid]);
+		manager->fds[fd] = dev->newsocket;
+		manager->fdstate[fd] = MANAGED;
+		UNLOCK(&manager->fdlock[lockid]);
+
 		LOCK(&manager->lock);
 		ISC_LIST_APPEND(manager->socklist, dev->newsocket, link);
 
@@ -2093,10 +2626,10 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 		 */
 		dev->address = dev->newsocket->address;
 
-		manager->fds[fd] = dev->newsocket;
-		manager->fdstate[fd] = MANAGED;
+#ifdef USE_SELECT
 		if (manager->maxfd < fd)
 			manager->maxfd = fd;
+#endif
 
 		socket_log(sock, &dev->newsocket->address, CREATION,
 			   isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_ACCEPTEDCXN,
@@ -2245,77 +2778,256 @@ internal_send(isc_task_t *me, isc_event_t *ev) {
 	UNLOCK(&sock->lock);
 }
 
+/*
+ * Process read/writes on each fd here.  Avoid locking
+ * and unlocking twice if both reads and writes are possible.
+ */
 static void
-process_fds(isc_socketmgr_t *manager, int maxfd,
-	    fd_set *readfds, fd_set *writefds)
+process_fd(isc_socketmgr_t *manager, int fd, isc_boolean_t readable,
+	   isc_boolean_t writeable)
 {
-	int i;
 	isc_socket_t *sock;
 	isc_boolean_t unlock_sock;
-
-	REQUIRE(maxfd <= (int)manager->fdsize);
+	int lockid = FDLOCK_ID(fd);
 
 	/*
-	 * Process read/writes on other fds here.  Avoid locking
-	 * and unlocking twice if both reads and writes are possible.
+	 * If the socket is going to be closed, don't do more I/O.
 	 */
-	for (i = 0; i < maxfd; i++) {
+	LOCK(&manager->fdlock[lockid]);
+	if (manager->fdstate[fd] == CLOSE_PENDING) {
+		UNLOCK(&manager->fdlock[lockid]);
+
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+		return;
+	}
+
+	sock = manager->fds[fd];
+	UNLOCK(&manager->fdlock[lockid]);
+	unlock_sock = ISC_FALSE;
+	if (readable) {
+		if (sock == NULL) {
+			(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+			goto check_write;
+		}
+		unlock_sock = ISC_TRUE;
+		LOCK(&sock->lock);
+		if (!SOCK_DEAD(sock)) {
+			if (sock->listener)
+				dispatch_accept(sock);
+			else
+				dispatch_recv(sock);
+		}
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+	}
+check_write:
+	if (writeable) {
+		if (sock == NULL) {
+			(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+			return;
+		}
+		if (!unlock_sock) {
+			unlock_sock = ISC_TRUE;
+			LOCK(&sock->lock);
+		}
+		if (!SOCK_DEAD(sock)) {
+			if (sock->connecting)
+				dispatch_connect(sock);
+			else
+				dispatch_send(sock);
+		}
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+	}
+	if (unlock_sock)
+		UNLOCK(&sock->lock);
+}
+
+#ifdef USE_KQUEUE
+static isc_boolean_t
+process_fds(isc_socketmgr_t *manager, struct kevent *events, int nevents) {
+	int i;
+	isc_boolean_t readable, writable;
+	isc_boolean_t done = ISC_FALSE;
 #ifdef ISC_PLATFORM_USETHREADS
-		if (i == manager->pipe_fds[0] || i == manager->pipe_fds[1])
+	isc_boolean_t have_ctlevent = ISC_FALSE;
+#endif
+
+	if (nevents == manager->nevents) {
+		/*
+		 * This is not an error, but something unexpected.  If this
+		 * happens, it may indicate the need for increasing
+		 * ISC_SOCKET_MAXEVENTS.
+		 */
+		manager_log(manager, ISC_LOGCATEGORY_GENERAL,
+			    ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
+			    "maximum number of FD events (%d) received",
+			    nevents);
+	}
+
+	for (i = 0; i < nevents; i++) {
+		REQUIRE(events[i].ident < manager->maxsocks);
+#ifdef ISC_PLATFORM_USETHREADS
+		if (events[i].ident == (uintptr_t)manager->pipe_fds[0]) {
+			have_ctlevent = ISC_TRUE;
 			continue;
-#endif /* ISC_PLATFORM_USETHREADS */
+		}
+#endif
+		readable = ISC_TF(events[i].filter == EVFILT_READ);
+		writable = ISC_TF(events[i].filter == EVFILT_WRITE);
+		process_fd(manager, events[i].ident, readable, writable);
+	}
 
-		if (manager->fdstate[i] == CLOSE_PENDING) {
-			manager->fdstate[i] = CLOSED;
-			FD_CLR(i, manager->read_fds);
-			FD_CLR(i, manager->write_fds);
+#ifdef ISC_PLATFORM_USETHREADS
+	if (have_ctlevent)
+		done = process_ctlfd(manager);
+#endif
 
-			(void)close(i);
+	return (done);
+}
+#elif defined(USE_EPOLL)
+static isc_boolean_t
+process_fds(isc_socketmgr_t *manager, struct epoll_event *events, int nevents) {
+	int i;
+	isc_boolean_t done = ISC_FALSE;
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_boolean_t have_ctlevent = ISC_FALSE;
+#endif
+
+	if (nevents == manager->nevents) {
+		manager_log(manager, ISC_LOGCATEGORY_GENERAL,
+			    ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
+			    "maximum number of FD events (%d) received",
+			    nevents);
+	}
 
+	for (i = 0; i < nevents; i++) {
+		REQUIRE(events[i].data.fd < (int)manager->maxsocks);
+#ifdef ISC_PLATFORM_USETHREADS
+		if (events[i].data.fd == manager->pipe_fds[0]) {
+			have_ctlevent = ISC_TRUE;
 			continue;
 		}
-
-		sock = manager->fds[i];
-		unlock_sock = ISC_FALSE;
-		if (FD_ISSET(i, readfds)) {
-			if (sock == NULL) {
-				FD_CLR(i, manager->read_fds);
-				goto check_write;
-			}
-			unlock_sock = ISC_TRUE;
-			LOCK(&sock->lock);
-			if (!SOCK_DEAD(sock)) {
-				if (sock->listener)
-					dispatch_accept(sock);
-				else
-					dispatch_recv(sock);
-			}
-			FD_CLR(i, manager->read_fds);
+#endif
+		if ((events[i].events & EPOLLERR) != 0 ||
+		    (events[i].events & EPOLLHUP) != 0) {
+			/*
+			 * epoll does not set IN/OUT bits on an erroneous
+			 * condition, so we need to try both anyway.  This is a
+			 * bit inefficient, but should be okay for such rare
+			 * events.  Note also that the read or write attempt
+			 * won't block because we use non-blocking sockets.
+			 */
+			events[i].events |= (EPOLLIN | EPOLLOUT);
 		}
-	check_write:
-		if (FD_ISSET(i, writefds)) {
-			if (sock == NULL) {
-				FD_CLR(i, manager->write_fds);
-				continue;
-			}
-			if (!unlock_sock) {
-				unlock_sock = ISC_TRUE;
-				LOCK(&sock->lock);
-			}
-			if (!SOCK_DEAD(sock)) {
-				if (sock->connecting)
-					dispatch_connect(sock);
-				else
-					dispatch_send(sock);
-			}
-			FD_CLR(i, manager->write_fds);
+		process_fd(manager, events[i].data.fd,
+			   (events[i].events & EPOLLIN) != 0,
+			   (events[i].events & EPOLLOUT) != 0);
+	}
+
+#ifdef ISC_PLATFORM_USETHREADS
+	if (have_ctlevent)
+		done = process_ctlfd(manager);
+#endif
+
+	return (done);
+}
+#elif defined(USE_DEVPOLL)
+static isc_boolean_t
+process_fds(isc_socketmgr_t *manager, struct pollfd *events, int nevents) {
+	int i;
+	isc_boolean_t done = ISC_FALSE;
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_boolean_t have_ctlevent = ISC_FALSE;
+#endif
+
+	if (nevents == manager->nevents) {
+		manager_log(manager, ISC_LOGCATEGORY_GENERAL,
+			    ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
+			    "maximum number of FD events (%d) received",
+			    nevents);
+	}
+
+	for (i = 0; i < nevents; i++) {
+		REQUIRE(events[i].fd < (int)manager->maxsocks);
+#ifdef ISC_PLATFORM_USETHREADS
+		if (events[i].fd == manager->pipe_fds[0]) {
+			have_ctlevent = ISC_TRUE;
+			continue;
 		}
-		if (unlock_sock)
-			UNLOCK(&sock->lock);
+#endif
+		process_fd(manager, events[i].fd,
+			   (events[i].events & POLLIN) != 0,
+			   (events[i].events & POLLOUT) != 0);
+	}
+
+#ifdef ISC_PLATFORM_USETHREADS
+	if (have_ctlevent)
+		done = process_ctlfd(manager);
+#endif
+
+	return (done);
+}
+#elif defined(USE_SELECT)
+static void
+process_fds(isc_socketmgr_t *manager, int maxfd,
+	    fd_set *readfds, fd_set *writefds)
+{
+	int i;
+
+	REQUIRE(maxfd <= (int)manager->maxsocks);
+
+	for (i = 0; i < maxfd; i++) {
+#ifdef ISC_PLATFORM_USETHREADS
+		if (i == manager->pipe_fds[0] || i == manager->pipe_fds[1])
+			continue;
+#endif /* ISC_PLATFORM_USETHREADS */
+		process_fd(manager, i, FD_ISSET(i, readfds),
+			   FD_ISSET(i, writefds));
 	}
 }
+#endif
 
 #ifdef ISC_PLATFORM_USETHREADS
+static isc_boolean_t
+process_ctlfd(isc_socketmgr_t *manager) {
+	int msg, fd;
+
+	for (;;) {
+		select_readmsg(manager, &fd, &msg);
+
+		manager_log(manager, IOEVENT,
+			    isc_msgcat_get(isc_msgcat, ISC_MSGSET_SOCKET,
+					   ISC_MSG_WATCHERMSG,
+					   "watcher got message %d "
+					   "for socket %d"), msg, fd);
+
+		/*
+		 * Nothing to read?
+		 */
+		if (msg == SELECT_POKE_NOTHING)
+			break;
+
+		/*
+		 * Handle shutdown message.  We really should
+		 * jump out of this loop right away, but
+		 * it doesn't matter if we have to do a little
+		 * more work first.
+		 */
+		if (msg == SELECT_POKE_SHUTDOWN)
+			return (ISC_TRUE);
+
+		/*
+		 * This is a wakeup on a socket.  Look
+		 * at the event queue for both read and write,
+		 * and decide if we need to watch on it now
+		 * or not.
+		 */
+		wakeup_socket(manager, fd, msg);
+	}
+
+	return (ISC_FALSE);
+}
+
 /*
  * This is the thread that will loop forever, always in a select or poll
  * call.
@@ -2329,98 +3041,115 @@ watcher(void *uap) {
 	isc_boolean_t done;
 	int ctlfd;
 	int cc;
-	int msg, fd;
+#ifdef USE_KQUEUE
+	const char *fnname = "kevent()";
+#elif defined (USE_EPOLL)
+	const char *fnname = "epoll_wait()";
+#elif defined(USE_DEVPOLL)
+	const char *fnname = "ioctl(DP_POLL)";
+	struct dvpoll dvp;
+#elif defined (USE_SELECT)
+	const char *fnname = "select()";
 	int maxfd;
+#endif
 	char strbuf[ISC_STRERRORSIZE];
+#ifdef ISC_SOCKET_USE_POLLWATCH
+	pollstate_t pollstate = poll_idle;
+#endif
 
 	/*
 	 * Get the control fd here.  This will never change.
 	 */
-	LOCK(&manager->lock);
 	ctlfd = manager->pipe_fds[0];
-
 	done = ISC_FALSE;
 	while (!done) {
 		do {
+#ifdef USE_KQUEUE
+			cc = kevent(manager->kqueue_fd, NULL, 0,
+				    manager->events, manager->nevents, NULL);
+#elif defined(USE_EPOLL)
+			cc = epoll_wait(manager->epoll_fd, manager->events,
+					manager->nevents, -1);
+#elif defined(USE_DEVPOLL)
+			dvp.dp_fds = manager->events;
+			dvp.dp_nfds = manager->nevents;
+#ifndef ISC_SOCKET_USE_POLLWATCH
+			dvp.dp_timeout = -1;
+#else
+			if (pollstate == poll_idle)
+				dvp.dp_timeout = -1;
+			else
+				dvp.dp_timeout = ISC_SOCKET_POLLWATCH_TIMEOUT;
+#endif	/* ISC_SOCKET_USE_POLLWATCH */
+			cc = ioctl(manager->devpoll_fd, DP_POLL, &dvp);
+#elif defined(USE_SELECT)
+			LOCK(&manager->lock);
 			memcpy(manager->read_fds_copy, manager->read_fds,
 			       manager->fd_bufsize);
 			memcpy(manager->write_fds_copy, manager->write_fds,
 			       manager->fd_bufsize);
 			maxfd = manager->maxfd + 1;
-
 			UNLOCK(&manager->lock);
 
 			cc = select(maxfd, manager->read_fds_copy,
 				    manager->write_fds_copy, NULL, NULL);
-			if (cc < 0) {
-				if (!SOFT_ERROR(errno)) {
-					isc__strerror(errno, strbuf,
-						      sizeof(strbuf));
-					FATAL_ERROR(__FILE__, __LINE__,
-						    "select() %s: %s",
-						    isc_msgcat_get(isc_msgcat,
-							    ISC_MSGSET_GENERAL,
-							    ISC_MSG_FAILED,
-							    "failed"),
-						    strbuf);
-				}
+#endif	/* USE_KQUEUE */
+
+			if (cc < 0 && !SOFT_ERROR(errno)) {
+				isc__strerror(errno, strbuf, sizeof(strbuf));
+				FATAL_ERROR(__FILE__, __LINE__,
+					    "%s %s: %s", fnname,
+					    isc_msgcat_get(isc_msgcat,
+							   ISC_MSGSET_GENERAL,
+							   ISC_MSG_FAILED,
+							   "failed"), strbuf);
 			}
 
-			LOCK(&manager->lock);
+#if defined(USE_DEVPOLL) && defined(ISC_SOCKET_USE_POLLWATCH)
+			if (cc == 0) {
+				if (pollstate == poll_active)
+					pollstate = poll_checking;
+				else if (pollstate == poll_checking)
+					pollstate = poll_idle;
+			} else if (cc > 0) {
+				if (pollstate == poll_checking) {
+					/*
+					 * XXX: We'd like to use a more
+					 * verbose log level as it's actually an
+					 * unexpected event, but the kernel bug
+					 * reportedly happens pretty frequently
+					 * (and it can also be a false positive)
+					 * so it would be just too noisy.
+					 */
+					manager_log(manager,
+						    ISC_LOGCATEGORY_GENERAL,
+						    ISC_LOGMODULE_SOCKET,
+						    ISC_LOG_DEBUG(1),
+						    "unexpected POLL timeout");
+				}
+				pollstate = poll_active;
+			}
+#endif
 		} while (cc < 0);
 
+#if defined(USE_KQUEUE) || defined (USE_EPOLL) || defined (USE_DEVPOLL)
+		done = process_fds(manager, manager->events, cc);
+#elif defined(USE_SELECT)
+		process_fds(manager, maxfd, manager->read_fds_copy,
+			    manager->write_fds_copy);
 
 		/*
 		 * Process reads on internal, control fd.
 		 */
-		if (FD_ISSET(ctlfd, manager->read_fds_copy)) {
-			for (;;) {
-				select_readmsg(manager, &fd, &msg);
-
-				manager_log(manager, IOEVENT,
-					    isc_msgcat_get(isc_msgcat,
-						     ISC_MSGSET_SOCKET,
-						     ISC_MSG_WATCHERMSG,
-						     "watcher got message %d"),
-						     msg);
-
-				/*
-				 * Nothing to read?
-				 */
-				if (msg == SELECT_POKE_NOTHING)
-					break;
-
-				/*
-				 * Handle shutdown message.  We really should
-				 * jump out of this loop right away, but
-				 * it doesn't matter if we have to do a little
-				 * more work first.
-				 */
-				if (msg == SELECT_POKE_SHUTDOWN) {
-					done = ISC_TRUE;
-
-					break;
-				}
-
-				/*
-				 * This is a wakeup on a socket.  Look
-				 * at the event queue for both read and write,
-				 * and decide if we need to watch on it now
-				 * or not.
-				 */
-				wakeup_socket(manager, fd, msg);
-			}
-		}
-
-		process_fds(manager, maxfd, manager->read_fds_copy,
-			    manager->write_fds_copy);
+		if (FD_ISSET(ctlfd, manager->read_fds_copy))
+			done = process_ctlfd(manager);
+#endif
 	}
 
 	manager_log(manager, TRACE,
 		    isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 				   ISC_MSG_EXITING, "watcher exiting"));
 
-	UNLOCK(&manager->lock);
 	return ((isc_threadresult_t)0);
 }
 #endif /* ISC_PLATFORM_USETHREADS */
@@ -2434,69 +3163,208 @@ isc__socketmgr_setreserved(isc_socketmgr_t *manager, isc_uint32_t reserved) {
 }
 
 /*
- * Initialize fdsets in socketmgr structure.
+ * Create a new socket manager.
  */
+
 static isc_result_t
-create_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) {
-#if ISC_SOCKET_FDSETSIZE > FD_SETSIZE
-	manager->fdsize = ISC_SOCKET_FDSETSIZE;
-	manager->fd_bufsize = howmany(ISC_SOCKET_FDSETSIZE, NFDBITS) *
+setup_watcher(isc_mem_t *mctx, isc_socketmgr_t *manager) {
+	isc_result_t result;
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+	char strbuf[ISC_STRERRORSIZE];
+#endif
+
+#ifdef USE_KQUEUE
+	manager->nevents = ISC_SOCKET_MAXEVENTS;
+	manager->events = isc_mem_get(mctx, sizeof(struct kevent) *
+				      manager->nevents);
+	if (manager->events == NULL)
+		return (ISC_R_NOMEMORY);
+	manager->kqueue_fd = kqueue();
+	if (manager->kqueue_fd == -1) {
+		result = isc__errno2result(errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "kqueue %s: %s",
+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED, "failed"),
+				 strbuf);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct kevent) * manager->nevents);
+		return (result);
+	}
+
+#ifdef ISC_PLATFORM_USETHREADS
+	result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		close(manager->kqueue_fd);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct kevent) * manager->nevents);
+		return (result);
+	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+#elif defined(USE_EPOLL)
+	manager->nevents = ISC_SOCKET_MAXEVENTS;
+	manager->events = isc_mem_get(mctx, sizeof(struct epoll_event) *
+				      manager->nevents);
+	if (manager->events == NULL)
+		return (ISC_R_NOMEMORY);
+	manager->epoll_fd = epoll_create(manager->nevents);
+	if (manager->epoll_fd == -1) {
+		result = isc__errno2result(errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "epoll_create %s: %s",
+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED, "failed"),
+				 strbuf);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct epoll_event) * manager->nevents);
+		return (result);
+	}
+#ifdef ISC_PLATFORM_USETHREADS
+	result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		close(manager->epoll_fd);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct epoll_event) * manager->nevents);
+		return (result);
+	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+#elif defined(USE_DEVPOLL)
+	/*
+	 * XXXJT: /dev/poll seems to reject large numbers of events,
+	 * so we should be careful about redefining ISC_SOCKET_MAXEVENTS.
+	 */
+	manager->nevents = ISC_SOCKET_MAXEVENTS;
+	manager->events = isc_mem_get(mctx, sizeof(struct pollfd) *
+				      manager->nevents);
+	if (manager->events == NULL)
+		return (ISC_R_NOMEMORY);
+	/*
+	 * Note: fdpollinfo should be able to support all possible FDs, so
+	 * it must have maxsocks entries (not nevents).
+	 */
+	manager->fdpollinfo = isc_mem_get(mctx, sizeof(pollinfo_t) *
+					  manager->maxsocks);
+	if (manager->fdpollinfo == NULL) {
+		isc_mem_put(mctx, manager->events,
+			    sizeof(pollinfo_t) * manager->maxsocks);
+		return (ISC_R_NOMEMORY);
+	}
+	memset(manager->fdpollinfo, 0, sizeof(pollinfo_t) * manager->maxsocks);
+	manager->devpoll_fd = open("/dev/poll", O_RDWR);
+	if (manager->devpoll_fd == -1) {
+		result = isc__errno2result(errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "open(/dev/poll) %s: %s",
+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED, "failed"),
+				 strbuf);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct pollfd) * manager->nevents);
+		isc_mem_put(mctx, manager->fdpollinfo,
+			    sizeof(pollinfo_t) * manager->maxsocks);
+		return (result);
+	}
+#ifdef ISC_PLATFORM_USETHREADS
+	result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		close(manager->devpoll_fd);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct pollfd) * manager->nevents);
+		isc_mem_put(mctx, manager->fdpollinfo,
+			    sizeof(pollinfo_t) * manager->maxsocks);
+		return (result);
+	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+#elif defined(USE_SELECT)
+	UNUSED(result);
+
+#if ISC_SOCKET_MAXSOCKETS > FD_SETSIZE
+	/*
+	 * Note: this code should also cover the case of MAXSOCKETS <=
+	 * FD_SETSIZE, but we separate the cases to avoid possible portability
+	 * issues regarding howmany() and the actual representation of fd_set.
+	 */
+	manager->fd_bufsize = howmany(manager->maxsocks, NFDBITS) *
 		sizeof(fd_mask);
 #else
-	manager->fdsize = FD_SETSIZE;
 	manager->fd_bufsize = sizeof(fd_set);
 #endif
 
-	manager->fds = NULL;
-	manager->fdstate = NULL;
 	manager->read_fds = NULL;
 	manager->read_fds_copy = NULL;
 	manager->write_fds = NULL;
 	manager->write_fds_copy = NULL;
 
-	manager->fds = isc_mem_get(mctx,
-				   manager->fdsize * sizeof(manager->fds[0]));
-	if (manager->fds == NULL)
-		goto fail;
-
-	manager->fdstate = isc_mem_get(mctx, manager->fdsize *
-				       sizeof(manager->fdstate[0]));
-	if (manager->fdstate == NULL)
-		goto fail;
-
 	manager->read_fds = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->read_fds == NULL)
-		goto fail;
-	manager->read_fds_copy = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->read_fds_copy == NULL)
-		goto fail;
-	manager->write_fds = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->write_fds == NULL)
-		goto fail;
-	manager->write_fds_copy = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->write_fds_copy == NULL)
-		goto fail;
+	if (manager->read_fds != NULL)
+		manager->read_fds_copy = isc_mem_get(mctx, manager->fd_bufsize);
+	if (manager->read_fds_copy != NULL)
+		manager->write_fds = isc_mem_get(mctx, manager->fd_bufsize);
+	if (manager->write_fds != NULL) {
+		manager->write_fds_copy = isc_mem_get(mctx,
+						      manager->fd_bufsize);
+	}
+	if (manager->write_fds_copy == NULL) {
+		if (manager->write_fds != NULL) {
+			isc_mem_put(mctx, manager->write_fds,
+				    manager->fd_bufsize);
+		}
+		if (manager->read_fds_copy != NULL) {
+			isc_mem_put(mctx, manager->read_fds_copy,
+				    manager->fd_bufsize);
+		}
+		if (manager->read_fds != NULL) {
+			isc_mem_put(mctx, manager->read_fds,
+				    manager->fd_bufsize);
+		}
+		return (ISC_R_NOMEMORY);
+	}
+	memset(manager->read_fds, 0, manager->fd_bufsize);
+	memset(manager->write_fds, 0, manager->fd_bufsize);
 
-	return (ISC_R_SUCCESS);
+#ifdef ISC_PLATFORM_USETHREADS
+	(void)watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	manager->maxfd = manager->pipe_fds[0];
+#else /* ISC_PLATFORM_USETHREADS */
+	manager->maxfd = 0;
+#endif /* ISC_PLATFORM_USETHREADS */
+#endif	/* USE_KQUEUE */
 
-  fail:
-	cleanup_fdsets(manager, mctx);
-	return (ISC_R_NOMEMORY);
+	return (ISC_R_SUCCESS);
 }
 
-/*
- * Clean up fdsets in socketmgr structure.
- */
 static void
-cleanup_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) {
-	if (manager->fds != NULL) {
-		isc_mem_put(mctx, manager->fds,
-			    manager->fdsize * sizeof(manager->fds[0]));
-	}
-	if (manager->fdstate != NULL) {
-		isc_mem_put(mctx, manager->fdstate,
-			    manager->fdsize * sizeof(manager->fdstate[0]));
+cleanup_watcher(isc_mem_t *mctx, isc_socketmgr_t *manager) {
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_result_t result;
+
+	result = unwatch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "epoll_ctl(DEL) %s",
+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED, "failed"));
 	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+#ifdef USE_KQUEUE
+	close(manager->kqueue_fd);
+	isc_mem_put(mctx, manager->events,
+		    sizeof(struct kevent) * manager->nevents);
+#elif defined(USE_EPOLL)
+	close(manager->epoll_fd);
+	isc_mem_put(mctx, manager->events,
+		    sizeof(struct epoll_event) * manager->nevents);
+#elif defined(USE_DEVPOLL)
+	close(manager->devpoll_fd);
+	isc_mem_put(mctx, manager->events,
+		    sizeof(struct pollfd) * manager->nevents);
+	isc_mem_put(mctx, manager->fdpollinfo,
+		    sizeof(pollinfo_t) * manager->maxsocks);
+#elif defined(USE_SELECT)
 	if (manager->read_fds != NULL)
 		isc_mem_put(mctx, manager->read_fds, manager->fd_bufsize);
 	if (manager->read_fds_copy != NULL)
@@ -2505,13 +3373,19 @@ cleanup_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) {
 		isc_mem_put(mctx, manager->write_fds, manager->fd_bufsize);
 	if (manager->write_fds_copy != NULL)
 		isc_mem_put(mctx, manager->write_fds_copy, manager->fd_bufsize);
+#endif	/* USE_KQUEUE */
 }
 
-/*
- * Create a new socket manager.
- */
 isc_result_t
 isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
+	return (isc_socketmgr_create2(mctx, managerp, 0));
+}
+
+isc_result_t
+isc_socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp,
+		      unsigned int maxsocks)
+{
+	int i;
 	isc_socketmgr_t *manager;
 #ifdef ISC_PLATFORM_USETHREADS
 	char strbuf[ISC_STRERRORSIZE];
@@ -2522,46 +3396,71 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 
 #ifndef ISC_PLATFORM_USETHREADS
 	if (socketmgr != NULL) {
+		/* Don't allow maxsocks to be updated */
+		if (maxsocks > 0 && socketmgr->maxsocks != maxsocks)
+			return (ISC_R_EXISTS);
+
 		socketmgr->refs++;
 		*managerp = socketmgr;
 		return (ISC_R_SUCCESS);
 	}
 #endif /* ISC_PLATFORM_USETHREADS */
 
+	if (maxsocks == 0)
+		maxsocks = ISC_SOCKET_MAXSOCKETS;
+
 	manager = isc_mem_get(mctx, sizeof(*manager));
 	if (manager == NULL)
 		return (ISC_R_NOMEMORY);
 
-	result = create_fdsets(manager, mctx);
-	if (result != ISC_R_SUCCESS) {
-		cleanup_fdsets(manager, mctx);
-		isc_mem_put(mctx, manager, sizeof(*manager));
-		return (result);
+	/* zero-clear so that necessary cleanup on failure will be easy */
+	memset(manager, 0, sizeof(*manager));
+	manager->maxsocks = maxsocks;
+	manager->reserved = 0;
+	manager->fds = isc_mem_get(mctx,
+				   manager->maxsocks * sizeof(isc_socket_t *));
+	if (manager->fds == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto free_manager;
+	}
+	manager->fdstate = isc_mem_get(mctx, manager->maxsocks * sizeof(int));
+	if (manager->fds == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto free_manager;
 	}
 
 	manager->magic = SOCKET_MANAGER_MAGIC;
 	manager->mctx = NULL;
+	memset(manager->fds, 0, manager->maxsocks * sizeof(isc_socket_t *));
 	ISC_LIST_INIT(manager->socklist);
-  	result = isc_mutex_init(&manager->lock);
-  	if (result != ISC_R_SUCCESS) {
-		cleanup_fdsets(manager, mctx);
-		isc_mem_put(mctx, manager, sizeof(*manager));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+	result = isc_mutex_init(&manager->lock);
+	if (result != ISC_R_SUCCESS)
+		goto free_manager;
+	manager->fdlock = isc_mem_get(mctx, FDLOCK_COUNT * sizeof(isc_mutex_t));
+	if (manager->fdlock == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup_lock;
 	}
+	for (i = 0; i < FDLOCK_COUNT; i++) {
+		result = isc_mutex_init(&manager->fdlock[i]);
+		if (result != ISC_R_SUCCESS) {
+			while (--i >= 0)
+				DESTROYLOCK(&manager->fdlock[i]);
+			isc_mem_put(mctx, manager->fdlock,
+				    FDLOCK_COUNT * sizeof(isc_mutex_t));
+			manager->fdlock = NULL;
+			goto cleanup_lock;
+		}
+	}
+
 #ifdef ISC_PLATFORM_USETHREADS
 	if (isc_condition_init(&manager->shutdown_ok) != ISC_R_SUCCESS) {
-		cleanup_fdsets(manager, mctx);
-		DESTROYLOCK(&manager->lock);
-		isc_mem_put(mctx, manager, sizeof(*manager));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_condition_init() %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		result = ISC_R_UNEXPECTED;
+		goto cleanup_lock;
 	}
 
 	/*
@@ -2569,17 +3468,14 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 	 * select/poll loop when something internal needs to be done.
 	 */
 	if (pipe(manager->pipe_fds) != 0) {
-		cleanup_fdsets(manager, mctx);
-		DESTROYLOCK(&manager->lock);
-		isc_mem_put(mctx, manager, sizeof(*manager));
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "pipe() %s: %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 						ISC_MSG_FAILED, "failed"),
 				 strbuf);
-
-		return (ISC_R_UNEXPECTED);
+		result = ISC_R_UNEXPECTED;
+		goto cleanup_condition;
 	}
 
 	RUNTIME_CHECK(make_nonblock(manager->pipe_fds[0]) == ISC_R_SUCCESS);
@@ -2593,33 +3489,23 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 	/*
 	 * Set up initial state for the select loop
 	 */
-	memset(manager->read_fds, 0, manager->fd_bufsize);
-	memset(manager->write_fds, 0, manager->fd_bufsize);
-#ifdef ISC_PLATFORM_USETHREADS
-	FD_SET(manager->pipe_fds[0], manager->read_fds);
-	manager->maxfd = manager->pipe_fds[0];
-#else /* ISC_PLATFORM_USETHREADS */
-	manager->maxfd = 0;
-#endif /* ISC_PLATFORM_USETHREADS */
-	manager->reserved = 0;
-	memset(manager->fdstate, 0,
-	       manager->fdsize * sizeof(manager->fdstate[0]));
-
+	result = setup_watcher(mctx, manager);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+	memset(manager->fdstate, 0, manager->maxsocks * sizeof(int));
 #ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Start up the select/poll thread.
 	 */
 	if (isc_thread_create(watcher, manager, &manager->watcher) !=
 	    ISC_R_SUCCESS) {
-		(void)close(manager->pipe_fds[0]);
-		(void)close(manager->pipe_fds[1]);
-		DESTROYLOCK(&manager->lock);
-		isc_mem_put(mctx, manager, sizeof(*manager));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_thread_create() %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		cleanup_watcher(mctx, manager);
+		result = ISC_R_UNEXPECTED;
+		goto cleanup;
 	}
 #endif /* ISC_PLATFORM_USETHREADS */
 	isc_mem_attach(mctx, &manager->mctx);
@@ -2629,6 +3515,52 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 #endif /* ISC_PLATFORM_USETHREADS */
 	*managerp = manager;
 
+	return (ISC_R_SUCCESS);
+
+cleanup:
+#ifdef ISC_PLATFORM_USETHREADS
+	(void)close(manager->pipe_fds[0]);
+	(void)close(manager->pipe_fds[1]);
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+#ifdef ISC_PLATFORM_USETHREADS
+cleanup_condition:
+	(void)isc_condition_destroy(&manager->shutdown_ok);
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+
+cleanup_lock:
+	if (manager->fdlock != NULL) {
+		for (i = 0; i < FDLOCK_COUNT; i++)
+			DESTROYLOCK(&manager->fdlock[i]);
+	}
+	DESTROYLOCK(&manager->lock);
+
+free_manager:
+	if (manager->fdlock != NULL) {
+		isc_mem_put(mctx, manager->fdlock,
+			    FDLOCK_COUNT * sizeof(isc_mutex_t));
+	}
+	if (manager->fdstate != NULL) {
+		isc_mem_put(mctx, manager->fdstate,
+			    manager->maxsocks * sizeof(int));
+	}
+	if (manager->fds != NULL) {
+		isc_mem_put(mctx, manager->fds,
+			    manager->maxsocks * sizeof(isc_socket_t *));
+	}
+	isc_mem_put(mctx, manager, sizeof(*manager));
+
+	return (result);
+}
+
+isc_result_t
+isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp) {
+	REQUIRE(VALID_MANAGER(manager));
+	REQUIRE(nsockp != NULL);
+
+	*nsockp = manager->maxsocks;
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -2703,18 +3635,30 @@ isc_socketmgr_destroy(isc_socketmgr_t **managerp) {
 	/*
 	 * Clean up.
 	 */
+	cleanup_watcher(manager->mctx, manager);
+
 #ifdef ISC_PLATFORM_USETHREADS
 	(void)close(manager->pipe_fds[0]);
 	(void)close(manager->pipe_fds[1]);
 	(void)isc_condition_destroy(&manager->shutdown_ok);
 #endif /* ISC_PLATFORM_USETHREADS */
 
-	for (i = 0; i < (int)manager->fdsize; i++)
-		if (manager->fdstate[i] == CLOSE_PENDING)
+	for (i = 0; i < (int)manager->maxsocks; i++)
+		if (manager->fdstate[i] == CLOSE_PENDING) /* no need to lock */
 			(void)close(i);
 
+	isc_mem_put(manager->mctx, manager->fds,
+		    manager->maxsocks * sizeof(isc_socket_t *));
+	isc_mem_put(manager->mctx, manager->fdstate,
+		    manager->maxsocks * sizeof(int));
+
+	if (manager->fdlock != NULL) {
+		for (i = 0; i < FDLOCK_COUNT; i++)
+			DESTROYLOCK(&manager->fdlock[i]);
+		isc_mem_put(manager->mctx, manager->fdlock,
+			    FDLOCK_COUNT * sizeof(isc_mutex_t));
+	}
 	DESTROYLOCK(&manager->lock);
-	cleanup_fdsets(manager, manager->mctx);
 	manager->magic = 0;
 	mctx= manager->mctx;
 	isc_mem_put(mctx, manager, sizeof(*manager));
@@ -2767,7 +3711,7 @@ socket_recv(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task,
 		 * Enqueue the request.  If the socket was previously not being
 		 * watched, poke the watcher to start paying attention to it.
 		 */
-		if (ISC_LIST_EMPTY(sock->recv_list))
+		if (ISC_LIST_EMPTY(sock->recv_list) && !sock->pending_recv)
 			select_poke(sock->manager, sock->fd, SELECT_POKE_READ);
 		ISC_LIST_ENQUEUE(sock->recv_list, dev, ev_link);
 
@@ -2964,7 +3908,8 @@ socket_send(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task,
 			 * not being watched, poke the watcher to start
 			 * paying attention to it.
 			 */
-			if (ISC_LIST_EMPTY(sock->send_list))
+			if (ISC_LIST_EMPTY(sock->send_list) &&
+			    !sock->pending_send)
 				select_poke(sock->manager, sock->fd,
 					    SELECT_POKE_WRITE);
 			ISC_LIST_ENQUEUE(sock->send_list, dev, ev_link);
@@ -3222,7 +4167,7 @@ isc_socket_listen(isc_socket_t *sock, unsigned int backlog) {
 }
 
 /*
- * This should try to do agressive accept() XXXMLG
+ * This should try to do aggressive accept() XXXMLG
  */
 isc_result_t
 isc_socket_accept(isc_socket_t *sock,
@@ -3333,6 +4278,16 @@ isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr,
 	sock->address = *addr;
 	cc = connect(sock->fd, &addr->type.sa, addr->length);
 	if (cc < 0) {
+		/*
+		 * HP-UX "fails" to connect a UDP socket and sets errno to
+		 * EINPROGRESS if it's non-blocking.  We'd rather regard this as
+		 * a success and let the user detect it if it's really an error
+		 * at the time of sending a packet on the socket.
+		 */
+		if (sock->type == isc_sockettype_udp && errno == EINPROGRESS) {
+			cc = 0;
+			goto success;
+		}
 		if (SOFT_ERROR(errno) || errno == EINPROGRESS)
 			goto queue;
 
@@ -3374,6 +4329,7 @@ isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr,
 	/*
 	 * If connect completed, fire off the done event.
 	 */
+ success:
 	if (cc == 0) {
 		sock->connected = 1;
 		sock->bound = 1;
@@ -3733,37 +4689,107 @@ isc_socket_ipv6only(isc_socket_t *sock, isc_boolean_t yes) {
 
 #ifdef IPV6_V6ONLY
 	if (sock->pf == AF_INET6) {
-		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY,
-				 (void *)&onoff, sizeof(onoff));
+		if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY,
+			       (void *)&onoff, sizeof(int)) < 0) {
+			char strbuf[ISC_STRERRORSIZE];
+
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "setsockopt(%d, IPV6_V6ONLY) "
+					 "%s: %s", sock->fd,
+					 isc_msgcat_get(isc_msgcat,
+							ISC_MSGSET_GENERAL,
+							ISC_MSG_FAILED,
+							"failed"),
+					 strbuf);
+		}
 	}
+	FIX_IPV6_RECVPKTINFO(sock);	/* AIX */
 #endif
 }
 
 #ifndef ISC_PLATFORM_USETHREADS
-void
-isc__socketmgr_getfdsets(fd_set **readset, fd_set **writeset, int *maxfd) {
+/* In our assumed scenario, we can simply use a single static object. */
+static isc_socketwait_t swait_private;
+
+int
+isc__socketmgr_waitevents(struct timeval *tvp, isc_socketwait_t **swaitp) {
+	int n;
+#ifdef USE_KQUEUE
+	struct timespec ts, *tsp;
+#endif
+#ifdef USE_EPOLL
+	int timeout;
+#endif
+#ifdef USE_DEVPOLL
+	struct dvpoll dvp;
+#endif
+
+	REQUIRE(swaitp != NULL && *swaitp == NULL);
+
 	if (socketmgr == NULL)
-		*maxfd = 0;
-	else {
-		/* Prepare duplicates of fd_sets, as select() will modify */
-		memcpy(socketmgr->read_fds_copy, socketmgr->read_fds,
-		       socketmgr->fd_bufsize);
-		memcpy(socketmgr->write_fds_copy, socketmgr->write_fds,
-		       socketmgr->fd_bufsize);
-		*readset = socketmgr->read_fds_copy;
-		*writeset = socketmgr->write_fds_copy;
-		*maxfd = socketmgr->maxfd + 1;
-	}
+		return (0);
+
+#ifdef USE_KQUEUE
+	if (tvp != NULL) {
+		ts.tv_sec = tvp->tv_sec;
+		ts.tv_nsec = tvp->tv_usec * 1000;
+		tsp = &ts;
+	} else
+		tsp = NULL;
+	swait_private.nevents = kevent(socketmgr->kqueue_fd, NULL, 0,
+				       socketmgr->events, socketmgr->nevents,
+				       tsp);
+	n = swait_private.nevents;
+#elif defined(USE_EPOLL)
+	if (tvp != NULL)
+		timeout = tvp->tv_sec * 1000 + (tvp->tv_usec + 999) / 1000;
+	else
+		timeout = -1;
+	swait_private.nevents = epoll_wait(socketmgr->epoll_fd,
+					   socketmgr->events,
+					   socketmgr->nevents, timeout);
+	n = swait_private.nevents;
+#elif defined(USE_DEVPOLL)
+	dvp.dp_fds = socketmgr->events;
+	dvp.dp_nfds = socketmgr->nevents;
+	if (tvp != NULL) {
+		dvp.dp_timeout = tvp->tv_sec * 1000 +
+			(tvp->tv_usec + 999) / 1000;
+	} else
+		dvp.dp_timeout = -1;
+	swait_private.nevents = ioctl(socketmgr->devpoll_fd, DP_POLL, &dvp);
+	n = swait_private.nevents;
+#elif defined(USE_SELECT)
+	memcpy(socketmgr->read_fds_copy, socketmgr->read_fds,
+	       socketmgr->fd_bufsize);
+	memcpy(socketmgr->write_fds_copy, socketmgr->write_fds,
+	       socketmgr->fd_bufsize);
+
+	swait_private.readset = socketmgr->read_fds_copy;
+	swait_private.writeset = socketmgr->write_fds_copy;
+	swait_private.maxfd = socketmgr->maxfd + 1;
+
+	n = select(swait_private.maxfd, swait_private.readset,
+		   swait_private.writeset, NULL, tvp);
+#endif
+
+	*swaitp = &swait_private;
+	return (n);
 }
 
 isc_result_t
-isc__socketmgr_dispatch(fd_set *readset, fd_set *writeset, int maxfd) {
-	isc_socketmgr_t *manager = socketmgr;
+isc__socketmgr_dispatch(isc_socketwait_t *swait) {
+	REQUIRE(swait == &swait_private);
 
-	if (manager == NULL)
+	if (socketmgr == NULL)
 		return (ISC_R_NOTFOUND);
 
-	process_fds(manager, maxfd, readset, writeset);
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+	(void)process_fds(socketmgr, socketmgr->events, swait->nevents);
+	return (ISC_R_SUCCESS);
+#elif defined(USE_SELECT)
+	process_fds(socketmgr, swait->maxfd, swait->readset, swait->writeset);
 	return (ISC_R_SUCCESS);
+#endif
 }
 #endif /* ISC_PLATFORM_USETHREADS */
diff --git a/lib/isc/unix/socket_p.h b/lib/isc/unix/socket_p.h
index 07720eef656c7..5786facad9c89 100644
--- a/lib/isc/unix/socket_p.h
+++ b/lib/isc/unix/socket_p.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket_p.h,v 1.6.206.1.34.1 2008/07/29 04:43:57 each Exp $ */
+/* $Id: socket_p.h,v 1.6.206.3 2008/06/25 23:45:37 tbox Exp $ */
 
 #ifndef ISC_SOCKET_P_H
 #define ISC_SOCKET_P_H
@@ -24,10 +24,7 @@
 #include 
 #endif
 
-void
-isc__socketmgr_getfdsets(fd_set **readset, fd_set **writeset, int *maxfd);
-
-isc_result_t
-isc__socketmgr_dispatch(fd_set *readset, fd_set *writeset, int maxfd);
-
+typedef struct isc_socketwait isc_socketwait_t;
+int isc__socketmgr_waitevents(struct timeval *, isc_socketwait_t **);
+isc_result_t isc__socketmgr_dispatch(isc_socketwait_t *);
 #endif /* ISC_SOCKET_P_H */
diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
index 39c851cebe9a9..c4b7f13600eba 100644
--- a/lib/isc/unix/time.c
+++ b/lib/isc/unix/time.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.34.2.6.2.4 2004/03/06 08:15:03 marka Exp $ */
+/* $Id: time.c,v 1.34.2.6.2.6 2008/04/28 23:45:41 tbox Exp $ */
 
 #include 
 
@@ -225,7 +225,7 @@ isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) {
 
 	t->seconds = tv.tv_sec + i->seconds;
 	t->nanoseconds = tv.tv_usec * NS_PER_US + i->nanoseconds;
-	if (t->nanoseconds > NS_PER_S) {
+	if (t->nanoseconds >= NS_PER_S) {
 		t->seconds++;
 		t->nanoseconds -= NS_PER_S;
 	}
@@ -408,5 +408,5 @@ isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 		snprintf(buf + flen, len - flen,
 			 ".%03u", t->nanoseconds / 1000000);
 	else
-                snprintf(buf, len, "99-Bad-9999 99:99:99.999");
+		snprintf(buf, len, "99-Bad-9999 99:99:99.999");
 }
diff --git a/lib/isccfg/api b/lib/isccfg/api
index 808217d1f364c..364ea9d2a3bc4 100644
--- a/lib/isccfg/api
+++ b/lib/isccfg/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 1
-LIBREVISION = 9
+LIBREVISION = 10
 LIBAGE = 0
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 622d76aef790a..65b4e4e57e722 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.c,v 1.21.44.36.2.1 2008/07/23 12:03:53 marka Exp $ */
+/* $Id: namedconf.c,v 1.21.44.40 2008/09/04 08:11:25 marka Exp $ */
 
 #include 
 
@@ -513,30 +513,80 @@ static cfg_type_t cfg_type_serverid = {
 /*
  * Port list.
  */
+static cfg_tuplefielddef_t porttuple_fields[] = {
+	{ "loport", &cfg_type_uint32, 0 },
+	{ "hiport", &cfg_type_uint32, 0 },
+	{ NULL, NULL, 0 }
+};
+static cfg_type_t cfg_type_porttuple = {
+	"porttuple", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+	&cfg_rep_tuple, porttuple_fields
+};
+
 static isc_result_t
-parse_port(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+parse_port(cfg_parser_t *pctx, cfg_obj_t **ret) {
 	isc_result_t result;
 
-	UNUSED(type);
-
 	CHECK(cfg_parse_uint32(pctx, NULL, ret));
 	if ((*ret)->value.uint32 > 0xffff) {
 		cfg_parser_error(pctx, CFG_LOG_NEAR, "invalid port");
 		cfg_obj_destroy(pctx, ret);
 		result = ISC_R_RANGE;
 	}
+
+ cleanup:
+	return (result);
+}
+
+static isc_result_t
+parse_portrange(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+	isc_result_t result;
+	cfg_obj_t *obj = NULL;
+
+	UNUSED(type);
+
+	CHECK(cfg_peektoken(pctx, ISC_LEXOPT_NUMBER | ISC_LEXOPT_CNUMBER));
+	if (pctx->token.type == isc_tokentype_number)
+		CHECK(parse_port(pctx, ret));
+	else {
+		CHECK(cfg_gettoken(pctx, 0));
+		if (pctx->token.type != isc_tokentype_string ||
+		    strcasecmp(TOKEN_STRING(pctx), "range") != 0) {
+			cfg_parser_error(pctx, CFG_LOG_NEAR,
+					 "expected integer or 'range'");
+			return (ISC_R_UNEXPECTEDTOKEN);
+		}
+		CHECK(cfg_create_tuple(pctx, &cfg_type_porttuple, &obj));
+		CHECK(parse_port(pctx, &obj->value.tuple[0]));
+		CHECK(parse_port(pctx, &obj->value.tuple[1]));
+		if (obj->value.tuple[0]->value.uint32 >
+		    obj->value.tuple[1]->value.uint32) {
+			cfg_parser_error(pctx, CFG_LOG_NOPREP,
+					 "low port '%u' must not be larger "
+					 "than high port",
+					 obj->value.tuple[0]->value.uint32);
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		*ret = obj;
+		obj = NULL;
+	}
+
  cleanup:
+	if (obj != NULL)
+		cfg_obj_destroy(pctx, &obj);
 	return (result);
 }
 
-static cfg_type_t cfg_type_port = {
-	"port", parse_port, NULL, cfg_doc_terminal,
+static cfg_type_t cfg_type_portrange = {
+	"portrange", parse_portrange, NULL, cfg_doc_terminal,
 	NULL, NULL
 };
 
 static cfg_type_t cfg_type_bracketed_portlist = {
-	"bracketed_sockaddrlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
-	&cfg_rep_list, &cfg_type_port
+	"bracketed_sockaddrlist", cfg_parse_bracketed_list,
+	cfg_print_bracketed_list, cfg_doc_bracketed_list,
+	&cfg_rep_list, &cfg_type_portrange
 };
 
 /*
@@ -573,6 +623,8 @@ namedconf_or_view_clauses[] = {
  */
 static cfg_clausedef_t
 options_clauses[] = {
+	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
+	{ "use-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "avoid-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "blackhole", &cfg_type_bracketed_aml, 0 },
@@ -1565,6 +1617,7 @@ static isc_result_t
 parse_logversions(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (parse_enum_or_other(pctx, type, &cfg_type_uint32, ret));
 }
+
 static cfg_type_t cfg_type_logversions = {
 	"logversions", parse_logversions, cfg_print_ustring, cfg_doc_terminal,
 	&cfg_rep_string, logversions_enums
@@ -1638,8 +1691,19 @@ print_logfile(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	}
 }
 
+
+static void
+doc_logfile(cfg_printer_t *pctx, const cfg_type_t *type) {
+	UNUSED(type);
+	cfg_print_cstr(pctx, "");
+	cfg_print_chars(pctx, " ", 1);
+	cfg_print_cstr(pctx, "[ versions ( \"unlimited\" |  ) ]");
+	cfg_print_chars(pctx, " ", 1);
+	cfg_print_cstr(pctx, "[ size  ]");
+}
+
 static cfg_type_t cfg_type_logfile = {
-	"log_file", parse_logfile, print_logfile, cfg_doc_terminal,
+	"log_file", parse_logfile, print_logfile, doc_logfile,
 	&cfg_rep_tuple, logfile_fields
 };
 
@@ -1671,8 +1735,8 @@ static cfg_type_t cfg_type_lwres_view = {
 };
 
 static cfg_type_t cfg_type_lwres_searchlist = {
-	"lwres_searchlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
-	&cfg_rep_list, &cfg_type_astring };
+	"lwres_searchlist", cfg_parse_bracketed_list, cfg_print_bracketed_list,
+	cfg_doc_bracketed_list, &cfg_rep_list, &cfg_type_astring };
 
 static cfg_clausedef_t
 lwres_clauses[] = {
@@ -1784,15 +1848,15 @@ doc_sockaddrnameport(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_chars(pctx, "( ", 2);
 	cfg_print_cstr(pctx, "");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port ]");
+	cfg_print_cstr(pctx, "[ port  ]");
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port ]");
+	cfg_print_cstr(pctx, "[ port  ]");
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port ]");
+	cfg_print_cstr(pctx, "[ port  ]");
 	cfg_print_chars(pctx, " )", 2);
 }
 
@@ -1870,11 +1934,11 @@ doc_masterselement(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port ]");
+	cfg_print_cstr(pctx, "[ port  ]");
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port ]");
+	cfg_print_cstr(pctx, "[ port  ]");
 	cfg_print_chars(pctx, " )", 2);
 }
 
diff --git a/version b/version
index 9a2d587b3d09b..f89ed03fd6dc8 100644
--- a/version
+++ b/version
@@ -1,10 +1,10 @@
-# $Id: version,v 1.26.2.17.2.31.4.2 2008/07/29 05:03:50 each Exp $
+# $Id: version,v 1.26.2.17.2.35 2008/12/24 00:21:45 marka Exp $
 #
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
 MAJORVER=9
 MINORVER=3
-PATCHVER=5
+PATCHVER=6
 RELEASETYPE=-P
-RELEASEVER=2
+RELEASEVER=1
-- 
cgit v1.3



 
 

 
 
 
SSHFP
Provides a way to securly publish a secure shell
+key's fingerprint.  Described in RFC 4255.

 
TXT

 
text records.  Described in RFC 1035.