diff options
| author | Doug Barton <dougb@FreeBSD.org> | 2009-01-09 09:58:33 +0000 |
|---|---|---|
| committer | Doug Barton <dougb@FreeBSD.org> | 2009-01-09 09:58:33 +0000 |
| commit | 0da30d61e624fa6fbd4d6b2057244e0c9e0c213b (patch) | |
| tree | 76e88c380de063d6c34d9c662df82c2ee84b3bf1 | |
| parent | 84c329fd83557f6415f6355007797dbcbaa685b0 (diff) | |
| download | src-test2-0da30d61e624fa6fbd4d6b2057244e0c9e0c213b.tar.gz src-test2-0da30d61e624fa6fbd4d6b2057244e0c9e0c213b.zip | |
Vendor import of BIND 9.3.6-P1vendor/bind9/9.3.6-P1
Notes
Notes:
svn path=/vendor/bind9/dist-9.3/; revision=186928
svn path=/vendor/bind9/9.3.6-P1/; revision=186929; tag=vendor/bind9/9.3.6-P1
139 files changed, 13576 insertions, 4775 deletions
@@ -1,14 +1,154 @@ - --- 9.3.5-P2 released --- - -2406. [bug] Some operating systems have FD_SETSIZE set to a - low value by default, which can cause resource - exhaustion when many simultaneous connections are - open. Linux in particular makes it difficult to - increase this value. To use more sockets with - select(), set ISC_SOCKET_FDSETSIZE. Example: - STD_CDEFINES="-DISC_SOCKET_FDSETSIZE=4096" ./configure - (This should not be necessary in most cases, and - never for an authoritative-only server.) [RT #18328] + --- 9.3.6-P1 released --- + +2522. [security] Handle -1 from DSA_do_verify(). + +2498. [bug] Removed a bogus function argument used with + ISC_SOCKET_USE_POLLWATCH: it could cause compiler + warning or crash named with the debug 1 level + of logging. [RT #18917] + + --- 9.3.6 released --- + +2490. [port] aix: work around a kernel bug where IPV6_RECVPKTINFO + is cleared when IPV6_V6ONLY is set. [RT #18785] + +2489. [port] solaris: Workaround Solaris's kernel bug about + /dev/poll: + http://bugs.opensolaris.org/view_bug.do?bug_id=6724237 + Define ISC_SOCKET_USE_POLLWATCH at build time to enable + this workaround. [RT #18870] + + --- 9.3.6rc1 released --- + +2473. [port] linux: raise the limit on open files to the possible + maximum value before spawning threads; 'files' + specified in named.conf doesn't seem to work with + threads as expected. [RT #18784] + +2472. [port] linux: check the number of available cpu's before + calling chroot as it depends on "/proc". [RT #16923] + +2469. [port] solaris: Work around Solaris's select() limitations. + [RT #18769] + +2468. [bug] Resolver could try unreachable servers multiple times. + [RT #18739] + +2467. [bug] Failure of fcntl(F_DUPFD) wasn't logged. [RT #18740] + +2465. [bug] Adb's handling of lame addresses was different + for IPv4 and IPv6. [RT #18738] + +2463. [port] linux: POSIX doesn't include the IPv6 Advanced Socket + API and glibc hides parts of the IPv6 Advanced Socket + API as a result. This is stupid as it breaks how the + two halves (Basic and Advanced) of the IPv6 Socket API were designed to be used but we have to live with it. + Define _GNU_SOURCE to pull in the IPv6 Advanced Socket + API. [RT #18388] + +2462. [doc] Document -m (enable memory usage debugging) + option for dig. [RT #18757] + +2461. [port] sunos: Change #2363 was not complete. [RT #17513] + +2458. [doc] ARM: update and correction for max-cache-size. + [RT #18294] + +2455. [bug] Stop metadata being transfered via axfr/ixfr. + [RT #18639] + +2453. [bug] Remove NULL pointer dereference in dns_journal_print(). + [RT #18316] + +2449. [bug] libbind: Out of bounds reference in dns_ho.c:addrsort. + [RT #18044] + +2444. [port] Linux, FreeBSD, AIX: Turn off path mtu discovery + (clear DF) for UDP responses and requests. + + --- 9.3.6b1 released --- + +2443. [bug] win32: UDP connect() would not generate an event, + and so connected UDP sockets would never clean up. + Fix this by doing an immediate WSAConnect() rather + than an io completion port type for UDP. + +2438. [bug] Timeouts could be logged incorrectly under win32. + [RT #18617] + +2437. [bug] Sockets could be closed too early, leading to + inconsistent states in the socket module. [RT #18298] + +2436. [security] win32: UDP client handler can be shutdown. [RT #18576] + +2432. [bug] More Windows socket handling improvements. Stop + using I/O events and use IO Completion Ports + throughout. Rewrite the receive path logic to make + it easier to support multiple simultaneous + requestrs in the future. Add stricter consistency + checking as a compile-time option (define + ISC_SOCKET_CONSISTENCY_CHECKS; defaults to off). + +2430. [bug] win32: isc_interval_set() could round down to + zero if the input was less than NS_INTERVAL + nanoseconds. Round up instead. [RT #18549] + +2429. [doc] nsupdate should be in section 1 of the man pages. + [RT #18283] + +2426. [bug] libbind: inet_net_pton() can sometimes return the + wrong value if excessively large netmasks are + supplied. [RT #18512] + +2425. [bug] named didn't detect unavailable query source addresses + at load time. [RT #18536] + +2424. [port] configure now probes for a working epoll + implementation. Allow the use of kqueue, + epoll and /dev/poll to be selected at compile + time. [RT #18277] + +2422. [bug] Handle the special return value of a empty node as + if it was a NXRRSET in the validator. [RT #18447] + +2421. [func] Add new command line option '-S' for named to specify + the max number of sockets. [RT #18493] + Use caution: this option may not work for some + operating systems without rebuilding named. + +2420. [bug] Windows socket handling cleanup. Let the io + completion event send out cancelled read/write + done events, which keeps us from writing to memeory + we no longer have ownership of. Add debugging + socket_log() function. Rework TCP socket handling + to not leak sockets. + +2417. [bug] Connecting UDP sockets for outgoing queries could + unexpectedly fail with an 'address already in use' + error. [RT #18411] + +2416. [func] Log file descriptors that cause exceeding the + internal maximum. [RT #18460] + +2414. [bug] A masterdump context held the database lock too long, + causing various troubles such as dead lock and + recursive lock acquisition. [RT #18311, #18456] + +2413. [bug] Fixed an unreachable code path in socket.c. [RT #18442] + +2412. [bug] win32: address a resourse leak. [RT #18374] + +2411. [bug] Allow using a larger number of sockets than FD_SETSIZE + for select(). To enable this, set ISC_SOCKET_MAXSOCKETS + at compilation time. [RT #18433] + +2410. [bug] Correctly delete m_versionInfo. [RT #18432] + +2408. [bug] A duplicate TCP dispatch event could be sent, which + could then trigger an assertion failure in + resquery_response(). [RT #18275] + +2407. [port] hpux: test for sys/dyntune.h. [RT #18421] 2404. [port] hpux: files unlimited support. @@ -22,7 +162,7 @@ 2399. [bug] Abort timeout queries to reduce the number of open UDP sockets. [RT #18367] -2398. [bug] Improve file descriptor management. New, +2398. [bug] Improve file descriptor management. New, temporary, named.conf option reserved-sockets, default 512. [RT #18344] @@ -39,11 +179,111 @@ 2392. [bug] remove 'grep -q' from acl test script, some platforms don't support it. [RT #18253] - --- 9.3.5-P1 released --- +2391 [port] hpux: cover additional recvmsg() error codes. + [RT #18301] + +2390 [bug] dispatch.c could make a false warning on 'odd socket'. + [RT #18301]. + +2389 [bug] Move the "working directory writable" check to after + the ns_os_changeuser() call. [RT #18326] + +2386. [func] Add warning about too small 'open files' limit. + [RT #18269] + +2385. [bug] A condition variable in socket.c could leak in + rare error handling [RT #17968]. + +2384. [security] Additional support for query port randomization (change + #2375) including performance improvement and port range + specification. [RT #17949, #18098] + +2383. [bug] named could double queries when they resulted in + SERVFAIL due to overkilling EDNS0 failure detection. + [RT #18182] + +2382. [doc] Add a description SSHFP to ARM. + +2380. [bug] dns_view_find() was not returning NXDOMAIN/NXRRSET + proofs which, in turn, caused validation failures + for insecure zones immediately below a secure zone + the server was authoritative for. [RT #18112] -2375. [security] Fully randomize UDP query ports to improve +2379. [contrib] queryperf/gen-data-queryperf.py: removed redundant + TLDs and supported RRs with TTLs [RT #17972] + +2377. [bug] Address race condition in dnssec-signzone. [RT #18142] + +2376. [bug] Change #2144 was not complete. + +2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949] +2369. [bug] libbind: Array bounds overrun on read in bitncmp(). + [RT #18054] + +2364. [bug] named could trigger an assertion when serving a + malformed signed zone. [RT #17828] + +2363. [port] sunos: pre-set "lt_cv_sys_max_cmd_len=4096;". + [RT #17513] + +2361. [bug] "recursion" statistics counter could be counted + multiple times for a single query. [RT #17990] + +2358. [doc] Update host's default query description. [RT #17934] + +2356. [bug] Built in mutex profiler was not scalable enough. + [RT #17436] + +2353. [func] libbind: nsid support. [RT #17091] + +2350. [port] win32: IPv6 support. [RT #17797] + +2347. [bug] Delete now traverses the RB tree in the canonical + order. [RT #17451] + +2345. [bug] named-checkconf failed to detect when forwarders + were set at both the options/view level and in + a root zone. [RT #17671] + +2344. [bug] Improve "logging{ file ...; };" documentation. + [RT #17888] + +2343. [bug] (Seemingly) duplicate IPv6 entries could be + created in ADB. [RT #17837] + +2341. [bug] libbind: add missing -I../include for off source + tree builds. [RT #17606] + +2340. [port] openbsd: interface configuration. [RT #17700] + +2335. [port] sunos: libbind and *printf() support for long long. + [RT #17513] + +2334. [bug] Bad REQUIRES in fromstruct_in_naptr(), off by one + bug in fromstruct_txt(). [RT #17609] + +2333. [bug] Fix off by one error in isc_time_nowplusinterval(). + [RT #17608] + +2332. [contrib] query-loc-0.4.0. [RT #17602] + +2331. [bug] Failure to regenerate any signatures was not being + reported nor being past back to the UPDATE client. + [RT #17570] + +2330. [bug] Remove potential race condition when handling + over memory events. [RT #17572] + + WARNING: API CHANGE: over memory callback + function now needs to call isc_mem_waterack(). + See <isc/mem.h> for details. + +2329. [bug] Clearer help text for dig's '-x' and '-i' options. + +2325. [port] Linux: use capset() function if available. [RT #17557] + --- 9.3.5 released --- --- 9.3.5rc2 released --- @@ -65,11 +305,11 @@ 2322. [port] MacOS: work around the limitation of setrlimit() for RLIMIT_NOFILE. [RT #17526] -2321. [bug] Silence Coverity warnings in lib/dns/master.c, +2321. [bug] Silence Coverity warnings in lib/dns/master.c, lib/dns/rbtdb.c, lib/isccfg/namedconf.c, lib/dns/tsig.c and bin/dnssec/dnssec-signzone.c. -2319. [bug] Silence Coverity warnings in +2319. [bug] Silence Coverity warnings in lib/dns/rdata/in_1/apl_42.c. [RT #17469] 2318. [port] sunos fixes for libbind. [RT #17514] @@ -83,7 +323,7 @@ 2312. [cleanup] Silence Coverity warning in lib/isc/unix/socket.c. [RT #17458] -2311. [func] Update ACL regression test. [RT #17462] +2311. [func] Update ACL regression test. [RT #17462] 2310. [bug] dig, host, nslookup: flush stdout before emitting debug/fatal messages. [RT #17501] @@ -106,7 +346,7 @@ 2301. [bug] Remove resource leak and fix error messages in bin/tests/system/lwresd/lwtest.c. [RT #17474] -2300. [bug] Fixed failure to close open file in +2300. [bug] Fixed failure to close open file in bin/tests/names/t_names.c. [RT #17473] 2299. [bug] Remove unnecessary NULL check in @@ -129,7 +369,7 @@ 2292. [bug] Log if the working directory is not writable. [RT #17312] -2291. [bug] PR_SET_DUMPABLE may be set too late. Also report +2291. [bug] PR_SET_DUMPABLE may be set too late. Also report failure to set PR_SET_DUMPABLE. [RT #17312] 2290. [bug] Let AD in the query signal that the client wants AD @@ -148,7 +388,7 @@ memory context rather than the clients memory context. [RT #17377] -2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available, +2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available, to protect applications from receiving spurious SIGPIPE signals when using the resolver. @@ -157,7 +397,7 @@ --- 9.3.5b1 released --- -2273. [bug] Adjust log level to WARNING when saving inconsistant +2273. [bug] Adjust log level to WARNING when saving inconsistent stub/slave master and journal files. [RT# 17279] 2272. [bug] Handle illegal dnssec-lookaside trust-anchor names. @@ -194,10 +434,10 @@ reality. Note there is behaviour change for BIND 9.5. [RT #17113] -2249. [bug] Only set Authentic Data bit if client requested +2249. [bug] Only set Authentic Data bit if client requested DNSSEC, per RFC 3655 [RT #17175] -2248. [cleanup] Fix several errors reported by Coverity. [RT #17160] +2248. [cleanup] Fix several errors reported by Coverity. [RT #17160] 2247. [doc] Sort doc/misc/options. [RT #17067] @@ -208,18 +448,18 @@ working. [RT #17151] 2238. [bug] It was possible to trigger a REQUIRE when a - validation was cancelled. [RT #17106] + validation was canceled. [RT #17106] 2237. [bug] libbind: res_init() was not thread aware. [RT #17123] 2236. [bug] dnssec-signzone failed to preserve the case of of wildcard owner names. [RT #17085] -2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134] - +2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134] + 2229. [bug] Null pointer dereference on query pool creation - failure. [RT #17133] - + failure. [RT #17133] + 2232. [bug] dns_adb_findaddrinfo() could fail and return ISC_R_SUCCESS. [RT #17137] @@ -230,10 +470,10 @@ 2227. [cleanup] Tidied up the FAQ. [RT #17121] -2226. [bug] Fix build error. [RT #17124] +2226. [bug] Fix build error. [RT #17124] 2225. [bug] More support for systems with no IPv4 addresses. - [RT #17111] + [RT #17111] 2224. [bug] Defer journal compaction if a xfrin is in progress. [RT #17119] @@ -247,12 +487,12 @@ 2220. [bug] win32: Address a race condition in final shutdown of the Windows socket code. [RT #17028] - + 2218. [bug] Remove unnecessary REQUIRE from dns_validator_create(). [RT #16976] 2216. [cleanup] Fix a number of errors reported by Coverity. - [RT #17094] + [RT #17094] 2214. [bug] Deregister OpenSSL lock callback when cleaning up. [RT #17098] @@ -297,7 +537,7 @@ 2187. [bug] query_addds(), query_addwildcardproof() and query_addnxrrsetnsec() should take a version - arguement. [RT #16368] + argument. [RT #16368] 2186. [port] cygwin: libbind: check for struct sockaddr_storage independently of IPv6. [RT #16482] @@ -324,7 +564,7 @@ debug level 10+. [RT #16798] 2176. [contrib] dbus update to handle race condition during - initialisation (Bugzilla 235809). [RT #16842] + initialization (Bugzilla 235809). [RT #16842] 2175. [bug] win32: windows broadcast condition variable support was broken. [RT #16592] @@ -444,7 +684,7 @@ 2111. [bug] Fix a number of errors reported by Coverity. [RT #16507] -2110. [bug] "minimal-response yes;" interacted badly with BIND 8 +2110. [bug] "minimal-responses yes;" interacted badly with BIND 8 priming queries. [RT #16491] 2109. [port] libbind: silence aix 5.3 compiler warnings. [RT #16502] @@ -453,7 +693,7 @@ 2203. [security] Query id generation was cryptographically weak. [RT # 16915] - + 2193. [port] win32: BINDInstall.exe is now linked statically. [RT #16906] @@ -463,7 +703,7 @@ --- 9.3.4 released --- -2126. [security] Serialise validation of type ANY responses. [RT #16555] +2126. [security] Serialize validation of type ANY responses. [RT #16555] 2124. [security] It was possible to dereference a freed fetch context. [RT #16584] @@ -477,14 +717,14 @@ 2103. [port] Add /usr/sfw to list of locations for OpenSSL under Solaris. -2102. [port] Silence solaris 10 warnings. +2102. [port] Silence Solaris 10 warnings. 2101. [bug] OpenSSL version checks were not quite right. [RT #16476] 2100. [port] win32: copy libeay32.dll to Build\Debug. -2099. [port] win32: more manifiest issues. +2099. [port] win32: more manifest issues. --- 9.3.3rc3 released --- @@ -493,12 +733,12 @@ 2095. [port] libbind: alway prototype inet_cidr_ntop_ipv6() and net_cidr_ntop_ipv6(). [RT #16388] - + 2094. [contrib] Update named-bootconf. [RT# 16404] 2092. [bug] win32: dig, host, nslookup. Use registry config if resolv.conf does not exist or no nameservers - listed. [RT #15877] + listed. [RT #15877] 2091. [port] dighost.c: race condition on cleanup. [RT #16417] @@ -588,7 +828,7 @@ [RT #16287] 2049. [bug] Restore SOA before AXFR when falling back from - a attempted IXFR when transfering in a zone. + a attempted IXFR when transferring in a zone. Allow a initial SOA query before attempting a AXFR to be requested. [RT #16156] @@ -597,7 +837,7 @@ the OS always returned the same local port. [RT #16182] -2047. [bug] Failed to initialise the interface flags to zero. +2047. [bug] Failed to initialize the interface flags to zero. [RT #16245] 2043. [port] nsupdate/nslookup: Force the flushing of the prompt @@ -626,7 +866,7 @@ 2029. [bug] host printed out the server multiple times when specified on the command line. [RT #15992] -2028. [port] linux: socket.c compatability for old systems. +2028. [port] linux: socket.c compatibility for old systems. [RT #16015] 2027. [port] libbind: Solaris x86 support. [RT #16020] @@ -634,7 +874,7 @@ 2026. [bug] Rate limit the two recursive client exceeded messages. [RT #16044] -2024. [bug] named emited spurious "zone serial unchanged" +2024. [bug] named emitted spurious "zone serial unchanged" messages on reload. [RT #16027] 2023. [bug] "make install" should create ${localstatedir}/run and @@ -647,7 +887,7 @@ 2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully. [RT #15941] -2009. [bug] libbind: coverity fixes. [RT #15808] +2009. [bug] libbind: Coverity fixes. [RT #15808] 2005. [bug] libbind: Retransmission timeouts should be based on which attempt it is to the nameserver @@ -679,16 +919,16 @@ 1994. [port] OpenSSL 0.9.8 support. [RT #15694] -1993. [bug] Log messsage, via syslog, were missing the space +1993. [bug] Log messages, via syslog, were missing the space after the timestamp if "print-time yes" was specified. [RT #15844] 1991. [cleanup] The configuration data, once read, should be treated - as readonly. Expand the use of const to enforce this + as read only. Expand the use of const to enforce this at compile time. [RT #15813] 1990. [bug] libbind: isc's override of broken gettimeofday() - implementions was not always effective. + implementations was not always effective. [RT #15709] 1989. [bug] win32: don't check the service password when @@ -703,7 +943,7 @@ server for the zone. Also any zones that contain DLV records should be removed when upgrading a slave zone. You do not however have to upgrade all - servers for a zone with DLV records simultaniously. + servers for a zone with DLV records simultaneously. 1982. [bug] DNSKEY was being accepted on the parent side of a delegation. KEY is still accepted there for @@ -728,7 +968,7 @@ 1974. [doc] List each of the zone types and associated zone options separately in the ARM. -1972. [contrib] DBUS dynamic forwarders integation from +1972. [contrib] DBUS dynamic forwarders integration from Jason Vas Dias <jvdias@redhat.com>. 1971. [port] linux: make detection of missing IF_NAMESIZE more @@ -745,7 +985,7 @@ 1966. [bug] Don't set CD when we have fallen back to plain DNS. [RT #15727] -1963. [port] Tru64 4.0E doesn't support send() and recv(). +1963. [port] Tru64 4.0E doesn't support send() and recv(). [RT #15586] 1962. [bug] Named failed to clear old update-policy when it @@ -767,7 +1007,7 @@ by native compiler. See README for additional cross compile support information. [RT #15148] -1955. [bug] Pre-allocate the cache cleaning interator. [RT #14998] +1955. [bug] Pre-allocate the cache cleaning iterator. [RT #14998] 1952. [port] hpux: tell the linker to build a runtime link path "-Wl,+b:". [RT #14816]. @@ -775,7 +1015,7 @@ 1951. [security] Drop queries from particular well known ports. Don't return FORMERR to queries from particular well known ports. [RT #15636] - + 1950. [port] Solaris 2.5.1 and earlier cannot bind() then connect() a TCP socket. This prevents the source address being set for TCP connections. [RT #15628] @@ -803,7 +1043,7 @@ 1940. [bug] Fixed a number of error conditions reported by Coverity. -1939. [bug] The resolver could dereference a null pointer after +1939. [bug] The resolver could dereference a null pointer after validation if all the queries have timed out. [RT #15528] @@ -848,7 +1088,7 @@ 1914. [protocol] DS is required to accept mnemonic algorithms (RFC 4034). Still emit numeric algorithms for - compatability with RFC 3658. [RT #15354] + compatibility with RFC 3658. [RT #15354] 1911. [bug] Update windows socket code. [RT #14965] @@ -892,7 +1132,7 @@ 1881. [func] Add a system test for named-checkconf. [RT #14931] 1877. [bug] Fix unreasonably low quantum on call to - dns_rbt_destroy2(). Remove unnecessay unhash_node() + dns_rbt_destroy2(). Remove unnecessary unhash_node() call. [RT #14919] 1875. [bug] process_dhtkey() was using the wrong memory context @@ -951,24 +1191,24 @@ 1850. [bug] Memory leak in lwres_getipnodebyaddr(). [RT #14591] 1849. [doc] All forms of the man pages (docbook, man, html) should - have consistant copyright dates. + have consistent copyright dates. 1848. [bug] Improve SMF integration. [RT #13238] 1847. [bug] isc_ondestroy_init() is called too late in - dns_rbtdb_create()/dns_rbtdb64_create(). + dns_rbtdb_create()/dns_rbtdb64_create(). [RT #13661] - + 1846. [contrib] query-loc-0.3.0 from Stephane Bortzmeyer <bortzmeyer@nic.fr>. -1845. [bug] Improve error reporting to distingish between +1845. [bug] Improve error reporting to distinguish between accept()/fcntl() and socket()/fcntl() errors. [RT #13745] 1844. [bug] inet_pton() accepted more that 4 hexadecimal digits for each 16 bit piece of the IPv6 address. The text - representation of a IPv6 address has been tighted + representation of a IPv6 address has been tightened to disallow this (draft-ietf-ipv6-addr-arch-v4-02.txt). [RT #5662] @@ -1026,7 +1266,7 @@ 1822. [bug] check-names test for RT was reversed. [RT #13382] -1821. [doc] acls definitions are no longer required to be +1821. [doc] acls definitions are no longer required to be in named.conf prior to reference. They can be defined after being referenced. @@ -1052,7 +1292,7 @@ 1807. [bug] When forwarding (forward only) set the active domain from the forward zone name. [RT #13526] - + 1804. [bug] Ensure that if we are queried for glue that it fits in the additional section or TC is set to tell the client to retry using TCP. [RT #10114] @@ -1165,7 +1405,7 @@ 1765. [bug] configure --with-openssl=auto failed. [RT #12937] 1764. [bug] dns_zone_replacedb failed to emit a error message - if there was no SOA record in the replacment db. + if there was no SOA record in the replacement db. [RT #13016] 1762. [bug] isc_interfaceiter_create() could return ISC_R_SUCCESS @@ -1180,7 +1420,7 @@ 1759. [bug] Named failed to startup if the OS supported IPv6 but had no IPv6 interfaces configured. [RT #12942] -1754. [bug] We wern't always attempting to query the parent +1754. [bug] We weren't always attempting to query the parent server for the DS records at the zone cut. [RT #12774] @@ -1199,7 +1439,7 @@ 1749. [bug] 'check-names response ignore;' failed to ignore. [RT #12866] -1747. [bug] BIND 8 compatability: named/named-checkconf failed +1747. [bug] BIND 8 compatibility: named/named-checkconf failed to parse "host-statistics-max" in named.conf. 1745. [bug] Dig/host/nslookup accept replies from link locals @@ -1213,7 +1453,7 @@ requested number of worker threads then destruction of the manager would trigger an INSIST() failure. [RT #12790] - + 1742. [bug] Deleting all records at a node then adding a previously existing record, in a single UPDATE transaction, failed to leave / regenerate the @@ -1224,7 +1464,7 @@ 1740. [bug] Replace rbt's hash algorithm as it performed badly with certain zones. [RT #12729] - + NOTE: a hash context now needs to be established via isc_hash_create() if the application was not already doing this. @@ -1239,7 +1479,7 @@ 1736. [bug] dst_key_fromnamedfile() could fail to read a public key. [RT #12687] - + 1735. [bug] 'dig +sigtrace' could die with a REQUIRE failure. [RE #12688] @@ -1277,7 +1517,7 @@ [RT #12519] 1721. [bug] Error message from the journal processing were not - always identifing the relevent journal. [RT #12519] + always identifying the relevant journal. [RT #12519] 1720. [bug] 'dig +chase' did not terminate on a RFC 2308 Type 1 negative response. [RT #12506] @@ -1330,7 +1570,7 @@ 1703. [bug] named would loop sending NOTIFY messages when it failed to receive a response. [RT #12322] -1702. [bug] also-notify should not be applied to builtin zones. +1702. [bug] also-notify should not be applied to built in zones. [RT #12323] 1701. [doc] A minimal named.conf man page. @@ -1402,7 +1642,7 @@ 1675. [bug] named would sometimes add extra NSEC records to the authority section. - + 1674. [port] linux: increase buffer size used to scan /proc/net/if_inet6. @@ -1473,7 +1713,7 @@ 1648. [func] Update dnssec-lookaside named.conf syntax to support multiple dnssec-lookaside namespaces (not yet - implemented). + implemented). 1647. [bug] It was possible trigger a INSIST when chasing a DS record that required walking back over a empty node. @@ -1486,7 +1726,7 @@ masters with keys are specified. 1644. [bug] Update the journal modification time after a - sucessfull refresh query. [RT #11436] + successful refresh query. [RT #11436] 1643. [bug] dns_db_closeversion() could leak memory / node references. [RT #11163] @@ -1505,11 +1745,11 @@ 1638. [bug] "ixfr-from-differences" could generate a REQUIRE failure if the journal open failed. [RT #11347] - + 1637. [bug] Node reference leak on error in addnoqname(). 1636. [bug] The dump done callback could get ISC_R_SUCCESS even if - a error had occured. The database version no longer + a error had occurred. The database version no longer matched the version of the database that was dumped. 1635. [bug] Memory leak on error in query_addds(). @@ -1542,7 +1782,7 @@ 1625. [bug] named failed to load/transfer RFC2535 signed zones which contained CNAMES. [RT# 11237] -1606. [bug] DLV insecurity proof was failing. +1606. [bug] DLV insecurity proof was failing. 1605. [func] New dns_db_find() option DNS_DBFIND_COVERINGNSEC. @@ -1618,14 +1858,14 @@ 1604. [bug] A xfrout_ctx_create() failure would result in xfrout_ctx_destroy() being called with a partially initialized structure. - + 1603. [bug] nsupdate: set interactive based on isatty(). [RT# 10929] 1602. [bug] Logging to a file failed unless a size was specified. [RT# 10925] -1601. [bug] Silence spurious warning 'both "recursion no;" and +1601. [bug] Silence spurious warning 'both "recursion no;" and "allow-recursion" active' warning from view "_bind". [RT# 10920] @@ -1860,7 +2100,7 @@ type, class and responding nameserver. 1511. [bug] delegation-only was generating false positives - on negative answers from subzones. + on negative answers from sub-zones. 1510. [func] New view option "root-delegation-only". Apply delegation-only check to all TLDs and root. @@ -3568,7 +3808,7 @@ 954. [bug] When requesting AXFRs or IXFRs using dig, host, or nslookup, the RD bit should not be set as zone - transfers are inherently nonrecursive. [RT #1575] + transfers are inherently non-recursive. [RT #1575] 953. [func] The /var/run/named.key file from change #843 has been replaced by /etc/rndc.key. Both @@ -3841,7 +4081,7 @@ 860. [func] Drop cross class glue in zone transfers. 859. [bug] Cache cleaning now won't swamp the CPU if there - is a persistent overlimit condition. + is a persistent over limit condition. 858. [func] isc_mem_setwater() no longer requires that when the callback function is non-NULL then its hi_water @@ -4017,7 +4257,7 @@ 811. [bug] Parentheses were not quoted in zone dumps. [RT #1194] 810. [bug] The signer name in SIG records was not properly - downcased when signing/verifying records. [RT #1186] + down-cased when signing/verifying records. [RT #1186] 809. [bug] Configuring a non-local address as a transfer-source could cause an assertion failure during load. @@ -4029,9 +4269,9 @@ ignored like it should be. 806. [bug] DNS_R_SEENINCLUDE was failing to propagate back up - the calling stack to the zone maintence level, causing - zones to not reload when an included file was touched - but the top-level zone file was not. + the calling stack to the zone maintenance level, + causing zones to not reload when an included file was + touched but the top-level zone file was not. 805. [bug] When using "forward only", missing root hints should not cause queries to fail. [RT #1143] @@ -4071,7 +4311,7 @@ in rndc.conf. 793. [cleanup] The DNSSEC tools could create filenames that were - illegal or contained shell metacharacters. They + illegal or contained shell meta-characters. They now use a different text encoding of names that doesn't have these problems. [RT #1101] @@ -4095,7 +4335,7 @@ names when mapping them into file names. 786. [bug] When DNSSEC signing/verifying data, owner names were - not properly downcased. + not properly down-cased. 785. [bug] A race condition in the resolver could cause an assertion failure. [RT #673, #872, #1048] @@ -4114,7 +4354,7 @@ 780. [bug] Error handling code dealing with out of memory or other rare errors could lead to assertion failures - by calling functions on unitialized names. [RT #1065] + by calling functions on uninitialized names. [RT #1065] 779. [func] Added the "minimal-responses" option. @@ -4257,7 +4497,7 @@ 735. [doc] Add BIND 4 migration notes. 734. [bug] An attempt to re-lock the zone lock could occur if - the server was shutdown during a zone tranfer. + the server was shutdown during a zone transfer. [RT #830] 733. [bug] Reference counts of dns_acl_t objects need to be @@ -4397,7 +4637,7 @@ 688. [func] "make tags" now works on systems with the "Exuberant Ctags" etags. - 687. [bug] Only say we have IPv6, with sufficent functionality, + 687. [bug] Only say we have IPv6, with sufficient functionality, if it has actually been tested. [RT #586] 686. [bug] dig and nslookup can now be properly aborted during @@ -4713,7 +4953,7 @@ --- 9.1.0b1 released --- 591. [bug] Work around non-reentrancy in openssl by disabling - precomputation in keys. + pre-computation in keys. 590. [doc] There are now man pages for the lwres library in doc/man/lwres. @@ -4762,7 +5002,7 @@ source address for notify messages. 577. [func] Log illegal RDATA combinations. e.g. multiple - singlton types, cname and other data. + singleton types, cname and other data. 576. [doc] isc_log_create() description did not match reality. @@ -4773,7 +5013,7 @@ have their responses validated and would leak memory. 573. [bug] The journal files of IXFRed slave zones were - inadvertantly discarded on server reload, causing + inadvertently discarded on server reload, causing "journal out of sync with zone" errors on subsequent reloads. [RT #482] @@ -4938,7 +5178,7 @@ others). 519. [bug] dns_name_split() would improperly split some bitstring - labels, zeroing a few of the least signficant bits in + labels, zeroing a few of the least significant bits in the prefix part. When such an improperly created prefix was returned to the RBT database, the bogus label was dutifully stored, corrupting the tree. @@ -4966,7 +5206,7 @@ 513. [func] New functionality added to rdnc and server to allow individual zones to be refreshed or reloaded. - 512. [bug] The zone transfer code could throw an execption with + 512. [bug] The zone transfer code could throw an exception with an invalid IXFR stream. 511. [bug] The message code could throw an assertion on an @@ -5157,7 +5397,7 @@ 452. [bug] Warn if the unimplemented option "statistics-file" is specified in named.conf. [RT #301] - 451. [func] Update forwarding implememted. + 451. [func] Update forwarding implemented. 450. [func] New function ns_client_sendraw(). @@ -5258,7 +5498,7 @@ e.g. due to corrupt zones with multiple SOA records. [RT #279] - 423. [bug] When responding to a recusive query, errors that occur + 423. [bug] When responding to a recursive query, errors that occur after following a CNAME should cause the query to fail. [RT #274] @@ -5303,7 +5543,7 @@ 409. [bug] If named was shut down early in the startup process, ns_omapi_shutdown() would attempt to lock - an unintialized mutex. [RT #262] + an uninitialized mutex. [RT #262] 408. [bug] stub zones could leak memory and reference counts if all the masters were unreachable. @@ -5370,7 +5610,7 @@ making the functions dns_zone_adddbarg() and dns_zone_cleardbargs() unnecessary. - 389. [bug] Attempting to send a reqeust over IPv6 using + 389. [bug] Attempting to send a request over IPv6 using dns_request_create() on a system without IPv6 support caused an assertion failure [RT #235]. @@ -5427,7 +5667,7 @@ of a very large RRset could cause an assertion failure during logging. - 370. [bug] The error messages for rollforward failures were + 370. [bug] The error messages for roll-forward failures were overly terse. 369. [func] Support new named.conf options, view and zone @@ -5569,7 +5809,7 @@ 328. [func] Added isc_base64_decodestring(). - 327. [bug] rndc.conf parser wasn't correctly recognising an IP + 327. [bug] rndc.conf parser wasn't correctly recognizing an IP address where a host specification was required. 326. [func] 'keys' in an 'inet' control statement is now @@ -5599,7 +5839,7 @@ where they previously didn't. 321. [bug] When synthesizing a CNAME RR for a DNAME - response, query_addcname() failed to intitialize + response, query_addcname() failed to initialize the type and class of the CNAME dns_rdata_t, causing random failures. @@ -5875,7 +6115,7 @@ --- 9.0.0b4 released --- - 253. [func] resolv.conf parser now recognises ';' and '#' as + 253. [func] resolv.conf parser now recognizes ';' and '#' as comments (anywhere in line, not just as the beginning). 252. [bug] resolv.conf parser mishandled masks on sortlists. @@ -5945,7 +6185,7 @@ requiring a quoted string. 233. [cleanup] Convert all config structure integer values to unsigned - integer (isc_uint32_t) to match grammer. + integer (isc_uint32_t) to match grammar. 232. [bug] Allow slave zones to not have a file. @@ -5982,7 +6222,7 @@ from confparser.c, because of yacc's code, are unfortunately to be expected.) - 223. [func] Several functions were reprototyped to qualify one + 223. [func] Several functions were re-prototyped to qualify one or more of their arguments with "const". Similarly, several functions that return pointers now have those pointers qualified with const. @@ -6148,7 +6388,7 @@ 183. [func] ISC_LOG_PRINTTAG option for log channels. Useful for logging the program name or other identifier. - 182. [cleanup] New commandline parameters for dnssec tools + 182. [cleanup] New command-line parameters for dnssec tools 181. [func] Added dst_key_buildfilename and dst_key_parsefilename @@ -6193,7 +6433,7 @@ --with-mit-pthreads option is no longer needed and has been removed. - 170. [cleanup] Remove inter server consistancy checks from zone, + 170. [cleanup] Remove inter server consistency checks from zone, these should return as a separate module in 9.1. dns_zone_checkservers(), dns_zone_checkparents(), dns_zone_checkchildren(), dns_zone_checkglue(). @@ -6286,7 +6526,7 @@ than continuing to itemize every header which changed, this changelog entry just notes that if a header file did not need another header file that it was including - in order to provide its advertized functionality, the + in order to provide its advertised functionality, the inclusion of the other header file was removed. See util/check-includes for how this was tested. @@ -6678,7 +6918,7 @@ 31. [bug] Use ${LIBTOOL} to compile bin/named/main.@O@. - 30. [func] config file grammer change to support optional + 30. [func] config file grammar change to support optional class type for a view. 29. [func] support new config file view options: @@ -6742,7 +6982,7 @@ 13. [bug] lib/dns/master.c and lib/dns/xfrin.c didn't ignore out-of-zone data. - 12. [bug] Fixed possible unitialized variable error. + 12. [bug] Fixed possible uninitialized variable error. 11. [bug] axfr_rrstream_first() didn't check the result code of db_rr_iterator_first(), possibly causing an assertion @@ -205,6 +205,8 @@ A: These indicate a malformed master zone. You can identify the exact Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is the last line of named.conf. +A: There are unbalanced quotes in named.conf. + A: Some text editors (notepad and wordpad) fail to put a line title indication (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a blank line to the end of the file. Named expects to @@ -375,7 +377,60 @@ A: When reloading a zone named my have multiple copies of the zone in other errors in the master file as it still has an in-core copy of the old contents. -3. General Questions +Q: I want to use IPv6 locally but I don't have a external IPv6 connection. + External lookups are slow. + +A: You can use server clauses to stop named making external lookups over + IPv6. + + server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix + server ::/0 { bogus yes; }; + +3. Operations Questions + +Q: How to change the nameservers for a zone? + +A: Step 1: Ensure all nameservers, new and old, are serving the same zone + content. + + Step 2: Work out the maximum TTL of the NS RRset in the parent and + child zones. This is the time it will take caches to be clear of a + particular version of the NS RRset. If you are just removing + nameservers you can skip to Step 6. + + Step 3: Add new nameservers to the NS RRset for the zone and wait until + all the servers for the zone are answering with this new NS RRset. + + Step 4: Inform the parent zone of the new NS RRset then wait for all + the parent servers to be answering with the new NS RRset. + + Step 5: Wait for cache to be clear of the old NS RRset. See Step 2 for + how long. If you are just adding nameservers you are done. + + Step 6: Remove any old nameservers from the zones NS RRset and wait for + all the servers for the zone to be serving the new NS RRset. + + Step 7: Inform the parent zone of the new NS RRset then wait for all + the parent servers to be answering with the new NS RRset. + + Step 8: Wait for cache to be clear of the old NS RRset. See Step 2 for + how long. + + Step 9: Turn off the old nameservers or remove the zone entry from the + configuration of the old nameservers. + + Step 10: Increment the serial number and wait for the change to be + visible in all nameservers for the zone. This ensures that zone + transfers are still working after the old servers are decommissioned. + + Note: the above procedure is designed to be transparent to dns clients. + Decommissioning the old servers too early will result in some clients + not being able to look up answers in the zone. + + Note: while it is possible to run the addition and removal stages + together it is not recommended. + +4. General Questions Q: I keep getting log messages like the following. Why? @@ -396,8 +451,8 @@ A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update protocol. Windows 2000 machines have a habit of sending dynamic update requests to DNS servers without being specifically configured to do so. If the update requests are coming from a Windows 2000 machine, - see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for - information about how to turn them off. + see <http://support.microsoft.com/support/kb/articles/q246/8/04.asp> + for information about how to turn them off. Q: When I do a "dig . ns", many of the A records for the root servers are missing. Why? @@ -468,7 +523,7 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are using then you have failed to follow RFC 1918 usage rules and are leaking queries to the Internet. You should establish your own zones for these addresses to prevent you querying the Internet's name servers - for these addresses. Please see http://as112.net/ for details of the + for these addresses. Please see <http://as112.net/> for details of the problems you are causing and the counter measures that have had to be deployed. @@ -541,9 +596,16 @@ A: No. The BIND 9 bug database is kept closed for a number of reasons. that have been fixed post release. That is as close as we can get to providing a bug database. -4. Operating-System Specific Questions +Q: Why do queries for NSEC3 records fail to return the NSEC3 record? -4.1. HPUX +A: NSEC3 records are strictly meta data and can only be returned in the + authority section. This is done so that signing the zone using NSEC3 + records does not bring names into existance that do not exist in the + unsigned version of the zone. + +5. Operating-System Specific Questions + +5.1. HPUX Q: I get the following error trying to configure BIND: @@ -559,7 +621,7 @@ A: You have attempted to configure BIND with the bundled C compiler. This ./configure CC=<compiler> ... -4.2. Linux +5.2. Linux Q: Why do I get the following errors: @@ -569,7 +631,20 @@ Q: Why do I get the following errors: A: This is the result of a Linux kernel bug. - See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2 + See: <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w= + 2> + +Q: Why does named lock up when it attempts to connect over IPSEC tunnels? + +A: This is due to a kernel bug where the fact that a socket is marked + non-blocking is ignored. It is reported that setting xfrm_larval_drop + to 1 helps but this may have negative side effects. See: <https:// + bugzilla.redhat.com/show_bug.cgi?id=427629> and <http://lkml.org/lkml/ + 2007/12/4/260>. + + xfrm_larval_drop can be set to 1 by the following procedure: + + echo "1" > proc/sys/net/core/xfrm_larval_drop Q: Why do I see 5 (or more) copies of named on Linux? @@ -613,7 +688,7 @@ Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core - A: Red Hat Security Enhanced Linux (SELinux) policy security protections : Red Hat have adopted the National Security Agency's SELinux security - policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND + policy (see <http://www.nsa.gov/selinux>) and recommendations for BIND security , which are more secure than running named in a chroot and make use of the bind-chroot environment unnecessary . @@ -716,7 +791,7 @@ A: This is usually due to "/proc/net/if_inet6" not being available in the proc /proc proc defaults 0 0 proc /var/named/proc proc defaults 0 0 -4.3. Windows +5.3. Windows Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why? @@ -742,7 +817,7 @@ A: This is the service manager saying that named exited. You need to Directory "C:\windows\dns\etc"; }; -4.4. FreeBSD +5.4. FreeBSD Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there. @@ -753,17 +828,17 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to /etc/rc.conf rand_irqs="3 14 15" - See also http://people.freebsd.org/~dougb/randomness.html + See also <http://people.freebsd.org/~dougb/randomness.html>. -4.5. Solaris +5.5. Solaris Q: How do I integrate BIND 9 and Solaris SMF A: Sun has a blog entry describing how to do this. - http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris> -4.6. Apple Mac OS X +5.6. Apple Mac OS X Q: How do I run BIND 9 on Apple Mac OS X? @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: FAQ.xml,v 1.4.6.20 2008/02/25 05:07:58 marka Exp $ --> +<!-- $Id: FAQ.xml,v 1.4.6.25 2008/09/10 01:22:05 tbox Exp $ --> <article class="faq"> <title>Frequently Asked Questions about BIND 9</title> @@ -393,6 +393,11 @@ named-checkzone example.com tmp</programlisting> </question> <answer> <para> + There are unbalanced quotes in named.conf. + </para> + </answer> + <answer> + <para> Some text editors (notepad and wordpad) fail to put a line title indication (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a blank line to @@ -661,9 +666,98 @@ zone "list.dsbl.org" { </para> </answer> </qandaentry> + + <qandaentry> + <question> + <para> + I want to use IPv6 locally but I don't have a external IPv6 + connection. External lookups are slow. + </para> + </question> + <answer> + <para> + You can use server clauses to stop named making external lookups + over IPv6. + </para> + <programlisting> +server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix +server ::/0 { bogus yes; }; +</programlisting> + </answer> + </qandaentry> </qandadiv> <!-- Configuration and Setup Questions --> + <qandadiv><title>Operations Questions</title> + + <qandaentry> + <question> + <para> + How to change the nameservers for a zone? + </para> + </question> + <answer> + <para> + Step 1: Ensure all nameservers, new and old, are serving the + same zone content. + </para> + <para> + Step 2: Work out the maximum TTL of the NS RRset in the parent and child + zones. This is the time it will take caches to be clear of a + particular version of the NS RRset. + If you are just removing nameservers you can skip to Step 6. + </para> + <para> + Step 3: Add new nameservers to the NS RRset for the zone and + wait until all the servers for the zone are answering with this + new NS RRset. + </para> + <para> + Step 4: Inform the parent zone of the new NS RRset then wait for all the + parent servers to be answering with the new NS RRset. + </para> + <para> + Step 5: Wait for cache to be clear of the old NS RRset. + See Step 2 for how long. + If you are just adding nameservers you are done. + </para> + <para> + Step 6: Remove any old nameservers from the zones NS RRset and + wait for all the servers for the zone to be serving the new NS RRset. + </para> + <para> + Step 7: Inform the parent zone of the new NS RRset then wait for all the + parent servers to be answering with the new NS RRset. + </para> + <para> + Step 8: Wait for cache to be clear of the old NS RRset. + See Step 2 for how long. + </para> + <para> + Step 9: Turn off the old nameservers or remove the zone entry from + the configuration of the old nameservers. + </para> + <para> + Step 10: Increment the serial number and wait for the change to + be visible in all nameservers for the zone. This ensures that + zone transfers are still working after the old servers are + decommissioned. + </para> + <para> + Note: the above procedure is designed to be transparent + to dns clients. Decommissioning the old servers too early + will result in some clients not being able to look up + answers in the zone. + </para> + <para> + Note: while it is possible to run the addition and removal + stages together it is not recommended. + </para> + </answer> + </qandaentry> + + </qandadiv> <!-- Operations Questions --> + <qandadiv><title>General Questions</title> <qandaentry> @@ -706,8 +800,7 @@ zone "list.dsbl.org" { requests are coming from a Windows 2000 machine, see <ulink url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp"> - http://support.microsoft.com/support/kb/articles/q246/8/04.asp - </ulink> + <http://support.microsoft.com/support/kb/articles/q246/8/04.asp></ulink> for information about how to turn them off. </para> </answer> @@ -857,7 +950,7 @@ serial-query-rate 5; // default 20</programlisting> usage rules and are leaking queries to the Internet. You should establish your own zones for these addresses to prevent you querying the Internet's name servers for these addresses. - Please see <ulink url="http://as112.net/">http://as112.net/</ulink> + Please see <ulink url="http://as112.net/"><http://as112.net/></ulink> for details of the problems you are causing and the counter measures that have had to be deployed. </para> @@ -963,6 +1056,23 @@ empty: </answer> </qandaentry> + <qandaentry> + <question> + <para> + Why do queries for NSEC3 records fail to return the NSEC3 record? + </para> + </question> + <answer> + <para> + NSEC3 records are strictly meta data and can only be + returned in the authority section. This is done so that + signing the zone using NSEC3 records does not bring names + into existance that do not exist in the unsigned version + of the zone. + </para> + </answer> + </qandaentry> + </qandadiv> <!-- General Questions --> <qandadiv><title>Operating-System Specific Questions</title> @@ -1010,7 +1120,31 @@ client: UDP client handler shutting down due to fatal receive error: unexpected </para> <para> See: - <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2">http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2</ulink> + <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2"><http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2></ulink> + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why does named lock up when it attempts to connect over IPSEC tunnels? + </para> + </question> + <answer> + <para> + This is due to a kernel bug where the fact that a socket is marked + non-blocking is ignored. It is reported that setting + xfrm_larval_drop to 1 helps but this may have negative side effects. + See: +<ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=427629"><https://bugzilla.redhat.com/show_bug.cgi?id=427629></ulink> + and +<ulink url="http://lkml.org/lkml/2007/12/4/260"><http://lkml.org/lkml/2007/12/4/260></ulink>. + </para> + <para> + xfrm_larval_drop can be set to 1 by the following procedure: +<programlisting> +echo "1" > proc/sys/net/core/xfrm_larval_drop</programlisting> </para> </answer> </qandaentry> @@ -1101,8 +1235,9 @@ modprobe capability</programlisting> <para> Red Hat have adopted the National Security Agency's - SELinux security policy ( see http://www.nsa.gov/selinux - ) and recommendations for BIND security , which are more + SELinux security policy (see <ulink + url="http://www.nsa.gov/selinux"><http://www.nsa.gov/selinux></ulink>) + and recommendations for BIND security , which are more secure than running named in a chroot and make use of the bind-chroot environment unnecessary . </para> @@ -1341,8 +1476,7 @@ rand_irqs="3 14 15"</programlisting> <para> See also <ulink url="http://people.freebsd.org/~dougb/randomness.html"> - http://people.freebsd.org/~dougb/randomness.html - </ulink> + <http://people.freebsd.org/~dougb/randomness.html></ulink>. </para> </answer> </qandaentry> @@ -1364,7 +1498,7 @@ rand_irqs="3 14 15"</programlisting> <para> <ulink url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris"> - http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris> </ulink> </para> </answer> @@ -43,6 +43,14 @@ BIND 9 Nominum, Inc. +BIND 9.3.6 + + BIND 9.3.6 is a maintenance release, containing fixes for + a number of bugs in previous releases. + + The major change since 9.3.5 is query port randomization, + to improve resilience against cache poisoning attacks. + BIND 9.3.2 BIND 9.3.2 is a maintenance release, containing fixes for @@ -145,7 +153,7 @@ BIND 9.2.0 This does not apply to the use of TSIG, which does not require OpenSSL. - - The source distribution now builds on Windows NT/2000. + - The source distribution now builds on Windows. See win32utils/readme1.txt and win32utils/win32-build.txt for details. @@ -194,11 +202,8 @@ BIND 9.2.0 --with-libtool does not work on AIX. - --with-libtool does not work on SunOS 4. configure - requires "printf" which is not available. - - A bug in the Windows 2000 DNS server can cause zone transfers - from a BIND 9 server to a W2K server to fail. For details, + A bug in some versions of the Microsoft DNS server can cause zone + transfers from a BIND 9 server to a W2K server to fail. For details, see the "Zone Transfers" section in doc/misc/migration. For a detailed list of user-visible changes from @@ -218,7 +223,11 @@ Building NetBSD 1.5 Slackware Linux 8.1 Solaris 8, 9, 9 (x86) - Windows NT/2000/XP/2003 + Windows XP/2003/2008 + + NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of + Windows, including Windows NT and Windows 2000, are no longer + supported. Additionally, we have unverified reports of success building previous versions of BIND 9 from users of the following systems: @@ -270,6 +279,10 @@ Building -DDIG_SIGCHASE_BU=1) Disable dropping queries from particular well known ports. -DNS_CLIENT_DROPPORT=0 + Enable workaround for Solaris kernel bug about /dev/poll + -DISC_SOCKET_USE_POLLWATCH=1 + The watch timeout is also configurable, e.g., + -DISC_SOCKET_POLLWATCH_TIMEOUT=20 LDFLAGS Linker flags. Defaults to empty string. @@ -298,6 +311,10 @@ Building To build libbind (the BIND 8 resolver library), specify "--enable-libbind" on the configure command line. + On some platforms it is necessary to explictly request large + file support to handle files bigger than 2GB. This can be + done by "--enable-largefile" on the configure command line. + On some platforms, BIND 9 can be built with multithreading support, allowing it to take advantage of multiple CPUs. You can specify whether to build a multithreaded BIND 9 @@ -347,6 +364,9 @@ Building on your system, and some require Perl; see bin/tests/system/README for details. + SunOS 4 requires "printf" to be installed to make the shared + libraries. sh-utils-1.16 provides a "printf" which compiles + on SunOS 4. Documentation diff --git a/bin/dig/dig.1 b/bin/dig/dig.1 index a5f5ff3c04a3..346e45d80362 100644 --- a/bin/dig/dig.1 +++ b/bin/dig/dig.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dig.1,v 1.14.2.4.2.18 2007/05/16 06:10:54 marka Exp $ +.\" $Id: dig.1,v 1.14.2.4.2.20 2008/10/14 01:20:30 tbox Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ dig \- DNS lookup utility .SH "SYNOPSIS" .HP 4 -\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...] +\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...] .HP 4 \fBdig\fR [\fB\-h\fR] .HP 4 @@ -59,7 +59,9 @@ Unless it is told to query a specific name server, will try each of the servers listed in \fI/etc/resolv.conf\fR. .PP -When no command line arguments or options are given, will perform an NS query for "." (the root). +When no command line arguments or options are given, +\fBdig\fR +will perform an NS query for "." (the root). .PP It is possible to set per\-user defaults for \fBdig\fR @@ -70,7 +72,7 @@ The IN and CH class names overlap with the IN and CH top level domains names. Ei \fB\-t\fR and \fB\-c\fR -options to specify the type and class or use "IN." and "CH." when looking up these top level domains. +options to specify the type and class, or use "IN." and "CH." when looking up these top level domains. .SH "SIMPLE USAGE" .PP A typical invocation of @@ -137,6 +139,10 @@ operate in batch mode by reading a list of lookup requests to process from the f \fBdig\fR using the command\-line interface. .PP +The +\fB\-m\fR +option enables memory usage debugging. +.PP If a non\-standard port number is to be queried, the \fB\-p\fR option is used. @@ -517,7 +523,7 @@ RFC1035. .PP There are probably too many query options. .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 763613dfca79..34f0e90a3d81 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dig.c,v 1.157.2.13.2.35 2007/08/28 07:19:07 tbox Exp $ */ +/* $Id: dig.c,v 1.157.2.13.2.39 2008/10/15 02:20:32 marka Exp $ */ #include <config.h> #include <stdlib.h> @@ -47,7 +47,7 @@ #define ADD_STRING(b, s) { \ if (strlen(s) >= isc_buffer_availablelength(b)) \ - return (ISC_R_NOSPACE); \ + return (ISC_R_NOSPACE); \ else \ isc_buffer_putstr(b, s); \ } @@ -67,7 +67,7 @@ static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE, ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE, multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE; -static const char *opcodetext[] = { +static const char * const opcodetext[] = { "QUERY", "IQUERY", "STATUS", @@ -86,7 +86,7 @@ static const char *opcodetext[] = { "RESERVED15" }; -static const char *rcodetext[] = { +static const char * const rcodetext[] = { "NOERROR", "FORMERR", "SERVFAIL", @@ -136,8 +136,8 @@ help(void) { " q-type is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n" " (Use ixfr=version for type ixfr)\n" " q-opt is one of:\n" -" -x dot-notation (shortcut for in-addr lookups)\n" -" -i (IP6.INT reverse IPv6 lookups)\n" +" -x dot-notation (shortcut for reverse lookups)\n" +" -i (use IP6.INT for IPv6 reverse lookups)\n" " -f filename (batch mode)\n" " -b address[#port] (bind to source address/port)\n" " -p port (specify port number)\n" @@ -147,6 +147,7 @@ help(void) { " -y name:key (specify named base64 tsig key)\n" " -4 (use IPv4 query transport only)\n" " -6 (use IPv6 query transport only)\n" +" -m (enable memory usage debugging)\n" " d-opt is of the form +keyword[=value], where keyword is:\n" " +[no]vc (TCP mode)\n" " +[no]tcp (TCP mode, alternate syntax)\n" @@ -367,7 +368,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, else if (nottl || noclass) result = dns_master_stylecreate(&style, styleflags, 24, 24, 32, 40, 80, 8, mctx); - else + else result = dns_master_stylecreate(&style, styleflags, 24, 32, 40, 48, 80, 8, mctx); check_result(result, "dns_master_stylecreate"); @@ -376,7 +377,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, if (style != NULL) dns_master_styledestroy(&style, mctx); - + return(result); } #endif @@ -413,7 +414,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { else if (nottl || noclass) result = dns_master_stylecreate(&style, styleflags, 24, 24, 32, 40, 80, 8, mctx); - else + else result = dns_master_stylecreate(&style, styleflags, 24, 32, 40, 48, 80, 8, mctx); check_result(result, "dns_master_stylecreate"); @@ -613,7 +614,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) { strncat(lookup->cmdline, append, remaining); } if (first) { - snprintf(append, sizeof(append), + snprintf(append, sizeof(append), ";; global options: %s %s\n", short_form ? "short_form" : "", printcmd ? "printcmd" : ""); @@ -691,7 +692,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, FULLCHECK2("aaonly", "aaflag"); lookup->aaonly = state; break; - case 'd': + case 'd': switch (cmd[2]) { case 'd': /* additional */ FULLCHECK("additional"); @@ -776,11 +777,11 @@ plus_option(char *option, isc_boolean_t is_batchfile, FULLCHECK("defname"); usesearch = state; break; - case 'n': /* dnssec */ + case 'n': /* dnssec */ FULLCHECK("dnssec"); lookup->dnssec = state; break; - case 'o': /* domain */ + case 'o': /* domain */ FULLCHECK("domain"); if (value == NULL) goto need_value; @@ -844,7 +845,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, goto invalid_option; } break; - case 'q': + case 'q': switch (cmd[1]) { case 'r': /* qr */ FULLCHECK("qr"); @@ -907,11 +908,11 @@ plus_option(char *option, isc_boolean_t is_batchfile, break; #ifdef DIG_SIGCHASE case 'i': /* sigchase */ - FULLCHECK("sigchase"); + FULLCHECK("sigchase"); lookup->sigchase = state; if (lookup->sigchase) lookup->dnssec = ISC_TRUE; - break; + break; #endif case 't': /* stats */ FULLCHECK("stats"); @@ -939,7 +940,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, timeout = 1; break; #if DIG_SIGCHASE_TD - case 'o': /* topdown */ + case 'o': /* topdown */ FULLCHECK("topdown"); lookup->do_topdown = state; break; @@ -974,7 +975,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, #ifdef DIG_SIGCHASE case 'u': /* trusted-key */ FULLCHECK("trusted-key"); - if (value == NULL) + if (value == NULL) goto need_value; if (!state) goto invalid_option; @@ -1018,8 +1019,8 @@ static const char *single_dash_opts = "46dhimnv"; static const char *dash_opts = "46bcdfhikmnptvyx"; static isc_boolean_t dash_option(char *option, char *next, dig_lookup_t **lookup, - isc_boolean_t *open_type_class, isc_boolean_t *need_clone, - int argc, char **argv, isc_boolean_t *firstarg) + isc_boolean_t *open_type_class, isc_boolean_t *need_clone, + int argc, char **argv, isc_boolean_t *firstarg) { char opt, *value, *ptr; isc_result_t result; @@ -1107,7 +1108,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, hash = strchr(value, '#'); if (hash != NULL) { srcport = (in_port_t) - parse_uint(hash + 1, + parse_uint(hash + 1, "port number", MAXPORT); *hash = '\0'; } else @@ -1179,7 +1180,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, (*lookup)->rdtypeset = ISC_TRUE; (*lookup)->ixfr_serial = parse_uint(&value[5], "serial number", - MAXSERIAL); + MAXSERIAL); (*lookup)->section_question = plusquest; (*lookup)->comments = pluscomm; } else { @@ -1286,7 +1287,7 @@ getaddresses(dig_lookup_t *lookup, const char *host) { char tmp[ISC_NETADDR_FORMATSIZE]; result = bind9_getaddresses(host, 0, sockaddrs, - DIG_MAX_ADDRESSES, &count); + DIG_MAX_ADDRESSES, &count); if (result != ISC_R_SUCCESS) fatal("couldn't get address for '%s': %s", host, isc_result_totext(result)); @@ -1348,7 +1349,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (homedir != NULL) { unsigned int n; n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc", - homedir); + homedir); if (n < sizeof(rcfile)) batchfp = fopen(rcfile, "r"); } @@ -1402,16 +1403,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rc <= 1) { if (dash_option(&rv[0][1], NULL, &lookup, &open_type_class, - &need_clone, argc, argv, - &firstarg)) { + &need_clone, argc, argv, + &firstarg)) { rc--; rv++; } } else { if (dash_option(&rv[0][1], rv[1], &lookup, &open_type_class, - &need_clone, argc, argv, - &firstarg)) { + &need_clone, argc, argv, + &firstarg)) { rc--; rv++; } @@ -1428,7 +1429,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, tr.base = rv[0]; tr.length = strlen(rv[0]); result = dns_rdatatype_fromtext(&rdtype, - (isc_textregion_t *)&tr); + (isc_textregion_t *)&tr); if (result == ISC_R_SUCCESS && rdtype == dns_rdatatype_ixfr) { result = DNS_R_UNKNOWN; @@ -1449,8 +1450,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, lookup->rdtypeset = ISC_TRUE; lookup->ixfr_serial = parse_uint(&rv[0][5], - "serial number", - MAXSERIAL); + "serial number", + MAXSERIAL); lookup->section_question = plusquest; lookup->comments = pluscomm; @@ -1485,7 +1486,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, lookup = clone_lookup(default_lookup, ISC_TRUE); need_clone = ISC_TRUE; - strncpy(lookup->textname, rv[0], + strncpy(lookup->textname, rv[0], sizeof(lookup->textname)); lookup->textname[sizeof(lookup->textname)-1]=0; lookup->trace_root = ISC_TF(lookup->trace || diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook index 82b2516cbbe6..8a072d191d3a 100644 --- a/bin/dig/dig.docbook +++ b/bin/dig/dig.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.docbook,v 1.4.2.7.4.20 2007/08/28 07:19:07 tbox Exp $ --> +<!-- $Id: dig.docbook,v 1.4.2.7.4.23 2008/10/14 00:55:01 marka Exp $ --> <refentry> @@ -38,6 +38,7 @@ <year>2005</year> <year>2006</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -62,6 +63,7 @@ <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> <arg><option>-f <replaceable class="parameter">filename</replaceable></option></arg> <arg><option>-k <replaceable class="parameter">filename</replaceable></option></arg> +<arg><option>-m</option></arg> <arg><option>-p <replaceable class="parameter">port#</replaceable></option></arg> <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg> <arg><option>-x <replaceable class="parameter">addr</replaceable></option></arg> @@ -114,10 +116,10 @@ Unless it is told to query a specific name server, <filename>/etc/resolv.conf</filename>. </para> -<para> -When no command line arguments or options are given, will perform an -NS query for "." (the root). -</para> + <para> + When no command line arguments or options are given, + <command>dig</command> will perform an NS query for "." (the root). + </para> <para> It is possible to set per-user defaults for <command>dig</command> via @@ -128,7 +130,7 @@ are applied before the command line arguments. <para> The IN and CH class names overlap with the IN and CH top level domains names. Either use the <option>-t</option> and - <option>-c</option> options to specify the type and class or + <option>-c</option> options to specify the type and class, or use "IN." and "CH." when looking up these top level domains. </para> @@ -200,6 +202,12 @@ the same way they would be presented as queries to <command>dig</command> using the command-line interface. </para> + <para> + The <option>-m</option> option enables memory usage debugging. + <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD + documented in include/isc/mem.h --> + </para> + <para> If a non-standard port number is to be queried, the <option>-p</option> option is used. <parameter>port#</parameter> is diff --git a/bin/dig/dig.html b/bin/dig/dig.html index 054c1974656b..1c18ec309aa1 100644 --- a/bin/dig/dig.html +++ b/bin/dig/dig.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dig.html,v 1.6.2.4.2.23 2007/05/16 06:10:54 marka Exp $ --> +<!-- $Id: dig.html,v 1.6.2.4.2.25 2008/10/14 01:20:30 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -29,12 +29,12 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">dig</code> [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div> +<div class="cmdsynopsis"><p><code class="command">dig</code> [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div> <div class="cmdsynopsis"><p><code class="command">dig</code> [<code class="option">-h</code>]</p></div> <div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543485"></a><h2>DESCRIPTION</h2> +<a name="id2543493"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">dig</strong></span> (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -59,9 +59,9 @@ Unless it is told to query a specific name server, <code class="filename">/etc/resolv.conf</code>. </p> <p> -When no command line arguments or options are given, will perform an -NS query for "." (the root). -</p> + When no command line arguments or options are given, + <span><strong class="command">dig</strong></span> will perform an NS query for "." (the root). + </p> <p> It is possible to set per-user defaults for <span><strong class="command">dig</strong></span> via <code class="filename">${HOME}/.digrc</code>. This file is read and any options in it @@ -70,12 +70,12 @@ are applied before the command line arguments. <p> The IN and CH class names overlap with the IN and CH top level domains names. Either use the <code class="option">-t</code> and - <code class="option">-c</code> options to specify the type and class or + <code class="option">-c</code> options to specify the type and class, or use "IN." and "CH." when looking up these top level domains. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543554"></a><h2>SIMPLE USAGE</h2> +<a name="id2543565"></a><h2>SIMPLE USAGE</h2> <p> A typical invocation of <span><strong class="command">dig</strong></span> looks like: </p> @@ -113,7 +113,7 @@ ANY, A, MX, SIG, etc. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543633"></a><h2>OPTIONS</h2> +<a name="id2543644"></a><h2>OPTIONS</h2> <p> The <code class="option">-b</code> option sets the source IP address of the query to <em class="parameter"><code>address</code></em>. This must be a valid address on @@ -134,6 +134,10 @@ the same way they would be presented as queries to <span><strong class="command">dig</strong></span> using the command-line interface. </p> <p> + The <code class="option">-m</code> option enables memory usage debugging. + + </p> +<p> If a non-standard port number is to be queried, the <code class="option">-p</code> option is used. <em class="parameter"><code>port#</code></em> is the port number that <span><strong class="command">dig</strong></span> will send its queries @@ -194,7 +198,7 @@ being used. In BIND, this is done by providing appropriate </p> </div> <div class="refsect1" lang="en"> -<a name="id2543816"></a><h2>QUERY OPTIONS</h2> +<a name="id2543837"></a><h2>QUERY OPTIONS</h2> <p> <span><strong class="command">dig</strong></span> provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -452,7 +456,7 @@ Requires dig be compiled with -DDIG_SIGCHASE. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544553"></a><h2>MULTIPLE QUERIES</h2> +<a name="id2544574"></a><h2>MULTIPLE QUERIES</h2> <p> The BIND 9 implementation of <span><strong class="command">dig </strong></span> supports specifying multiple queries on the command line (in addition to @@ -493,7 +497,7 @@ will not print the initial query when it looks up the NS records for </p> </div> <div class="refsect1" lang="en"> -<a name="id2544612"></a><h2>FILES</h2> +<a name="id2544633"></a><h2>FILES</h2> <p> <code class="filename">/etc/resolv.conf</code> </p> @@ -502,7 +506,7 @@ will not print the initial query when it looks up the NS records for </p> </div> <div class="refsect1" lang="en"> -<a name="id2544631"></a><h2>SEE ALSO</h2> +<a name="id2544721"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, @@ -511,7 +515,7 @@ will not print the initial query when it looks up the NS records for </p> </div> <div class="refsect1" lang="en"> -<a name="id2544738"></a><h2>BUGS </h2> +<a name="id2544759"></a><h2>BUGS </h2> <p> There are probably too many query options. </p> diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index efd24030b17f..2c81fd433c8c 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dighost.c,v 1.221.2.19.2.46.4.2 2008/07/23 23:16:25 marka Exp $ */ +/* $Id: dighost.c,v 1.221.2.19.2.48 2008/07/23 23:36:21 marka Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to diff --git a/bin/dig/host.1 b/bin/dig/host.1 index 2d1687a687c3..1d09af9145de 100644 --- a/bin/dig/host.1 +++ b/bin/dig/host.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: host.1,v 1.11.2.1.4.12 2007/05/09 03:32:36 marka Exp $ +.\" $Id: host.1,v 1.11.2.1.4.13 2008/04/29 01:21:29 tbox Exp $ .\" .hy 0 .ad l @@ -154,7 +154,7 @@ option is used to select the query type. \fItype\fR can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, \fBhost\fR -automatically selects an appropriate query type. By default it looks for A records, but if the +automatically selects an appropriate query type. By default it looks for A, AAAA, and MX records, but if the \fB\-C\fR option was given, queries will be made for SOA records, and if \fIname\fR @@ -187,7 +187,7 @@ will effectively wait forever for a reply. The time to wait for a response will \fBdig\fR(1), \fBnamed\fR(8). .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook index a399043403ba..29ca7ea658f1 100644 --- a/bin/dig/host.docbook +++ b/bin/dig/host.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: host.docbook,v 1.2.2.2.4.12 2007/08/28 07:19:07 tbox Exp $ --> +<!-- $Id: host.docbook,v 1.2.2.2.4.14 2008/04/28 23:45:35 tbox Exp $ --> <refentry> @@ -37,6 +37,7 @@ <year>2004</year> <year>2005</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -185,7 +186,7 @@ The <option>-t</option> option is used to select the query type. <parameter>type</parameter> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <command>host</command> automatically selects an appropriate query -type. By default it looks for A records, but if the +type. By default it looks for A, AAAA, and MX records, but if the <option>-C</option> option was given, queries will be made for SOA records, and if <parameter>name</parameter> is a dotted-decimal IPv4 address or colon-delimited IPv6 address, <command>host</command> will diff --git a/bin/dig/host.html b/bin/dig/host.html index 07c930550f45..a1786bb1c578 100644 --- a/bin/dig/host.html +++ b/bin/dig/host.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: host.html,v 1.4.2.1.4.19 2007/05/09 03:32:36 marka Exp $ --> +<!-- $Id: host.html,v 1.4.2.1.4.20 2008/04/29 01:21:29 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -32,7 +32,7 @@ <div class="cmdsynopsis"><p><code class="command">host</code> [<code class="option">-aCdlnrTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543411"></a><h2>DESCRIPTION</h2> +<a name="id2543414"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">host</strong></span> is a simple utility for performing DNS lookups. @@ -134,7 +134,7 @@ The <code class="option">-t</code> option is used to select the query type. <em class="parameter"><code>type</code></em> can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, <span><strong class="command">host</strong></span> automatically selects an appropriate query -type. By default it looks for A records, but if the +type. By default it looks for A, AAAA, and MX records, but if the <code class="option">-C</code> option was given, queries will be made for SOA records, and if <em class="parameter"><code>name</code></em> is a dotted-decimal IPv4 address or colon-delimited IPv6 address, <span><strong class="command">host</strong></span> will @@ -155,13 +155,13 @@ value for an integer quantity. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543682"></a><h2>FILES</h2> +<a name="id2543685"></a><h2>FILES</h2> <p> <code class="filename">/etc/resolv.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2543694"></a><h2>SEE ALSO</h2> +<a name="id2543698"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>, <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>. diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 877ac0782909..2d3215366724 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.19.12.13 2007/05/09 03:32:36 marka Exp $ +.\" $Id: dnssec-keygen.8,v 1.19.12.14 2008/10/16 01:19:52 tbox Exp $ .\" .hy 0 .ad l @@ -187,14 +187,14 @@ and .PP \fBdnssec\-signzone\fR(8), BIND 9 Administrator Reference Manual, -RFC 2535, +RFC 2539, RFC 2845, -RFC 2539. +RFC 4033. .SH "AUTHOR" .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook index 6ef1f090e628..6690f542c25e 100644 --- a/bin/dnssec/dnssec-keygen.docbook +++ b/bin/dnssec/dnssec-keygen.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.docbook,v 1.3.12.13 2007/08/28 07:19:07 tbox Exp $ --> +<!-- $Id: dnssec-keygen.docbook,v 1.3.12.15 2008/10/15 23:45:34 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,6 +36,7 @@ <year>2004</year> <year>2005</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -337,9 +338,9 @@ <manvolnum>8</manvolnum> </citerefentry>, <citetitle>BIND 9 Administrator Reference Manual</citetitle>, - <citetitle>RFC 2535</citetitle>, + <citetitle>RFC 2539</citetitle>, <citetitle>RFC 2845</citetitle>, - <citetitle>RFC 2539</citetitle>. + <citetitle>RFC 4033</citetitle>. </para> </refsect1> diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html index 6d3cc83f5ddf..f855d1f433de 100644 --- a/bin/dnssec/dnssec-keygen.html +++ b/bin/dnssec/dnssec-keygen.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-keygen.html,v 1.5.2.1.4.19 2007/05/09 03:32:36 marka Exp $ --> +<!-- $Id: dnssec-keygen.html,v 1.5.2.1.4.20 2008/10/16 01:19:52 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -32,7 +32,7 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543462"></a><h2>DESCRIPTION</h2> +<a name="id2543465"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate @@ -41,7 +41,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543475"></a><h2>OPTIONS</h2> +<a name="id2543478"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt> <dd> @@ -144,7 +144,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543744"></a><h2>GENERATED KEYS</h2> +<a name="id2543747"></a><h2>GENERATED KEYS</h2> <p> When <span><strong class="command">dnssec-keygen</strong></span> completes successfully, it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code> @@ -187,7 +187,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543900"></a><h2>EXAMPLE</h2> +<a name="id2543835"></a><h2>EXAMPLE</h2> <p> To generate a 768-bit DSA key for the domain <strong class="userinput"><code>example.com</code></strong>, the following command would be @@ -209,17 +209,17 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543946"></a><h2>SEE ALSO</h2> +<a name="id2543881"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, - <em class="citetitle">RFC 2535</em>, + <em class="citetitle">RFC 2539</em>, <em class="citetitle">RFC 2845</em>, - <em class="citetitle">RFC 2539</em>. + <em class="citetitle">RFC 4033</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543979"></a><h2>AUTHOR</h2> +<a name="id2543982"></a><h2>AUTHOR</h2> <p> <span class="corpauthor">Internet Systems Consortium</span> </p> diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index e1e88c8466ce..f1d55adf451e 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.23.2.1.4.14 2007/05/09 03:32:36 marka Exp $ +.\" $Id: dnssec-signzone.8,v 1.23.2.1.4.15 2008/10/16 01:19:52 tbox Exp $ .\" .hy 0 .ad l @@ -209,12 +209,12 @@ db.example.com.signed .PP \fBdnssec\-keygen\fR(8), BIND 9 Administrator Reference Manual, -RFC 2535. +RFC 4033. .SH "AUTHOR" .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c index 10e1133660c4..4d35f98f8ff2 100644 --- a/bin/dnssec/dnssec-signzone.c +++ b/bin/dnssec/dnssec-signzone.c @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signzone.c,v 1.139.2.2.4.29 2008/01/30 01:51:54 marka Exp $ */ +/* $Id: dnssec-signzone.c,v 1.139.2.2.4.30 2008/06/02 00:26:20 marka Exp $ */ #include <config.h> @@ -117,7 +117,6 @@ static dns_name_t *gorigin; /* The database origin */ static isc_task_t *master = NULL; static unsigned int ntasks = 0; static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE; -static unsigned int assigned = 0, completed = 0; static isc_boolean_t nokeys = ISC_FALSE; static isc_boolean_t removefile = ISC_FALSE; static isc_boolean_t generateds = ISC_FALSE; @@ -1094,16 +1093,19 @@ assignwork(isc_task_t *task, isc_task_t *worker) { dns_rdataset_t nsec; isc_boolean_t found; isc_result_t result; + static unsigned int ended = 0; /* Protected by namelock. */ if (shuttingdown) return; + LOCK(&namelock); if (finished) { - if (assigned == completed) { + ended++; + if (ended == ntasks) { isc_task_detach(&task); isc_app_shutdown(); } - return; + goto unlock; } fname = isc_mem_get(mctx, sizeof(dns_fixedname_t)); @@ -1113,7 +1115,6 @@ assignwork(isc_task_t *task, isc_task_t *worker) { name = dns_fixedname_name(fname); node = NULL; found = ISC_FALSE; - LOCK(&namelock); while (!found) { result = dns_dbiterator_current(gdbiter, &node, name); if (result != ISC_R_SUCCESS) @@ -1140,14 +1141,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) { fatal("failure iterating database: %s", isc_result_totext(result)); } - UNLOCK(&namelock); if (!found) { - if (assigned == completed) { + ended++; + if (ended == ntasks) { isc_task_detach(&task); isc_app_shutdown(); } isc_mem_put(mctx, fname, sizeof(dns_fixedname_t)); - return; + goto unlock; } sevent = (sevent_t *) isc_event_allocate(mctx, task, SIGNER_EVENT_WORK, @@ -1158,7 +1159,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) { sevent->node = node; sevent->fname = fname; isc_task_send(worker, ISC_EVENT_PTR(&sevent)); - assigned++; + unlock: + UNLOCK(&namelock); } /* @@ -1181,7 +1183,6 @@ writenode(isc_task_t *task, isc_event_t *event) { isc_task_t *worker; sevent_t *sevent = (sevent_t *)event; - completed++; worker = (isc_task_t *)event->ev_sender; dumpnode(dns_fixedname_name(sevent->fname), sevent->node); cleannode(gdb, gversion, sevent->node); diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook index d3f9fc5c5b83..b5587d2153fd 100644 --- a/bin/dnssec/dnssec-signzone.docbook +++ b/bin/dnssec/dnssec-signzone.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.docbook,v 1.2.2.2.4.16 2007/08/28 07:19:07 tbox Exp $ --> +<!-- $Id: dnssec-signzone.docbook,v 1.2.2.2.4.18 2008/10/15 23:45:34 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,6 +36,7 @@ <year>2004</year> <year>2005</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -366,7 +367,7 @@ db.example.com.signed <manvolnum>8</manvolnum> </citerefentry>, <citetitle>BIND 9 Administrator Reference Manual</citetitle>, - <citetitle>RFC 2535</citetitle>. + <citetitle>RFC 4033</citetitle>. </para> </refsect1> diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index b3d00ce0f056..85ec6d61dea3 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: dnssec-signzone.html,v 1.4.2.1.4.20 2007/05/09 03:32:36 marka Exp $ --> +<!-- $Id: dnssec-signzone.html,v 1.4.2.1.4.21 2008/10/16 01:19:52 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -32,7 +32,7 @@ <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nthreads</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543485"></a><h2>DESCRIPTION</h2> +<a name="id2543489"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">dnssec-signzone</strong></span> signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -43,7 +43,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543501"></a><h2>OPTIONS</h2> +<a name="id2543505"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-a</span></dt> <dd><p> @@ -181,7 +181,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543874"></a><h2>EXAMPLE</h2> +<a name="id2543877"></a><h2>EXAMPLE</h2> <p> The following command signs the <strong class="userinput"><code>example.com</code></strong> zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> @@ -210,15 +210,15 @@ db.example.com.signed %</pre> </div> <div class="refsect1" lang="en"> -<a name="id2543993"></a><h2>SEE ALSO</h2> +<a name="id2543996"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, <em class="citetitle">BIND 9 Administrator Reference Manual</em>, - <em class="citetitle">RFC 2535</em>. + <em class="citetitle">RFC 4033</em>. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544020"></a><h2>AUTHOR</h2> +<a name="id2544023"></a><h2>AUTHOR</h2> <p> <span class="corpauthor">Internet Systems Consortium</span> </p> diff --git a/bin/named/client.c b/bin/named/client.c index fbc3bad18de7..9c22b1fe5606 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.176.2.13.4.38.4.2 2008/07/23 07:28:11 tbox Exp $ */ +/* $Id: client.c,v 1.176.2.13.4.40 2008/05/22 23:45:34 tbox Exp $ */ #include <config.h> diff --git a/bin/named/config.c b/bin/named/config.c index dc4d928d4f6e..b57b24a0f722 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.11.2.4.8.36.4.3 2008/07/23 23:47:49 tbox Exp $ */ +/* $Id: config.c,v 1.11.2.4.8.39 2008/09/04 08:11:24 marka Exp $ */ #include <config.h> diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c index e9c53ec8dd80..ffebec8048b4 100644 --- a/bin/named/controlconf.c +++ b/bin/named/controlconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: controlconf.c,v 1.28.2.9.2.13.4.2 2008/07/23 23:16:25 marka Exp $ */ +/* $Id: controlconf.c,v 1.28.2.9.2.15 2008/07/23 23:36:22 marka Exp $ */ #include <config.h> diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h index b8137e8d3321..b7aaf5a90323 100644 --- a/bin/named/include/named/globals.h +++ b/bin/named/include/named/globals.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: globals.h,v 1.59.68.7 2006/03/02 00:37:20 marka Exp $ */ +/* $Id: globals.h,v 1.59.68.9 2008/10/24 01:42:46 tbox Exp $ */ #ifndef NAMED_GLOBALS_H #define NAMED_GLOBALS_H 1 @@ -46,6 +46,7 @@ EXTERN isc_taskmgr_t * ns_g_taskmgr INIT(NULL); EXTERN dns_dispatchmgr_t * ns_g_dispatchmgr INIT(NULL); EXTERN isc_entropy_t * ns_g_entropy INIT(NULL); EXTERN isc_entropy_t * ns_g_fallbackentropy INIT(NULL); +EXTERN unsigned int ns_g_cpus_detected INIT(1); /* * XXXRTH We're going to want multiple timer managers eventually. One diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c index 524f47b3387f..e56bd9c3876e 100644 --- a/bin/named/interfacemgr.c +++ b/bin/named/interfacemgr.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: interfacemgr.c,v 1.59.2.5.8.21.4.3 2008/07/23 23:16:25 marka Exp $ */ +/* $Id: interfacemgr.c,v 1.59.2.5.8.24 2008/07/23 23:36:22 marka Exp $ */ #include <config.h> diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8 index 91d0e8a79167..77e90907c77f 100644 --- a/bin/named/lwresd.8 +++ b/bin/named/lwresd.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.13.208.10 2007/05/16 06:10:54 marka Exp $ +.\" $Id: lwresd.8,v 1.13.208.11 2008/10/17 01:19:58 tbox Exp $ .\" .hy 0 .ad l @@ -85,9 +85,9 @@ Use \fIconfig\-file\fR as the configuration file instead of the default, \fI/etc/lwresd.conf\fR. -<term>\-c</term> +\fB\-c\fR can not be used with -<term>\-C</term>. +\fB\-C\fR. .RE .PP \-C \fIconfig\-file\fR @@ -96,9 +96,9 @@ Use \fIconfig\-file\fR as the configuration file instead of the default, \fI/etc/resolv.conf\fR. -<term>\-C</term> +\fB\-C\fR can not be used with -<term>\-c</term>. +\fB\-c\fR. .RE .PP \-d \fIdebug\-level\fR @@ -217,7 +217,7 @@ The default process\-id file. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/bin/named/lwresd.c b/bin/named/lwresd.c index 7dcdad4d47bb..77dce1e4ff41 100644 --- a/bin/named/lwresd.c +++ b/bin/named/lwresd.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lwresd.c,v 1.37.2.2.2.8.14.3 2008/07/23 23:16:26 marka Exp $ */ +/* $Id: lwresd.c,v 1.37.2.2.2.11 2008/07/23 23:36:22 marka Exp $ */ /* * Main program for the Lightweight Resolver Daemon. diff --git a/bin/named/lwresd.docbook b/bin/named/lwresd.docbook index 354a4ab85d58..b4cd22bc66e0 100644 --- a/bin/named/lwresd.docbook +++ b/bin/named/lwresd.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwresd.docbook,v 1.6.208.9 2007/08/28 07:19:08 tbox Exp $ --> +<!-- $Id: lwresd.docbook,v 1.6.208.11 2008/10/16 23:45:27 tbox Exp $ --> <refentry> <refentryinfo> @@ -36,6 +36,7 @@ <year>2004</year> <year>2005</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -143,7 +144,7 @@ Use <replaceable class="parameter">config-file</replaceable> as the configuration file instead of the default, <filename>/etc/lwresd.conf</filename>. - <term>-c</term> can not be used with <term>-C</term>. + <option>-c</option> can not be used with <option>-C</option>. </para> </listitem> </varlistentry> @@ -155,7 +156,7 @@ Use <replaceable class="parameter">config-file</replaceable> as the configuration file instead of the default, <filename>/etc/resolv.conf</filename>. - <term>-C</term> can not be used with <term>-c</term>. + <option>-C</option> can not be used with <option>-c</option>. </para> </listitem> </varlistentry> diff --git a/bin/named/lwresd.html b/bin/named/lwresd.html index 45837e8ed4a1..bb794583a570 100644 --- a/bin/named/lwresd.html +++ b/bin/named/lwresd.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: lwresd.html,v 1.4.2.1.4.15 2007/05/16 06:10:55 marka Exp $ --> +<!-- $Id: lwresd.html,v 1.4.2.1.4.16 2008/10/17 01:19:58 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -32,7 +32,7 @@ <div class="cmdsynopsis"><p><code class="command">lwresd</code> [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543451"></a><h2>DESCRIPTION</h2> +<a name="id2543454"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">lwresd</strong></span> is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver @@ -67,7 +67,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543500"></a><h2>OPTIONS</h2> +<a name="id2543504"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -86,14 +86,14 @@ Use <em class="replaceable"><code>config-file</code></em> as the configuration file instead of the default, <code class="filename">/etc/lwresd.conf</code>. - <font color="red"><term>-c</term></font> can not be used with <font color="red"><term>-C</term></font>. + <code class="option">-c</code> can not be used with <code class="option">-C</code>. </p></dd> <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt> <dd><p> Use <em class="replaceable"><code>config-file</code></em> as the configuration file instead of the default, <code class="filename">/etc/resolv.conf</code>. - <font color="red"><term>-C</term></font> can not be used with <font color="red"><term>-c</term></font>. + <code class="option">-C</code> can not be used with <code class="option">-c</code>. </p></dd> <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt> <dd><p> @@ -194,7 +194,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543915"></a><h2>FILES</h2> +<a name="id2543918"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt> <dd><p> @@ -207,7 +207,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543955"></a><h2>SEE ALSO</h2> +<a name="id2543958"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>, @@ -215,7 +215,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543993"></a><h2>AUTHOR</h2> +<a name="id2543996"></a><h2>AUTHOR</h2> <p> <span class="corpauthor">Internet Systems Consortium</span> </p> diff --git a/bin/named/main.c b/bin/named/main.c index 960de2a34bb1..11a56c9ba88a 100644 --- a/bin/named/main.c +++ b/bin/named/main.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: main.c,v 1.119.2.3.2.25 2006/11/10 18:51:06 marka Exp $ */ +/* $Id: main.c,v 1.119.2.3.2.29 2008/10/24 01:28:55 marka Exp $ */ #include <config.h> @@ -31,6 +31,7 @@ #include <isc/hash.h> #include <isc/os.h> #include <isc/platform.h> +#include <isc/print.h> #include <isc/resource.h> #include <isc/stdio.h> #include <isc/string.h> @@ -76,6 +77,7 @@ static char program_name[ISC_DIR_NAMEMAX] = "named"; static char absolute_conffile[ISC_DIR_PATHMAX]; static char saved_command_line[512]; static char version[512]; +static unsigned int maxsocks = 0; void ns_main_earlywarning(const char *format, ...) { @@ -345,7 +347,8 @@ parse_command_line(int argc, char *argv[]) { isc_commandline_errprint = ISC_FALSE; while ((ch = isc_commandline_parse(argc, argv, - "46c:C:d:fgi:lm:n:N:p:P:st:u:vx:")) != -1) { + "46c:C:d:fgi:lm:n:N:p:P:" + "sS:t:u:vx:")) != -1) { switch (ch) { case '4': if (disable4) @@ -424,6 +427,10 @@ parse_command_line(int argc, char *argv[]) { /* XXXRTH temporary syntax */ want_stats = ISC_TRUE; break; + case 'S': + maxsocks = parse_int(isc_commandline_argument, + "max number of sockets"); + break; case 't': /* XXXJAB should we make a copy? */ ns_g_chrootdir = isc_commandline_argument; @@ -455,17 +462,14 @@ parse_command_line(int argc, char *argv[]) { static isc_result_t create_managers(void) { isc_result_t result; -#ifdef ISC_PLATFORM_USETHREADS - unsigned int cpus_detected; -#endif + unsigned int socks; #ifdef ISC_PLATFORM_USETHREADS - cpus_detected = isc_os_ncpus(); if (ns_g_cpus == 0) - ns_g_cpus = cpus_detected; + ns_g_cpus = ns_g_cpus_detected; isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s", - cpus_detected, cpus_detected == 1 ? "" : "s", + ns_g_cpus_detected, ns_g_cpus_detected == 1 ? "" : "s", ns_g_cpus, ns_g_cpus == 1 ? "" : "s"); #else ns_g_cpus = 1; @@ -486,13 +490,19 @@ create_managers(void) { return (ISC_R_UNEXPECTED); } - result = isc_socketmgr_create(ns_g_mctx, &ns_g_socketmgr); + result = isc_socketmgr_create2(ns_g_mctx, &ns_g_socketmgr, maxsocks); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_socketmgr_create() failed: %s", isc_result_totext(result)); return (ISC_R_UNEXPECTED); } + result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &socks); + if (result == ISC_R_SUCCESS) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, + ISC_LOG_INFO, "using up to %u sockets", socks); + } result = isc_entropy_create(ns_g_mctx, &ns_g_entropy); if (result != ISC_R_SUCCESS) { @@ -539,6 +549,7 @@ destroy_managers(void) { static void setup(void) { isc_result_t result; + isc_resourcevalue_t old_openfiles; #ifdef HAVE_LIBSCF char *instance = NULL; #endif @@ -592,6 +603,13 @@ setup(void) { } #endif +#ifdef ISC_PLATFORM_USETHREADS + /* + * Check for the number of cpu's before ns_os_chroot(). + */ + ns_g_cpus_detected = isc_os_ncpus(); +#endif + ns_os_chroot(ns_g_chrootdir); /* @@ -645,6 +663,23 @@ setup(void) { &ns_g_initopenfiles); /* + * System resources cannot effectively be tuned on some systems. + * Raise the limit in such cases for safety. + */ + old_openfiles = ns_g_initopenfiles; + ns_os_adjustnofile(); + (void)isc_resource_getlimit(isc_resource_openfiles, + &ns_g_initopenfiles); + if (old_openfiles != ns_g_initopenfiles) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_MAIN, ISC_LOG_NOTICE, + "adjusted limit on open files from " + "%" ISC_PRINT_QUADFORMAT "u to " + "%" ISC_PRINT_QUADFORMAT "u", + old_openfiles, ns_g_initopenfiles); + } + + /* * If the named configuration filename is relative, prepend the current * directory's name before possibly changing to another directory. */ @@ -654,7 +689,7 @@ setup(void) { sizeof(absolute_conffile)); if (result != ISC_R_SUCCESS) ns_main_earlyfatal("could not construct absolute path of " - "configuration file: %s", + "configuration file: %s", isc_result_totext(result)); ns_g_conffile = absolute_conffile; } @@ -727,7 +762,7 @@ ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) { if (debug) UNEXPECTED_ERROR(__FILE__, __LINE__, "scf_handle_create() failed: %s", - scf_strerror(scf_error())); + scf_strerror(scf_error())); return (ISC_R_FAILURE); } diff --git a/bin/named/named.8 b/bin/named/named.8 index a8d49747fe68..ab554211a152 100644 --- a/bin/named/named.8 +++ b/bin/named/named.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.8,v 1.17.208.14 2007/06/20 02:26:23 marka Exp $ +.\" $Id: named.8,v 1.17.208.16 2008/08/22 01:21:36 tbox Exp $ .\" .hy 0 .ad l @@ -33,7 +33,7 @@ named \- Internet domain name server .SH "SYNOPSIS" .HP 6 -\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] +\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] .SH "DESCRIPTION" .PP \fBnamed\fR @@ -129,6 +129,21 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .RE .RE .PP +\-S \fI#max\-socks\fR +.RS 4 +Allow +\fBnamed\fR +to use up to +\fI#max\-socks\fR +sockets. +.RS +.B "Warning:" +This option should be unnecessary for the vast majority of users. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because +\fBnamed\fR +reserves some file descriptors for its internal use. +.RE +.RE +.PP \-t \fIdirectory\fR .RS 4 \fBChroot\fR @@ -230,7 +245,7 @@ BIND 9 Administrator Reference Manual. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 15a8cf723c45..790745511cf9 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.conf.5,v 1.1.4.14 2007/06/20 02:26:23 marka Exp $ +.\" $Id: named.conf.5,v 1.1.4.15 2008/09/05 01:21:40 tbox Exp $ .\" .hy 0 .ad l @@ -173,6 +173,7 @@ options { port \fIinteger\fR; querylog \fIboolean\fR; recursing\-file \fIquoted_string\fR; + reserved\-sockets \fIinteger\fR; random\-device \fIquoted_string\fR; recursive\-clients \fIinteger\fR; serial\-query\-rate \fIinteger\fR; @@ -464,5 +465,5 @@ zone \fIstring\fR \fIoptional_class\fR { \fBrndc\fR(8), BIND 9 Administrator Reference Manual .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index 0f5676cfdd61..6a9c384d1fb7 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.docbook,v 1.1.4.13.4.2 2008/07/23 23:47:49 tbox Exp $ --> +<!-- $Id: named.conf.docbook,v 1.1.4.15 2008/09/04 23:45:32 tbox Exp $ --> <refentry> <refentryinfo> diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index 54f20fbf731c..e2e965a3585c 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - - Permission to use, copy, modify, and distribute this software for any - purpose with or without fee is hereby granted, provided that the above @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.conf.html,v 1.1.4.20 2007/06/20 02:26:23 marka Exp $ --> +<!-- $Id: named.conf.html,v 1.1.4.21 2008/09/05 01:21:40 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -31,7 +31,7 @@ <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543330"></a><h2>DESCRIPTION</h2> +<a name="id2543333"></a><h2>DESCRIPTION</h2> <p> <code class="filename">named.conf</code> is the configuration file for <span><strong class="command">named</strong></span>. Statements are enclosed @@ -50,14 +50,14 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543358"></a><h2>ACL</h2> +<a name="id2543362"></a><h2>ACL</h2> <div class="literallayout"><p><br> acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> <br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543374"></a><h2>KEY</h2> +<a name="id2543378"></a><h2>KEY</h2> <div class="literallayout"><p><br> key <em class="replaceable"><code>domain_name</code></em> {<br> algorithm <em class="replaceable"><code>string</code></em>;<br> @@ -66,7 +66,7 @@ key <em class="replaceable"><code>domain_name</code></em> {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543394"></a><h2>MASTERS</h2> +<a name="id2543397"></a><h2>MASTERS</h2> <div class="literallayout"><p><br> masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br> ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br> @@ -75,7 +75,7 @@ masters <em class="replaceable"><code>string</code></em> [<span class="optional" </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543440"></a><h2>SERVER</h2> +<a name="id2543443"></a><h2>SERVER</h2> <div class="literallayout"><p><br> server ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) {<br> bogus <em class="replaceable"><code>boolean</code></em>;<br> @@ -95,7 +95,7 @@ server ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="rep </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543497"></a><h2>TRUSTED-KEYS</h2> +<a name="id2543500"></a><h2>TRUSTED-KEYS</h2> <div class="literallayout"><p><br> trusted-keys {<br> <em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br> @@ -103,7 +103,7 @@ trusted-keys {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543523"></a><h2>CONTROLS</h2> +<a name="id2543526"></a><h2>CONTROLS</h2> <div class="literallayout"><p><br> controls {<br> inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br> @@ -115,7 +115,7 @@ controls {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543558"></a><h2>LOGGING</h2> +<a name="id2543561"></a><h2>LOGGING</h2> <div class="literallayout"><p><br> logging {<br> channel <em class="replaceable"><code>string</code></em> {<br> @@ -133,7 +133,7 @@ logging {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543596"></a><h2>LWRES</h2> +<a name="id2543600"></a><h2>LWRES</h2> <div class="literallayout"><p><br> lwres {<br> listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br> @@ -146,7 +146,7 @@ lwres {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543638"></a><h2>OPTIONS</h2> +<a name="id2543641"></a><h2>OPTIONS</h2> <div class="literallayout"><p><br> options {<br> avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br> @@ -171,6 +171,7 @@ options {<br> port <em class="replaceable"><code>integer</code></em>;<br> querylog <em class="replaceable"><code>boolean</code></em>;<br> recursing-file <em class="replaceable"><code>quoted_string</code></em>;<br> + reserved-sockets <em class="replaceable"><code>integer</code></em>;<br> random-device <em class="replaceable"><code>quoted_string</code></em>;<br> recursive-clients <em class="replaceable"><code>integer</code></em>;<br> serial-query-rate <em class="replaceable"><code>integer</code></em>;<br> @@ -290,7 +291,7 @@ options {<br> </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2544322"></a><h2>VIEW</h2> +<a name="id2544328"></a><h2>VIEW</h2> <div class="literallayout"><p><br> view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br> match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br> @@ -408,7 +409,7 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2544820"></a><h2>ZONE</h2> +<a name="id2544826"></a><h2>ZONE</h2> <div class="literallayout"><p><br> zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br> type ( master | slave | stub | hint |<br> @@ -484,13 +485,13 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c </p></div> </div> <div class="refsect1" lang="en"> -<a name="id2545089"></a><h2>FILES</h2> +<a name="id2545095"></a><h2>FILES</h2> <p> <code class="filename">/etc/named.conf</code> </p> </div> <div class="refsect1" lang="en"> -<a name="id2545101"></a><h2>SEE ALSO</h2> +<a name="id2545108"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>, diff --git a/bin/named/named.docbook b/bin/named/named.docbook index 43401d027447..c6073c34dd36 100644 --- a/bin/named/named.docbook +++ b/bin/named/named.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.docbook,v 1.5.98.13 2007/08/28 07:19:08 tbox Exp $ --> +<!-- $Id: named.docbook,v 1.5.98.15 2008/08/21 23:45:31 tbox Exp $ --> <refentry> <refentryinfo> @@ -37,6 +37,7 @@ <year>2005</year> <year>2006</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> @@ -65,6 +66,7 @@ <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg> <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg> <arg><option>-s</option></arg> + <arg><option>-S <replaceable class="parameter">#max-socks</replaceable></option></arg> <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg> <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg> <arg><option>-v</option></arg> @@ -218,6 +220,33 @@ </varlistentry> <varlistentry> + <term>-S <replaceable class="parameter">#max-socks</replaceable></term> + <listitem> + <para> + Allow <command>named</command> to use up to + <replaceable class="parameter">#max-socks</replaceable> sockets. + </para> + <warning> + <para> + This option should be unnecessary for the vast majority + of users. + The use of this option could even be harmful because the + specified value may exceed the limitation of the + underlying system API. + It is therefore set only when the default configuration + causes exhaustion of file descriptors and the + operational environment is known to support the + specified number of sockets. + Note also that the actual maximum number is normally a little + fewer than the specified value because + <command>named</command> reserves some file descriptors + for its internal use. + </para> + </warning> + </listitem> + </varlistentry> + + <varlistentry> <term>-t <replaceable class="parameter">directory</replaceable></term> <listitem> <para> diff --git a/bin/named/named.html b/bin/named/named.html index f90b087b25c3..101c3b4ee334 100644 --- a/bin/named/named.html +++ b/bin/named/named.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000, 2001, 2003 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: named.html,v 1.4.2.1.4.19 2007/06/20 02:26:23 marka Exp $ --> +<!-- $Id: named.html,v 1.4.2.1.4.21 2008/08/22 01:21:36 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -29,10 +29,10 @@ </div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> -<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> +<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543441"></a><h2>DESCRIPTION</h2> +<a name="id2543452"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">named</strong></span> is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -46,7 +46,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543466"></a><h2>OPTIONS</h2> +<a name="id2543478"></a><h2>OPTIONS</h2> <div class="variablelist"><dl> <dt><span class="term">-4</span></dt> <dd><p> @@ -123,6 +123,31 @@ </p> </div> </dd> +<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt> +<dd> +<p> + Allow <span><strong class="command">named</strong></span> to use up to + <em class="replaceable"><code>#max-socks</code></em> sockets. + </p> +<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"> +<h3 class="title">Warning</h3> +<p> + This option should be unnecessary for the vast majority + of users. + The use of this option could even be harmful because the + specified value may exceed the limitation of the + underlying system API. + It is therefore set only when the default configuration + causes exhaustion of file descriptors and the + operational environment is known to support the + specified number of sockets. + Note also that the actual maximum number is normally a little + fewer than the specified value because + <span><strong class="command">named</strong></span> reserves some file descriptors + for its internal use. + </p> +</div> +</dd> <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt> <dd> <p> @@ -186,7 +211,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543851"></a><h2>SIGNALS</h2> +<a name="id2543011"></a><h2>SIGNALS</h2> <p> In routine operation, signals should not be used to control the nameserver; <span><strong class="command">rndc</strong></span> should be used @@ -207,7 +232,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543898"></a><h2>CONFIGURATION</h2> +<a name="id2543058"></a><h2>CONFIGURATION</h2> <p> The <span><strong class="command">named</strong></span> configuration file is too complex to describe in detail here. A complete description is @@ -216,7 +241,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2543915"></a><h2>FILES</h2> +<a name="id2543075"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt> <dd><p> @@ -229,7 +254,7 @@ </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2543955"></a><h2>SEE ALSO</h2> +<a name="id2543114"></a><h2>SEE ALSO</h2> <p> <em class="citetitle">RFC 1033</em>, <em class="citetitle">RFC 1034</em>, @@ -243,7 +268,7 @@ </p> </div> <div class="refsect1" lang="en"> -<a name="id2544026"></a><h2>AUTHOR</h2> +<a name="id2544210"></a><h2>AUTHOR</h2> <p> <span class="corpauthor">Internet Systems Consortium</span> </p> diff --git a/bin/named/query.c b/bin/named/query.c index 858df8cd975b..2b2705fd363f 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.198.2.13.4.53 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: query.c,v 1.198.2.13.4.56 2008/10/15 22:30:47 marka Exp $ */ #include <config.h> @@ -1900,6 +1900,13 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, &olabels); (void)dns_name_fullcompare(name, &nsec.next, &order, &nlabels); + /* + * Check for a pathological condition created when + * serving some malformed signed zones and bail out. + */ + if (dns_name_countlabels(name) == nlabels) + goto cleanup; + if (olabels > nlabels) dns_name_split(name, olabels, NULL, wname); else @@ -2067,12 +2074,13 @@ query_resume(isc_task_t *task, isc_event_t *event) { static isc_result_t query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain, - dns_rdataset_t *nameservers) + dns_rdataset_t *nameservers, isc_boolean_t resuming) { isc_result_t result; dns_rdataset_t *rdataset, *sigrdataset; - inc_stats(client, dns_statscounter_recursion); + if (!resuming) + inc_stats(client, dns_statscounter_recursion); /* * We are about to recurse, which means that this client will @@ -2367,6 +2375,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) unsigned int options; isc_boolean_t empty_wild; dns_rdataset_t *noqname; + isc_boolean_t resuming; CTRACE("query_find"); @@ -2392,6 +2401,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) need_wildcardproof = ISC_FALSE; empty_wild = ISC_FALSE; options = 0; + resuming = ISC_FALSE; + is_zone = ISC_FALSE; if (event != NULL) { /* @@ -2401,7 +2412,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) want_restart = ISC_FALSE; authoritative = ISC_FALSE; - is_zone = ISC_FALSE; qtype = event->qtype; if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig) @@ -2434,6 +2444,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) } result = event->result; + resuming = ISC_TRUE; goto resume; } @@ -2624,7 +2635,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ if (RECURSIONOK(client)) { result = query_recurse(client, qtype, - NULL, NULL); + NULL, NULL, resuming); if (result == ISC_R_SUCCESS) client->query.attributes |= NS_QUERYATTR_RECURSING; @@ -2791,10 +2802,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ if (dns_rdatatype_atparent(type)) result = query_recurse(client, qtype, - NULL, NULL); + NULL, NULL, + resuming); else result = query_recurse(client, qtype, - fname, rdataset); + fname, rdataset, + resuming); if (result == ISC_R_SUCCESS) client->query.attributes |= NS_QUERYATTR_RECURSING; @@ -3223,7 +3236,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) result = query_recurse(client, qtype, NULL, - NULL); + NULL, + resuming); if (result == ISC_R_SUCCESS) client->query.attributes |= NS_QUERYATTR_RECURSING; diff --git a/bin/named/server.c b/bin/named/server.c index afbecb8487ef..8acb00875210 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.339.2.15.2.78.4.3 2008/07/23 23:47:49 tbox Exp $ */ +/* $Id: server.c,v 1.339.2.15.2.84 2008/09/04 23:45:32 tbox Exp $ */ #include <config.h> @@ -30,8 +30,10 @@ #include <isc/hash.h> #include <isc/lex.h> #include <isc/parseint.h> +#include <isc/portset.h> #include <isc/print.h> #include <isc/resource.h> +#include <isc/socket.h> #include <isc/stdio.h> #include <isc/string.h> #include <isc/task.h> @@ -427,13 +429,15 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver) */ static isc_result_t get_view_querysource_dispatch(const cfg_obj_t **maps, - int af, dns_dispatch_t **dispatchp) + int af, dns_dispatch_t **dispatchp, + isc_boolean_t is_firstview) { isc_result_t result; dns_dispatch_t *disp; isc_sockaddr_t sa; unsigned int attrs, attrmask; const cfg_obj_t *obj = NULL; + unsigned int maxdispatchbuffers; /* * Make compiler happy. @@ -485,12 +489,18 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, attrs |= DNS_DISPATCHATTR_IPV6; break; } - - if (isc_sockaddr_getport(&sa) != 0) { + if (isc_sockaddr_getport(&sa) == 0) { + attrs |= DNS_DISPATCHATTR_EXCLUSIVE; + maxdispatchbuffers = 4096; + } else { INSIST(obj != NULL); - cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO, - "using specific query-source port suppresses port " - "randomization and can be insecure."); + if (is_firstview) { + cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO, + "using specific query-source port " + "suppresses port randomization and can be " + "insecure."); + } + maxdispatchbuffers = 1000; } attrmask = 0; @@ -502,7 +512,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, disp = NULL; result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr, ns_g_taskmgr, &sa, 4096, - 1024, 32768, 16411, 16433, + maxdispatchbuffers, 32768, 16411, 16433, attrs, attrmask, &disp); if (result != ISC_R_SUCCESS) { isc_sockaddr_t any; @@ -912,8 +922,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, * * XXXRTH Hardwired number of tasks. */ - CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4)); - CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6)); + CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4, + ISC_TF(ISC_LIST_PREV(view, link) + == NULL))); + CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6, + ISC_TF(ISC_LIST_PREV(view, link) + == NULL))); if (dispatch4 == NULL && dispatch6 == NULL) { UNEXPECTED_ERROR(__FILE__, __LINE__, "unable to obtain neither an IPv4 nor" @@ -2129,24 +2143,41 @@ set_limits(const cfg_obj_t **maps) { SETLIMIT("files", openfiles, "open files"); } -static isc_result_t -portlist_fromconf(dns_portlist_t *portlist, unsigned int family, - const cfg_obj_t *ports) +static void +portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports, + isc_boolean_t positive) { const cfg_listelt_t *element; - isc_result_t result = ISC_R_SUCCESS; for (element = cfg_list_first(ports); element != NULL; element = cfg_list_next(element)) { const cfg_obj_t *obj = cfg_listelt_value(element); - in_port_t port = (in_port_t)cfg_obj_asuint32(obj); - result = dns_portlist_add(portlist, family, port); - if (result != ISC_R_SUCCESS) - break; + if (cfg_obj_isuint32(obj)) { + in_port_t port = (in_port_t)cfg_obj_asuint32(obj); + + if (positive) + isc_portset_add(portset, port); + else + isc_portset_remove(portset, port); + } else { + const cfg_obj_t *obj_loport, *obj_hiport; + in_port_t loport, hiport; + + obj_loport = cfg_tuple_get(obj, "loport"); + loport = (in_port_t)cfg_obj_asuint32(obj_loport); + obj_hiport = cfg_tuple_get(obj, "hiport"); + hiport = (in_port_t)cfg_obj_asuint32(obj_hiport); + + if (positive) + isc_portset_addrange(portset, loport, hiport); + else { + isc_portset_removerange(portset, loport, + hiport); + } + } } - return (result); } static isc_result_t @@ -2160,21 +2191,24 @@ load_configuration(const char *filename, ns_server_t *server, const cfg_obj_t *maps[3]; const cfg_obj_t *obj; const cfg_obj_t *options; - const cfg_obj_t *v4ports, *v6ports; + const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports; const cfg_obj_t *views; dns_view_t *view = NULL; dns_view_t *view_next; dns_viewlist_t tmpviewlist; dns_viewlist_t viewlist; - in_port_t listen_port; + in_port_t listen_port, udpport_low, udpport_high; int i; - isc_resourcevalue_t files; + isc_portset_t *v4portset = NULL; + isc_portset_t *v6portset = NULL; + isc_resourcevalue_t nfiles; isc_result_t result; isc_uint32_t heartbeat_interval; isc_uint32_t interface_interval; isc_uint32_t reserved; isc_uint32_t udpsize; ns_aclconfctx_t aclconfctx; + unsigned int maxsocks; ns_aclconfctx_init(&aclconfctx); ISC_LIST_INIT(viewlist); @@ -2234,15 +2268,6 @@ load_configuration(const char *filename, ns_server_t *server, CHECK(result); /* - * Check that the working directory is writable. - */ - if (access(".", W_OK) != 0) { - isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, - NS_LOGMODULE_SERVER, ISC_LOG_ERROR, - "the working directory is not writable"); - } - - /* * Check the validity of the configuration. */ CHECK(bind9_check_namedconf(config, ns_g_lctx, ns_g_mctx)); @@ -2264,20 +2289,22 @@ load_configuration(const char *filename, ns_server_t *server, set_limits(maps); /* - * Sanity check on "files" limit. + * Check if max number of open sockets that the system allows is + * sufficiently large. Failing this condition is not necessarily fatal, + * but may cause subsequent runtime failures for a busy recursive + * server. */ - result = isc_resource_curlimit(isc_resource_openfiles, &files); - if (result == ISC_R_SUCCESS && files < FD_SETSIZE) { + result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &maxsocks); + if (result != ISC_R_SUCCESS) + maxsocks = 0; + result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles); + if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_WARNING, - "the 'files' limit (%" ISC_PRINT_QUADFORMAT "u) " - "is less than FD_SETSIZE (%d), increase " - "'files' in named.conf or recompile with a " - "smaller FD_SETSIZE.", files, FD_SETSIZE); - if (files > FD_SETSIZE) - files = FD_SETSIZE; - } else - files = FD_SETSIZE; + "max open files (%" ISC_PRINT_QUADFORMAT "u)" + " is smaller than max sockets (%u)", + nfiles, maxsocks); + } /* * Set the number of socket reserved for TCP, stdio etc. @@ -2286,17 +2313,20 @@ load_configuration(const char *filename, ns_server_t *server, result = ns_config_get(maps, "reserved-sockets", &obj); INSIST(result == ISC_R_SUCCESS); reserved = cfg_obj_asuint32(obj); - if (files < 128U) /* Prevent underflow. */ - reserved = 0; - else if (reserved > files - 128U) /* Mimimum UDP space. */ - reserved = files - 128; - if (reserved < 128U) /* Mimimum TCP/stdio space. */ + if (maxsocks != 0) { + if (maxsocks < 128U) /* Prevent underflow. */ + reserved = 0; + else if (reserved > maxsocks - 128U) /* Minimum UDP space. */ + reserved = maxsocks - 128; + } + /* Minimum TCP/stdio space. */ + if (reserved < 128U) reserved = 128; - if (reserved + 128U > files) { + if (reserved + 128U > maxsocks && maxsocks != 0) { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_WARNING, "less than 128 UDP sockets available after " - "applying 'reserved-sockets' and 'files'"); + "applying 'reserved-sockets' and 'maxsockets'"); } isc__socketmgr_setreserved(ns_g_socketmgr, reserved); @@ -2324,24 +2354,64 @@ load_configuration(const char *filename, ns_server_t *server, INSIST(result == ISC_R_SUCCESS); server->aclenv.match_mapped = cfg_obj_asboolean(obj); - v4ports = NULL; - v6ports = NULL; - (void)ns_config_get(maps, "avoid-v4-udp-ports", &v4ports); - (void)ns_config_get(maps, "avoid-v6-udp-ports", &v6ports); - if (v4ports != NULL || v6ports != NULL) { - dns_portlist_t *portlist = NULL; - result = dns_portlist_create(ns_g_mctx, &portlist); - if (result == ISC_R_SUCCESS && v4ports != NULL) - result = portlist_fromconf(portlist, AF_INET, v4ports); - if (result == ISC_R_SUCCESS && v6ports != NULL) - portlist_fromconf(portlist, AF_INET6, v6ports); - if (result == ISC_R_SUCCESS) - dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, portlist); - if (portlist != NULL) - dns_portlist_detach(&portlist); - CHECK(result); - } else - dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, NULL); + /* + * Configure sets of UDP query source ports. + */ + CHECKM(isc_portset_create(ns_g_mctx, &v4portset), + "creating UDP port set"); + CHECKM(isc_portset_create(ns_g_mctx, &v6portset), + "creating UDP port set"); + + usev4ports = NULL; + usev6ports = NULL; + avoidv4ports = NULL; + avoidv6ports = NULL; + + (void)ns_config_get(maps, "use-v4-udp-ports", &usev4ports); + if (usev4ports != NULL) + portset_fromconf(v4portset, usev4ports, ISC_TRUE); + else { + CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low, + &udpport_high), + "get the default UDP/IPv4 port range"); + if (udpport_low == udpport_high) + isc_portset_add(v4portset, udpport_low); + else { + isc_portset_addrange(v4portset, udpport_low, + udpport_high); + } + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_INFO, + "using default UDP/IPv4 port range: [%d, %d]", + udpport_low, udpport_high); + } + (void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports); + if (avoidv4ports != NULL) + portset_fromconf(v4portset, avoidv4ports, ISC_FALSE); + + (void)ns_config_get(maps, "use-v6-udp-ports", &usev6ports); + if (usev6ports != NULL) + portset_fromconf(v6portset, usev6ports, ISC_TRUE); + else { + CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low, + &udpport_high), + "get the default UDP/IPv6 port range"); + if (udpport_low == udpport_high) + isc_portset_add(v6portset, udpport_low); + else { + isc_portset_addrange(v6portset, udpport_low, + udpport_high); + } + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_INFO, + "using default UDP/IPv6 port range: [%d, %d]", + udpport_low, udpport_high); + } + (void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports); + if (avoidv6ports != NULL) + portset_fromconf(v6portset, avoidv6ports, ISC_FALSE); + + dns_dispatchmgr_setavailports(ns_g_dispatchmgr, v4portset, v6portset); /* * Set the EDNS UDP size when we don't match a view. @@ -2648,6 +2718,15 @@ load_configuration(const char *filename, ns_server_t *server, ns_os_changeuser(); /* + * Check that the working directory is writable. + */ + if (access(".", W_OK) != 0) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_ERROR, + "the working directory is not writable"); + } + + /* * Configure the logging system. * * Do this after changing UID to make sure that any log @@ -2807,6 +2886,12 @@ load_configuration(const char *filename, ns_server_t *server, result = ISC_R_SUCCESS; cleanup: + if (v4portset != NULL) + isc_portset_destroy(ns_g_mctx, &v4portset); + + if (v6portset != NULL) + isc_portset_destroy(ns_g_mctx, &v6portset); + ns_aclconfctx_destroy(&aclconfctx); if (parser != NULL) { diff --git a/bin/named/unix/include/named/os.h b/bin/named/unix/include/named/os.h index 1c4bec070727..96604e54acd4 100644 --- a/bin/named/unix/include/named/os.h +++ b/bin/named/unix/include/named/os.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.h,v 1.14.2.2.8.12 2007/08/28 07:19:08 tbox Exp $ */ +/* $Id: os.h,v 1.14.2.2.8.14 2008/10/24 01:42:46 tbox Exp $ */ #ifndef NS_OS_H #define NS_OS_H 1 @@ -44,11 +44,13 @@ void ns_os_changeuser(void); void +ns_os_adjustnofile(void); + +void ns_os_minprivs(void); void ns_os_writepidfile(const char *filename, isc_boolean_t first_time); - void ns_os_shutdown(void); diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c index f8026660391e..3fe15cb1a007 100644 --- a/bin/named/unix/os.c +++ b/bin/named/unix/os.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.46.2.4.8.30 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: os.c,v 1.46.2.4.8.33 2008/10/24 01:42:46 tbox Exp $ */ #include <config.h> #include <stdarg.h> @@ -40,6 +40,7 @@ #include <isc/buffer.h> #include <isc/file.h> #include <isc/print.h> +#include <isc/resource.h> #include <isc/result.h> #include <isc/strerror.h> #include <isc/string.h> @@ -114,6 +115,16 @@ static int dfd[2] = { -1, -1 }; static isc_boolean_t non_root = ISC_FALSE; static isc_boolean_t non_root_caps = ISC_FALSE; +#if defined(HAVE_CAPSET) +#undef _POSIX_SOURCE +#ifdef HAVE_SYS_CAPABILITY_H +#include <sys/capability.h> +#else +#include <linux/capability.h> +int capset(cap_user_header_t hdrp, const cap_user_data_t datap); +#endif +#include <sys/prctl.h> +#else /* * We define _LINUX_FS_H to prevent it from being included. We don't need * anything from it, and the files it includes cause warnings with 2.2 @@ -146,6 +157,7 @@ static isc_boolean_t non_root_caps = ISC_FALSE; #endif #define SYS_capset __NR_capset #endif +#endif static void linux_setcaps(unsigned int caps) { @@ -163,13 +175,23 @@ linux_setcaps(unsigned int caps) { cap.effective = caps; cap.permitted = caps; cap.inheritable = 0; - if (syscall(SYS_capset, &caphead, &cap) < 0) { +#ifdef HAVE_CAPSET + if (capset(&caphead, &cap) < 0 ) { isc__strerror(errno, strbuf, sizeof(strbuf)); ns_main_earlyfatal("capset failed: %s:" " please ensure that the capset kernel" " module is loaded. see insmod(8)", strbuf); } +#else + if (syscall(SYS_capset, &caphead, &cap) < 0) { + isc__strerror(errno, strbuf, sizeof(strbuf)); + ns_main_earlyfatal("syscall(capset) failed: %s:" + " please ensure that the capset kernel" + " module is loaded. see insmod(8)", + strbuf); + } +#endif } static void @@ -511,6 +533,24 @@ ns_os_changeuser(void) { } void +ns_os_adjustnofile() { +#ifdef HAVE_LINUXTHREADS + isc_result_t result; + isc_resourcevalue_t newvalue; + + /* + * Linux: max number of open files specified by one thread doesn't seem + * to apply to other threads on Linux. + */ + newvalue = ISC_RESOURCE_UNLIMITED; + + result = isc_resource_setlimit(isc_resource_openfiles, newvalue); + if (result != ISC_R_SUCCESS) + ns_main_earlywarning("couldn't adjust limit on open files"); +#endif +} + +void ns_os_minprivs(void) { #ifdef HAVE_SYS_PRCTL_H linux_keepcaps(); diff --git a/bin/named/update.c b/bin/named/update.c index 6733d76902b1..b556935a7bca 100644 --- a/bin/named/update.c +++ b/bin/named/update.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: update.c,v 1.88.2.5.2.35 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: update.c,v 1.88.2.5.2.36 2008/04/28 03:28:10 marka Exp $ */ #include <config.h> @@ -1612,10 +1612,10 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, * Add RRSIG records for an RRset, recording the change in "diff". */ static isc_result_t -add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, - dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys, - unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception, - isc_stdtime_t expire) +add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, + dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type, + dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, + isc_mem_t *mctx, isc_stdtime_t inception, isc_stdtime_t expire) { isc_result_t result; dns_dbnode_t *node = NULL; @@ -1624,6 +1624,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, isc_buffer_t buffer; unsigned char data[1024]; /* XXX */ unsigned int i; + isc_boolean_t added_sig = ISC_FALSE; dns_rdataset_init(&rdataset); isc_buffer_init(&buffer, data, sizeof(data)); @@ -1648,6 +1649,13 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name, rdataset.ttl, &sig_rdata)); dns_rdata_reset(&sig_rdata); + added_sig = ISC_TRUE; + } + if (!added_sig) { + update_log(client, zone, ISC_LOG_ERROR, + "found no private keys, " + "unable to generate any signatures"); + result = ISC_R_NOTFOUND; } failure: @@ -1767,9 +1775,9 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, */ CHECK(rrset_exists(db, newver, name, type, 0, &flag)); if (flag) { - CHECK(add_sigs(db, newver, name, type, - &sig_diff, zone_keys, nkeys, - client->mctx, inception, + CHECK(add_sigs(client, zone, db, newver, name, + type, &sig_diff, zone_keys, + nkeys, client->mctx, inception, expire)); } skip: @@ -1953,9 +1961,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, dns_rdatatype_rrsig, dns_rdatatype_nsec, NULL, &sig_diff)); } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec, - &sig_diff, zone_keys, nkeys, - client->mctx, inception, expire)); + CHECK(add_sigs(client, zone, db, newver, &t->name, + dns_rdatatype_nsec, &sig_diff, + zone_keys, nkeys, client->mctx, + inception, expire)); } else { INSIST(0); } diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in index 3474f7cfa06c..a09760353e0c 100644 --- a/bin/nsupdate/Makefile.in +++ b/bin/nsupdate/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.15.12.13 2007/08/28 07:19:08 tbox Exp $ +# $Id: Makefile.in,v 1.15.12.15 2008/08/29 23:45:33 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -55,7 +55,7 @@ UOBJS = SRCS = nsupdate.c -MANPAGES = nsupdate.8 +MANPAGES = nsupdate.1 HTMLPAGES = nsupdate.html @@ -76,8 +76,8 @@ clean distclean:: installdirs: $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir} - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8 + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1 install:: nsupdate@EXEEXT@ installdirs ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} nsupdate@EXEEXT@ ${DESTDIR}${bindir} - ${INSTALL_DATA} ${srcdir}/nsupdate.8 ${DESTDIR}${mandir}/man8 + ${INSTALL_DATA} ${srcdir}/nsupdate.1 ${DESTDIR}${mandir}/man1 diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.1 index 5d608e3565af..14b9eeb53a61 100644 --- a/bin/nsupdate/nsupdate.8 +++ b/bin/nsupdate/nsupdate.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nsupdate.8,v 1.24.2.2.2.13 2007/05/09 03:32:36 marka Exp $ +.\" $Id: nsupdate.1,v 1.1.6.2 2008/09/01 01:53:43 tbox Exp $ .\" .hy 0 .ad l @@ -24,7 +24,7 @@ .\" Manual: BIND9 .\" Source: BIND9 .\" -.TH "NSUPDATE" "8" "Jun 30, 2000" "BIND9" "BIND9" +.TH "NSUPDATE" "1" "Jun 30, 2000" "BIND9" "BIND9" .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) @@ -342,7 +342,7 @@ base\-64 encoding of HMAC\-MD5 key created by .PP The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases. .SH "COPYRIGHT" -Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index f45ec143bbd5..7e4ba9666a2b 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [<!ENTITY mdash "—">]> <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and/or distribute this software for any @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.docbook,v 1.8.2.3.2.16 2007/08/28 07:19:08 tbox Exp $ --> +<!-- $Id: nsupdate.docbook,v 1.8.2.3.2.18 2008/08/29 23:45:33 tbox Exp $ --> <refentry> <refentryinfo> @@ -26,7 +26,7 @@ </refentryinfo> <refmeta> <refentrytitle>nsupdate</refentrytitle> -<manvolnum>8</manvolnum> +<manvolnum>1</manvolnum> <refmiscinfo>BIND9</refmiscinfo> </refmeta> @@ -36,6 +36,7 @@ <year>2005</year> <year>2006</year> <year>2007</year> + <year>2008</year> <holder>Internet Systems Consortium, Inc. ("ISC")</holder> </copyright> <copyright> diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html index 009942d11b4e..f64368a715c9 100644 --- a/bin/nsupdate/nsupdate.html +++ b/bin/nsupdate/nsupdate.html @@ -1,5 +1,5 @@ <!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") - Copyright (C) 2000-2003 Internet Software Consortium. - - Permission to use, copy, modify, and distribute this software for any @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: nsupdate.html,v 1.9.2.3.2.20 2007/05/09 03:32:36 marka Exp $ --> +<!-- $Id: nsupdate.html,v 1.9.2.3.2.21 2008/09/01 01:53:43 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -32,7 +32,7 @@ <div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div> </div> <div class="refsect1" lang="en"> -<a name="id2543405"></a><h2>DESCRIPTION</h2> +<a name="id2543409"></a><h2>DESCRIPTION</h2> <p> <span><strong class="command">nsupdate</strong></span> is used to submit Dynamic DNS Update requests as defined in RFC2136 @@ -160,7 +160,7 @@ and number of UDP retries. </p> </div> <div class="refsect1" lang="en"> -<a name="id2543562"></a><h2>INPUT FORMAT</h2> +<a name="id2543565"></a><h2>INPUT FORMAT</h2> <p> <span><strong class="command">nsupdate</strong></span> reads input from @@ -399,7 +399,7 @@ Lines beginning with a semicolon are comments and are ignored. </p> </div> <div class="refsect1" lang="en"> -<a name="id2544279"></a><h2>EXAMPLES</h2> +<a name="id2544282"></a><h2>EXAMPLES</h2> <p> The examples below show how <span><strong class="command">nsupdate</strong></span> @@ -452,7 +452,7 @@ RRSIG, DNSKEY and NSEC records.) </p> </div> <div class="refsect1" lang="en"> -<a name="id2544323"></a><h2>FILES</h2> +<a name="id2544326"></a><h2>FILES</h2> <div class="variablelist"><dl> <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt> <dd><p> @@ -471,7 +471,7 @@ base-64 encoding of HMAC-MD5 key created by </dl></div> </div> <div class="refsect1" lang="en"> -<a name="id2544459"></a><h2>SEE ALSO</h2> +<a name="id2544462"></a><h2>SEE ALSO</h2> <p> <span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>, <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>, @@ -485,7 +485,7 @@ base-64 encoding of HMAC-MD5 key created by </p> </div> <div class="refsect1" lang="en"> -<a name="id2544531"></a><h2>BUGS</h2> +<a name="id2544534"></a><h2>BUGS</h2> <p> The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/bin/rndc/rndc-confgen.c b/bin/rndc/rndc-confgen.c index f6e578ed9878..f0cd0cbd367b 100644 --- a/bin/rndc/rndc-confgen.c +++ b/bin/rndc/rndc-confgen.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rndc-confgen.c,v 1.9.2.6.2.5 2004/09/28 07:14:57 marka Exp $ */ +/* $Id: rndc-confgen.c,v 1.9.2.6.2.7 2008/10/15 23:45:34 tbox Exp $ */ #include <config.h> @@ -51,7 +51,7 @@ #define DEFAULT_PORT 953 static char program[256]; -char *progname; +const char *progname; isc_boolean_t verbose = ISC_FALSE; @@ -137,7 +137,7 @@ main(int argc, char **argv) { isc_boolean_t keyonly = ISC_FALSE; int len; - keydef = keyfile = RNDC_KEYFILE; + keydef = keyfile = RNDC_KEYFILE; result = isc_file_progname(*argv, program, sizeof(program)); if (result != ISC_R_SUCCESS) @@ -275,7 +275,7 @@ main(int argc, char **argv) { fatal("isc_mem_get(%d) failed\n", len); snprintf(buf, len, "%s%s%s", chrootdir, (*keyfile != '/') ? "/" : "", keyfile); - + write_key_file(buf, user, keyname, &key_txtbuffer); isc_mem_put(mctx, buf, len); } diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index a5e912ddfd42..977a8ba60541 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rndc.c,v 1.77.2.5.2.19 2006/08/04 03:03:08 marka Exp $ */ +/* $Id: rndc.c,v 1.77.2.5.2.21 2008/10/15 23:45:34 tbox Exp $ */ /* * Principal Author: DCL @@ -56,7 +56,7 @@ #define SERVERADDRS 10 -char *progname; +const char *progname; isc_boolean_t verbose; static const char *admin_conffile; @@ -86,7 +86,7 @@ static void usage(int status) { fprintf(stderr, "\ Usage: %s [-c config] [-s server] [-p port]\n\ - [-k key-file ] [-y key] [-V] command\n\ + [-k key-file ] [-y key] [-V] command\n\ \n\ command is one of the following:\n\ \n\ @@ -98,9 +98,9 @@ command is one of the following:\n\ retransfer zone [class [view]]\n\ Retransfer a single zone without checking serial number.\n\ freeze zone [class [view]]\n\ - Suspend updates to a dynamic zone.\n\ + Suspend updates to a dynamic zone.\n\ thaw zone [class [view]]\n\ - Enable updates to a frozen dynamic zone and reload it.\n\ + Enable updates to a frozen dynamic zone and reload it.\n\ reconfig Reload configuration file and new zones only.\n\ stats Write server statistics to the statistics file.\n\ querylog Toggle query logging.\n\ @@ -443,7 +443,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname, (void)cfg_map_get(config, "server", &servers); if (servers != NULL) { for (elt = cfg_list_first(servers); - elt != NULL; + elt != NULL; elt = cfg_list_next(elt)) { const char *name; @@ -479,7 +479,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname, else { DO("get config key list", cfg_map_get(config, "key", &keys)); for (elt = cfg_list_first(keys); - elt != NULL; + elt != NULL; elt = cfg_list_next(elt)) { key = cfg_listelt_value(elt); @@ -624,7 +624,7 @@ main(int argc, char **argv) { logdest.file.maximum_size = 0; DO("creating log channel", isc_log_createchannel(logconfig, "stderr", - ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest, + ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest, ISC_LOG_PRINTTAG|ISC_LOG_PRINTLEVEL)); DO("enabling log channel", isc_log_usechannel(logconfig, "stderr", NULL, NULL)); diff --git a/configure.in b/configure.in index 67ebe68e9a93..d24630be4a37 100644 --- a/configure.in +++ b/configure.in @@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl esyscmd([sed "s/^/# /" COPYRIGHT])dnl AC_DIVERT_POP()dnl -AC_REVISION($Revision: 1.294.2.23.2.82.2.1 $) +AC_REVISION($Revision: 1.294.2.23.2.92 $) AC_INIT(lib/dns/name.c) AC_PREREQ(2.13) @@ -224,6 +224,15 @@ case "$host" in STD_CDEFINES="$STD_CDEFINES -D_XPG4_2 -D__EXTENSIONS__" CPPFLAGS="$CPPFLAGS -D_XPG4_2 -D__EXTENSIONS__" ;; + # POSIX doesn't include the IPv6 Advanced Socket API and glibc hides + # parts of the IPv6 Advanced Socket API as a result. This is stupid + # as it breaks how the two halves (Basic and Advanced) of the IPv6 + # Socket API were designed to be used but we have to live with it. + # Define _GNU_SOURCE to pull in the IPv6 Advanced Socket API. + *-linux*) + STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE" + CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" + ;; esac AC_HEADER_STDC @@ -309,6 +318,78 @@ lifconf.lifc_len = 0; ISC_PLATFORM_HAVELIFCONF="#undef ISC_PLATFORM_HAVELIFCONF"]) AC_SUBST(ISC_PLATFORM_HAVELIFCONF) +# +# check if we have kqueue +# +AC_ARG_ENABLE(kqueue, + [ --enable-kqueue use BSD kqueue when available [[default=yes]]], + want_kqueue="$enableval", want_kqueue="yes") +case $want_kqueue in +yes) + AC_CHECK_FUNC(kqueue, ac_cv_have_kqueue=yes, ac_cv_have_kqueue=no) + case $ac_cv_have_kqueue in + yes) + ISC_PLATFORM_HAVEKQUEUE="#define ISC_PLATFORM_HAVEKQUEUE 1" + ;; + *) + ISC_PLATFORM_HAVEKQUEUE="#undef ISC_PLATFORM_HAVEKQUEUE" + ;; + esac + ;; +*) + ISC_PLATFORM_HAVEKQUEUE="#undef ISC_PLATFORM_HAVEKQUEUE" + ;; +esac +AC_SUBST(ISC_PLATFORM_HAVEKQUEUE) + +# +# check if we have epoll. Linux kernel 2.4 has epoll_create() which fails, +# so we need to try running the code, not just test its existence. +# +AC_ARG_ENABLE(epoll, + [ --enable-epoll use Linux epoll when available [[default=yes]]], + want_epoll="$enableval", want_epoll="yes") +case $want_epoll in +yes) + AC_MSG_CHECKING(epoll support) + AC_TRY_RUN([ +#include <sys/epoll.h> +int main() { + if (epoll_create(1) < 0) + return (1); + return (0); +} +], + [AC_MSG_RESULT(yes) + ISC_PLATFORM_HAVEEPOLL="#define ISC_PLATFORM_HAVEEPOLL 1"], + [AC_MSG_RESULT(no) + ISC_PLATFORM_HAVEEPOLL="#undef ISC_PLATFORM_HAVEEPOLL"]) + ;; +*) + ISC_PLATFORM_HAVEEPOLL="#undef ISC_PLATFORM_HAVEEPOLL" + ;; +esac +AC_SUBST(ISC_PLATFORM_HAVEEPOLL) + +# +# check if we support /dev/poll +# +AC_ARG_ENABLE(devpoll, + [ --enable-devpoll use /dev/poll when available [[default=yes]]], + want_devpoll="$enableval", want_devpoll="yes") +case $want_devpoll in +yes) + AC_CHECK_HEADERS(sys/devpoll.h, + ISC_PLATFORM_HAVEDEVPOLL="#define ISC_PLATFORM_HAVEDEVPOLL 1" + , + ISC_PLATFORM_HAVEDEVPOLL="#undef ISC_PLATFORM_HAVEDEVPOLL" + ) + ;; +*) + ISC_PLATFORM_HAVEDEVPOLL="#undef ISC_PLATFORM_HAVEDEVPOLL" + ;; +esac +AC_SUBST(ISC_PLATFORM_HAVEDEVPOLL) # # check if we need to #include sys/select.h explicitly @@ -891,6 +972,16 @@ case "$host" in esac # +# Work around Solaris's select() limitations. +# +case "$host" in + *-solaris2.[[89]]|*-solaris2.1?) + AC_DEFINE(FD_SETSIZE, 65536, + [Solaris hack to get select_large_fdset.]) + ;; +esac + +# # Purify support # AC_MSG_CHECKING(whether to use purify) @@ -935,6 +1026,14 @@ AC_SUBST(PURIFY) # # GNU libtool support # +case $build_os in +sunos*) + # Just set the maximum command line length for sunos as it otherwise + # takes a exceptionally long time to work it out. Required for libtool. + lt_cv_sys_max_cmd_len=4096; + ;; +esac + AC_ARG_WITH(libtool, [ --with-libtool use GNU libtool (following indented options supported)], use_libtool="$withval", use_libtool="no") @@ -1686,7 +1785,8 @@ AC_ARG_ENABLE(linux-caps, [ --disable-linux-caps disable linux capabilities]) case "$enable_linux_caps" in yes|'') - AC_CHECK_HEADERS(linux/capability.h) + AC_CHECK_HEADERS(linux/capability.h sys/capability.h) + AC_CHECK_FUNCS(capset) ;; no) ;; @@ -1755,6 +1855,18 @@ AC_MSG_RESULT(cannot determine type of rlim_cur when cross compiling - assuming AC_SUBST(ISC_PLATFORM_RLIMITTYPE) # +# Older HP-UX doesn't have gettune +# +case "$host" in + *-hp-hpux*) + AC_CHECK_HEADERS(sys/dyntune.h) + ;; + *) + ;; +esac + + +# # Compaq TruCluster requires more code for handling cluster IP aliases # case "$host" in @@ -1812,7 +1924,7 @@ case "$host" in [*-solaris2.[89]]) hack_shutup_pthreadonceinit=yes ;; - *-solaris2.1[0-9]) + *-solaris2.1[[0-9]]) hack_shutup_pthreadonceinit=yes ;; esac diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 41837c6a9a1c..4ce75d7fcabd 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- File: $Id: Bv9ARM-book.xml,v 1.155.2.27.2.88.2.2 2008/07/23 12:03:52 marka Exp $ --> +<!-- File: $Id: Bv9ARM-book.xml,v 1.155.2.27.2.96 2008/09/27 23:50:37 jinmei Exp $ --> <book> <title>BIND 9 Administrator Reference Manual</title> @@ -436,9 +436,11 @@ as none of the name servers share their cached data.</para></sect1> <sect1><title>Supported Operating Systems</title> <para>ISC <acronym>BIND</acronym> 9 compiles and runs on a large number -of Unix-like operating system and on Windows NT / 2000. For an up-to-date +of Unix-like operating systems, and on some versions of Microsoft Windows +including Windows XP, Windows 2003, and Windows 2008. For an up-to-date list of supported systems, see the README file in the top level directory -of the BIND 9 source distribution.</para> +of the BIND 9 source distribution. +</para> </sect1> </chapter> @@ -1906,6 +1908,33 @@ be limited by the context in which it is used.</para></entry> a pathname, such as <filename>zones/master/my.test.domain</filename>.</para></entry> </row> <row rowsep = "0"> + <entry colname="1"> + <para> + <varname>port_list</varname> + </para> + </entry> + <entry colname="2"> + <para> + A list of an <varname>ip_port</varname> or a port + range. + A port range is specified in the form of + <userinput>range</userinput> followed by + two <varname>ip_port</varname>s, + <varname>port_low</varname> and + <varname>port_high</varname>, which represents + port numbers from <varname>port_low</varname> through + <varname>port_high</varname>, inclusive. + <varname>port_low</varname> must not be larger than + <varname>port_high</varname>. + For example, + <userinput>range 1024 65535</userinput> represents + ports from 1024 through 65535. + In either case an asterisk (`*') character is not + allowed as a valid <varname>ip_port</varname>. + </para> + </entry> +</row> +<row rowsep = "0"> <entry colname = "1"><para><varname>size_spec</varname></para></entry> <entry colname = "2"><para>A number, the word <userinput>unlimited</userinput>, or the word <userinput>default</userinput>.</para><para> @@ -2867,7 +2896,9 @@ statement in the <filename>named.conf</filename> file:</para> <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-v6-synthesis { <replaceable>address_match_list</replaceable> }; </optional> <optional> blackhole { <replaceable>address_match_list</replaceable> }; </optional> + <optional> use-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional> <optional> avoid-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional> + <optional> use-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional> <optional> avoid-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional> <optional> listen-on <optional> port <replaceable>ip_port</replaceable> </optional> { <replaceable>address_match_list</replaceable> }; </optional> <optional> listen-on-v6 <optional> port <replaceable>ip_port</replaceable> </optional> { <replaceable>address_match_list</replaceable> }; </optional> @@ -3725,28 +3756,100 @@ and on port 1234 of IPv6 addresses that is not in the prefix <para>If no <command>listen-on-v6</command> option is specified, the server will not listen on any IPv6 address.</para></sect3> -<sect3><title>Query Address</title> +<sect3 id="query_address"><title>Query Address</title> <para>If the server doesn't know the answer to a question, it will query other name servers. <command>query-source</command> specifies the address and port used for such queries. For queries sent over IPv6, there is a separate <command>query-source-v6</command> option. If <command>address</command> is <command>*</command> (asterisk) or is omitted, a wildcard IP address (<command>INADDR_ANY</command>) will be used. -If <command>port</command> is <command>*</command> or is omitted, -a random unprivileged port number is picked up and will be -used for each query. -It is generally strongly discouraged to -specify a particular port for the -<command>query-source</command> or -<command>query-source-v6</command> options; -it implicitly disables the use of randomized port numbers -and leads to insecure operation. -The <command>avoid-v4-udp-ports</command> -and <command>avoid-v6-udp-ports</command> options can be used to prevent named -from selecting certain ports. The defaults are:</para> +</para> + <para> + If <command>port</command> is <command>*</command> or is omitted, + a random port number from a pre-configured + range is picked up and will be used for each query. + The port range(s) is that specified in + the <command>use-v4-udp-ports</command> (for IPv4) + and <command>use-v6-udp-ports</command> (for IPv6) + options, excluding the ranges specified in + the <command>avoid-v4-udp-ports</command> + and <command>avoid-v6-udp-ports</command> options, respectively. + </para> + + <para> + The defaults of the <command>query-source</command> and + <command>query-source-v6</command> options + are: + </para> + <programlisting>query-source address * port *; query-source-v6 address * port *; </programlisting> + + <para> + If <command>use-v4-udp-ports</command> or + <command>use-v6-udp-ports</command> is unspecified, + <command>named</command> will check if the operating + system provides a programming interface to retrieve the + system's default range for ephemeral ports. + If such an interface is available, + <command>named</command> will use the corresponding system + default range; otherwise, it will use its own defaults: + </para> + +<programlisting>use-v4-udp-ports { range 1024 65535; }; +use-v6-udp-ports { range 1024 65535; }; +</programlisting> + + <para> + Note: make sure the ranges be sufficiently large for + security. A desirable size depends on various parameters, + but we generally recommend it contain at least 16384 ports + (14 bits of entropy). + Note also that the system's default range when used may be + too small for this purpose, and that the range may even be + changed while <command>named</command> is running; the new + range will automatically be applied when <command>named</command> + is reloaded. + It is encouraged to + configure <command>use-v4-udp-ports</command> and + <command>use-v6-udp-ports</command> explicitly so that the + ranges are sufficiently large and are reasonably + independent from the ranges used by other applications. + </para> + + <para> + Note: the operational configuration + where <command>named</command> runs may prohibit the use + of some ports. For example, UNIX systems will not allow + <command>named</command> running without a root privilege + to use ports less than 1024. + If such ports are included in the specified (or detected) + set of query ports, the corresponding query attempts will + fail, resulting in resolution failures or delay. + It is therefore important to configure the set of ports + that can be safely used in the expected operational environment. + </para> + + <para> + The defaults of the <command>avoid-v4-udp-ports</command> and + <command>avoid-v6-udp-ports</command> options + are: + </para> + +<programlisting>avoid-v4-udp-ports {}; +avoid-v6-udp-ports {}; +</programlisting> + + <para> + Note: it is generally strongly discouraged to + specify a particular port for the + <command>query-source</command> or + <command>query-source-v6</command> options; + it implicitly disables the use of randomized port numbers + and can be insecure. + </para> + <note> <para>The address specified in the <command>query-source</command> option is used for both UDP and TCP queries, but the port applies only to @@ -3957,16 +4060,48 @@ but applies to notify messages sent to IPv6 addresses.</para> </sect3> <sect3> -<title>Bad UDP Port Lists</title> -<para> -<command>avoid-v4-udp-ports</command> and <command>avoid-v6-udp-ports</command> -specify a list of IPv4 and IPv6 UDP ports that will not be used as system -assigned source ports for UDP sockets. These lists prevent named -from choosing as its random source port a port that is blocked by -your firewall. If a query went out with such a source port, the -answer would not get by the firewall and the name server would have -to query again. -</para> +<title>UDP Port Lists</title> + <para> + <command>use-v4-udp-ports</command>, + <command>avoid-v4-udp-ports</command>, + <command>use-v6-udp-ports</command>, and + <command>avoid-v6-udp-ports</command> + specify a list of IPv4 and IPv6 UDP ports that will be + used or not used as source ports for UDP messages. + See <xref linkend="query_address"/> about how the + available ports are determined. + For example, with the following configuration + </para> + +<programlisting> +use-v6-udp-ports { range 32768 65535; }; +avoid-v6-udp-ports { 40000; range 50000 60000; }; +</programlisting> + + <para> + UDP ports of IPv6 messages sent + from <command>named</command> will be in one + of the following ranges: 32768 to 39999, 40001 to 49999, + and 60001 to 65535. + </para> + + <para> + <command>avoid-v4-udp-ports</command> and + <command>avoid-v6-udp-ports</command> can be used + to prevent <command>named</command> from choosing as its random source port a + port that is blocked by your firewall or a port that is + used by other applications; + if a query went out with a source port blocked by a + firewall, the + answer would not get by the firewall and the name server would + have to query again. + Note: the desired range can also be represented only with + <command>use-v4-udp-ports</command> and + <command>use-v6-udp-ports</command>, and the + <command>avoid-</command> options are redundant in that + sense; they are provided for backward compatibility and + to possibly simplify the port specification. + </para> </sect3> <sect3> @@ -4073,31 +4208,45 @@ connections that the server will accept. The default is <literal>100</literal>.</para> </listitem></varlistentry> - <varlistentry> - <term><command>reserved-sockets</command></term> - <listitem> - <para> - The number of file descriptors reserved for TCP, stdio, - etc. This needs to be big enough to cover the number of - interfaces named listens on, tcp-clients as well as - to provide room for outgoing TCP queries and incoming zone - transfers. The default is <literal>512</literal>. - The minimum value is <literal>128</literal> and the - maximum value is <literal>128</literal> less than - 'files' or FD_SETSIZE (whichever is smaller). This - option may be removed in the future. - </para> - </listitem> - </varlistentry> + <varlistentry> + <term><command>reserved-sockets</command></term> + <listitem> + <para> + The number of file descriptors reserved for TCP, stdio, + etc. This needs to be big enough to cover the number of + interfaces named listens on, tcp-clients as well as + to provide room for outgoing TCP queries and incoming zone + transfers. The default is <literal>512</literal>. + The minimum value is <literal>128</literal> and the + maximum value is <literal>128</literal> less than + maxsockets (-S). This option may be removed in the future. + </para> + <para> + This option has little effect on Windows. + </para> + </listitem> + </varlistentry> <varlistentry><term><command>max-cache-size</command></term> -<listitem><para>The maximum amount of memory to use for the -server's cache, in bytes. When the amount of data in the cache +<listitem><para> +The maximum amount of memory to use for the +server's cache, in bytes. +When the amount of data in the cache reaches this limit, the server will cause records to expire -prematurely so that the limit is not exceeded. In a server with -multiple views, the limit applies separately to the cache of each -view. The default is <literal>unlimited</literal>, meaning that -records are purged from the cache only when their TTLs expire. +prematurely so that the limit is not exceeded. +A value of 0 is special, meaning that +records are purged from the cache only when their +TTLs expire. +Another special keyword <literal>unlimited</literal> +means the maximum value of 32-bit unsigned integers +(0xffffffff), which may not have the same effect as +0 on machines that support more than 32 bits of +memory space. +Any positive values less than 2MB will be ignored reset +to 2MB. +In a server with multiple views, the limit applies +separately to the cache of each view. +The default is 0. </para> </listitem></varlistentry> @@ -4725,7 +4874,7 @@ a client request will be resolved in the context of the first <command>view</command> that it matches.</para> <para>Zones defined within a <command>view</command> statement will -be only be accessible to clients that match the <command>view</command>. +only be accessible to clients that match the <command>view</command>. By defining a zone of the same name in multiple views, different zone data can be given to different clients, for example, "internal" and "external" clients in a split DNS setup.</para> @@ -5545,6 +5694,11 @@ Described in RFC 1035.</para></entry> <entry colname = "2"><para>information about well known network services (replaces WKS). Described in RFC 2782.</para></entry> </row> +<row rowsep="0"> +<entry colname="1"><para>SSHFP</para></entry> +<entry colname="2"><para>Provides a way to securly publish a secure shell +key's fingerprint. Described in RFC 4255.</para></entry> +</row> <row rowsep = "0"> <entry colname = "1"><para>TXT</para></entry> <entry colname = "2"><para>text records. Described in RFC 1035.</para></entry> @@ -5899,7 +6053,7 @@ delegation.</para> $GENERATE 1-2 0 NS SERVER$.EXAMPLE. $GENERATE 1-127 $ CNAME $.0</programlisting> <para>is equivalent to</para> -<programlisting>0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE. +<programlisting>0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE. 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE. 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA. 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA. diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index 34220264a27c..0dcb9b551055 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch02.html,v 1.10.2.1.8.16 2008/01/19 01:52:13 marka Exp $ --> +<!-- $Id: Bv9ARM.ch02.html,v 1.10.2.1.8.18 2008/09/12 01:22:03 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -104,9 +104,11 @@ as none of the name servers share their cached data.</p> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> <a name="id2565440"></a>Supported Operating Systems</h2></div></div></div> <p>ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large number -of Unix-like operating system and on Windows NT / 2000. For an up-to-date +of Unix-like operating systems, and on some versions of Microsoft Windows +including Windows XP, Windows 2003, and Windows 2008. For an up-to-date list of supported systems, see the README file in the top level directory -of the BIND 9 source distribution.</p> +of the BIND 9 source distribution. +</p> </div> </div> <div class="navfooter"> diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 12f30fe38325..5f2ae11bce04 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch04.html,v 1.30.2.6.2.32 2008/01/19 01:52:13 marka Exp $ --> +<!-- $Id: Bv9ARM.ch04.html,v 1.30.2.6.2.33 2008/09/12 01:22:03 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -64,11 +64,11 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2568457">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568592">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568660">Generating Keys</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568727">Signing the Zone</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568802">Configuring Servers</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2568939">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2568871">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2569066">Address Lookups Using AAAA Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2569086">Address to Name Lookups Using Nibble Format</a></span></dt> @@ -571,7 +571,7 @@ allow-update { key host1-host2. ;}; zone key of another zone above this one in the DNS tree.</p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2568592"></a>Generating Keys</h3></div></div></div> +<a name="id2568660"></a>Generating Keys</h3></div></div></div> <p>The <span><strong class="command">dnssec-keygen</strong></span> program is used to generate keys.</p> <p>A secure zone must contain one or more zone keys. The @@ -717,7 +717,7 @@ options { </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2568939"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> +<a name="id2568871"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div> <p><acronym class="acronym">BIND</acronym> 9 fully supports all currently defined forms of IPv6 name to address and address to name lookups. It will also use IPv6 addresses to make queries when running on an IPv6 capable diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index d59d9d198b61..75d49e3f9333 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch06.html,v 1.56.2.12.2.54.2.1 2008/05/27 22:09:04 each Exp $ --> +<!-- $Id: Bv9ARM.ch06.html,v 1.56.2.12.2.62 2008/09/28 01:20:38 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -48,46 +48,46 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2570147">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572052">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2570700"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572674"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2570937"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572910"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571351"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571368"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571390"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571414"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571485"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571611"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572886"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572958"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573021"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573065"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573080"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573256"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573273"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573296"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573387"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573459"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573585"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574859"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574932"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574995"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575038"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575053"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2580682"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2580801"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2581268"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2581318"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2580885"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2581402"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2582238"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2582689"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2583777">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2584227">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585141">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585609">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585570">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585744">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585980"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586174">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586280">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586517"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> </dl></dd> </dl> </div> @@ -202,6 +202,33 @@ be limited by the context in which it is used.</p></td> a pathname, such as <code class="filename">zones/master/my.test.domain</code>.</p></td> </tr> <tr> +<td> + <p> + <code class="varname">port_list</code> + </p> + </td> +<td> + <p> + A list of an <code class="varname">ip_port</code> or a port + range. + A port range is specified in the form of + <strong class="userinput"><code>range</code></strong> followed by + two <code class="varname">ip_port</code>s, + <code class="varname">port_low</code> and + <code class="varname">port_high</code>, which represents + port numbers from <code class="varname">port_low</code> through + <code class="varname">port_high</code>, inclusive. + <code class="varname">port_low</code> must not be larger than + <code class="varname">port_high</code>. + For example, + <strong class="userinput"><code>range 1024 65535</code></strong> represents + ports from 1024 through 65535. + In either case an asterisk (`*') character is not + allowed as a valid <code class="varname">ip_port</code>. + </p> + </td> +</tr> +<tr> <td><p><code class="varname">size_spec</code></p></td> <td> <p>A number, the word <strong class="userinput"><code>unlimited</code></strong>, @@ -244,7 +271,7 @@ are restricted to slave and stub zones.</p></td> <a name="address_match_lists"></a>Address Match Lists</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2570026"></a>Syntax</h4></div></div></div> +<a name="id2564763"></a>Syntax</h4></div></div></div> <pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ; [<span class="optional"> address_match_list_element; ... </span>] <code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] | @@ -253,7 +280,7 @@ are restricted to slave and stub zones.</p></td> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2570053"></a>Definition and Usage</h4></div></div></div> +<a name="id2564790"></a>Definition and Usage</h4></div></div></div> <p>Address match lists are primarily used to determine access control for various server operations. They are also used in the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span> @@ -303,14 +330,14 @@ other 1.2.3.* hosts fall through.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570147"></a>Comment Syntax</h3></div></div></div> +<a name="id2572052"></a>Comment Syntax</h3></div></div></div> <p>The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for comments to appear anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file. To appeal to programmers of all kinds, they can be written in the C, C++, or shell/perl style.</p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2570162"></a>Syntax</h4></div></div></div> +<a name="id2572067"></a>Syntax</h4></div></div></div> <pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre> <p> </p> @@ -323,7 +350,7 @@ in the C, C++, or shell/perl style.</p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2570259"></a>Definition and Usage</h4></div></div></div> +<a name="id2572232"></a>Definition and Usage</h4></div></div></div> <p>Comments may appear anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration file.</p> <p>C-style comments start with the two characters /* (slash, @@ -444,7 +471,7 @@ a per-server basis.</p></td> configuration.</p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570700"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2572674"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name { address_match_list }; @@ -495,7 +522,7 @@ IPv6 addresses, just like <span><strong class="command">localhost</strong></span </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2570937"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2572910"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">controls</strong></span> { inet ( ip_addr | * ) [<span class="optional"> port ip_port </span>] allow { <em class="replaceable"><code> address_match_list </code></em> } keys { <em class="replaceable"><code> key_list </code></em> }; @@ -600,12 +627,12 @@ statement: <span><strong class="command">controls { };</strong></span>. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571351"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2573256"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571368"></a><span><strong class="command">include</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2573273"></a><span><strong class="command">include</strong></span> Statement Definition and Usage</h3></div></div></div> <p>The <span><strong class="command">include</strong></span> statement inserts the specified file at the point where the <span><strong class="command">include</strong></span> statement is encountered. The <span><strong class="command">include</strong></span> @@ -616,7 +643,7 @@ statement: <span><strong class="command">controls { };</strong></span>. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571390"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2573296"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> { algorithm <em class="replaceable"><code>string</code></em>; secret <em class="replaceable"><code>string</code></em>; @@ -625,7 +652,7 @@ statement: <span><strong class="command">controls { };</strong></span>. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571414"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2573387"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div> <p>The <span><strong class="command">key</strong></span> statement defines a shared secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>) or the command channel @@ -657,7 +684,7 @@ string.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571485"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2573459"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">logging</strong></span> { [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> { ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path name</code></em> @@ -681,7 +708,7 @@ string.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2571611"></a><span><strong class="command">logging</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2573585"></a><span><strong class="command">logging</strong></span> Statement Definition and Usage</h3></div></div></div> <p>The <span><strong class="command">logging</strong></span> statement configures a wide variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase associates output methods, format options and severity levels with @@ -704,7 +731,7 @@ channels, or to standard error if the "<code class="option">-g</code>" option was specified.</p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2571664"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> +<a name="id2573637"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div> <p>All log output goes to one or more <span class="emphasis"><em>channels</em></span>; you can make as many of them as you want.</p> <p>Every channel definition must include a destination clause that @@ -1019,7 +1046,7 @@ a <span><strong class="command">delegation-only</strong></span> in a hint or stu </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572886"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574859"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div> <p> This is the grammar of the <span><strong class="command">lwres</strong></span> statement in the <code class="filename">named.conf</code> file:</p> <pre class="programlisting"><span><strong class="command">lwres</strong></span> { @@ -1032,7 +1059,7 @@ statement in the <code class="filename">named.conf</code> file:</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2572958"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2574932"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div> <p>The <span><strong class="command">lwres</strong></span> statement configures the name server to also act as a lightweight resolver server. (See <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple @@ -1060,20 +1087,20 @@ exact match lookup before search path elements are appended.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2573021"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2574995"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"> <span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] } ; </pre> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2573065"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage </h3></div></div></div> +<a name="id2575038"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage </h3></div></div></div> <p><span><strong class="command">masters</strong></span> lists allow for a common set of masters to be easily used by multiple stub and slave zones.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2573080"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2575053"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div> <p>This is the grammar of the <span><strong class="command">options</strong></span> statement in the <code class="filename">named.conf</code> file:</p> <pre class="programlisting"><span><strong class="command">options</strong></span> { @@ -1122,7 +1149,9 @@ statement in the <code class="filename">named.conf</code> file:</p> [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>] + [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>] [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>] + [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>] [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>] [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>] [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>] @@ -1133,6 +1162,7 @@ statement in the <code class="filename">named.conf</code> file:</p> [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>] + [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>] [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>] @@ -1721,7 +1751,7 @@ IN-ADDR.ARPA, IP6.ARPA, or IP6.INT). </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2575838"></a>Forwarding</h4></div></div></div> +<a name="id2577831"></a>Forwarding</h4></div></div></div> <p>The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external name servers. It can also be used to allow queries by servers that @@ -1753,7 +1783,7 @@ Statement Grammar”</a>.</p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2575889"></a>Dual-stack Servers</h4></div></div></div> +<a name="id2577881"></a>Dual-stack Servers</h4></div></div></div> <p>Dual-stack servers are used as servers of last resort to work around problems in reachability due the lack of support for either IPv4 or IPv6 on the host machine.</p> @@ -1834,7 +1864,7 @@ from these addresses will not be responded to. The default is <strong class="use </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2576136"></a>Interfaces</h4></div></div></div> +<a name="id2578129"></a>Interfaces</h4></div></div></div> <p>The interfaces and ports that the server will answer queries from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes an optional port, and an <code class="varname">address_match_list</code>. @@ -1884,28 +1914,90 @@ the server will not listen on any IPv6 address.</p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2576225"></a>Query Address</h4></div></div></div> +<a name="query_address"></a>Query Address</h4></div></div></div> <p>If the server doesn't know the answer to a question, it will query other name servers. <span><strong class="command">query-source</strong></span> specifies the address and port used for such queries. For queries sent over IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option. If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted, a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>) will be used. -If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted, -a random unprivileged port number is picked up and will be -used for each query. -It is generally strongly discouraged to -specify a particular port for the -<span><strong class="command">query-source</strong></span> or -<span><strong class="command">query-source-v6</strong></span> options; -it implicitly disables the use of randomized port numbers -and leads to insecure operation. -The <span><strong class="command">avoid-v4-udp-ports</strong></span> -and <span><strong class="command">avoid-v6-udp-ports</strong></span> options can be used to prevent named -from selecting certain ports. The defaults are:</p> +</p> +<p> + If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted, + a random port number from a pre-configured + range is picked up and will be used for each query. + The port range(s) is that specified in + the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4) + and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6) + options, excluding the ranges specified in + the <span><strong class="command">avoid-v4-udp-ports</strong></span> + and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively. + </p> +<p> + The defaults of the <span><strong class="command">query-source</strong></span> and + <span><strong class="command">query-source-v6</strong></span> options + are: + </p> <pre class="programlisting">query-source address * port *; query-source-v6 address * port *; </pre> +<p> + If <span><strong class="command">use-v4-udp-ports</strong></span> or + <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified, + <span><strong class="command">named</strong></span> will check if the operating + system provides a programming interface to retrieve the + system's default range for ephemeral ports. + If such an interface is available, + <span><strong class="command">named</strong></span> will use the corresponding system + default range; otherwise, it will use its own defaults: + </p> +<pre class="programlisting">use-v4-udp-ports { range 1024 65535; }; +use-v6-udp-ports { range 1024 65535; }; +</pre> +<p> + Note: make sure the ranges be sufficiently large for + security. A desirable size depends on various parameters, + but we generally recommend it contain at least 16384 ports + (14 bits of entropy). + Note also that the system's default range when used may be + too small for this purpose, and that the range may even be + changed while <span><strong class="command">named</strong></span> is running; the new + range will automatically be applied when <span><strong class="command">named</strong></span> + is reloaded. + It is encouraged to + configure <span><strong class="command">use-v4-udp-ports</strong></span> and + <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the + ranges are sufficiently large and are reasonably + independent from the ranges used by other applications. + </p> +<p> + Note: the operational configuration + where <span><strong class="command">named</strong></span> runs may prohibit the use + of some ports. For example, UNIX systems will not allow + <span><strong class="command">named</strong></span> running without a root privilege + to use ports less than 1024. + If such ports are included in the specified (or detected) + set of query ports, the corresponding query attempts will + fail, resulting in resolution failures or delay. + It is therefore important to configure the set of ports + that can be safely used in the expected operational environment. + </p> +<p> + The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and + <span><strong class="command">avoid-v6-udp-ports</strong></span> options + are: + </p> +<pre class="programlisting">avoid-v4-udp-ports {}; +avoid-v6-udp-ports {}; +</pre> +<p> + Note: it is generally strongly discouraged to + specify a particular port for the + <span><strong class="command">query-source</strong></span> or + <span><strong class="command">query-source-v6</strong></span> options; + it implicitly disables the use of randomized port numbers + and can be insecure. + </p> <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"> <h3 class="title">Note</h3> <p>The address specified in the <span><strong class="command">query-source</strong></span> option @@ -2083,20 +2175,49 @@ but applies to notify messages sent to IPv6 addresses.</p></dd> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2576903"></a>Bad UDP Port Lists</h4></div></div></div> +<a name="id2579123"></a>UDP Port Lists</h4></div></div></div> <p> -<span><strong class="command">avoid-v4-udp-ports</strong></span> and <span><strong class="command">avoid-v6-udp-ports</strong></span> -specify a list of IPv4 and IPv6 UDP ports that will not be used as system -assigned source ports for UDP sockets. These lists prevent named -from choosing as its random source port a port that is blocked by -your firewall. If a query went out with such a source port, the -answer would not get by the firewall and the name server would have -to query again. -</p> + <span><strong class="command">use-v4-udp-ports</strong></span>, + <span><strong class="command">avoid-v4-udp-ports</strong></span>, + <span><strong class="command">use-v6-udp-ports</strong></span>, and + <span><strong class="command">avoid-v6-udp-ports</strong></span> + specify a list of IPv4 and IPv6 UDP ports that will be + used or not used as source ports for UDP messages. + See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the + available ports are determined. + For example, with the following configuration + </p> +<pre class="programlisting"> +use-v6-udp-ports { range 32768 65535; }; +avoid-v6-udp-ports { 40000; range 50000 60000; }; +</pre> +<p> + UDP ports of IPv6 messages sent + from <span><strong class="command">named</strong></span> will be in one + of the following ranges: 32768 to 39999, 40001 to 49999, + and 60001 to 65535. + </p> +<p> + <span><strong class="command">avoid-v4-udp-ports</strong></span> and + <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used + to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a + port that is blocked by your firewall or a port that is + used by other applications; + if a query went out with a source port blocked by a + firewall, the + answer would not get by the firewall and the name server would + have to query again. + Note: the desired range can also be represented only with + <span><strong class="command">use-v4-udp-ports</strong></span> and + <span><strong class="command">use-v6-udp-ports</strong></span>, and the + <span><strong class="command">avoid-</strong></span> options are redundant in that + sense; they are provided for backward compatibility and + to possibly simplify the port specification. + </p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2576919"></a>Operating System Resource Limits</h4></div></div></div> +<a name="id2579184"></a>Operating System Resource Limits</h4></div></div></div> <p>The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For example, <span><strong class="command">1G</strong></span> can be used instead of @@ -2140,7 +2261,7 @@ may use. The default is <code class="literal">default</code>.</p></dd> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2564732"></a>Server Resource Limits</h4></div></div></div> +<a name="id2579285"></a>Server Resource Limits</h4></div></div></div> <p>The following options set limits on the server's resource consumption that are enforced internally by the server rather than the operating system.</p> @@ -2174,14 +2295,42 @@ on hosts with limited memory. <dd><p>The maximum number of simultaneous client TCP connections that the server will accept. The default is <code class="literal">100</code>.</p></dd> +<dt><span class="term"><span><strong class="command">reserved-sockets</strong></span></span></dt> +<dd> +<p> + The number of file descriptors reserved for TCP, stdio, + etc. This needs to be big enough to cover the number of + interfaces named listens on, tcp-clients as well as + to provide room for outgoing TCP queries and incoming zone + transfers. The default is <code class="literal">512</code>. + The minimum value is <code class="literal">128</code> and the + maximum value is <code class="literal">128</code> less than + maxsockets (-S). This option may be removed in the future. + </p> +<p> + This option has little effect on Windows. + </p> +</dd> <dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt> -<dd><p>The maximum amount of memory to use for the -server's cache, in bytes. When the amount of data in the cache +<dd><p> +The maximum amount of memory to use for the +server's cache, in bytes. +When the amount of data in the cache reaches this limit, the server will cause records to expire -prematurely so that the limit is not exceeded. In a server with -multiple views, the limit applies separately to the cache of each -view. The default is <code class="literal">unlimited</code>, meaning that -records are purged from the cache only when their TTLs expire. +prematurely so that the limit is not exceeded. +A value of 0 is special, meaning that +records are purged from the cache only when their +TTLs expire. +Another special keyword <code class="literal">unlimited</code> +means the maximum value of 32-bit unsigned integers +(0xffffffff), which may not have the same effect as +0 on machines that support more than 32 bits of +memory space. +Any positive values less than 2MB will be ignored reset +to 2MB. +In a server with multiple views, the limit applies +separately to the cache of each view. +The default is 0. </p></dd> <dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt> <dd><p>The listen queue depth. The default and minimum is 3. @@ -2194,7 +2343,7 @@ silently raised. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2564845"></a>Periodic Task Intervals</h4></div></div></div> +<a name="id2579426"></a>Periodic Task Intervals</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt> <dd><p>The server will remove expired resource records @@ -2689,7 +2838,7 @@ For more details, see the description of </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2580682"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div> +<a name="id2581268"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div> <pre class="programlisting"><span><strong class="command">trusted-keys</strong></span> { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>] @@ -2698,7 +2847,7 @@ For more details, see the description of </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2580801"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition +<a name="id2581318"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</h3></div></div></div> <p> The <span><strong class="command">trusted-keys</strong></span> statement defines @@ -2741,7 +2890,7 @@ For more details, see the description of </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2580885"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2581402"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div> <p>The <span><strong class="command">view</strong></span> statement is a powerful new feature of <acronym class="acronym">BIND</acronym> 9 that lets a name server answer a DNS query differently depending on who is asking. It is particularly useful for implementing @@ -2764,7 +2913,7 @@ The order of the <span><strong class="command">view</strong></span> statements i a client request will be resolved in the context of the first <span><strong class="command">view</strong></span> that it matches.</p> <p>Zones defined within a <span><strong class="command">view</strong></span> statement will -be only be accessible to clients that match the <span><strong class="command">view</strong></span>. +only be accessible to clients that match the <span><strong class="command">view</strong></span>. By defining a zone of the same name in multiple views, different zone data can be given to different clients, for example, "internal" and "external" clients in a split DNS setup.</p> @@ -2943,10 +3092,10 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional" </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2582238"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> +<a name="id2582689"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2582245"></a>Zone Types</h4></div></div></div> +<a name="id2582695"></a>Zone Types</h4></div></div></div> <div class="informaltable"><table border="1"> <colgroup> <col> @@ -3059,7 +3208,7 @@ from forwarders.</p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2582551"></a>Class</h4></div></div></div> +<a name="id2583001"></a>Class</h4></div></div></div> <p>The zone's name may optionally be followed by a class. If a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>), is assumed. This is correct for the vast majority of cases.</p> @@ -3074,7 +3223,7 @@ in the mid-1970s. Zone data for it can be specified with the <code class="litera </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2582582"></a>Zone Options</h4></div></div></div> +<a name="id2583032"></a>Zone Options</h4></div></div></div> <div class="variablelist"><dl> <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt> <dd><p>See the description of @@ -3322,7 +3471,7 @@ name, the rules are checked for each existing record type. </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2583777"></a>Zone File</h2></div></div></div> +<a name="id2584227"></a>Zone File</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> <a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div> @@ -3332,7 +3481,7 @@ Since the publication of RFC 1034, several new RRs have been identified and implemented in the DNS. These are also included.</p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2583795"></a>Resource Records</h4></div></div></div> +<a name="id2584245"></a>Resource Records</h4></div></div></div> <p>A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource information associated with a particular name is composed of @@ -3520,6 +3669,11 @@ Described in RFC 1035.</p></td> services (replaces WKS). Described in RFC 2782.</p></td> </tr> <tr> +<td><p>SSHFP</p></td> +<td><p>Provides a way to securly publish a secure shell +key's fingerprint. Described in RFC 4255.</p></td> +</tr> +<tr> <td><p>TXT</p></td> <td><p>text records. Described in RFC 1035.</p></td> </tr> @@ -3591,7 +3745,7 @@ used as "pointers" to other data in the DNS.</p> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2584784"></a>Textual expression of RRs</h4></div></div></div> +<a name="id2585252"></a>Textual expression of RRs</h4></div></div></div> <p>RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form when stored in a name server or resolver. In the examples provided in @@ -3681,7 +3835,7 @@ each of a different class.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585141"></a>Discussion of MX Records</h3></div></div></div> +<a name="id2585609"></a>Discussion of MX Records</h3></div></div></div> <p>As described above, domain servers store information as a series of resource records, each of which contains a particular piece of information about a given domain name (which is usually, @@ -3798,7 +3952,7 @@ can be explicitly specified, for example, <code class="literal">1h30m</code>. </ </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585570"></a>Inverse Mapping in IPv4</h3></div></div></div> +<a name="id2586174"></a>Inverse Mapping in IPv4</h3></div></div></div> <p>Reverse name resolution (that is, translation from IP address to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain and PTR records. Entries in the in-addr.arpa domain are made in @@ -3836,7 +3990,7 @@ that the example is relative to the listed origin.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585744"></a>Other Zone File Directives</h3></div></div></div> +<a name="id2586280"></a>Other Zone File Directives</h3></div></div></div> <p>The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format itself is class independent all records in a Master File must be of the same @@ -3845,7 +3999,7 @@ class.</p> and <span><strong class="command">$TTL.</strong></span></p> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2585763"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> +<a name="id2586299"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div> <p>Syntax: <span><strong class="command">$ORIGIN </strong></span><em class="replaceable"><code>domain-name</code></em> [<span class="optional"> <em class="replaceable"><code>comment</code></em></span>]</p> <p><span><strong class="command">$ORIGIN</strong></span> sets the domain name that will @@ -3860,7 +4014,7 @@ WWW CNAME MAIN-SERVER</pre> </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2585818"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> +<a name="id2586355"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div> <p>Syntax: <span><strong class="command">$INCLUDE</strong></span> <em class="replaceable"><code>filename</code></em> [<span class="optional"> <em class="replaceable"><code>origin</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>comment</code></em> </span>]</p> @@ -3884,7 +4038,7 @@ This could be construed as a deviation from RFC 1035, a feature, or both. </div> <div class="sect3" lang="en"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2585949"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> +<a name="id2586418"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div> <p>Syntax: <span><strong class="command">$TTL</strong></span> <em class="replaceable"><code>default-ttl</code></em> [<span class="optional"> <em class="replaceable"><code>comment</code></em> </span>]</p> @@ -3895,7 +4049,7 @@ with undefined TTLs. Valid TTLs are of the range 0-2147483647 seconds.</p> </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2585980"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> +<a name="id2586517"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div> <p>Syntax: <span><strong class="command">$GENERATE</strong></span> <em class="replaceable"><code>range</code></em> <em class="replaceable"><code>lhs</code></em> [<span class="optional"><em class="replaceable"><code>ttl</code></em></span>] [<span class="optional"><em class="replaceable"><code>class</code></em></span>] <em class="replaceable"><code>type</code></em> <em class="replaceable"><code>rhs</code></em> [<span class="optional"> <em class="replaceable"><code>comment</code></em> </span>]</p> <p><span><strong class="command">$GENERATE</strong></span> is used to create a series of resource records that only differ from each other by an iterator. <span><strong class="command">$GENERATE</strong></span> can @@ -3906,7 +4060,7 @@ delegation.</p> $GENERATE 1-2 0 NS SERVER$.EXAMPLE. $GENERATE 1-127 $ CNAME $.0</pre> <p>is equivalent to</p> -<pre class="programlisting">0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE. +<pre class="programlisting">0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE. 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE. 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA. 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA. diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index cfb405482e98..535956fbe18e 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch07.html,v 1.50.2.9.2.42 2008/01/19 01:52:15 marka Exp $ --> +<!-- $Id: Bv9ARM.ch07.html,v 1.50.2.9.2.49 2008/09/28 01:20:39 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -46,11 +46,11 @@ <p><b>Table of Contents</b></p> <dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2586576"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> (for +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2586976"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> (for UNIX servers)</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2586720">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2586777">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2587051">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2587109">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl> @@ -102,7 +102,7 @@ see the <span class="emphasis"><em>AUSCERT</em></span> advisory at </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2586576"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> (for +<a name="id2586976"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> (for UNIX servers)</h2></div></div></div> <p>On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> in a <span class="emphasis"><em>chrooted</em></span> environment (using the <span><strong class="command">chroot()</strong></span> function) by specifying the "<code class="option">-t</code>" @@ -117,7 +117,7 @@ user 202:</p> <p><strong class="userinput"><code>/usr/local/bin/named -u 202 -t /var/named</code></strong></p> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2586720"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> +<a name="id2587051"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div> <p>In order for a <span><strong class="command">chroot</strong></span> environment to work properly in a particular directory (for example, <code class="filename">/var/named</code>), @@ -142,7 +142,7 @@ to set up things like </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2586777"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> +<a name="id2587109"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div> <p>Prior to running the <span><strong class="command">named</strong></span> daemon, use the <span><strong class="command">touch</strong></span> utility (to change file access and modification times) or the <span><strong class="command">chown</strong></span> utility (to diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index 1bb97711b5b5..b4577ba1ae26 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch08.html,v 1.50.2.9.2.44 2008/01/19 01:52:15 marka Exp $ --> +<!-- $Id: Bv9ARM.ch08.html,v 1.50.2.9.2.51 2008/09/28 01:20:39 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -45,18 +45,18 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2586916">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2586921">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2586933">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2586950">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2587248">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2587253">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2587265">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2587282">Where Can I Get Help?</a></span></dt> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2586916"></a>Common Problems</h2></div></div></div> +<a name="id2587248"></a>Common Problems</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2586921"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> +<a name="id2587253"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div> <p>The best solution to solving installation and configuration issues is to take preventative measures by setting up logging files beforehand. The log files provide a @@ -66,7 +66,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2586933"></a>Incrementing and Changing the Serial Number</h2></div></div></div> +<a name="id2587265"></a>Incrementing and Changing the Serial Number</h2></div></div></div> <p> Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that @@ -89,7 +89,7 @@ </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2586950"></a>Where Can I Get Help?</h2></div></div></div> +<a name="id2587282"></a>Where Can I Get Help?</h2></div></div></div> <p>The Internet Software Consortium (<acronym class="acronym">ISC</acronym>) offers a wide range of support and service agreements for <acronym class="acronym">BIND</acronym> and <acronym class="acronym">DHCP</acronym> servers. Four levels of premium support are available and each level includes diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 4d07ae9a1cb6..907b23cbeeea 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.ch09.html,v 1.50.2.9.2.44 2008/01/19 01:52:15 marka Exp $ --> +<!-- $Id: Bv9ARM.ch09.html,v 1.50.2.9.2.51 2008/09/28 01:20:40 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -43,24 +43,24 @@ <div class="toc"> <p><b>Table of Contents</b></p> <dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2587012">Acknowledgments</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2587017">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2587412">Acknowledgments</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2587417">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#historical_dns_information">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2589386">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2589718">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> </dl> </div> <div class="sect1" lang="en"> <div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2587012"></a>Acknowledgments</h2></div></div></div> +<a name="id2587412"></a>Acknowledgments</h2></div></div></div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2587017"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> +<a name="id2587417"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> </h3></div></div></div> <p>Although the "official" beginning of the Domain Name System occurred in 1984 with the publication of RFC 920, the @@ -277,17 +277,17 @@ the number of the RFC). RFCs are also available via the Web at </p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2587943"></a>Bibliography</h4></div></div></div> +<a name="id2588206"></a>Bibliography</h4></div></div></div> <div class="bibliodiv"> <h3 class="title">Standards</h3> <div class="biblioentry"> -<a name="id2587954"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> +<a name="id2588217"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p> </div> <div class="biblioentry"> -<a name="id2587977"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> +<a name="id2588241"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p> </div> <div class="biblioentry"> -<a name="id2588001"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and +<a name="id2588264"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and Specification</i>. </span><span class="pubdate">November 1987. </span></p> </div> </div> @@ -295,22 +295,22 @@ Specification</i>. </span><span class="pubdate">November 1987. </span></p> <h3 class="title"> <a name="proposed_standards"></a>Proposed Standards</h3> <div class="biblioentry"> -<a name="id2588038"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> Specification</i>. </span><span class="pubdate">July 1997. </span></p> +<a name="id2588301"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> Specification</i>. </span><span class="pubdate">July 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2588064"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> Queries</i>. </span><span class="pubdate">March 1998. </span></p> +<a name="id2588327"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> Queries</i>. </span><span class="pubdate">March 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2588089"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2588353"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2588114"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2588377"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2588137"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2588401"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2588193"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> +<a name="id2588456"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p> </div> </div> <div class="bibliodiv"> @@ -321,85 +321,85 @@ Specification</i>. </span><span class="pubdate">November 1987. </span></p> RFCs are undergoing major revision by the IETF.</p> </div> <div class="biblioentry"> -<a name="id2588268"></a><p>[<abbr class="abbrev">RFC1886</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP version 6</i>. </span><span class="pubdate">December 1995. </span></p> +<a name="id2588532"></a><p>[<abbr class="abbrev">RFC1886</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP version 6</i>. </span><span class="pubdate">December 1995. </span></p> </div> <div class="biblioentry"> -<a name="id2588307"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> +<a name="id2588570"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2588346"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> +<a name="id2588610"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Other Important RFCs About <acronym class="acronym">DNS</acronym> Implementation</h3> <div class="biblioentry"> -<a name="id2588382"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p> +<a name="id2588646"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2588408"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p> +<a name="id2588672"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2588475"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> +<a name="id2588739"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Resource Record Types</h3> <div class="biblioentry"> -<a name="id2588517"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> +<a name="id2588849"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p> </div> <div class="biblioentry"> -<a name="id2588574"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> +<a name="id2588974"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2588612"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using +<a name="id2589012"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2588647"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain +<a name="id2589047"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain Name System</i>. </span><span class="pubdate">January 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2588701"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the Location of +<a name="id2589101"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the Location of Services.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2588741"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to Distribute MIXER +<a name="id2589141"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to Distribute MIXER Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2588768"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> +<a name="id2589168"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> and the Internet</h3> <div class="biblioentry"> -<a name="id2588802"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p> +<a name="id2589202"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2588827"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p> +<a name="id2589227"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p> </div> <div class="biblioentry"> -<a name="id2588851"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> +<a name="id2589251"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2588872"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> +<a name="id2589272"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title"> <acronym class="acronym">DNS</acronym> Operations</h3> <div class="biblioentry"> -<a name="id2588995"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p> +<a name="id2589326"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2589020"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p> +<a name="id2589352"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2589047"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> +<a name="id2589379"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p> </div> <div class="biblioentry"> -<a name="id2589083"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p> +<a name="id2589415"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p> </div> </div> <div class="bibliodiv"> @@ -410,28 +410,28 @@ Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998 <acronym class="acronym">DNS</acronym>-related, are not concerned with implementing software.</p> </div> <div class="biblioentry"> -<a name="id2589143"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p> +<a name="id2589475"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p> </div> <div class="biblioentry"> -<a name="id2589165"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> +<a name="id2589497"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p> </div> <div class="biblioentry"> -<a name="id2589190"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p> +<a name="id2589522"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p> </div> <div class="biblioentry"> -<a name="id2589214"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> +<a name="id2589546"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p> </div> <div class="biblioentry"> -<a name="id2589237"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2589569"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p> </div> <div class="biblioentry"> -<a name="id2589283"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> +<a name="id2589614"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p> </div> </div> <div class="bibliodiv"> <h3 class="title">Obsolete and Unimplemented Experimental RRs</h3> <div class="biblioentry"> -<a name="id2589314"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical +<a name="id2589645"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical Location</i>. </span><span class="pubdate">November 1994. </span></p> </div> </div> @@ -451,14 +451,14 @@ after which they are deleted unless updated by their authors. </div> <div class="sect2" lang="en"> <div class="titlepage"><div><div><h3 class="title"> -<a name="id2589386"></a>Other Documents About <acronym class="acronym">BIND</acronym> +<a name="id2589718"></a>Other Documents About <acronym class="acronym">BIND</acronym> </h3></div></div></div> <p></p> <div class="bibliography"> <div class="titlepage"><div><div><h4 class="title"> -<a name="id2589396"></a>Bibliography</h4></div></div></div> +<a name="id2589728"></a>Bibliography</h4></div></div></div> <div class="biblioentry"> -<a name="id2589398"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> +<a name="id2589730"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p> </div> </div> </div> diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 41b763c3e35e..02c0f1a98779 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> -<!-- $Id: Bv9ARM.html,v 1.60.2.9.2.48 2008/01/19 01:52:15 marka Exp $ --> +<!-- $Id: Bv9ARM.html,v 1.60.2.9.2.55 2008/09/28 01:20:40 tbox Exp $ --> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> @@ -107,11 +107,11 @@ <dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2568457">SIG(0)</a></span></dt> <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568592">Generating Keys</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568660">Generating Keys</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568727">Signing the Zone</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2568802">Configuring Servers</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2568939">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2568871">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2569066">Address Lookups Using AAAA Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2569086">Address to Name Lookups Using Nibble Format</a></span></dt> @@ -127,77 +127,77 @@ <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2570147">Comment Syntax</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572052">Comment Syntax</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2570700"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572674"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2570937"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572910"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571351"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571368"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571390"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571414"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571485"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2571611"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572886"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2572958"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573021"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573065"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573080"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573256"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573273"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573296"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573387"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573459"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573585"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574859"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574932"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574995"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575038"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575053"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2580682"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2580801"><span><strong class="command">trusted-keys</strong></span> Statement Definition +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2581268"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2581318"><span><strong class="command">trusted-keys</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2580885"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2581402"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span> Statement Grammar</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2582238"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2582689"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt> </dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2583777">Zone File</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2584227">Zone File</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585141">Discussion of MX Records</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585609">Discussion of MX Records</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585570">Inverse Mapping in IPv4</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585744">Other Zone File Directives</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585980"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586174">Inverse Mapping in IPv4</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586280">Other Zone File Directives</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586517"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt> </dl></dd> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</a></span></dt> <dd><dl> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2586576"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> (for +<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2586976"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span> (for UNIX servers)</a></span></dt> <dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2586720">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2586777">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2587051">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2587109">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt> </dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt> </dl></dd> <dt><span class="chapter"><a href="Bv9ARM.ch08.html">8. Troubleshooting</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2586916">Common Problems</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2586921">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2586933">Incrementing and Changing the Serial Number</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2586950">Where Can I Get Help?</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2587248">Common Problems</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2587253">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2587265">Incrementing and Changing the Serial Number</a></span></dt> +<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2587282">Where Can I Get Help?</a></span></dt> </dl></dd> <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Appendices</a></span></dt> <dd><dl> -<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2587012">Acknowledgments</a></span></dt> -<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2587017">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> +<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2587412">Acknowledgments</a></span></dt> +<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2587417">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#historical_dns_information">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt> <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd> <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt> <dd><dl> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt> <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2589386">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> +<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2589718">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt> </dl></dd> </dl></dd> </dl> diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index 7b599bab06e6..324b8cb028d1 100644 --- a/doc/arm/Bv9ARM.pdf +++ b/doc/arm/Bv9ARM.pdf @@ -561,7 +561,7 @@ endobj << /S /GoTo /D (subsubsection.6.2.16.8) >> endobj 380 0 obj -(6.2.16.8 Bad UDP Port Lists) +(6.2.16.8 UDP Port Lists) endobj 381 0 obj << /S /GoTo /D (subsubsection.6.2.16.9) >> @@ -885,12 +885,11 @@ endobj << /S /GoTo /D [594 0 R /FitH ] >> endobj 596 0 obj << -/Length 220 +/Length 222 /Filter /FlateDecode >> stream -xÚ=O1 †÷û [‰3þl’± © (êpj¯¨R{HGø÷äz¥B‚eHl?öë¼ TCt$M!:±ÃúP¼–Ú}ÅgÆ\ÑMµTkMŠÑ4B-1¢ûL~b¿p6à 1Aíä˜Êð_äêúÎ8 °ä-°% B -.o^&‹‡§›i-N“4^óÍa×íÞ}s|ëÇÔs»mû¶[·c¸lºf?]åÇ"¡ÀŒÉ]N0P(«GÃY?I,›Ï±QÂÕùA‡þê6_>òíœ:ÞüÛ·/kP»endstream +xÚOOÃ0 Åïý>n1ql¯Î‘‰? PnˆCé24‰uR)ߟt- ±ãŸÞK /E`Šž£@ Õ“B»¯<¼•ÝME3#ʨÂ\†?¶Ž#£ ¸`†ª«ðû…“ÖlœzÅXÄG|ªók @5R´’ˆuð '.mžëۇ˥ êq:.6û]·ûúf8ôÓÕSÞæ>wmžÆû¦ûlÞ—/é®X0aT
G *6 À™àÊ‚ - Ûáðšg gsã½ÕU:}æ;=V óùwv_þÜRXendstream endobj 594 0 obj << /Type /Page @@ -1241,12 +1240,16 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 679 0 obj << -/Length 561 +/Length 606 /Filter /FlateDecode >> stream -xÚ¥T]o›0}çWø¤áúƒý˜¦´K¥¤)MSׇ4¸ÆÇÚþûl¢tOŠÌ=çúúÜÃu0@êÁ€ùÐD€@x!ÌÀî`!°WÜ…MŽ;&¹Ó¬ëĺºõ PøÄÉ뤇ˆs ’ôÉ&AGU@v¼Y¯ "‡vÞ8.aÈ~X‡ÑÌ <;Y¬î4“p;. ¶ç_gë$Œ4EL¡ëÅÊìÂøaÍÃ1zÜ,¢p®’ØyNî09ö0í#Ú7ðÛzzF UíÞ[RÁxS‚X–Ç(d ¥#’[±õx,8a‡Ÿú†$TytiœG -.â¹ÚáñÑ@/°…vå¡ÊrÙèh[¤ú¥v¸ÝN- Ãê%ßÖæö^j¶è/²ÖTùª×M‘½»yöˤ”ÙŠmÙg'žùæ0fgEZ¾M«D¯W}›}cCÁ˜qJ™¤fƒ*þ¶ìEøD•ìWjw•Û–nºm¥Æó¬i53ÈTH3qWÁZWó¥˜ÝH©áö§)…³›e¨Á ‘ÜàYq–¨^ÊÊ )ÿÈ\ci6¸&wmYhVËÐûÎzÓ÷ç4ìB/MÙ
5vRÇ©j¨Î^º6+ ø¯±§ ö³úɪŸqò¿¯Äé 圜¦}:•„#(zÕwÉ/„WçRù_` éendstream +xÚ¥T[o›0~çWðh¤âù‚Á~ì…v©”6¢mêú§C#8ãÒ®ÿ~›„-éÓ„Ïýœï3ì"ý`—…0D¸‘ C˜¹ëƒÜí»q°ñÇ u‘9Ÿ®Câ +(BºÙfR‹CÄ9v³üÈ §+ .‹ûÄ£Èâ+Ï' ûEœœ{Q +‚Xân€QÈJGKé¤ÎþàÄ;¤žä
#H¨æ蘸€¸8€4ÐÎ)sL@Â#22çù!ÍI·Û©º•¹em'ëU[T/–±÷¦•Û¦G¬ëÒÉ… ×' †‘ CÁYz©34ÿ–@- s¬ÕvW”²1ÚªêÑÔ ]eª²^s”«Úà ¼H£VÝöYÖ6rcÎeUüöËâ§
Q“±uñÆŒ}¦µ +U
+8h&ß«Êh¤4æö‡’øüj ù;B¤´ö¢ú'°U;#”òU–FÌ‹A¹nUýnLãû<ûáèæÂN¤º!k-Ç"M[Ï]«/ ~´ƒ”Á~qNlŒ~íåþ÷~ ~ZA)çä°zÓ! AÑýP=ûühðq'ÿ®yD +endstream endobj 678 0 obj << /Type /Page @@ -2231,24 +2234,27 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 839 0 obj << -/Length 3530 +/Length 3946 /Filter /FlateDecode >> stream -xÚÍ[[sÛ6~÷¯Ð>UîD0î—vö!mnºmÚMÝÙ‡¶“Òíp"QIÅqw÷¿ïÁU$ÑîÚÙÉ$„@ð -`Áå]`…çL».Ú·–ØlA¨’‘Z!¨£ó ø·³OàANÜò²J (toËÚwAË7êÝæ²lüëí•ï»¬ºÖ·ª:}†—ݦhßqk®ç§Ï›¢ZWõµ[ ®äw Lô|ke©ˆ£fŸEF¤\!à ?*Qª12†_™@Šóh‰&Š‹>ÉC‰R
RÒâ°)‰*$±ŒÝw~ÇÛMÕuå -Ø&›¿Ø6¾»üXlnÖå³@ˆŽŒ‡p€O‰Pu¦sóI$Ž&VF[q9¡\"bñ -ïpV:KŒÚOŠ°ý“™F¦My[uo-Ž'ÉЖp‘D S!¦iGÒVy3ì1ì?-QÄ>£9q -©LEa‹È#2£j¨ºGDAãÃysr1ýI#{ð4{„á²Çžô—çf -^¨¨ hl/Ü€AYQöÜÍã ˜?b& -s-—åMW\®í©œ(Ö»Ò¿ÚT×o;ß{µk -iÓ´e‚&Jè¨t™ìÀÉ"ÚFZ·E;Œ
®¼µ,£ñ¸òæÀžÚ²ùP6£ÏÛ®hº:Œ@V4 Ž4åG#<fkRIÖEĶ76Á,Öë;ÿÛ91xº:¯/òÚÞðÖ…uà -—ÅÚûB;rÔmóY(á"’ý=³*Èíâr\ßÚ6r„!ŠEÜÁ» 5Èúq1—H3Íçïªõöòüå³ Q Dyúæ»#DeTü,lóà…m ´ [pböÅÄ1ˆS¡#õ¯Ÿ`…×^áu•Ê AL1Ó~ùŒ±é¤ôM§:ðÈÝ@ꚟ¦ßÌŸ -4`Í6'Y÷j!ã`þÂÃût -ÿ°5°Ü^ˆMŸiºØðÜðH#ˆ0D»ã|îÉâ!QÇÀ|´Iz7Á&‹)FŒá™b Ãன–¾`Ã9#¼k×ŇÒw¹ÀÚõu»KßreÄ èëÊS•¥÷7Ùî½ß(¬FWãþ·¯Òq4ìH+pü PÐxÞ¿RwpµŽ*m uÔ^©²’Pû‚ §ÉÚ{·§"y“n'PgŒñüùjª âwE ¾lQçð†¶U»Rº'•ˆýx™ÉÇ|‘¸ÿUá'}³±ó½ñ‡Œ¶DóWÿ8|ý¦\—H{üûϧ¸8ÐüãŸ~î¿EÅk_ƒÏÉ=Ÿ§ -Ï¿„§;NºySD&Ú1gë²¾¶gyöÇ¿/Õž‡º1ÐxSâxÏåú?Èïuþëw|ÿüÃÝX;”Û~¿\þ/æÅGƒø¾*íåÁºÚŸå{Ë„ÆOmq3þ‘`6y›oým‚MÐ(h®FA“ö@úošjS4•KÅàg¸b`¯4„ «²+›MU—áãå2‘·‡]þvÜÚwøk Ðø -Ž*czî*y>cªrowM¥ €ûš^U_vì3aÀ -ùô½íþ(„÷#OH¢˜ìÑò…¢Æ“* G4ž4:œtèÑ øTð•ƒI#gì^Ç™›…G™—?|àÃãè‘ÑسL‚4SLîaRoÔ“â¨{™45éžIãIóLêO:fR¨…YÀú¸çR¬iÿvöIHæ¶3öIFÙS/ÁÔ=Œêš`T u/£¦&Ý3j<ižQýIC…ËyÇ°¯FYïÊ£|îAtÜ QB†wxÆÙ…ôJUÙ8Çø
aÖŠM³»7è8·ã û˜=5câõxÆ,«û3î+þÊ]Ë¢¶ ˜òf aí±q$‘ýM ¼L(åàqSýb…œLlm€š‡ÊD -Äè=P± s\"aÌ}™˜.Éc4]V ½éŠx7¸Mwc Æý²^®·é^cD˦X BS8-ýÏ/™õã}?úÿØì9!Óšæy‘r°(wóY ¬œ`ˆ -$Í,ý¿LËUæendstream +xÚÍ[[s#·•~ׯ`ž–r…Ü/IíÃÄÑ8“Øã¬-×>$©I‹lI]ËÌnŽFÞÝÿ¾çàÆî&HÉ+¦jkÊn> +«o¯¾»úpý#üE…›~ý§·½¾ú!¼Ó‘È Þøcèqáq„êWï®~¸úðõÕå?®ÿ|qu7Óß0£wòóÅßþA' Ø÷Ÿ/(ΪÉ#üA sŽOVR ¢¤©gyñãÅd‚½·þÓ¥dDs%&3« 7Z Ÿ6LAaÚØTŽ£ìhÖ™¶D3Š2¡–p¾‰2=‘Iœ5D´àÂK¤yóÄ¢„sûa/` +ÂÖ–Y2Kg}Š‡«s”(>^Þö¾m¾àß¼“¢7šqh“ืëË™túþ¯ðänº®»ÇÍöSèl êyówJy½o«6¼¨Öò` LXb¥T‘ò!ƒ„aÄâ>ÏÆ¡Lñ E[ð¨Z,¶qA êtØÆoaÇ` ·›årsɦžÀ‚›§ÈŠÀ™vYµ÷Hl2cTÉi
-FœRÜÓù;UôŸoþ
ìr&‘—k $Bw_¯C´Bc½[ÝÔÛðzsúnš®
f?ŒÃënUµŸÀ¸´ÓëKG§ÛªY6ë;¿":\É/@™Ùéei˜§†Ïª RiˆN •(·”8'¯BÙ{µD3ÅYŸä¡D¹)Yô@iØ)‰¢©N]UOaÇ›UÓuõئ˜¾ÛlCwý¥Z=,ëßFB|d<L‚ ”7oli>M”¡ÉÄšÈh—W.5±Tð$–àâ“å Î*@g™3ûI Å…‰a¤ÖÅ‘Mw~<+H¶æàY’0Wê4íD•·À GÀþóB '‚Ð7¼Ä"ÉÁ ë±(®s–x$AfÜ U÷ƒ8¨ +L0w‡„þ=¦‚Ã\óyýÐU7K\#×ÓÏÕrW‡W«æî¾ ½·»-¸òmè¾x”, +àÆ,¡Ìö @ÛéÏ»MðDÐn»÷)B›$vì~l–Ëк©Ã3Ärlù2>Ãyƒ³£R;3mw‰Œ;tò#›øDûàyWo߬žHW· Ù#°ñn4xE'ͳ +à³ÒçÛ¤÷Ìö¹³DI RÐaj +‹H%ÄB~·áá¿ñl +5ŽpËÜQ‰Je‰àÒb Ò£Ò¾Z¦™â¬OòPª= 3û‰O 5¦é n’<I W£jaÉŒ9`JAø@áõzœ(Îú$ šŒu@ïjÒ0oÈ›ÇÒžA3d.(å:Ñ %ΨT+íU0°0.äùöš)>³W~H1·{½@õ¬€!¾I%R”Œ ¦×XÁË
&‹#RLÆÊA8 úÛP®]• Јu‚‘X°Â +½þœí«xÎæ?¸¯¶Õ¼Kßû4Õ¹ bžLB%Vì H©›Å© … Cœ +1 †ÛØÛæ—úX¾”ž-_êS<‘/
W`ý%ù’?È +u'#}¾_Åy UÕEÁc8F´ËÙÓnÊA‡s‚×6Îö"RÎuûLž’#tˆç(õmµ[–ô\••ùŽÙ ›*#‡¦÷¶€5*Ÿ¿îwðŒ%. +åÙ<öÕ&ž(Îú$K&î+eÃE0Z4sM¨æIY¿Ç›EZ‰ò–‘µr'máõçL¯ ¡åò…ÒXú htÍíSÉ£°ÙCÕ"T( ¶Õ/^׶¾ÝÖí}œƒ ++7ÆeÏ(ÃåîXž=º¸qþ?ckMÿÓçFJËxÕ +ø¸ÐÈþ`ˆåŽói¸'ô†Ì sÍ¡]Ö»lBŸâÔØ9sjî¶Í<\í¡ñF&¼k—Õç:tyPíûºÝMhù ' _Ï©œëÏþ7?Ïþˆ¾1ÔŒ~Dôû*×joXaJ"ìð×[?BâÆb‘Žãh‰WþöîUòlí½ßqAâH„fûßq1PgJéôíbªÃáwU—.T}Û`Açð.:ÅŠ '÷¤2± Ÿ +ùR.U÷¿ªÂ¤ W8ßÇp¿Ë3ÿ ‡¯?ÖËz)Oxÿ{ ç“_ üñO ¾%„¤ È >gÏ|žÈ8<ŸþâÝÃÇ*1ǼYÖë;¼õˆü÷ñ¥âÍQ? ›E 80_~ Wž{ÿuŒ;¡ÿÂß9 Êm¿_,`rÝÓ£øþXãuŒu³¿õ ,?µUñrÅH°¨MÁæÛpïz5 +šK¯QÐä='ýÛfUmŸ†ÁŸñ26^þŽw·uWoWͺŽ Ïç™<^ ç9ËÐ.pCã3Üìâ|¹x/6õ¶Â ‚{Üèð>•²òÞ"y„™ØÚ]²i\"õ3“ë™#ž[ –žÝ=î¿^ÏŠ A"XÏxþèïZ”Éa«Ýl»#—˜„$\ØD¬íªÎkpد + +Úé/pVë”'ÕŠy·¿Ð߇ߡž×¬ï~wìŸàË¥¬ôûL:Ió¿ú× ûßÊJ.¹WÅ ¥9ѧUù é؃µ3ÈJ„æ¥Åÿ/À@Þendstream endobj 838 0 obj << /Type /Page @@ -2261,50 +2267,44 @@ endobj /D [838 0 R /XYZ 56.6929 794.5015 null] >> endobj 250 0 obj << -/D [838 0 R /XYZ 56.6929 363.2968 null] +/D [838 0 R /XYZ 56.6929 268.7207 null] >> endobj 836 0 obj << -/D [838 0 R /XYZ 56.6929 335.217 null] +/D [838 0 R /XYZ 56.6929 240.9336 null] >> endobj 254 0 obj << -/D [838 0 R /XYZ 56.6929 335.217 null] +/D [838 0 R /XYZ 56.6929 240.9336 null] >> endobj 841 0 obj << -/D [838 0 R /XYZ 56.6929 306.9099 null] +/D [838 0 R /XYZ 56.6929 212.9194 null] >> endobj 258 0 obj << -/D [838 0 R /XYZ 56.6929 226.5017 null] +/D [838 0 R /XYZ 56.6929 133.1778 null] >> endobj 842 0 obj << -/D [838 0 R /XYZ 56.6929 197.9796 null] +/D [838 0 R /XYZ 56.6929 104.9484 null] >> endobj 837 0 obj << -/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F14 612 0 R >> +/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R >> /ProcSet [ /PDF /Text ] >> endobj 845 0 obj << -/Length 2754 +/Length 2841 /Filter /FlateDecode >> stream -xÚ]sÛ6òÝ¿Â{( G4Ið³}j\»u§u{‰2w3Mg&!‰cŠTI*ŽþýíHJ¦“δ£»‹Å.°ŸîÁÏ?O#×SYxžd¡y~tžoϼó5à~8ó…fa‰Sª7˳«Û88ÏÜ,âóåjÂ+u½4õÏ—ÅïÎõßý¶¼y{±"ω݋E{Λ»ûï’ñçú×ûÛ» Þ¿ýî" åݯ÷ ~{s{óöæþú¦ÀÖûÂá…·w?ßðèæç›_nî—ï.þXþtv³ ”™*ì{ -5ùóì÷?¼óôþéÌsU–FçO0ñ\?Ë‚óíY)7 -•²êìÝÙ¿†,-;ÀH¥n”ÉÌ †jî£ÌU èo*³5uß^J9¹®yð`ð8µYëÞ |*û
4*£‹²^óÄ|Ê+½Õ}ÙÔ¼v«ÛGF}ð"ï_}
ÿ5BbG×Â³ß ÀÊ\¸We×ó¨Ö[Ó1·Aêú€ ⑤njà ¸ 8Ž…ï»Y¤"ª&×Õ¦ézY²¹Êü‘ 6}‡ëöÂO Ó O -óÁó‚Ú`" HöK3yNY¯šÖꎫ췇…‘è‚C:f <nÕìLå°ÒÌéT˜.oËœ2˜b³â/ $ t^ñ ëáêðrÝQê&Y£%ÓÃiEiÙÅÂ.²ìbçÑ x -2g]~´»ßt$)"ð`!ž…~õ‰1(*bòf»',ƒ§LÌìvGL!ê#Õ[QaƪX–"Eßꦥƒ p=‡w 7caûÎÎ&‹I ›Úr³o6 cñ0 -°4?ÃoF>è -“ã[ Îû ¥ƒ¾Pˆù*ú ßÈ
å ÉÉÜà€Oº¥Šé9cß dLÂ3ølHV5sK@ª”½¥‡J盦š7LÜ8ŽÒQ`›F'ò4>Ž£ˆ±ApèÅTŽQÍOœw嶬t[ .|ß·bÚbœU¹q¨’ã3
1G¶|Rû‰“RŒEKû
`Йö#…ˆ˜S -gœ 8$ë‚v…5²+ØiåU‰¹*–É&¦ Ç”á[cR”$v 8·¥þ¤·»ÊÌ_¬í‰÷!ïۨ滫®‚ð[ ™ó„Ú e(8é·3> }˜J2ê¸D Ô°gÁxèˆâºˆÎ$í
8 %URau+¦…˜ë`"<ewC -›’¦>°÷f‰dþñÕVMó¸ß¡%(ª `NdE0y¦o/ÓWÙ0ØTxö܈Àe¦Îûn Ga͇„„6~ÅÔãQ’¼Ÿ l’¸© Û˜Ou%Ù:Š(NJÕÙ<Àù2êáÀˆþÈUŽ?¹ jÐV¡— ÌtŽ¶Ž&&Ó@éhÒ lmm ÞŒµoöŠ'Ø?Hѳˆ'Uº;œÛ Ë -V¥ K†ÁÅÂ÷<Ϲn¶c=õû°O3' ‚Ø
ЪÇÞê!yJ.&“^j`“ŽÙqû#eÂW¶õênÚ)ANÛíŒ -0½§±Â!*¾©}ºìM·Ó¹´m[}8e>‹GRÓbäN¬ø0‚¢ía½oíÄ)YHe°ƒ(¿¼È§amPñJN;‰µ›u«A§¶c '–T® -hê@áû.Ù–"Žd§Ä¹~-ßËKb8Íl;ÒAÛX]íL;4üTç¹c¡}@ùåÅh ®/25Š(yÙ(®H„ÈÍ’K&7 UHˆW„°Ç?A,é ö¸±Ã¯æß Ž{"¬¥®ù{ÍŒ1^z‘?³§3_‰Çz …ÇÉ÷êŠùþm¹./çrû¿þîˆldüþþî¿<¢»¶ü°ÕÀ]ý_¼n¾—†n NCGö¾Ókóåèp=z5•?ú¯$–GnM!LÛ¦nêÖ/18é!Ç'Ý玌"âÈ3—r½ ¯¾g {£®×mÏ~ÙTö=Aý“´XùF·:ïÉçqõŠáø¨ÙUº³í²ÃN¦âvŸEy0ÝãÕCˆ¬’Ç-b‚ ‘ µléP/Î? aà%“÷J/9®`^˜ -*vîDa*Rxô‚ÐÙ5ƒŠ¯¥|€Œ=°ç×J£~¥Ïö88ʦRÀ¤©íÞš?øHÀ/£ ‡LÆÍD´ -ŠòãÇ -¿ÛvZ.{»¯úrW
•v.Ÿ»ùàèæ¡7C¸|ÌøÒÝqq¨<%Å!@‡âfö±À«Ó<}s·|¦ôžhùÛŠ_ù#¥ Üc”oîLä!=‡ßߧe†t <yuõÍ|? -‚ÿ@§í)*± áïuìD!wN£ç åm’bÚ3ŽÃnG<~âf*8é4g´‹^Ò.z)IÕ6 çMÛR÷E`ÈØÛÝ0á/Z
™ÁKª+/tÓ(Ng„™f¯éÝ,”﹩ -Ã/>á·jê5“Ó,B½ï3iO¹4 =—ž¤(Á×Ó - ²SɇZŸ‹þXBendstream +xÚ]sÛ6òÝ¿B™{ˆœXAðóúÔ¸NÏÖÍ%ÊÜÍ4)EAÇ©’” ÿûÛÅ.@R¢äÜ´ã‹Åb±ß YL\ø“8p\™ø“(ñÀÁ$Û^¸“{XûñB0ÎÌ ÍúXïó÷¡7Iœ$ôÂÉbÝ£;n ‹ÉbõÛôú_ßXÜ|¼œy;
ËYºÓw·w?$¡Ïõ¯wïoüüñûËÈŸ.n½#ðÇ›÷7 oî®o` +¤a¿` +'6¼¿ýù†F7?ßürs·øtùû⧋›…½Lÿ•x“?/~ûݬàÞ?]¸ŽLâ`ò×IâM¶~ À—Ò@Š‹Oÿ¶{«zë˜ +Æ~8<6-IÚ· è›®Võ¥ˆ§ªiðÅ
ÜÛ>ÍªÚ ?†°"N*ÇŽáKbêa“ÁzYLçNí‰éðØq1õ=ÓŽ„ôÅu½¯œrÆúcþšeÕ¦m^•gEåyNè¿ (‹sFL„ó²NŸ×ÑðÀqu¦tÝõÌbúáŠÍ‰h¥EUªM—Œ×nò ôÉãûÙBâH•\$Ž ÷fœä¬¶ªlOJ®&|™¼ ç ÖI¬—e}îÔž´ —wÿX” ™XºåQµf™—'\y›¶Ù††EÞ´£šyÊÛÍ9Ýx Ä¿ÈXîiVŒé&p<áÅߪ› ‡ø¼núX§uc±^ÔÍÙS;Ý ;ª›Á±ì
¥jZ#ÖoÓ…*³¢jÌ M–uš©ï1™ô7 ÁØñ“2ôM¡Å‹”¥œfZÿ0X¢]Hø¸O‰ +äLtÎAÛtU á>ýåsG9¼#-{A%$–™M~0Ö…¤Š¢zjÈê£ÌÙLÃîïœá+U朔¬‹¨a—DÓÛ5Ú£N‘6×@"$ë…Ô\Ѳ&ŒÌ²ãÆâI:mÅ4¦BѼ«ÒBé¸AbŠ4¼ë z‘|=VI!TÛQÄÈW#äBÇu£p@íϽªG‰Žô=ñÿ'.›59ë½jÞ8ÏЃÞ\Àe½è@
šò~§SÂ]hö… ÎÐ
ß“bÀ'Q›>¥µ®šFj_(~…ù–28¯ÍjDM€*¥QÓ²H³‡MUŒ±ëGNqÇ
ƒ)%ó8<¨/aÅD!XCÇ`(¦s k"š~Ê·y‘ÖÅó¥Â°i +ðV õ¬Œ†1¦ 5B(L bß y +±0"®BÁá +·£à ÀŽš§£ûÉ*%öM:‚QE±>–˜Ðy}©Ö¶xƹݸ¤˜œ®ô©°‡OÕvX}l®’†í]6‰Ê»±ÎŠð-1+r;ö¦ï+ƒý5Ýî +5Z}ÑmžœDãSÂñ 9÷üï0 +'ÓWk½˜ à¤ßø$´|2J<ÞO5Š'íœyÐq‰ +#-Gà´Uà| ,©à+\6-\±T‰Ð”Ü
1LNBœò™¼7‰ /¾[Uû Z‚Ô% ü ¯Öž)Œ2…´2!0Ö»7# Ìxú¹éBà ¬ È(žoBà+ÂîD©mÜÒ>l9±MlÖ…¥¶ud‘Àç²³ZG´¤ß”`a“>R™#zº –øŽç»ÉÐ6–Ð=>Œ=Lu%‹mÔ–¦¸NM
^uÅ ö†&ØCpÕ³¶È½2ݱr³¼¬Ñjeè$ « ˽˙p]wz]m»‚êöb_G$çbäv¢0鵇Pñk=42 ·S–L¢F —E_›î‡±›~³)m·S)c€å=uŽÆ"EEèÒy«š]šqç¶MŸ øGáH؇”02ìÃ(çT×»ß×F)a¬
¤P؇A_\&Þ´¢}@A;)ëDÆlîëîT7¤¼³VðCÙŽ!+ÒÉæ™–© …eÝ„Â÷ <²U Ì™ NNÑôúŠ¿oßjRÞ´mGh‹ùNÕ¶çÆë ûšG +°‹Ÿ·4$ˆTtÇÛjq¼âÂ"Àz/–n4¬`¾RÔëԈ”¹põBcöØ+^qñ endobj 844 0 obj << /Type /Page @@ -2317,41 +2317,44 @@ endobj /D [844 0 R /XYZ 85.0394 794.5015 null] >> endobj 262 0 obj << -/D [844 0 R /XYZ 85.0394 497.0473 null] +/D [844 0 R /XYZ 85.0394 406.479 null] >> endobj 847 0 obj << -/D [844 0 R /XYZ 85.0394 468.4726 null] +/D [844 0 R /XYZ 85.0394 378.3469 null] >> endobj 266 0 obj << -/D [844 0 R /XYZ 85.0394 408.9221 null] +/D [844 0 R /XYZ 85.0394 319.8046 null] >> endobj 848 0 obj << -/D [844 0 R /XYZ 85.0394 382.8699 null] +/D [844 0 R /XYZ 85.0394 294.1951 null] >> endobj 270 0 obj << -/D [844 0 R /XYZ 85.0394 310.3501 null] +/D [844 0 R /XYZ 85.0394 223.2862 null] >> endobj 849 0 obj << -/D [844 0 R /XYZ 85.0394 283.0525 null] +/D [844 0 R /XYZ 85.0394 196.4313 null] >> endobj 843 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> +/Font << /F62 638 0 R /F14 612 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 853 0 obj << -/Length 2299 +/Length 2429 /Filter /FlateDecode >> stream -xÚÍZmoã6þž_! j£k.ß%ö>¥Ù$—¢›ö‡C[àY±…Ê’+ÉI³¿þ†o2 +qÒøŠ`_†CòÎÌC:$ÂðDB"©¨ŠbÅ‘ÀDDÙòGsè;?"Nfâ…&¡ÔwÓ£g’F -)Ie4½
t%' ‰¦³_FQ4
xtòãåÙÅùÏWÇ㘦?^Ž'TàÑÙŧ¶t~uüùóñÕxBAF'ÿ<þizze»¤ÓñÝÅå'Û¢ìç ¥W§g§W§—'§ãß¦ß Nû½„û%˜éüqôËo8šÁ¶¿?ˆ©DD÷PÁˆ(E£å Θo)®þÕ+ zÍÐAüF”V» -fÁ1 LÁ‚Óf°Šþ -Ëf÷TLÃÇ‹%>Õ°Ç(ئW< 5›m&<8è,A -æ1ÌlÄúϘp°> Žå(K«ªîlyÝæ¶`Ž„.´ù²Èê²®lUGˆÿþãkxŒMø8½&Ù±µ ->£K#§<uóÙcådÖÙÂõ¶öû0¦fmø^OT¯K$Lp˜`Z¯®~1ªÁÕLíWŒ)dhÒÉ=&Ö1uO°#=º¨fà2]ÞÚÞ΋™x¥´—è7
?{¾¶Ûî -¯¶Ûå“!G ô".¢‰J¢ðœ¾íèk'JÂÙßÐ…·9fèM1’1°ŒÞ›hD8b\Ò\è]a¡”gg1„’“ 4˜áfEé2Ày“.—ióD®M`bż÷Qp3GÔ ¤ì'ÛÑ/™nl‹ÖdQ1i¾ÆL>»BÝf5£Ã'• ãñèú‘\îå\ÖCF ‘“¡Ü'uá“©ØÊõÐlÙ€¸ ¯O5DtSÊË<îiç´¤•S°ZåicËz¥õÚHèóœ•u[TsÛw¤!7{Åjô9œþ -y³,*æˆÂ†ì¸© ·ò¾MâSÏ'n벬ïíNÞ6øãÙÛõjU70å·ý3‰Æqį1‘/1¾DÀÖ[¾ô×F©‘2èUj´#Øcgv[‚h¥ åqúr2`à #‹ˆ ëÊiVx'ÐE rÙÔ8˵V&’Jeâ%$ˆ*]jƒê–‹ŸlS:›Y´Nt™vÙÂLw—à´ph˜R`ÊÆ)Ë2+SœB3¾.‡œ,í‰&ø£‚×ÚÝ C’§ l àñ6„µ-‘ñÆm^®Òïá)£ñ.wjÍ Íc%dïM]¶/0\V:¯h=ÁÞ@lÀòÒu{r“÷ð:Ìo 6äÞN.“ -¸àÊ´rß¾ŠAÆÂÚ’÷ Z¼"SÑ<ÑJXšM&¶öJnª¶¿íÖ7Neå4µez7ø*÷Å<!h»÷“T¦Ï“È–÷ëïDBîaþ”ý«ƒ
ÏõJçªy¼§Œ2•Œæe}c^uÈ÷Úw/ë à§16^+ ÏÍ
úgùmº. _Kíñºõ/¾ãßÜúž1Y€Æ»åýs„ÃWÌA‹é×ƤËKë½ù4÷7â,o6×úlè©fc ]Ù~ +xÚÍZ[oÜ6~÷¯‡ÙD4o¢Èö)ul¯‹MÚµ½X,Ú+kdP4•4v_¿‡7‰ãQfœÆÝ
D¼ ’çú ŽI„á ‰„¢*JG &I”¯ŽptsçGÄÑÄž(©¾»>:>4RH *¢ëÛ€—DXJ]/~š DÑ 8àÙÉ Î.ÎÿyùvžòÙõÅ æ1Mðììâ臨u~ùöýû·—ó˜È„ÌNþööÇëÓK;% ï.>¼³#Ê~>ÁôòôìôòôÃÉéü—ëïN¯‡»„÷%˜é‹üvôÓ/8ZÀµ¿?ˆ)™DÐÁˆ(E£ÕOJ8c~¤:º:úÇÀ0˜5K'åG0¢ dµ+À$
˜r$(Œ¤‰B‚Qfx½,»y,0žùoÝØoÕÔwEëæjûÍêGÛțժ¨{¤QÌà +I)
åÉë×q×?V+¿eg{]Ÿµ½m>”ýÒ¶ú¥£í ·h™µYÞ[v|l¿?ãwUÖ-ß8vº
ƒÄv³zá7û²Þx¶Í“} +O×Ü>™Y/ »Øˆ +ïáe×aàåš~Å6«(q¶MÈæÁìéßF‚"–q™›ÔÚÁ¿I'šÖ$)Xõ· :»4ÿÎdv1´éìü©¨`œ‚‘qÎÜ\/ú
„ ¢°m.? +Å _¬hô®+FÁ-=ã8äl®)y`ç€ +ö ŽÝý{N8( âÇc.Õm“wtÃX„ntŪÌ@9¶«Ä¾ý‹ <Å&úÌ ¯‰@vmã–‚ËèÖÌ1ÏÜ~>qšNƒf¶³ßÇ95g›ð—½Q³©t†O¸‰ +,aš¯î~œ“ÄåjèýŒ1…x C<¤Äú¥ž n¤W—õ<¦/:;Û{2®4v=à¶Ø§yßmìµûÒ3‚ëöÅ$˜™t".¢RÉ(0Ó/3|íb‰`ù# þ2·Üö%L舙9GŒ V ,U°‰ ¾ê€˜ˆ!œ 2sò25GéqÑy›VYû‰L+‘HóÎGÁË\-e?ùÁô`Wv&‡‰I:ð5Zò¹ú6§ >¥ÄŒ§³«'t…§sX/u ½=…+ãI4èSzâSi²•éaØbÛq^5ÄsÓ*ª" î—Yï¸dµc°^YkÛú¤ÍÆPhsΫ¦+ë;;w¡0wÅjöÞ,z8΄ ë´Ÿù\œÙÏMÕä¿nçõnsŒ\*X– ðŽ—Ôªó@¡hWe
Ë L¡ŽÛ*ôDÖ¿öhⶩªæÁÞ4ÁÛ +º{·Y¯›¶üæ©{BVÀ8¨b(%Ðx†/1¾D@×[¾ôÇV‰‘2˜ßW%ïÄ¿â‰3»+Ñx؇¾ d †˜d$¢2÷¦Ör³¼šðN‚%Ô£©ËŒ‹Bû`m©P&\B~¨³•©È`äâG;”-V#]e}¾4 +ÓÓ8-
S +TÙ:fyn©uÆ+´¥]5ådÙ +ò(”Ç—IXë2!" Oô|–~ŧ”–¤HrËqÒ ÍsFäà®mSuÏÐ\^9·è<¾ el–€ŠÊM{lS òuB¿y ±½Ý6<&QX—# Kµõ"Ÿ8 Ô,J0¸M_Veÿ8'„Ìöè0Ï— üÏÔ!OT4Èâ©ö‚öfQ T £ë¶Â¥E@{D6œæ¥öò‘ŠÂ– +$ñR1êÅÕEô›³P‡ ‚¼ÙˆêÕ;-‚ÏSKOì- “˜|ÐÞ›ˆƒÀ× î_-Ì’bÈýã:Ck¬ ÇdwP4Ì:;à±Â„ »ILïÕJâeÕÅ_P])G$9ˆT(ÅØf”ê¡-§“°B2)e7@BøW'‹vÙ2П9"ó.«¡€ŒGä½Ú† Uy·ìã‡Bì„;HSûÐ#‹ÌAôXBÃ@SÛHÝ;¨®w'ÎO!tr¨wð(–É @m/Yð¸Fö˜ŒÕùºM&Áˆry ‘èÕäUÖ™ >>¦‰Õ% à#ŒxF¦£A¢¥°†Lìl9nºv¾ë77Žeí8u•~ÛŸpêÍðï73à§Êö#ÈP,_ot¦,] ˆÎ„$%¶Ñ¹YëTõ,÷pQ‹LÉÙ]Õܘ]@ñC\†ñÝJ ü6†Â†k¥Ã¹)Ù`~QÜf›jº&½õ½Ü K¾=* ¤ñÕ‚~¢ŸX$; endobj 852 0 obj << /Type /Page @@ -2384,16 +2387,16 @@ endobj /D [852 0 R /XYZ 56.6929 794.5015 null] >> endobj 274 0 obj << -/D [852 0 R /XYZ 56.6929 486.3415 null] +/D [852 0 R /XYZ 56.6929 396.6777 null] >> endobj 855 0 obj << -/D [852 0 R /XYZ 56.6929 454.4975 null] +/D [852 0 R /XYZ 56.6929 364.8337 null] >> endobj 856 0 obj << -/D [852 0 R /XYZ 56.6929 395.7282 null] +/D [852 0 R /XYZ 56.6929 306.0644 null] >> endobj 857 0 obj << -/D [852 0 R /XYZ 56.6929 383.773 null] +/D [852 0 R /XYZ 56.6929 294.1092 null] >> endobj 851 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F84 802 0 R /F42 601 0 R >> @@ -2401,30 +2404,18 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 860 0 obj << -/Length 3170 +/Length 2842 /Filter /FlateDecode >> stream -xÚÅZKsãƾëWð*µÏƒÝ“,k ¹ÖëÍ®|²].ˆ„$dI@! ••Äÿ=ÝÓ3x %[J¥xÀ` ==ýüz@1ãð3gW™ž¥™f† 3[¬øìƾ=aN'%ÃY__ }õÖÊYÆ2+íìâj@Ë1],šŸþíäÃÅÙÇãD>·ì81–Ï¿>ÿ
õdô8ýáýÛóoüxrœêùÅùï©ûãÙÛ³gïOώጀõ2Pسàíù»3j}ûñäûïO> ÿrñÝÑÙEw–áyWx ýô Ÿ-áØß q¦2gf÷ð™È29[ i£˜ÑJÅžÕѧ£¿w£~é”üŒrÌ8™NPË™,3FŽ$h2f•T^‚xhàœÏóÅŠŽ÷©ÍÛb]Tm8í&_¯ó
žö«·& (…Ï©Y¦…öÄ<K”’*_ôöo\9“Še(”¤c W,—›¢i~]çíâæ×UÙ´~n²5™´ýûba|,àA§Œ[ãºÉGôMñ3ç²*Û²®¨'¯–Ôø±É¯‹°ÚÒ‹›¢ã¥Ÿ$2&„Ë`r”Æ.!a˜°*ÎiŒi3Ï›¦¼®šðBæa}Y¯Ê½‘T±ÕÖaZž Êcáæ Nì°s/SCÁ‚m+îæça«ë¢
û”±ÑÓ¾ò”êõˆ‘ÛM Vð@/wMAšRšI'ÝXõUëˆ'èˆ<Ayj^S‚ÏO‹nÊi]µ´}PÞ;œHÍŸ¹á'§ïx -æ÷½ˆ”e -ì 7~_·p¥@<7y‹-ë„=#fp 0ƒcÈÌ_B7‰{×wM qz–d9Å’ºïËöfÂdêXÆSqØ,NÃœËâª&îh£2l¼ˆÜ¿¤žbÕ÷7z}i6¯êà? -²Tl©¶¸Ïýü`í´ö*Ш@ Ao‘ÿ²ZÕ÷ÅrRÞè~ÒU³Êêš^QI¤.ïÊU›”ÕëíÈ)„fišÊ™±Š9¥õSb'3ašŽcçŸ[á½Äör@ë8Ð -͸bL*é•@c.Íä02,A -& Dyc Ó1åÕÄÕdŠ)aL°šïÑ‚;¥‚ÃÜÔà0l[Ć;¦µÕ³ÀŒzþpc-ŒÿOd¦àÔR‹Çd¦!E -NæXÕUñÇ„VÕO“Ù€™—’YÌqO'Wì—¡Üc2S‚/ŽU½ÈWxü? ¸TA|EŸNåüüÃM]”D©Ë†®>æÆ…>7À$2W訊ö¾Þ|¦—²j‹ÍU¾(ŽÅ<.¨ºÈ3ˆemŒ<ÍC)ô€ê2yžœ{Õàplîé$㊽ªÓÖÁLõ¨¹ó”Y dàUWa"²êD¦}d†òFO]ˆƒhˆFH©~dCOÒ)ŽuúÂî«8~Sb2Å ^5ØGª™ÒÞMŽÊŠÐ‹½Þ¦ÈÌÍ?Õ ‹À "ÒдeMUÝRã– Â0—rVäô¸Ï ¨ÑÂ`X·,`›uIQ¢gJ LJê@Ô§úߨgUT@亽ièÝ1ö£¨Œ Z#£÷°KÌÏ+kî<þ‘Ä%t,ò¦x5…!Àb, É ÀCªNº¹cV ¨+F¼Îq"ïÐ ¼[Ѽ¢¾xD˜íóîÃëvjÈ랈¢9€h‘Ñ~¯ ºÃó\¬÷Ú¾ˆú ‘IÆ4ÎX–ebXÍíTuŠ[8MUV)KA©Tu*˘–NwE -EÐñt½jþDig™JCÁÓSé+ºGV¾ÕÒ$ëÔ*oõvå_þCk¹ -§,nòª*Va [ìõ<CÅ#—ÔòŠïË—ÎA;›¼7
G -ãRŠ}^)–3c¹Ý -˜·P!Ú”b¼u!`BG¨¡«)6_ hJõ û•(¿&Œ6Åeýép¸¯‡`ˆŽ†-<ZÜlW
$×AÀ›j¹˜PšPi,(ïÚrU¶DÝßx¾«°ß¢¿¯–©6” -B“Ò}"¡•‹í¦,¾>WÉ7ï?
‡›»U,××h“a I‘Û@Š1 cáléjꤚºbŸŽÃ!½¿M”ÖÐtB
í¶SˆìÌ
_ܼl¨3§×‹ÓôÞÔ‹ÏèÌØFï/**naN º^ -Š îž-ÖŽb2$¹+Wi -/q¥¿ÜŠàc:€»¥{UXˆ’25ÐÈ -œëû"FÓü2`pŒµmˆ¿eÓÜ…ñ „û`˜¦ÞtFŒé¡«§Dw¤Ø Ð|ѥˇ>¸O”ZC»ÿXéËç‰ ‘¡ê¢¿`%0Y&BÉÕë èÉÀ™Z = JÂ;Ÿž<`7Rl}î= æLiU1FÆ,µ…ì±£Cö0mðåIÍoñÚ¯¥$¯—y0YIXÖ¨=b‚üÁ²„… -öf·0é°?Ëd¦^ŽÃHð0‡šƒ] -'F îs ÆÆ;¸Ñ×ôòº -ÿXÆ|>ÕFMä#H‡ƒpÀK~×ÞÔ›ò_ÝW6_@ËfM·Bt«|ŸæóUxéb-¼x¿ S'r
úaÖÿ gÑà÷R@Ó”Ið«ç§H0PœÐàA)AqÖ“Câ´´ûì/þò² -’ÈéAÇØŠµÂhÿDáåÕvœú&$$¸dRk7³|ïùêè%=Á‰ÚˆRP͆I{c‰Ç½±ºó÷ÚÍÏòÅÔßc”œÅ„NŽ.,¼ÔY#½Ãg…¸iD?zV!ñvÍvwXÙ}øÁ1-¾DŠŸÎ^è¨ ½ƒG•J0) ` uŸÕCi 9 ¶¡ÃÆàá( ¾¦gñEmA/ƒ;fx#x%t ¿á -Š)Á|>žX¢ )5õH>{ô¿(Oý÷eÿ×T
Bpnð÷ µu9ï?Õ¦PNJì|ÙŒÓÜeý¿@{Lþendstream +xÚÅZÝsã6Ï_á·snÖ<~‹Ü}JÓl/v»·›>µŽ"+‰nm)gÉ›fzýß HI¶•6;sãQ ‚ +2°ÄiQçë’Þ~Ç™3©˜G§ZôBáŒårS¶í¯ë¼+n~]UmÆ.öÓiùãÍÔÆ@1në7$ŸØÐ×%ª«®PYDAs†Æm~]NXlo§»’pÉ•põCF”o•ß7=¬®Í<oÛêºnã =Úûõe³ª +z#b«kâ°:>A•ÇÂÍAH°ó SêCÅBlPÜÍÏãR×eשRcà}85ë An7xÁ=½lÛ’,§V:évÍÚ\EµîÈ\›d‚&ÊÔ¾¡ŸŸE?ä´©;Z>ï; HÍŸ¹á'§ßµðÁËÑ."c^É,,ü®é` Jznò[6();Â`GûP˜¿E2©©ëmy\FÊ’<§\ù®ên&ü@fŽyž‰Ç Á‚Óê.Ë«†¤£…ª¸p‘¤' ,*~I”rÕ–w7%Íz´ÌÏë&ž ˆà>{f%îò0>z;ͽŠ< °D=çI”ð²Z5wårRßx «Gaä ¯h¤ V—ÛjÕ-ªúõ~æB³,ËäÌÎ2/ž“z ¾ƒ³l7õüµYI>Dœ% y xÅfRñ.«E¿§…†œï”ñC®Ú‰R0a I.™–ÒÄs?á4^1%LJBߣ÷6[ÅórÓÀyaû6Ü1!ü…yÙHc1c÷Nö%uæ G:ž=¡3í9ÓR.ê£nêòÏ)nž§³‘0_Jg)Å=Ÿešñ°Î¬„SÏõS:ƒðdà-ž"_áöÿ„â2át&ççï?k"Q%’¤!䦉!5À rW Ôew×l>ÑKUwåæ*„#æiBÝžQ(ëRàiï[È ˜n¤“—éy0 à
'ÿ”7¤›qöOº»ÑÌráÓ՘ǟm:áuˆ,ÐPÁ鉄0ˆº¨‡Œz6ô$›b_o/$_¥þ»› +s)¦A™fÊz79W(/Bv”"½›lĤ¥aˆˆuÓQã–Âgp—jgäô¸ ( tÆyË–YW%ÆÁ~p)©#Óé#ʪ¬ÉuwÓÒ{pb¤£¨ Z;N P—˜Ÿ×Ô×nü‘$%Š¼-_MAð `²/K 6õ¢ »‹Áúâa=ŽxýÁI²C3ʾ ØÊöÑþ PA¶OS° ¼Û©±¬DÍCÛŒ 9µ£ãð²#6œÚ¡ý á%ã’ûB:¨M)ÿ>£ÎUz28ûãÀ0ª~R¡« gFe²¯T¬ +„Óͪý •aZpâ8p +º„w¼ÎVGƒ«S«ºý5øUxù/ÍåP—c©´€â_+*ªþN]‘Û¨á>lGÂôÛfÓõ\é%ÐHMÒEÒamI ÄÊÅ0g!DîÈÿ©¼owÙ +z"bx´›{ô»7TŠ +#Ó%–Ú÷HèÁ= }{Røµ|]u”ááõ2þ* Ëõ€š y0ßC“x©p€á½eZ99³†)ùò´Õó[ 'ð»‡H#³´(ÊGß4ŽVƬçîKI×ó{T:À+2oÇâ¥/üûGK3ðS?¤Bv»¸©¢Ùé)SVó¶Zß®¢]Ïß?ô7eþ÷dâO'|öä«çþÅeøÿ†ü뜜þCJ¡…Â}*qpÿ© 3Nf¢ÿÀÎJendstream endobj 859 0 obj << /Type /Page @@ -2437,56 +2428,57 @@ endobj /D [859 0 R /XYZ 85.0394 794.5015 null] >> endobj 278 0 obj << -/D [859 0 R /XYZ 85.0394 769.5949 null] +/D [859 0 R /XYZ 85.0394 723.7047 null] >> endobj 862 0 obj << -/D [859 0 R /XYZ 85.0394 752.4085 null] +/D [859 0 R /XYZ 85.0394 699.3651 null] >> endobj 282 0 obj << -/D [859 0 R /XYZ 85.0394 683.64 null] +/D [859 0 R /XYZ 85.0394 630.5966 null] >> endobj 863 0 obj << -/D [859 0 R /XYZ 85.0394 653.5261 null] +/D [859 0 R /XYZ 85.0394 600.4827 null] >> endobj 864 0 obj << -/D [859 0 R /XYZ 85.0394 576.1881 null] +/D [859 0 R /XYZ 85.0394 523.1447 null] >> endobj 865 0 obj << -/D [859 0 R /XYZ 85.0394 564.2329 null] +/D [859 0 R /XYZ 85.0394 511.1895 null] >> endobj 286 0 obj << -/D [859 0 R /XYZ 85.0394 420.3273 null] +/D [859 0 R /XYZ 85.0394 370.7816 null] >> endobj 866 0 obj << -/D [859 0 R /XYZ 85.0394 391.7481 null] +/D [859 0 R /XYZ 85.0394 343.1637 null] >> endobj 290 0 obj << -/D [859 0 R /XYZ 85.0394 295.8129 null] +/D [859 0 R /XYZ 85.0394 249.4174 null] >> endobj 722 0 obj << -/D [859 0 R /XYZ 85.0394 264.2689 null] +/D [859 0 R /XYZ 85.0394 218.8347 null] >> endobj 858 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F57 628 0 R /F43 604 0 R >> +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 870 0 obj << -/Length 3251 +/Length 3442 /Filter /FlateDecode >> stream -xÚµ]ã¶ñ}… ½À™á§(%O—ËÞuÛæ’îm€IPh-ÙΖ\K>g[ô¿w†CÒ’¥ýhƒÂ¢†£áp8ß´˜qø‰™IX’Élf3Í f¶Ü]ñÙæ>\ ³H‹>Ö·÷W_½Oä,cY"“ÙýªG+e<MÅì¾øyž0É®Ÿ¿ûáãûÛ?ݽ½¶z~ûÃÇë…4|þþöÏ74úp÷öûïßÞ]/DjÄüÝ ÞþxsGS‰§ñííÇï’Ñã ¢w7ïoîn>¾»¹þõþW7÷q/ýý -®p#ÿ¸úùW>+`Û¼âLe©™à…3‘er¶»ÒF1£• -íÕ§«¿D‚½Y÷é”ü"ÎBi–ÂúˆE³‡õŒw“ò6K”TQÞZMÉ;`¡¼¾+wMW‚¬œÌwn¤æßå -©»¬ žMU\ -͇f6Õzã±Ë5}\ÒŒs¹*ë[ìCµºÇk)'LžÌÿææÑc‚ã…ÐÍ·•ÓN„;»¥q0&>t.”ôãò-¹´Á„mõÏ0µLiHï}péœqØ9fºˆñèxCŒMsÜD—G£©˜Ê Þ/æ´N«Ð"¦Ô -r+s«SÕm⪞ùæTÓ n°Z
83ðY»! »ÆÛ OÀ È ›‰RtoÚ8soñ8 e|"’ |ª×å€P=‰Avâ%µ
"ݸxŽ;éü`_ v‡¦ö -ÊX;ÀtÉ\^ -×ùʱO>ÄÅ8Ó Hx_•fj˜`œÑÀÚ€* 8îfW„rU‚ºn/}ÃÃP"ƒ™¬¶vþ Ó„–¿åPç¢×…
e—´š9¶\Å™h,ß ª/.ÍÀÌyż
¼äþÛÜëÔ„c¾È -À¦BöÊIt} JˆèåûœVOûž K·ÞÒ}™ð¿ûG !JÇžŽÿåöy[†·¤Ã‰íºCÛìôŽè›©
k,Ìë/Ñ“tÿý”ƒCr7ž¾°ñÿ—{“ Œ_ön ¦oÉŒUBAZXc®wæ²D÷h7yLÜ{,LéÝmîN.6ã€ÊG ݺý@#,mÚ² ]_ZHªl¢¹I_ºPø‹þ™#ºƒ UäHCx¼àFKË ‡ü»O||m °^àaLí|™Š ¹‘'ÀbâÜÛÂr– -iÆ¥3%à 6OÈTÅ$äž3ÁñVªåçeñýÆûÓ ^R»ÿC@¾2â'±å$zÀÏHªë%.FÔ‚TÃÍ€àPD©§n†-eè<k;€“èxÏÑf\ûZÍré:%\SÜçᆠüx×ì ²-¿¸³CüÕ -›ì§sÃŒŒ—Ù_ªò4ÝO6Þ‘Å]1¬ÍüOØ„w+¥oé);è› ÷ôjJ~|U¯°û³_ÐVÇÜYËÆKÏ4 I¼%ê$r<”ô¿3` -–¨uì©?W)ÃðßN|óÚ÷ ¯Îÿ’Òï«åÿø±)Ó)ñL¡Ôèß=ÔDâ¿@Ƭÿ——Õendstream +xÚµZÝsã¶÷_¡GzæÄà“ + ²: ’SÔ.ͤ^€ùr¹¿ä6)š†öv—7Å’š¿1&6m±/«uÔÕæñ55óê7Kôψ+à„yÚŸŠÇ±€‡µ3LÇÄ D$Rgм£8Ý÷YB¤™r|¸ýrvÑç©uZ†]›b[TmO}OÏv]Lì?s©Ž‡/Q¶(ב ¤„Y’‰¯'ƒŽâ32J¤’e°ÍÛÅú„IÃRm…ýŠLFŠÏ1i@å
7C&7eÓN U–Ú,ÓQà¤ÊtB媪é}™â—(&™°¨¸€ÔnýG·kü sÉn_nóý#½ä‡v]ïËæmYWÔµ-ë¼*›-¾ZÒènã÷‹z»Í«ex©U±¡—²9N=U úæœÒçFZ
‰‡¡ØS_~‘â¼Orâ0,HÊòì¸òS‡¡R ‡öñ +ö ^óa]‚vy‰-êªÍË*#§‡§å[ ÐSáÌ¥ÊR©
Ĥ5?'$Pë,x,3ýå + ÎûOEd@A™Žëžõ+.UL™ žbŽR6¹ÊÉøƂשÌ× .mê¸å_o¿ Åg6Ì ËÜ vÌÁßh8;ÚE‰†ä²3f +°£ ð‚¾©¨èpàÕ !<É‘àx]ïîòÅ'’&$DÀ¯ Ø 3V%\˜”Áã+Ø.B ì/Û0áúçÏ-êC‰Ã.ß·4ôí· œ”á<¹®hJ».Ãg È8 +ð›¢t-Ç0&°èy?ZÚø”°Féôyl@åî—å~‚~&`÷:jÜCÞñfW,J‚GÐH×±*Øïå¦EG
†¹Tr{éDRÓØ‚ô3§ðË¢â
ø†“ÁdÉðáa<-eÈMd' <µW”\í/mrˆb·}]ƒ5dãø å³Â¬“y>±Å^š¡ç¬äv'ÙÚÄaÙhf^¤8™SÑçÞƒÄ]Îhm¶u=.iÄ› à¬BÏ:6öyÕ”!PZG‰!ôƒj€}‚=¡p¼Ð²(Pç0Mºä‰Ï”`ö² Ë’S ïT¼\ JLjY®Ê6«” †Ô·Û:Yf|À1rÖÌ {;£Æ—-xü|?ìæ´ëCèòÜa—çäòüô)'¥Lš)ÅŸqy*eîèǽËC` 1àº%âÛü±…ûþÚ@¬§=ò×uÓ”w< À¶4É¡ yEÏ∓%a8 +ô[z aN„A0+8/?¡ tâ—Æ×
¡ãP¡DWÅOW:"ÀrÞûÂÔx¢caxÐÓ 2a¢Â?ÔûOa«Ñó +™,NÄ*¬8ûLœ”@ºCø±À†'¹¿Ã©hÚª3IUP…Îvë 5ò3™· +Š.w€aÛ‘^è<fkRŒX3ý«±@ºZÖ +çŒÈ¾óÀtQ…ºëðÖ¥°ÜÍø¬ µ| ;MÏL°cÁkå Ðçk ñþ +Fò嶬 åî RµÄLx1…ÝÐ äàé!\2Ç>ù»‘zO"Àû*ëä`<ìK¢¹e<pÜõ¶ ªÔë«½Ø + š€Œ¿Â5&y‡ð {‹?rÈsÑë‚ÂÆ´KJÍ Ë +>„âHg,Ø¿Û—Ÿ=ÌÀļ<i"/yø6þÃaÂ1PAø»NøSÏãÈÇÔ"z±Ç:§QÓ¾gÂÒM°ô&üïþÆȈÒß±¦„íù½nsøªáÄfUá·4ôŽèõTŠ†9âúñ´ù$ÝŸóqbfºÛg6þÿro‚ñ‹ÑNoÉ´‘B,\c¾væQ¢4ë¼þ½KLéÝoþN>6cƒÒGlÝ~¼~O-LmšÓhi endobj 869 0 obj << /Type /Page @@ -2494,40 +2486,33 @@ endobj /Resources 868 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 867 0 R -/Annots [ 872 0 R 873 0 R 878 0 R 879 0 R 880 0 R ] +/Annots [ 872 0 R 873 0 R 878 0 R 879 0 R ] >> endobj 872 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [55.6967 755.8266 256.3816 767.8862] +/Rect [55.6967 713.0444 256.3816 725.1041] /Subtype /Link /A << /S /GoTo /D (rndc) >> >> endobj 873 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [268.5158 755.8266 332.4306 767.8862] +/Rect [268.5158 713.0444 332.4306 725.1041] /Subtype /Link /A << /S /GoTo /D (admin_tools) >> >> endobj 878 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [378.2799 116.2526 428.5017 128.3123] +/Rect [378.2799 73.4705 428.5017 85.5301] /Subtype /Link /A << /S /GoTo /D (tsig) >> >> endobj 879 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [112.234 104.965 168.4527 116.3571] -/Subtype /Link -/A << /S /GoTo /D (controls_statement_definition_and_usage) >> ->> endobj -880 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [75.273 61.5153 131.4917 73.5749] +/Rect [112.234 62.1828 168.4527 73.5749] /Subtype /Link /A << /S /GoTo /D (controls_statement_definition_and_usage) >> >> endobj @@ -2535,136 +2520,137 @@ endobj /D [869 0 R /XYZ 56.6929 794.5015 null] >> endobj 294 0 obj << -/D [869 0 R /XYZ 56.6929 441.8384 null] +/D [869 0 R /XYZ 56.6929 399.0562 null] >> endobj 874 0 obj << -/D [869 0 R /XYZ 56.6929 416.1193 null] +/D [869 0 R /XYZ 56.6929 373.3371 null] >> endobj 298 0 obj << -/D [869 0 R /XYZ 56.6929 378.9792 null] +/D [869 0 R /XYZ 56.6929 336.1971 null] >> endobj 875 0 obj << -/D [869 0 R /XYZ 56.6929 348.5817 null] +/D [869 0 R /XYZ 56.6929 305.7996 null] >> endobj 302 0 obj << -/D [869 0 R /XYZ 56.6929 276.8275 null] +/D [869 0 R /XYZ 56.6929 234.0453 null] >> endobj 876 0 obj << -/D [869 0 R /XYZ 56.6929 248.1435 null] +/D [869 0 R /XYZ 56.6929 205.3614 null] >> endobj 306 0 obj << -/D [869 0 R /XYZ 56.6929 167.2435 null] +/D [869 0 R /XYZ 56.6929 124.4614 null] >> endobj 877 0 obj << -/D [869 0 R /XYZ 56.6929 135.7502 null] +/D [869 0 R /XYZ 56.6929 92.968 null] >> endobj 868 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F58 631 0 R /F14 612 0 R >> /ProcSet [ /PDF /Text ] >> endobj -884 0 obj << -/Length 2414 +883 0 obj << +/Length 2444 /Filter /FlateDecode >> stream -xÚ¥Ù’Û6ò}¾Bš*‹&^ñ“㌽“ÚØÙñ¤ò`»\ Ò°Ìc"RV´›üûv£!qâ©réA@hô}€bÃOÌò$ŠU¡gY¡£$ÉlY_ij
¬½¹¼gá7-Æ»~¼½xþ:•³"*R™În×#\y繘ݮ>Ì_ýë寷W7— ™Äó4º\$i<ÿñúíO)èïÕ»·¯¯ßüvóò2ÓóÛëwo |sõúêæêí««Ë…Èç%cxäÀëë_ÑèÍÍË_~yysùéöç‹«Û—1¿"VÈÈ >ų°ýóE ©"Of{˜Ä‘( -9«/t¢¢D+å!ÕÅû‹ÿ G«îè”ü•GI.³ j5%À¤ˆR%•àí½E&ž¿Î²ÑV‘G…J3À{¾ØÃ)£BJ¸)MÈžÀªŒŠ<ϧ] c”Ž‹4™DºHNØ(WÄEÀ°Q‘$’¹xšSbnª®…‘Ìæ_švßÐÐtô߃4h
X†A:oLmÝI9/y“¡•U[›’Ïã.íšò4+W¶éËõ¡l6t(¸@1ƒS±œ_÷^ÆxçñuÖ±j–‘B‚¤˜-Ç7nWh"öe¨D•Ä³ßÙíW»’Š£Xx!u½ém
DÚ E¥ è ÐöRäs <v}G‹ÝÙöþÞ0„o%hK0Çž+7
0ç`û²¿÷gœæEäÄŸÏÛ-‰ådnV+¢¥ãýµé—÷$+
¬§²eU•Drž)y>Ú@; #¢aT6˶&•Áž†aýÞ|µ´vgmC°33°n@ÖG’YͳÁÊ -°®jÓnAíç
é?öÌVç’ë£a˜ÖÙ?yuåR&¬êá¢3ßÇ’IV̲\Mù÷û¶Ç¸£œðíTFRCܶ=îÛ ØX3/(G%R”·`YýÖ A¤V uvY~Œci;Úfn—;Äá¹Ù{‚¿.M_¶
côRÂÌgN²n¡mÐÉ š± g‹BF*¶ÛƒH]MïŽi5ïví¶G£Á)Òr~ûþú
ÁΰꤑŒ'AµY¦RÇ}m–‹z•LÈMg`±ìÈT^<b.2´ÎÒ!~,·¶?µ-2ÈO:™¥…ŠtªÓﶕãbŒòÜV´Œ£DAf ¶QüršŸˆr`¹Pc{aºpì”1¸/´¤‹;KJU™'2tBœ]=pw Šï0Üç
ït.;é>Ó{† c4]¤š&"ÒÊo$ £!âv¶Æ( RH)Y 4P£ÄóªÝl(ò -ÿçDê*”<1÷´cyošÆVÁä3åÊ> ø'1mZ—o0è!8r(ð¬TQuV ¾ b{^ÓÑ숰ÙÕw˜’püòQ(
ûïhºkª².A1g>…¡8`¶+ÿkÏFrÆ'“Ì2Ý¡ùŽÇŸ×fYVš¦2€?Õ¯ìv;E×_žßª:òñbL‡˜fÄbZ„KÁ-a -A¨ -„·¶¡÷fÛ Öáooá¤õ ¼;Q¦DÈKÙ¬ÛàØÊÞíSUU•—e°õ -&’V IUˆóÚ\)hÚ©Ûì¸ -F¨«8qq¾šmiÑ&qÒ®i×À´>ô'q²F;Ã¥FØK:DóÐcÝa×ÒMp§ ÚS±ð5†OçìQ®Ïrjøá~k¨ÛÀ¤ØµËøî¨{kwýÚö÷íª{FÕ?^^8r
ŸS™Ç5œ¹xÂ[ö奘S"\þU±oéT<t3‚»3²<¢fF û´så^€Kƒ aQœø²dpɉº-ŽÒÜ‹t¢m¹*°•]²ÝÞ·{ òÛ Ë -¤iy‚–€ÿ5´O`ɾö [¢ ‰]±·eP`jî1ÒÂQñÎUÀRk¨…§XÓP|èæ°ò,RBç ( vå’N|©¥¹ÉÈŠœÓÔð¾Ú4LÛ ÃÉ -L2._èÁÀ: -«ƒRa¼iùDœÔƒsM9 G9î‘lœz|L5·’žLnG×'Q壔z"TàÓLZä^_‹Í7ß[ ""êa’|›{|YEfåŽÒãªÂGm•J·Hpñvë© :MœüJéñ›ÅÙK ]Ûå(õåŒ7ÏŠ^˜mcC)×-;-É+
Þ§ð @,Â"¨›òƒ* +xÚ¥]sÛ¸ñÝ¿BôLˆÃ'?š§\ÎI}í%ã›>$™ -A2ç$R'RVÝ6ÿ½»X€"%8ñLÆ^.‹ýÆ.$f þĬ0Œ«RÏòR3Ã…™Í7|¶‚µ·ÂÓ¤( Sý|{ñÓ›LÎJVf2›Ý.G¼ +Æ‹BÌn “×}õÛ«›ËTždì25O~¾~÷ aJú÷úý»7×o¿yu™ëäöúý;Bß\½¹º¹z÷úê2…°_zOlxsý÷+‚ÞÞ¼úí·W7—Ÿo½¸º të+¸BEþ¼øø™Ï ö¯œ©²0³|p&ÊRÎ6Ú(f´R³¾øpñÏáhÕmÙϨ‚™Bæj3 )Y¦¤r¼½·¨Žm- +– ^ +‚>Çj±?¯«ÿcÏ (9ãiTY/E÷Ø}Çð—e5¯×Pšbdž]ýÂîvß höëõQ—c9ÄTŽ ˆÅ{ 7‡O(Bë‰ÑàÔvjÆCµk†è§·°Óž –+1µn–ídÛÂÞí=#/• É–ÒG‡z>VqlñØqžåò¨O¡¸ZÈU¯î£õtkÚ—Qß‹sNSÃ=›SD¦¾9ò=.§E̾>Cæ©Þáë{éIüÏsùåÄYO®3Æ~Pzä@[c…çëË'Ê"t p§„¢(ø3ªâ/4eÕÇap(â¿wÕÊFn™“rs‹‹«<´aA‚èü,Uy>?§Jå£×j‚ëN\<¸÷„ ª]m1"ñŸ\jPÚ!·=UIüpOÐÅ´äADù^>×®kÈqhéb¯/`iÅEè0Âp® Ýôy¡¦þÝÞï*6ðJìÚy
zw4¼µû~»ïimcûûvѽ æ ßT~eÐÈÍ{Îej\ÕðËUOr¨/EBó‡p·¯âa¢S|fDxwq—¼‡h–Ç1í$©ý(àƒˆ±JÆMhJ†„ŒtmœeE0é`!7éûžÀ®íÜÇí}{ +•`s˜^|1ıpÂÇ™Íé øï§C€,xðn]wNtD \õ@hà‹3^®'Y‡§p„ï+Ž{ˆo[í:Â8³:Í`PõšÁðZ fø¦ÕÓÊ¡òôTZœý¬ÜµÃDì1ñŠ&1|qâ{ÆíÆeäG<âΘ¨ñ/2 ÎôP°Ã ~|Øßç†i)N²Ñù £új×û{O'û-ÚÀø·r$Ç×¢ UF5¼z¨J,¢î±é«liÀow~ ¾SᓪˆSÕñ÷
„WßÑNvê!¹"ÝP(s¾:¸G²ñµÐCåóRûI2ˆé§ÑåIYù$¥ŽÔ +|™ÉÊ"ø+]}÷½Õ1"¡¶£š¦Üãc Ý1± ×xS©ØÛ: ûá ÞŽ¿JÂ䬊BÆ éÏX!Ë<…**u*ùð ݹèÿkdÔendstream endobj -883 0 obj << +882 0 obj << /Type /Page -/Contents 884 0 R -/Resources 882 0 R +/Contents 883 0 R +/Resources 881 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 867 0 R +/Annots [ 885 0 R ] >> endobj 885 0 obj << -/D [883 0 R /XYZ 85.0394 794.5015 null] +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [103.6195 731.9163 159.8382 743.9759] +/Subtype /Link +/A << /S /GoTo /D (controls_statement_definition_and_usage) >> +>> endobj +884 0 obj << +/D [882 0 R /XYZ 85.0394 794.5015 null] >> endobj 310 0 obj << -/D [883 0 R /XYZ 85.0394 662.5434 null] +/D [882 0 R /XYZ 85.0394 605.9993 null] >> endobj 886 0 obj << -/D [883 0 R /XYZ 85.0394 634.6304 null] +/D [882 0 R /XYZ 85.0394 573.2561 null] >> endobj 314 0 obj << -/D [883 0 R /XYZ 85.0394 376.1585 null] +/D [882 0 R /XYZ 85.0394 303.7856 null] >> endobj 887 0 obj << -/D [883 0 R /XYZ 85.0394 345.4362 null] ->> endobj -318 0 obj << -/D [883 0 R /XYZ 85.0394 136.7105 null] ->> endobj -888 0 obj << -/D [883 0 R /XYZ 85.0394 113.7908 null] +/D [882 0 R /XYZ 85.0394 268.233 null] >> endobj -882 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F77 707 0 R /F42 601 0 R /F57 628 0 R /F56 622 0 R >> +881 0 obj << +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F77 707 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -891 0 obj << +890 0 obj << /Length 4109 /Filter /FlateDecode >> stream -xÚ]sã¶ñݿ“—È3ƒ/’`îé’Þ¥×6—öz}è´™ -Q2{©Š”·ÓÿÞ]ì$eÈÖµ7 Á,û½¼ð'¯Ó,É -U\ç…IR!ÓëÅöJ\¯¡ï‡+Écæ~Ð|<ê»Wß¼ÍÔu‘™Ê®?®FsÙDX+¯?.ÿ6Ë•ÜÀ böýOïß¾ûá/ ^ßäföñÝOïoæ*³·ïþð†Z?|xýã¯?ÜÌ¥Måìûß¾þãÇ7 ¨+ã9¾{÷þ7)èqfÒoÞ¾ùðæý÷on~þø»«7 Ã^Æû•BãFþyõ·ŸÅõ¶ý»+‘è¦×Gx‰, -u½½2©NR£µ‡l®þ|õ§0á¨×}¥Ÿ‰Ò@«§4:FÀ´H2´#`»ëë¶)7›GØšÎgå¦k±eg›z[÷ìï+‚m«®+×A»ê¡Ú×ý#‡· ^ö<Ö†ÝñGåbQíújIýw' ,î˦ñóü]¤"ô,«UyØ0Bu‡”‡ýÄ(›2¢àÆêfÕò 1¤M¬2Ó XAÞâ¨ë¹1y’ë¨(eR¤ÐÀe˜j™ÏŽ÷ ²§—¾¥gÝ,6‡eE/e%)ÓÄš”WkÊ-lü)NZ$E¡=âóuÕTûÒÑÈ-Voy…®/·»[hkCCàF®Ûý#½áŒN³ü¦e|‡“Â7>)lz -; -H“%VÛlJîÀø@w÷lZ %\‡§¾”Í#6qÓ -˜VØÜM÷‘V;¥r¤(<À5Oɤd’gšÇ,«®¯›™-²ÙbS :D @š@³#xé8€Ì» '¸Û@ˆÓðëÀƒm èøÞ—u·(÷7rù -¨¨pó~†²÷t ”°³Ö±
±˜!ÖÅ”¾$€Lמ˜£ë=Ór@ ëæžmU6u³ÞÀ¶>ƒÒJ$Ff6ð¿P›*.&R¥YŒØ:O±uŽ!¬}GÄš8ÊãŽÃœÌ -oíê™YIºÙéÙ•~áª\Üó·N¨LEÛ3Û°dîe²ŒòÇ;ÀI›böØ E' ->Ê9Y–¡=ç„ý=å `ó,Ër ¸i×4«G—"¦G É*k"ë -¦Ñê%Ýi“k¯9ˆ”¸ñd_¢lj'P(›ØCg„»rñé°£þá¼°§]
”p݃ \ƒJ%ò=‰¦LçŠtA6 “l©uĺž @®ÏóÙ[§¨\ý -~ƒü¤žÕ+‚Ò Acq߶$vŠåIÍ>UÕίCkó€v³¤Æhk^¬°¡': ÍG¤§²³…‰<줂 -Q¥){‘h³]ÔeÛTÔw ß± ”
Vºï*ž%óšÂ«_UµìN>¬›e½à
Á ¤L‚ ÏÞ·4Â[ -(Ö=r¸HIc@Wàph´Nx^§o‡XœäZèDgö$" ñˆæÐR’ ·›
± tò ˆ ûú.€ïÚþ‚£kå‚x4Õ‘°QIÓ*ùõ¡A=X¤ÌTÎyVV̪ð}ãŒer›^个BÉ ÁoIa4-°mÇë.˾äh “‹lª6Ø äÙãùªw^‘ Â=ï¹—¤ ‡¦¯ùË®Ýro{èçíj~GTÀ¶Â«î¶ôJ˜mº °çù÷7¦DUØ[ÑãBÌLcÊfª ƒfç -& {vÏËTulGÎ3QöRdÊØþsÈ\¼¥³‡«lL”_:Ïf¥¯NžÝÐÜ -ôu&Úܘµâ9”ÒDJãùöpXìb³¨$³Æ¾4‹wûèaç*½<+Py±S/Ð÷0—δêwçè,䥓lÚE¹‰EÑ -X0ê³æ‘ÿû<éx õ…ðÑ_h ó…ö•~!|²Ø<D9!euÖ 1YHߺ©ò Pš«Lc~ÛEl: Ìõ™³Ìéë-r¢é]Gˆ7à¥;ìvížs
rFÆ5|Œ b,Q†ÃÁtÙg¿¥ ÿieÌUZ ®Ûsö݆ rò Ö -k¢€4\æÔTØ7㢿ÙA|£Ä ÝGApì22‘ª—¢%#0ø|ÞõX(-ÄÑß Î„±©W î=aG&±†›³Ñ/ 8S"Z³uœ« ÐÈmQL6’ Ë}3 Ÿ`CÊ„¼Q O!'©Òæ2f2ãøÌg$5Ý‘Á¦É&v¸1@O¬ÉT¿IÁLþüU+Í,Ö+Å«|«˜zQÅ/H˦GE5DôŽÑ_ÃîvÁ„j›'…¶vÊÙ.y,üý!
.ƒÀëqÈ) _¶BϦZÞRyÂ¥Ù#{H¡-ÓôåR„ÐÁ\y| -yJ§^åg»]ç -,௓?͖Ŷ…ú'Érsb.ŽíaæÁ%ùXo{E>5>ãËÙ´ª~f…Îv·-ŸW!Ÿ*l§_Vûý™Hʨ<šüK‹‘çTœ$ÿ²€]1¾³ÅNEZ ½]µwÕ/8¯ùË®éà[e4±Ãïù›žÖ*·è$h ›$w²˜…gÓ»ª!ià´ u¢ÚÉF[E7}¨v®¶ZŸ›´* ‡m7·ÅÊÖHÕ#Ü•·,¥#ááotp
ðà®EÁg;z_ÀYßRX0¨Br~‚…ÓÍëa z€fCS³>ìËy,‹Œçs–8‚ãMäYr êÜðKµ@½®~àñc<àÜ~’ÀÂcŒ] R†Öß<™ø½]V.zU\Ë÷wÁFÈCD²éëM{W";ÙŒ4Ã=N„ÒAe\…ÊžN0÷¾*tý‹´[{n 44dBóÌaJ GÌ*;µ|ÿºKy ÜV@u}¡7Ša6`˜?¹žÆþwÕ“jêáv»I0Š=ëH®
Ç”¡‚N_Tõq¦wPé¡Ný´æ’ °a©÷Bæ±¹1NW" nTê’Q^µþ -áx[%=v-˜Ÿú‹ã(½@íõ ™u:óeyÿåH #¶F›!Â!ÙØ7Ë+ }5®Æ$pÄ(Ñ™¯áÃÉ¢Æã“M‡ÛÞiá#µ‚sK‡:V}cÖ˸ê‹ÇœÃ˜óðÃÞ¯v¸`IyKš’n\Ï“,bŒðÊÞ‘€«þ:¹xšº:C'«F׉T:{M"QLÇŽMšµ¤¬WûÖŽôjás/Ö’†³ƒÌptæ„Ô2¥ ?ÄI‘±¼àš”—-†5ùB¼‡“2P_ÖodÛC¿;ô\½ýžŒ—O „ÔK·«õÊ_QÁP5/|Á—dÍI)g·'1"kÿoÏ\:<WÜ$êÅ/n_˜//o®Úö«hrˆGp ïÂ<_û…‡NüYFä÷ðÏËÿß¿þ~cò¸ZÅØ¡0E®¶G -·¤ÍÌýÏDž¢þ_ûîl¯endstream +xÚ]sã¶ñÝ¿ÂÓ—È3'† +åZ‹1•aL¦áüèÙóÌÌ ·S—¯à%O¦}z¶/}µ<ÖÅÞ»‡ŽXÚëbYÕUÿp#„˜}Þ[6Äú¢Y–)V´\y°o›±'Ž)v<…ë(˜“ì˪ê–<K¹aO„ž½ëiBäˆÉÖ¥Ýz»G’u‡¨à8ê‘SÙ¬®vUO@Â`Lg‚v%œ=Ã[í†Ûã੪¶àŠå²Ü÷åŠúg 'Пc ûžU¹.Ž5#T9 ~"³(†%¢jÖm@j,ï‚þ¡A°‚xEì$i”* Ê„<p,7s%ÒÝðÏŸž‘ñ¥ Re‰æÕšbHr å¹rˆÏ7eS +K#»Xµã€Kv{8¥¢—0rÓ¢ â.Áè4«/[Æw8)|㓦£0 xb¢Lef*ÝA T¬ š¶Ÿª¸A¤Q‹4HØÈóÛH_ÜmËPUǹ£Ó¸æ1™¤ˆR£xÌT_äfÐ9Òš Á ËùDG +¦@]ç0Û¶'"¶ÊÀ£É”Ø5QÐj0#˜ÊÐ`:ضåqxã´'«¨pdKÏE¹lwÖ +˜„”BqQÛ`Û +-¸ŽÏÞ¬¥½´ +I;;=»âÞ-\Ë-kõ€4ò"ÚËÖîA™¬‚üñpRIN¶^Cщ¤rŽ1Q+Ç9~yØÜ“ò@kqV‡,.EL’ZUÖÖË%L£äsº3‰’T9ÍA¤ÄÕˆ'ûeSYBÙÄ :#l-ŠåÇãžú‡óžv=PÂv‚® x^2NÍ”µÐ”©Tò€.È&AȽÂÖ wj[x.0 +ùBÊMwdRVÑ=žVêÈ sÄϳ‡‘D£Ÿûø9ìÑ›ò› ØþHk’aD¥3W vr`Þé©Œ´9Øùcc
QP A”$¹ç[¿
çTçÎùÇÎãnah[CO· n$é ƒƒ>f&=ÎÜ’]õ[È ƒÝ7ÚKé_š³rŽR׵ˊüNÄïT¡m yF†ãÝ|†H æ1„ãùT[ìƒ q¦¥ÖìE¢Í¶Q´V "kV‘cÈ Vº%Ïbœ¦°àòÓ²,WÝÙ‡U³ª–¼!„”‰¡ÓÙû–F8 €í±E;’&Ž×G`¨µà@š}ä×Þý¥Fù©B¿is–,ö38Ô]zŸ?+ö°³Õ«}Ñμ¼Ì™Ñç €QÀšâ„Œ1ë8¸á'¸+êva3±mZëŽ.…«§~‹I&!ɽ© T²Áþãn¹“³ ¸ ·0:!ï@ð2ÒÔ<ï í7mÝR¾ÊDœé1w}‹Ì €
!\¢“Sœ p1ü B”xàÔ¦xœÐ‚AyEe˜HùG +äJšs‘ÅiÇ¢ª¼¨ŠU kÒÐå9 Ú#-¦Æ™xAž~5Äâ$×±Š”ÉäT°G<"‡9”$èm]»H›LÂ'DËCµðàE{Ï_pt-mP +ß·!NÁX&Íô‹ W™K1!ø+RMK+ìÚñº«¢/8Ú +»K+:\ˆ™iL8cäCÓ]ñ©Ú wN‘r£äê$u°(·Å}åâÛ‹‰g Ç1°Uhç˱.=Ó” e&É—¦qGN[͈:L”BŒõ¬*yâyïè\%+ªI9(²)×u 8Bs‘8†$›Z e›mϯ Cü:ÿÛRHª(Ç|ýä<× ý?EïêT¾)zÐy`KÆ»×! Ù ª¦ŸSÄŠã Êîu(<¥qC +k2v D÷?¯Ã zG)„OIùÔçh& K..ä™ä(Ï$§©°§$Ç9$É^à¨ÖîmÊ ÚèÉÞ =š½s³p’â¸ã •d ÍêIþž]1ÅùeP—6 €‚<0‘Lmº~D½±.†øÖFÇ#þ ü$Ož%˜ŒÀr±Ö®à9÷ qßÆföç¦=1”ÓáUÉ‘v1®„L+ØIy úX špR0>À¦i‹H +დ;„²] «&•/eWTuX+$ Ý‹“8þ[ ªC;²ž‰Ì^ŠLqÛ ™oéâáÊ,&J_:O½ÒWEOnhž +_t4ýÏR&`ñÚƒUøöjÈØQMûóµ–‚ñ–Ä]H°¹?zRB +ûª5A˜©“qžnÈáPqÛ$QžfgZ«ëEµÙâê2'n'2ºåé +[@Ŧ?Òõ |ß *NR4p¼*/å,½Cy¼ãfkkòÂU'“IuRû^TæTTØOÆEÿddñW0tt Á¡Ë<*‘ˆ3ù\´”Ä|>íú@,¤óxˆèÇ a¬Žý•‡Å±'ìÈä Öpbs6úyÎT¬§Êdæ*4Ò,Ï'‰NÅ¡†O +H°!™ø¼QN!GZªäeÌ”Œã3—‘TtG›r$›Øa Ä +=›rõŠÊ6Í Øƒ†¶ÐúùRD¬¼î ¸òø +endstream endobj -890 0 obj << +889 0 obj << /Type /Page -/Contents 891 0 R -/Resources 889 0 R +/Contents 890 0 R +/Resources 888 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 867 0 R >> endobj +891 0 obj << +/D [889 0 R /XYZ 56.6929 794.5015 null] +>> endobj +318 0 obj << +/D [889 0 R /XYZ 56.6929 769.5949 null] +>> endobj 892 0 obj << -/D [890 0 R /XYZ 56.6929 794.5015 null] +/D [889 0 R /XYZ 56.6929 752.0323 null] >> endobj -889 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> +888 0 obj << +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 895 0 obj << -/Length 2474 +/Length 2579 /Filter /FlateDecode >> stream -xÚÍMsÛ6öî_¡é%ôL„àƒ Áô”¦vâÎ6ÙuÝSÛÙ¡%Hæ,Eº$v§ÿ½ïá)#q:{ÙñAàðð¾¿, þÄÂhÆU‘.ò"eš ½Xí.øb {ï.„?³ ‡–ÓSßÝ]¼ºÎä¢`E&³ÅÝf‚Ë0nŒXÜIÞ¾ó÷»«ÛË¥Ô<ÉØåRg<ùîæÃ÷)èçíÇ×7ï~¾}s™§ÉÝÍǾ½º¾º½úðöêr)Œp_z Ÿ¹p}ó·+Z½»}óãon/»ûáâênäeʯà -ùýâ—ßøb
lÿpÁ™*Œ^ àƒ3Qr±»Hµb:U*@ê‹Ÿ.þ1"œìº«1ùie˜62Pç1ê‚eJ*'À?¾E ^]§jr’/–J³"/´;s¨êú "ÙÚk{¿ßn«f‹Ÿ<i÷ÃãÞoµúí'ë¯)¿ÓÑéÚö=AÊæH‹¡ÚY¿zð‹ÞvŸ¬¿QùóUy^$»vm_Â2Ï’îR˜ÄnK÷»>½TŸÈ™¬ÐZ:Îè1£’mÝÞ—HIgÈaËñv‘ ‘¼}(›ÆÖ=í ªáÁKoj¨’sÆy®á1|c}lÊ]µŠˆ9ULåõðLW
GB½ï-3RÄù¢§½ÑŠˆ&p<@‡Öq½”ø”ä:pO㶃ívUcɦå@« ˆÜÚž¾ -Æs%<wîîÒi9"ÃL®Rô¡ÄwS‘Ü[Ûà -(Øw]´m^âB¡dÂ6Ê÷ÖåàWe³ö{ΰDVLˆé·n·[»f1jˆ1©Öú]yœ>“þÑ®ª_9—
¸SŠÊRf2ÎM²Œ“C È1ý±Â#„(ÁTšþØŠL…¥‹ä~ïTkœ'Iƒí˺>ð±þÈWp¯¯š•!2ÃR9²ú•„”uß^'Æžž$Ðë @¤3 -¾B¸¥ ýBœNŽrÀŸF`uï!Á—i‘%w1›“ª`JféŒÇo²€„[ i ‡ªmzODyœ? ÁuM+—ODÈC -
ÿÕ+÷®°ºsw -çtž:5 Ϧ\UµÏ6ÀÀü¨<+lñBÕlÚ'Ô´M}<§ âI;¿£FΨ)Ãå‡j‹ŽKD)L
êŒê{œ»;¦Ÿ—º/?+tB¸©0²â¡oœ“2ˆ1ß §Pœ8= -¨\ǒ¨¶Í†¿ôtµ9£>´4Sú¡ì»þ ×vÍ1½Xn^xš\~aQ{{ôÝÙE„Q;Bõ‹þy5ö]g›!XÓhET1ESFóK!a¢Ä/…w ¹ÌŸ˜ccDïÿožüÕÂjöu=‘È!&ãÀdŠ!?Å”Ÿ¡íû@Ñqx} õê[l)9Ïâž7=š@×”¡4ÆÐçF2i¨K¢“èhB’ÿyêUº -ŽÐ¯üüÙ
7”‘8Çr{ÇvO‹ÆZÿŽ“&ü®ÊÇa?¶†¹òI·H^nLÃO(vû~˜ÒçÑÑ * ý×aR »X÷(HjÒ!$,·_ëPšŸ<Gó` Ü{÷)RøÈ2À/1‚`‚¢í¾øBt–4Õb \>â +xÚÅËrÛFò®¯`ùb¨J„çÇÀ>9Žd+µq²ŠrJR.’¨ +îoúHà»ë›ë»ëï®/—\Å Î {ÃÜÜþãšVïïÞþøãÛ»Ë?¾ y™òË™DFþ¼øí¶(í .X(3/öðÁBžeb±½ˆbÆ‘”R_ürñÏñÂÉ®9ê“_,U+‘zyga"…4ìš²@–²`èòB#CpLNŽEQ˜ˆ,†· $eÜo4Z×íC^ÓºÔ»5.UPëÏÚB‹¼¡Åƒ¦½^öÅ–~ÿ£»K®‚ö +> äMIˆæ¾uÕ¬ mÛ–öÑa×5º¤u»Â³+s–‚v—*Ø5
ž%Ž¦‚J…QÄ”eɈ +¥Ò}9à&ÿl¡9ý8Éž‘,r›)+)ØßTë
>ǵ®+ºåhĉgÇÃŒåRyU“ˆYÐî†ÇÝ€šçà›¼ièVØ6ù@«þQÕê@ ùö;c¢ ïÑ@` HëªápÉ9®¶j;ZèçÛÇZ¿&‘ÇéDä ÿ’ÔZ5—Ë„9ªâ“y瓵AÜù¯áUÈ0ã§Ú]Ÿ„ôbÕ¶/ÞLæp(ÊŒÄ<Ë.%¡/½7ÿõÆc2p³d!c\œ}…Ö"!ø¬Ñ+p119 +Ÿ¶ÀÖÍ¯å —Òît„]ƒ‘$o´ª¶«]8[ÕÅGƒ<{ž§õÈ4 ÈjÖ¹ù-/U3™÷ô˜’c„*š][†°«làhW¸³¯†ÇsCÙ¥.•‡&ßV…/hÉsiÑŽêëw½&bF +8 Ö¿ìiïH´túF°<@!x‘êñ)ð 3Òݶj4ô~t“I@÷ié÷±«p0'Ɖ߮<bÈ JIn¹3g—FË 9¨P¥2²¨› ß8„bñ'bÇP +жAGŒ$JÆm›ð{e>Ø Ü3†… ²bº˜~ëv½ÖeèSaŒÜÅñ·S¿ÍÓG&áÅ1€„‚Z…*‰£¹Rr9)¤×ÄÓ z Üèy(£$³h6è\Ù´¶(]UF©)Ø.¯ë [à|÷úª3É” ž@J#«_IH^÷-ÝkÄØÓ“¤3 +°†h|¥4 l¼¦ G¨å~XB¦eTãðø5‹_Kð‡DdÝå5È Ãú¸*´ûêfe·ürév?‘R"''Ô·ëüHàRcœ§LÐâX„&¡óK¤µE\Ù¼pfÿ"sâƒRð=!#¢L,ÖËž®,õ*ßÕ€ÎF¶†4ôîQ4Á Í'RÁ‡vO`0Ñʧe8l…BE'e„eÁ–iTB÷EW=Œàæ´å)ök"ZÄL„ ÝšAÚìÖ ZÜMºÇ9=@ÝãT ç÷"¿èÎõß"E(NI‚Ô J¬x§/œµ±#Ö3„œßFÍ—ÇÀy $%"z¢g°züd3îsÝÂÌõ¶mÞ€ÝK4üW¯l¢1€á +«;1‡ÐrŽÇè CÓ/çqÁݳʋª¶Ù¤3Gž¾¤jVí5mS Né‚xÒÎù¨3jrwضš¶íÁÔ Oøkì¡H„Ñ—¥>i¥¼Bç§-šqÒbÌ äª•#§{`IÏ?b;NŸçÓds]ÛýËø´¡·êÀÐm tÚ鸣 Û£ ‘õ endobj 894 0 obj << /Type /Page @@ -2677,7 +2663,7 @@ endobj 897 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [173.6261 554.783 242.2981 564.1926] +/Rect [173.6261 500.8708 242.2981 510.2804] /Subtype /Link /A << /S /GoTo /D (the_category_phrase) >> >> endobj @@ -2685,27 +2671,21 @@ endobj /D [894 0 R /XYZ 85.0394 794.5015 null] >> endobj 893 0 obj << -/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R >> +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 901 0 obj << -/Length 2361 +/Length 2502 /Filter /FlateDecode >> stream -xÚÍZÝoÛ8Ï_aìK æñ[Òõ)ÛMzY\Ò^Ö÷°·»(d›Ž…Ê’×”“õ-ö¿’²%G¶Ók -i8 ’¿ù¦Ìþ±ÒD§< Ä©$Š25˜,Îèà ÆÞ±À3l˜†m®ïGg»Ò|’Ts=ÍZ²B“„
FÓ_"M89 4zûþöêúÝ¿ï.Îc®ßßž¹¢ÑÕõ?/ýÓ»»‹››‹»ó!K‹ÞþãâÃèòÎé ãûëÛ <%õ½»¼º¼»¼}{yþÛèdzËÑö,íó2*ð ¿Ÿýò LáØ?žQ"ÒD
á…–¦|°8“J%…h(ÅÙOgÿÚ -lº©½ø1J¸ -ëßfժÿÕc,‚3ê -è"p:”‚:ñ6Ѷ3&IR6똚Y¶.ê ㊀Á{®öâ lÕÖ&›¢[JíÐDª× ¬ÐDÚM¤gžÖ¬èhO ’I³o -S¿²~ÀfÏ€ÖcÉ«\yÛrÌf²^åu˜îUÖALÚù×_)åÛÕÆëzo‰¬°¿YLGŸŒY†eשeEû -[ºß*klæÙCîÌG0ý|žò¨Z¿šzŽÿÁKÝÄ»Îê/öúó¾é5°Ø|l øØøÓí• ’2*÷ ,/Œgú®= Éß½ésR‹áË“òrVy¶a¯ø¿ÞôÁÔµºúîÕ/Ýs¾^ñû&{„%pßXë -²Âc3£+j¸=ÔP$’ĉ`ýU(ï‘`ï’q\ùp… -ãMñqp[»þ–ÁU‚ðXóà*
}èŸBoÿ¬¢¡º}?º¾ú¹ôëjRG°ó›úÖ“*—ŒÎN$U.%Ii ’ª –'±ûÐÉ}ñösj”ö>_ -N•B@SŸ›áÄÛq%Õ‰Ú [ã>ƒ®Ëvd¦ž_ä³T…¯ØtaRšzâcú·u™ 8Cs65P×/ò²!ÏÃkèúÒ'ªK$iT¹ï@ÔSAÂã<Ç|´ºõý -G2ëéØâ#Á
ç«€¥c N÷›Ç¾KAN˜Ði`‚ž½è¯QÏ_‰R?ˆ¶o -wT. Ò‹Ì}™!ü ®Ñ!¾¹›W&ˆÐ·ˆC™ º3&Ó¤¹¦<ä -<&±ˆÕþ—¼5Å+v¨aFó܆/*±»2‡î"…nÏBH(^ð«R§% ¹Æ(™mªV$9} ìæ§f劕׾ÅoüÀî».æ¶ÿ«^ã±Mk׸e©øÜ«Þîßö©/óÓ¯I™N¡¡£'")‹a±ö‘´4õcµútÒñoŸ¡Pðº&åH´lïåN> ö«…LO@¦áœ…h¹œ‚cœî66óIs“„sŽÁÕÚÇ· —T/a¿Çá’)áZ‹\ïu¿´ñy¼}†/ÃERèG bF¨)áRÇ}?õ ƒ“ŠxîKv¿º‘1IÒª7»¡?=€ú^
B?ùÙKó ”ÀÕÚúÿ +xÚÍZ_sÛ6÷§Ðô%ôL„#‚ /OnjçÜ9;9W÷Ðk;J‚,N(RH»ºN¿ûíbAŠ”)ɹ83?˜\,Àoÿƒâ# þøHF,J‚d¤’IŸËÑluæîaìÝw<ã†iÜåú~rö·«(%,‰‚h4YtdÅÌc>šÌñ"°sà{oßß^]¿û÷ÝŹ +½ÉõûÛóq }ïêúŸ—ôôîîâææâî|Ìcɽ·ÿ¸ø0¹¼£¡ÈÉøþúö¢$ôï€Ð»Ë«Ë»ËÛ·—ç¿M~<»œ´géž—ûòûÙ/¿ù£9 ûÇ3Ÿ‰$–£GxñO’`´: ¥`2¢¡äg?ý«ØµSñã> `õÀP (‰@X +=}>¾ò²Šè3à-ÝóT“€Í9=ÝÎ +èÂqZ”‚:yja<”,N$»@cöOGHQ‰¸º‹Ç°USé \‚ƒ#šH%ÍÁºM¤µh"=%ZëhH{U7û bÎb[í©|QæyùØúá¯Aö|×½ ™óÅÚèùßé Rõ½„+–ÀÞöÎù°€/öh ÍÖ€2ßô‰s=Ú_o8eÂâX%v¹ t— +™§U: n$ûÚ½iÓ¶² ¦àCVЃ‘h«LÙTˆ2l…»IX‹Ó +ÐÈ–F Û ôvÄ‹t垌ÞخѪ֕¦êeÿ–…Þ3‚Y:k;~ØÒa=w|)=7åù" ëY–Dx\ÍA,˜„pîªUW[žRóÅzmÁ, Ò|Ź.²†h~›T¯µ©ÌXwûý2öQ
^UH‰ŠO$É@q&#I—+M69 ëÛý´c»XÛ†¹{¦tcÚŽ©…Üéb¾ƒG +É'CæGñ‰äà%÷)l´)stùSÿpûÓùXBYJ& ³jDú5Þõ*ÏÔ³%C®1Äfƒ ܽb
ø?hËËòS½64¾¦ì0 ª°Èm*ÐF«Øî拾›ÌòŒšñîÕbº NæŸD:Û3 T{Ï—
W/ëX"€'!N¨ Ê¡(I(-aeQ§²£šÿOð«MZ˜iönºY£¹rj×ÙÃqÏêìý[Ž]pÊøDæ@û* U bwËú0Æ«âãèv¶ý²è¾l¾õchŒNÙ/ˆQqBùÖõöÏ*™©Û÷“ë«Ÿ{A¿*ge~ºÝž¾a»äIÄ‚PÈ© ‹Å"t9ÕÆÊ“Ð}è¥Æ¡pû9JwŸ/'¤1¥äçˆlf †SD,TÁ 4cÅb•Pþ¬‹vc¤ž_àóDºoØpaJšñ1u½[]¤Ó\;NטÍ5Ôô«¬hÈK÷`›¹¡ò µ%âÄ+íW Ÿ¾¨ áq™a¶FZÕùz…#©!:¶÷H°‡Cý|óˆ9‹TäN÷éÇ¡+Aˆî"J ô«*ˆ½ ZC ]ˆú‚Å ¿Ywsnsõj•ÚïrÂÅ>á»Kô@p{Ëa‹ázqè“KØN˜ÄÍ%å!OSBÉýï4xgŠìPÁL–™qßS”½0‡n"…vÏB„Pºà7/¤¸K@³M PRzmjV$Y} ìäçzcK•×ÔÞM·4°ûꃋ8™þ¦×8lÓÖ
CÞåóD|îEïÏß¹Ô—yé×£AÈ$NÅÑ Æ "P -tõXn>ôû[ÇGª]Û¡ ‹•½|Ë©‡Ð¨ñèd<—‹]°\ÏÁ/N·[ˆ‰Ù¬¹DÂ9Çàêìã[†Ë÷YäG'.¸ 2t¿ Zã¯uµà”ñ9IœŽ ¿ –$© endobj 900 0 obj << /Type /Page @@ -2718,19 +2698,19 @@ endobj /D [900 0 R /XYZ 56.6929 794.5015 null] >> endobj 322 0 obj << -/D [900 0 R /XYZ 56.6929 769.5949 null] +/D [900 0 R /XYZ 56.6929 729.6823 null] >> endobj 898 0 obj << -/D [900 0 R /XYZ 56.6929 749.9737 null] +/D [900 0 R /XYZ 56.6929 704.9004 null] >> endobj 903 0 obj << -/D [900 0 R /XYZ 56.6929 433.0023 null] +/D [900 0 R /XYZ 56.6929 387.929 null] >> endobj 904 0 obj << -/D [900 0 R /XYZ 56.6929 421.0471 null] +/D [900 0 R /XYZ 56.6929 375.9738 null] >> endobj 899 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >> +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 907 0 obj << @@ -2836,15 +2816,16 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 923 0 obj << -/Length 1170 +/Length 1163 /Filter /FlateDecode >> stream -xÚX[wâ6~çWø1ô ©ºX¾œ>eS’fO7ÛRú´ÝÃqlÔ‹•Y¶Ýÿ^ùl0IÆÒ̧oF3£±°ƒì;ƒˆ†®ã‡.d3'^ ódçµhJ½› ~¼õˆÂÐ#ž3™5°ˆ‚ -§(µþB mËgÊ—ÿ -,‚($Ô-$ô]Ê -Ä Š©Ú†Æ„…ÂyJî™°‡¿.ñ1a‘vâ“cü\»´PF çû¬ÛâS/0š`ˆ}äU¤Ü.RîëŒ&—à7öô0"ûa´ˆ¾£¢LϸF,8Y©–\µÆƱ’\™Ë´D’žY -w(õYÊÄK§‚guÚžU<^)-Ö¼‡FÉIs%¢”ñ¢l =»FCCpÝ‹~•ßVeÅÏ2ÚzÈt›Þ‡Á$3¬À3ßÆkñXDÙ¦ßÅ7ngT- ‹=+ãÿôéÍÂÒKkAÖÃ=µµuuªK÷(+±çCê·¥T0æE µR´ÔÒF.aŸBê†áI^E
ÙQóŽ©ÙöÚ[º æµçój!†¤èöŽÄÔ€Ëܶƒiu›÷"·…>$ ¢‡ý÷³®#(„3÷MéY@Û“ °[i›;]ÞÛp=•jšÉÖÀΤ³M?w3]ì“·u·‡méûí±: £»HCb~)9<£TKP²ÛëµöŽÚNà²(õ”Í ÂJé{çÉ#¾ÎHåÐâïuÀýmÝšÙR¿SÈÿMõ’Ç:±´ÝűlÓ]¼lã õÕ(ט‰´>túˆkc[ðË8Å)2ûaOÃÕ:JÏújÎ#e ydú«‚³(æ}TpmŠ±ç¨ˆuÿeŒ\J»å›W|Ähk;™µ÷Jin€TI}fW(ÅÈÞv”1Ü2¾ ò û%²Í›1i¯ØÎâ(žŸß%O éÊ_â ؉0›Ö: ‘%e¶-¯äyB ”îØK%×"iÕêh%m»¦MùºóÉ V Ò@/££SåœÙ|f#j^tà}½e÷å"5ÜXÍØv÷âµ.T:ªÙí_ø‰
!óB;Sr¢•™÷÷Ý¡v¨Ýêm>Ô ×”¶]Ï íÇØ«/ƒv7e®íaƒ€lïy\Ú¸ç¡Èƒ ýšTn"
™ooŽ©ÿOªWxendstream +xÚXK“£6¾ûWp §JŠ På4;ñLf+;›8Îi³åb@ +‹Ù³N²ÿ=âeÀÆÛS>`D÷×_·Zê–°ôƒˆrÓ°¹ ÂÌðV#d¼èo#\Ê€J4¥ÞÍF?Þ[Äà[Ä2f‹–‘ã`c溹ûåö·Ùd:„¡ Ž³ÐͻǧŸ‹^<î>>Ý?>ü9½ ÛæÍìñãS1<ÜO¦“§»É`‡aOJ„# +÷¿NŠÓÛ n§ãϳ÷£ÉlçKÓ_ŒhæÈ×ѧÏÈðµÛïGRî0ãU¿ ˆ9'Æjd2 +™Ii5Œþý¾l|ÍU»âǨ™CìŽ +°1ÁÚA %ªM'éwiIÿJŒœ…un²°®a‘}!ˆBó¤T*äe</^òñ‹&k®I¾-~€¯k‘lAO”8%@¡õbhg,ûR¼ü—cD!¡6×Ð6)ËÈ?U6 4ζ…– -üz¸ÀÇ„AF8=ŠOñ3íÂS@–m³vD› ×A=Ãi‚!¶‘u© œ&—:m#haDÚN¯Üo@%n˜.D”\ ÃB-\¯žEÒ™‡JÑZÐê0%ý ÇÔ1¥Ó¦ +‚Ê‹HVËö„=»"Ù_ϼ÷E RðÖI*7b€‰‚Ž6 Ý +ˆêZHi×…
Ú ®¾ ªïÎLÝ :ÙÝü˜´qóC‘ ÂíŠTæåûÌw÷H‡Ôÿ;µ\endstream endobj 922 0 obj << /Type /Page @@ -2861,23 +2842,26 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 927 0 obj << -/Length 3146 +/Length 2981 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿Bo•§%C -™Ö|u¸Š¥e,„‡”W?^ý£ßp4k—.ÊE! «SÊt$@•„REj•J &‚ +À&«òúäæc±1×AE뇬ۿ¯²ƒ{ý ”ÆB-%·ËÙ§`“mö&h‹ß "ŽÞ·fsq]·Ù‡ìáÁäA–çi[ÓÒ‚'Ó¾¯›÷U=[I7ýИiX¶+Žâ/‘Œhô’ ÿuoð7¼yûæ¦_Â93yÕÇüat êx¸7Í"vS× 4»¬+ê*¨«ò 4‹Ã*óiS s·ÅÜN Ͳh;zûÃa.žó·£ižÊz7“É™æE›Ý—&ÈÊ]ÝÝþàä ÷šÕ„ åKÇ à"p *•ê)%š|ñ:æ« ¼Evâ4ä‘æ½I²¶‹`»úÅÓ’ÙüØe9˜ª£×Wæ—(âU]¤ÁOm¶3Ž–©0â2Œ¢8¶¤îö¦gh@b*ÔZ'€Œ8žƒÓÍ«Òáµ#æ„X·¦kit| 箬ﳒÆñ५ñ¯ï[КœF÷OôD¿Òðn_¸e3‚‡Ì!£md£cÕŠFC7#%²Í¦7ƒ÷,’dá#]oê -e»;6IçRà#‘z}»%`·7Í5SkC ‘9ƒÂ-6Q¡Òš=/Ù†àif’ýöÖn™hõBD‚÷e½ù@ÃGÐGÂ0àaF¸4†«¡i<Š®uJ%¡’z¦µ¹ÙfÇÒ)ÝcQ–4²×O¼®ðÄ‘³0e,YI<ŠHØÇKHÁËúÝx)põXd´Ùtuó4§¬Ó0‰•ºLÙ#-P ß‹8èJħ¤ÑjÁåú±n>ÕŽ^€!«›îš‘/ ·ôìüšÖ4 Ac bÌY9Ô -Ü`vßÖå±s¸HÐóáó˜tt¼×©–´ÔÝ' #%Óë¤1œˆÁ -a( Ó™%w¦uÈ¡xsﶣÖ÷à”Q"ÈÆPxR¥ŠsŠ -žxò8TQü ñ kúÄ—3 ¦}OÉ“«YùjÇPâ@¸4UnÕZ:”^añ~\ÚCëÚe -¥jI€vŸ‘×r‹á€ug*ƒ:”Ó -[Hœª“€ #tä Ä»ïoþµ H<
W} -b÷w O@÷.T¦‘œÞû¦,È ëÔå¡PÓ·6ñÑn匣4
cHæ.3$ VÒ›¥ù´p°3`E1ØWÑÑDÂ6=…§(—ÂdððB‡éÜ´Å U˜qîF”êj; -&E¾ - -¾ªp×°©=å<=[ƒØwÖL¡tçésßGHçÔ#Ùš¹ÈÏX¦ÂïòJ\¤ëqNéNzŽàðLèÞ-7 )Ž¥C?qˆc£&ãÄÒÁ&±gÙ¹6¦ëÆmLë -3µ3?K‚8Š¿%ZЙ¨ÿAÇÿý“¥á÷\ضUŠ/« OU+ØÄ1…£S3s¿m:eý§êWendstream +xÚ¥]“Û¶ñý~…Þ¢›„$0yrâsrIc·Îe:$ãR"$qL‘ +Iù|ióß»‹(’¢tÎÔ~ + E×:£
¦¤ÖcÊÍ&;–Îè ‹²¤™UŒ¨.v–k8K9O±ÖL ¹‚!–M
ñ\ní±Èi³îêæiJY§`ßJ]§ì‘f(õÀC¶Š1iôš rùX7ï‹jK ÀµƒuwË—È—…Ö;¿§5Í°ÈؘÖÁê_Tµ‚0˜Úº<v F>T±ˆÉF‡g[) +Œ1¸@›`âlœÖÑ¢,°Ëš#Öd"î €âO4br€]},s:rå¶b ´£wš™ÜŽ.t98D±ŽŸ N¬+ÁÉc!Õ÷æ)¸ 8O™LãëÔ=Ò õQ€-J)£1ùî¬;s(EMŽ¶wfê|—(Ö´x<ä™
50·q +Z³>öù àÔ•i¿ øC–ÊÃ3ãÐã
Â1=êá¸*==¬NlXŠCTšhª)>;` @šœ _¨Þpaå07õ±²®ëe±!¼ &ÀËƱ„¢v;›9…g&pÙ1Î ¤« .N}˜ºÇL5:6dÈ–ûcÛógæ‹·>öã×UÃ…LÄÂTÈë†;ĺl¸=V 0ƒ(¹©Õ† +Ž‹¼J»Ç:'.“¡Ýò¨C Q§Ú.ŠÔ©\‰\I…0”éÌ\8ƒô, ¿tï¾£ 6öàTQ"ÈæP©™Æ5E +Û<9 Õ3 ùL<ÆífËgKèxûºx,ÒiŽRP|ê 6Än›lϤk$ªPK
F/Ž•¦ýnÍ!k²n¶ S ñOáHB“®¥O FˆŠ-¾a¬ŒÉMþ² lýh¡›cµ¦^ºèž†À_•¨ƒÎñ숅'Ü~Z““ÀцEÓ%—àò¹|Î%XW\Âc!
æÔ +žEò˜©0~†x5C}˹f)Tßcòj@V¾Å9´8.M•[³–Î"¥7XÔ+ajC»L¡U- Ðî2ŠZn3\СnMeІrÚa‰ssŠ éD:ô
âÃwÿš1$‘2.T_‚Øó]bÂÞ#•²4”c½¯Ë‚â±N] +=}k ívN8JSC1w¡Ša%½[škH[^ƒ n»H$lËS @¹ § $pXÎM[œ¤ ++.\ÀŒJ]íµLo.¤R` i¥ÑS&RL nì±o + ùÉXŸ_§1¡b¯Ì‰ûMH$’¥²µx s%ÔC<‰Ó±e½Áný±hQë‘ }|ç^‘+„¢~) Pßc‹òDs'ˈ’9Ž—îÄA–I/ +z4$áíÌG÷ÜTl]#~Ö…rÈJåÄ>'..Ñø¢ÿ9Æ#9`€˜w\É“nZ7 Ð묵e¢pB=wQhI éû;#Vê3Ì&’ÄÛ]_ùJ&ê4N‰!€Ìð™{$óqçHàbÆQÌ’:À«cˆu9côX'QïÐã拨gh÷X3Ä£ó"jBÝuVéò%UÁ¶ø ¾3e¹§†IQ,@÷Ò •ƒt~wßÃiÊ.óé CÇÔZšÑâPÐh=5[Y =Hü‘`¡¿ÙÕ΋Ëmc*ÐOg + @cõ×2 LRƒsO½+÷µ:@á߉ife+eåâð=Ý`_dèÛ„:QÁ¬o¦)DíiÒõ=š´7íÞúŽÅÿ\Ç‚½×½ÛvÙeíT]ÑóvýÙWýŽ«ªQþŒß
±.û]e3”ý=åôþ5z„a´aöUÐ!Í Çãº
+\D3é •Ý+s ÙºñÛ6¤ãk6q¥‡^ஞó:%˜RñÐ阳¹*_A1§’“YÛgò +§†uí9(§å h
r »ôÇ(šð/HfÜ#ì#ÿ¿ÿPåôW<ø¦.Ô"Qpˆc +o‡çÆýEË9ëÿ½¤oendstream endobj 926 0 obj << /Type /Page @@ -2890,30 +2874,43 @@ endobj /D [926 0 R /XYZ 56.6929 794.5015 null] >> endobj 346 0 obj << -/D [926 0 R /XYZ 56.6929 636.7498 null] +/D [926 0 R /XYZ 56.6929 599.8623 null] >> endobj 929 0 obj << -/D [926 0 R /XYZ 56.6929 606.5729 null] +/D [926 0 R /XYZ 56.6929 569.0452 null] >> endobj 925 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R >> /ProcSet [ /PDF /Text ] >> endobj 932 0 obj << -/Length 3344 +/Length 3511 /Filter /FlateDecode >> stream -xÚ¥ZÝsÛ6÷_¡éËÉ3Bð§OiìôÒKœœíÜÍMÛZ„,N)Rá‡]ßÍýï·‹]P$EɹdÆ°Xüö“’ þË…Ž„$á"NBy2Z¬wÞâÆ~ºL³rD«!Õ÷oÞ+‘ˆDùjq¿¬¥…§µ\Üg¿,ßýõí—ûëÛË• yK%.W‘ò–?~¸¹¢ž„ ï>ß¼ÿðÓ×Û·—q¸¼ÿðù†ºo¯ß_ß^ß¼»¾\I I˜ïó -'&¼ÿðñšZ?ݾýôéííåo÷?_\ß÷gžWz äÛÅ/¿y‹ Žýó…'‚DG‹gxñ„L±»£@Da¸žââîâïý‚ƒQ;uN~Q E¤ýxF€a0 ô ªE %B~`X¦;GÒñ²1õ“©ñÀ „Ð÷–w{³Î7/yùˆÇ„ÅüÉb*N°€Ëìólõ«çù/VV¥áYC”ʋܤ,oÒ‡Â44¥ÝòÜ®±
µ¬6Ô‘Òãˇ+j 7úÕ÷c·%ÍŽ>çEA×SçmkJ^¸ÌÉÅJÆRø:ò¡%EAùKË—ËUà…KóGÞ´(û†GƒFÀ«c׃¡g})õÒìª'“¡c¹¼©Z k·i;#HßóD ã
Ó}Ì ÎDìKG”7´dJßÍËse·Î¾‡ ‰²hËïÚh{r;R'¦7´3 ;XÁø¾!‚f$»<ª)×EÕ˜ŒÞò’žYÕ=Ø€ö·Ðˆ#Eñ„Ç^(t0š5 L´R®g
ƒ£Bk³îêîÌÁr€ #D°ÀYzªFª~î- £h¹OÛ-ë¼YTó½”KGÑcû]'+¤mgÝnßLÆ¿u°‚©sÓ¤-µRw•ør ײ-^¨‹ÞY@Ôõ¼¥°W ÂQ´ _x^6m}©—ݺu—ÝVî²éÙðó9o·³ö"2T #¸.³5Ñ÷5g."Å Vš#ºÞòÆ&ö lÐN¡
Âßò¶eôef“vӦ߼â!_A$”L´S?¸¦LœãIƒÝSAÜótØJùÂó}y ØCªÓÀî©pǦM[´Fëæ$²Úƒ‹;ËBO5ÃÃÙ¡‰Vј m´h[˸Á'C; ®ÉþqÃá)ÓýÞ”›³ÃÑxFEO‹MK>Áá(ãgSi×Ì;®U /ô¢1À "&š™{ÁµªÄ ˆDœBÖçŽ$> †z$*8D´ô䉧¸Q‰Àk8PÒ&¼[Ћœù_˜æ(g3ÐVõË¥”Ò /—Œ¿ò€Ò‰Šî Å.e•ª6…;2«o¬„ͺΠ^b‚X?‚å=™,D2ÀˆF(Ò`ý¸ Æí -u2†Gµ7uŠ`nlæà/›n½Eåx4ô¼ÿÛõ¿¨êT6©5¯ú$q Nà Z¾¦—nŸ¥”y 3À¹òÇÒ0ñ¿! jP £„•ÊRîyaKŽ®v5hë‘J:‡(ÑýZ0@“¡È³FDº -ù7vûœqÏÔ±€Û¢Do âáߺ¼&6Ùgtd9Ôá.6͹EA“)(if<pÎÐÞâíáè&ŽÔü±M»¦µÙkÓAšLC|kÇ. Úƒmº§´èx§Ù`'cÈ+uÄ̸Ÿ7¤·sÁŽaèb/¾=B¬ŒD†“XEûƒÌè^ý0qÒ€9 ¢ýžz,F±asoÛ²öó9o ÊÁKœO˜¦î>ú:ßqvdw&Lj=E.™é=ìÖ¦¿Û šÆº£
„(ôžuKÖÇe DZ©iŽ–·¹3¼ëªÄ[zìYÔYT)Ç`.~;øߺíölÍóse6ç@O¹TÀnù¦{h@ö6À´™%ÂMOçÿ¡’B{ú•üHuÚ ôT6Ò©ÍÆÔµÉVˆÄ#/àad¨ÏïßSÍ00ö‘Ð:c¬îhª2‰SH ,‹¼¡|ÈÚ—½¡"ü-ØÀ -C¼)Øb-¢8Öç¹è©fØMC*%rÌÇý%F
5æš42Ð`ÎÁ¶— †µÙQêýÖçj¼„1ã¶3çEî?^5DŽ"n«=uæÉ<½Â˜¶aï©ÙVà rVUKxŠ¡d0Á“õñÓ 2u˜ÚáfþX]Æ÷:#z'"1‰€*TŠrÆ‹Î`W>”Ä8;À™²âå -òÍ ¿È–§×è …_Mù{ Yè' mh FÆÐ=‡ô̆ ðÊÆYi2Îø,ZS—TPÉrgÚm•ñ"U¿cS‚ˆý#›•»ü/F-áüQ¹’Ëâ‚OÊ5"® Aú"OqêÓG®Øz[ÃñX|ƒ±á.ùda*()§‚ƒYäà¨=TÆ™¬ót?tÊàZÌÞ4s_ü”ž”êÏ_ Džì?ج%rYË`Ç ³uÒªÔæ åt#àÔ -³i©‹×°Ÿ©Ñ•ThÇ -ÝfNÙlÇ€ý¹Ä-Ø¢ii |Áäƒ ³ßüœ4á2Šñ›RrÞ„©N›ðžj T;„ãƒY5ø=ïØŽkˆiB?>ÏFO5ÃÇÈŽ'¾Hü ü -ˆ /·&¯É]®·ôÑ:¹Ä„Mä–ZV„>Y&;’ò¸(ìÉœö H¨’†ïd% áð•õÑ'H8Ž'–K‘© Êâwí*/f.J ø0 Ø(‚‰uƈ¾fQ“ô[©b+]¯Í¾åvÙ<›º¡—|COXÉ’ªCÀ݇ã JgÙ÷£@$ýï+æ˜gœbž
+¶aÅöÀ°r]Æ¡§‚±]¤8õ: )B¢²^ð· è†,jp‘–ÐI鬞'ü3 ´â²V Jþº’LF$ì ´ ^Hæ–éÊÌ0錟šÚ„Ú*ó -Mݱ#üåQ/B*ÐMcO)´ê `.d‰¼ØÕY=†âºÍŸŒ˜ûÈ‹?è‰uZ@ ÄA•ûØ·çAjócUÆeœŸ9Û:ñƒ® ø+¬áõèù¿ìuø% „‚Öþ‰‰žÚObÇ -”SÎû_… ³þ?ˆSäÓendstream +xÚ¥ZQsœ8~÷¯˜Ú—Wí!@ˆÚ§lììe/qr¶sWW»û€Ù¦– 0öú®î¿_·º¥†oÕ%UFˆFjµ¾îþZL¸ð?\è$Q/Ò,&‹õæL, àÙOg!ˬœÐj(õãíÙ›÷J.² SR-nïcé@h .n‹_–ïþúöËíåõùJ&b©‚óU¢ÄòÇWÔ“ÑåÝç«÷ ~úzýö<—· >_Q÷õåûËëË«w—ç«P'!¼/y„#/¼ÿðñ’Z?]¿ýôéíõùo·?Ÿ]Þúµ ׊òíì—ßÄ¢€eÿ|&‚(ÓÉânDf™\lÎâ$ +’8Š\Ouvsöw?àà©}uÎ~q¢ƒDÆj±Jâ@Å™š·²DV[¥QÀj3oåxÖÊN +¼-‹Õ¯BÈÊL †:Qœ.†£ Ìí¥f&“‡2 +d¨Æ“ß>šóU¥ËmÞ?ÖùÆÞéesO½½{Ì +Ú‡¾³3í“i©ýÜ–½éH ì; ´=a°µé¸ãÃKÔˆ…T.?ðDuÓó˜[³.q6S|= +ê¹{aI2ÄC›oX¦Ì{zöœ×Üêºv¦.Hª+ ê¼êÆ{š?^¶çz¹«ë²~ …zuG ¥]•Úïx ¬$†•Ü ±ï_x€ XC0¦Jðb +S;XÝÔfÆd +T‰{©(»ü®B\à+¤84À@ØPgØ‘Óå âÉ~•2uSÒ[çÏeUQëÎõ +UlÍz×v°gÇ¢gœQœÔÀKͨ0 + $‰h¢G‚d=ñ΢®ýy¸tû8‘8N| +°R'€í¤pÆ®Ï{ŒFëî(²e lÜI¼ÔŒ#dÇ*È´JÆJ1€81 1_ †(vxb`ã 7<1 +H«¥'ð +E[|wLO2É‹†G{z¢¢#HKCŽ #ñ˜6 +¨ d
—jš„g‹¼‰!™ÿ¥£gƒ0À• ú¦}9ÃÐ- 7—‚?D3 + ®€€Æ>Nhä„ ‰"O±]Œ^S>13ó¬F[Žì{/®nèUæÙ}³n*ž«Íï±a»FƦcÿ¼Q…cF8È')ã[/¡NĪC›ԕ.›ƒ˜^º¾M^Ö”€±ÂZGð’°±Ïø š±”ó¸S¡¥ÀKÞ©{JöÄg¥u¶XAíô´ëcwfŠ<L¨wìÀ¹gq.Ù¯›ÍfW—ë¼7ƒl?Us—ó`úã ÀÂèŒï…N@œ…l 4›UažÊõaj„ +ÃHœÛ N>¦|:äÃáìça†lhgÁ¶æ{ ”x…èK ܾPZ¯w,HÕ¡íq~Ìa&¡ãr:B
¯Û¶ÜämYqwmLáFµXÃlÍÍå;¦|¸Ù´2l¶¦ÍÆä²Û Ñm +¾Rù¥Ž' +µl‘ˆ«ÏW—hž£0‹À÷ÂP¼B¥‡RÇa楬Ï7M _™ëg«ÉÝl©’4Õ§µðR3jŒÀ¦¡ˆÀ“ê‘ ·çÈZ¬ +#ˆ»QªÆ:ü“øªÂC ੇ« N"¿‘3*O·Q +?Úó—:ŠÐO ÛÑ<Œ:Ô½„òÌR¸åà¬4g¼V½ik*þU¶Ü˜þ±)xÆÁØ ÁÄò f•®þKÑK¸~Tî0‡¿bñQOΧC|"
›Š„âÒ1¥Ï[©Í(öôF°ùφ³”“é(I9 ¼E ŽÚCgœ)ÁìWÜØ9o Aj1[ÓÍ}ëS*a¨þüÖ3 +Ï>Á q:¡t€\b¦zhcüɈ;¹x1s,øa:ˆQÿÏúŽEMòOlSÅV¾^›mÏíº{6mG7å=]a$+ªö„»÷˨´žU_&Qù_VÌ)ÏÐ?¦<Vl»ÀŠíA`åsÄBMˆñôë,&†DÇzYÄ_1 ª¨ÁFZAg”³~žñLð¡5—%Zi òw•lBQÐ'0h¼PÌ
³« à +ä3yjZëÌ+ u‡&Lð—ƒÞ„t@7åža •? +´ÌR§.(§š'‘-ÓÕÿÔ*q›endstream endobj 931 0 obj << /Type /Page @@ -2926,42 +2923,34 @@ endobj 934 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [250.9056 636.9561 324.559 646.3657] +/Rect [250.9056 591.5389 324.559 600.9485] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj 933 0 obj << /D [931 0 R /XYZ 85.0394 794.5015 null] >> endobj -350 0 obj << -/D [931 0 R /XYZ 85.0394 101.0136 null] ->> endobj -740 0 obj << -/D [931 0 R /XYZ 85.0394 74.7058 null] ->> endobj 930 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F58 631 0 R >> +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F58 631 0 R >> /ProcSet [ /PDF /Text ] >> endobj 938 0 obj << -/Length 3525 +/Length 3451 /Filter /FlateDecode >> stream -xÚÍ]sã¶ñÝ¿Âo•gN ¾‚Ó§Kâ»:Óó%Ž3m&É-Q{©ˆ” ÷×w»à‡DINšNoôÀ° -ùõâ§_Äå ¶ýÍ…ˆtêâËgø#"™¦êr}ab ÅFëвºøþâ»vÂ^¯ :Æ?»(VÆ^Nµ‰ ¬?Îe%RR§‘ÕJ·\6£\XÈål×,§åoójåþž¥²‘QR^ö'>X¾ÅY_÷Ö—ZFF(3$àf«~ñ.v=Ô4J´IazÄxÉkBΖD©VŽqÞ\Mµ’“f™— -[5*2¥OÂ=Ið°Ú4* ÂÏ™o”pº÷wuÛ -ÊuE`^f«œzgË|ö‰Dþ-ª-Ÿj¾®¶/„¾Ê³Oaqž y -ƒw›•õ"ßòÙŒ,[ ¦¦fd4êÛ<_£\xÓÀAP¡¡ˆñ‰Lu OVEù }…S“çe1[Rë,+ x@gÛɸ{\6ÔÆ?¼ÐH\ ÊÏB¨ßðX”àpCˆÓd?Âk(BÌJˆ‹@EàXy±k™Õ4Ù¼ðÓ<³JoQàxcÂåŒ3ÃÐÒ -è'ìy¸½Ôü¸[e<êg¥LGFS ¿¢ï l"b0.ˆ8M0 ;÷¯¹dI¶ÉÔ{[xÛÈ—P•ÞÄWúD2ôÌ;MŽ8 -%á¦~W\a"!‚$ä¿mŠîVë¼^6Ÿ¬¸zE_´h¨|ÜSzjL‡Id{¦î9žS=ÙxW”Þº¨´/òÜàC^ -2kBhBn˜˜!ÜuM`k¸^ƒTe˜Ù[]DÚ;X}£†[T’j;šMV×`wÆt-Ž”Žå …F´tÙÑeDKõPmÄ~¸ç;É~›.ŒÃFBj…˜X€Çö -càº×ºà- Åa‡9عêïH¦‡4b[
áÒ°‘Í ÆðUïá~FâÑÑÁbâŸg¾UŠ#ꦋbׯR·i;h°éžâ½éR‡Ìãȹ4D¥'„ÄDZëd($8í¿v5{™yQcÖ¤> Ü8㳶 ¤)R
‡ní¥Q2²Iš¼& ®GeœóálT £B ¥€Æ ˜‹Á0b8Õ4ìijD%ÊÄGÒ)E“FêHK)wxý©æ>b3ñi6k!5IÑÅè–Ltr€ÕÙ³þ¡˜DE)¸ð>ýÿ KùF&æÁe&QbÓ#ÕŠ–ËBœ8NO\ýL$eý½H3Ë9cjiêÜa†)^‰xª1îõéúŒ¹çÀ4H#OsO; @ˆäD‚
Sè],×ò§ce¡>sV%˜KIÏp -cb{:\2kD¬N1«#ã3æ•¡ÝfÙOaÎxü³¢uB {t|ÆÜ‚‹Pjœ=Ã-¬ôjöüÇ}øn½ÆbõÈøs™%ÿLfiýS Ÿa†“NÈ~àüÇyvJ {äüYLëJùÿXH‚ã›Y$ÅðÀA)/ëŠã±»ñ`ÇÁi¤½*p$.±t,·UÓ¦Sºˆ¤‹tú—Àý𼟡B6¿m¡àdºB¼ïžM -*¤59[lUqŠœ>]bëc /±µX>}ʧÞ-B48˜È)O/Þb¬®÷ - N;\þ¯íõ„»™8¼d¤¦ÓÇ]æz©œ:§ŽºXïV\$R!ûˆXÕC]rðÐL¥u -7ØxóÝ×wW·þx2–‘úôÄ“”¯Â:RbïfTæ”ÉÁKn+½ù(wÆDr®wôp%^6Ï nëÄá,¸y3[N W»üðlUd•Ð§×n±F œH"+ú;éÕÑëNÐ&“¶ÏÓ—V“ @33 7š€[¦qíí±·Á©âHØwyðk¡´0˸‚o]H²%½¬œã’›dM“¯7M?¯ähEÎ*Ù$rz¯@J´`¯EÕγAk(-ÖÃÒļ˜—axIF€8µ†ÅŒª¬›í•›ìf,õiØ -›UÀ áê€.¸%¶5ÎûGN U%X)–¤Æ'˜±}½Yù’«Onc$F ¸\;ð(aÎö]’ïà ƒ±)–›Ü_¥ —$x&‰„ÔrOð(ÃÞ¥@=àKùóœªÝ“ú_-Æ$
¸cL§œÌž|YF_šßùH(ª¬/^öHnž«þÝdøh„iõ‡2ªó¬2ïÁ£Ø=rý-#ìM '[‰È(m^Qz Š¹]ÌåS §ä³æ\Nª¢ÁTFÈàßòl~ü¥Y iuF ;œ¯ÌÇŸxU7S|IPÔM1;ÔE4':MO-Ýâ ¬=ÔCÐW0jýÅ}ÔËþ Â7ü„½nxAÈNñSžoØÎJ.ðÊIúþËBÉ|<ˆÛ ÞƒdïiLF¯fdìKÙìÐ>.jˆÅôhä(.Ï&0^ûö¼{˜oðÊèÔ8wÁ7a`¨QÈ]£åHDJ[5Bú +xÚÍ]sã¶ñÝ¿Âo•gN ¾‚Ó§Kâ»:Óó5Ž3m&É-Q{©ˆ” ÷×w»à‡DINz3½ÑWÀX,ö—~ò2¶‘MUz™¤&Š…Œ/gë qù}ï/$ãLÒ´õõýÅWךּL£Ô*{y¿èÍå"᜼¼Ÿÿ<±‘Š®`1ùæãí»›÷?Þ½½JÌäþæãíÕTÅbòîæï×½¿{ûáÃÛ»«©t±œ|ó··ÿ¸¿¾£.Ës|}sû-µ¤ô92éÝõ»ë»ëÛo®¯~½ÿîâú¾ÝK¿RhÜÈo?ÿ*.ç°íï.D¤S_>à É4U—ë ë(6Z‡–ÕÅß·özýÐQþI)
¼:d e`œFV+Ý2PÚH[„ +ý&…éã%¯ e8[¥Z9Æys5ÕJNšeüÔÂ!ăú,0q¤L"yÐÛ·cóº(¶2 <
ΗLŠš¾Ùê9{a¸ÎZ¬*©áö_ß~üðöæ–þm¯¤›äõŽ5¯™Àü)gÜbA_$ÔORçÛ§|Û®”kŒTâ€d”ƱòD•¬«\:ÉfÍ.[^ø eµ‚å$kŠ§ ͨdr `ÿ<_d»• êx…=¶KãbË›/«1þ0!„ò×Àmä.¾}fˬ|ÌiÉ…gHµ¦ Ö€œ'Ô¢$øÿ/ÕŽç ÒŸ]]”4°é…ùJ˜áÈPU«9)Õ··?PW‹æ™§{CM´ + +JwE`^f«œzgË|ö‰þ-ª-Ÿm¾®¶/„¶öSXœgG6€ði)i!/SVDÎJ5T9öQÅcY±Z³@,óÃýd%ï" „7ùÈZïó„×ÇåA%‘H9#=¬ò°¼<Ùj·Ù_ÖÙ(NDrzÙ€4²l_R÷äpÙQkï"‹ÐyõI:k¯¤`kžœÙ)DkD}#TÖÔÔ +@ ÿ©Ê<´ÕÔ„ÖÿÃD/ÔÒ hžW^¶Â`ÆÝfe½È·<E6#ûV‡©©*7Ï×(^Ä4p”h(b|"S Ç“UQ~BáÔäyYÌ–Ô:Ã`t±<Њ»ÇeC aüà }Ä¢ü"„šÑðE 7„8Yö#¼†"Ĭ„` TŽ•»–YM“Í ?=0Á3«ôFi°±œqfxZàÔŒ´hND@Z\üw}ˈ!¯NZÂþ«rklÁˆñLä<ã0ŽiÀ4 +þz@`™m6yÉs¢éÁÕ²á^ȵÔàa½/P\fû”ÞÐßÊ/ˆP üÓž Ji Nj…x™gÛæÄsf‘{§#› lXÔdYmòÅŽ<?üï¶lûT°,H3ا·ràb™ölU³w›
[´:QDý*Iôðëj lÝbψQ\ù fýðŽµw ¿/ž"ÁÑ tvÑ ÚÙ±èDY %‰{}pÑvTC8©Ñ¢³!W4 J× ‘gg$÷ÖÑ*r&µý©ãhͱšP[ñ[oòY{÷N¼“cë5BJìÀƒê°ÈS‘?P¢bH~\ÜÑM9ÝÆ'þ€F&‚ ÆŠ œuJ¶eó«-lŽüYVóÎ|xßê‰ Á”ïì +Ù•ê©`3o)Žö˜`uÀÖcî‚Ø‚AÔªznC»Vdx±~¸Ü/¨~&íð:{¢ÂÅ.üªÊ Sº…ð2+Ê 6ªÍ‚¤#¯ûÉÁþv‚ +¡Ø÷|'ÙoÓ…qØHH ðØ^a ¤{ ÞÂP v¸‘ƒËþŽdzH#¶Ò>
ÙÙÌ` §jœ‡û‰GG·Š‰ž9«GÔMÅ®
þ^¥nÓvÐ03êïMW:8dn GÎ¥!*=!$&ÒZ'C!Áiÿ½«ÙËÌ‹«&õaà~À_µ°õ L‘j8tk/AÊ£Äiùš"¼N •q:,Âÿ¹QŽží=J0ƒaÄpªiØÓT'9*HÓÇË)y7ØÈHrxŸþTs ±™ø4›µš¤hŠbtK&:9ÀêìYÿP Ђ ïÓÿ¿±™odb:•ýŒ\Æz[®`´vÕrÙBî §æDêg")ƒèïEÂX_†ÈKKS' ÿ…¦˜ñT£ÜëÑõy¹÷YeìJ*{†{±'mÔ‰Ò»X®åOÇ2 6ʪ _0«´ÅÝš3¬2"ŠMz:\2kD¬N1«GƬ•*† +ø”ÈsO+úXǯØZ,_È>åÓs‹ƒM + Mi}zñkdu½w±à„±Ãåo0m‡¨'\´›‰Ã$#5ím}ÜU®¡—®SçÔQëÝŠ/‰T¨>"VõPW«Ü <4Ó; +ÂÕÓRÖC:.dÉ×â2ØÂj> +¼º<|Ψ! endobj 937 0 obj << /Type /Page @@ -2973,170 +2962,161 @@ endobj 939 0 obj << /D [937 0 R /XYZ 56.6929 794.5015 null] >> endobj +350 0 obj << +/D [937 0 R /XYZ 56.6929 769.5949 null] +>> endobj +740 0 obj << +/D [937 0 R /XYZ 56.6929 750.0533 null] +>> endobj 940 0 obj << -/D [937 0 R /XYZ 56.6929 434.0333 null] +/D [937 0 R /XYZ 56.6929 397.1368 null] >> endobj 941 0 obj << -/D [937 0 R /XYZ 56.6929 422.0782 null] +/D [937 0 R /XYZ 56.6929 385.1816 null] >> endobj 936 0 obj << /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F58 631 0 R >> /ProcSet [ /PDF /Text ] >> endobj 944 0 obj << -/Length 3508 +/Length 3363 /Filter /FlateDecode >> stream -xÚ¥]sÛ¸ñÝ¿BoGÏœpø pú”Kœ«o§uÜ™¶×{ )Êâ„&‘ŠOýõÝÅ)Rrn2‡ °Ü],ö ÿÄÂjÆU/L3Í…^äÏW|ñk¿\ ³ @Ë!ÔÏW?½Oä"ei"“ÅÃz€Ë2nX<¬~‹ÞþõÍß nRó(a×KðèçÛ»w4“ÒãíÇ»÷·¿üóþ͵‰£‡Ûw4}óþæþæîíÍõRX-à{é1œùàýíßnhôËý› ÞÜ_ÿþðëÕÍC¿—á~W¸‘/W¿ýÎ+Øö¯Wœ©ÔêÅ ¼p&ÒT.ž¯b˜Ž• -3ÕÕ§«ô«îÓ9ùie™¶ÒÌ0V -ã8Y²DIåøRvØ´<ºk:Ú\ù¼Šç¢îŠ•Ÿ¨é9,›l3®áTŒ´L 5Ò f9 - ·ÑmGß¿d é¾%yÇ^Þq/ï8²D£kèutvÏe]x›¢Û;zÉèÑí²ºÍòîZD=«Uó„Ü´DŽŒKµ&c"Nb}.¶ ÖÍŽ·uîäîô"«hò?ã æÑÃuÊ#¤¸6ÀfpÜ„
-ȨÀÎêâká™Ø6m[>V…Ç~»v»áaÒíâÐìIGë"è/‰G«²ÍàsziöÝSSÖOAÅO÷“ÿ£ý!¿·öGz߷ᜇš+“”Ù$¶þ ·»æk¹*Hg ´¶hm˜´`\73ŠN'(ΛK@[¹Uú²Ñ
¡Î[]åÌ®¬Ëç¬ZîŠvÛÔmÑN,Î -þ†à³ê%;xm·+óM AŠzM,äE{B„và†»kí+:×ÓÐõØt›qÆõœµ ¹†ÉeUx;"o€ -ŸÏ!oP
r#gÖ¦vÄÍD7z¨Wx˜bó™vœXŠÈÆàÀø â’?0N96.w›~ O§¥—ªl]Y„¥ß]‰GûƒÇ‰s¢ü[r(/” GIyÿÈ]òT ÜGÜ{ ÷ºcH.ë®D¿àXR±÷zƒO?}|CƒÁÅΑÕ*¨7¦!µÿÞm žY}’ké¥ßü ¥i&|âزªm–G qrx4˜¸Èu˜÷÷~i)R¦’øR>¨RŒ¹øc[•yÙÍЊ!ÐInI¡I÷rBAçjÔ K2±× œöYžñu˜H'Õ -¿=ÇéAìBžó]ïøT{1iòxÇÜÏVÈýfK%0S)ŽYØ™-+`\ŒTö
IK$q€2£ÑcAÏv[äG«ð™ -.ÌëªH4“€<çŸgÂ…f¢¼‚d¡s¥".V²§ð²)ó
slP¸QÙÑRÝÝl¶½Ä
ºPûĉ ûÚ:jšMÏ‹+1`.§,¢” õàã—f_hèÚZ':‡¹ÈÑGîôêô –»ý®öŸ¬ñÌ×~™REœ©" -*ž=„ɹùò6”Y®Ô]¼ªûŪi>ï·ïý|*|â¹ð¹‹•!,®‹.ß,Ÿªý\-‹EÐ÷ìöÙ ¤dÊŒ~%
€Î‡ -fÍuŠínÔ̸$f&áúr…
E$· †< "t A RZöe
tOH)W4¢bÊÌtz8&€M`o³Fˆ/€xròm¨Ã&b“ΔÔtƒÐ·:]Ë=yûç[ŽBƒŒE*¾£åîî$*é·Ü,*ë.JíüÍ"žäš'ú<.úŽ.? _ŒQ-wßXlÆíÆ^²¸I³€t›Y-¨¿7‡vUƒkàhÕÛìÇëe"¢ø_F7Ó&(¼C 1·ŸÅ—ž8MA
Æn·G)¸‰ŸnŸÅâ]{Z ·0/‡¨Ý¾l<:_Ø¢åÀB« -£éÝj ±:Q‰Z åû}G¦,6Óððx³ü} -)ÃE°ð,"¹à±·Uú•à -å >cY®–Û¦©&* UébˆvêÔ”úøîjr®@cGäWÇË_ õs/c “(1ó…ÐV¦qÕäØǥײÃðöŸdø¿8ÑœW[çOEtºp* (ËK¬4KÈ òée¶,¸•©÷@Sòãˆ3aS=¢¦hJ„TßÙšaÑ”„ÚdpÉ—ö—|PNäMUQêƒ aÏ.ÃÁ«
ÊìðÚ¤î¯?h€Bj ¶øöuE© ¢ -ÀãÒG¼Ô?ܱ„úÄE+0ecíÉ ah±fô€<Ëý<Âw™aæ1kKß¼|<øŽ&R] æ3vôf1dƒvÈð„ ‚Ù©¾U"D¹ast¦ýcäéâ•–KŒ®+=ígÐ-ã2NR ÂmèÒž°ˆ©“š´xg¤O~ëà ÚDYŽ
ú¡@r¶M‡w†²/–võ*§¯‘èœzÅà¦Ó>|¹«gzCøÝñæxµÞö7ÓÏ~ÔøÛâg’n~h²ï*Â<Ýë$InÀ®ÄP~$ ¥Ç7S{Aªœè¡¯R}‚ô ö\b‚ m¹~íN!d -Cøó?Uê¡F7 -ô[/É$ofzËáž q4õ9ê5F&Ø.Þ[ðd¯þøi -‚/‡ w€|¢iæ2§˜IѤ’ q&^&öåу¿ÂÍ)Ö‰<b¦&é8¸w¬S. #À\&ŠiÞ¹„>føKÐj¼/²¾û§Ç_ãƆAÂæ¾Ò%fejSÈx<TÿËÔ)ëÿ¹-endstream +xÚ¥]sÛ¸ñÝ¿Bo'Ïœxø8}Ê%ÎÕÆi ÷¡½ÞMQ'4©ˆ”}ê¯ï. H‰’ï&“qËÅîb¿!>cðÏœN˜LÕ̦*ÑŒëYþ|ÅfO°öË0‹´BýüpõÓG#fi’af«.—0çøìaùëüý_ßýãáæþz!4››äz¡
›ÿ|{÷fRz¼ÿ|÷ñö—Ý¿»¶jþpûùŽ¦ïo>ÞÜßܽ¿¹^p§9|/†3 |¼ýû
~¹÷éÓ»ûëß þvuóÐó2ä—3‰Œ|»úõ76[Û»b‰Lž½Â KxšŠÙó•Ò2ÑJÊ8S]}¹úgp°ê?’ŸÒ.ÑB™ÙBëDˆôŒ”YÂ4Hmaeš+z!«I! ”ñºi»EÛe]ÙveÞ óÌ•IRgßLíÞn/ÛsÍalíhÿÛeÎÇê~¤™n]¶4*êì±*ZZþZ›²~¢•fEÏ hÕlç/ÅvOCä”V»uÖÅ= +šª³ç" *¶ð
˺+¶YÞy±ÀYˆ„ na`DkbàµìÖ X’³ù]6(Ÿ7Uñ\À×Ë0QÓs ¼É‰z…34) ãòòA¡ÎŸt…”>gÀü-ÊßWÛkîæ‹Ç¬-NNÜ8@£.“NÉÐfxâV&©ÒGt<„ƒUófÓ•MMcš“óæ±mª¢ót )S°,
+]ðùmGß¿fé®%©« uÕK]Í íÑ5ôº„}¶Ïe]ëbK/=ºmV· ×
‘Ôªy"…àZ EòH#<%Šƒªn:‘>Âà¶Î½è½vdMþ§ñ(6¸NÙ w\àGf# +ªÓ!Ù³¡ ³ñàdÜ5Eqáx×b’9Q8@…‰o¤ç² D!ÝÃbäبc¥þã©N/"w r=Ÿ§è{ÇÇÚ‹I“ËëS@:®X<OVL,1‚ ’±3,K`Œtø†¬Àç“8@™Ñè± g»)òƒY„T¦••ˆ@aï 'â…N4„ù +Ë”+ât̸ «eØ0ÏBÒkmI^Û#÷ÊED¸Í·Y»>›ÆH±[w9BOcz(ŸIùnÛ"#DZS@î¡Ò7¶î¡&ö ™ž‰k¼ù·¦ û“Õ®n>?LeÞœ|ÿ¶£öb*ú*°h»– B°"üØÇÁšà© +ƒA_ +Ã'¡Æ:P7ß>‚iÊé¡D
ÏŒ øÉk³ýœ<¶š§“úQ‰Ê(> ˆªYݾz +Xˆu8 Ö8çèEªP¢~aÄ!ðz Kuf*-Ftœé9Å‚¸ñŠË¼w T„:[îiåkí+ž!UTèc¹œSX:„ÈØ”õ.P,Þ³áô +<H6¤ +<¡Ã¢rÖå0¼L–à òDjû'T+¡Œæ®éÂ&¡+-,È©ë¦ h8˜£ (¶ƒS + +£l>û6ƒØ£ÒTÔ`ì¹=HÁOütûÌg ài6d+b^ Q{¾œ:¾)v (HeªDÍ)º^µn¾¿ b:½ŒïZq¢¦gè¤Âèô®UA¸6Ò€,òý¾#“jxx¸Íÿ>…‚¬+ÁÅv褽Ôg$'¥4ú‹®±‡By‚ÃX”ËŦiªÐÊt6D{ê#Ôéîãk`¼8— ±£í—‡k`6ïç.^+LóyŸøYHl-Ó¸jrìåÒkÌÚaxû!þbà@àá +Ds6dq.ÁÏqs9d
¡.œK„Š%óÅŸd¤‰`N\& ‡š ` ´TÂ]ªÇ$œ©ž ò¤¸vX=™X¤ .ýÒþÒꊼ©*Ê$²íS ¼ä /Pêþ"„(§–p`³oWW”Ó šØ³ endobj 943 0 obj << /Type /Page /Contents 944 0 R /Resources 942 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 950 0 R -/Annots [ 946 0 R 947 0 R 948 0 R 949 0 R ] +/Parent 948 0 R +/Annots [ 946 0 R 947 0 R ] >> endobj 946 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [182.6146 546.8636 231.8861 558.9232] +/Rect [182.6146 510.563 231.8861 522.6227] /Subtype /Link /A << /S /GoTo /D (notify) >> >> endobj 947 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [108.9497 119.3949 182.6031 128.6103] +/Rect [108.9497 76.1205 182.6031 85.3359] /Subtype /Link /A << /S /GoTo /D (statsfile) >> >> endobj -948 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [293.8042 73.4705 355.0043 85.5301] -/Subtype /Link -/A << /S /GoTo /D (server_statement_definition_and_usage) >> ->> endobj -949 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [395.8905 73.4705 444.6373 85.5301] -/Subtype /Link -/A << /S /GoTo /D (incremental_zone_transfers) >> ->> endobj 945 0 obj << /D [943 0 R /XYZ 85.0394 794.5015 null] >> endobj 942 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F56 622 0 R /F58 631 0 R /F84 802 0 R >> +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F58 631 0 R /F84 802 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj -954 0 obj << -/Length 3894 +951 0 obj << +/Length 3959 /Filter /FlateDecode >> stream -xÚ]sÛ6òÝ¿Âo'ÏD,ðóÑMœž;MšsœigÚ>ÐdñB‘*IYñýúÛ/@¤D˽¹Æ“!°»vû J]†ð§.ã$Hr_¦yÄ¡Š/›‹ðòp?\(¡™;¢ùêûû‹ïÞ'ú2òD'—÷«ÁZYf™º¼_þ6K \Á -áìíÏ ßßþðåîú*f÷·?¼šë8œ½¿ýé†G?Ü]øp}w5WY¬foÿyýéþæŽQ‰¬ñýíÇw Éùñ¢w7ïoîn>¾½¹úãþÇ‹›{/ËP^äÏ‹ßþ/— öa`ò,¾ÜÃ$ TžëËÍE› ŽŒqêâóÅ¿ü‚,½:¥¿(΂XGÉåÜDAûOkY©R@”Æym¼–£I-;*Ôò¶mžÊ¥—ßVí±ÈJ© Ê’ìr¸îÉîžjb{3Ø 8 ¢$Óãý?[ËŠï×2XÚnÑ–Û¾lj4+dìH˜<
B eÀ”G[Çi 3Ð"—õ± :S@Ç#AÙ>^òàn ²§EäÓuYäÅA8´r• 3d"¨txVSš÷T¯°qº²œX¸˜QªÁ zÍÖTglÍQáŽýsg»~ÚÖÂ<È”Ñçw÷TÛm- -ÀQãñþ Kqlkq -RótQ´mY<ÊŒëwlò{‡¿k ±«hx‚: -LFbÁõ„CDA^èüa L¥±[÷ý”ðµ.Úb1Ç—Àª²$Ó “HDZ mQ9i"r¦é¬+6–Aû♤@@<åó¥aÓ2¦/ À[²˜êß -»Ï]o7$bèd㢦_óù€ –Ï„g¶¶-0A¶óÊ -Ç’ ðo’ƒÌ6Ò&€´ í¶¶û -΢ã`[øãÅIvë‹…ÝÂI¿‘)éd˜”šA>*å¥ò±nxÁå˱"nž˜ô•X: :K -V,—%²TTóUÛlæÅ®_;îP °Ç“0«¡ŠMR“çÐSM°8Jt )_y¼_ÛôgòHô×ñdÑÔ › -†ÕŒ˜».žJô(ziÅOô8z‚ŒM‹¡|²|ê*ÓAcÕ7<u‚# Îök[ãHÁ2 88D@ÅЖhLU.Ö<¬¼àɘeÑ ã(1äôÃÕÃÙª©ªfïWûñúÃÛw9;Ìä;¦Àƒ`XÖ]à© "„.ƒ¨~¡
gK¸Àéž½èW©~îÍ 'í…ºag‚…ù1
í¼í´qêoZAÍ;§Ç$ÅÇK.íªØU='Ú ‡Ìêø™!¥0÷`IGLݹˆ+¯Ø,6‚ßIJR¹ -tz”‘¦ -ö[±Ù’Áë c…Ð Ã""%,â°è¾v<Zñ«¥;|ø•Ÿb×3¤Y¹}ÖM×K\O‡AÛ˜ ÍòT¢öªiá(X4›‰(Ÿ‰q¦°Mf‹».pßS^ñ£“ -â0É%!ñ¯gPŸmŠª"U‡N:P±™Žc©ˆYäZ^`ùÂÙ5üãl‡3ñ©cÕkH©P× ;#D;PÑ¥q®Çæ<- , ÎE\QEl¿ð<²_€PH…çÞVê*4?}›}-0ûD )v&ÅÓgYÆGa˜ÔMσҿ#˜¡U -€ š¹tºœCsè 5ph9”+eïZ¬‘¤ãpéz²RtÕ¶1ƒj&‡jÐ ½ÉTpF|ã`×y<>Ç¥öËœ…G”äIÌ¢1gQ„ò‹f\xø·Ìì©´ûA…;þº‡¾|Û£ˆ:æ ®.[ °¶:5 -FAjÌy«À¦SEÞ‡Ðàeõ©l¸µ‹rõ,ö:± Sݸص |°Èä¦Ð9¥pðcÇâEAÊÆ-ùØæl €Cwéõ Ž„ØqzT ÜgØ¿VÍ£@$ m͵L6ÿŠG;iLŸÏi#Ê‚L%®#˜n7¡ÒÕ/œ†J•øøX, š¬¸6ÖC—œÂ€Ui©˜Ñn½Õn9vÌH ™}“›Š$òã{.vX“ ꚯ»-úP eÚ BÙ^pÄ+"‘’{ -WÒíì™Æ–2
§žšïUt`RIýO¨ž WèzO–$.%÷ñy´·dMã.ù0…u²ŸËiwŸþ„§ýÆ# W¬ŸÜMvô½1,šŒÂ·Ñá Á™æ8Á8äÀüÄÊe·Ý¾ A ½²m[T|kg4ß?#–Å‘5lë{œÅ iÇدHýÝ„PÒTÈfT>ðp+Y¥îyN«¸Ä‰×ùÃm?JgŸËza(Ëi1iÍúH°Çê -ê\pDÚ‡ç øbÀ˜ãẖ€(pœU£tå:9 UÍKQuîß ÞšªÁ8!ÈÝ ŒP¢ã »Iƒ->´]~&J*Ì_S¸¤Û6œV2é¼r×ÇÄ_¦ñ›t±
w7ï¿|¾y0\>»à‹kטeâ‡q.™q*˜ÕÏ£f
Îa#q¦cƒÂáH÷‡¾ÐëþäX6v„îá–Š¦= -y¾ÑÜ .{„¥Ê/5$Ì0^¹ R½| 쩸·èëù¦ØnírŽ]
pÁ½òè‹Î&‹Ïóá©&¥ï4
´‚cNnWS—‹x·˜œ½\„Z 7zÐvšŒš JÜ -›8Ý~zŠDNF -MˆV<&g"® kͲ|l|UÙa ;¶qjÉ'v»„ò
±>…’Ópq -*ë³ánHõr¸óTôÃoœã9#.ËNÀ,ä€Ó¨k Oæ<;žj‚ŸQœŠSüΔŒúŧòQÜÓ9fbýÚW•(w-)6‰S ¦|I@üüÝIôbHm÷<Ç2ŽÏ6–“?mŠ®wK°ß rP%¼ìea" ˜Y¤.§ø;— Üò'îÖÌB1Þ1¦`³ó{ -?ã>ÿ#‰‹òC‹Q’ -€ êDW²N_ƒ[®Û…õ|È:×;ôdœõ-tc»ŽQÂŽ\õ#dQT‹]E?b 8Cùs ÌY ùì`Æ\P/è’?NcñíiYópµ“sÖœj ùs—\ßEîú.ŠIÿèøopl¾¹‚‰; K ŽbÿS ¿B„ß.ëG+K, -ÙàAÖ§ÃÙ”}ï8à ÎD³%´ûyÌFöA“èøÅb2üø¶òØ$Æ—gC“˜¼¦ÿ J´EÿÍg§«zCÓCëdÚðóAÐò«!q刎 +xÚ]sÛFîÝ¿Bo'ÏD,÷‹ nâôÜiÒžãN;Óö–V/©’” ÷× °À®H‰–ӹƓá.ÄX|.%f1ü‰™I¢$—ù,ÍudbafËíE<{€µï.ã,<ÒbˆõíÝÅ7ï9Ë£<‘Éìn= •Eq–‰ÙÝê·yÉè(Äó·?~|óÝÏ·W—©žßÝüøñr!M<óÃ5¾»½úðáêör!2#æoÿ}õÓÝõ--%LãÛ›ï’Ó㢷×ï¯o¯?¾½¾üãîû‹ë» ËP^+äÏ‹ßþˆg+ûû‹8RyffO0‰#‘çr¶½ÐFEF+å!Õŧ‹ÿ‚ƒU÷ê”þ´É"#u2[( e°ÿ´–E” +H©É£DI´¬'µì±PËûÎ.Ê/ëöXÜ\Dƈl6$y²±G:ÝØ$ƒó$2J‰ñÆw›²»\¨4Ÿ7»¾ljØ}×T¶·Èˆ¡†Ôd¤D’HŽ7ÉÓùÍÞËâùs³'µµ+õ
=WeWÜW–&7¿¾¿ /ôØm_.÷UÑÁÎ^ŠyûhyÚ´„ÖY„uo.Z˜1Ù~ã8ž-DœF`NF"Ê‘ŽÙ²^7í¶ qÑÚü“ß;:°Ì€7°œ»¶y,W‡³:RŠí2mÙkI—õñÑÊ$‰´Ñ³T§Q’¦ÖÚ‡
n‡ìÑC|²®!'T‘‘Ovyà ZdÇÜ(i¢$È0$bië.N©±‘(7–8)ª®9á#WÓñW«%à¿ÆÑ ÝÅèH s£…‰d®_ÑJÀz…‡Sj¤•ãÇq$I§‰x%Ø °Î5eÄÃÍ8ŠÎÀ¯Ïî °&¶ J F:Éäxÿ` +§ÔÎÚZ’éH§æ¼©
^¶4„ÛµöϽíúiC‹ó(JžÝ: î=63 ¥èXÃÍÿ+;áØÊ Î“/[Yš”RþÏ™G?/ï Õ¯51•F™4ç; çá„Öyû22ÊRýŠ} ÎØ#áv}k‹~±l/E6_Ý¢ÛK{bh2‡º'gyH§LŒ
ê?#c3â‚J(©Å!áÃø©` ”v+ ¹ÀA¸†QF,~ð¹->[†8›Õ1W8 t‚‚È4]m[üõû–7ù=6ñïRj2Z¡GÙR] ¹¬¶žp åàwÞ& _øÆSÀ}`?Á|mŠ¶X.¨S†Ÿl\€õP³nš°œi:ïŠ%ÐSñL§@X*hJ‡ë†XþáJ_Ü€¶²ØE@5(3EJ…µu±,«²/z~¹jŠUY?ˆ +̃¤ +ÆL4L¢d¢|3øa.&ê*"drPj’AÚ&Ø=¯¹¸CL¼Â¶mV%ž¯åùý3!ì1"â!÷~´ê8` +îzÍvXT$Éüªê´N¨ŠÇ¦äê(ñG˜ ERpŠ†ùºi§k §àLŽ;ÞÈ`…í`ÝÎ]"p¿£g¨v3 BX/±a ÉžžÄ ìš®+ÝU"‚í—;^rGu† Qzâ¼çÒAuMõÈþöD Žš}Å©Ü9ÇSÙÙàzî¹#À{‰U¸÷çþc·ggŸ ×ïѪ¸‚ýRlwÎàe Ž±Fh†a9,â°è>w4ZÓ«™Kwøð+=Ù®oˆ³öûlš®ç¸žƒ¶RQšå)GíuÓDÌQ´l¶Q>!å LfÛ™-îâtûžò‚Œï= €…‚bL¥[¨*G¼Ž*>:‰ã¹ˆé¹-Ê*°^Û~‚u¡Ddâp±»8þå¼ÆKãªrªŽ½î@Ùf:Œ¥b f‘+~ä‹çWð² ÎاŽU/!¥B]ÇìŒ`í@E—š\ —ªS±øp.ìŠB“ýÂóÈ~âB*<ŸlU¡ AóCÐçºyªf ]Ä(dŠý† áâé3“ Q&uÓÓ ïðÊЪ +°ÀA4Q|Ñ4[@sȃ|æPs(WÊÞ·"X#qÇáÓõdèñÕ¶Rƒj&‡jP!½©àÌñƒ}Öñ9.µ/ÁX$<. ¾à(CY¡ô¢ á-5,íÓ Â ØÀU}ù®G¥¡ .*[ `c·aéÔ(D¬£T©óVM§ÐÁ‡Ðà™ºû Aîì²\?³½NìÃ4\1.÷mG ™Ü:§~츀¼,œ²qK:v€+(àÐ]=°#áuµIÓ± ÜgØ¿VÍC8 mMµL¶ÿŠ;iLŸÎiCgQ&ßL·›PéÊNC¤‘HB|,–PMVTË¡Ëjï†0 •iɵõ`e´[ÏHµ'GŽ©Ù1ÁÉ7©©HL” ßs‘êU×|ÞïЇ ”ih/%{ÁU¬¸ˆ˜ÔÓ +®ÿ]ªÌºÞ£uˆœûè¼Zð[LSùK>La ïçsÚ½…Æ=¤?æig¿ÐÈ Žëçw“ =Fo ‹*sá[ÉxPà,sœ` ò`zbå²ß=¡ A ½¶m[Ttk§$Ý?ã*Y‹GkÞ6ô28q3Ä ¯®‰¢ëï&,‰›JÙÌ•4ÜqV©{š;*>qâÀwþ0ÄC@Û×éüSY/í¦w9É&-I öC] +‡#Ý ú û“ `ÞØ#þ¹?„[Wl5íQÈ æþpÙÃ,-!P¾x ,¡z0"{å[íëåKà€E½E¿Ü,¶ÅngW ìj€ ê•GŸÓ°pVðÊY>Ö#£ô¦‘‚VpÌÉÍzêr—‹P äJÚN•¹æÂ¥Vj…•Iç7?=j–“ +ÁúŽ²hÊ \’r&N½!ÄÿLp¸9®úüžÎwûv×x:Çw¹Â·ÔËfßBÛðò7/ý–Ð08î†X/‡»€å~¬ñ…r<eÄU¹Æ Ø€… põŒŒâ‚ÍYvÖ?£8eRüΔŒú%¤òQÜ“9fbùÚWû–”>›˜”„©P’ +Z ö`~` Ž=dü%:® ‰ß?Œ±°ì‡O[m!»ÂOùÏÿˆâ#ÿ€Ä¢%N€u¢/Y'¯’Þ¡ngÖó!ëTï 0 QÖ·Ðí;Zbvøª !ˢŸÃö NPú sRþºÖ›1ÔKwÉoRþ=Â4W;9eÍ Ùªæá>wñõö×wÚ85þ«#àÁ±éæ +&þLpÌqX›ðS‰@Aã·ËúÁ2‰eÁÜ3}w8Û²ï=ôÃ=_A+ÑùŸÇly 4‰Ž^,ºéJÐßÑ ™ÄøòlhÑK¿GW& ‘ODøÏúû¿«~ø!¿†²)ËäË?Óa¦PVO¬+¨äëÿØ0Kªendstream endobj -953 0 obj << +950 0 obj << /Type /Page -/Contents 954 0 R -/Resources 952 0 R +/Contents 951 0 R +/Resources 949 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 950 0 R -/Annots [ 956 0 R 957 0 R ] +/Parent 948 0 R +/Annots [ 953 0 R 954 0 R 955 0 R 956 0 R ] >> endobj -956 0 obj << +953 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [280.9692 755.8266 342.1692 767.8862] +/Rect [265.4578 743.8714 326.6578 755.9311] /Subtype /Link /A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj -957 0 obj << +954 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [277.6219 724.2256 338.8219 736.2852] +/Rect [367.5441 743.8714 416.2908 755.9311] /Subtype /Link -/A << /S /GoTo /D (server_statement_definition_and_usage) >> +/A << /S /GoTo /D (incremental_zone_transfers) >> >> endobj 955 0 obj << -/D [953 0 R /XYZ 56.6929 794.5015 null] +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [280.9692 712.2704 342.1692 724.33] +/Subtype /Link +/A << /S /GoTo /D (server_statement_definition_and_usage) >> +>> endobj +956 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [277.6219 680.6694 338.8219 692.729] +/Subtype /Link +/A << /S /GoTo /D (server_statement_definition_and_usage) >> >> endobj 952 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F14 612 0 R /F58 631 0 R /F57 628 0 R >> +/D [950 0 R /XYZ 56.6929 794.5015 null] +>> endobj +949 0 obj << +/Font << /F62 638 0 R /F42 601 0 R /F56 622 0 R /F43 604 0 R /F14 612 0 R /F58 631 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 960 0 obj << -/Length 3452 +/Length 3538 /Filter /FlateDecode >> stream -xÚ]oã6ò=¿"oç -7òûÅ/¿Å— Øöq¤2k.÷ðG"ËäåúB”‡Ôÿ fݧSò3ÊFÆÊtB€Z
(bëä25Y”(©œ -ùõò†d"D u -ùÙý*ïI»=«h»—‘·«Uî$bPo&å2‡ƒ¥—ª››°*JQóH&M;%6>!B9k_I"£D$úmûb·¯€å´¢m*æeã<á‰e‘V¿M>`MÐ mÕh 阛†}°µ³Ïw7Ÿp q·×ÖÓDÕÐ „–fösãÙ² ÚŒ-àè ¤ ñÕ7³õµ`ñhÏ QÉ™lµ¤÷ŠÙ\´ uÜ© *5c[<lt‡v ÑË_Q/#m“äïP/ ›¼£]¤7”‹‘Üï»rûŠF~¬V2‰âØè7ɤSº£
ª8Êl’Ž?lÊ¢Z¢éjÎœzˆ%‚cÏUóL/Á¹ÃØ9wÀíú|Û—‹°JC#¯øb8ÇÛà9GbQä"„?€¡DŽ6QJaCˆÎ“!1ç+‘Ô¦¼³bÎ>Í"“#ª~cY.>øðî86Þ©ÂÀïÞăÝö›NçÀ•®}ÒÏž^Øp -wãPEËÀ -UœÑÝÞͯ?¾®ï¿^e’Ô Á_“c³mžº½{D?4ecFY µóH‹”ÈaãÊf0UÇ1:]ðÑ.RžKŒ>8WƒÇµtß "ll DU]õ¯„Qä
ŸøÎi -¦±Í]Ï M1¥`ëÙ)
‡_5ß::®U6+ÿ€˜ß GE( .Ž˜*æ(ÞBtÌbÐÞÖqôÄ ì\¦¶¬®©Ó·§¡Ïé£W¢ÎTø#§Ì8Zðç®°ÀÁŠÃû±ª-*60Ä“)fJ®ÜƱãAZ¶W -ÙgþäK5Xl±+ýÖ »¨ƒTüµÀè¢+¤ÙeÅ72®0}ÑÇ¥êKâ-ä(YÆ:šÚ@×Ög㥈U”eæx9Ä: /–KËÂ1λÃÑâf’BœÏÌÛ<¬ &Æ“5$± s1ŠœJ– _¾‚ +ªàyE‹zû&\ÿÓÛ †æC¹§¹ Dz®¥YÇ斦‹ƒ„NO22B 5ž ”n:Ttî ¶¶Ôºš ÊàC‡.=Oéz³eáûÔ†ì ç×;·ëÔR ºLFˆã:
"mýâ'VŒëé! P|1{¦7®2øWS©¬ß fx’D’$ ãÔm!œ2J/fÆï艪„#wÕX|ãD3ÜÜñ÷
zG™ -½åi<Ž&&’&ü„ƒëP‹=KeïeG·ëÔVWI$lfƉ«×á‹80åC?žà&mé¯$U‡'µ8cçE»^‡:º&ÁqO¾Œž§œ·´^žù.øà× s=ÕQj•tç£s¿yÃX &cP ®×ÿïßà ~, ƒ²Vž‰©q¥r–z¦ymŽ9?œ;eý}üB—endstream +xÚ]oã6ò=¿"o§ +FÃõºwØvA¿®d±vÛWmÃí..;žý˜7˲μˆã0³VÑÕ²__-t¤ƒ¼ço¿.¹Qþ±-›Ž:&hW ΖÓ6ôáóϲB#M¹iw/Ü.Ú¦Ûod[3tL°É»¾Ü¡¬€ü˜$ ns›ïúªØ×9
ÂYuœÕjî ´˜²*hÊ7žÁÌ +èàîñ›óGîZÄ7øíf[—}Yã…Z , œrUÂÀyÓ +" ± ºYl{³…™g4 4‰˜µ®Ü +·ÏÏÄ××”¼›H6 ßr³mwù®â‰HÅŠ¼/¹ç%l<e-Û¼>@Ëß+÷ÎyÍp¸”ðÌEadÁN&.ÓHéyã+H‹1ÛŽ9ã;`á™7ûº¯"ü'Äc£ÃÄ9÷6õk†üÄt&iOé?0“àκu»'Ö%Š¥ a$§Ð8¬Ë†[/ížqÖ`XDgØÖ¾GgéiE– %‚?"0ƒˆ$^)²\òt]){âþŠQ[›ëT™xª§×Š;w #y±1ïÀªè ¬ +Ž÷Ÿ¬±¼¡Šbp´Ð P'œ)ûÒ0ÓÊ Ê¹K°Ä$²@‡„šZM+¤ë]Ašyî¹HëPØvUî'ì7tDh“J³#¢ˆµéªpa`‘_/o˜'qœ„±>2E,û:ïYºýVQ ö;Ï#¯WëœG ^MÊU˪›a[ìt˜¢ä1OšvŽm²Fy]¿T +B þ÷mýa½¡_ ‹¤¢i*eC–ðLÁ²PÅμM~Àš¡?9ª5~¤Ó
Ü4bƒ >Þ}ùróÛ`÷[0m=T
é’Ðÿ)üÜøkv¢‡.
8¹¥b`PüÅ7sGñu ñk €J.d«÷+Ùæ²õ(ã$v +d@éÔNuñx8 >uÈ¿"^Æ„Æ%Éß ^d#q}[¼ÆX¯‹×€…ß—»ÔóSÉRIEÖ¼MyÀš!=9¥ŽÂÌ%é”ö—mYT+T`cÐÄ€É@;a4ïŠá°·'I¡3˜xh“‰Ü®‡øª\«4Üò¢³ƒÌCäû9aŽ7qì¯aÌ”““€¯Ò?3"Ù3$FIm1Â*bæÓ,4&9‘ê×(Råòwò´cëM+4üém4:½ëI’uãCŸ(x|9Y@B¸îpL4B™,ŒÉ"3œIlè´6#ÎT³ú©Á”ZýmAZ«³oòë
AöXH±X—Å×Þz7 †dß >`ÍPŸ CNÈs¢M6ä.Zn aœ i‰ò"7Ô甆—J$`¨XCØ[ÏÔÕD §&€Ó½@Jö)§Áyå®Ï+¡¼l7Ü6l”;ÙP3@ÌÔ×zO!ÕBit€ìûVÀrCN°…ÄÈã1¨(«g:.æ~CŽ=>"¦ehw_)ÑvlR<˜Tì<ç$i¼¢hi¥%É,ÕÎeû.B OW’à¡Þ§*øÔîfÄ; WN¼t £ØsáŽ8FF£œ•‰°>¥ñȤGo0•ZˆÑÌàäVyUϹš,vƒÁÖãW¶®@á²Ô[¢®Æhö|AeÁm&Ù߸óC¾kæ5*=ß9É›î€15 _âB›Y=•¾©ð Y'¨#Ó%ÂÃ_#Íl9V +tÓ {'b:gÏ©¦âͬŸP›uóZ`!íÑBVOM»›½‰,Ô:KÇ¢›‚y.„ø+cRr¾°»rÁ¾ædBû\DAøüD¡7ÀÖm׋~ãˆ$%D¹ªÄ–@–¥°åÌlLtŽÌ¼ûO œY%3}º#C:p*¢²ø¦]V³åvxSgÅË@Ü®gØyžÌ™÷Þ&Q˜êÔ«M¾ÝÖd:T,iuäó +`Câ~%à8Ô6ȯ§½+ m=>¶ ö.|¹†È»ŠŸÄ£ñ‹<Œ0×”W2h<Õí#¥‚<z¶?¶ÌÌj_}ˆ…ì
¤]µ\ò;™a‡‰ ¨ CìNø àô©® +þï¿ËòÓš¶ endobj 959 0 obj << /Type /Page /Contents 960 0 R /Resources 958 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 950 0 R +/Parent 948 0 R /Annots [ 963 0 R ] >> endobj 963 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.5469 204.2481 428.747 216.1483] +/Rect [367.5469 174.8193 428.747 186.7195] /Subtype /Link /A << /S /GoTo /D (zone_statement_grammar) >> >> endobj @@ -3144,64 +3124,62 @@ endobj /D [959 0 R /XYZ 85.0394 794.5015 null] >> endobj 354 0 obj << -/D [959 0 R /XYZ 85.0394 437.6905 null] +/D [959 0 R /XYZ 85.0394 405.7134 null] >> endobj 962 0 obj << -/D [959 0 R /XYZ 85.0394 411.2314 null] +/D [959 0 R /XYZ 85.0394 379.9387 null] >> endobj 358 0 obj << -/D [959 0 R /XYZ 85.0394 188.4473 null] +/D [959 0 R /XYZ 85.0394 160.1112 null] >> endobj 964 0 obj << -/D [959 0 R /XYZ 85.0394 164.9671 null] +/D [959 0 R /XYZ 85.0394 137.3154 null] >> endobj 958 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 968 0 obj << -/Length 3263 +/Length 3319 /Filter /FlateDecode >> stream -xÚµËrã6òî¯ÐžV®!@`å4I<‰S›Iâñž’ (‰±†" ‘²£ÝÚߺ>%Oöá©)6F£Ñè7Åüã‹D1•Št¡Ó˜%O›ÃM´øsßÞpÂYy¤U ë«Ç›/Þ)±HYª„Z<îz´ ‹Œá‹Çí/KÅ» -Ñòë ß¿»ÿöïoou¼|¼ÿñýíJ$ÑòÝýßîúöáí?¼}¸]q“ðå×ß½ýéñî§Ñøêþý78’âãч»www￾»ýíñû›»Çp–þyy$íA~¿ùå·h±…c1™šdñ/ãi*‡›8‘,‰¥ô#å͇›ŸÁÞ¬[:+? 1!AVSƳLR¦¤A€\±ÄEÑòíf“7
¾®Úc]Ú3%Ù£-VB±HFH#,ŠÅ²í“/Û}ŽM~|Îo² -g×4y¼åf™7í±Ø´ùÇÖYƒ _ÖõÄî‰l»¥¥´m½`r¢üû ˆÕGbåÜ´ùîZFzù!ÏÇ·ƒ„"'!)™Š„#Î ?.xèÉ= ¯zø(ö¾°&TÈ>䛶ðÇSŒ3>Q%«=â×®þ áæg*VƱ°«xÏۼ͊’.ÝñÏ}ý‚€»Px6Où¦ØñÅÝ<‡÷ -ÍÓÛá°ƒÇç:b©ó6}}é]ÒrÎ ;ϲËNe‹/E3t(OÎê.Þåø -ÑJ˜?wÅÚöÑüqášfè -¦T¨•¦Ç›£ -‚á‘¢% áÔœ@žg|ÙÔ§ -´™ -€íi³òåHFÆjT®È•YQmìݦÞ2ÒÐBz‚ü©XeÑžÛ€43ß©x©TÞÈD‰c;>•[„}o -©¼í~´3Ù$.ì—è–U̵}Æc;É‘›2Li‰® #žŒ}Ä“^ÅQ9@±10À°?›…‡ÚNcyÖž¼Ë³¶½cŸò…Ÿµ Š1Æ’ÜnûÇSÝä~Û!φ"ÜDMîw”Šª±Úûßk]$ß´s½†äÆ6$ÃuõóÒ¶Í6Ÿš/)»vö$T®àv1hXddúJgÏ£¯úøÓH4¡:ìì+šÉI“ -¸D©!/“`°^a!¤Ÿ* òZ{‡º/ojô]Ì$”H®5r5Oèc]ÎVçJŸÕª9W »
†©AŠƒ -EB_ç!`Í01HbÅŒ‰‡L<b>¬*·~ÉÜ õlƒ?‚2!9êø&ËæP×ÎØÁ#„À“Rƒd6Y¾…?«iDá3«¶£Îû)¨œM<jÆý*D\k o°¤ÌÖyÙØQ|GÚz¹ö•zÀ±qÊöï Ãé5MçDsMgQÄ›ò¼ÍDø%e·ß畯(QÞ€C‚zaà0:RAb]ÂSg"x®llj¯§}Z.á‰\w«_“V¾->V¤åä2ÈU[OP r¿Ë± - É7—.‚Ð,…ðþŠ!ô°®‚Çê Á)Î.?N+Sð'†'×÷X3 Œ@$̨1ƒ<9‰Ïé,Hyr,z•© y²}±gŸtC¹+ìì -huvá&÷„Õ¯J§ ™$LÙOYýdŒÒ„rH›QšÐêÄOÛ„+ ô™dê —dÂsØQ‚×ñç….Ž°ß $¥¥$Yª§ ›7øÊïàSk -ú@jï Aå–…°ía‰@ÞõDp×<—^¯ÃîIN.KXÜÚâ .ŸsÏ.N13©Š§Ý™ó-ç|IJõóåî¢Í òIÞèq©pìëãš°»Baë#E[Ó~—4tZI0‡XG¾&ª.½ý€¯ñ¦æ -ÑYAÀ×6$,IuÒÿ ŸÐ÷ø{[(í2ȯ}†”à¸ÂÄú”°È*Ôaâ©>ºFHÊ}ÑžúOæ)ï¾ÔLrt‹›?Úõîà¥w-®:ã𚪣¡/…‰Sƒ8å ˜Ma¹õG(4«Øyµª«™“¯î@Ðç͆H£Ä|éX2e¼³k³OX„ó¥ýé‚}â Y‰¥¬•¨øŽR<=¨Ð
ðÙ}Õµu͸N:01Ü,¸ÑÌHPŽÏø‰`©1fþ÷#«@qÕ'éœÎ€?)À9i¨ÛÆÊ¢Ò˜ÉDØšCþ™ô_c’‚(†[ 0é<àë&¸-A±—ÜŸôÊn!T ºè -¯ØF œB0¡Æ½«±ù0æ Ìú<Š€“R% ~;1 -ªôÓjÙ8û½m;äDŽ¢÷…à®·ÃÞCìóø¾â©œµÎˆ”~Ž ftH·B¾àåÓ¯HIXtêw¾lÍÿÈÀÅ›;ZÉkÉ}¶;n\[ŠúT@2P“A+n\“ŒV¢ì,¹]< öžY²˜ÈÁÛ\]kóÁNÒÊ,¥ '^¤»¡]©}3 «ì@CÁ
Ã(––Òß)Œ¸;Õ¾½E àº)03T1»å`ÕC§¾Â›£gv 1wô-²º@³ ~j 7Ùf_T¹oüÎ椗 ;oÙ%½&iÏ)i—qÎ}€åKã?¥~ÿ+Ék¸—EyÑïtM-ÐÏ„ ¶óìÒo!+°?ü›É$á?Éú¿þ}a÷ãËX3i»Á³)©€Ú"6@„˜²"‹ÕÅŸ¬MYÿ7?²Žendstream +xÚµËrã6òî¯Ðž"WâA¬œ&OâÔÎ$ñxOI´DY¬¡HG”ìh·öß·ÝàK”<ûòÔ›`£Ñhô’³þÉYl…MU:KR#âHƳåö*š=·ï¯$ã,Ò¢õíýÕ×"µÊÎî×=ZNDÎÉÙýê×¹J\…hþî§ïo¿ÿÛÝÛëÄÌïoúx½Pq4ûׂ¾¿{ûáÃÛ»ë…t±œ¿ûáíÏ÷7wôÉ2oo?~G#)=ν»yswóñÝÍõï÷?^ÝÜ·{éïWF7òÇÕ¯¿G³lûÇ«HèÔųx‰„LS5Û^™X‹Øh FÊ«OW¿´{_ýÔIùÉH(
²: Ñ=:)â4gIœ +«•öÜﲪyªw{Ø™Só‚Ÿ›¬™˜(™ß®id¿É ØfËMQñKÑÐsuÈJ„ô¼ÙgËÏùê
¼¥Îªºù -੨ M‘jûóÜ ™…§°hòÝs¾kxÎ` ±P±T<e“=3/UMÏ|}-Ý|/y/‡ªÌOh¶ÐÚ +é@ )EÇÊÓÈ–KÄðg»¯é™ñkO>ð +r!à!÷hU4ÙC™¯èæQ +|‚.Á±¼ÀI&©L‚À(ûÀh©p?pH»b…"Ç×ýµœO²™(‘Ø4pY?áyðœWB–Öž°ÎÌ&ñü–ù(˜X]•G‚¶yV\ J|—dú~=zxE"…èiØ¡íËÃ4:›¾¾ôéÍ(êòuv(9h£Ðúä¡îBM«ü +ŠÇÅ¥Õ[¤Ó嶨QØñpý¡)Û* €ÁìLÑÄ=S„/”A[0‡Ï9A„ê7ôÌCôqƆÄxÜ=Î àS—?ø´7%U€gICŽª/:v³~$IO?Gú‘°ûH\« €7f:q=¦á¥§2€M*ì2 êùÇzÏ3÷›ŒWÄb ¡¤ †ëà–¢á^ÚUu¬9üÑ—#hU o%P˜ÊŸÁ¼h€ò¢Á´nøF œÉŸ=ƒžp¶ÏÂôŒg¼TVÒŒluäÕh¥P>Á ~Õ ·GÎp Õx~ÖÆL î"Žäe#ëc·²«3³Ãì._€T_²Ý +·<6·D +Eú2#-Ö'ƒƒ˜—¸þ¶N-ÎêÖâ¬n-ÀÎâð¥µ8xñÚ Ïæð°õ^ àïŽPvK~ñ¡ +ã>Öù<¡Åê\é³]4Ç +t·¡05H ¨P¤’Ë<´XL Rc…sfÈÄ=åÃIÌ…Á/¾•ŸXPÏ}먔ŒYŽI›øÆóf[×Þà ^ +” $³ñü-ü1^Í#–žtПཟ…šÙ™Q3î7¥LU<Pxƒ)eö—
ŽÒ;ÑNæ¡Foq0NBÁþd8½æ¡ëœ(`>ð^,ófoS ~É[ÂåébÇWœ(/Á!A½0áò¸ A—ðÔ™ÈK¸K¡ö éiŸ–Ox"ßÝêW£U¨A‹ÇŠµœ]»jôõ6«ìªÖ#…æÒYCÀ,EG.½l}¬ó†Ðbu†àgïNËRð'NÆ—×o±&Š…³cy²QqÈéä<Ù¨^eŠãmžŒ/¨qøäÊ}a‡Ô&ö(¼?¦ÕÙ…ÿ¸a¬~UzÚÑÜ[¼Äì'cœ&¤Câ-Æ0Mè õÄOc•:L:
+O2á9ì%Á€ïõÀóLÿFáA{év®™>(9íÕ¼¡+ª°BHän’‰¨›#ýnÒyn'TìNúÊ´Õžø,pH;2΋âK£ÄLt½]þ ÚJ=a|IK œ£°ŽîÝ/Xoë‚õ,ßr,!ËØÔåIz!#)b:——n±&Ö nd…IãÑâÃÕŠz÷ðÀ7‚ð +HÓ OH§.'’ŠïFhó=¥¸ÜBˆÚ Hò®'†»æ ¼ôz ¸&S8ø,QQq‹ÌA]>ç]*œŒp©5§Ý™ãµ”rÎJõËù¾"æùIÞp¹pìëãcw…Â*DŠ}ÍëÝŸÓÐÓ’Hƒ9˜Þ½üy£ÇŸ~„oê*ÞYø‰¼Šù*þ ¥u9ðë7ð´‰}J;É*Ôáþ‚¡!‹ö4Ü–§²»¤˜åè'7/a´ëÝÁKïX|1t¤á®Ž†¾> +À©<ãÀ ^Á¢?"¡¡bçÕ¢®&v¾hqzD>o2œ@BÅî H
6œÝ>ûLE¸œã¯ðIkàï\°”E‰bÅK’2c’Ú$ƒ +ÝŸÝ•¨.ÿ eP§@ ;é<z"¡ ÿ‚ß)‘:ç¦9´h).ú$½Óð§8§êöbå ¢Ò˜ÉXaÍ¡ÿ‡LŠ¯1 IAdàÔLzøº .@KÈFðZ÷§ƒ²#DŠÁ]ÑcÔ¡À©”PV~540¶Æ‚ƒy8Ž"àI©Kn;1 +ª|ÁÙýò¨Ë~ÏFÛ9Öc§|!¸ëÕ¨÷@iÀp~ÅS9iž‘ endobj 967 0 obj << /Type /Page /Contents 968 0 R /Resources 966 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 950 0 R +/Parent 948 0 R /Annots [ 971 0 R 972 0 R ] >> endobj 971 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [455.0966 729.7963 511.2325 741.856] +/Rect [455.0966 681.8143 511.2325 693.874] /Subtype /Link /A << /S /GoTo /D (address_match_lists) >> >> endobj 972 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [369.8158 409.2782 418.5625 421.3378] +/Rect [369.8158 360.8503 418.5625 372.9099] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj @@ -3209,105 +3187,129 @@ endobj /D [967 0 R /XYZ 56.6929 794.5015 null] >> endobj 362 0 obj << -/D [967 0 R /XYZ 56.6929 769.5949 null] +/D [967 0 R /XYZ 56.6929 727.735 null] >> endobj 970 0 obj << -/D [967 0 R /XYZ 56.6929 752.0968 null] +/D [967 0 R /XYZ 56.6929 704.2039 null] >> endobj 366 0 obj << -/D [967 0 R /XYZ 56.6929 241.6876 null] +/D [967 0 R /XYZ 56.6929 192.783 null] >> endobj 973 0 obj << -/D [967 0 R /XYZ 56.6929 218.2875 null] +/D [967 0 R /XYZ 56.6929 169.2519 null] >> endobj 966 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F58 631 0 R /F57 628 0 R >> +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 977 0 obj << -/Length 2662 +/Length 2708 /Filter /FlateDecode >> stream -xÚ]“Û¶ñý~…úT]Ç„ñI‚öÓå|v•©ÏÎE™L'ÉO¢N K¤,Rw¹vúß»‹(’¢b§îèAàb±Ø]ì' & ~bb
ã*Õ“$ÕÌpa&‹íŸ<ÀÜ» áq¢€u±¾›_¼|ËIÊÒXÆ“ùªCË2n˜Ì—¿L¯ÿ~õq~swIç1»ŒĻßÍnß$¥¿ë·ogï~º»ºLôt>ûpKà»›·7w7·×7—‘°FÀzé)œYðvö½»»zÿþêîò·ù÷7óV–®¼‚+äóÅ/¿ñÉÄþþ‚3•Z3y‚ÎDšÊÉöBÅŒV*@6?^üÐì̺¥cú3Ê2ce2¢@ÆhR+©œçë … -AWÕ ¥µ' èO–# E¹¨¶Eù@çýùï Ç–AÒeC£CÝbÌ>>‚ý!=>‰¤`J%Æúy
:™¤£µ+vXÿ¾ŒbÎAâç×4úψ¦”zyBÊü•sé´Ìí4óM8ÜÞÎIÂb®?¯l¹Üçu=´dÉÁZÀàb«X kó5¦,Yj 7ä(Œº‘ö˜öOTzÜ™ÜfÍb}Â"Ú½IÿŸ<Š_bR ðJ«úL¢m š4,Mâ n4ºþÙô Oq~'¾Úñd -~ßu¼@]ÄÞ
Ð6‚€Y,«ÜFY5º/ÀuÊ`6aÉ.ÛgMNÎ!ã”i 1¥ç uµø”#
e½OÛiž-Ö4B_ QëÑô‰Æv) -\RÙ4ùæµ¥uIÒ]O—=#$3 7Ç]Á{ûϱU²8ÕÉQ«”2"m8“ÔÝóï¯JR•«D(Œ1ãö‘ D2h*ô]§L@>þ#ã úÐ6 [G"ìvO\:G.v Ð0¹G®¶^Œr·/ ‹Mþà f½sè<lïO „ÙRôү݌⠂–\/à´)d)w·ÐõF 5B§„Jò -z -ˆê~PoÑ|ÖŠcþ ò`×"~Ý8Ó \z&„eQ/ÀÓ³‡°‹‹É– ïßð#£å½®Ç†B³ÇÛø¥…–ŠÅÆĽèëm(L
z“3‘Y 0ÅD pÄ )G"ýÙhèýhV¿ÆÛ@éo +ƒb¾Xkrñ¢¨±öõwíu2tï°¢2Ÿâ_®•¸ï{aDã P¯Ð
4ôu0Ël,Å {Åš £{Yç‹Cˆ÷.ŒÑU‡Äúܽ-PÕºõµì±*–Ñ£ŽË]DW§§ -J9ãÇp¼ŽÞ®dŸlü'È [,ŽZ,ʵXmîDHP€/ 1':}Aeϲï>X ø6rE¶¿
Ø&_4íåì"ß7Yá+-DZïèæǶu•AséK;J
ù«/ßÛöJ
ê·Žp"¤aF¦ -¸«Uúº&AŒÎD{%Õ¦€ÓEx•sþÚ›S¢ ëLÍÐ;NùÓŠéXžeOžg/IÏñŸð7öD"¨RûU—¶²Yê’íXR„ÁkXÒó´h Z~V òkû•*è¸û’ÒjÖw", ^ úÓ–´}Ûñká“–Q?~€Ð|E±œÞ 4µ -BëD( h±h߇ ŠëÖl0¤÷op} ÿÛaã.i¥¡SI»å9ö'S²ÍK‰ê—u9Š-úðaÉmçù ÀÕ¥â.çãÇ}…]5Ž~zó‘0}\ÃwÁ¬Ñªï)ók¬ÿ¬¼A†ðî†2žÞ#“w©iÂu¥»ï +xÚZÝsÛ6÷_¡{ªÜ Q|Dòä&NÎÆM]ßÜÜ´} %ÚâD"UQ²›¹¹ÿ½»X€"%Øqš?Z,€Ý ö²˜pø“Â0®œžX§™áÂLf«>¹ƒ¹w'"ðd‘)r}}òÝÛ\N s¹Ì'×·ƒ½ +Æ‹BL®ç¿N_ÿóìÃõùÕi&
Ÿæì439Ÿ~qù†(Ž>^ÿtùöâÝ¿®ÎNž^_ütIä«ó·çWç—¯ÏO3QëeØá‘o/~<§Ñ»«³÷ïÏ®N¿þáäüº×e¨¯à +ùãä×ßùdjÿp™r…™<À΄sr²:ÑF1£•Š”åÉ/'?÷fýÒ~FÌÒ& +êÝ- ò°¨OÅt¶8Ø«ÇV,õ +»™ÌÑâ ¼£kg }°UEðiÝ¥wB¡/Ш÷hú:Žò*Xª²Ó:ìD„E›é°Ùm8p¶k×J._»O + uÃ^³P–Ð×»`EKòY¬4Bqô°¨@âÍA
3¯ºšV†É0X08óé° +ò†—¼±÷»å¶£KDN
‘bÕ³#§=3EÎ ¿N/Ws|5G Ð4ô8þY¢í¿Hd×ÌY¦´*Æé}$ÏïÇ ÿUê’sሪéÁfÿœ‹—ó›âåËï”|•>ḦP‚) ‰rßD(nú&BñÐ ‘š$õ6 +To–@#Ñ‚U)R¼å!¤ Að%˜;ô%˜ÄHûPoˆXcEAFqf½càDº¬Aª $£p&À'œö’
G²!Eœ¬ÅgQOhèÓÄ3kZŒþõ'Mn†H{eqIïË~Ž´ +çx‘Jî‹#_UŸ
íËØBÕêä´%[^• «'ú¾_Jµ!þVcõûX zªþUO;HÓ6ÕØïßèÜž "âØ—6r_%Kh“Yhþ‡†ªPÁ5Ù7¾|èÈÀN8`ö34.aã³}¥Œ¡´L(ÑC¨¢6j 2ÂhÍ7[šøØ´¼eÓ=/5{¸¦¤¯ÐCu¡DUÖø’Fõø”—´”YBN/G å4SÒÄëò;e]»Û̪„¾YÏ>N™ý…b8ÊCr3®[q†‚ BÈ jr‘FAÝÎ'y˜ ý#ä‘ÜXÊ#Èз•žÛ·•ÈÝÜ@ e“¢àB2O %‰‹÷¥À6pˆMÚôc?<4}FW +誼Q@·³7 +_ÕÓ伺]úêbàK³[ÝTa‡[o ‘-¬ ù>ƒãÇÝn_ì{WÏ_×ßçDÛÃ^M „tšp]0§L>NôáUÍÅ^ÙÙX߉b© +×5˜èß·¤cEa]b>LÚ|¸ˆZÐLXÅöV ’H ‹§Ó¹ ç˜Ç¤3OIg ‘Îì¥;,å„LúŸÌÚ€Tæ1¢_˜ÀH)$a-’IaÝ8ø<OzÞ‚Ú±5‰ —ƒ*–ÄóT…¥X¡ú§æF`{hg q˜Ó›eaâ“›½¡Â|ÿêS”ÕÚ +‹åi¹$Š¿
ÿƒ°¦öä Å9 +ž|(>][MWmKy_ÖK|I]“µ¹ùü5YYèñ5ÁØ(û3ú_\gí&FѶ¡ƒóû§Y½'|ÂyEª¾…z¨»êExJ
<‰ój2UÐ ÜQqíÆ®ß>4ã¸üòó¿g ¹×°§‘Â|K£Üež| ;r¯¿±gê'~eþ.ŸøAž÷±ë«þßÿoæ¾¢é_ö´;Q(Ô[Û£¾"þŸÀ±èKì’endstream endobj 976 0 obj << /Type /Page /Contents 977 0 R /Resources 975 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 950 0 R +/Parent 948 0 R >> endobj 978 0 obj << /D [976 0 R /XYZ 85.0394 794.5015 null] >> endobj 370 0 obj << -/D [976 0 R /XYZ 85.0394 388.7711 null] +/D [976 0 R /XYZ 85.0394 361.5999 null] >> endobj 979 0 obj << -/D [976 0 R /XYZ 85.0394 358.9876 null] +/D [976 0 R /XYZ 85.0394 334.6283 null] >> endobj 975 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F84 802 0 R /F86 982 0 R >> -/XObject << /Im1 795 0 R >> +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -985 0 obj << -/Length 2975 +982 0 obj << +/Length 2981 /Filter /FlateDecode >> stream -xÚÝZÝsÛ6÷_¡·R3Š~ -£ó-] ”UæÛûFæÓίBŹû‡z›ï!@'QÙÌÆÊ ‘ˆgO̳-Á)|˺.˜ MDs¸¿¯¡;–Qh)Ú¶¬îà%sQ»)¸°¿b:_¯÷EÃ3ÝÎŒj°|ù7ßÙômêúÍGüW´Í ”:í }# n¾½‡ ¡gqz„âTNX”î2°JE&‘RFÿ©«‚’är®”Š| -Ö. ÂåaSTÅg Ð Åe@ì¾eõ6Ôºªï ‰"ª€QÙa]Rä„.Dh±þ ã—eÇñ®DÑùNo–ãZá÷XG?÷ Kºþ0…R}Uûç°¸ˆ
d£
꧌6ÅöžIaxUsÛªâÝÆ XyY07®ÝÚ0êÂ}åvKÔ§C¹úè}įpka滂'©h,,1߶jä峪W·Ãe)®ª8’õýA™^Q5ò„„Á¿lª
ó65$h¿-°™wåç¢â&~æ¡vÊŽ¥ž·þSY°KCéÖ`dÜ>¿Çi!Ŷ$‘÷ Õ°ú}¹.è
÷wj©N_±ãIQ =»r‹U°tcm9…±0obõDÿÚøÍpfrL& rýMð¼§7 Š ™ÆchÓPR@¢'dZ-¬NLW@OH -¨Üî‚g}Èny{ÌLãä¶.nóÖÊf”‹Ý}ËéÕêW™ÈŠ“]ˆïHãº1¬rŠlað«ÓP*DcüLìqÉ‚ ÷j—ÿ¾ Í»hË]±(«'I1Zݞ׃y&ÔÀ
P¤Pgô¸ªn jñs ²PýJÈÒ6:T•Åн«;*ª…y(*ÇcX]õH#weuh n&$!uäû]¹ PetUÙSøÞú‹P¡´d ‘
šÈ
”ð
Y{8 Ø¢Ü vôò9ß ŠáÌÚ²Øü±7k,ÍHâY$(…ÓäÔÕV@RŸë4’:®I$•ëí$’âLX¨ŸÎkÒqM¨2D“™Sv¨ËMªC“¢I!:>’€FOÅç½×½¾ ±ŽZ}=¡:d©Yp‚‚M‡BžÁï .ÅàR#p)ÈqZÿ¯àJOaK ±õÿƒ–ÊD¢uú ´z\g ¸N©úÐ>Rp:WNW¥ãšÐe€Œ%©}eÞ ZV#œÅ±*í ൠªð} áhå¹}´"*ÔR„)Ouæí<ŠéʉDJ7¬úþ2ÑJã ¡3ö<¤ú\§!ÕqŽV“‚b9vϨÒqMè2 WV#GÊ !ed€”‘r¯¤:Æ+ }¼‚çD¼‚>^É€-ëã•$lÍCÜÃñJ¼ü(ÞX -gW5:þÁ$˜¥á| ÓØ=° ×€._û2ß.> Šýãb—<c`ÜÏó -0Ï„ü¨L*œŠj À‡mþwÌèã9Y›.œ@ó=¨X¯ËU¾õOèóÚRç.oZ ¬ ¹7^Óéžþ cM è7¾±¼¥‹$»ÌY`uØÝðÝl.8€Ä=ÀÕ†t¶.›´;°X§Ñe¾ÚP{sTPÈI€ÊéA¦ç&¾Ó–®T°JwœnÛI¤UÎY }dzUEûPï?ÒËM^ Êu»SíåÜÁ‰8!áûë9$m@{-°@3/¬/@´VáË ð¸Þ”ÍhN+šÅ=lðVqÅâÑ=²tWðÒø“, ¦,ûp“‹M\xu婶NEâT8£N¡~×,&ƒ9®Z©È§D‰7 m™,Á=Þç%_ý Ë18È€+âÊ ×.U8 Jùдª«µ ì’V†÷zFØ$ ('Ú–'ƒ - qt&Ÿ©±û\§ƒJÇ5ÚÞ’®çEY‘>#y&„"Š6"!¢ ¤_¡y´ àÔ6²h cN #Màp .Oè>šÆBÇq< -—Û§NB0Hõ„êÿ« ÂÌendstream +xÚÍZYsÛF~ׯà[ ªåd. €äÉñ‘U*‘½¶R{$y€HPBh”¢líß¾ +v–©,Ø0»YÆJ•NS3»YþeÕ%Œ £ç¯¯_]}ûãÛg—‰n®^__Îm¬£WWß¿dêÛ·Ï~øáÙÛ˹Ic=ÿë³77/ßò§ c|suý‚[2~œôíËW/ß¾¼~þòò—›ï.^Þ ²Œå5Ú¡ ï/~úEÏ– öwZ¹,gð¢•É2;[_øØ©Ø;×·Tï.þ6 8úJ]'õg´²tuª@ï¦g*8ëH×MW|u9÷6Dëü×ârîtµ»í¥I#zK£î^ˆm^ß-Ó·ÒÖîVÈú³ÖvQuW=q{•Ów2âªÙ +±ØmËîéÒÚ}ê£güiY´å¥Yn«~ðò÷¢ÿ¶)ê¥ÌÝÔü|È·e³“ÆM>ÇÝ +vÀYCýðYÔ‹f·ÍIŸøÞ5ü›FϽëýýt¹ÆÁ°6±²°šùƒŸï–›9ùéÊSBHbé€f1¡tˆýxÐð
Ò¡ø
ô¼(l@ŒVÄaÓcª`bÀ, ó½”³¹3N9›$‡Š›‚3Düœá+;=Pâ ÓyÛÔ +à € vÉ+nØo<5sã#NrÎÒ Œ·ñÇÌÖª,I…‰=¬åÁÉñ‘Ø°îË[DVla%h\Ö»âgÛ¬¥… ðÑf.z…X„ÅoùzSÑŽZ“ÏèøpG¼¾úú·„lùEü¨ºé˜ +Çîu]´y8øZJ!ŸšjÇ®Ð÷Pl¹¥O`–E•²ËX‹Ã c×{†Ì}U®QÔ¼nB`x #ð8ãJDs8ûJ²œ Oó€\ +,hoS J‚©¥O°zOí =„±|¹ÜRôc= ¥žB/?OJÃA:îU +-¸ tø0L$±r>„ãÄê ±Jûá¡v‚$á#ئ¢]=ç½c¼ÁŸf3ÿÿÞFü9I©G8ë Eã1͇½ÃfFÂýçôëå\ì?¿wŒG>ï 6‹Ô†£Ï»†²SDgLS )(Ã$åYHÂ1fË-˦~:@¢ÝmFQ‰ZŠNªÇD-¨•Yž¡íø2R|Á4‘ø·Í çWüWtÃÎyÈx“?Ín>¿‡ŒM1QÁ¦£|oêÇdVðÅÃ-Ž *ÁTªž5µä¿7Th†a¶<Y +cB…Ì&Í8.„è>o™Xx’\¶ky§ª ž›*§] kž€Eÿ/ ª²Ë»‚›~§¥Ó° +ze[‚Kt ªrMçûH72 ²¯›]-ŒTËc‡&_ò,g÷÷sRùÀK¦ +ã¸zçÃ-Ì +¥1Žô‡òAFgj§©ŽkP *ŸÂ ²(T¹OOã¸üjätéÿ .åëendstream endobj -984 0 obj << +981 0 obj << /Type /Page -/Contents 985 0 R -/Resources 983 0 R +/Contents 982 0 R +/Resources 980 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 950 0 R +/Parent 948 0 R >> endobj -986 0 obj << -/D [984 0 R /XYZ 56.6929 794.5015 null] +983 0 obj << +/D [981 0 R /XYZ 56.6929 794.5015 null] >> endobj 374 0 obj << -/D [984 0 R /XYZ 56.6929 573.6377 null] +/D [981 0 R /XYZ 56.6929 206.8777 null] >> endobj 741 0 obj << -/D [984 0 R /XYZ 56.6929 551.8981 null] +/D [981 0 R /XYZ 56.6929 185.1918 null] >> endobj -983 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F84 802 0 R /F86 982 0 R /F42 601 0 R >> +980 0 obj << +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F84 802 0 R /F86 986 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj 989 0 obj << -/Length 3506 +/Length 3421 /Filter /FlateDecode >> stream -xÚ]sÛ6òÝ¿Bo'ÏD,¾? ÓÔé¹sMr9wnîš>Pes*‘ªHÙuýíbŠ”(Ù™Üd ,€%°Xì7Ä' þñ‰Ó“^M¬W™f\O›+6¹‡¹ ¯xÄ™%¤Y ëû»«ïÞ1ñ™7ÂLîV½µ\Ɯ㓻å¯ÓwûéîæóõLh65ÙõL6ýþöÃ4â©y÷ñÃûÛ ùüöÚªéÝíÇ4üùæýÍç›ïn®gÜiß‹¸Â™Þßþㆠ?¿ýùç·Ÿ¯»ûéêæ®;Kÿ¼œI<È W¿þÆ&K8öOW,“ÞéÉtXƽ“Í•Ò2ÓJÊ4²¾ú×Õ?»{³áÓ1þié2í„ a ’=r°2«}f¤»kî¦ESï°(àxÜÆÑE ÚeCƒyl·uÓ”óuD-«¶ŽóÔlŠ¦Éï‹ yô¯{‘ÁÍÁiÂÞ›¼zžåUóT욈ݧ×À=sé#rwßQq÷b…/Œ‰EYTír:ß·‘¸øQ]Ÿ jöÛm½k‹%n8™ Ã2絘Ì8ϼ -!0˜}BÔ3*DšÄZsäöÿ6
w˜¬{èÑ싦m’@P[ü¹€h'ÞÿêøþËMÙøT®£$Ì‹þš«}S,Ñ{s LuŒ¨ÁaÓ1
– 2ÏÅרð)„¿Œk¥.Ka ë¼vXC)L jN„Q›Ì:o.SÑa18±á™µÌé svFì$aÌÇøŠ Ì9vHêÉbèYÄï‚,âÐ<bžÈÞàû]4šp 0ÀBù¡ ®(\Bú< a54÷ƒVÒ²›º-¨ÁAѵƒ…FC-|Š¢úBåBåÏ ÖðäĘÍ쵦ç yW -¡]Ÿšþ%â]b ¥w‰ÂyþUL«A/û.Ö Š>œ ¢.R mNÓ'(~QŸ -¢0t.…dEy, -öÑ.cKÐÉäÀȺlÂ3@ÀªÆ"n3c¬ûZëbº‚û*/×M$ºZŽ™
0è^%u‡¸g†ÜŽ¦ÈÃÙ½<Ê -^mõ¥íÌHÅ üˉø¤6‰-sæ5ÏÒ…×L7þü¡…ÃDH_Š>c°TÃÒ 4KÄA -õ\Œ•a!lƒ°?á|ašÅ2RÿWV.%H›-¤Fór]¶Ï€ÊÏ !Ç7En^ Ö!LXį¶\=Ÿ;Ú‚9ÿÅí;¬öç,¹‚ðô2Çy̤6|¤rŠÕŒX¾Â7êX9ÅÑASƒBaxÙ Qû¥A쇊 ~+‚ˆL…1œÇŸIÐÒ‹7T9”† .¶MpìÒØé‡w·ïÿC£ñ÷^Xû3F¦2L ËXˆIe,œJe,㨌eRVaº VÑŽôà`Õt¼’e<>: Þ5ÀÜ>'àOä„Gµ -Qà3µ½b-:âÖÂg_ózv0ÏN^hý®`3ß±7'i!„Ñ|¨@¯ª8½¢rõª -ØÿrÕ•-2üÙ鈅d]¶øÍ¿n=üôWÙ ‚`1îá!?‚(ÉÛDžWùcÊ»ŸÁž’þ?èo%Yendstream +xÚÝËrã6òî¯ð-rÕ‹' 'OÖ©ÍdvâÔVm’%Q6+©ˆ” ï×o7àK¤<“=lUJ6€Ðhô× ~âÚÆ•ÓשÓÌpa®×û+~ý +3Þßýã– o?½ýþû·Ÿn~½ÿîêö¾=Kÿ¼‚+<ÈïW?ÿʯ7pìï®8SΚëghp&œ“×û+m3Z©Ø³»úñêŸí‚½Q?uŠÚXf¤N®—ø'Œ˜æ2gÜ +É h·ÄÆ/ÜpIàcu:ÖÐãåà>ŠýiO§lwʇ+K¶Í^z«j®F;ÒÚc‚’¸„iÅåeiêcÍKS‹5)MÅf7-M &q—)i±&HJ“`BY9¤¥“&ÑJ“J“@éø$ ಢïÁÓ^=øO^Ì¢ d‰V²„ñL¿ .háA¸ÄH¸€\'埮dN¶D'[ÿ?Ñ2’ÙT¿"Y ÒÁ +HóVª:5g‚e5Ó‰I.ÒÑ"2+Ç´F!íQòé b%Ä +¡žXa³o¤°½«@<ÈNylo§*Â’&µ
%„Vq«¾(9p«ÜýUíwLOyEšzXÄ)bÍÛ©Iy ¬Ê+¤´X´ %*aIšŽˆéDJñ(RŠó¥â¢³T +˜NgÁ¬ (¸Ã’.J¨´ ‹7¤ÔŒx$x Ps>CÿhÓD3©µ ÈmXç
íG + y²ÎŒ˜²òÈñ +wYÞxúÊü™€˜ H™ß]ÇÜCØÀ1ÛÆéà·N×cÙ ™ «…[lÖyhຠyñ Ûñ‚š9fåôÓÊ? +Ó_gº… '0½ÕFÔ ¾Ù®®êx雞kÎEá!_ ýßk*AÔÕ6týëÆœMõ -3â"ærF‡„–Ûà /|`í¯,R8¸±¢ž7ÊaÓ?mcGË¥Ì9e¿ÌˆJHÍk)ðÑ](£`B ç=›
…zÜÛQìÏèsËG ê§fµ/Ø +žÁ’@ć,é(L ûæË‹/!—wѽvUb +‚CkŸAaâðñÐ~V¤WAþeýécÍëO‹5düTÝZ+ AÛ/nßbMì?T ËäeC¼iÑ˱5HKî/
ûª¶Â-R!„z*„è¤B8àUUÀ쫢Ψi›&#·OÉ…¿ÃhÝ}‹–€$nê(ôÍÿXûŠº¿ÿíøþC}ÀPMh•÷×Üb }±D>¬jŸk°2 +Òk!¿D…ç¤kÊM/Kaë‚F¬¡FVž¥ ìMK.SÑbM1¬u –¦Ü
é5Ìþ»4º¢`( Þ™sl„*µ¼¶ø¦—Eœçe»VóLöóÁh^/
`©Gos[ +—>Ç}X
ŸPB–ÝW¾Äm ž +® ,´¯ˆ»Eõ…ÊuBåf„ +†4Ñ/È)›Í\š&=¯ +C±ÇPœ\/Š{ GõÞ!(3Ÿ=®çxŸ!B)X 9á3•q0ú !:Ÿ!Óà3°°Ü yì!?%äÈ;ô¶Á; ’íúÔô/è=)½K¼ÎË/b"¸XãôÀÅZþÖ¢†¨
ÔÂ7£á³@§†@Áðß™ˆÚÙG +açB^Å™H’¶ ÷j¤+$V3“W^›ûXó6²Å:Ë'0 _Ÿ?ɜԯÑb½B…0ÏpóydŒ¥ ¸–Ú˜ +µÅ ÿôÇÛjŽêB Ìi6›îÚ£…Æ`4ñl.&2uÝ}|ÒÝ¿ûH +ßÄõ6/`²Š5ŸP ÌÝ•„Cm %& êœ +5¡Â'eôN5µü…Io}ðCÁ3Ápù
yÇÝÎ}Ñ›EA/€Nõ)0K’Åó{<`(—R†g!°/7bAHÊ?4 ·Ù:ÌùEJ½ÞUõrêt%"` +ñÛaçÀìÃ@îßÄVoOg@"íOqÍìpȳ#õú¿pH× ¹€µ¿ª'˦ EIôÃþ©ªû«ËDi$ešËq)w@™ +.X1¹ÔÔ“ŠR oøצÐXåôH‚ÿ*Ÿ"LÂßÔ¢ýw€/=AøüuÅ> +š¹LócÑvÇ?4õ¥GÅ!wnË=Ÿmö$oCmÒ'Ø ‹ÿ”ÃÌŸ‚•azúM„·úÿü‡áîßÔ:eÊÚ™C*ž@ÜéÒHžG»1å²$ce:Aú“ +¤½endstream endobj 988 0 obj << /Type /Page @@ -3320,23 +3322,22 @@ endobj /D [988 0 R /XYZ 85.0394 794.5015 null] >> endobj 987 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R /F84 802 0 R /F86 982 0 R >> -/XObject << /Im1 795 0 R >> +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 994 0 obj << -/Length 2914 +/Length 2907 /Filter /FlateDecode >> stream -xÚ¥Z_sÛ8ϧðÛ*35—ÿEÍ=uÛ´—nÚK²O{û ÛJ¢«,¹–œ4÷é HY²å´½Ng*Š„ -8#
3FØi0,°6·¬g†Þ:F=ž¦¼{žÓqÏ íá1 ~`ôlÈúHH4¡€:—2Ì)£Æ|(?!d†ÚJØ"&?Vs`‘ÚÂÙJ©_ä-v
òÍœ²¥—®¡'±¤ñÜ+¿mQwcÚËOp2Ä -|ñ\¸>(Z6¡÷\XÁ¤Qý Ëõ˜/,s œhç+b÷çÛO4øÔlƒÌe .Ü[¦L©<ü±)WóG=ß6s"¢:8ˆ BYcóXE‘±Ôð![û l#€µ›bIg—‰$LJ¨o;šhîhM„ˆ0eiŠ6’èW»‡<°x*«Šæ<pàÔ› N€I+ŽC×(™IûÜvÅ:εå}MÂC šáW£°t‡Ð„s¤ž'^~aˆX€ÙE[ÐBåÍD È# Ém`Î×Q;¿Ö¬iaùÐ4»¡ªåÞÞÃ=máØü‡FŽu6tj´’Óc?NˆÊ–fnb^žiñ9ú™s.iOyUÁNàåå݈ý—]±
>…èI³ ƒ§²{ Åv·|}8Vœô|5Þ-UE ù}„ÕíS±¥ñS³«V}¸ÒྃEÞþËñF"·Õ'ÆùöqBÒCþXŒÃ¿ß=ð»ÏËz*îùT¼g!Þ?nŠmNY™ÜDßĺ¬ˆ©Ž‚]N`šRßtý Öû¥¥© B
}(Ê,Yçõs ¢a €¬·Pø~™×4X.*U¬Ð3¸Jn–yå V ój?ˉ]x©ªæ‰¨²äé¡ pàAL9ü>(O’t €Ö&ï0@Dbñ5_oªâÕ¼A1&L_m‰÷Ç ¶‘.UÄïe-‚L‚ •5œW ^à8'ÄqÉT -É,ˆã©JµpROˆ5’9É#ò¢{!Û Nñ% 욶ŠFôÒë Ý}yŸ/ž»b2ý(®™Õ\Ž£kW#N(¥S( xÔŸŒ - ñBXp6y‘h%¡ê2齕§Cœ¤¼ -{ ø6bÙ ÞøP•ˆhTÑcÙô… -”Úõ
£ ¨^0J¤òšå]~Â()¦˜G¢ ÁFI5¸çH0 &ôE{£`£å“ì¸
Ci±n¶¡këâ÷=x^a< .%÷röFËÄ´ÑP?¨ƒÌ
)äëg§’I–:+Çxã÷b H÷^¶¢·¤0ô˜Ïý¾ô`ㆪc”©C““Åbô, àÌæ Žª
TMX -Q+_Ô¡':VbüW/Ç´ +xÚÅ]sÛ6òÝ¿BoGÏD,¾?.OiêôÜi“œë>Ü´} %ÊæTU‘²ê»¹ÿ~»X€"%Jq&™¹dÆ\ +ÝQP8…z'›—‹b»lã,ðaÇ‚ÚBM5Ô„U=rèP°Á!¥œº†
n JŬ·Š9roIÍÆ—„Ò9·¢«žËfl1›+©R½õÓlD£ûu¼K•Òãj¤»jYµÏ€ÊOk¡¹?‘d÷±ÎhaÂ"µÕâù”ÞÁfاVOHŸX 8&–{~ùÃÒTU ¥9/A# «êœd*Û=T³lè êÑbI½ƒ< †ŠùœÔ®i0àŽ‚4¢Ök¬P‹%FolÿòÝGš³®7mDÞUËHø®Œñõ@K”V UC1¿MˆíÒØìý‡Ûëwÿ¢ÞGࣸ/°c$Ô…áz|FÌ-Æé0´^—ņ`¬·‘&¥W¸Ì²xJ`¹yB µ*ûÛXq)!„sÑ%¡xû͘C¥«…Wè!`+m†©ÉlYlÑž¤TtÝßÀ¦” ë>€
ex2$½›’*Œð¢}nLEk…›1ž„Ëí¯T¨Y¶q`üê„+H ½ID_ †F¹®¶J{,‚f +Ê¥U¼º‚ÎYó9Cî1`ôå.&dý Ð_›R¼áµU@Ø Gèª §Ä >Ó·w¡EyãHH·à µ2/—óÌ ]eúÝ¥U¬{Gü¶”Pz€JãE·N/¸½zÑ-Ø׺½J5¢´x€"ðkT°Ü´æ3’ë4ãT+¼Dm>QÁJHë´îkV°’›\3é¾~Û§|¦‚•Â«ñt÷s½,bÉ\¬ÏD®sN +²’¯rCD ×µë5(å>E
ß7œr‹TÖ¬Ú!.^äFRûdS‘?Í
ÏÔšè±s9m÷²– ,gŒQ„ô>BÂDÐPB6IÁïz-tWð<©év¾žbz5–vXHžóÝöG +Cr´1qxª«ù§h‚2+(=_J3pi>‹KPj¢ŽÅøåÔ¿ç©;Hwzñ‹¤p¼2¼qá‹t„tV/¨ÎUÅ\ÃhH³sàÛ„pI„']ÄG +ôPz‹PÈ?à|!¢ì‡ŠHhpá +øðM§«˜æ(]βw©-ÿ* ×Ë2ºÌÛVXÔ˜–wo@‡yQP\m‡×¬èæAéÆ
ijÀaü‡>›bu_(…5Ž@£µÔ¯ þïë±Ð8bA}² +|{}´„Æî¸Dƒ–88Šnäï¨"„¥àÁê°‹Œ {ö~ûÉïbÿ"œEý8–¶Bð…¸üÒªÀ‡·‘B rsgÒsJ¬EE¼‡B™%â
^Ÿ9Ê@‡ý9bKówÈ\4O²G´P´Â¸ôðï9ê«ìþ"šÎ endobj 993 0 obj << /Type /Page @@ -3344,106 +3345,115 @@ endobj /Resources 992 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 991 0 R -/Annots [ 998 0 R ] +/Annots [ 997 0 R ] >> endobj -998 0 obj << +997 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [361.118 436.2023 409.8647 448.2619] +/Rect [442.7768 199.0224 511.2325 211.0821] /Subtype /Link -/A << /S /GoTo /D (configuration_file_elements) >> +/A << /S /GoTo /D (query_address) >> >> endobj 995 0 obj << /D [993 0 R /XYZ 56.6929 794.5015 null] >> endobj 378 0 obj << -/D [993 0 R /XYZ 56.6929 621.8163 null] +/D [993 0 R /XYZ 56.6929 254.8667 null] >> endobj 996 0 obj << -/D [993 0 R /XYZ 56.6929 597.0941 null] ->> endobj -382 0 obj << -/D [993 0 R /XYZ 56.6929 519.9904 null] ->> endobj -997 0 obj << -/D [993 0 R /XYZ 56.6929 492.7975 null] ->> endobj -386 0 obj << -/D [993 0 R /XYZ 56.6929 176.8325 null] ->> endobj -999 0 obj << -/D [993 0 R /XYZ 56.6929 152.1104 null] +/D [993 0 R /XYZ 56.6929 232.5443 null] >> endobj 992 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F84 802 0 R /F42 601 0 R /F57 628 0 R >> +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F84 802 0 R /F86 986 0 R /F57 628 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1002 0 obj << -/Length 3192 +1000 0 obj << +/Length 3256 /Filter /FlateDecode >> stream -xÚ¥ZKsã6¾ûWè¶tUÄàA€Àq2ñdJœ¬ãÝ=ds $ÚæE*"eÇùõéF$(QrR) Ø -9X9›µràB+o‹ß–ÿoû¦¨—]õ{y¼l®yš1½5§ÁÀ5£‚ŒTàZ§ÒH3Õ᧲ï®a…,)èJUÛÖN+G=¶{"ÊbýL”WÿcLÔe ëÊ“åÈ\§™6z² Ü?-ˆ¸6𿳰S¹´°u_µ
i” òc}2ÉSe¹½lÞë -N¥¡` -ŽÎoXòßçÒkÓ?—ç-JÂÒOu¦`RÎS«”pŠÝnÍMÒ”°k"ÏIÝ®\W(£ÜøØ»/€42éÚçj ^këMÙõ¾s_4]áÌæ¥WÍû 16^«ÚS+?\ úv[ôÕº¨ë7·6]‚ӿܶ/åÌ"9K œhˆýMùX êžU‡oùIå±³<Í8X…9Y‡¦®¶Uëu¬“Ý€ø†„&=gz’P|ÔæL¥FfïDöÈt!°=N÷Üvý²ëÁ ˜¢[BH†¶M¹â¢Ó© -“ÀÎ1+B¢Šu¸ÅÓ&$m'!‘£tÄB› ÄúÈÞ ¶«rOÎkà‰ £Ñqu4R6ý¾"à--u®¼ÜÏå®ÇÝÖ2¹k{òp
:+ŒíØ;ªí®.· Ëù0ºACϨôœÝKej-³—73æ:¿›—óÙr}ØwÕK¹\×(×l&D|. Œ\TaàšÑaš§³4gÖN•ÂdÜ$(Ã&Á€Û$…9{ aT4e{舋‚Î/‚˜ê¶ý|ØuÔ -ÕL
hÕ†4HØ -jB^Nì®Ø=.†” Ô/çиß
ûí< žþxN|m…«©¹òÎ ýC´cc¾r8 -¦v–jpšœÎÛ½bØ"üå³Òæ
;hˆòREù -›²Œs_ÛùK1£EæGw‘]/-ÞÔ æàñMî¯d Wl¸@‡§fô<óÎˆÏ NfÑëÂxÙÅ›ëáîJοb*—niq^×I ߆#}éÁµ‹Hx²/èÙ´Ã=rþ`·ãƒ|»†³ ^½ŸVP}a²wNU1×…0\îÐWû~Uý…8ð×Óu¸f”˜ &x*µâS-(؈320ö Øý{Ûxæm:7Eã¼ †zÈ+ ¹4‹}E‚ïuÔ·-öŸ]ü@wÑÍù; ¥´Æ{è¦WÚÍ82x‡IseìÔ=”n 27¡Låv ×?†²óc \nbß7Ix›|ßľïÜÃù¾mŠUí_}ñ% -iF…i=2©²JNuð76:ÓÖ޵ʆ›I›4eÿÚî?ç°CðIÔ¹º"$KUfÃؼ Ž47 /¨Oj‡”e)iç,•J Ý‚QÅvþ‰OŒ*|Ž’à(g _÷p;Üõů£{ã“ܩȽ#¹Þ½Q6º7Ž8÷FÝÅ;÷†ô„ç×Ñ’8‚†w…ctúí16 lpc×éOJ&ì€zc? àDênñ•ð\ì³n :(^I><:L>‘„z}Açè±/¸N>è¶*Ÿ*?“? ÍÅ) .ˆÐU -‚—‘d·*“Mn9Žš…)Ãÿæ¸5¹+W€šoׂ%¥oL¿%cGCOÿ-¨ÓoÉ™ÍS-µ\D¶ý{» 6ÕÖ³ ÿjô÷|i¼
ÄL¦bƒ+üíÿJ$Ëà´bŒ8ó/ ¦S#l¾*EY¸3êä?7J̇W¤ú .Ñœ‹endstream +xÚ¥ÙrÛFò]_Á·PU!vÌÝ'Û±½N%vÖÒÖ>dó +xfe:ÿX·Å_}RÍÛ‡‚æ×ESŸ¼Û>¯îy»U^Q#ß45/yŠ–ìèÓU—×Õ†1?•ír Î81[H™dƨpºCS, ÓÅa½[ìê}ÛðŠWDb•Ï`%.È«õÄ®J$BYÇ0aS{qSç’Ôv›~$ë4ì½ÐÒöœ"IUâ4™Çº\/&¶Öp¼TÆë][ÖUCûæÄ0ê0ÛÕ:¯Z*‘á0Ú>ä<¼mŠ¿ñõ>Ïã} +l LáwW7M¹ÜðtSnw›òŽ{Ašhß2À®X•ÿBr<2- Ú%™ÖD1궴 )„˜Ú{XZÝÓ~7ÏM[lÙ*M}دçO嶜¼bØ_¹D¶¿
4*ßiØï:4ù=ÏÖwøÍæÛ¼zføˆÚ,ï€ «‚×EÁÆ’wÙ MÅôN =¿Yå›p 0ó˜oqY'
¡³ÙÔO•ÍŸ +Þ1ðñîù€—}¤=Çô >EØ@žZ;‡×®…œ_s¸³âû‰›Z'Ò¨”EV¾Ÿà&\òN3™Á¾ rkj•ð+ç°sP‰vYT$)œv©ô*@‹²DT¦`à`[æ +uòÁ©é¨x‰{ÅÔÝ—÷ùò¹-¦Ä +^Ëj7>4(,u¨‡,³CsU-L‡Mq°Í÷¬ôº(ŽGZíË`5i`R†`"1ÚÅ£5å ű«×à™½ójf
Þ:õgœ½B†ùiW¿èv\ ·$?>$N‹³=â@"ÈìÄ)•¤Âx>q|tŠL€§nt +šÜßϨñyktð4ŽDãd_ÄS¬zÆÛD S“‚ÅV2ÍFÔœÄ; Ô 4œî†4$,t úÒB—¹àhˆÌ¸Ö }h0É?@·s³ +üxS´q´w"ÐíL9´OM'®$Ó1ì©ÑFœŠ–leW Þ ?ßÔ®'`Âz9xÄêê;4_ â¼ÃŽ )Ž7a/lCßà™.˜9 ƒ9?0üN˜ù§Š78¬ ¸EøÀ¥
æ4‘@:åfC{/y˲iÁ²c{€otœh1™ðqDãÍ’• ÝDr“Cðf ]€¸>QæŒLE ÅêTõbÝAoUï‹) !•»¦^ÀÜAM yHe18Â}íZoêCüôGÑY7 +¸b(Öh Û ÊÛÞ>’µ|
&Ÿ‘I‘˜ÙÝC +n$Õ’áÎß‹òI¦2÷½ .ÜK„ +”åm>}/ ú%\ÆÜAM ß Dä\#ÜÄÏLî:äs© n&J-¶5&VØnãú΄½xä ã/z<ý½AgòÞ4„a.sß~o€H¢ dÝæè +Tâ¼= +lÂY d]õq +R|Žª0bM§^h«ØÃQ;Ží9…9·
QøÝ-¸Õóœarú<å ¼†egA–ßF ‚à¬CÐxEŒbM–pµÏÔ<ã˜Mi…ø7›/(ØNó—’'ˆ6Cò„[0³Ïˆ' ØŽ=»xvõZle‡q®íâ\KN #ߺføm ÄšËgšc% ŽÝ¢¼OÜÝs} +.êÝ hÿß«xZeÃôOcÙ®«²ªŒÒ?lÄl.@T4ÖÆ Žê€8sBõAE
&@_ÅÙ‡]rÆÑ—t*SWYÓtYµÅ¾·òL}0éŽròrÁ¿=Ä6à;.®Ôã)yÀ³Z¥<ÜÅK©Õ +Š|u¦û)ã Ç–M½)Z,¢§6
aÇp:_Š =_`/¼ +šÐ| ?Ôy¦<(u–x¬cÆgS!¦Þ“t’á[úÚ Pó×Å*§RlNn [>„0²£Ž¦ù½Z9MÞååž–e;<UWÅè'XZß1FZHˆ…ôcÎá—áIËáw-’¬2+Aý/å¦Æ—Û&üDÃÄuŽ Òy‹»K¿ÚÞƒ©ö¤`q¾(á Tjü B.ÄÅ?º‘TêÁ‘%÷×ÅŠøšS¥ ŬPw(«ÍØ—¡i¢Œµƒ·“¨õæžÕv Y9û‚²€Îëz +×´ÚUr`Wå.bî€NQsfHñôõm,¶ +ô¶WphSeØ +8ŒtR íÛ7¿ð`]UEçÒ³®Øvݨ°Û׌)GàwIÌF½ _á7xn«ãÓOýÖShåκìXÝ0 þðl‚ïðϺöÿ¾ÿñ_ê höçž“ä8ø¶ÂD!áæ$Îì~wJú$¼#9endstream endobj -1001 0 obj << +999 0 obj << /Type /Page -/Contents 1002 0 R -/Resources 1000 0 R +/Contents 1000 0 R +/Resources 998 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 991 0 R -/Annots [ 1004 0 R ] +/Annots [ 1003 0 R 1005 0 R ] >> endobj -1004 0 obj << +1003 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [389.4645 631.0615 438.2112 643.1212] +/Subtype /Link +/A << /S /GoTo /D (configuration_file_elements) >> +>> endobj +1005 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [375.4723 755.8266 432.5882 767.8862] +/Rect [375.4723 239.1838 432.5882 251.2434] /Subtype /Link /A << /S /GoTo /D (journal) >> >> endobj -1003 0 obj << -/D [1001 0 R /XYZ 85.0394 794.5015 null] +1001 0 obj << +/D [999 0 R /XYZ 85.0394 794.5015 null] >> endobj -390 0 obj << -/D [1001 0 R /XYZ 85.0394 427.5127 null] +382 0 obj << +/D [999 0 R /XYZ 85.0394 714.3516 null] >> endobj -1005 0 obj << -/D [1001 0 R /XYZ 85.0394 402.5515 null] +1002 0 obj << +/D [999 0 R /XYZ 85.0394 687.455 null] >> endobj -1000 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R >> -/XObject << /Im1 795 0 R >> +386 0 obj << +/D [999 0 R /XYZ 85.0394 373.1735 null] +>> endobj +1004 0 obj << +/D [999 0 R /XYZ 85.0394 348.7476 null] +>> endobj +998 0 obj << +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1008 0 obj << -/Length 3433 +/Length 3036 /Filter /FlateDecode >> stream -xÚ]oÜ6òÝ¿bïéd «ðK…<¹©ÓúÐ:ãÃ=´}we[ˆVrVÚ8Fqÿýf8C-¥ÕÚ9$0
Éáp8 ÎW.üÉE’Æi®òE–›82Y¬6'bqc?HÆYz¤eˆõÃõÉëw©Zäqžªtq}в±°V.®×Di¬âS ¢·ï/ß]üô﫳ÓÌD×ï/O—*Ñ»‹_Î úéêì×_Ï®N—Ò&2zûóÙo×çW4”2 ..¤žœ>Gˆ^¿;¿:¿|{~ú×õ¿Nί‡½„û•BãF>üñ—X¬aÛÿ:±Îm²x„†ˆež«ÅæÄ$:NŒÖ¾§>ùpòû@0uSgå'E¬4ÈêP€fV€I §ZéA€2¥¹!¢ëS)eÔ>´u{÷„Û": "K•ÆˆÔM?«ëÓ¥Áý}¹EPEý}ÕÜuÔ}SLÝå§]Q¿¤ÿx_6 ¹$Ì®Ü~öV÷mÛ•L¢ OSlJÝcʨo©ïÓ®Ü>Q×íöTڨݳUTW]ÏŒÞR£ûà IçI¢ÜŽˆzŒê\FÌÑFŽhy #Ø¡‰o i›Ò÷Œ\y cµ*êú‰†V5n¬÷ãŒßwe} :˜]ß—,öðì´Èâ4^‘Åþøñ •çŒØõE_nÊƯw -òøX2wE3³ŽÍb“f Ï/ÖK'¢¥Ñy,“ÌŒEµÞ–]7½VÂí”j‘ Ð2+¿ê¨8·ÖÎ߀¥'¸ ) j·…gûU‘¿Mѯî§üI©bµý~ _àPÊ$Ö -à“N3Rfq¦•ôѬáÐtUM_nYûŽûz?†ßU ›ÝC¹ªŠšÅ“»Øhè2 7 -å€ —ÅïínK~ `ЂŠæ‰€&Tcì û‚+ô+?ƒ¼n #c !-!riyZù¥Ø<Ôå+²I6öÆÒ¢-û…e -žüo·g¥ã #‘ÑÎ¥xmßÌéô?$„úµ2oæö7œ×2}C
” ô_š³œ]‘c‰€{:Deeàl©Í.ÊY -ç¿Oõ¾M9Ç¥ó\?ŸB* ÀA„y¡öy¡¿Ï -{¯÷aÈ0^L‰‚6ûé\%B8RPóÇËÔæ¬ÁMñDƒ+˜FËC¯³Bй SÁ9ŽhwXzWû®;šˆ&óêªsFÜaݶÛKYq´øèÍæ’Ègnü2e 7`œI 0H™-B>³E˜Ý!ŽK”Ab‹cÿݶ¡6ù<‰€¾Ÿ‰øhÔDnuý˜ F`bia³.!…ÃqR/ï Ø™q¸Ÿ› Òh”%ýlê -¶IâíÐv |,Û-ž¨L"béÔaúŠä«fz
˜•4Í“…†‹šÔ]CÜÞ±qº -*%þ2œàmlàƒè"; ÊÛ`ÆßsÀ“Mâ\@æ.qP³°^â䀋 µHå)k0´ª«AR^akÒ& m׌YÇ®^‡xÅv[4wÁ: -ˆ-è(3¤ ù‹n—ñ—á„9·;¥;v»ÀØþ¹â@¯œ „Õá3n—±^âä€Zàv5¤ËT@uÇÐ>ÀUTÚDšÕ³'&
èQ>$+Ï›©GÜì:Oß½ p¥^ -žIz¡¢‹ßH‹d|K3 gYÜ´$ÇiîËVùø2A9{û ”í äö•P©6Áu×SÙiê8V2’ › -è;Z•åéwpLq’œsIœff¿ðqÇF7×™ýŽ<zŠ/ñþ,Wi:fò˜FšXg‰D¤Ä Ø-}Kz=È?ü‚˜O:-L¸žßÕ}¹úÈEEðx^‰|b£Š»¢j|]¡ß—‚¬Cµ°ö "‡¾h -úðÛǨæßîšõ\ ÷ž 5ŒL äF5y‰0ôº<šÁÜ ò}ÁH7ô’cø‘©\»—!HÌÇ“‹× ¾Å±DŒÐ„(¸G¹ñò.fÆ©h=fàý+…V Âã[C±êwî©PbRUmª¾ú\RsoG¤ðoÜràœ‘|¤œÈGJÒ@ÜuÃÜ–¾àÂÀÑûeŽÎoævEg¯òii ß—ZúnÚÏ“žaÒMyW5
%Š´|4 u©™v¯W#œÐãó3–¢W(üp½,$þÈ\x[þŠŠJ=å|Lz&;ëJ8q':
¿Â·ç¤žžûdæ… 9 Y^€ -; @ ž¡_J$ÀÇad1jœeÏ•@¿:‘`ŠËä\"¡c›™í™LÂE£’ïÇä@ñ&Ñ)H-õ˜Éã™Db”e»'l<¥9_(b!•þªð>D`Þãë«ôá«Ógb`521dŸ5ÆXvâþmS)O=÷ÄØ[Ðgÿ"ì:ÝCXêK:éÔ†§‚doÃurSá ÌB¤MÕÐ+ôášÆ[ïWo[ŽDŒŒÀœWCgq‡fý;> -7ÞQi8x+$a1yRÊà -òPg~âŽ[úEiWªªyìZ ÀW><›ºº$\—å—žð6n ˆrøféöå6lðO˜Äô§K!³ÂF¾®ËõOÉ 3MË×ÊÐs„–Z¦¬Ö€XÜöTeµ¾ì ¸eÅ¥Ga÷%UOR1I®#zÙ¿ñ -KÊ?ã ܯ$ô| û»ûö±!0ø‰ûÑ]Ç(”ThÊ;Itôû ˜€?QL þÈ[}XÃ4ÿLGûÀ +xÚ¥Ërã6òî¯Ðm©ªƒA‚Ggâ™u*™É:ÞÍ!É¢ ‹5|hDÊçëÓø°(M¶¦\e4
»Ñ/€â |¡â0NEºHÒ(TŒ«E^Ý°ÅŒ½¿áŽfå‰Vcªï o¾{‹E¦±ˆÛÑZ:dZóÅãæ÷ E¸„Xðöã‡w÷ïÿûp»L¢àñþã‡åJ(¼»ÿéŽ ÷·?ÿ|û°\qxðöß·¿<Þ=ÐPìÖøþþÄI©¹°èÃÝ»»‡»oï–>þxs÷ØË2–—3‰‚|¾ùýO¶Ø€Ø?Þ°P¦Z-NÐa!OS±¨n"%CIé1åͯ7ÿé Ú©sú‹”•ˆb«I!æuÌÄs I¤… é8šÕ±§B LkÏf³j›ü“éÚ×BsÉÃT-Æ+Ÿíïhf¶—£í¹ŒÃTr9Ýÿqg–«ˆ« >Vks@8š-áþ`L”n|cÚüPì»æÐâ°ä:pÜÓ´ms ¡Ç·¿,¹Hƒ7Ôm»MÑ ¬’Àt9؃f1ì\¸•jc6ìj׆–\O¨Ð± +¥ä„EY•°Ì›º9>íÐl´‰mÞ<£B¥A‡²!Έ0ʆmQwæ°ÍrÓqU(•EÛ™ºuô5p.À~»|¿ÊËÂÔÉÜÌ“)Ë1fàeouÔ<C¤Ôo*+ó·Yí Ú?vOMQ?QuiÏGs(,·ÐÉê
E7UOüWS‚ºCV·[shAÛÒjÛ
lÌ6;–›míí»w* +‡LòD¾D4µ¦ŒIhGc7QÃ&ÀQQ +ê<gåÑâ“ùýVRH耯L— =³¯ +ÿyH›“©ãP³ïŠ¦ŸöBÀÚñN U5Ö¡QÔƒtÖ xÌ %éTSÛcw¤¹¡7,ÁC©˜v.nw‡ÐÚïð.sȲèºÒl¶¸ÌÖä›àˆ[*Pa½iNmx–]ô‹¥ +5‹øõ9¦º "{*ä Իʳ|gVmñ—9 " +“(‘×÷ï©f˜˜µ +2‡–zuÙ +`×ÿad~C žvE¾£ùŽGƘ]öìxq•Ø:T D5
•Âå~a
¹¯‰¬‚Ã+jÓÎÙ0YO! ÷ûæà:UãM{”f’‚ZÐFKªÈÎpQÇ.µ‡šóN*àÐ rß´EW<»%’ݔϦ‰Ÿ¿'€¼Ùî馂ö w›9Sõ5!ê„KòqhaA䈋à¾&LFM : +ê“bosLy.Ì©ÅãܽãRû}Iu‘]pŸ ²ƒÆˆ€€ðq@k`Ðb¨#·Z‚ÞÂ9Ù¨¸d8TPÐñ©•]Ì‹ŠëPó¯Ü FD—³¢'²¶Õ(Õ©+( çiQ²PCíquûžè|ÿéÍs¡Ò\NL]µL0±²’VKûngs– h{ÕÙü‰Å}µ(B)ÝÜûí$g¦¯µ) v~ÓÒÔ>!ª(,~UOfy,¥NèbÓÙpˆ=!"L.ñm^AC”úÊJL9åMÝQÜ.ÝØ®9PeèqÙ²ÝQ×$ îjý’™ã‚Ü !t/©5éoC8HÑ3Vè¥6Œƒ«xÊÀ¿mF‚Ý$ ©Ü¸Ëüà k³íã Ž¬M?oŸµ +»¡c¦(áî4ŸÍYÑbR¦¬2¶}HŒaÊbHQ¹ì_&x rQ‰1üW£fSää‹KŽœ·Ÿ¨{7=ˆyí%•i FI¢®»è˜ê²öT6s—T(¬ +ǹ—F \k¯²ÐSÍð0õÓ4ä‘äS&è†÷0 ¶K ØK>té„î ØW£âa3&hª^rGvVî éPÑ Iç÷va×®ÿeæ¤%”ÞPpûR£×+t * %S»ëõ•2PL*_ŽõÑÕÐ sñ(…rìXO‡6fÔ^˜3Ü ãê•ñt¸DÒÚÙ‹Åp[™DLŠéºt?$á ¯O¿ß’ùR6ÅðÖ¸Tó†ÚÚõ÷ã÷z£žsC¼Êå9 \4.&* l@¹/¿â#ª+nà©P’ÉÝÚdÝ?Ð!ƒÏu zª&&~Éq O¹ ?`Ã¥+b>#´±"4½£ ºÊç:«ÕÃPq¥¥1zïb˜Ü"8¯%\• >Yÿaö]hÆÞeƒ¾`Þ@A~ÜÏ2X‡†\¿ºôãÀX9d¢}žJÒÁ%,~pekÇ©òv¬Ç¶¯?›l_m æ<˜¬mêl]º©¾€D¸¿ßàt€Øi¨å„W˜Ëeè<Š°bNÔÔ-(‡ÚŠ ‡úGdxÔI_€B—Ã>¹ bF.7·vLÞ•ÄλzyD„õ.-È» +ßï¨ i]©èìáÿõD‘°i0«ž8¦ºì‰=U /ñÑóŠ'*pH Wyè©f˜˜z" áf«§\¸J: ½ úlnk‰á7
jÓÁ õQöBÐÖŸ]Ê,Ê\¥‰ó´y%¼â\ó+}–=¤¤j–Â6%Õ«lïV<µï«¶E·ÂvX¯gVíí›C‘åì{< í[²o„Fö=Z×?9ÂÚ÷[±ö +·“»Í… › %T"ô @ÿ´.edoR^âç‰SéÀMÑÒ÷W !nü!ûx4£‡ÿ
+œ»5†€‰²lN~¥µ£p÷˜×ùBkô%_Ñ8›z6exÚéCÒôHúgæÞÑ'Qªíš½ Æú’¿ O? 0ÿfŸ–Ÿ]ü{¢à‰;œ `Y~1èqà9åW.ÊcªËA¯§²O… ˆÛvEÞ^Ãc~…‰žj†‹×u8”Œ¯Øø`ŸŽä¨ +5„¹¹Å>kó¯#†ŸŽDpQÑúB°…†1ÄJBX‹Ê%Σ<T‚2 ÈFÌÿ
Ñp·gendstream endobj 1007 0 obj << /Type /Page @@ -3451,1127 +3461,1137 @@ endobj /Resources 1006 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 991 0 R -/Annots [ 1012 0 R 1013 0 R ] >> endobj +1009 0 obj << +/D [1007 0 R /XYZ 56.6929 794.5015 null] +>> endobj +390 0 obj << +/D [1007 0 R /XYZ 56.6929 459.5865 null] +>> endobj +1010 0 obj << +/D [1007 0 R /XYZ 56.6929 429.6043 null] +>> endobj +1006 0 obj << +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R >> +/XObject << /Im1 795 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1013 0 obj << +/Length 3431 +/Filter /FlateDecode +>> +stream +xÚ]oÜ6òÝ¿bïéd «ðS"‘'7uZ Z§u|¸‡¶ò®l ÑJÎJÇ(î¿ß ‡ÔRZCÃ?†Ãáp8ŸË þøÂè”I«¹U©f\/V›¶¸ƒ¹ŸN¸‡Y e õÃõÉëw™XØÔf"[\ßF¸LÊŒá‹ëõ ÉÛŸÏ~»>¿:] +Í’,=]êŒ%?\\þH#–>oß_¾»øéßWg§¹J®/Þ_ÒðÕù»ó«óË·ç§Kn4‡õÂc8²àÝÅ/çÔúéêì×_Ï®Nÿºþ×Éùõp–ø¼œI<ȧ“?þb‹5 û_',•ÖèÅ#tXʋ͉Ò2ÕJÊ0RŸ|8ù}@ͺ¥süÓÒ¤Úˆ|†j–Ú¦™Ò1Ï̳” àc,¹>åœ'íC[·wOx<@"#$l±YÊËÜò³º>]*\Ñß—[lŠ¤¿¯š»Ž†oJhÓpùiWÔ¯
œ~¼/› +@$o{CMƒC~Î Td,‚¿o·½Û7Æ †‰ñ”iÿX–
T~/Ñ6^?‚år“3ß³ ÃÉ`ü±ªk¼™ÕˆÑ}‹a¾T›Ý†F㻲‘ + ºîâv€Ø߉õçeIÓRßÑŠŒS ë5é<´?LyA²$›‘ Í îñ¾B> MÇmñ{»Û’1Ãhõ†ZEóD&c ÷‚-/Я +dë™G ’ <ŽÖ/+¿›‡º|EZBçc“Ì
ê’±iXf`Îÿvg2µèŽŒNÎÙkófN¦ÿÁÁ'¯…z3Ç°¿ 1À¼æÙêHÄäZÿ¥5ËÙ iòСˆ¨§K†G—úÞ.cG8
€ƒ
¼ˆvû‘:œÑ׉BmZ÷Þ„‰lëº}t<ˆ›'úÞÀ³,õhÿdšÁì¦è>Ò¡uŠÿ + Nçù”1€ø!Šƒ©ÝYŸ |}k%ÁDmwÒ=ÜÀë‹
_üØÂyÑ‘Þe„ØȨØÕyÊrp•”à)çJ äe²šRϺÂ#œà +É`ÞUN¿MÛûT®¨wŠÀécIhÙtÊ1eÁ)Wz_Ö·Ý?Jš¶™],÷ß·IçX¤¤µòùè +® +Ý‹<ó霯:7”'»ŽÞ®q¾/6ön|éñ‘’~ 4œQ§fS¤ (rñëB·¸õȼ+?Ý +ýkD~§ÐÇ$¯æÞ.U +÷¡3¶£¡•{CÐXã¦.H©ü”sßqyˆo |ëý«UïÞ³jþdLÜí¼ã…ä1›üÇåÉ Â<\±òF ¾Ê Sq0ø*Ðæ©@Ž g 6 ÈäºïC¹E•Hþ3%„É‚§Ov™ôÑ:ε × +42U–:þ˜ ¦Ÿv•‡õ˜®â]^ÎïQ,×.lˆÏÊ´!™Ýı »%ãÔŽM³L_k°‡úMªTs£g’t`bQ©:]Š›¢o–,ÜÏÞ16Ÿ½ãÒ¤ÆÚlHßÍfè$—©ÎM*µÜù·&¿ŒËå¡!A]ê,×ûfè$9oâ;0¾D¤ÊS# y<Cà8CÇØa†ÇzºDÐ7
lÚ!ë=—ªCq¦t1)^gQr’Gó)„Œ ±µ(à›~E®LœàbÆÐîuëž„ +(’FWZpêH3D ö%«à—ñ‚³{€wlw3 •,›¥†›I3f—€^ ã +@Ÿ×!Ü(ˆÁ¤\!RàQþí ô€q£œI ›<µ +3šù„ι8 +7~%É…H.~#)âèæjìD¦³±à +•$hÄÔH%&eEõåÑ +O
ß è†Ê8ÊW˜Êµ+ AP>^,<{Õ`\ ‘Ã]p‚{ä›ß޹̸ÕÇŒÿ»/QHá=x,4«~çê„ cªjSõÕç’º{EÂY¨rórê xFüá| ÎI +?>W#ôTeþŠJ=…| õLpÖ•pãŽu&¾_&„oïczªõñ<0B>R½Ð*ì¼GbLš«ágÇ.³`Û2åjÚyþ\úókuYÀ¸ŒQÎÅ ó\ý +Yʸ_åÚk¦®=^yð^l8»‘‚!í >8„së?ȚȼêÏs_ÆÑ‚>ûb°t5°,äs²©Ï˜÷ƒÐÉ+ÎX¨•Å@›ª¡ôáž•GŒo>ìÞ ×šTÀœM«€CSq—fB Tqt¥É÷õÛ¥’Ò_…Æ¡r1ýäX••#Ú!ÙÒÙ¯r6&Þl’ECd0X%£–\ÛWÍ¡…UóÅï() • ‰a˜Fžäñ0w<d˜ŸüÀ-}‡t´ËSÕ~´ZúßÝ— *¦.)ñÖeù¥'¸;‚ –+ À>׆ ÿ&6ýéRL,3IHêúä§I¸Å(Ó¤üµP4å)B=Í3/Ö +endobj 1012 0 obj << +/Type /Page +/Contents 1013 0 R +/Resources 1011 0 R +/MediaBox [0 0 595.2756 841.8898] +/Parent 991 0 R +/Annots [ 1017 0 R 1018 0 R ] +>> endobj +1017 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [213.6732 308.8411 286.8984 320.9007] +/Rect [242.0197 308.8411 315.2448 320.9007] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1013 0 obj << +1018 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [209.702 230.3842 283.4678 242.4439] +/Rect [238.0484 230.3842 311.8142 242.4439] /Subtype /Link /A << /S /GoTo /D (topology) >> >> endobj -1009 0 obj << -/D [1007 0 R /XYZ 56.6929 794.5015 null] +1014 0 obj << +/D [1012 0 R /XYZ 85.0394 794.5015 null] >> endobj 394 0 obj << -/D [1007 0 R /XYZ 56.6929 769.5949 null] +/D [1012 0 R /XYZ 85.0394 769.5949 null] >> endobj -1010 0 obj << -/D [1007 0 R /XYZ 56.6929 749.6227 null] +1015 0 obj << +/D [1012 0 R /XYZ 85.0394 749.6227 null] >> endobj 398 0 obj << -/D [1007 0 R /XYZ 56.6929 377.478 null] +/D [1012 0 R /XYZ 85.0394 377.478 null] >> endobj -1011 0 obj << -/D [1007 0 R /XYZ 56.6929 355.0589 null] +1016 0 obj << +/D [1012 0 R /XYZ 85.0394 355.0589 null] >> endobj -1006 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R /F86 982 0 R >> +1011 0 obj << +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F84 802 0 R /F86 986 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1016 0 obj << -/Length 2147 +1021 0 obj << +/Length 2160 /Filter /FlateDecode >> stream -xÚÅYßsã¶~÷_¡¹'¹ÁøIwOÎÕ¾8Óø:N’éÐesB‘ŽHŸÏÍôï P EÙjÜ›Ž .€Åî‡ÅîŠM(üØD+B…‘“ÔH¢(S“åæ„Nn¡ïà ócfaÐ, õíâäì2áCL“Éb éÒ„jÍ&‹ÕOÓ÷ßÿuq1?qE§ 9©„N¿½ºþ3J >Þ¼¾¼úð·ùùi*§‹«×(ž_\^Ì/®ß_œÎ˜V æs¯áÀ„Ë«¿\`ëÃüü‡ Î秿,¾?¹Xt¾Äþ2*¬#¿üô ¬ÀíïO(F«É#¼PÂŒá“͉T‚()D”'ŸN~ìF½nê~Jh¢4OG -»bJŒ€p±+6õ¶- ‹GBéôwgÄØàí™ö;Ž(ëeVZ -úÍëº,ëÇ¢ºEMÖˆ±ýñ†Æáû®/;Ñ¿÷ŸVåL¦Dsš>«9XiøÂÁáe™5
6ßæÍž[)Ñ£x?4~3 ûÆ£½õ>x/Ï×Ç¿7~4nüXÜø7ö‡qc_
7ñJÜÄѸ‰cq/áÆ_ƒ nƒäþª¿@»[¬½ rà’ò>ßo±X`VËÚ.+õ“ ì E;D`P6aó$‰³ }Í¿d›ûÒ÷a]³[(¯ØÂ2”5u•Ý„q7ù]ö¹° ¡Fßhþ(Ø&ÖaÛrÕ?ˆlºÂÏAµÉ®Ú¤è]í› ®§Wv•L WNÓiSlŠ2Û¢Ðò÷tÆ©žñðV¯ÝQyFž¨·¨P¨g2•Ä/ÞŠyÞÜו¯é0-¯Ú¾¿cuu¤eÄ=¤! mÓóÑ‘Ä'ûì˜ ³ê Ö ûìtô¡µ’ˆHØ×L•&±¶Ýpk|vnØ—ˆ{y+F‚×óJ®E·÷šãÞƒ(ÃÇ `@Lx`@ÇÀì‹Tó.§n@¯@„+qʬ¤É6yO+8/i¡\ Ùžà°hKi°Ér³ºÅÆMŽOCùêYª¦RµD‘T‰ñŒSµ!½Šò }‘‹ÅIq°à Éð¾õ. ©À1önÅ å9Ú8Ÿ7¹GâãvPAÖÍT ’dÒ)ùû]šn ʶ蒓Ú=W
ÉPh ¶•‹è.ª{üðªyt{gû|^ÚdO(¸ñj < J”¹³ OˆÅŸ)å·ñz>ß©©·)÷yÐå;ùî€é#[r_fKgµ`µ[VJ¯D>¤]pÚ|±º@&<Ø&d£A¿U»ÝÂÌj þòŠ•rãÇ6mÖæL[°ä}¾Ýî°‚!;ÿ³¶pç F8?áÙYÙá€åæí
ƒƒ2lÒ~ˆþV”á#Šxëë‰e;~Êýø¬lêî’5†›Ná.UÀ"œÃ}Є$”ó!fß ¿%I’ª‰`Æm¯ëØ·½`c ÝïÃðY<~ÿz¿§Õñ ²dîá Š¡A’'DÀµgÑÞw†nÔ †ìk³–àõ}&$¡Id?·Wc¸'ö{Eêáì56œq;Î 7kLÊŽùâ‰ÑZo™ug±Jt²g 7à›Ü-ì¶ü>_Ž„çDRÎ]ákÂ*·Ç¦ -—öÌ‹‘„5oG -db"@ÖÃ.bå®ùÏÊU0f©|ûtïù´mÅ=Ø´=oVõ&+*×ù9µ!Z§fPÚ þž¯ LجD'JYøP‰{µÆ UŸF¼ÉVTœ²©oZô -‹I¾ ,t>ºØ¼±ÎàŒû)Íh° -"y—@ž³-yÞ6ܵÝB€7$'¡YÒ߬¾¹!µù°óæÚ—‹?s.Ç §6îhÔŸFÌ–àð àÔ BªhÖ´&ͯÐfþô3È‚Štì³Êü6ó<ésV>äÝ‘ØŽ§5hP"Nã1 '5])ó´àí^*)‘*•f(á)åǤ!5Iãô“É › ¡»«ÜA p ]¾f ³Yp -.Ü”•1²™DCΞØrk(„“ÛN /xÍ@ -4ÐÕb„tÞ£^’FÔK²!õ‚nW½eˆI“$”?í)ê'L˜4ÐB§ÿª«|ìŽag•9Ù+z¸l’ðI ÍëචüKïãñ*ÃŒÃ;õ]RÈ^/ì ‚“e~ÝßÂÍ/’ÿŪ÷Ž;u¨hG¿šzÆàBøɺÛÍTNŸ=òçu}]Ø%ToiÔK°KËŒ¸åÓ²,–_
ö,P?T«¶nBÿ±yö¿Ú€ÝßTÿÔÉCDÊdPMXšÆ4vÎ -št7 ØDØëgÿ5ž§RŸQ.kÉ÷ŸÈÞ ¸½k ºfï²ÝßCì嫈Ð]]ïضÎý·À }³W|â
!Ëzó&"iØÄÃùîП•@Ùì?Œ#”ŸN^<PÇþ‘¹û—WZ¢ùKLØo”ÅCíÝWº<÷Mÿc©Mendstream +xÚÅYmoÜ6þî_±È'ùÐ¥ù*‘É'7g§.®ÎuãCQ´ÅAÙÕÚBµ’³’ãøŠûï7äZJ«µ}õÖhH‡‡3µlFáÍTJRÃÍ,3’(ÊÔl¹9¢³kh{wÄ|Ÿyè4{}{utržò™!&åéìj ÙÒ„jÍfW«_’”pr hòöýåùÅ»,N3™\]¼¿<žsE“ó‹¿¡ônqúç‹ã9ÓŠ%o¿;ýûÕÙ›RoãÛ‹Ë¿¢Æàã€ÑÅÙùÙâìòíÙñoWß ]õk‰×˨° ùtôËot¶‚eD‰0ZÍîá…f ŸmŽ¤DI!‚¦:úpôco0juC'ñc”pXí(Å€ÊTpá +Û¶hJ'MMÝMÞ¡40Û5¡¹@NXª ?áÒWÃ&á›t0Õ 6¬xÎ1JqçþwŶD7L‚n-‹òs±Â±k§j6Øž£ò¦i;T ß:8fúÙ¥Ÿ ºltQc±9@hA© P7Óx0'V3‚Ö†šuÑ>aH¹EqUú…vv«Y6u
¯vÕöu€Øɹʢ °3fÄž¹ÛfÛU¥Å#¥4ùÃ9Å1ŒÊ¡k`ªYæ•ð
LÅ(hNN°åâÜž,J©¾/ŠòmqØ6øÞ¾±–ÒÈöÕwg—(Ëmpv]zÁB”ú‰'æÀD¶Á¶Yû*Øw>¯›ªjîËú-Y'¦öÇ;‡ï›¡JìTÿÞZ“s™Íiú¨åà¥áS‡/«¼mQ|;ˆ3¥zï»Öo&aßx´·^ÁGïâÉ
þú¸ñâÆŸ.n|ŒûÓ¸±¯†›x!nâÙ¸‰çâ&žÂ¿7þ2ÜFÈý Ôp‚,^n¹öK£%)¿æÛ- Ìjy×g¥aRB€ƒ¿“iGD`T®lÂæigAûZ|É7·•oúf¥k(¯(aÊÛ¦Î?†~ ‹›üsiW„½Ð…9|Q°"Öa+¹ê T-Š®ðÁsTí@³«v)zWûæ‚ëäÂÎ Ò¤tå4KÚrSVù•–—¸§sN
œ‡·f=jŽÊ3*lõD»ešÀ ÓDC¾x/E{ÛÔ¾¦Ã°¢îb²äÓÝ1K<“±ï=o™X!2a”Vô”FôüC +¶<¢}¬ÆŽÃL©ÖÙŒH8&cÏùøÂÁ9§?½ÌƒÁyl—8pR’f™ÚMì6ý¶XNçDRNSé ê°§÷÷Ü«‘µ¯'ª¤c"™ýhCt'þ³veŒYVß=Üzjm¥¸EÛòjÕlò²v¯^˜Q}sð{êz0kÏ…":UÊâ‡FìØ‹5~©üJâ]¶ªR¨-z¥Å¤X%:
ß_læXçpÊýv2V€~§YHo§—?OoDjd(‚æÐ9íRó +îÞP ”1ÒSDBÖ³õÖPˆ&·›?_ðÂ5B¨ 5Dt1 _’FôK²1ý‚fW¾eIè³$Ô?ìæK4²B“5u1uÕ°£ª‚Œ÷[ª ’)T—™—¡m÷˜ÞÅç› #o ‚£F!y=¾°*c~æ߯“ÿÅþ©öž;õû§hO¿ÚfúàDøíºßÌL& -çe}]Ô%ÔniÔ¨KËTRŒ·åò*—_
õ<êÐÜÕ«9J Cûsñö¿Â÷sÕÿ#o²Ô‘q`§\–e1…Ý£²<Ó°spAu%Igòñ_Ï€ä©Ìç“óÆ_óý§²×îïh®Ù»kE7ø@âÙ*bs—;ê†Ò©ÿ&¸ãnö’O¼#dÙl^E
E<›oýh |ÍþÒ8A÷éìÉóôÜ 4w¿öJËV4ŸFÛoŠNY<”Üó<üò¹ïú endobj -1015 0 obj << +1020 0 obj << /Type /Page -/Contents 1016 0 R -/Resources 1014 0 R +/Contents 1021 0 R +/Resources 1019 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 991 0 R -/Annots [ 1018 0 R ] +/Annots [ 1023 0 R ] >> endobj -1018 0 obj << +1023 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [353.6787 309.2241 427.332 321.2838] +/Rect [325.3322 309.2241 398.9856 321.2838] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1017 0 obj << -/D [1015 0 R /XYZ 85.0394 794.5015 null] +1022 0 obj << +/D [1020 0 R /XYZ 56.6929 794.5015 null] >> endobj 402 0 obj << -/D [1015 0 R /XYZ 85.0394 379.8143 null] +/D [1020 0 R /XYZ 56.6929 379.8143 null] >> endobj 700 0 obj << -/D [1015 0 R /XYZ 85.0394 352.2229 null] +/D [1020 0 R /XYZ 56.6929 352.2229 null] >> endobj -1019 0 obj << -/D [1015 0 R /XYZ 85.0394 202.6239 null] +1024 0 obj << +/D [1020 0 R /XYZ 56.6929 202.6239 null] >> endobj -1020 0 obj << -/D [1015 0 R /XYZ 85.0394 190.6687 null] +1025 0 obj << +/D [1020 0 R /XYZ 56.6929 190.6687 null] >> endobj -1014 0 obj << +1019 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F57 628 0 R /F42 601 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1023 0 obj << -/Length 2922 +1028 0 obj << +/Length 2936 /Filter /FlateDecode >> stream -xÚZÝsÛ6÷_Á·£fBŸ$1÷ä&NΫsç¨Om hŠ²8‘H•¤ìèfî¿ @‘RÓK'3¸X,€Å~ü2
ü£LâD1¤JÄ’P»<ÃØÇjy"Çù\?,oÞ~HX b•°$X®=YYL²ŒËÕ/a³xHøîÓÇû??Þ.R.ï?=,"&IøáþŸwØûøxûÓO·‹ˆf’†ïþqû¯åÝ#%VÆ÷ï‘¢°¹ ôñîÃÝãÝû»ÅoË oî–ÃYüóRÂõA~¿ùå7¬àØ?Þ˜«L¯ðAbª v7BòX -Î e{óùæ߃@oÔLÕ %1ã «©eê)0q€’J'œq£À¦]•í"J ‹c±Š¿ë3McÅY +)™aþ¯|ûApO, "Nb™ÊÌð¼VÛ-h)IÂ"?t%vóúˆvA³°ìöMÝ•&¥áºiq¬?î-ûÏ\4¦]uH¬j+}›w–tÿ€’úMÞ#e“¿XQ¿2&pÓ#]0ÅbžRЫÙô¦éú¸üšïöÛ2.šÝÌ1•ŒA…`ÄâÑì&rlºÃZïöWBØ×7@JiØ7¨RžáR–:¢çÛ×üØ¡]=•ØâÁûC[—+¤˜S둼^ÁöLßꮌ,˜SÞåëÁ~£ïõ$ÍW#s¤þÑzh³ëé3ÁÝÓ ¬Š$æ,÷käÜ ¶}ª´jô½X¨˜&"³jlÛ®ì#´Á©Ê%;UÒòv}Þ—»²îÝ öû27{yƒ8ñqæpuÓÛ³4»§j8!Ü`:ÌÃX”emêrXd[•]|ÉÑ §¯ò[<²X))æ= T™¦q’$â²,œG@–íâ ~&êQešÄY–¥C@ -yø´œI3à ,Kœù‘Íš;pÓU¹Ša5Š9véòŪ\çélÆìf`å"Vs0PÖÌú: 1> 8%6Võ¡/;\Ú¤£zu–³vù×jw°ˆà%ß ÊkÛÇcŠ»íÐl~?à)„zÛáÓíÄ—<@8pyÕ|®Ë | -jcQs~@ãåòúú×Ì|
PHM£”Ñ– ª`ÒZÇêPhu3ÖeÿÚ´_p°oó8ŽÇt(-pnn°1Pöe x—×E© „¼\&ONº¾±àÇêò\æÅræu÷Z¶ˆSδ ¸ÏDò±yOÕy¦ƒp ¬Òxã! úöŒ“CÛéô¦;9îód@³ÀR8·W™ -nVQz= ù\—ãÑÀå4}9 –”„suùkfýq8U§i2Þ€ÍÌ2qÉ ñ“tŽdt4è¼nªb3šãÅ=n¯1R7tmÙWÕy{DŠ6Í}ÓU}Éø¥té)9E¡ˆ³Ìn_¡ÌÈÎLæ<yŽë®×²übë4XÌ3’«É‡ëŠ1!t٠וËv\沫:j›¦ï&MÌÔ}mékfíÑEQŠ—Ñâ6|ezîzÕ …Á€AaК›jС•½Ù‡ìÛôP×ÊÆæß•Íe8jm%Cw;q•]Æ`-HVÍÎVmåÉZƒŠEœ,Á¾€E¹‡À¼ÊFú‚ÒC¦®‚csoè9È01œŒBÁñ—ƒ ”‹oª8Ì3<—Ëxš*ögê!;ã¬xq»‹—P†H~¡ŒÏ -œ
ö/)ãàÈ—<-ã5TK8ì âJÌ¡º4grUì¨~6„[û‚ =u¹bõÕù}7ƒhAøŸ©X¯ÛOÄTÓ©2¾"¡v¸ Ë\)•Yr=–
\eTÏäÌjUõǨ¶ð5‰k"dBÓÀ_`× ×Ì>FqM2]âŒ÷ñy_•†ÈÑrbažî¸Ð¦û:´é'ºZÔQe4a}èîÉO¿nÊ{ï >¾{‡}8x;F»f~è›]Þ»C±&lj -JS|·Øô\Öe‹ †SjÞ~59ÇO+ÙÄ,M6{úêXç;ýŠª‰‡ý -t8¢“Û¹ê™ÊâLÑ, Ða„£ÂÁöÙz×ãGß`,äO˜^ÂT.¢ˆ±¹Þ›ˆÙùn8TLÀ•ùÂ'†0pýÁ ¦ÒliKk Z3å×½ML„¢˜Œ6]ZÐæË\&¡ -H øæsÈ›Jˆ^™CÞÚºbVdÌ©8+—puâÕÛúÃÖÛºkžþ Õ¥»neÞZ’AòÍ!.)å(ÌÈIðÈ:ÌZ'F¼ øD@ç/ˆ -†J³X%œÝÛ¼w£ˆ¥« -‡Ù×ÿb><.‡éµÃâSz¨|»m^±k‘Á€Ô·Õ®ð~¾kNJc!~±m -‹òº/å«.¯/B;¸è¤âz8ô¹.‡Ãk€våº-»M¤÷fxW™%î¾=Ny qâA ’ˆëG¸fÎ0ò $‰eqtˆ%VÐTrÅtøæÑ#<Û"Á\î8ØŸŠðog™~¬:ÇéOå&©ÌÕrÇ5¶hkñÌ»œ¡çØüŒ Œp4 -®_Þô¤Hß³ve!ÒK…ñÈ%Z£`áó¶y2ÖEéð m¢ -Ñ §»‡¸°‹v w±š×<êgñþð„$½©Î.o‡¹þÑ{·Ÿ³è!d£i¿ézÚ½ {Úrq½öAb7à´•÷àrù'Q -Xdœ»MiUI1Í1ö(¦[ÿ ëo endstream +xÚZÝoÛ8Ï_á·“Jå§$âž²mÚËâ6½K½OÛ}Pd%jK®$'õ÷¿ß ‡”%[v[tQ ¤†Cr8œßÐá3ÿø,Õ“FÍ£"͸žå›+6{‚±÷WÜñ„ž) rý²¸zý.3™XijÅã`4biÊg‹å Á›]ÿgqs?…fA ÍC ³à—Û»·D1Ô¼ùp÷îöýï÷×óD‹ÛwD¾¿ywss÷æf òTs˜/Ü +g&¼»ý÷
õÞß_ÿöÛõýüÏůW7‹þ,Ãór&ñ _®þø“Í–pì_¯X$Mªg/ðÁ"nŒ˜m®”–‘VRzÊúêãÕû£vê”þ´L#ŠdB:(3™DðY¢MK!ëfY4ó0f,È÷ùºÌÿ‰‡š…<‰ŒÄE9ŒÖÂ2ÿϾ~§ä`]6 %‹t¢SËóR®× ¤8òl×Ôͪ=uš9Oƒ¢ÝÖU[´HJ‚Ǻ¡±n¿uì×C漶í²%bY¹Õ×YëH·w´R·Ê:¢¬²g·Ô'! =R†0"’ ÅZ¡WuÛEÅ×l³]Q^o&Žit«~‚]–Žæ„Ȩiw(í'ÆÄ×W@JxÐÕ¤R™‚årXÍé”L8[¿dû–Ìê¡ –Þ횪XÅžG²j âÙ¾Ó \ X)X®ä,¸¶ÊÇÁn…÷zXm¨F fDýÖ~d“ûá™àîyÅ‚Åö,·Ä¹Ù»TéÔ8tce" «Ô©±iÚ¢ ÉOU®Ø)¸ñ¶]Ö›¢êü ¶Û"³²¼"œx?q¸ªîÜYêÍCÙŸn0éçQ,ʱÖUÑo².‹6:ç鱗ëü Wçà€F«iWU&IDZ:¿Íc°–ëÒ y´Ô!¤ê$ŽÒ4Múˆ +† I¡Èï7¡a„bG¤ÁÝĈ<XÀÿ"¸9Ö ¬©8ˆ¦M22»õìËŒGL#‰iзg=èÀ^ßnøìm
'š
å‡+ÛC¥jæD±l.¡w^¶X9cLãa€%“1Î¹È ç‚½QŽÖ‡ˆœ¦æØ&Áû¤Ê–ZkrØÙã:…ýÁãn½Þ;F 48Ñ*j)waÏ`.bÉBM¾kB +(‰Šd,ÓqŒn`UÜF$૵
²Ð#'€N»Ûn1à*°{¢`(³áj.AÖ¥‹l0àR褬žN<@Á-Ä°ýlhc?g¶è ÚÄf ÒÝÏ9ÕØ”aâà SàB+ÆÃH“ˆx q
:` s.L°«@'á +mW;üLcUñ.óì8³ª})‚*GÚ &ÖrlÞ§ê<ÒA ÐŽ÷Vi½LÈ +šæ¶nË®×{.|†Š(”"õÈS,TÜé‘É çÏqõõRŸ]µ›
Œäbþ‘X7Æì[—=àºpÙžË^vY…M]wí) +3‘äxÑ—¶î¹&ö–GˆAÅÇ›»ð•¢þz͈Á€bÐÚ›ªÉ¡»Ù–†Ü ôH×Æ…ç/»Ò¥3u¶’’» ¸Š¶;bpdF»¦G»ÖÄòà,A@Ý¢–àÞAò¼ØB`ˆ¾ a¥£‡-(@tâk21õ’™`-1œgÀ©â™„…©¾«î°9Pöœ/æy2‰ ©ŠÜŒ£ÆK +©¡ÑòL1ϹŽbÉà]¤™âG5‹J¸Ã™P`¼ ™ìßRÎ÷+‡Ã¥'êyðt“2 +êSz¿èôTTEC0Frn߀‘œÑ§[ÙF-$[Ù¾ÜWÙ_S‘¸Û.a–F0½ ë^ +¨Ô$h•›4LZ›¢ÁæÉy×ýàzþp8áôN×% ‘@GÙ ÿœH“ B¬ .~b =×·d8YÍš®¾&‚š)¾n]j‚Ä §Ä`µéN˜®uDD {ø-§°7D!¦R½Ñº"W >quT3ÑîlPtã‡+º±kŸ +Ú ëáËyÿÂï¢W ;T9ÀåëuýB]‡
z¬¾.7eø³M½ó«Ôäçë:w8¯ý\¼`}ÜÁD OÔep7ä: {® ÜMÑ®B<Þ«þqe’l¹»fÊë‰' „QàßÅ#ô\gyQ‘²a|ˆ•ÑÜ€rÅ´ôæÑ@[Á^-v<ðOTðÖÁ³_¬l ØÍC±ÊžK{µÂqE-™Å£‹x+|µôŒš¿Èʤ²Æÿe•BÑì —r–| ?\S'_eÕSÿÜ…5ú~2û ŠË%õ»ŠŽGWt0 üÞâV Öб(ì×¹Z„¡'í>iý¸¥>Éf<Š; ô¿/Á¾‡¼¢ô°ëˆæŸ3ŽÖ ÌK]i Ô‡}?‰:›¬í +ÿË®ûT>Ó±a°]Óo›Æ Š6\zNy; -h§«›Ö{#TªÞ¯‡fa=òÙ×Ó LÙ ¸ðg·ÉŸüœÅš:XœŒ•H§ôŒ´å@ 7VSk•ayè»/r,
_Î,µºñ‰é ±ööBtïÇú)J÷;©’ø +‡“B¼gôh¥zÒsIaÉ’5¥ÁÓº~°—Ã%¹'i§\°W~ î >,ð¢.ÙtüÅ"¯}*Ä'òn÷@$ªuÛ»a‰¿o¶SÝGn2íþ'Þ¶FoÉmùðÞŽã{¿bÛõåàååü/¤ +U¥õ±äý TœŠþÅ„q
endstream endobj -1022 0 obj << +1027 0 obj << /Type /Page -/Contents 1023 0 R -/Resources 1021 0 R +/Contents 1028 0 R +/Resources 1026 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 991 0 R -/Annots [ 1026 0 R ] +/Parent 1032 0 R +/Annots [ 1031 0 R ] >> endobj -1026 0 obj << +1031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [297.8955 194.3978 347.2449 206.4574] +/Rect [326.242 194.3978 375.5914 206.4574] /Subtype /Link /A << /S /GoTo /D (dynamic_update) >> >> endobj -1024 0 obj << -/D [1022 0 R /XYZ 56.6929 794.5015 null] +1029 0 obj << +/D [1027 0 R /XYZ 85.0394 794.5015 null] >> endobj 406 0 obj << -/D [1022 0 R /XYZ 56.6929 554.7106 null] +/D [1027 0 R /XYZ 85.0394 554.7106 null] >> endobj -1025 0 obj << -/D [1022 0 R /XYZ 56.6929 530.089 null] +1030 0 obj << +/D [1027 0 R /XYZ 85.0394 530.089 null] >> endobj -1021 0 obj << -/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F84 802 0 R /F86 982 0 R /F58 631 0 R >> +1026 0 obj << +/Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R /F84 802 0 R /F86 986 0 R /F58 631 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1029 0 obj << -/Length 3197 +1035 0 obj << +/Length 3191 /Filter /FlateDecode >> stream -xÚZÝsã6Ï_áGeºVù)QíÓ¶›í¥Óf{NÚ¹™¶Š%Ûº•%×’“Mÿú’– 9Ù¶7› ~ H? -Øö÷,–™Ñ³Gh°˜g™˜m/”–±VRúžúâöâßá`ÔN:?¥M¬…Jfs-bÃÄô!³˜i8´yªxœdÙñÕä!{*<ä²hºù¡ØÍ»êÏòtË\e±àf0ejù@õÊú\+<†ô`– ÌJLÌu‡d©»²ï.ç2Ë¢~SR%/ Ê}_ueq9WŒEWïnniäçw?Qåþ°ºä&Z•{jÛ¥lj ÅS_v ©6Ñ/—™ˆòº*hè!¯¥[4ß# +&웋Xáþyœi-¬|š ä,ê[(Y)–%Ôc— êoL³ÀÚí¡ïª¢¤ý¦rÝû¼Y—T}¬êš†ï]OWÕeÓ×OÔÊ‹ÿ º¾,€3‡m(“EwG Œy´ÊuOm»2UýJ(elwÅü~ȉ 3Ñ¡;äN:ƒ¼kZµ{ªÀåôU³&ªñ½Úq:åDѴͼ(½`Ð ÃMY—=uÐ"“¦{,÷Ýsíò®oƒ®¥ßX¡ÛÃz6ÎdtOíeƒm7Âíë1¯ëŽˆúMÞ;òº]~¤êjŸ¯·pò¨n8s—/?Z¥ÄÁ¼)¾ÄÓÍQ$4öˆì½ZYâµ;ß ´ur+yC8eu
+NyÉv†7*ÎXè!e̹ÃU„BžÀ @#ƒùæPÕý¼r\»rÿ€v‚õª»Ýæ}ÕºÁ?Û¦ì&Œ”ÑRŠ«Ö˜#3ix´£# -¼€ÎíÂoYš£šÙÝåûžjö¨$™%4'‡ª|¤a®,ϹÅÏeý4´_Ϩ²˜Šää)䄧òD¸½ÛréôgV…î®$è 8Éó oåˆ^á/”Ñ•À3ÃÒ úÄýÉ,–©I^¹@ 2\(Gõ¸©–b‹ð‡eWÂ5@K0€ «ö[³zŠ•€¡Ø û -"¬s" -fbZëV¿¾™< Oa‘| &EBàÇò
.” -±î }d…0FVWx+„ª=æ!ÏsVhx¬Ò$sWï:g†pÞ2!.2m„Yƒ5-O²ÈϱF˜«ÏÇSêB¦ô—
XÞ‘‰˜Ä[^Gý6gÄ’’•áÕ`7%aXƒGYnªf@K.oHâg'ƒÄG»H4â-|%ͪ…<ŽT¥Ö¡ -åQ: çõ"aìí‚O X Ç”ôÞù »}µÍ:`ã°ßµ6˜Q¡¡Ó…WÊx¤îÊ•6rAˆ#š °ƒz}\J|&2&ÔEcí²² 5íšPBX¸Ì»žt.6¦$ßR,û¸è'O‰=¡4!æÚS-ÀT¯Áè–0BŸè8ñA|ûzÊá€÷Ddac\£06“1Sìûþ?hÇÁ©(ÐÚ—Ñn@õÚyªA
Ϋâ9äéXh#^^>PM¬?=ù*Äl# è¥Ñõ»!D¥S°—`/9½ôöÒç°—¾{ug*<$^¿‹o¯¿\-¦‡$†¨_}.èAäÁ9KþJäa%>CÚ ‘9d.#eûlÐ>Ú `ô 1Á…Xú”‹0ÁE&XR6#.yD° - Ö ú|üÕUÍñûC -X)ÌË;*ÛcU®«Æõ:¬Æ”ŸŠ"¶7¾ú±üjâjŠ䴾øâ‹é+xV $¨`Pif2•Yµ¼¢g‚´Àes{jØ×VmðQÖz¾Æ>unЕ9pMAtÍú¹©>Í»þ й.©«¯¶%nw6®VѶ̻ñ. 7ǵ+—mSøFÕ, ‡ïóæÓ»ÚéG!ŽL3 ñ ððrqô¾Å§8Šˆíî]‚Ϭ)dF× ^Ÿ §¾Î9 é ¹ŸÑHÖç•{["ïÅ€¦·Ñ5.NÙÉChƒY’û”èÀ5ŒùÉV'‚YzisGKR$eŸç¨aê
uæ6v×jz’ô±@`3,@—~£XE½mɪT˜%ü«×UçŒhøÙH®';™lÛ~¯ÃŠ{¯Q¨oUàíÑ[‚42ú¡Ý"iS Þb½ñR"iØDª\R4½ðºz°_àFÏV[C “,å„Zº…ÐÕn«>@>ŒÌçÐ@®ôõô Act–€†p¤$#‚>: ì#¥ƒ.gÐõè ÏO(ÂãŽp ?¡/ ª£m©»÷ÂŒæàxBÆÆŧZ"}}r2å'@ŒúsPò7!Ò×`òHówq’„ È2åœ9û‡Þ£Eàpeá£,¾z–ý@Ä©tª ^ -ðc hõ[ê®…mŸ÷õÌdþÓ„ +xÚZ[sã¶~ϯð£2]«âM$Û§m7Û“N›íqÒΙiû X²³²äZr²é¯? +1á©nï¶Xz=dÖ©0gÏÜS±²Â ×òÜ[¢——ðŒ®¡•€g†¥;ô‰û6Ú¤¯\ Pƃo{Ü”Ë
±Eøò-àš +á ÐéØÓ:yp’"Eg‹F*¥Ç"¨ô‡$¤ÿÛÆ Å‘ƒï©Sæ§ózcž¸@l¸óÈ°8Q:h‰‡äüDBó}gM~ úÑ;aY|ÚUå²ì¨æ)Bè9§–sžªXˆGó2f¨z— +ž +üÅrƒÀ‡ #'¬,«\7ùʈùZIð‹J¥/‡ÙCªóavOåÎ
BD¯¹6‰¥zE¬§™:<«b)´Ku~˜kÓ‹w.ôöVˆõMs¨rª“Uïtnv™QÅdp®ê@fȳζń‡äšÇJˆ +ªNYœ7@iy,”/àê¼öT¸Ö
”A7G1CATš¾"¹§š=Ò2<[©Od“¦éq®Õ…îÞ± ìp}d‡0Fv_;„ª;è!ÏsvhX,ujýå‡3D“ĽÍz3D!Ófa5Ødø')äçØ#ÌUçƒ)8|H“þ²éË;2“Ûk©ß%ŒXR¦2¼ì¦ì¡ VàN–›² Ð’¿’„Ùé ëQ>Œ™Í
[FŽ¡fÕ@G*µó¦\ …HxÃ’0ðö‘'P¬µ „cÊxï„ݾÜfN °qØïÉHÑÐéc+i‚RwéK¶À uèA½!(%>éê"¬cíS² 5L(!&\fmG
:—ýR†ï(–ÝüóS Ǭžðšpí©ÖDS¯ è7\è8ñA„ûzÊåˆX+à½G6Šaˆ™è±^ÿðŽ[‘ µ/ãÝ€ê¼ TƒV8/ógaG[1ù‹ÒÑ„tq’C +B‘ò—Ñ':†)¶P Ú‰cv"ÈÖ™<…7ç¤úT?õ fÐƉ¶b¼ñ×.-¾›ëé¥ Áz¬›Z>€˜Õý[=&ÔeFÙ¦HœýxFÎ?BÙùW16t”ÐÊZö® »\bˆ,6~ªwesŸýJ§Zœ€é‰Ÿä ú9–x†þCO<p ¥™<ž‰Ìì,±Á,Ë)c„ãf"ð;swÒ ~………íÔ3¬öÏ°ýo»¬+ñùÓÖï˪øÌ7W÷€{2 ÓóÊ‹ºÀ÷¤<< SùìÛXéç¶å¶¬2—Z¼ñS>Á¦w¤uØ°Ì*Oá0ÃùÀ‹¿*Õ ¿=h€Jn^ÞQ~Øî<«b]Ö¾×£5¦ûTT°½ ÕÅWWÓK$·õÅ_L_Á»^bO‚ÚjA±Ò:µ¼¢g‚¬À§s{j¸—VeðAÖù¾Ú=µ~ЗpuNt9Íú¹.?ÍÛî °¹*¨«+·nw.¬–ѶÈÚñÎ=7ϵ-–M‡FY/=‡ï³úÑ›Úé!†LŠ˜8¼œCJ ½oðŽâTù{à+Š˜Ñy÷/Ï@Q_ëýð®<Ìh‰ +VÖe¥W"ÿÅ€¦sÁ5ŠŸì×ChƒI’ÿˆ”ªžk?&;užˆeé•Íû%H‘¤{š£„©7Ô™¹Ð]ÉéI"<ÄK°`¼·q6ŠUÔÛ†¬Jö³Ä‘ÿQzU¶Þˆ†ŸŒ€dðàz²£‘éÀ¶Ý·:¬ø‰úVö¼ =zLFD? ߧÕjÕ?ÆHz ꗧÉè~ZúœhZðº|p_ßFz r†ÖOr”jé
«Ù–]9$}˜ Í¡\é³é9‚Æè,1< áHAF}t<ØGJ]Þ + ë1<œŸPô¯;Üø„¾ U=mCÝ]XÌh^Ј§!d¬}qª¸¤¯ON¦øˆQ}Jþƹ~
&4'iq=²LùoÎá‘÷høü[:ø(ò¯ž¿øX Ù-Ä à‚!Rùœ_ri ZÐ'¿äø{³ÂB`×Rdž'éùмxù*ÍÐ'¬æý¦æUJÆÏýƒ©s4Èëb“Jz%† +¸y7S`ŒŠi¬CüJý–z†²° rBã?œ¾J8û‡fÖŽ)mâ3˜ ¹¤FÝaï á|/7 ®‹ø«"ÒÔv×Ô.£Áò }GeUPƒŸXkOEÌ‚-Ï ¤Òp—ïîôŸ©‰L’XóÔàÛ7dÓ?èÿþ8þñOœŽß{aAÔòé7L…¤&¿bУ©JŸ¿™$`¯)Tƒ¥ÿæBÏ›endstream endobj -1028 0 obj << +1034 0 obj << /Type /Page -/Contents 1029 0 R -/Resources 1027 0 R +/Contents 1035 0 R +/Resources 1033 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1035 0 R -/Annots [ 1032 0 R ] +/Parent 1032 0 R +/Annots [ 1038 0 R ] >> endobj -1032 0 obj << +1038 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.0431 608.1033 144.9365 620.163] +/Rect [55.6967 608.1033 116.59 620.163] /Subtype /Link /A << /S /GoTo /D (view_statement_grammar) >> >> endobj -1030 0 obj << -/D [1028 0 R /XYZ 85.0394 794.5015 null] +1036 0 obj << +/D [1034 0 R /XYZ 56.6929 794.5015 null] >> endobj 410 0 obj << -/D [1028 0 R /XYZ 85.0394 675.8841 null] +/D [1034 0 R /XYZ 56.6929 675.8841 null] >> endobj -1031 0 obj << -/D [1028 0 R /XYZ 85.0394 653.5729 null] +1037 0 obj << +/D [1034 0 R /XYZ 56.6929 653.5729 null] >> endobj 414 0 obj << -/D [1028 0 R /XYZ 85.0394 349.5008 null] +/D [1034 0 R /XYZ 56.6929 349.5008 null] >> endobj 935 0 obj << -/D [1028 0 R /XYZ 85.0394 326.5221 null] +/D [1034 0 R /XYZ 56.6929 326.5221 null] >> endobj -1033 0 obj << -/D [1028 0 R /XYZ 85.0394 138.5868 null] +1039 0 obj << +/D [1034 0 R /XYZ 56.6929 138.5868 null] >> endobj -1034 0 obj << -/D [1028 0 R /XYZ 85.0394 126.6316 null] +1040 0 obj << +/D [1034 0 R /XYZ 56.6929 126.6316 null] >> endobj -1027 0 obj << +1033 0 obj << /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1039 0 obj << -/Length 2879 +1044 0 obj << +/Length 2886 /Filter /FlateDecode >> stream -xÚÍÙnãFòÝ_¡Gy1êíû@ž&‰'ë`ãÙu @´DÙÄH¢BRò8›üûVwuó([Iæ!0`««º«šb -l¢4ÑŽ»‰q’(ÊÔd¾¾ “ûê‚EšY"šõ©>¿»øç;Í'Ž8ÍõänÙ[Ëj-›Ü-~˜jÂÉ%¬@§_¼¿ywýÕw·o/œÞ]¿¿¹œqE§ï®ÿ}…ÐW·o¿ùæííåŒYŦ_üëíî®nqHÇ5>¿¾ù1 '½½zwu{uóÅÕåOw__\ݵ¼ôùeTxF~¹øá':Y -¡`PHÌæÍ*N+7y–Ñ’û¦Ï
hƒSM¹ÞÍçy]˜¼NtoF–ÒD*%#Á 5 ¬d4ˆâÌ•NW'‚A%Ìäù Ì›R'ŒjWšÑx¿9^q&…!†y…÷ –Óá_p¯NrKÎwŸ' £Â×ù"û›äxÑ/×ÙsÄ,EžVÕ¼wD³\ÝòôR4î¥ILórG9'ÎKÚ}Û¨"”ƒAµe ämcÆ 4[”Ò.ÐÁšß6YÖ‹]Y•×Y”½2½sBðã°Šc1‹Å54¬WlÅ—ÿ…Pé½×7ÔÓ}ù°«‘ê9¯.«Ÿ}5é_?‹¯ÛªÜ‹|V|\VçϪrðçº9{ -_lþÀÉš -¢3¸Xœ’2Ï«ô3Ÿ2²)¤Š"AbÃ}xÿ
ëló ñu;…¥mÂã§1^>äÏuÒExÔMUl Ú‰Œ ãüƒ‚Àïç°R—»jžw¬[Ù³‚ßÂ\¦æ– F -VøGŸ7FOzøŽ¹mY5eu/xžƒ S^:Õl¯ûÓdz -Òbñ`òÄÁä :çÐøª‡Úøý³17¥áv€ ';÷´¯»ç—y¨B4:ˆVßÕÙÃXlý–µåÒq¸bPªi“²B<ÀH8…#k¢Z=<ÛÏ–ZÆùcVA"„ú«nŠy= Ѳº.çE»~Ÿ™õ+«uÙÄ ›l ¡xÈT An€Ü.¤·5K¬bæev!ÇÈ3Øΰv€°A œCpG0‹cXÑÁÑšr‹˜U¾ÏW‘~9 ‚•Ê—Üîʢ^é1«HPÆå‹M
ñWÎFØPI3%l<ð¾ÈŸF¸‚Ìd•=â -|_7½^ž^ß_ K Zøé} …JnÄXŒç¹j ˜E¬’<:p -ˆu›©ÝIJ¬Qç(Kv´} ²¼ƒ-1—Û®Ý2Ól»m±%¢bqn‘K¤B—³ -™%ã¯S´“CÉdõ òŒô ¿è—«ÊpEûж•¿™8ŒLÜrŒL1,q˺°ä£,X -K 7p`äéW@”EÚèÔܺd<–÷Ýgz ¨UR§†N‡1ˆ=´c5]¢·ã Z³JÈㆆøˆgº.¢zÏ´:z¦ŽÖf6oúò±d&~t‰g‰Lþ2•·IëuµYŽ¬Õ„5؆05‘
jJÌ©Œ¤±Ö¥
{\kþIŠ6ì|DÅ[ëÐ9m×ß¿ó Ö…<ãàm`e_ã ÖG~x‡QÒžn·Å¾×v GS\¶kÊ5ô1óxYƒK u - 5ห§ì¹Fø©¬>xÏÑ:},qÓí®ÚbÛ£]üZâN…sˉB Î¥á©HôR
”J*u¶Ççq2òUÄ'~«ñšþ²¡ê\ÆŒÞÒaõ +xÚÍ]oã6ò=¿ÂÎa¿D}Ú¶Ù^Škö.MmQ(¶œk[®$;›^ûßo†3”%GIÜv Š<h8 ’ó=C:b’Ÿ˜8“¤Êë‰õ:1©0“ùú,ÜÁÜWg‚if‘hÖ§úüæìŸï29ñ‰Ïd6¹YöörIꜘÜ,~˜~ñ¯·ÿ¹¹¸>ŸI“N³ä|f²túùåÕ—„ñôùâýջ˯¾»~{nõôæòý¡¯/Þ]\_\}qq>ÎX/y‡g¼»ü÷A_]¿ýæ›·×ç?Ý|}vqÓÉÒ—W¤ +ùå쇟ÒÉÄþú,M”wfò +–ìÉ}ß—¬!Ù‘›Ý|^4͈Ã+%K¢{3²Q¡Ö¼ÐøÁN6{u#ÍÏ7(J@;,ô© ½P9µI¼²¦Ûi ƒAótÇ™†Œb…’Þåùä¯$(7‹ê‘w[Ä +ˆuÅW©Ûé4qÖœb<©Å“ã›På= IµÜ .[všo· ¶"w掤$* +9À#UÛY˜2”7‰~˜¢ª*/鮉©ž–w–êùLÛ4X Á ß +l³Åt]R\êá¾ Ç ÐeϺ骚ã} q‡’ó_µ¡HÍ[²4L ý:oÚ ‘ˆv¶¾{¦ƒc+Ì!áÐPñÂR†õIŠJ ˜}Ðú~Òlú+]-ŠýŽðI±Ø0þž À{#nàì0 H¥„§ÄøU¾/%cuC³Áå´µœ®p›–Ï ËJÊ¥‰í è±Ç\C'^+ß»Êô‰à”<¾¡Ë£ëÅA X,IíÒJj6 +q@%ØqŸ +ˆr¦å –ÎGçq² Þ´j4êÀ¬:õft”ƒ¤Í†~l¦KŠ¶5O’7›˜ˆ7tls$ó t‡ŒŠ‘é2ŽÌŒ½5¬lßôõsÑ[-ÿìÂ<Œd&p@-»¢õºÙ\fžx+ì^rú†žz"¯Ž.¨±0Ç62å^7=ø0â: ÆKû0xFñ“u¸9ì—߿ßå•>Jã”m`†tßЀú#œ^ð4iév[º÷âìacv%À延ZÃ=fÎe0¹¤TÐm êû¶H¼¹/øwcnˆÑ¤*„ÿá2pÜÅ(O¿L*7ÝAA€¡° Ûì"/PÍËàâÊw?(ßÞõ%ô„ž›~åú먥Gh¯ÚÏ endobj -1038 0 obj << +1043 0 obj << /Type /Page -/Contents 1039 0 R -/Resources 1037 0 R +/Contents 1044 0 R +/Resources 1042 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1035 0 R +/Parent 1032 0 R >> endobj -1040 0 obj << -/D [1038 0 R /XYZ 56.6929 794.5015 null] +1045 0 obj << +/D [1043 0 R /XYZ 85.0394 794.5015 null] >> endobj 418 0 obj << -/D [1038 0 R /XYZ 56.6929 567.2594 null] +/D [1043 0 R /XYZ 85.0394 567.2594 null] >> endobj -1041 0 obj << -/D [1038 0 R /XYZ 56.6929 541.57 null] +1046 0 obj << +/D [1043 0 R /XYZ 85.0394 541.57 null] >> endobj 422 0 obj << -/D [1038 0 R /XYZ 56.6929 374.0866 null] +/D [1043 0 R /XYZ 85.0394 374.0866 null] >> endobj -951 0 obj << -/D [1038 0 R /XYZ 56.6929 342.623 null] +957 0 obj << +/D [1043 0 R /XYZ 85.0394 342.623 null] >> endobj -1037 0 obj << +1042 0 obj << /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1044 0 obj << -/Length 3111 +1049 0 obj << +/Length 3118 /Filter /FlateDecode >> stream -xÚ¥ZÝoÜ6÷_±o·, ?DŠBŸœÄɹwMz¶‹Cц¼+ÛB´Òv¥µë;ô¿©¯•c'… –
‡Ãá|ý(‹‡?±°šq•Æ‹$™æB/V›#¾¸ƒw Ž„ç‰S4äzsuô÷÷F.R–iW·Y–qkÅâjýËòí?N¼:»8Ž¤æKÃŽ#møòÍùÇwDIéçí§ïÏ?ütqzœÄË«óO ‰|qöþìâìãÛ³ãHX-`¾ôž™ðþü_g4úpqúçǿ]}tvÕíe¸_Ánä÷£_~ã‹5lûû#ÎTjõâ 8i*›£X+¦c¥¥<º<úw'pðÖM³ŸV–i+“Æj΀:eFIå xuŸã&€uhk‘2 ò‘'_WgÊ“1Kb¥=ÓªÌöM~ )a—ë¼Íw›¢Ê|N–÷y{Ÿïè%ŒˆZÖ«¬$Z“ï ÂûÇ¢,‰!kÛ|³mý´š~ý"ÉòìÝÇK?ã>¯ˆ¶ª7›}U¬²¶¨îPåEƒI¬V‹H–j-²E{Oé´ÁÁî$固õÏ^%8†²¹³”{³Îo³}ÙÒCÑÌ™Ï$ŒK{Ó<åsæ1Kc•z FÚ - Z§®eIÒŸQ¤¬êÍ„ãýv[ïZ´°—ícMäÿÖ•gnwYÕÜö
œ@½n`/IØ ’å\îšödf2áL£Ï‘‚ 7 ðp/Z2ÈÀzr ÅppR
ÒéDGæÔišìÎS·$sS2‘ˆñYÑÁ4õÞ
VxFxêªv¿k¤ñnÇônÍæNFj¦xPt“UO~Ss'd,‹ë6[}nh鬡åpöP™/«8™¼›¦¸)=kQ¡{»÷^6Ùgn ‘HK´V¯ÜŠ4Á× -Ô!†C ÕP‡X.ó[|@‡Xy.Ôxy³o‰™&I8Ëò‰(Ÿ«ú±"¢Ó H7^Ö¾Zƒ m]¯=ý‰è>3%õò{ŠexZV‰}›µ«û|MÎá·0ò
ˆ†¦¨+t³Ä.ë[ú%™8‚c|Þ¤ñòçã´ßÓ‹UVÑ Ùæ«âö‰ ï‹Õ=
)^hìROR në
2/$Ä%Êp©ÅM›MÑe8‹.JÁöÈÝdíÌñEݬÑöëm »‡ýÅÖ.ÏogV‹5K%ÿºÅ õÊCï,Š§Ëªn):‹¡›äk8/%ãg6jSL¼aåÁB¤zj0¿^¢ ²ãsÉ4s¡ (¥ý›6ƒ"þNK¸âC¹(…’k;³_Àfó %î°ë95bH™JÚaH&$G‚B -(e±)ZR‚AµßÜ ¿! :=ÒVuµÚûÔWù EuSï]0ÁU'ºS˽¸u“êÍd‘‘ùqÚ¸"y ”X¿•‘oVõ\ú…Ì%m<qŠgÌ£·“æÂW\*Ð#? Õò`³!wî Ù*ddlh^ÝÏŸ©ƒ’³$†Pm½7Ï:Y3wqâ” K ÆÓTxOO|¾ƒ¥…–Á^Ÿó§gú0Í¡Užôaqº,Öà -d£†(Ù\ *÷ºÂ"Ó®V*…æè LäkúZÉRkí|Wu£¡HjYGûWÔJ‰~e,ë¹vJ2Û Ó:Ç]W.sÄ>sÀïü Ce±JO 052ÇÔd§Y3`¢¨Bà:ÞðÆ8¢RK£ãd+t"49Ä+¸©X>‘c€ ‚cÈI«ú+×üêòüÃÉôT„0,MYž0C¤w»»
.(¡cü‡ á@*êp™½m5U ¨b4B
59@)ç…å'’¼-í}k–mV~vñ‹dg}ü¥®6õòÈ=Ê\‰äËÿxA‰«àÝŒß÷yÓÁ•=7µj¿¸ -œ_X(,tBgjáHeÆE×ÔédM 4Å]•µûД)Ý!í] ~ïò*ß÷éqßtêƒIèÁ$pTApŸ÷ÂSê³Ü`»Í¡cóOè’õHdÚ÷£‘QÉòÔmŽÏõé~;˜Në]qWTÅ aPh^¼FéÛu =óïûÂ7ùã Ê3Z2¼s½§[/Cû!<æ—ìÓú¾ý ´p1÷:âàn—m6ÙŽ °ä†·s5.e‰Ñæ…¤
`\5IÚ(5+Ëú±¡±Ë 8Ø -5R‰xlt*<Hžë!’ºHwÑ ¤Q¾ƒÃ4änH¼J[ÌãyÜ?Š¡v½§õÒA"FûEÊXn|(×Á9Œ£™ÑÖ|Õ‘Gݬ±¢ZRzÂï ©a ÊåòÚ½2Ûùma3¨Ùùi~Î (£„#Íx[8÷™mI
xRKýÕ §Xšc¼b?ïIõ¤èÔ8* `ÎN€ÿ:o³¢lNBîÌ'Ùu7«]±¥úíÒòílÒ‚F
o,¿6H ¿¤:QߤR¨ º¨¦ $/&Jqj¡ù[|¹ûéø£á„ÃþãPî¨ÿ¡[f „%*蜌’#•Ú Žë%E¤u·„ÎÂ]ˆ¸À© -¯R2Ï9p|
3&jìßnŸ„dš¬ÃxeÞwßî-åDBÎ 0ð…Qg Ï['±ŒKûjãXk»;Öªì€[ÝäÓ¥{ÛÁƒ¿eG^΂û ŸË)ÿ<ûÙÛEAG&¦_ ..š¼:oÒ¿w÷ìØiHW;£Ëƒ¯ }¶àZ§¯7š0f¦P©Ç&Êb‚Â<MÔþîŸ|1Iqw»"wÀ#†<’á—3?·sö’zKCirœY€—B—ÈU¶ÉýY’@›%õô"”«ì. -ß >ùã·vÝÔü‘ãe]£œ©”fÖ艥VeÖŒzóIÖÞàgÕhUâgÞŽÏýàí¤ŠkÇq]ºl‚ô?‡-9Ÿ~yFiÐðµî²Ï}ýf‘Cw˜»èJ"ŠmdÊ›ëzw]ÕÏcÙìš¾»LZ~~˜Ø®»8óÎýkX ÿ g¦Aä;üåûéÿ'*N ‰´ÏÜ–+n˜•P ¼R¸ } +xÚ¥ZÝoä6Ï_1o7b>,YFŸÒÝì^z×m/Iq(ÚbáÌ8c=ötìIš;ô?R”ü5N6»E F¦)Š¢(òG:bÁáO,´a&•é"Ic¦¹Ð‹Õö„/6ðîý‰ð<Q`Š†\ßÞœüý‘‹”¥FšÅÍÝ@–eÜZ±¸Yÿ²4L²SÀ—o~øðîòýOWç§I¼¼¹üáÃi$5_¾»ü×Þ_ÿýùÕi$¬Ë7ÿ8ÿñæâŠ^/ãÛËo‰’ÒÏ3B¯.Þ]\]|xsqúÛÍw'7Ý^†û\áF~?ùå7¾Xö¿;áL¥V/ á3‘¦r±=‰µb:V*PÊ“ë“woÝÔYû Τ[ 0VsÔ)3J*gÀ›û 7¬C[‹”ÙXX<ùºj<ÓPžŒY+ã™VevhòÓH »\çm¾ßUÞàs²|¼ÏÛû|O/aDÔ²^e%Ñš|ÿÞ?eI YÛæÛ]ë§ÕôëI–o?\û÷yE´U½Ý ªb•µEµA•Q &±:^DB°Tké”},Ú{:J§
ö§ )ßÖö*Á¹3”ͥܛu~— Ê– ŠfÎ|&a\Â9ižò9󉘥± +6f¤° ¥Ñ +G,Iú3Š”U½™p|Øíê}‹¶ñ²}¬‰üߺòÌí>«š»À¾…¨×
ì% {Aò¯œË}ÓžÍlB&œéÔ†ó¹|Ç{Ñ’éD†ýžF1 ž”Xz;µèÔœFM“m<uGbø%‰ãó¢Ãiꃬð ŒðÔUí~×HãÝ®éݚ͎ÔLñ ì6«žüÆæNÉXÖ]¶úÔÐÒYCËáì¡2/«8™¼«›¦¸-=kQ¡‹»÷^6hn ‘HK´V¯ÜŠ4©ßK:Äp +¤êËe~‡è«"¯À-€/o-1Ó$ ‡Y>åSU?VDtÚéÖË:TkУ뵧?ÝY ¤^~O±ìO˪5±ï²vuŸ¯É;üF¾7¢)ê +ý,±ËúŽ~I&Žàš1
~oÒxùói +Ú èÅ*«hÐìòUq÷D÷ÅꞆtghìÂO îê=
2/$ÜM”á‹›6^áB@T—á,º› +¶@î6kgŽ/êf¶_ïZØ=ì/¶vyy7³Z¬Y*ù—-–Hȱ"zgQ<]VuK±ÐY Ý$_Ãy)?³Q›bðý +"ЋPƒùõ7;ŽCÈr¦™» +*tÚÙ¿i3H4àï´„K@ŒRH»&±ãkvëó + M÷µ +…À
ØË„©LTà:JÛªžê!”a‰1z¨ÈQÒ1½¼þ‘,oA«{°oͲÍÊOîþ"ÙY Ù&#<ܣȕH¾ü”¸ ÞÍøý7-\ÚsS«öåUàýBÉ`¡3:S Gš@4J"¸¦N'k¡)6UÖ (Sº+ˆ´w-øÝäU¾ï[Óã¡!3èÔ+“ЃIà(ƒá>ï…§„³Ü`·Ë±ù§w4™öx42*Yž»Íñ9œî·ƒá´Þ›¢¢r̉æÕ×(|;ôÑ3ÿ~(<È GðžÑ’áÞn½ í#„ðu×8eŸ—€û€p1÷:â`³Ï¶ÛlO˜rÃÛ¹ —‚kó™ FM‚6JÍʲ~lh좶Pt»Ò³ L,´”E8Çõ„tW<àkt‰+
0]Ñ[o^ S 0PÏ[1—<Qz#úÊÓƒŸÎv/&1ÝBJ9‡±dZåsùRŠLCúGG•«„Hž—=˜Ñ€¤¡FOF–wµî‹ïŸ@½üñ!&’/L Éø)âYÖk_
z™T_iJ
dôr¤“xO ƒÇ¡šçzXÍÝHw·H£x/†aÈuI¼J; åyÜ?Š!w½£õÒ•D ö‹”±ÜøX®+çj
y¤k ¼îÈ£nÖØ Q-)½áwÔ‡r¹¼¸Wf{¿-ƒJ ‘Ÿæ'áÌ€2 +8ÒŒ·…sŸÙ–Ô€F´Ô_ìqŠ¥I×+ûü~Þ‘êI_ pTŠ9;)ü×y›esbg>‰®ë¼Yí‹ ¥p–ïfƒ +DÕt¨L +~|83Ú”IÙõdiyW25ôøöÃõõÅS©Ò>Ñ¡¸ºÅ†2¢Ž!gÑaun Cru|[³±U %¡Ò·P~¾|;þh8aîÞLåŽ/0(3{¤
àô”Cd +?¾»ës: I£»ë ×y0iš'êxjŽ Ù[‰ÎÞôä, ¿ƒ +W*îK#|A‘ »ÃmY¬hì``Ÿ5šá§ª«(; +K?T+W-q*ðD¨Ãøò »þH¹Í]Ý©]»Ïosèê7ÑóeôØîO±ë܆סpq]o_$ᬖdeíX 0ÜC˜pŸƒ>P<Jbù•Åz0¹òL;²æC^Í gÜÓoeá«HÙUsþ£ž]Ü€±_»)!Hbùë™=žÉÚÌ׆U¨In×õ|ªé +î1v7€J"ºÛÈþ”7 ëýǪ>*&Ê™‰>½LP??l »{0æû °8þ[Î Dä;üåÿþéÿ5*N endobj -1043 0 obj << +1048 0 obj << /Type /Page -/Contents 1044 0 R -/Resources 1042 0 R +/Contents 1049 0 R +/Resources 1047 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1035 0 R -/Annots [ 1046 0 R 1047 0 R 1050 0 R ] +/Parent 1032 0 R +/Annots [ 1051 0 R 1052 0 R 1055 0 R ] >> endobj -1046 0 obj << +1051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [116.0003 603.8664 166.1092 615.926] +/Rect [87.6538 603.8664 137.7628 615.926] /Subtype /Link /A << /S /GoTo /D (tsig) >> >> endobj -1047 0 obj << +1052 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [399.2874 494.5894 467.9594 506.649] +/Rect [370.941 494.5894 439.613 506.649] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1050 0 obj << +1055 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [461.1985 318.5752 510.2452 330.6348] +/Rect [432.8521 318.5752 481.8988 330.6348] /Subtype /Link /A << /S /GoTo /D (DNSSEC) >> >> endobj -1045 0 obj << -/D [1043 0 R /XYZ 85.0394 794.5015 null] +1050 0 obj << +/D [1048 0 R /XYZ 56.6929 794.5015 null] >> endobj 426 0 obj << -/D [1043 0 R /XYZ 85.0394 478.43 null] +/D [1048 0 R /XYZ 56.6929 478.43 null] >> endobj -1048 0 obj << -/D [1043 0 R /XYZ 85.0394 449.8913 null] +1053 0 obj << +/D [1048 0 R /XYZ 56.6929 449.8913 null] >> endobj 430 0 obj << -/D [1043 0 R /XYZ 85.0394 369.322 null] +/D [1048 0 R /XYZ 56.6929 369.322 null] >> endobj -1049 0 obj << -/D [1043 0 R /XYZ 85.0394 337.9739 null] +1054 0 obj << +/D [1048 0 R /XYZ 56.6929 337.9739 null] >> endobj 434 0 obj << -/D [1043 0 R /XYZ 85.0394 181.1837 null] +/D [1048 0 R /XYZ 56.6929 181.1837 null] >> endobj -1036 0 obj << -/D [1043 0 R /XYZ 85.0394 155.6098 null] +1041 0 obj << +/D [1048 0 R /XYZ 56.6929 155.6098 null] >> endobj -1042 0 obj << +1047 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1053 0 obj << -/Length 2906 +1058 0 obj << +/Length 2912 /Filter /FlateDecode >> stream -xÚZÝsÛ6÷_¡ÉËÑ3C -•ÉÙ#¼D!SŠÏÖg±¡Œ…pœêìÓÙ?z£Qó©×~, -¹ -„<N†…QK³¯ 3¦‚%ßPG'ñ˜ŽŠ‡)â©’UÙv>L'aš2üf9 Ž!¿k=þvH“ÈEXc¹Eç¡”*óA¬õh DAH°’Š*‡h‚ -®P'!‚ºéˆh7º(1®ëÅKàÈ8¸k:_ú€B”ÌØDÉç1Ÿ@—¨Ô!pîÉHp0PvN$ ÙšÂOúµÐË Ò"í“&> L¥Æ€àwaÌŸújŽi‡ƒ=F^¥1‘Wu?Ö—mÊæd€ÏŸm¦V” öåø¶ -Ù7…2æTë‰0ÿSëAÇR~õ2ü„÷(wZ»¹.ÿì+6çB²Ñ½&Vü¬Ÿ|«ÀV;ø=®Jðf*«Œ‰š‡r‘ˆ ·ÕÙZ«¼.Ûõ¤ÀÖs€ãÒ7Òæœa°Õ•. ÏM4Õˆâ)ì”fªQP[’öŒÔUfä ®Dô™Âínâdý.vÛ¶|Ð󦮞|è…œ¹ŒîÆÓÄÙ‡§ Ì -þ&†?·i ‡ZÓý"«î)+uuœ -„㤱ƒ—¦¸uT°È»œxȸ³C÷ ,ˤ-xzÅ)gÞ—¾öÔ„aÄ—þ’c§ûÒ‚rY >°ó -é½[
dì
¡qënBl/KM³¹-ÁŽ‘ú[hš½Ý퇼Æx(Z -çfÀØPâ3/Î@–õ0Ñð8 ™Œ:!ž2> 3Á=GÙ6™Š>™ -:
xBõµ Êùš™çSêá4Kùñp ûB¬×à OìÂì¶v5Påß»BÉ7“Y”r9¨Ç•1PC($¨ /eJÓÝâLØ R™ HÀ%ˆX¦Á¿zau3L˜÷‰¶°Ì¼Úi"K+Ü ÞËÑuÂþ¼z -Ø!ÞzŒ -ý_œ¨ãÇ #ö ®ŠZ±;IejzÒâ¸ï˜ -d!îØ‹´¡¼-‡ó¡`ÃW×.vÓ Ì%¥%Šf½)+½˜»# àkóßMóI¼Ô½Å1û/ Mëi‘œqtBdŒcå«A.©ê -0Àjx´÷ô†¤Mrœ¬ÆÇ»âý _o¸ðÃ(3±¡êÄUÝà®k`vYÀ©Ú#Ë°ƒÛ Ë™TwgŠÔfŠ¹c@ÖÕuHÄEýä-Ùâ2€3–‰A cA©úndl,”<‰:¸|SÓ€±ž!š
TúAWÄÔ<šÄzï¶öJ GÉÒD÷'og·åÂ"cáJë4L%Ÿ†3SÕd¥Xxâ…=Qt¿‡(6†ÏÆÈL‡ õ’îk)YfÏE –rˆ@ê¤Ü)•y²È¶mP.åfQ¿{éÔ<pÑû8—F9Š¨ +xÚZKsã6¾ûW¨rYºjÄÁ“““x§2NÖãìVm’MA#ÖP¤"Rv¼[ùïÛøá±&›ò`lt7¾~Aæ |‘é˜É\-Ò\Åšq½(·glñæ¾9ãnÍÒ/ZNW}y{öúm"yœ'"YÜ®'¼²˜e_Ü®~Ž¾úöâÇÛË›ó¥Ð,Jâó¥NXôåÕõ×DÉéñÕ×o¯¾ùéæâ<UÑíÕ×D¾¹|{ysyýÕåù’gšÃ÷Âqx惷Wß_Òè››‹wï.nνýîìòvÐeª/gùíìç_ÙbjwÆb™gzñ +Œ ªº¦%wn®3¦¡ÑÝãlŸîp–œïTÖHVXª\G/èÈI>Ç Ûei´-úrƒZàK,º?‡°. /€-;WõnQ×’ ø~õ£ûxµ"üu }9cÝ{Ç ¡Ó˜ éYàçG1Sf*N˜L‰d±N…:%jŠ8ϲ, 3—Çå”åÓ€(³4Ö9ÌËPL«Ø± +PÇRH:™Ç„T‚Ç,Cž YW] u§)÷Èo×ãéØøo]Àa #¤ ËÜwÖK1!bó,„±. ”d/AYNÁ% X¬á`e:ˆ'å $ ØìÒ)Ø0€
_žšéaçgÁ&c™J±HÀü OÅ_ +yTIÛ†X%-f˜€³üEy’zMdëì ›903ò:»eYB̬îlkÃ(Š#}Ä*S^e&¬2õ ¼4éi¢^j´Æ‰O#€g Ä—´‡3ИB øiÅzPlL ý ‹#×'¾‚AG}/L¹hUC”±ŸC*JÙaú…&âIo;߇G«¢/ˆ‰ f®} ŽDQ’‡Ù
¡Àî™Û€èPÍïö¸¯ ˆ!‡U€ý}SÔ8>ºÏ@øÅÑôxŒˆWâºXj—í= öŠÔÙB» ìkß
ž–_´ôî„ %<ûâl€Ãª€’˜kå}Ï3 ÔïP)J!ØÞ.‰Ê!‰J‚6<¡êZÑhð1\Eh³T¼ ôP€
rØãQþ ¬¶¯}(#Ä1pw;ë„yîÝFk4!òð:¦²áW‚.8ʼWm’”N£
Ìšv\° léˆE}04¬ s{x¯& Çëš9NÇ80*4~jðñO o‹PàÊ•Kù“ÌmM@Oz¸õV"º +½=Ø +¥€b¤;… ²w\ŒEHºPÞUãùPp‡aW×>v“özÒ
Êv»«j³Zú# áë6 ßJZói¼ü3ƒÅ¡> Ís`Ú@k,áŒÙ ‘Q©<T/_Õ €Õðh?Ð]’d51ÕJ ·ûCU´ñª?¢ÌÄÇjwõ“‡¾…ÕU §êî´³ ;·£°\’)@tpwž“Ø<çþtu Óà¢y –j*† àecPÀXÐ[æC25ržE ܾmhÂZÏÚ ÍÔæÞÔDÔ<YÄ öî. gÉÒ4 NÞCÆÊ—Ôiœj1g¶:Ì¥XxâU=èbQl
ŸM‘™ŽêÝÔR²Ìž‹@<ò“rËó,=€·+{aäSnÆ
ܤó ÀEïÓ\Ê9²h ó;”MeÕ{S
~ž§¶íä à }â™C`ï|µÁlˆ +Ø
r.´ ò endobj -1052 0 obj << +1057 0 obj << /Type /Page -/Contents 1053 0 R -/Resources 1051 0 R +/Contents 1058 0 R +/Resources 1056 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1035 0 R +/Parent 1032 0 R >> endobj -1054 0 obj << -/D [1052 0 R /XYZ 56.6929 794.5015 null] +1059 0 obj << +/D [1057 0 R /XYZ 85.0394 794.5015 null] >> endobj 438 0 obj << -/D [1052 0 R /XYZ 56.6929 731.1791 null] +/D [1057 0 R /XYZ 85.0394 731.1791 null] >> endobj -1055 0 obj << -/D [1052 0 R /XYZ 56.6929 700.243 null] +1060 0 obj << +/D [1057 0 R /XYZ 85.0394 700.243 null] >> endobj -1051 0 obj << +1056 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1058 0 obj << -/Length 1065 +1063 0 obj << +/Length 1064 /Filter /FlateDecode >> stream -xÚÍXKoÛ8¾ûW9Å IQä”flŠmºëzOÝÂ%Ú!ªWI:±[ç¿/%ʲì(ŽóX ðA|}ÙáGÎŒ‘eë ²| -m8–8ÚˆZQÚ³™ž»ì¡z
X/íU F½“ [ \ìZ£iK–mßGÖ(þz|þÇÙ_£Á°0µ]ØÔµ?\]ÿnFó9ÿ|}quùÏð¬ï9Ç£«Ï×fx8¸ ×çƒ>@>Ek -yƳ™éçY²4b>Ix´î…QĤ䓄™þM.•„¥#´6 -ôYEY#Ƚ¦þÚ¸¶]XÈ£W‡“´‰çM£}J§ß]…µ®ÙÊj¸£ ¶›zíÕE÷æ ]ôßÇM=íVGlú8ðÖJ•Þ¥Á®æMuþPõÿ +xÚÍXKoÛ8¾ûW9Ù )Qä”flŠmºëzOÝ %:!ªWI:‰[ç¿/%ʲl+ŽóX ðA|}ÙáGÎŒ‘eë ²ˆ½‡– ºØˆXQÚ³k=wÑCõ°ZÚ«>Œ{Çç ¶BzسƳ–¬ +ôþ² +ü‚¬½AVQÖr¯©¿Ö®m²Åèåá$mâyÓhŸÒãéwW]k¶²î¨‚í¦^{uͽþCB}NজvV‡ý endobj -1057 0 obj << +1062 0 obj << /Type /Page -/Contents 1058 0 R -/Resources 1056 0 R +/Contents 1063 0 R +/Resources 1061 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1035 0 R +/Parent 1032 0 R >> endobj -1059 0 obj << -/D [1057 0 R /XYZ 85.0394 794.5015 null] +1064 0 obj << +/D [1062 0 R /XYZ 56.6929 794.5015 null] >> endobj 442 0 obj << -/D [1057 0 R /XYZ 85.0394 672.4064 null] +/D [1062 0 R /XYZ 56.6929 672.4064 null] >> endobj 965 0 obj << -/D [1057 0 R /XYZ 85.0394 645.0635 null] +/D [1062 0 R /XYZ 56.6929 645.0635 null] >> endobj -1056 0 obj << +1061 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1062 0 obj << -/Length 992 +1067 0 obj << +/Length 996 /Filter /FlateDecode >> stream -xÚíXKsÛ6¾ëWð(u0 IŒOŽ+»Î4J«ª§4£¡EHÆ„…€b+‘ÿ{A‚¢(‹²%GÍôñx - ŸqèQBK“ðȇiâl”ü*zÀC¨›.’[‘Ûýyá¥10†œ1RËé<LÕTä@F± -5ÎòqšÙÇ•]ÄÃ<–©ŸÁ>_Ü~Ë]‹ûöJç2=ƒªöFe‹|REî Äœ»ã0Šò5ÂB{>¤>q -è»”•~)?1È}ßsïl…çY^ù$çã̓ŰO¡yøâ5y»À©±Ws÷ +xÚíXßsÚ8~ç¯ðc¸)–dÙÖä)Í‘ +½ã¸§^‡q° šúµDZò¿Ÿlc‚ †r{è0ŒdY»ûí§Ýe²lýA–O¡M˜cyÌÔFÔšÄ Ûšéww TîëM ¾ëͨsyëb‹Aæb×Mkº|hû>²Fᇋ›ß®ÿõ†]€©}áÂ. ®}ñ¦?øÕ¬03ܼ Üöïþ ^w=çbÔ?0ËÃÞmoØÜôº +ãà ˆ§i¢t¤øÊ»Àµí‹dßóÌ̯r7µ-€d”âJNeA"§<"Œ8ÉÉ¢éB ”E»²Jħš-DÛ˜5²IªÄti6,¹ §Ù8IÍãÊ üi ‰‰P¯`Ÿ/î?ñå®Å}s©2‘Ì^AUy#ÓE6)Oî ›Úb0ÌÖsYäzxXç‚žCh¡á—â…Ìó¨U[×Jž§Y铘7@ ÄaìU\à‹[‡æîBÓyC´ÅšóškÕÖ[Ccâ"-êgD + GÛFM#mîI´1bWˆ-Ú° ¤Û bD³ÂÓ +u1zn!9ØË^•o²§ Ý”Byø¼t»H—OÇoÊéÖ1º‰ô3ó$X§Þ°¯iÂTR‰‰l¬:<‡ +îÉ[–X$ ãӌˇ¢ QGC5k*[ oëX¡E¤ˆ©ÖÛɘAß÷Ø6ÌçJ%&!Û©ŽÄÈæ³q¬ÁL¢@–'ôÍ$d!E¶•ªå¼Üÿ uUš-äSµ=¼G|¦C$M@šDËöA2yà“O ÷@n"þ1È’Õ4ÑJÌ’4ã› endobj -1061 0 obj << +1066 0 obj << /Type /Page -/Contents 1062 0 R -/Resources 1060 0 R +/Contents 1067 0 R +/Resources 1065 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1035 0 R +/Parent 1069 0 R >> endobj -1063 0 obj << -/D [1061 0 R /XYZ 56.6929 794.5015 null] +1068 0 obj << +/D [1066 0 R /XYZ 85.0394 794.5015 null] >> endobj -1060 0 obj << +1065 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1066 0 obj << -/Length 2980 +1072 0 obj << +/Length 2978 /Filter /FlateDecode >> stream -xÚ¥]sÛÆñ]¿‚ÐL wø ?ÉŽä*S+©¤¼4ÉxNH¢– -æ>\„B3·Dó1ջNj77‰šå~ž¨dö¸ •ùA–…³Çâgïý_¯~|¼¾¿œ«8ðÿr '÷îöî;ÆäüyÿÃÝÍ퇟î¯.ÓÈ{¼ýáŽÑ÷×7×÷×wï¯/ça‡À¯d…WnnÿvÍЇû« ¯î/}üþâúÑe|Þ0Ðx]üük0+àØß_¾Î³xv€Aà‡y®f›‹(Ö~ im1õÅÃÅßÝ‚£YbÒ_¬3?ÎT:¡À8 )0 2?òt–ƹŸh¥Iƒýq[^Γ ð–íî`vÅ[<Ô,öó4Mfó0ôó8VD*LýKmS ÿ³¬v]£ñÌ Lr–»Ž‰þ
Wð¶ŸLQì¹mw=C€ oùãû¾0ý÷l ¶„¢¬Ë•é«¶™£XÌt,»OíîSÓŽe›«Üϲ4?qXUi?ÇËCìïm#ÚAèSc62\Ô¦s‡AFËu²è Ü3ñ¬$SL,É››HÍ z‰‚E© $qFDh«*"ÛåCoúrS6=¿+ ÕT¸/cLS0ðSgV¥Ûh°T@vF£}üPvú‡Ûéñ2ýnËîÜÂØã4šÅ ¬šÂ:_á:×~¤g^ðÿqYAFWùªÌÀZZŽÓ¥æîPó8JàÂð S¡¯µŽáð¡Ÿ*'%nL×—;Q¶ ‘§)Pƒ¿Dö¸FÝF±×•»g 8ñÖ¦c¤á¬Eð¢Ý ™ª]2¦·K¦7<¾w6'æ‚k’5 -ƒµ€ÙO:æíצg4:γ\´Mo½,F<aÚû-x
ÒgiÇ€øX–²€áå°JU‘÷¥º ½p±b‚¸ñØ®fLݵ ‘ÃÁò˜[º)±hßö‡ñàiæî‡ð¸Wrè\yïŽLP”K³¯û¿àÒ‘×ïÀ—ŽÁ8•ÓRäÀ€^²GoÏ ñ±–ý›©¼KÚÐ.huoQ
h²V-td-‘…kӬʂ‘0€pÚ]*ñ ‰æµ<VÍJ¨ùCBN¨¬ÙožÈôC
Û.é0aBŒ r ø¢ù!ɉùµÊÉ`‰¶á¯aÒmI”s²iGÓÑá‘j)ÿEeµ¼gtbòX„fw,Ü›Ó7Raô¥¯ewN°h:ãBèIÈ -" -‚ð¶+9…"-9lê ,“Ø"ù‰’th–nÁ7 -fuÎ1y—´\˜2¨€ q†‡.§J.º7» ý6ÀjÌr-O¸Ü‚€¢M -. -Kdm+ŸMµZ£ÊÈ=µA[ÖI.¢$™=- 0•sFE|Õ‚rD¸€”`ºkðà‰„ œ©;›³S@“A´ûÊc(,òx©Ãº”lórW¨Ó“M¿¸™“N½îÉœ -ã ö&T_NfgÖ€ŽœtÙ2SKqaf+Ãåi4” ‚^ %Ö Œ’ y«z/TxÓˆ9½iž«&ëÃ+zjúóTAÅEÀ@!ã~ÞB• cŠð݈5ðÇ!nH&ì ˆ…}(ÊÁ4ÖHj£‚b`‰ÛC‹G»H‹g§l•ž7»ÈÀÇ=wö8ñ#ízo\¬ð!.'|=Îý43!ÅÊ])èü¹@OáÆÌJ$©dK4^N}˜ƒ$:=ÒYщ¦4o*Ä{=0ÄAS\íwdT Å…PjI˜—§y`ÉÑí·ØÄuŒäÊ5¶Q1¯]¼J v+ëI ŒÄ}¶¢Û†Ñ²#@Ñ› ÅI" -¨n`¸,Ç1(wñ@êR(UR³ŽLÊA|‘cfûPw—g\7ÙXäNüù”¨.ùAS‚Šã áω1§Î ·å'æ4rW—ºº@èì¼»mmøéç_¤ðpôò9WA>z±ƒ‡@³‚zðDÆÀ]„ä½ Î!Ä&˜µ[^‚}(Ò"gÂ.KXli4uÏòN}~È?JŒq4t‡Z#àäý%–» Ó
ɧpÌÝ&Û9ì»NоWŶêÚz/ïA#.3¥÷UõLÏ%å‹3 ä6Jòòhø!‹“j±çŠÏ¦¯áá3}ñÂïòuæ©ëDtùy>™¥Å÷ -¾*<©+"[…gH|¼,á¯áÏvW=óKmˆö +xÚ¥]sÛÆñ]¿‚ÐL îð9~’ ÉU¦VRIyi’ñœD,ŠaÚþ÷î× ÙN= öövïöööó¨`¦à_0‹b?Ît6K²ÐTÍ› 5[Á܇‹@hæŽh>¦z÷xñæ&Ö³ÌÏb Ï —£µR_¥i0{Ìöb_û—°‚òÞÿpwsûá§û«Ë$ô o¸»œëHy7·»fèÃýÕÇW÷—ó ïý_¯~|¼¾ç©XÖxw{÷ c2þ¼²èýõÍõýõÝûëË_ ¿¿¸~ìÏ2>o ä_?ÿªf9 ûû å›,f(?È2=Û\„‘ñ£Ð‡©. .þÞ/8š%ÖIýÊ×tõRQ2R`ªüXÁRI”ù±Ñ†Ø ·Åå<VÊ[6»ƒÝåoñL³ÈÏ’$žÍƒÀÏ¢H©0õ/*RM] ÿ³,wm£€ñÌ®&9‹]ËDÿ†KÐð-·Ÿlžï¹mv C€ oùãû¾0ý÷l 6„¼¨Š•íʦž£XÌt,ÚOÍîSÝŒe›ëÌOÓôTÂaQmü ¯±4µ(¡OµÝÈpQÙ¶? 22Wxºè Û3éœ SL,É››PÏzô _ÅQÚ›½A!Jdc»|èlWlŠºãáwÅ/JéºÄ}c뜟Z»*úA„~áh ?þÑïôx™z·E{î)x@ 2ðX4e¾ÂLfüD%g.ðÿq99F7ùªÌ§`- ÇéRsw¦yÆpA0í_™ö³4“àgPÛvÅNmFÄI➪ˆìqz
#¯-vÏ@pìmËHË Y‹àE³=2U³dLç–Èmgy +ÜîlNL×$K +0| +!Ö¶^9#)& `1üàt©Äs$š×òXÖ+¡æ 9¡²z¿y"Û l»ìmÌ¡ b¼ +Â)Xø7'n¤ÂØK_ÇÞ{9À¢i%ƅГå E +â,ûŒ(¹èÎî:ô[…u˜ãZžpõ Š6 s/š
Ä•œe×à~e½5ÊŽš%ªkâ®á~Šœ4`¹F‰ö[ ˆ2 è¡Ü”5DFá°ü©aªhy +öè–Øt”õ™'ÀYeÚ-±Þ×âS¹›Y:¦fß‚l-5,¯Ä\í!Z òb¹C^8Ñt‚И:¦ 󂧂 @ä®0³ÇëE„ü¡™ƒ¶*°ÑŠ1ý9¸á‹u±)˜õ1qƒRZ,„’æ¢,òn8Ti¯øÝn¶UA,ဥûÒ"èBè¥c’ð¨y * +Å +1|Î]=4 TEÇUÈ‚Mêx§DÕæ˜D“'}lZN¢ó +æ(HÎJ60|È@dœ*ñÚ#$œM˃§b-…jê) …¤j•Àå’¿ÇfÏÀvß1=t’ŒQàÛ“¥ånB¸[UÒd䥄Į°lßùõd‹1.Þ¿ µ±ñU`’?³¦cyɈÁ£0üla´öÃ,“ £Û?}M‹¡¡b%Z€ŒËŠ€ã sð1þÒ€2æ°sRSˆŒ”}2°çE±í„"×⸤|GÙž àø×îÖ“ÿî¦é3 })q™sŒa¹`Ø÷¦?@e
X›Ÿrp= +o1§7Ísåd
c9ðoEOuwž*¨¢²Ú(æªS„„ïÆB¬ÿ â†d ‚ˆaQ؇¢ Lc}4¡6*f!¸=´w´‹´wnÊUØÉy£‹ |Ü3o¢Ø¡“ ÆÅr ’árÂÝ£ÌO’(R¬Úµ†¶Ÿ‹ónÌ®D’R¶DãåÔ‡©QÅÑé‘Î +N,.¥qÓÞë1 šâj¿#£j)4RG¼¼ªKƈv¿Å®e$W‘‹ +ˆyíâu µXYGÂÀà`%î³ÝÖŒ– +ߤ(N ºØ +å >Ç1³{¤À»ËR®›\,êOüÙ”¨}òƒ¦ÇËŸcNz'€¾– —“°¿º¤/
„ÎÍ÷·Í µÌŠŸmpþE +FÏžs²Ñk 8|( ÏêÁ• ºÉ[@œCˆM0ë~yYö¡H‹ž .[X\u4uÏòB}~ÈÏ%Æ( ºC#‰pòöIŠŒú Û +
ɧpÌÝ&Û9ì»NнUE®j›j/oA#.;¥÷UùLO%åó3 ä6Jòêhù‹“r±ç¢Ï¥¯áÑ3yñ¶ßç1ê:!ÌS׉èâ÷ùd^”Vß*øªð¤®ˆlœ!ñáb°t¶š¿–?Û]ù̯´Ú4?»ßxfßöKÝß¼² ”cȸD |=2€W†ßs;`,‡>„ØCBéªZFJ«~Þmºn’Óq ü²ž£¯t›’äv[;Õ RçêÖ¢Ë4±\¦áË4±\žô€ˆ€ú¦ØÕ¶b¬èÙŒžZ‰¹e¤TÇråø¦=ܺéo]„yÎåeo’yìÐÈ_ÿÑgÔé|cójãk CGf 1ÒüÃãùOåªÿIõ›˜ þj!„.+Muß^\’úajôÌD>®E?ªê6à~Áª‘èÿÍXˆ:endstream endobj -1065 0 obj << +1071 0 obj << /Type /Page -/Contents 1066 0 R -/Resources 1064 0 R +/Contents 1072 0 R +/Resources 1070 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1072 0 R +/Parent 1069 0 R >> endobj -1067 0 obj << -/D [1065 0 R /XYZ 85.0394 794.5015 null] +1073 0 obj << +/D [1071 0 R /XYZ 56.6929 794.5015 null] >> endobj 446 0 obj << -/D [1065 0 R /XYZ 85.0394 636.8504 null] +/D [1071 0 R /XYZ 56.6929 636.8504 null] >> endobj -1068 0 obj << -/D [1065 0 R /XYZ 85.0394 606.7365 null] +1074 0 obj << +/D [1071 0 R /XYZ 56.6929 606.7365 null] >> endobj 450 0 obj << -/D [1065 0 R /XYZ 85.0394 606.7365 null] +/D [1071 0 R /XYZ 56.6929 606.7365 null] >> endobj -1069 0 obj << -/D [1065 0 R /XYZ 85.0394 582.3251 null] +1075 0 obj << +/D [1071 0 R /XYZ 56.6929 582.3251 null] >> endobj -1070 0 obj << -/D [1065 0 R /XYZ 85.0394 582.3251 null] +1076 0 obj << +/D [1071 0 R /XYZ 56.6929 582.3251 null] >> endobj -1071 0 obj << -/D [1065 0 R /XYZ 85.0394 570.37 null] +1077 0 obj << +/D [1071 0 R /XYZ 56.6929 570.37 null] >> endobj -1064 0 obj << +1070 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1075 0 obj << -/Length 3257 +1080 0 obj << +/Length 3263 /Filter /FlateDecode >> stream -xÚZYsã6~÷¯Ð[誂‹jŸœÏÄ© OÖvj·6É-Q³©ˆ” ï¯ßn4@ñåì¤\.‚ÐèþÐ(1ãð'faÄ"#Í,6š…\„³Åö‚Ïž ïÓ…p<sÏ4os}÷pñíÇHÎ 3‘Œf«Ö\ ãI"fËŸƒˆIv 3ðàý—Û7Ÿ~º»ºŒuðpóåör.C |¼ùû5µ>Ý]}þ|uw9I(‚÷ß_ýøp}G]‘›ã»›ÛD1ô81éÝõÇë»ëÛ÷×—¿>üpqýÐ쥽_Ánä÷‹Ÿå³%lû‡ ΔIÂÙ ¼p&Œ‘³í… µRž²¹¸¿øG3a«× ÓŸ–ŠE2T³¹Ðã¡œX—Öà°®k -aXŠ¸·î<F‰t´No”0nÅHf’x‡†E -F›¬ÊýKº_¢n¾ý¨U‹;Ž™R`_nù®@™1~‘RÓK‘K"þ·,2ì ·¼¢gJ—ô•uIÏEYü¹|:Ø)2"¶æÌ‹'¢•Eg¢]fûçËr›æ - ¢Í…`& ¥•ñ1ò -ÐaŒyiGmP‚Âc%”ÛJ=²m1¥í˜ª:³mVÔ—s 'A¹Âg Ô¯»ld$dQd¼ÊN«V &e‘m‘49(¦ÆÙґ飘qmÌÙéç9]õ¤ÅòÛr?2¯½Ä‰êÎ›í«‘©CÍ”²¯wp$¹ ^Öùb
ò‡ÐÌ7l‰ Ýí6¯DDàó÷C¶Ï/EUž¹^;“Î -×^e‹º¢xú°#-^›¹½„nÛG—@ÀA¬H -†ðN! [V󞃎Íà NóªáØÝ8nŒEøô¶ïkÒyJØ—õ¦Ru… 6 -v¬U¼GéìºÀU‚\{â©ik› ÀËÍ-õƒ‹Ï¨eƒ5< ù¦&ùL#ßhHt‹žr ísùU'ýè:ðõIôgfô#N9
ss5í;Â(˜iÈw,³Mö”b¬šc¬xƒA<i¡zZP,‰b³XxfB Œ‹AÆv¬3âí¯f{1m8¸Im !ÐIöiUï/“à°¨}Etçˆ
Ù0›±'†–6Pô~~GôÛë,|í[ |¹û„Á‡QßfLØH‹êÅ" Ú«‘9wSûÓ iá’(˜™—6^ÚÁcxÊþØmòEnñÍ)ôðÛ6õ¨z'œ:÷‡„ô -”´•ÅÎŽÁûÑt\%ï§ -Ÿš&!œûs¶)w[w©º ¦0x¿NË -ÎÓ;J_S¢þýê–ÆÑeXY—‹rC]‹Vd§™ -b¥Ó -f›Ô~ÃuNÁlÓˆ 9ƒ*÷L(msM Îs -uØAÆ’
Ý•Gzzõ†kdù.Þ^†ÅÝõï›|ó4žø·Pß벪 5m¾Ð㋯øÉÞ[ -`†ñômøçí#¨Ì;8°1d¦ý€¥lÊ :Ò ï:<פÒÌÄxrÚ24¥Ê2«Ó|S<»&„ÑâL°h1>¹ž —' Ìwå&_Œ$&ÏâÐL®Ý0
W½Oûq«ÎêÝc{,æð;Ó=^¸ºàqß@‡Þ²R»¯ªðîÄBî^â~ˆ-¥@K äÂ-9§bgŸÞ×`ÖÑH +xÚZÝsã¶÷_¡·Ð3' œ>9w¾‹2=_j;ÓN“<Ðe1•HE¤ì¨}w± +éÈô:f<J’‹ÓOCäL„èª'-ß–»‘y%è%6²;o¶«F¦V
†}í¼cäaðºÊç+_A3_¯±%‚t»] ˆˆÀçïûl—_‹ «<s½rG:MˆÎ•œG½œÈ(ÜáÛösþ’Ù¦žDjøìáÚV‘n2À„æ<˜- © Q‚H4Ó&1oÒ‚d âxˆœ=¯h#a” ]ªî!l õ•e
@j‡O8ð‚޳Ͷ>PsWŽi9zn"ŒX(â7I 2 'þˆ‰Â´VƒpvabUç$(J’¨g“vS"ÖÌ$Zv7E‡-žPëBÀ9Yý kÙÔ ³±}pôxŒ°² 5À<[[³oññ [âÚËl^W4;ÒâÐÌí%tÛ>ºb%â¤C†1S¡òUnë¼,Æ´b„ ø†R@ÔYíQŸ€ã|I« Ê=^S{Ì(@I”}•y‰r7Ê:K+—D!ôºaVïì¢GWíóUZ<£²dè´&%œÀ*}ÉÒlUT× Ïëò)] @m„¸è\d ˜uGg4õ/\ñz•Ö´b^áñ*9„£"¡Ò=…qaWÕ.–€]×%¢32 @F °¹²X °ã{ÝïK>ψòøH]ïÓ¾¦nw:è7J¢ÐéxG‚” +ÜÇ°ªl‡sRŽ‘ºg•ÕÔ -ƒL\ ¢8Hð Ȳµ< 0¶Ù<_ \Ÿ]¿™‰Ú]¸³~J£¸·™X;øÊäBÂ9IÈá å<ÿÄ”nÀÉlE+‰…¹”èˆCɵÕ:D‰úbªò豞y£ò “Îæh‚Ô^–ŽŠa‚ZÍÉ"S^9"  û +˜õYð–: +ÉØbLY©Í“àî_`> ¾|¾™Ý1¢Ð±JŒ£eæ¸ +뎀äʤYß)ŒÏH_UX®ì¼ +…®
$#`àx5À¸ò˜(‰„àöMEm +ÇØÚàÍ
6(ÉÇ|–ÞŸ ò\¯ËWÄ„¥ºÞ” 6Ô2²T åý.jæ~U4l´b7ú0îcöÐ$Äœ ’ƒ6ÄÅá†Ô4QìÝ9ú̦’˜%<ô•ô¬¨³]‘ešQ GÄãã„â ¡ J")w¯ÚÏ›¡Úo²£²õqåéþ9/wÎÈê&Õï/iåú6éoÞIÂ[é\Æ<œË°NÂ08'ñèkßî–¡É•WÍ*«òòD¹ÇéKdwr2Œ(3†'âeAM*õ¡‘ŽcãÆy|$`êck2ËÞ8|û<{üÆMù#uüfµ„,ÿRô·dÏê® +YÁdü3Žcš¶¹NÇ™†ËfUèò§pþxUÑ[\DàM|aõ†kdù.r5‹´éÿe=ǸȪù.w÷PÎ#õ›ÄŒ‡‘÷cý]ôoKÁcÈæ endobj -1074 0 obj << +1079 0 obj << /Type /Page -/Contents 1075 0 R -/Resources 1073 0 R +/Contents 1080 0 R +/Resources 1078 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1072 0 R -/Annots [ 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R ] +/Parent 1069 0 R +/Annots [ 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R ] >> endobj -1079 0 obj << +1084 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [284.2769 238.6772 352.9489 250.7369] +/Rect [312.6233 238.6772 381.2953 250.7369] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1080 0 obj << +1085 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [282.0654 208.0269 350.7374 220.0865] +/Rect [310.4119 208.0269 379.0839 220.0865] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1081 0 obj << +1086 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [299.7586 177.3766 368.4306 189.4362] +/Rect [328.1051 177.3766 396.7771 189.4362] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1082 0 obj << +1087 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [184.7318 124.0912 233.4785 134.8756] +/Rect [213.0783 124.0912 261.825 134.8756] /Subtype /Link /A << /S /GoTo /D (dynamic_update_security) >> >> endobj -1083 0 obj << +1088 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [330.7921 92.1656 399.4641 104.2252] +/Rect [359.1386 92.1656 427.8106 104.2252] /Subtype /Link /A << /S /GoTo /D (dynamic_update_policies) >> >> endobj -1084 0 obj << +1089 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [401.5962 61.5153 470.2682 73.5749] +/Rect [429.9426 61.5153 498.6146 73.5749] /Subtype /Link /A << /S /GoTo /D (access_control) >> >> endobj -1076 0 obj << -/D [1074 0 R /XYZ 56.6929 794.5015 null] +1081 0 obj << +/D [1079 0 R /XYZ 85.0394 794.5015 null] >> endobj 454 0 obj << -/D [1074 0 R /XYZ 56.6929 446.1352 null] +/D [1079 0 R /XYZ 85.0394 446.1352 null] >> endobj -1077 0 obj << -/D [1074 0 R /XYZ 56.6929 419.8946 null] +1082 0 obj << +/D [1079 0 R /XYZ 85.0394 419.8946 null] >> endobj 458 0 obj << -/D [1074 0 R /XYZ 56.6929 296.3851 null] +/D [1079 0 R /XYZ 85.0394 296.3851 null] >> endobj -1078 0 obj << -/D [1074 0 R /XYZ 56.6929 270.5629 null] +1083 0 obj << +/D [1079 0 R /XYZ 85.0394 270.5629 null] >> endobj -1073 0 obj << +1078 0 obj << /Font << /F62 638 0 R /F57 628 0 R /F43 604 0 R /F42 601 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1087 0 obj << -/Length 3398 +1092 0 obj << +/Length 3384 /Filter /FlateDecode >> stream -xÚµ]sã¶ñݿ“—Ê3B€ -Nm©%g"•q8e9yÊ O9+›zYÕm±9%æ±D<~ÝÝvD<`MP;Ôyœ2¡Õ€üǪ<±‹t±Í³ª¨ž6‡’ž‹
ò3!á¬"»øÄö€–€¡Ò©C+Ú1[µÅçœÆ›zOƒöÙOÿ¯®rБ8ŠÏÉ[ÔÇe¶z.ª¼ñ‹37ÿZ”Žïý
7‹|•R1¨t—ÁD1©p ¾ûð ‘à¾yÄtöÂ9H „ýðñáîý'ÄŒ
ƒƒOÜ&Û¼i²§ %pòá€ä‹#cå#AP˜µƒ vô‹b"n†ÒÐr‡QM›¯i\e[mòýç|ïü©¨†rV
6Ùí‹m¶?’¬žûž¬Û Èìa'+¤prÀ€ö±@»òÐÐ(«Ž4¸ûÎÖkº‡¦ÉZ×ìòUñc +à¼í󄊉D0¡ãNu` ƒ ÓJj‡‹ ÆèÅÇ^½oi´Í {ù€—¾ - €ì—µ›@wmN‚]]5 ¯ãþ×ÙXP½¥'UÞ¾Öû›•R1Ÿ >gû"0°ZÕv§5h®Û«¶’D}Ë i5ó¸Ë -¿‡µcÓJqî ‚“}"Ζ‚[thÖ2ª?4Œ‰È™çöØdE9AˆCTLyÇžg] -oñISpbW7MñXæ4Ul - kyEV¼ëOäb½/\)SÏ,ø1Ï+‚•EõB1Y¢šÔuþJºR›6$óŧz;©bM¶Ý•^A<Ñ“ì¹×¹UyX{
¤4¾¯[ºªÇeJ±ÏS«|bK/@W¥ ½0v6ðHUMÌ/ž.ÖùÀ°¬£,àw£°Ã%8U-æé¬ Â½°.Ú`‹¤GùSžby³Ú»Ó‰ÖS=„T³HHo]'þÇIOœ„V%]EA Ÿêžˆ4¹º¦Á}GØ€AØñ¾$ìê$6³xÂø%pùŒ«ô©¬ ŒŒw›Mm$Ô\ilÌ
ë`Íh˜Ç²7”—ùS†Ò/kì
UM% ¦óô=Òýž¢%0‹uMòï©-âì ÇjQSã - ÙnWC’ÅsAQù˜™øÚF¾¶”R/î6n6wø”ÔↈSÆOžcÞLeÏxæ6еƒqTŽ5/†+€–ëZ¡PNÓÈÅUŒ÷,JÍ _pa$ ±5sδý TÇnãSô ^g§ºû¼ŽOI© :ÖÁšÑ1eë‘z‰ýzœ=s¦4hþ,á€5A¹Ÿ='L)¨Fz¤©Çª×•°AjCp¢TÈ|%Ä·†@ýÿ6ór1Pº „2i5x¢„RØl ý o\ãÊÆpíË ²‰æ*;¸ªWžX,ëúÅ6cE>Lúb|`ÊÇZªßÊÙØ’[hЃýѦëBs§¯: ‡“dU0ù”·mXRÕ̪æ•b9&O:Á´ºœ>Îc|èSé‰S°MúPÖ‡ÒÑÏ°Äp<¤ª÷[LQäÃÊV̘ЂE&‘C+òõYˆTÈæRýØÅ:o -%Qhó"0ì¶E‚,Á,«v¸€äG5¦Ó_8 ÏK‡¶ÂA»]^9õ‡Ç …/Ö¤,Q)ï6âк ´g]?WåÅ,Ê’™n8a\÷ùŒÝ‘$g
G€ÓˆbàgÖpºXç
'`õ §Ýî–î8G¯ðµ´¸ÀDÀšà¢ÿJ@1®ãÁ|È9WRë•íø$²îÔl¾²=½é7®|q}5=ÒÂ0-/À]¬™“öXÔ5ÿuiw“»/¶ùr\/rm°‹.ç9 X¬ôŽÛÄ,´éóòÇJbÞœ—hÀFŠo µ>[$C ÅdjDOè™"9à_¼ï¹"YY’ -xž½‡€u‘ñn³E2Ooy©Hîb×€5ygźœÖBÈ3$^³œ¬ VúZˆù<\C—?§13'ÑP c–DácŠ)-àõSÑzV þñÇûþv-”m`’1{ë#ãÝæµ01p½êBºÖÅšÑBuÞsÔ‡v¤†F2™ÀªYVÖ/}5LAjTê.3‘vEòAvÁ“ô¼"¦)S:Q=±çÑã_8€ñ¾¿]“?w™¿tÑ^óZkfq¡™ÓÅšÑBuÞsLj!Tÿir•€5ÁK_ –h=`æ/ -É]‘†Þ[…ZÎ(¡„CÓª'õ¬:ü ò÷ý J1
¥×ì=x¤ lŒöšWÂH3tñ%ì`Í(¡Çê›Ø/"€9ÏÓ
X„ûïE4jfÒ§üçhÜÙO«b¨’$9ÿ^D%,ÒÊôDœ{/âñ/;Þ÷w¼óT—N=`]`d¼Û¬†iÍ„N.Tx ¤™ïv ’Û _ò õ‚U‘Q³DÒ˜j¿ "™1©é‘½Ã“ÖÒW\02Øa5ÜG PÌÁø5s@|/_ÑëP\§ -À®M⸒Z¨¥+±cWKÃ*Ø‚ÂòÏùžÞßg'’¶ì¦xª2÷é¾g”±é—ÿíáÔÕÔÒÁßw >}º}KcÜÃò,døx†¯ôNEؾ÷‘F§®™ÀÞM¶öëNŸáÓºh^ìKwîÏ€©›«=êº ps<1“˜>óyz¬~S>qñðïº?øÓõÓwýR3¨ÅÄK‰fDª=SxêI<ä\ņ)#ôëÿ;_ Rendstream +xÚµÛnë6ò=_ôe VÅ‹$êñô4§›b›ÓMRì.Ú>ȶœ¨‘%W’Oê~ýÎpHêj©E[©áˆ3CÎb×>ü±ë ô˜Ç×Q,½ÀgÁõöpå_?ÃÜ×WÌà¬-Òº‹õåÓÕ B~ {qÈÃë§}g-åùJ±ë§Ý«ÐãÞ
¬à¯Þ¼ÿp÷õ÷ïn"¹zºûx³æ¿úp÷¯[}ýðîÛoß=ܬ™ +Øêý?ß}÷tû@S¡YãË»û¯ÓÏ…E n?Ü>ÜÞ¿¿½ùé雫Û''KW^æ ä—« ~ò¯w ö7W¾'b\¿Áƒï±8æׇ+/BXH~õxõo·`gV¿:µ2P^Àe;)<îG|z—™1H‘d ¥p»,'wÙbá.'y]®‹²Éöç¡Ä̼XFÑuwÙq‡5A]t¨3æ{#ê ‹ü ûÎãÕ!MŠ¬xÞŸrzÎöÈÎ@¤„’@_n¹ â0 ¢Ø e5˜l›ìSJã}YÑ y±Ó¿•E +º"|±zz1huÚÐ Ü.“íKV¤µ}91óoYnø®n˜Z¥ÛÔ‘JˆÁ ê2žŒ7 ~uÿˆHpÜ°G‘/aSHp={ÿñéîÃÿ&Ä +6 Ž9¤u<§(‘$Ÿð•–`Aavr:Ò/Š‰¸ JC¯Œ<«›tGã"9hVŸÒÊøÑü^p”“b°È±ÊIu&Y-÷=Y ©`%oHnä€!…@ÇüTÓ()Î4¸ûÎ +ÀyËš— ã!÷x*³«óœ€ŒWF=ŠVï {eÕÐèö6逗¶vh;`Òìù@ͤÞÝ4o‚]z"âÁïâ6àžà¡å¶³GD¡)í¡;¡ƒSÖÒHkHÏz/Ƙ&¡à4A5Avé>9åuO³àâ&$\CLÑ{öeARpˆ2] +xø”T™c`»-õJ;P[³V©%ñûfAÞQ«åù˜ýý +ã»ï`ÍؽÅBŠ»¤I6I Ç¡!ç [¤ ½Óñ1<A¨ëQ~Ä@¦ƒ´Ö+bz"Óô[i¾$èÆ`× #F”º)+Ru·°ômì‡y\P‡[ßZ¾Ó¾²/ó¼|ë0YŒYÀû^ »›ÃpÞÎ÷mjðšžßŒU ‘«ÃßLéH΀’&ÒL&ôƒ‚Fz ++Çÿ€Œ±¦q‘˜r)ëCz(«3=Ò&ìÖ›<„ ¡GË©L—:‘ Ú¼g£L- Èš´Å ªX5HØ›äÕìQï<û›‘·øhRB!!¸å' +n¢Õœ8–umò”¦²=A!WÍ0¥Hr‚wý‰\íªÌT!0õ‚Á@ƒ7iZ,ÏŠWŠÈÕ¤$¨ñWÒT1ØЙ ËäŠÕÉá˜[±D[ÙS«sÛü´³H|_·2tU›%I±MQ‹tbI+@W¥7ç^»v¤‚‚F°…°Óź v –v” âqHVA<‰@ÏgÉZ¤ ²]kˆ!æœõÉ>¦é(Œ×Û*;¶ÛYNõâÈó¹´Î»e~œïˆPÙ‚ŠòÅ®| ¦]Öi²z¾¦ÁCGT‡¿ ëx]vÛŠ…
1zlÄTHŠq5¿çk‰‘Ñj³Y„A,”ZP¯ÖŒzY,}Biž>'(ýºÄ.Ñ°¢áPb2Ë€Ãšà —Þá…XÑôX ÷ ëj@$Ï8V%µ¬ +…€BšF&¬b¸÷üX
ÒEZãûÐGëßA]lnƒïð@]dm+îËZ<…± ,hYkFË,–.FÊ +²úÝ(u†”žÁ<]‹4A·çÅ”ÇýPõéRãSˆ ׌ÐjOpž—õJˆm5ú!æuÖeâŸ4cR«ïDñ`ѵ¬mkÅ"[øèpM4·ÉÉÔ»²e1/ËWÝCe÷0iË<ô< \cƒÎ^Û<%¨Î:Uç3Êù#áp’L +&ŸÓ¦q¯%“¢~£8Ž‰SbJOoóB¥lihÓè‰]ÐyWþ•§ÜÐO°¼0<¤(«¦'²Û¡e+ f‹GÜóU(‡Ö•¥»‹Ú/¨ÕRåØź¬ý«£ý¸¿£Þ?„h ”{–¶Ãš Þïý3œU}êßSMÀLfH©ª »ÒúbT,áH÷á1ÍÌËÞm€õÅCg“w…É̼¨½S¦€^?Xc„‘Уñ•Ž&UCÊ$‚Ø‹ÚIÇ¡ 3 ¬´yè¼4•f º û%hQº¾¤•Œ”½ã^w.StÝK—µ] 2˜îœÛ9Ì“tÎ4•ÃºV)Öæ—õ’PÌëekF/-–N»~¥ÆÙúB[C"ž§n‘&¨Ûà´xŸünb®ãƒPIÝ K!¡z GŠ&P}ñ±¶í|Ð;Ž³t]‚ ԤΠ*ðY‰Iñ7/Ÿi/S~.O”<tB@lJ¦>uîÎ@ ÛfPOÃ@/E
¼®V¨qîþûáÁ£¡©/Cº@ö\”¦½I +×î3Ú>Ç~M²³ïµßzáÓ.«_õ »ë¯ endobj -1086 0 obj << +1091 0 obj << /Type /Page -/Contents 1087 0 R -/Resources 1085 0 R +/Contents 1092 0 R +/Resources 1090 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1072 0 R -/Annots [ 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R ] +/Parent 1069 0 R +/Annots [ 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R ] >> endobj -1089 0 obj << +1094 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [259.4835 478.4263 328.1555 490.4859] +/Rect [231.137 478.4263 299.809 490.4859] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1090 0 obj << +1095 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [387.5019 224.9363 456.1739 236.9959] +/Rect [359.1555 224.9363 427.8275 236.9959] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1091 0 obj << +1096 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [381.9629 194.6431 450.6349 206.7028] +/Rect [353.6164 194.6431 422.2884 206.7028] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1092 0 obj << +1097 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [398.5803 164.35 467.2523 176.4096] +/Rect [370.2338 164.35 438.9058 176.4096] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1093 0 obj << +1098 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [393.0412 134.0568 461.7132 146.1164] +/Rect [364.6948 134.0568 433.3668 146.1164] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1094 0 obj << +1099 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [255.0796 103.7636 323.7516 115.8233] +/Rect [226.7331 103.7636 295.4051 115.8233] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1088 0 obj << -/D [1086 0 R /XYZ 85.0394 794.5015 null] +1093 0 obj << +/D [1091 0 R /XYZ 56.6929 794.5015 null] >> endobj -1085 0 obj << +1090 0 obj << /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F58 631 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1097 0 obj << -/Length 2801 +1102 0 obj << +/Length 2803 /Filter /FlateDecode >> stream -xÚµZ[“£6~ï_áGwU¬èŠÄîÓ$é™íÔf’íéÔ>$y ¶ì¦Æp÷8µ?~8ƒÑ©ÌÔTB|>:—OGG ¶ ð-TD¢˜Ç K¢(S‹õá†.vðìÝ
ó˜UZuQß<Þ|ý6⋘ÄÛŽ,C¨1lñ¸ùeNnA]~ûãû·÷ï~~xs«åòñþÇ÷·+®èòíý¿ï°õîáÍ?¼y¸]1£ØòÛ½ùéñî E^Æ7÷ï¿Ãž/B îÞÞ=ܽÿöîö·Çïoî [[ºö2*œ!Üüò]lÀìïo(±Q‹¸¡„Å1_ n¤DI!šžý͇›ÿ´;O럎úQÂøjè@):4Œ¨8V b .jæš´Ï“
¶’Ì7Ò]–·Ì,m‰ Õ“ÅF~¬Ò<#ëÑŒE Í
Q†± m´ê¢PÙÑh7(§ìŸyfWe•TiY¥ëòz|Æ)1ÓaZÔˆ]w1®ˆžž÷[7è×o•é Á\îg["¤/L“XðóÕíJPíýGËÒ϶ÀöKºßc룵Gÿ¼19ñÒl›‡ÄE;àÕSZbË9« È,_žÒõö®ÿ‹ßýØ›Óáh7Nep#†Rç#Fb¥xl•_¢†uãÄ5‘&RÞ°KlV¿RÊ÷vÄÀ>©Ú_l¬f¶á\vEµÖ5-íÊIÞEF¥¥ ó®‹šæ]‹ªÍJw«çdŸnÒê¼J³ -t‚H\³O‚+$ð*¨F‹Ñ£Gʼn„9ÚÓヵWîÙØr]¤GOç£íHbM(—q¤)k®Tˆ¤•Xú_Ad® ›Œ–t-Á‡Ån‡Žé-~Æô¡\´}}±Ò¥}¦®u’0i•˜¡BšÑc Ë©1M>¹Òð ù:¨ -p°AB6–¡pvXA]ZÔˆ2ý -ÐKR_›/JÃñlÇnU 01Rථ¢3Llð3Ê}=w¿áH´¨E†ÒÂLP¿°x†ˆP€‡ ä†;•võÚtè˜Ããš´ ¡*=FÀVÊyO—ϳ ÏXt¤ÆL4MC
t´kuˆ…
<lÿ@êë9(5µBAh0a ®%Ù'aºòHÏl‚»¨iþµ(7b–Wéö<E9¡½ŒÞß0ÇZô‡ÿ<‰o`ÄÕØ'† =I2›bê^ötM°¬ÅÏØ<”ûú‡Š $'ö½ œêÞ;F¨b|† ‘8šÙ§¶¨kG· ”ØÕuEÔhQ GW( %ú|ŠŒ¯ˆìWlš%WÁA±éÙÊE
~Æì¡Ü׳ÄhXºbv‹šSd -œ“„¥Ô̵‹ -p®A¹i¶*춰åÓªJî}§sÂ!ù4Ú]£«â<Ä6ÃÚ†‘ˆF2lB‹±¡_ÑDDûFÔ´e±§kôhë:†“0$‹˜é) X‹ŸQq(·G1§ÌäË7uwë{8Þ
jF“¡´0Ç(¨ÄäÌ ´‹ -p¬AÕÓûÓK“m‘ V›tën \±ÙÚ?A(N¨†_ÕiQ#úô· -}žêkÖ¬ë]€&&¸ °K }Û -ÖØÞðŸ‡|#®Ë0Øthfel£kB° óø›‡r'Ø6ö-DH-žoQ3j ¥…¹&%ÔÕs;Î.*ÀµU/¯§}•®IYÁîl@5:r ½E ß'lm8Þ½ñ?Ù®¸æs †MsÍÄ$Ò‘êâZƒŸ1y(÷Õ™M@´à/ìú4£Æ@VKµ+§Â$… ½„ÒørƒK"¡6 ”.¿;gÉ!]£þ? 7Iå#÷S¾O×éèÒBA¶«¨)~pö§0dTŸÂ€Ky: ó¢rßµ¥ZV/9v'{h–Té³ÅŽƒžòM‰7@Œúº+’¬JoÙ2ÛaÇzŸÚ¬ò($4Št÷Tù¾ :ÚÂ}eÇÎMkÜœj»Ê. Ô©¿¡ÓæãùåÄ‚/4×yæ>uïNx¦Âðþý úºÎÜZQÓ¾¶Ûç/+ }bóJe³F»s #cˆ6dÿ -¦µ:ºØŒæa÷å³Ýã÷woŽ?rt|}¶ûó-c yÑt_pc ŒFcÜ <Ž{W¡^i^½(4_eÖûäTZ<Hñ’ ËΙ -×(“Có49c#ñwÈ@ÐhyDžÓüäŸ<Û¢tG ðÎQÈ] ! 6ï+¼Ö¬ò° ØŸa³áVí•K½)è¦h2°ë–e;×›c§ÎœI²s×Ùk<Ž³i3_ ”Õž¢p4$-?gƒbÜûþzŽHÊã«°p!–õI¸föÅw8½of8ôÄxÁ3G®á(àvð§ð‰¬Àñ)ž>˜RUÉ÷(8dz"ðèå)©°u™¬N¾‰‚´58îRk`7.Þ\,ß8ÿ©ei0%½Ó%Ä,O{<¥ÐPèu³!uŠÚM=K"P2mí -Ég$ -‚{ôÙÆwž±…»F:‚ÞT¬Ò -´ßI&ÝY©†,Ä%‡¶C Åüq²e…A±2Ùù§©W²LwyhÿJ\ˆ{vaÓÒ§¨´j¦ÃzÚ4§Ø.ž†¹ƒ—Ç÷ïü¤ò Ã
Aá?66]ÿWW“Ì;àÜŸž—“LN}/ Oa¹ôßÖ5• jæˆ7œ¦žj‘n \ßtøæ:"œ`‘žZM˜€jòòþ}~bkÉšÂèO ?¿,šù™ÛW ßlÆîƒM²4ÛmO{¼GªºXÕp'Û±FDlùß'›áôdÚÀz¦âa 1
êMÕë-‹…ê Z³ˆ£Vä馛ա„ÎÖX!Ÿ:ˆo/ {s :m‰©À[4ÛLE†KJÚt~t/ÜFuÇy¬ j -14¼?ï;†9Ÿk=± (C8e¡TбŽGôÒ¼áƒKû)q4/± 't·“÷ؗàÏÿì&÷‹ ©µEX²Ùx»J¤~Œ,¯<Ÿ¸€u-æ}>áöö9qî["SŸ8šëSþÒË <N›óŒé¥ˆßçùÇò þبͻx7Ë7·«jè:ÿcóxÌrÆ&$׺¤wç’yu>ÚËÝ;é -ù:Ë©sÊÖn1ú^þ¼“þöæËo©‰0†Oì‡`ºKB¼RõæB÷¼þ°óPõÿï§ë†endstream +xÚµZKsã6¾ûWè(W… Äk÷4I<³Nm&YÇ©=$90%³F" ’²G©üøm +Уš9X&yµK›t Uũܤ#úqŠ4”hQZô³ $,Ìj¼
ýfŒh aÉ“ À,ù˜@±f¼goˆ| ¿`ùXî ùäˆ{˜!"Y8 ´ ÆHV˜x”¡XÒxx T€x 5«èEŒ¸'À‚.èÑ¢&鯕ɘ
4ùÛ¸çì(¡bD ÐOÀö ÉÏ [BôóøãÇr¯§ ÃHÅ: ZPc$+H?®)ŠÁ]aúuQóôkQfÄäPG×ä>!‘‚-YPšÐ£Ï>ŠÓ¬¯ÈÛ°/`Î~ 1 JÌÓO &ë™ ¤ŸÃ/X?–ûÐ! cŽB‹ZPd,-Ì@A`¹À gŽ.*À@ +„l* *‚„aU<hB•þîO !!ý÷tù[I8µF$– ‘³®¢ <ôøŒå^ÏC;g˜ìá@´¨EÆÒÂ<„¼Éˆ^ á`¡™áNU]› +
s„q\@“4V¥ÇB
d…Ó]O—¿FB혴`ÑèÕ,Š ô,
ÍnIK»VXØÂÃö¤^ÏAؽ +Þ‰â$=hA‹¡¬ c˜±TÈ…3p5OÁeFÌ‹:ÛçXÃz%àœ ¾EMŒß?|€¡1S}Þ&ûÌŒ-`õ'íËœ‰„G›4Àz–†žÇ/Ø<–{5Ù˜R°Tjv>Ãp¢ÓæðÍ°€Ð†`±pHmQ#×N-ܼyÃ|Õ•=qBu¨ z$1eET_‡·ÉNS– §A9xs–'±† Ö36Ä_0{,÷ú¤D8’”«°ÿ[Ô‚"ciá¼Ä$(ÅN¨]T€u eF<fyT¦»2ž¢:;šWžÆ Çäódwƒ®Ëóë;ÇÓ 4àT…MhQ6 76šY=#Úíhk=ÚšŽ‰E†äæMvwÄЪçñ *Žåö(f”™}ýÆa»Ä%ìÖƒÎjQ šŒ¥…9†A%/ C»¨ +ó)@õì ~Ác¹³oƒÇ/ƒô E‹ZPd,-ÈF&J‚- I»¨y6¶(3â§ô Ñ*ÁEyžÚ‰iŠãðð-jbüáNLcXd{ +¼ÍNldÆp'Æ`CZa)5¼ =Kƒ;1‡_°y,w†oã…Âœí™ »¾E-©1’f[ f²tòì¢ló¨f}= ê,:&U
§´ÙJ©ðè-jbø Ùb…„9a÷Æ›\7´bÈ5‚HŒÉ<×l±)ëÙ¢šƒ/<’zubc*FÃI*èøµ¤ÇHZKµS# +G aÈìEkËJ£&Q ›Œñú›sž ³5á§çmR»ÈýP ²M6¹¸`m¶ÔØ~tv5 ±hj8àRžŸ‹²6߶c¾®_ Û yRg/©í8¦õS±ì
£¹îË$¯³[²Î÷¶csÈÒ¼v(K,h”Ùþ©v}… è9-Í—vÛ¹mí‚›ScWÕ…ƒ:Íwtì? _ÊÜNsSäæs÷þd +ÜGïßΡ/ìĬ6_^ß Š×ÈŽ>s~űg²)昨ãÒÛ°¢¢g›É<l¾|2Ÿ‡í7xgŽ+y6”}Iç[Bˆå
DÓ|:5o:a4¬íéàqÚ@$ãWš×, +þ}ä未ÔS¼å§ªSWaUrôO“³m$c +
ëgkÃKVœÜ“—´¬L™½32WCHd›÷µ½6¬r°=ØŸÛ¦çVãÅÄ
**|&v ³ªj§»/µ8uæL’Ÿ»ÎÞØšœm›ùú ¼±x²’Âеü\ ŠBZ·»½+8›T= elÝT£À5O_]‡Ñ‹Q?áGÛ‹-<2
C÷³£+A²w¶T$Çg¶bú`JÕ
¦8XÁ…G¯OIm[—Éjä;‘6@¶F%/éÖÄ›²õ;ã?¾®R#ŒÇÎé1DO[ Å¡ÐkfCfM·Í, dž´µ°iÒ”ã\d¸î ‚UÚž\Í€¥}¾Mó,u}긎GA˜û?k}8‘› _Œ +7Ò>èz3P±ÎjÐ|“ØÔK50ËB@\rh;„EX1¿ŸÒª¶A±*Ù»§™S²Êö6òÐþs\›÷ì²Ì*—¢²ÚO‡Íá´õ¥lOÃܱ—Ç ï?¸Iå @‡Ãdj +šþ/“Ì9àÜŸž—j&£¾o+±Lúo÷5µ jnˆ7ž¦ŽjB¶nn:|3 ÂN0!çVÂ`7Ùn¯˜Ø2&~9ùÆ „_–IÜÌí+‹o~8ÛîcšäY¾ßöÞRÕ<°û±ndÖ0AÖÿ}Js;=‰T°žq=N ¦™of˜_o™f¼[¸– !v†ZÂÑMúÕ¡‚ÆVÍ-Ÿ:ˆÄÞ^v_”iiSioÙj.24†]:¹z4oÜ&u·óXZ5.dÊTœÑþ¼ïf|.åÌ2 endobj -1096 0 obj << +1101 0 obj << /Type /Page -/Contents 1097 0 R -/Resources 1095 0 R +/Contents 1102 0 R +/Resources 1100 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1072 0 R -/Annots [ 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R ] +/Parent 1069 0 R +/Annots [ 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R ] >> endobj -1099 0 obj << +1104 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [352.879 681.7691 426.5323 693.8287] +/Rect [381.2254 681.7691 454.8788 693.8287] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1100 0 obj << +1105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [307.1508 650.7179 375.8228 662.7776] +/Rect [335.4973 650.7179 404.1693 662.7776] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1101 0 obj << +1106 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [334.8268 619.6668 403.4988 631.7264] +/Rect [363.1733 619.6668 431.8453 631.7264] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1102 0 obj << +1107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [337.0185 588.6156 405.6905 600.6752] +/Rect [365.365 588.6156 434.037 600.6752] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1103 0 obj << +1108 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [364.6945 557.5644 433.3665 569.6241] +/Rect [393.041 557.5644 461.713 569.6241] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1104 0 obj << +1109 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [374.6372 526.5133 443.3092 538.5729] +/Rect [402.9837 526.5133 471.6557 538.5729] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1105 0 obj << +1110 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [292.0276 495.4621 360.6996 507.5217] +/Rect [320.374 495.4621 389.046 507.5217] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1106 0 obj << +1111 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [319.7036 464.4109 388.3756 476.4706] +/Rect [348.05 464.4109 416.722 476.4706] /Subtype /Link /A << /S /GoTo /D (zone_transfers) >> >> endobj -1107 0 obj << +1112 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [460.1655 433.3598 533.2211 445.4194] +/Rect [488.512 433.3598 561.5676 445.4194] /Subtype /Link /A << /S /GoTo /D (tuning) >> >> endobj -1108 0 obj << +1113 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [362.144 402.3086 430.816 414.3682] +/Rect [390.4905 402.3086 459.1625 414.3682] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1109 0 obj << +1114 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [293.1435 371.2574 354.3435 383.3171] +/Rect [321.49 371.2574 382.69 383.3171] /Subtype /Link /A << /S /GoTo /D (options) >> >> endobj -1110 0 obj << +1115 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [288.6803 340.2063 357.3523 352.2659] +/Rect [317.0267 340.2063 385.6987 352.2659] /Subtype /Link /A << /S /GoTo /D (boolean_options) >> >> endobj -1098 0 obj << -/D [1096 0 R /XYZ 56.6929 794.5015 null] +1103 0 obj << +/D [1101 0 R /XYZ 85.0394 794.5015 null] >> endobj 462 0 obj << -/D [1096 0 R /XYZ 56.6929 323.2894 null] +/D [1101 0 R /XYZ 85.0394 323.2894 null] >> endobj 779 0 obj << -/D [1096 0 R /XYZ 56.6929 296.7987 null] +/D [1101 0 R /XYZ 85.0394 296.7987 null] >> endobj -1095 0 obj << +1100 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F58 631 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1113 0 obj << -/Length 3154 +1118 0 obj << +/Length 3150 /Filter /FlateDecode >> stream -xÚÅÙr#7îÝ_¡GyËêðì#o“‰gâlʳk+µ›ë¡Õ¢ÞHjEÝgöë À>¤Öh’IÕ–«Ü$‚$€8$'þä$µ‘Й™$™‰¬vRl®ÄäÆÞ^IÆ™¤Y ë«ùÕob5É¢,VñdþÔ£•F"Måd¾üiúú›Wÿ˜ß>\Ï”Ó8ºžÙXL¿º»ÿš }^¿»s÷öû‡W׉™ÎïÞÝøáöÍíÃíýëÛë™ÔÆ* ™Äïîo éÍÝw·×¿Ì¿½º·[î K -ûýíê§_Äd §ûöJD:Kíä:"’Y¦&›+cudÖ²¾z¼úgK°7꧎±Éê4²©JFødôŸlÅZiϧۼXÁyâxº¿N§‡µ£Îó>ß65µ«=~“éÒmKǰݾ|_®Ý³«/Ú¦ÓwÛ‚§æôÙ¸ºÎŸ M]å<¯> < Ö댗7ÅÊ-sy+7ÐKÄ´Y1åjçöySV["ZÖÈ~àÁLÊ(³Vù•›[–yãüiFGñ ¤)€þ,Kjç[nl+ú> ö°æžfð^jÆÝ_Ëtê¨ã~Ï7åÖ-FÅÓWíø²&*Ý)ø²r[jÑÑ Q—Ï[Xqä<4ɘ„ñM:-á -- ?Â÷Œ6 À6µŸÄƒœ?fLlMǘ¡³ ξhý3ò4SiI%ãáÝv¹ °jÓ`56UÝ‚[[†ž¾õºza 8±¨¶L‰£c5Ý'½Ø¤†Œ_ªY,Á¼uÅ¥B Î㬸Ad›2ý!¾‰T÷h÷‘FÌ¿õ:ö)Šš v -5‡)0í…êô¾302"Æ‹ŒæéýmôÊm kÀ0IAjé·Ø¦Õ‚;[äµ;o{ûFíó eg{»d÷ÿ#ú‘`¥t¢@álHé´Ÿu?ɾÃÝC˜Ákda°üÑä»°f*HÌï˜×ùzݱº¾ù˜7§Àm©þ¸3ÇiVNAp>õéo€>£)1e—Ú·»LÃ,³<A*$ H|îÐþ££ŒzkUÈà"¨Íc þuY”
&h¯'ÛèÃ$qðRú :"v^Š•Ä8l´Ë(Ì•¹]CàÇ»·7Ôº¼¡áÇw¯äóþ~ìßs¬ÿD„0¿ÎÄÔ“uÚ‘c™ ; §¥q€8+¦ØÍm±>,)\€‘Ÿ•2¯îÀ„ - 5¬ëª(9–òiõPmÈ»¬z›AwR[ 1]fÄž[‹_ƒL?…XËQÌû¢eÝ´‘ýpƒ]…!b}Sðhƒ¯f V‚\ÅšÂPŽÀeBLôOž/–k×M
Ü÷SÁ{™…©‘äÉ$œãWW‡}áBö¸¬»Ü”op†¸—}ø¾æ ðPmFlæ|L”iz.¥¶x ?EÃÁEO×ÄãgGº›MÕÞCª ØtúDý
?¼yM` -ÕU˜ŒË-;Y ȉ•\g÷òÚJì¸h^¶WhuÒöÁ6{i"éó ¦±œQª¥ó¥)ÍUì -{ÑØýÌWìðÒâÐ B‘ [ ‹JÝâìJ÷,"öÉ"úúìò}SÔIß!¸lëYEµÙUu Ö¯ Ìä”D!Äà*mË ÇÃZ†Eq| ˆ… /4Ê^eЗì†óø¶b -a‹¾àÒàŽùåöïCYpÁ•Í )h©`t_ßP$8¼îÁª°_ß ¹0d'ÚRÁÕ×P E -k^¬ÅÄ ìðw#' vàçñkÞy|}ññîË÷ F&vR{jìû2X¼Ä½/ãm<:w "@|!
„R‰(‘Æhpÿ<¡ÆCß“ø³þ„SWú”.ž÷ÑM›GŠ#DXÿ$l‘¼ue{:ñé[¬ ;1°˜i9Ü ?:ƒeµ…'^ØOeE‹i'tϲ ïÉŠ$ÒJ|”-Ö…œRkK\p ¥"p?Óa¨0ï²Ù`¡¶§ùì¼ïï3Ù>,=¿ŒŸ±/ÏÔÒ$Šeÿùˆ²ã‡Š ¾2µñÏDëÞ}öÏ¿ºŸÀ`ošª3bP¤å f{rááwbŒÕÛúÿ +xÚÅksã6î{~…?*7±*¾$ªß¶Ûì6½Nö.q箯²Ì$ºÚ–kÉ›îýúP[Þl»¹ÉLD‚ H‚ +,ŠµQÕRÅsšÃò?®d ž ¿_ßÞÓè1)çÜÛ,<Ýô\h8‰B`È ™ &˜\ãuqMàb·ó +Ü|2Æ +‹ 㥫¶$ ô`‡„‚ŒCY¬Ù-©üT~GÞµ¡—# OÙ ËTÛ”'u"ÆZz"]Úd±y6ÞÃçÝ-J‘‚+ˆ‹úKÅ%…Îf —Æ%ûE£0’iÄðéC'T/ Z|s"¸fÐêd@ e@DlA ¿£ù´[ ü×ú
‹÷é¦äçê3HXŠµ4© +!W¶«} k kVÄñ} æ,¼Ð¨eA_¯kÎãÛšXrô— /ƒè F$ʃ ú’ë‚;æ—Û¿5Á%—5ƒ¤ ¥‚Ñ}sE‘\àðz +bý“=Yë, méÄ¥H/íÂߛ¦éx üäŒb¥$ƒ8B* ú ËŸP=Ë}²!ˆYr«íÇÙÐa½´‘j]i ˆHƒç™£„EŸÇã´=ÍdCW'XÈîM¸dü‚}y¶—” +›þù`²ÿ‘•Œ1µ‹_aM:ų¤óì>ûg_ýOß4ܳµršù]ø©@fý +MO~”~ ÆXƒÿGÌÚêendstream endobj -1112 0 obj << +1117 0 obj << /Type /Page -/Contents 1113 0 R -/Resources 1111 0 R +/Contents 1118 0 R +/Resources 1116 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1072 0 R -/Annots [ 1119 0 R 1120 0 R ] +/Parent 1069 0 R +/Annots [ 1124 0 R 1125 0 R ] >> endobj -1119 0 obj << +1124 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [341.1654 116.9088 414.8187 128.9684] +/Rect [312.8189 116.9088 386.4723 128.9684] /Subtype /Link /A << /S /GoTo /D (the_sortlist_statement) >> >> endobj -1120 0 obj << +1125 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [434.6742 116.9088 508.3275 128.9684] +/Rect [406.3277 116.9088 479.981 128.9684] /Subtype /Link /A << /S /GoTo /D (rrset_ordering) >> >> endobj -1114 0 obj << -/D [1112 0 R /XYZ 85.0394 794.5015 null] +1119 0 obj << +/D [1117 0 R /XYZ 56.6929 794.5015 null] >> endobj -1115 0 obj << -/D [1112 0 R /XYZ 85.0394 626.5613 null] +1120 0 obj << +/D [1117 0 R /XYZ 56.6929 626.5613 null] >> endobj -1116 0 obj << -/D [1112 0 R /XYZ 85.0394 614.6062 null] +1121 0 obj << +/D [1117 0 R /XYZ 56.6929 614.6062 null] >> endobj 466 0 obj << -/D [1112 0 R /XYZ 85.0394 327.2191 null] +/D [1117 0 R /XYZ 56.6929 327.2191 null] >> endobj -1117 0 obj << -/D [1112 0 R /XYZ 85.0394 295.1135 null] +1122 0 obj << +/D [1117 0 R /XYZ 56.6929 295.1135 null] >> endobj 470 0 obj << -/D [1112 0 R /XYZ 85.0394 295.1135 null] +/D [1117 0 R /XYZ 56.6929 295.1135 null] >> endobj 647 0 obj << -/D [1112 0 R /XYZ 85.0394 265.2577 null] +/D [1117 0 R /XYZ 56.6929 265.2577 null] >> endobj 474 0 obj << -/D [1112 0 R /XYZ 85.0394 208.5998 null] +/D [1117 0 R /XYZ 56.6929 208.5998 null] >> endobj -1118 0 obj << -/D [1112 0 R /XYZ 85.0394 186.2886 null] +1123 0 obj << +/D [1117 0 R /XYZ 56.6929 186.2886 null] >> endobj -1121 0 obj << -/D [1112 0 R /XYZ 85.0394 99.9723 null] +1126 0 obj << +/D [1117 0 R /XYZ 56.6929 99.9723 null] >> endobj -1122 0 obj << -/D [1112 0 R /XYZ 85.0394 88.0171 null] +1127 0 obj << +/D [1117 0 R /XYZ 56.6929 88.0171 null] >> endobj -1111 0 obj << +1116 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F77 707 0 R /F57 628 0 R /F42 601 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1125 0 obj << -/Length 3068 +1130 0 obj << +/Length 3065 /Filter /FlateDecode >> stream -xÚÍ[ÝsÛ6÷_¡Gy¦bñ
ðÞ\ÇNÝÇ'«3¹kû@KtÄ©,êDÚN],HAŽI&µ2çvZ -'Fã“e L§ QfKÔvìyYô¼!f4”"HHźÎ? ÑÑ [V÷ë¢FK’Öÿ>¶ˆj½¨¾ƒ‘b [ "aÚf[ÜeÛbõ‰†÷U &Ü -‰»*Wù6¼ÆL{h}9x8*¾d@k³¹·pƒÇ®ðÜ -Ï HžØYäÕ|[Ü ºâpY>b‡Wåú‘²f‘fÝ5unòý
ÐñýÏ.HMoòÛ2v9ÈKl«ey¿jçŸUTóŒô9ïÑèXU^¦~ßÔû-&õ€÷1Æ&ÚZò>óUVŒTŠÜ”à~ß##ß#w¾GÊÆ÷À„b‘¯ëóg5Ïײ.ç劦Þfw¨oJ\†èR¬«:[7nÇë3´5ñ²=‹Xq( DÔA%& Â5 1%1iú† -ë@îøjKŒr úÑ \íDqÊPŒjÖm¹Z•…w¨h>Á'Ó¿?‡¹»e nÙÁÎ[<RѬ½ kÁM˜Õ%¸„bÑ ºê OEÚjºF§£a¥ÿ“ -3Ðô³$+yÈsN€cF€êw3„ìÃF¶Ž¡oö‹lõÙ4ɧhîoñ†š»ðC0—[w[@±^!Ù©‹ÍPƒ–¡õæ Êq±å¸–ng„½Õ4òyA¼ÀÞî‘€»Ç§Ï lB=y|`%1 :žIІ,Ò…t|öq“Æt–)ÖM˜]„·I7¡# ð£S7c¡¿L‘¾)¦RøÆù€S†ÿ¥%©æùõ› À´…à dž‘Ð…ÓæœÁD@dt“U9‘«|‹ÉpWqû”áHÚ1¼GÙž:°ª[Ñé^±UóR=”\+ƒ5üë$‡ àS³f{ÚO”UQÕÁá>ÕóÈ C¦Ùá†%}\Ž¶(7ü
Šx -g zý\Ö<Ñ.$|§gÓcÈäg>s` -=ïn`¦wë0pùИš=¶Ã£"LA…îô-ýP->à+®ÓIkaÒ!%‡ÖŠ€`ƒ´Sãi¾Yes/,Vƒ’z)@¿WC?ˆ -øÞ -€ÈÊö+·„ì9eœœÌÛ«w -_ËÇó{½÷ÕYRgh;ü7ÿÿ Ÿô°5Îà -„›D¥j -J -¶xî‹ë7—€™nn! -ê®SþTÝ%ÓtmnÆ -и• -ž %~D pî—¦Öojò\Ñ«…_
ªý‚XØŸNÄjqØïÀëD‡Ån«S‚œˆzÚÈÔ£)cÛçþêÓDPt
xKd_{4¼`§©6â´pKj,UA Ž|ÒÀ/ùü :ú+Î÷¬…—Ù +xÚÍ[ÝsÛ6÷_¡Gy&bñ
ðÞ GNݦŽOVgr×ö–èˆYÔ‰´Ü_»X‚ SLjeÎÍL,AØÏß.h>`ðœN˜LÕÀ¦*ÑŒëÁìöˆ
>³·G<Ì5“Fñ¬×Ó£ŸÎŒ¤Ij„Lo¢µ\ÂœãƒéüáéÏ'—Óñäx$4šäx¤
¾>¿xC””šÓ÷gçoŸœ [5œž¿¿ òd|6žŒ/NÇÇ#.•°€ KüûýŘ&¿ ÿ5ýåh<m· ‹3‰ûýÏÑ ±Á N÷ËKdêôà,ái*·GJËD+)ÊòèêèŸí‚ÑSÿêSlRŒ'\h9I•8k|ÃÏJåËlÇϲÁˆó$ÕzÏZô ƒµB·ycw)à M”¶(Fec-oŨd$F®dâ¤Ô«y"Œ´^ŽåÃ*ßÃWÙm=—Úa½È‰6/o³bµó z x‡»a¶³'A ŠŠÚ›òn5O Q‹÷û< ·%èæ`$d’îÕŒ¯–lÞèf+Ì€ýº>¶Ê÷ =[ë/kà‰QF3`Ÿj˜¯ŽùpVÎó9¹]5öåð>[ÞåD®Y Vë|VüɘȫæQNOhu$•7²’Ëy>p™Å·º†;«Ê;?gdF/ÌJßîVÄ…çqv+,¿Ì~Ç’ÍÂ2V'©2½6À5þ±d:}²ÒiÐdÉÄ°.nóQ]Ž–Ž§pâ4>YÂd’eº@}ÇžÖrNÏbFC)‚¸T¬êü#š
º…u·*j´%iýïc[¬VóêŒåš¹ÓÖ›â6ÛË/4¼«ò0á:PHÞU¹¼Ï7á 0gÚCë–ÈÇÃQñ%j›Í¼<v…çVxî@òüÃÎ<¯f›âõ‡‹ò;l¸,W ‰”5‹4뮨sïn€ŽïvNzzß”±ÓA^b[-Ê»e;'x¢še¤Ðù •Žuåyú÷CýÑ¢žîó?ÆØD[Kþg¶Ì*‚‘J‘’ Pã}dä}äÖûHÙx ˜PÌóU½u?ð,£fí[Öå¬\ÒÔ›ì®S‹Ë`ŠUUg«Æñx…†6£&^vÈ"^ Ê ÑuP‘ ‡Aõ‰ : 6âÒä
¡$üßÉñH¥&x|ÅLkµ[ߘ γ:c´Ö‘1"
¬äeˆo!‹±Ñ DBá ùP‚½?™fèNöDŽÛ ýbî^Åà% ì°‰V³=Ò‹Ør(émÛ߃dÏrÜ@ЇÐZdfwäWHR2î#µ Œ%F¹i`®v"He(J5(ë¦\.ˇ»T´Ÿàé?ÁÜhܲƒ·¤¢Y;? Ö°?Íj¬|B1oP]õÇ"mU]£×Ñ°ÒÿI +YΫ4k^|,êÆÇÎò
¥x`yOn7ÜZº=ܶý‚«zJ¨„¥¬/Î)™&F +ò%§'¿ž©ôQ~, £2¨MÑu—«bæ¹ ÃP7…ž÷80Ó»vÆÎ|xLÍßáQ¦ Jwº—ý€->á ®ØIkaÒ^5çp,€lƒvj8É×Ëlæe€…kPS/è·µkè@o[Uá¡¨Ô±Õ _
ßyÐA§08ËT@d)?ùÒJ*‡wëW>Þ sRniÜçX‘Ù^æ>y󣽃ºÔâ Ww×5sšàFJã Ñž•ÉfçLÁY3_mâ& Gc¾Ä ¦fa ìgÙLÜ©Óó¬¢gô ¡,„FË' +wMÙÞ Ë¡t2¡N œÆŠníŽÕæPÅ» àÄÁW +-)4´ .œƒ zØrça%ÂM¢RÕ¥ Å[<øùÕ› @„L7WVõHçáÚZš.`F„ s ž"ý* BÒáÑy|Ê\{© +€Žs‡HŠOèå7W4Æ”ÐeÁß‘‹ÐûŒ$>ð 6a\b¬ìs[©Dðà ~ýp<2 ’¦G>Ëû†„üó º¿UÄáM:TGÄ IÈVjušö.òIOµ•†l4¢c 6‡=h\Ú$¢AŸ4 üSä² x‚•(ÄtÍ•šK[‰{yÕ@™›ò›k†ÖÄ©.îÖu²8Úû ®$ +Á§EŸ#¸ÈV=‹…×)¬ð’iºG7CÀ¹Kê5O#/œ.èMÀÄX¬±ËóHk¯=¡ Î
øFÝšŸÓ%³ÍM)v± ·, S‡ûwh¯óºÎ7¡Œcº¬ñâgáž5ß×@‡® °× öò¤'°51 +¡è ðV–ȾizÁNSuÄiáÊÔXª:‚ æ ù¨[ƒŸó5BtöœóY /³> ùk*}Fr‰ hgó=Ü= endobj -1124 0 obj << +1129 0 obj << /Type /Page -/Contents 1125 0 R -/Resources 1123 0 R +/Contents 1130 0 R +/Resources 1128 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1072 0 R +/Parent 1134 0 R >> endobj -1126 0 obj << -/D [1124 0 R /XYZ 56.6929 794.5015 null] +1131 0 obj << +/D [1129 0 R /XYZ 85.0394 794.5015 null] >> endobj -1127 0 obj << -/D [1124 0 R /XYZ 56.6929 579.9063 null] +1132 0 obj << +/D [1129 0 R /XYZ 85.0394 579.9063 null] >> endobj -1128 0 obj << -/D [1124 0 R /XYZ 56.6929 567.9511 null] +1133 0 obj << +/D [1129 0 R /XYZ 85.0394 567.9511 null] >> endobj -1123 0 obj << +1128 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F56 622 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1131 0 obj << -/Length 3381 +1137 0 obj << +/Length 3372 /Filter /FlateDecode >> stream -xÚÍZÝsÛ6÷_¡·Ò3Kü¼{J»q/MzŽîÚ¹¶ Kl(R(+î_»ØEÉ”•¹¸s ϘÀâk¹Ÿ¿Nø 'Yì2&i ùqÆ“buL0öíEÈs¦nÒt8ë›ÙÅ×׉˜ä~žˆd2»ì•ùA–…“Yù³÷êÍË fW·—S^â_Nã$ð¾¹y÷š(9=^½w}óí¿n_^¦‘7»yÿŽÈ·W×W·Wï^]]NCÅ6¼ÅÞ¿»¢I×7o¯.}wq5ëY ¾VHä÷÷‹Ÿ
&%¼Ýw/ó,žì øaž‹Éê"Š¥ GR:J}ñáâŸý†ƒQ»tLLQú¡ˆådš_& ›“ÇÒ ËMûYÇG§Â[§~§(z)üPƲ}$¢#égRÆ“4ÎýD -ie{)Sov ìd·¹ 3¯ÝvzÚ-¹½X‚“Ì›WMY5 êܵj,[Ólæ^·¼ =ÕQ§li¼i;ž¨î5µº¥®64«Ý5¨”Iùy ã«„Ø–±²² èvˆdîíªRSKÑ€‚^xîvíæ#•%
£
XA–¦ÞÕ§µÞT+Ýtª¶¤Ì{§öààðHSlª¹.Édª†íëú5Â0Ã:2¢¬(E5eÿeú”QæKðÉTH?Ò2 méVœ6‘ ó…ˆÏYìo•Y©|¸ùÜ)Ësï— ~"2Õ¢QÝ–$Á„‚Ô+ZsÕìe^©:E-µ½7]U¨Œ$0>a€F¼çi«xýîƒOêxŸV8Yü„ºörø2Ñþ©ÚJ²È—a”žQW’ç~'©ëýKPW$c $þK>šÆ$j‘&žéÔ¦#Z{G$E?ÚF
€êÚMÕ=\†aèôe– H æXéÃ¥?¢; -óðªOhdø®Ï«’èYU’~Dçbl’Æ~ %ôâ n/ãØû7&¥$YAø\©®jAhær±™x;]×DüØ`t´Ä>Â!ÝèÍ}U Bq=’\f]+¤žtœ ÿñ½ôs'ÍĪÈà¹Tå åó·towZU°yå✪b@ ¦`7ûi†j’¡×éO ƒóPkŸ%¦žák ðöeïûçZ» -D 'U8Í_9‡àî\ÊOÂÄÓ€@áO"Æ” §lûkUˆ¡H›‘ˆl‚ˆDìýäãt¤ì± a1 a±ÓY^ ¾ñs)féÏÕ¸&
Ò£á[å “Ü— -_bõ®ðZMdÞ
+Bx!™$Rº–(fÙn;ñ â=ı{µ©Ú-ïd ÌtÌü:½â„€7 -sez { û€›]ð%ÖÚÖ› -ƒ›Ë.
çÓÒŒð´}
4÷\öWA’!pô™¨À Ô¶xUD@!å UHB€ï1r`³Q+&’!Áà]§&ÖuUT~¥Ì¼äu€ãyZ•½“ÄŽ#¢‚ Ø[Û{ÚÜ-çSoo}j\·¼³þ¤àXÍg®Tó0vKH|£ R DcÊb{î¦Qµ
Ô0ˆÌQ«#_Ð4Ï[ .•YÅÀ„ÌÛîFÍôðú%/ œ¼†j m:—lÅ@,–TÎÀÌÛ[ÞÞ¶¼£NÓ–‰Gad52òrÄÖEtÙ…°>…¥!Ò –A‡ØƒÞ4}²‘f/µ*mŽ°qÐ=¬-Ñ$¼ÈíÙì-] â<® qyÅ'mc «ä£> &(¬‰=· Ù£)ZÔ¼Öc…ì} ™»}M ðßKæç bÄWëÌÀl´v8ÕAÛ~l ãÎ5I™+qüž½ j$ ø p³ÒŠ4!ùF‰dÂ@ -?ˆÝ¶?†Œ±—Õœî£}80†¬)¨»JóLë‘ðtÅÌØ»õÆ“¦` b¶‹…6ŒLÈû©¥
Ï@2<yÙnk>s &€#\’ —³”»'!šxà]HÃ%) Âc?°YØ•x7¼VÑ¢}³mä°"g®PÞ ìKÌmQæËÙ¡ñhÉ´ÜîrÄNÄkÎ8o°
33Ì€½ªéCyñ@¤r»áìMª Ñíûâ®!uÕ‡+»Œ»,š«â#OcTW¹ÈÊvu˽ª·n:c8 ~:>‹$`—ÂUw. á ©É -dzøÕm½.Óý!ôÖØ · †½˜dˆ»Õ; œ±
Œ!2–AÄÁæá·Œ=×#‘±‡¤ ‡Ï¸@ l×{ -€ÇÍãŒý6QÆ~$e8öSÂ`rö'ŸûÃÅý7£ðNvâf¯¿t\YÈ• ó ËÌ3‘Ž1ÿ_Á÷uˆendstream +xÚÍÙrãÆñ]_Á7CU+3ƒ3yZk%¯|h7»bûaŽHD @s@qå¯O÷tR¤´••+.U ==W£ïnPŒ"ø£$
ÓB£¬ˆÃ$ɨ\œD£Ì}{"xÍ™_t6\õÍøäëËTŽŠ°He:ß
ÎÊÃ(ÏÅh<ý%HCžÂ Qðïקg2‰‚Ë« +éýýä—ߢÑÞ(TEžŒ60ˆBQr´8‰&±R SŸÜžü£?p0ë¶ bS ‰PÈDÎRªxsôZº"‚kTI˜§I²w뙈ŠPÀ?`½’¡P‰êY «ë…HÂ8ÏFYR„©’ʱþæTeÁø¨É£`u*ò ]w欛3<›Ó<˜TÍ´jf4¸kWÌ[ÛY‹ ›ŸŠ@ƒÄ‚Žæ¦-=›–sý`êæ¦ZѶvÓ \FY I"ámHÜ´rT˜NˆUlª©!HÓÜÇQИnÓ®îyj:¥Ik]ɳ,¸ø´4«jašNוïÌ™»8Ú½Ò–«jb¦¤:UÃ*tyN€9hêž ÅIÆ¢ +í‘ fYkÄ 5›Ÿ¾¿Eý\ÓÉrùŒ¤,ø+ÛŽJøˆ_T"CPKvt·ï/?bLÉeð‘"à2[¹è¦” 6ú‘Æ]KçµêG,דº²ó ·æÐvNb†©{óø•%í´9;.Á™Y-WUÓ¡Š—EËä9cÛòæµ$èiýü#ýŽã”K*8üyÊ s*ò~ãŸÇhg( ó©#VpѺçÔ~&_ðVÒ¾ìuÿ\ˆ¢øóB´OEŠ,RÞS +o"·¥¬5Š˜ÖíÜ áz¡u. 콩m)¤•æ eCõQiØt,õ ëjOI:ÿçÿm_Gz«HÐaʼnúI4Ú&¶¯î’½dêQfYš9¡\]C夒t+ø«¦3+°äg lpÍk…._Ⱦb7#NápùRépŽ©ãÆù{ð{E®‚ó¹n-0CG&]ÀH³à‡·×Ô€ ‡ØvmÙÖ„)¹¡àjS\«¹kñãÕ˜NAS.VXTÓ3`gdŸñ„7lNá… +ÖÖ/$÷P + +š±ÅO"Ž8À:JŠx{†ž‚«3 +9< ÌG#ÈRm r*ÀÄГóɜĆO$xQýaü†ùç²—Â;-2TxüAä¶ý5pš=¯&”ä>9‡}£`IA5ØU†W:‹„§¯g:³r¹ISr®b׳™±œœõd,¯@²¼xÞ®kÎ}&<M9ŽôqF\ÐRø’ ‡$Hâ‘O!9·€§¤, ø‰Ôe^ipÅ{5=Àá7³ƒ¾ VLò»…]bu‚á-Îýek" +yã”L?„Æ
Y à°é@ž‚Æã5=8kÍ}üÙ?}–Tã ˜ æäPê^5´…M©ð¹9ÿVd¹ý´¶w)µˆ3÷ñ%~sèÝÐyFà»»ÇÚ0NªÖ+8ßõ¾?ò‘
q.×€çBƒãõ˜w9ºp°Ñ ¶}Üß7 ýUø5Ï¥`‘ +=ú±»@øºr Øp)$)oEU$®w~q®œä3ïövR™ÀùvQ¿#hmÍÞÆEcmS•ö`ábÜÇö>DOÚg ©÷Æ©ÏbÓ¨êšC¯kQ: ŒïÚžïÃähCˆK;|XkÄ°¿u&nyKhýÐVž*HfkÍNzÆf9ƒFÅkŽü°Q%a¬”8ô;Ähôâç‹ÏýÕãö—Ÿq±ö؇Jn@©ž*îó'´‹(”*•‡ˆÿ/ßGr‹endstream endobj -1130 0 obj << +1136 0 obj << /Type /Page -/Contents 1131 0 R -/Resources 1129 0 R +/Contents 1137 0 R +/Resources 1135 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1136 0 R +/Parent 1134 0 R >> endobj -1132 0 obj << -/D [1130 0 R /XYZ 85.0394 794.5015 null] +1138 0 obj << +/D [1136 0 R /XYZ 56.6929 794.5015 null] >> endobj -1133 0 obj << -/D [1130 0 R /XYZ 85.0394 552.4093 null] +1139 0 obj << +/D [1136 0 R /XYZ 56.6929 528.499 null] >> endobj -1134 0 obj << -/D [1130 0 R /XYZ 85.0394 540.4542 null] +1140 0 obj << +/D [1136 0 R /XYZ 56.6929 516.5438 null] >> endobj 478 0 obj << -/D [1130 0 R /XYZ 85.0394 229.3354 null] +/D [1136 0 R /XYZ 56.6929 205.425 null] >> endobj -1135 0 obj << -/D [1130 0 R /XYZ 85.0394 203.1874 null] +1141 0 obj << +/D [1136 0 R /XYZ 56.6929 179.2771 null] >> endobj -1129 0 obj << +1135 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F42 601 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1139 0 obj << -/Length 2798 +1144 0 obj << +/Length 2778 /Filter /FlateDecode >> stream -xÚÍZ[sÛ¶~÷¯Ð£<ãà~é››8:“ã¸g2§é-Ñ6§©CRqüï»À)Q¶“8s2ž1A`±X|»X| -k >^¾==ûå‹Óc#§—³·çX}qöúìâìüåÙñ_—¿ ]v&÷§Å¨ðöþïèÏ¿èd³ûíˆá¬šÜÁ %Ì9>Y I%ˆ’B¤šåÑû£w -{¡ë(LŒ. -5”Nÿsv~vqJ:± D¥`°D{cÛ|<rƒß!íÀ+†ºq„8§Ä:-&Ö:WF„ö!9ýÐrþHÏŠ{V<Œ%†)ûHÄhˉ \<†kÍ@Ü@¶2ÎcÄ-qL⇑éùGŠÖÄhª ‹ƒHƒ¹° Ôô´ÿÀ(I,Uò±èPAkㆦ}T8 ÂÍaTzãýÀkFrb‡"Cj"…vÃÈHËC ¡§þ™@Øò›ÿÇ^ÇŒ‚%â€jrC¨=ÂÙ„HpfÐÏñ0áRÎ)©Ú.`_!g .‘5øŠÛìSlÊÊØ4äZ¾©ãZþåߢè¼*›¢i£*Ïœ‚"ldúäªh±ªÜ¬®òË×ÕrYÝy¢â¥®î{ÄtQ²"Rf«œŒQ«ËÄ}²Å"2±f‡ mš|@€š6+H#Cš½; ˆÛ*‹|«"·ª€éíp*Áq~H·Ú¼.óvOåß3;ö_UŸòõÛÒ¼hMS|xaÑÞFóîªy'Ãól eŸ
„mJd4íË èf”™¾/VÅ2«—÷‡ižï±I8i!äD I¤Òöi Ì}Õs“I.ˆcôK'ö»9#Í) |”Ôs¿"”:5Q\ûs!ì‡ä÷—ïÉ›ÙeÇwczv js@( 9öÛ`ZÁ˜ß(üŸ”û9Ò@n5€xϸo›¯Göy7ŠA %å˜x A ÎÌÜ'^þ -ghjŒŠ`ðif ž\rz•þ€ßºs¸/ß9ž?°™qÄ~ÅÎ!
#ŒÉGvüg–¥£h ÎP]꥽|›K½Wv]lÀ³F¢#«å†YA´Õ<Š¿8”áb^^×ÞŠë )c¢š/³˜ŽAûÖÁ š±Ìyÿ*ÀØgºÌá>ê ¼^Í|Ó4xßÐÒo§!ÿæóª^4#¶û $‰“ ϧ~¯Ô|ºÈ›y]\…]P Ü^x^¸Í̾¾ÉëOy û4m•n3|[QâN…3´gQ.ëúy¬ -[3Ôíß·øV¬£öEì`à~oÜùG’WÜ ½Ó ~€Ç:«Ûb¾í#¾y¸àb€žƒ)„®WÕÆûKФ%ÝÙ@±Û² ì·,,}¤ŠFJTF#6Í&[¾Šoúˆjz…ª¡s Ùò.»‡ù¦„Wy Dô¨jZAš‘ÎD õMá×Bãé
ä"Ђ՞/øŠö¶(ÿƪ -ž·ùr ÕÜ7m¾j¢ 90ªUQÆîw·yê3™ÄE¼UMÙª?©Q˜0ÄÀNðcewm(B(—@)¸W ÕùⴾǷà/xæàœ¥¿åU"FŽ
—›¾Ô¬ÁEù¼øH)O#gú‘’øм(”¬ÄǺ.ªºhãàÁ_Ø:S0ÒD~ ¶O´êzº¤îϳÁö6 Fƒ©‡WÔ©»ÃT…Ùc±—mP6kÁÝë6_ø˜6,…iP€E62‘t¢àÂN=€un>ê4…äââ¾ÍqN!ú÷í0¼à=*ˆ7~ù`®1‡Ù˜Q ˆÝç0%Ùi
hW«˜fã[È2QqÊáaì6>ñÑe7·E~,uÛ.‡¯«rQ”7Þ^Çã4¬œ"è^®ã@ªnñ5»ÁÐú•»Œ2×–à –ÍÿŽýªøL*ËüsÔ±DCnBâóMÑqþ’Ñé».„|ôSƒâ‹jÔ•! CRó(ç‚ø «²«¦ZnÚ ßVyVâ½=È|äÜ`5XšÄ; @`'¯AsU.£`Ñ lÓ aâ^ -ôÕX û{§ª—$|#Þð‡ñƒ[A..¯±IÆÅÆy\lJn£’){«î+…/†•¢â·_XÁž rb¨ð™ÖÜP0¬=•œíKWiX\˜Ë£M³6ò4Ýã.ÂIBý ¯Õ¦iGÐàë: -Åû&C &,¡þ8 馩æEÖ¦§ý´½Mw¾.:Ú;?}s6Ìó<ž‘níó¹`^ä{I¿ÿ¥EãúÓÛõEt†_Nvçk¬ ‘> Y žWUØú´Iz’aÚîÏÀVv|†¸ÚŽƒÇ/O‡¤ú¦`âõïy‰ºö×6A‘ÃŽd“¸üjúˆðÏ⦬¶ñ !g%ìÅYÈÌ4}l².eGG”  -«0•¸ØßÑm>õåuoï V”±W-ÌßÔ+ç² gdÉ]Ýï|* ^ÚûR£á\j¬°p@µîIßO¹#Ê0óe‡ºñ^ßãÓWšÓ ³p¨³ÂŒŸµ
µ•ôS÷×Ï?ÎÆs ™W«ðñ 8×ìܳNêâõ!µá“¡1ÑA—ÝS¸ƒS8XØ·äÛ&çadFðgÇËød!‰áV ¸Ã¦P¶J ÖÁâzÚEÇ%tD@‡? æ&ý‘Ÿ öœøhNŒò1|4œž•sðá}|ˆ§ ›5©ê›ÐéûG¢Ä2Ë YmJI%îHûëÈûvÉÙpoCL…Ë?v¢Þà?0D«Å#IN¤tºChg
Áîö -±Ì‹xÞ|¬©Ò¬f3Ÿçጠ.7·¸*z +xÚÍZ[sÛ¶~÷¯Ð#=cáàN on¢ô¨“89ŽÛÉ´é-ÑO$RG¤ìøßw(J¢l'qçx<câ²X,>ìK±…?60ŠPaå µ’(ÊÔ`²<¡ƒÌýrÂÍ0
»T?_üëæK¬æzpuÓáe5†
®¦&¯þ}þájty:äŠ&šœ•¦ÉÏã‹×8bññêýÅ›ñ/¿]žŸ¦2¹¿¿ÀáËÑ›ÑåèâÕètÈ„T ˆÀâ÷#$z3~;:ýëêדÑU+r÷XŒ +'ïÿNþü‹¦pº_O(Ö¨Á t(aÖòÁòD*A”"Ž,N>žü§eØ™õKû`RÂexÚƒ“}8)K´àÂ㔕S8ŽÉd‘Õ56—e¾¬ÊbºÙú”™$Çδ¨ÿ[esæº&¹ºzÛGù,_מ*ÝnÒÌAs¿Êw7s=•‘Ûâ.»m¬ô…+Âõ*_t¥†[ +n¼¬x*-“À ÚøÆ$ŒN³&ÃVµÆçåkTX÷ï ‡ê|ÒUènðÙDÆ——øÜž:³â6 6uQΰù¥¬îùt– a7WL²EWàU;/›Ì ±s h7^ö.bîX½p¼‰¤ò3ìÝ…uËb6o°YÏ«»=®——ýI¶^ñ*ãueE^×Ù,¬ÈêŸö͘ F$¸“6’h+ždÈBS¢5W»†ü}«¢ J€ë(ð +Íh»¬†í¡†:å$†·nB¥ 7ÁDJŒRv Sp{\⥌?ŽÉèõo`‡Zš¼ût:LEÊFa„Òä÷ÑÅèòœ´d{ˆJËH* ÚÙûÇÎã Üšýs"¼S#úâÒ.AYµ–Dh«=@‡ˆœjñ8Çv£Œ†4â‹yL_'’IéáØÕ°´´|Uj DÜK@$~ ÜÓ¾pd„&&…Ðûˆ¢HJ¤²q[`À@=€A‡û Æ€KbYª Ó¸sE%Fƒ ÛÂÞ´ Xxz –Ά/Æ ú¦!Á3vW5¢}ˆã tØ?ÛóÿêàB‰ÖÀUšîæº9¯ `ÜBΫ •F‰‡s^¥Sg×Û| `ï³!ÂaÒàæÙm˜ÊÊ0µ›j¹©6Õr»y1™#é¤*ëÂgnÂ%NžN2=¼. *7ËkH}û¦Z,ª;—§8ªëûÎ"‘L«eVAÊl™“¾L÷*¦>Ùt±z/ÚÔùNþS7 c.¤ñ‡#< o[f!ÝjªZUèí¥T‚ãùÚ\¸Ì›–{é^º'ÿuu›ïd~Û,/HS_ۣŴ°hæA¼»jïÜQð<›ÌwsòfŽ2Å\4 +&ˆ6šò³c>.xæiq㤸 割i«Á!÷í{˜VÄ0@S(Â@Ëü6®ÆÒv½.êɦ®±ÞÐÙÑÅSï€óIµžÖ=¢; Ù¼& )»`©y2Íëɺ¸öaP Œg.1ܺf7^çëÛ| ÖÔM«n®(1Tad†ù,ÐeíÚ"C>6ÃØa½ÅÍâè¹Ok/ øvWcèï©u„øèËWÌ_<VÙº)&ˆ ¡_ä¾ÀM <wŽà—^Ww]‚F.±fÍ6fAÛÅ,l}¦Š†œÄ³ BlêM¶X`
ê Kh×ÈW¡E·³Þr ™A~TÕ
ìÀÀËH›†D +ÆëÂ×Æ\~®¸à°KÜ@3/Ê/8äÁc<2t…)×urº~ŸaáýÊ댬²bƒÈBø’» n"y«+0‹¸ +pÀ
N˜1à.=GÅë_ä·™7é p›¥CMªPW„ÁVýB?ä!n¦ò—-ð +|˜ þ Š°|>]’IÖ€vµ\ÄRwg^&0Ž>ÜïÝ„'>Zïf·È÷9£VbÓúðUUN‹ræäµ< ÃÈAwt
Të»Ù #¡q–»47¶àE,›| ëªðŒ,Ëükà±@AfÞñ¹©Vèp~Éhò¡U!·ï©FòiÕw:tÇàÔðe”s J|CÙu]-6MŽ½ež•X·šÏœ§8 ’Fò( Øók0]•‹@Ato¶qSpGüÖØôñ½eÕqn+ü~@Ì«O_ƒ±q ŒMÉ1*½·j¿R¸¦·¾E¸Æb²÷‰~´Âg´¹]Bo{*^¶k]ÇmÑÑ—™ÆMHÓt'w\P™Æ¼k¹©›ž ÒJD¡ +¦Íá ÜneÛÀ§×«â°yøòtŒª+ +:^×Ï×è¨×®nã ¿m½ó‡TÓi„{³²ÚêƒE —‹3ï™iüØdlô.–ö0ÙQ+ BWbÃzK·þÔµWØç¥(Ã*Ÿ»`ÛC`{ôÆVî³lg«ž£^ßï}-óuð±ÆÂK‡%̽'*jŸô›[¢R–~Ûk]ÿªâëW<Ó)MR«Ž}Ì ‚HÊœ ö0 _S« ™TKÿ ò.÷Zp +Z ïDɧÐqß~R ÙY¶‡±‚×f tåù±#:0Y*ø3)¶¨I oØT ©f C Dz&
‘`´±„ãP±¡Ì + +1‡ŠÇLB§b \‡Y|×î\1ÞxòU@v £Îî/X¨!6EØ Âˆq¢4K[Œö¬Ý ñã u¶.ž^ü'‚1T*WÎ"²Ñ'Ö \‰ôá’ v,©íý¹ÊOÇ~&‘XtÝßž U¨§þ`lû£9™B endobj -1138 0 obj << +1143 0 obj << /Type /Page -/Contents 1139 0 R -/Resources 1137 0 R +/Contents 1144 0 R +/Resources 1142 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1136 0 R +/Parent 1134 0 R >> endobj -1140 0 obj << -/D [1138 0 R /XYZ 56.6929 794.5015 null] +1145 0 obj << +/D [1143 0 R /XYZ 85.0394 794.5015 null] >> endobj -1141 0 obj << -/D [1138 0 R /XYZ 56.6929 726.9349 null] +1146 0 obj << +/D [1143 0 R /XYZ 85.0394 697.047 null] >> endobj -1142 0 obj << -/D [1138 0 R /XYZ 56.6929 714.9798 null] +1147 0 obj << +/D [1143 0 R /XYZ 85.0394 685.0919 null] >> endobj -1143 0 obj << -/D [1138 0 R /XYZ 56.6929 546.8104 null] +1148 0 obj << +/D [1143 0 R /XYZ 85.0394 516.9225 null] >> endobj -1144 0 obj << -/D [1138 0 R /XYZ 56.6929 534.8553 null] +1149 0 obj << +/D [1143 0 R /XYZ 85.0394 504.9673 null] >> endobj 482 0 obj << -/D [1138 0 R /XYZ 56.6929 435.1867 null] +/D [1143 0 R /XYZ 85.0394 405.2988 null] >> endobj -1145 0 obj << -/D [1138 0 R /XYZ 56.6929 410.8471 null] +1150 0 obj << +/D [1143 0 R /XYZ 85.0394 380.9592 null] >> endobj -1146 0 obj << -/D [1138 0 R /XYZ 56.6929 210.9925 null] +1151 0 obj << +/D [1143 0 R /XYZ 85.0394 181.1046 null] >> endobj -1147 0 obj << -/D [1138 0 R /XYZ 56.6929 199.0374 null] +1152 0 obj << +/D [1143 0 R /XYZ 85.0394 169.1494 null] >> endobj -1137 0 obj << +1142 0 obj << /Font << /F62 638 0 R /F43 604 0 R /F57 628 0 R /F42 601 0 R /F56 622 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1150 0 obj << -/Length 2704 +1155 0 obj << +/Length 2777 /Filter /FlateDecode >> stream -xÚÍY_sÛ6÷§ÐÃ=P3! - ö-íœ:SÔ¹›æò@‹°ÅŠTD*Núéo P¤LÅé%7½ñŒ - `±~ ˆ‡?1ÓŠq™Å³4‹™âBÍÖÛ >{€¾×Âñ„ž) rý´ºøá:‰fË’(™î²4ãZ‹Ùªx¼úûË7««å<Œ6UƒŸ7—DÉèóêöæzñú·åËy«Åí
‘—W×WË«›WWóPÈXE @:¿ßÞ\Óõâ—«ùûÕÏW«~ÉÃm .q½ .Þ½ç³v÷óg2Ójö?8YͶ±’LÅRzJuñöâ ½ÀA¯ :¥&%5S:J'ôG3!X¦T4R”ÊX"#i…[“°OÎyðÖt]Y?ÐþV«_ZÜ H‘móYÅ,‹El‡¯6Ù“ +·&ìš°*?:Jsß4è<ËrIßs ™ª eK\9ý”QxWv®«î̃ÙÓý\èÀìèÓèòjp¨Ë® ÎœY7uѾÀ_:ÈëÑ”I°Û—Û|_VŸ€D†q‹½Ö`‹wØŸH·‚¶©>š}K¤Ç©©›tlë|m7 Íå²³‘±vjh•…i×ûòÎ8I›æ‘Uc -9…ô=qP›‡¼sÎLÆæìÀ1#¦ÕÆOëì!7UK}hÒhp‰"k9•3s¥‚fÜS³5{ç[àeUÙ{4ë&lëMX4Ûœö¢`ƒŠßüëòö×—‹h ¢:oÝ5ukÚ)ÿ§ÕnÉØ>76åü½+lóOåöà¸1ØyÙSc¨.>Twªå¤¸ä¾õ&®¸Ü࢟˜¹âšE $º¡A|›‘¡9KÈÁ%˾˜Ÿžˆô#ÎÛ-ph¨çìVf,Ž4)÷o6\ÀOIz–‘v4¥™è פVìÌ;úvÄ
¹¥Ù%x9G°Eq„ºQáÃX9¾@öƒÔ˜´u³ž7ãÂÜ燪; ~½Q0gð–‹<– @7ŠyíάK\æúDPkº/Æ@ãßvŠ§†OÃP˜Ašˆç C(¦DJÍ+Ëb0JS\GA3RÔ)—¡±ÉÛA+§é·ô¥ )‡¨} Œð£¬O8—K„
Ä¡Mégv! ç>F»óÆA9 ¶áƒ ?;> vÜíÅŸ^}£ü‚ µû½Œàˆ5ÿŠ´*2Át -èÎñt zŸ€_Ɉu€_•F,β3v汯R -'´¥{ˆÐ“º ŸQ¦¶ì½aiQ± - 4ñUu „,ë#„´
3¿"r,ùÞuÝcÕ -€ÆqaOoé)¥C]I/Õ„ûà[ Zç§ÚÚZŽ4ЉÑÒwo°¢ø8‡úâDf?¶*[z€vã6ÿPÖOÂ^œ¥,‘‰œ
ÝéÛ<cÊ’ìÏ„½/Ç¡ÓÇ,ÑqòÌ ’€ÔÛÇÂP¹Âðöx¿ñ{‘]V®uYîé:ïÜËR ÜUƒ›W¡¾Uï©íD„@´µ' -ÔG‹¨4 yÙ• ²c)€x±¶çd{ièòú—ŠZô6¤µgÀÔ îZóáàŸ, ëÎØÇ h™O€ùé¹kÐnpU6Ùã°~ #mô[°w<©îÇ÷Åë*o[_Vf‡sÖþæ.Çù}ú¦2=ýöÐ:awfüŠÓ¯»Íý=·]Ëñ†\C
/S»Éiá—ÃËÛ~UëêP˜þÊax%˜:ÞbMDÓ‘`4 Áß‹ Q -JÓ'JKF— ¡•žNž +xÚÍZKsÛ8¾ûWð°ª*Bð Hpn™ØÎj*±³Š¦vj29Ð"l±–"‘Š“ýõÛ@$QNf“ÙJU5€Ðϯ³ˆÂ?É”¤9Ï£,Oˆ¤LFËõ ïÕsc¦~Ð4 õóââùuÊ£œä)O£Å}ÀKª‹åû8%‚L€¿½¹šL¹¤ñõì5´˜H$_þýÅÛÅÕ ;R7ôçÙÍ%Rrü¼¼½¹ž½úuþb’%ñbv{ƒäùÕõÕüêæåÕäÃâ—‹«Å°åðXŒ +³ßï?Ш„ÓýrA‰È•Œ á%,Ïy´¾H¤ 2ÂSê‹wÿ½vꨘ%\€HN唈19Éœ¤‚ +§7EUá8K]WŸôö‹ùÅâǪvô;ߢïõzÓëö9üók™K0ÉàÜi3Ì×ÀœèÏÅzSk²l×8ã`SyF”¤©›P4åלÐ,
xò¯0ÑÅwSþ ’V;EãØn'LÁ¡·ÐËžšòËGS‘1¢R"eŒäRr˧ºGõ7ºêWz‹?ZGìWm§±Ùí–KËgø+«6*¶4'R°<Û]±ü×nCÚíØÔ8a2‘n¼Óp¿s;tEÜd
¹¦<e$U ¦©„Â—à ”Òøîûªy@n‹Åënd%$OXb§/Vvñ4žöíÔ )(£ däó9~ÿ ”ëºÄ U‡£ +ü)øô®ê]WÓë”x[Åé
~:Ý IÚQÈ`×T}®œÆ^¶MÙY• žƒ%Óx³ÖŶª¿8FC ‡pgúSávе5èµCÒãJ7Ø‚CºaËbi Íù¼ƒ#åÄ$*6JÝ-·ÕvœVí#6êÖ* +×p½ý—Ý~àx<c‹ÃnàÇr·ÅŸM_;°Â¶-Ô E ñ¿ÛÆÍ2fÎ~ m4Fó(MCdßnE.HF³£pûßÍòû +úƒð= „º‡¢w~ŒvæLÀÚ/ÁA‹•ŸNÖ[ý¶u‡}Æš¥ÝèÀŸœ…K·> JpÕs+pL ÚäàLÐlÚ)„ØÕ´l!R6H31þæ·ËÛ7/f7&¢#Õ9ê¦m:Ýyô=îvvö¥Ý‘1ϼ`]|®Ö;7ÚÄ9ï [Ÿö⢡¸¨-~À··nIÅÊlúÄ“ tÎrÖð}öe,YPÆ°~ +£œ°ô3Ι¬ÌÒÁ ÎÚ¬„/€Ì³Q"áJ Œ$a¤ žA@Bý-Q¤¦³èñÛãhH)í)&îX‚çƒáô0|`·v"˜ íê,Ú¹UÏ›p©ï‹]Ý Å¼Á ô>óÏ Ø|ðÐîúƒP×mô²2Û\ 1êtÞ(ByŸ +"ù‘V!ù`hç"U`9º›—”Å Sže"¾W2Mb'—. BcUXƒV žùÝᣗ`{ áGÕ œÏ-$„ +>à}å9AÉ<”—@u»ó¥¼Bã5¿½kïlc©±ûФq䣿NJÑH ª5\¸DnkPåýóÎj±ö‰†)¨±(J¬ÖcHñ‚µ©Ý< 4Ž<‰öŽ(÷f
»d¿Þªp#×û2ÝŽG«€=ø‘æ<Æ´D_[<f +êJõÛŽ@W endobj -1149 0 obj << +1154 0 obj << /Type /Page -/Contents 1150 0 R -/Resources 1148 0 R +/Contents 1155 0 R +/Resources 1153 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1136 0 R +/Parent 1134 0 R >> endobj -1151 0 obj << -/D [1149 0 R /XYZ 85.0394 794.5015 null] +1156 0 obj << +/D [1154 0 R /XYZ 56.6929 794.5015 null] >> endobj 486 0 obj << -/D [1149 0 R /XYZ 85.0394 769.5949 null] +/D [1154 0 R /XYZ 56.6929 729.6823 null] >> endobj -1152 0 obj << -/D [1149 0 R /XYZ 85.0394 749.4437 null] +1157 0 obj << +/D [1154 0 R /XYZ 56.6929 702.3779 null] >> endobj -1153 0 obj << -/D [1149 0 R /XYZ 85.0394 707.9711 null] +1158 0 obj << +/D [1154 0 R /XYZ 56.6929 660.9053 null] >> endobj -1154 0 obj << -/D [1149 0 R /XYZ 85.0394 696.016 null] +1159 0 obj << +/D [1154 0 R /XYZ 56.6929 648.9502 null] >> endobj 490 0 obj << -/D [1149 0 R /XYZ 85.0394 527.3014 null] +/D [1154 0 R /XYZ 56.6929 480.2356 null] >> endobj -1155 0 obj << -/D [1149 0 R /XYZ 85.0394 497.312 null] +1160 0 obj << +/D [1154 0 R /XYZ 56.6929 450.2461 null] >> endobj -1156 0 obj << -/D [1149 0 R /XYZ 85.0394 408.0188 null] +1161 0 obj << +/D [1154 0 R /XYZ 56.6929 360.9529 null] >> endobj -1157 0 obj << -/D [1149 0 R /XYZ 85.0394 396.0636 null] +1162 0 obj << +/D [1154 0 R /XYZ 56.6929 348.9978 null] >> endobj 494 0 obj << -/D [1149 0 R /XYZ 85.0394 202.1472 null] ->> endobj -1158 0 obj << -/D [1149 0 R /XYZ 85.0394 177.8748 null] +/D [1154 0 R /XYZ 56.6929 144.8272 null] >> endobj -498 0 obj << -/D [1149 0 R /XYZ 85.0394 109.157 null] ->> endobj -1159 0 obj << -/D [1149 0 R /XYZ 85.0394 83.1291 null] +1163 0 obj << +/D [1154 0 R /XYZ 56.6929 118.1807 null] >> endobj -1148 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F57 628 0 R /F56 622 0 R /F84 802 0 R /F86 982 0 R /F77 707 0 R >> +1153 0 obj << +/Font << /F62 638 0 R /F43 604 0 R /F57 628 0 R /F42 601 0 R /F56 622 0 R /F84 802 0 R /F86 986 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1162 0 obj << -/Length 2290 +1166 0 obj << +/Length 2294 /Filter /FlateDecode >> stream -xÚµYÝoÛ8Ï_á‡<ÈÀš¿ô±X àMÜž‰Ós¼ÛÅuû Øt,À¶ Knšýëo†CÊR¬¦)z‹å˜
g†3?Î0¼Â?ÞÓ‹R‘öâT1 rÝ›oÎÂÞ=¬½;ãŽgà™M®_ggoÞF¢—²4Qo¶lÈJX˜$¼7[| "&Y $„Áo&£þ@è0x;¾ŠK¥EpñïáûÙhJ ‘cýu<¹¤™”†‹›ÉÛñ»ß§Ã~¬‚ÙøfBÓÓÑÛÑt4¹õ?Í~;Íj•›fñP¢¾g ?…½X÷ÛYÈdšèÞ#üOSÑÛœ)-™VRú™õÙíÙjUûi§›xÈ„—œúIuúI§,’BZ?ßLÇïÆ4Øeƒ]ÅL -à ÈWšªDãyP ‹b“å[¤E°Í6Æ/gQùzMÔ!®l·3Û…Y8΂ÆlûDÄaûpÈÖù_a(ˆGû>O3/ì¸(áœ$—Á‡•qûfôåßÅÖmŸ;-QȾ¬Ð®ÞÀ›2àœ¥Z k‰Îp#®kŒ` -¸é’ÆÌ.Ë ßìÖù<¯œ¿šîå\3'©sX˱œ7 ‚;¾_ˆCÇ
Ž˜Å*ñžGÛÖ¿§¢ : ê¥ãüW‡V-Q¬ã˜5S:õÊÌVÎîùaOnØv™ªKâZê !d-ulµ+A€þ.j¿“‡]TÙs“ðH·®Ü™y#HB:;QÆ©²QÊxœFßV‚„ ¯mfÍ¿?lдËÒþwIã¶pÙ]Y¬•a ' -DL¥< -P*Òª¥Í -ÃÀ|É º ›+4iÙýáÃÿ8/&ÃkD²èëáx2¸ Mÿ -U.XšÂytª -
T6 §¤%Êf¢ ñ`6ØLÀY X®Ê œ(WÅa½ N,ÐqnoʪØ7›-+ -Êk‘¤I¯™«?–þ4:…ùÁ±éý1pj"Š†Ž)ä/wÈ2Å £Fu*OªÓÙìêÿ^™Ö7 -?ýÀʼnª›µ…Yf‡u5¨ªuÇÎ ŒRüµ…éwV’ð!\l¡lßÒ·¶ÄH}Õ -Ãów£Éh:D—ÎFÿ\F´v9
æê÷Pú+¾q6ëUÙUo –„âµÉÑa<f©É÷¶lë¬ìÒH¤ š¢´™fÏ{RP9ñ:WO;gà¾Ó@ç
ùÿ¤ÿ³ƒ‚®*…B,}קÖÆ'Áb Éf€ m¢la-¢`îŠØÊÐ|FCiö¹q ÙD…‘8Ëâ` [Bƒ€Sœ@éÔûàÇÛõQ hAeic ~/©#Û“ÍWî ª3¼sŸÚçAsHœ ®~|.îÊý·º…$ßt•b<âþ渙Œ"ª¢Øù gÐg8š *¤'¢ïÍur¼6kqšÞs‘²E ,ø iòáÑÚ'HÞí -l¢¬Äà o„j~ mVéŠ)oHËú…Y›û +•äÊù>¿{äxì@è“iM¯°èðòrʆÓ÷èÌ¡—ç7`/½ru¼ÈA³å„`
¹ÃΧ9w‚3÷Æ arK#=Ž×¯cmQ¼[1‘ç'/nç,|éÍOÿÀ› y pê‚.£øWŒ/Èa]‚Ä‹‚øK‚ž!¾ož ¹\¼R¨xPÒ”±nDüZ çWöëjçáÊÄ¿uü‘(¬‹ þ“T£˜Ž™LÑìÎ÷Yœ0¨ˆ¤W -ÃÍýß®NUÿ Ë9Ë<endstream +xÚ½Y_oÛ8ϧðC d`Íò¯$.d§çEâtïöpÝ>(6°%Ç’›æ>ý
9¤,Åjš^¯‹å˜
g†3?Î0l@á ¤ŠP¡å Ñ’(ÊÔ`¾>¢ƒ;X{{Ä<Ï(0Ú\¿ÎŽÞœÇ| ‰Žy<˜-[²RBÓ”
f‹Ñé?OÞÍÆ×ÃW4ŠÉp¤bý:™žáŒÆáôjz>yûÇõÉ0‘Ñlr5Åéëñùøz<= GLHÅA€ð"þ}5 #Óùäb<ü8ûíh<kTn›Å¨°ú> }øH °î·#J„NÕà~P´æƒõ‘T‚()D˜Y Ý ýÞlºOûܤDJTÊ“ ?É^?)MbÁ…ó“µL†RJ£Ù½A㎯®'o'Þ gùÖÌëü“±æ‚PÑJÀBD‚^¿y*êìóÏž¯½¹PD±X¿å â _’´ø¤$)g±ç[”ë,/FE¶îÛ;N —’yÞ=Ò,Qža^®×¦¨{IFR)‚ =ê˜$‘ÖÉ våŠ ÚÑ™ÁeâEV¦®¬/YT£‡™7ÍÒ<röùå¬Fê1_º5È•m6¦X˜…ç,qÌŠ'$vÅÃ.[åQÊ‘‡GÛ!K#3/ݸ¨ „Ñû{ã÷ÍðËÿ”…ß>÷ZZ!Ûʹj0 +¦Œ#ZyËQtf7b2r†ÀÖá‚Ÿ®pÌܲˆòõf•ÏóºÇÁŒÙ(Ju_€0Övl JðpV¿ ‡j z•Ï[ÛZñÓ¹˜!<ç?z´êˆ"=ǬˆT:(ƒÙöÎw[tCÑgªâ$M©/„³Ô³5®ÜõwÙø =ì£Ê› €Åª{pÕÆÌ[ABñì`´2•5a‰Ž¿®, ãAÛÌ™·sù†»,ý~W8¥ŸÈn«rµ«
é9Q0 &R³´?ûF1@—ùœAtYîDXdjÛýþý{ r§Ó“K‹ì)З'“éèf|ý'\½àÖÞ/èl vù§lÕاp¨ó³oa{2þ×É廋19½º$¨´W%îjÒe<<-$¡àtáü +оF +y>™çr ÙËIÑ!Ê„É'œ½Ïü~›mÉÁ§=x3’4ÉßÅ›nN +îÊënDµé>óμ5Æ_ˆ¡Ä!_ªòebQŠÕ×”ùŒ•ì/ó¡¾ä<Ö_–…ßQåÉðEWÔ¾k)T„ÂéÄ 1 ’„A·$cËÆ° hŠ¡¶¶ÑI‰‚Ð{÷ +®+Íà ô? S2PÍYkgÍàa`qSkL-ÚÙº÷›x3Y³ÁY
ZFÁ£¶dgT*Û‰ÄBm"I™"µ‡èóÓ!T±:‚–L•ÒæT¸„錔A ›.ì¬X¦"L ;QÝ—»Õ9m…n綦ªËñ³Ù²v ™GÃ4n‡·à$Vû¬‡û?n~¡àïØ ¥ +@ð<õÕŒunÝÓ4ZnË5R.˜,aƒé'$3Ïde™¬ÞmÍöô‹ë`´v @‰Ô ôâ±´“õûòßfˆ‚Œöo߇N]H‘qÌ_~`RA¢Û â :Í.~Xeje Ö~ î ++ì{EoïÓi›£îx š=«“Ú&µ_Ìh lá´ß³uUŽ‚¼´Ô4MuÙ±ëýËâeV9ØwO„y(/ÆŸkST +Xòóäììšœ\¿³Î< òÂäë\9èõ¡˜à¤%÷¤÷eΟàÌ?„±÷p˜ÞàˆocÇÍãØ«DAC€äñÁƒÛ1¡?öÉÏ: Ï=V±úAü ‚0ZØK‚Z®A¾/ __' ×ý#UÏ_§hs~÷ßÂöe¨}ISÞnlÛL½u”²†'ì¹æÍ ÍUÿ/Ø
ìendstream endobj -1161 0 obj << +1165 0 obj << /Type /Page -/Contents 1162 0 R -/Resources 1160 0 R +/Contents 1166 0 R +/Resources 1164 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1136 0 R +/Parent 1134 0 R >> endobj -1163 0 obj << -/D [1161 0 R /XYZ 56.6929 794.5015 null] +1167 0 obj << +/D [1165 0 R /XYZ 85.0394 794.5015 null] +>> endobj +498 0 obj << +/D [1165 0 R /XYZ 85.0394 769.5949 null] +>> endobj +1168 0 obj << +/D [1165 0 R /XYZ 85.0394 751.3508 null] >> endobj 502 0 obj << -/D [1161 0 R /XYZ 56.6929 653.8847 null] +/D [1165 0 R /XYZ 85.0394 609.4345 null] >> endobj -1167 0 obj << -/D [1161 0 R /XYZ 56.6929 627.8019 null] +1172 0 obj << +/D [1165 0 R /XYZ 85.0394 583.1171 null] >> endobj 506 0 obj << -/D [1161 0 R /XYZ 56.6929 405.3123 null] +/D [1165 0 R /XYZ 85.0394 359.6137 null] >> endobj -1168 0 obj << -/D [1161 0 R /XYZ 56.6929 382.8411 null] +1173 0 obj << +/D [1165 0 R /XYZ 85.0394 336.9079 null] >> endobj 510 0 obj << -/D [1161 0 R /XYZ 56.6929 301.1931 null] +/D [1165 0 R /XYZ 85.0394 254.4059 null] >> endobj -1169 0 obj << -/D [1161 0 R /XYZ 56.6929 273.8371 null] +1174 0 obj << +/D [1165 0 R /XYZ 85.0394 226.8153 null] >> endobj -1160 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F11 1166 0 R /F57 628 0 R /F77 707 0 R /F84 802 0 R /F86 982 0 R >> +1164 0 obj << +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F77 707 0 R /F11 1171 0 R /F57 628 0 R /F84 802 0 R /F86 986 0 R >> /XObject << /Im1 795 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1172 0 obj << -/Length 2368 +1177 0 obj << +/Length 2424 /Filter /FlateDecode >> stream -xÚåY_sÛ8ϧðC ”[Ë¿¢toÙ®ÓËN7ÝK½3;×íƒlɱædÉ'ÉMÓO -m~?Šª#²½óƒ›†‰Ûr Cß[f= ”’ƒèPæëÎ1nÀ ]pÀµ·Û<+ T•nAÒýÌ«<‚l’#•;P›g¼R#m¤8Å<6Óv,‰P¿ ó8RÂ:×/áû`ôSk¹S4ÏÇ#œñOûØvÿUž!‚ëKn“)À®ŸÓí®Ì§#REI(5Óßmc3Á¦ršE -sý‘ -¬‘¿¯,î«â e>Ú†@l‹*+<fátbxø íg{ÀC7RSÚ¦¤ ¯¨±as¨ -mÏW“Ã"í+¿C9ù\\hÁB- `:_Lj…e‡Ž©ÚèÊ‹É÷;ˆ}6 ØRÏ[p¶ ¡ÂQø/X–T˜9ZÂøIňWPû['br* kû•2¿Õ± -™N|xq‰ñ©902ÞYÆÍ€ùŸêsHº3ÒTac !†"¾ß´GvΛ7ܤòܦðg0>ÀÎ÷º1ù ®bi©|é¾DƒæxÄäY+¹ÐÂÃFºùv̦LÃo˜ãøS˜Knüµ »›- ܦ Ög8蘉à ^Ž@» +xÚÝYKsÛ8¾ûWè]%að$ȹi9ë©Œ“µµUS›É)‹µ©%©8ίŸ (‰–=ëlmÕÚ@`£Ñè¾ØˆÂ?©„1G:–DQ¦FËÍ Ý÷÷ÌÑL<ѤOõËü⧫b‡< ÍW=^¡QÄFóôsA.
þùñfv9áŠW× Ç„T<xû·é§ùì?„Žô—ë›w8cóöãÍÕõûÜN/µ æ× opøvv5»Ý¼]~™ÿz1›w"÷·Å¨0òþûâó:Jaw¿^P"âH à%,Žùhs!• J +áGŠ‹»‹¿w {_íÔA51J¸ +V’L°—è\Ä‚hªtþŸÍòrÀ^…"Q¨ÔÓà< +¼\×Ï8d5ñ{š„ZùuØTö TGz¤© TJeu\'å}ft´¢G«%ÚZªù:oÀ•Ã(X&%v¶Ui;:¨V8Ð>TØYUõ¦ùùr"d4mR·“¦¶nVí~ü§¦Í¶`YŠàÚ³Z»Eþ ”×M;ä$f ŠãÀŠí®ÉÒ10bÌ00âÆf¡l{HÖd-vÚ +[«KÓ¢À»#Ci„t Ý€cR¦þ³g½Ù5Žç";”“̶jò6ÿš8¥Ô yëQ߀¯ó ã}ÒHj"4—g7å)GS4"Lƒ Î9Z\˜ŽíÖ‹uóB/ŒiÖ,ë|‘5q¼z(³ÇÊdãWGTõ%‹‚¬©v¶³Ìð3Ž.+Û¦n!c{Ó. Ñ©’6KSÒ´|4) Œž—÷…œƒÓÔE±ÛÒ›¡MªÈüAM«¢HjÏ÷¾„1füžÍãfQ
~zÈÛu^â³×Óµ™$ ©ç=¬sBÞãÊÑ4yš!û·Žü±¿-’e–âçÅ£ÕÇ„385ytèبzˆÜ¼Íê¤5Ñm~}MŠ]f²µŒƒùẽ +ÇïMè™N‚Í7¹Ä¶ãVíÚíÎF Ì}¬v8ZfF&Kèø·$Ûl?ùT3Gf 2KD`ã©egì yle„f‘,ÿÕI³Æ©Lö§2Áлq9À ü<bž¹Ùh$#÷d€‰f<:bÆ™É3 v°šÁ*RCp
éÎ͘Òs¼¬Z<Á&yDmTÛ6¯Ê¤(Üo?ЮÀ•«k ¾÷“Nb)Ù¡6Uš›ÄžÕ
*äa/צ A»¶ç’ Fw6 ƒW®lâ6¿WÖK«
NéÈ: fT…=?²"uËäi»Æ®Éáyz‘4Æm…àÁo}!¹Ò½0 yÙ¢ éΊ6›†Î‡Û2Aß[f5œ ¤½äPd«Ö1®!]n0ko6YšC¦*Ü‚¨û‰WyÐÀÇÊSë'¢D +pò¹D$÷‰H3,{D¤žJΚhÅÂóØN€–^:‹¦AeÕ"ãdÑTÅ®5Á,™?1 òCÖÄÈE—Ò?Þ^¿¿¾ÚS«w
02µxGx„°|‰1®†ÛÖ¦èt?À¯0S«`Ym¶I›/ò"o-‘ ãÇ,©‹Üz …³ÀJ3”Ô™†8‹c¯±7Cg Ä”f= +M››2Ñð÷…Å}™Gä£l +4m^¦¹÷Y8¨9üö³„=˜CÙl:Á¦° +yŽ{³.dþÂíf<i6¨6”Žž9N)T3¡Â÷œpä$¤µ½Sûh‰@¡=ôÓC*iµI|( b³—©×G±ŽÖ®–YÓø +M ¹Ø›Y ¼Û '¤ŠCw·ž
çF@} ²?»™ÝÚ:z>ªq¡TøLšæîü0/‡wî± Í¾µYi@øQÄY e]$©]¯Z NŠ!ïf}Ç7'…w…ë›?AD Áý2ƒµ5‰¬Ä{y"ï¿Ys$ˆË:ÇhÛ]wâ¯ùüÃÑ>Þ~˜ÞÝíEÊŠôÔ÷f!ævàe–ŽžÍ/}Þ¿…KmÞ#ø°«t.å„2ZÒüDrÿ`|*úŸ¡V‡ºendstream endobj -1171 0 obj << +1176 0 obj << /Type /Page -/Contents 1172 0 R -/Resources 1170 0 R +/Contents 1177 0 R +/Resources 1175 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1136 0 R ->> endobj -1173 0 obj << -/D [1171 0 R /XYZ 85.0394 794.5015 null] ->> endobj -1174 0 obj << -/D [1171 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1175 0 obj << -/D [1171 0 R /XYZ 85.0394 769.5949 null] ->> endobj -1170 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F14 612 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 1134 0 R >> endobj 1178 0 obj << -/Length 69 -/Filter /FlateDecode ->> -stream -xÚ3T0 -endobj -1177 0 obj << -/Type /Page -/Contents 1178 0 R -/Resources 1176 0 R -/MediaBox [0 0 595.2756 841.8898] -/Parent 1136 0 R +/D [1176 0 R /XYZ 56.6929 794.5015 null] >> endobj 1179 0 obj << -/D [1177 0 R /XYZ 56.6929 794.5015 null] +/D [1176 0 R /XYZ 56.6929 723.7668 null] >> endobj -1176 0 obj << -/ProcSet [ /PDF ] +1180 0 obj << +/D [1176 0 R /XYZ 56.6929 711.8116 null] >> endobj -1182 0 obj << +1175 0 obj << +/Font << /F62 638 0 R /F57 628 0 R /F42 601 0 R /F43 604 0 R /F14 612 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1183 0 obj << /Length 1550 /Filter /FlateDecode >> @@ -4579,46 +4599,46 @@ stream xÚ•ÛnÛ6ôÝ_!äÉ*Z¤îí0 MÛ-]1lMúÔöA–i[ˆ,ºº$͆ýûÎá!eÙR/Aè<<÷Í þ¸“„ÌóÓÀ‰Ó€… |?óœ-œý6ã'}¾‹‰S7ô&"vÜ!‘—·³å›@8ÂcQ$BçvÓóŠâ…©pn× çW»ìÐÊzáŠÐ›Ç‹Ï·oéVÀâ$æxË)ã¾ ë /¯ÿ|EØ)}ndÞÕEûH«+U5ÅZÖY[ ¡ Ï>y¡wyõ®/†[Ñ<Ó¸’γõš–D,˜ï³6ßÑYy$Óî²–Î UG[yVÐHsÔ ÍjM@UäwU¶7¬6ª&¼M×vCºÆ endobj -1181 0 obj << +1182 0 obj << /Type /Page -/Contents 1182 0 R -/Resources 1180 0 R +/Contents 1183 0 R +/Resources 1181 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1188 0 R -/Annots [ 1186 0 R 1187 0 R ] +/Parent 1189 0 R +/Annots [ 1187 0 R 1188 0 R ] >> endobj -1186 0 obj << +1187 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [513.6761 73.4705 539.579 85.5301] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos)>> >> endobj -1187 0 obj << +1188 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [84.0431 62.7606 448.7754 72.9224] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos)>> >> endobj -1183 0 obj << -/D [1181 0 R /XYZ 85.0394 794.5015 null] +1184 0 obj << +/D [1182 0 R /XYZ 85.0394 794.5015 null] >> endobj 514 0 obj << -/D [1181 0 R /XYZ 85.0394 769.5949 null] +/D [1182 0 R /XYZ 85.0394 769.5949 null] >> endobj -1184 0 obj << -/D [1181 0 R /XYZ 85.0394 570.0146 null] +1185 0 obj << +/D [1182 0 R /XYZ 85.0394 570.0146 null] >> endobj 518 0 obj << -/D [1181 0 R /XYZ 85.0394 570.0146 null] +/D [1182 0 R /XYZ 85.0394 570.0146 null] >> endobj -1185 0 obj << -/D [1181 0 R /XYZ 85.0394 536.782 null] +1186 0 obj << +/D [1182 0 R /XYZ 85.0394 536.782 null] >> endobj -1180 0 obj << -/Font << /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F11 1166 0 R >> +1181 0 obj << +/Font << /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F11 1171 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1191 0 obj << +1192 0 obj << /Length 3207 /Filter /FlateDecode >> @@ -4636,45 +4656,45 @@ b¯ö¦êh
ÔEßÕ–7¶3,gl"ˆýT
‘[ã—¯èJ¦~³?÷UÞue™í¢ë~´XÊ,óUªÅR?‹"ºÉö`òâùd÷$¥´{ oNIÛŒ\q¾ÀÐ Ñòòg¬Û2l]®1J3·)ǘ–
xW‚Á‹ûB¸"l°I„Q3 [e~K×!5-uYä§ùŠ1Jd|©-ë<X›¡]¼q-~€R1þÓ®ÉS½·¬`©EG'Žæ×-“És"P¯9E“ÿq -’¯vCï?>1‡î4(G ¿¶ýªaMÔØýð @² ’â!¿0ÿr.Z°™2šÏì{˜Ý(xÃ<í““pnN„Jî–† ¯$öàËÒÀ%ž¿¥Q^W ¬G±ß]¢è3>-®ÝSý‘^—®ckhò:1Ê¡£wqÀC¿. ¸=šõÅ/åpüròƒ¸³3÷³R5ü¸Ž.È¿2Žs?ÌúÌë¿öWPÝãŸÌüM@0ôþï¿@8ÿ™ˆœŸ¦áù ¦…tê«„ð¦l] ®vîþTázëÿ2}endstream endobj -1190 0 obj << +1191 0 obj << /Type /Page -/Contents 1191 0 R -/Resources 1189 0 R +/Contents 1192 0 R +/Resources 1190 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1188 0 R +/Parent 1189 0 R >> endobj -1192 0 obj << -/D [1190 0 R /XYZ 56.6929 794.5015 null] +1193 0 obj << +/D [1191 0 R /XYZ 56.6929 794.5015 null] >> endobj 522 0 obj << -/D [1190 0 R /XYZ 56.6929 769.5949 null] +/D [1191 0 R /XYZ 56.6929 769.5949 null] >> endobj -1196 0 obj << -/D [1190 0 R /XYZ 56.6929 747.0488 null] +1197 0 obj << +/D [1191 0 R /XYZ 56.6929 747.0488 null] >> endobj 526 0 obj << -/D [1190 0 R /XYZ 56.6929 613.0366 null] +/D [1191 0 R /XYZ 56.6929 613.0366 null] >> endobj -1197 0 obj << -/D [1190 0 R /XYZ 56.6929 586.6546 null] +1198 0 obj << +/D [1191 0 R /XYZ 56.6929 586.6546 null] >> endobj 530 0 obj << -/D [1190 0 R /XYZ 56.6929 473.2336 null] +/D [1191 0 R /XYZ 56.6929 473.2336 null] >> endobj -1198 0 obj << -/D [1190 0 R /XYZ 56.6929 445.9291 null] +1199 0 obj << +/D [1191 0 R /XYZ 56.6929 445.9291 null] >> endobj 534 0 obj << -/D [1190 0 R /XYZ 56.6929 376.148 null] +/D [1191 0 R /XYZ 56.6929 376.148 null] >> endobj 974 0 obj << -/D [1190 0 R /XYZ 56.6929 340.4845 null] +/D [1191 0 R /XYZ 56.6929 340.4845 null] >> endobj -1189 0 obj << -/Font << /F62 638 0 R /F90 1195 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F77 707 0 R /F58 631 0 R >> +1190 0 obj << +/Font << /F62 638 0 R /F90 1196 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F57 628 0 R /F77 707 0 R /F58 631 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1201 0 obj << +1202 0 obj << /Length 1962 /Filter /FlateDecode >> @@ -4687,84 +4707,84 @@ i ·¥Ý3ëÈ–yíˆùðŠ&Â8K<æcø¡› ‚hï C‡™=»úÐŒêˆþ~êwPãëP. ÆÊÄùû» pvV {Ê
ní6)ŠPä"½Æö¹ÙqóCu€à°+»"e(sñK{"R¸Ãd D …Eÿú¦Ì3¶Ë)÷»roÙ5Öž¾x|<ŸÏ!ïÊ£/ËGFßã n²pÇ71ÞlÔ¬u ×U>îý·ÂÁèªK§jW\†=¿ï„·Aû×ÄD†ø6¹±WÙ^tèYr\Ca—¹7„¡äòÖÛüÈyïî?lYŽ endobj -1200 0 obj << +1201 0 obj << /Type /Page -/Contents 1201 0 R -/Resources 1199 0 R +/Contents 1202 0 R +/Resources 1200 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1188 0 R -/Annots [ 1208 0 R 1209 0 R ] +/Parent 1189 0 R +/Annots [ 1209 0 R 1210 0 R ] >> endobj -1208 0 obj << +1209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [348.3486 128.9523 463.9152 141.0119] /Subtype/Link/A<</Type/Action/S/URI/URI(mailto:info@isc.org)>> >> endobj -1209 0 obj << +1210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [147.3629 116.9971 364.5484 129.0567] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.isc.org/services/support/)>> >> endobj -1202 0 obj << -/D [1200 0 R /XYZ 85.0394 794.5015 null] +1203 0 obj << +/D [1201 0 R /XYZ 85.0394 794.5015 null] >> endobj 538 0 obj << -/D [1200 0 R /XYZ 85.0394 769.5949 null] +/D [1201 0 R /XYZ 85.0394 769.5949 null] >> endobj -1203 0 obj << -/D [1200 0 R /XYZ 85.0394 576.7004 null] +1204 0 obj << +/D [1201 0 R /XYZ 85.0394 576.7004 null] >> endobj 542 0 obj << -/D [1200 0 R /XYZ 85.0394 576.7004 null] +/D [1201 0 R /XYZ 85.0394 576.7004 null] >> endobj -1204 0 obj << -/D [1200 0 R /XYZ 85.0394 548.3785 null] +1205 0 obj << +/D [1201 0 R /XYZ 85.0394 548.3785 null] >> endobj 546 0 obj << -/D [1200 0 R /XYZ 85.0394 548.3785 null] +/D [1201 0 R /XYZ 85.0394 548.3785 null] >> endobj -1205 0 obj << -/D [1200 0 R /XYZ 85.0394 518.5228 null] +1206 0 obj << +/D [1201 0 R /XYZ 85.0394 518.5228 null] >> endobj 550 0 obj << -/D [1200 0 R /XYZ 85.0394 460.6968 null] +/D [1201 0 R /XYZ 85.0394 460.6968 null] >> endobj -1206 0 obj << -/D [1200 0 R /XYZ 85.0394 425.0333 null] +1207 0 obj << +/D [1201 0 R /XYZ 85.0394 425.0333 null] >> endobj 554 0 obj << -/D [1200 0 R /XYZ 85.0394 260.2468 null] +/D [1201 0 R /XYZ 85.0394 260.2468 null] >> endobj -1207 0 obj << -/D [1200 0 R /XYZ 85.0394 224.698 null] +1208 0 obj << +/D [1201 0 R /XYZ 85.0394 224.698 null] >> endobj -1199 0 obj << -/Font << /F42 601 0 R /F43 604 0 R /F11 1166 0 R /F57 628 0 R >> +1200 0 obj << +/Font << /F42 601 0 R /F43 604 0 R /F11 1171 0 R /F57 628 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1212 0 obj << +1213 0 obj << /Length 69 /Filter /FlateDecode >> stream xÚ3T0 endobj -1211 0 obj << +1212 0 obj << /Type /Page -/Contents 1212 0 R -/Resources 1210 0 R +/Contents 1213 0 R +/Resources 1211 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1188 0 R +/Parent 1189 0 R >> endobj -1213 0 obj << -/D [1211 0 R /XYZ 56.6929 794.5015 null] +1214 0 obj << +/D [1212 0 R /XYZ 56.6929 794.5015 null] >> endobj -1210 0 obj << +1211 0 obj << /ProcSet [ /PDF ] >> endobj -1216 0 obj << +1217 0 obj << /Length 2598 /Filter /FlateDecode >> @@ -4781,39 +4801,39 @@ iÛuK![ÓiB¤ç ‘^&DjQQ›cÏ-+ñs [¨qçdn "€7jæ‚ †² ‹ ~+ø§‰¶×àfÖ.µUm¯r[Ÿ )³ÃXp=ͯØ#›Á,ôÈ<‘ëß½^ÌåbcÓK õ¾%ÕƒßU‰ï«¢P–ëcIk¦È‰ý$ì7;¸È«ê,`-µè½ÑÔ– A´Ä?OÌýq¢YŒ2ô—‰éð»Z&~÷ ¡Uq|¹ÛðwŽ¿o÷_ äÐÿendstream endobj -1215 0 obj << +1216 0 obj << /Type /Page -/Contents 1216 0 R -/Resources 1214 0 R +/Contents 1217 0 R +/Resources 1215 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1188 0 R +/Parent 1189 0 R >> endobj -1217 0 obj << -/D [1215 0 R /XYZ 85.0394 794.5015 null] +1218 0 obj << +/D [1216 0 R /XYZ 85.0394 794.5015 null] >> endobj 558 0 obj << -/D [1215 0 R /XYZ 85.0394 769.5949 null] +/D [1216 0 R /XYZ 85.0394 769.5949 null] >> endobj -1218 0 obj << -/D [1215 0 R /XYZ 85.0394 576.5762 null] +1219 0 obj << +/D [1216 0 R /XYZ 85.0394 576.5762 null] >> endobj 562 0 obj << -/D [1215 0 R /XYZ 85.0394 576.5762 null] +/D [1216 0 R /XYZ 85.0394 576.5762 null] >> endobj -1219 0 obj << -/D [1215 0 R /XYZ 85.0394 544.2616 null] +1220 0 obj << +/D [1216 0 R /XYZ 85.0394 544.2616 null] >> endobj 566 0 obj << -/D [1215 0 R /XYZ 85.0394 544.2616 null] +/D [1216 0 R /XYZ 85.0394 544.2616 null] >> endobj -1220 0 obj << -/D [1215 0 R /XYZ 85.0394 517.7268 null] +1221 0 obj << +/D [1216 0 R /XYZ 85.0394 517.7268 null] >> endobj -1214 0 obj << +1215 0 obj << /Font << /F42 601 0 R /F43 604 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1223 0 obj << +1224 0 obj << /Length 3012 /Filter /FlateDecode >> @@ -4833,45 +4853,45 @@ L9 €®²~Ò˜QÃP<TVþp +i‹ûaÒ¦mYÖÙo-–[½Iÿ ̵6ÐLH±!ƒ+Ñ&À Jø!Š Jæö8™ÿv 8‚6iÆ¡v-lY§;·¾c´^FsKô©×ƒé)@¢Oû”ÿ8=o-ŠnQrš/å)…_ušF”ðã…Ó{-É)]2z$Ë?8ýΤªÃš"psëÌÉß~eá†õšCÊâ7m?QîrPF¨U‡¦È À»šÁm i«>ÐØ£ùs£jÕ¯÷HÞ‘›¼J ]oQeå}EhO§ endobj -1222 0 obj << +1223 0 obj << /Type /Page -/Contents 1223 0 R -/Resources 1221 0 R +/Contents 1224 0 R +/Resources 1222 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1188 0 R +/Parent 1189 0 R >> endobj -1224 0 obj << -/D [1222 0 R /XYZ 56.6929 794.5015 null] +1225 0 obj << +/D [1223 0 R /XYZ 56.6929 794.5015 null] >> endobj 570 0 obj << -/D [1222 0 R /XYZ 56.6929 689.3212 null] +/D [1223 0 R /XYZ 56.6929 689.3212 null] >> endobj -1225 0 obj << -/D [1222 0 R /XYZ 56.6929 654.5655 null] +1226 0 obj << +/D [1223 0 R /XYZ 56.6929 654.5655 null] >> endobj 574 0 obj << -/D [1222 0 R /XYZ 56.6929 654.5655 null] +/D [1223 0 R /XYZ 56.6929 654.5655 null] >> endobj 814 0 obj << -/D [1222 0 R /XYZ 56.6929 626.6465 null] ->> endobj -1226 0 obj << -/D [1222 0 R /XYZ 56.6929 541.3941 null] +/D [1223 0 R /XYZ 56.6929 626.6465 null] >> endobj 1227 0 obj << -/D [1222 0 R /XYZ 56.6929 529.439 null] +/D [1223 0 R /XYZ 56.6929 541.3941 null] >> endobj 1228 0 obj << -/D [1222 0 R /XYZ 56.6929 423.6955 null] +/D [1223 0 R /XYZ 56.6929 529.439 null] >> endobj 1229 0 obj << -/D [1222 0 R /XYZ 56.6929 411.7403 null] +/D [1223 0 R /XYZ 56.6929 423.6955 null] >> endobj -1221 0 obj << -/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F56 622 0 R /F11 1166 0 R >> +1230 0 obj << +/D [1223 0 R /XYZ 56.6929 411.7403 null] +>> endobj +1222 0 obj << +/Font << /F62 638 0 R /F43 604 0 R /F42 601 0 R /F56 622 0 R /F11 1171 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1232 0 obj << +1233 0 obj << /Length 2647 /Filter /FlateDecode >> @@ -4887,178 +4907,178 @@ JAçµ.<š2Š(1:ÑZ Ä ,£yÊ÷ªq•o·"+‹ƒÞ‡ë«ÂZœY ÃÚÔG^ùõê‹X%¿aLWq™äÙdÊ‚h¼ÎW•^QvkE, N«JW†×Ù©fÄ½ì– F¼ a3 CÉþ¼ÛÇ>+yˆ`ê3¿T¿”Š·[™âL§õ´]/ÿ˜We‡<tÞŽ†<€KÄØ;ᖔÌT“_¹ëaÍ©Úò€®î°•CÊ©gE©ìéºó1•¨Ë:¸¬}wÉ‘«|¯<HS9öËâ0)7vo-R½úLìÒüÝ|_£Po!*_õ/¨Ç§˜ÏQÀ|ëIˆGl<×eM3Û é›øEmØÜ×_Vençk6ðQ„ ©ž@ÛÛYX;îR—ÞÔ]ÅýHÛšå¯ÁŠžÃÊz^Mar®ðÌ÷…’QW LØ¿çÃøuòÖÿÈÀDÄ&ÜÌ«ÿS…\äSµM}* ÚG¤V»ÏaåT^éÁ;QÕ\ñ7³n áÖëÅ,ÎþLž»Î\ìŸU5µñ9ƒ "ˆšÎ`
;ƒ:<=…tØ\zÎÐUÜï ¶æTKæ™ï®:0˜ È› endobj -1231 0 obj << +1232 0 obj << /Type /Page -/Contents 1232 0 R -/Resources 1230 0 R +/Contents 1233 0 R +/Resources 1231 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1278 0 R -/Annots [ 1235 0 R 1236 0 R 1237 0 R 1238 0 R ] +/Parent 1279 0 R +/Annots [ 1236 0 R 1237 0 R 1238 0 R 1239 0 R ] >> endobj -1235 0 obj << +1236 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [429.9899 660.9265 539.579 672.9861] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://www.isi.edu/in-notes/)>> >> endobj -1236 0 obj << +1237 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [84.0431 649.6389 140.332 661.031] /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://www.isi.edu/in-notes/)>> >> endobj -1237 0 obj << +1238 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [507.6985 649.6389 539.579 661.031] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.ietf.org/rfc/)>> >> endobj -1238 0 obj << +1239 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [84.0431 638.2615 199.6097 648.4233] /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.ietf.org/rfc/)>> >> endobj -1233 0 obj << -/D [1231 0 R /XYZ 85.0394 794.5015 null] +1234 0 obj << +/D [1232 0 R /XYZ 85.0394 794.5015 null] >> endobj 578 0 obj << -/D [1231 0 R /XYZ 85.0394 769.5949 null] +/D [1232 0 R /XYZ 85.0394 769.5949 null] >> endobj -1234 0 obj << -/D [1231 0 R /XYZ 85.0394 744.2337 null] +1235 0 obj << +/D [1232 0 R /XYZ 85.0394 744.2337 null] >> endobj 582 0 obj << -/D [1231 0 R /XYZ 85.0394 744.2337 null] +/D [1232 0 R /XYZ 85.0394 744.2337 null] >> endobj 648 0 obj << -/D [1231 0 R /XYZ 85.0394 716.4931 null] ->> endobj -1239 0 obj << -/D [1231 0 R /XYZ 85.0394 585.5597 null] +/D [1232 0 R /XYZ 85.0394 716.4931 null] >> endobj 1240 0 obj << -/D [1231 0 R /XYZ 85.0394 585.5597 null] +/D [1232 0 R /XYZ 85.0394 585.5597 null] >> endobj 1241 0 obj << -/D [1231 0 R /XYZ 85.0394 550.7275 null] +/D [1232 0 R /XYZ 85.0394 585.5597 null] >> endobj 1242 0 obj << -/D [1231 0 R /XYZ 85.0394 550.7275 null] +/D [1232 0 R /XYZ 85.0394 550.7275 null] >> endobj 1243 0 obj << -/D [1231 0 R /XYZ 85.0394 550.7275 null] +/D [1232 0 R /XYZ 85.0394 550.7275 null] >> endobj 1244 0 obj << -/D [1231 0 R /XYZ 85.0394 543.9179 null] +/D [1232 0 R /XYZ 85.0394 550.7275 null] >> endobj 1245 0 obj << -/D [1231 0 R /XYZ 85.0394 529.1534 null] +/D [1232 0 R /XYZ 85.0394 543.9179 null] >> endobj 1246 0 obj << -/D [1231 0 R /XYZ 85.0394 524.9381 null] +/D [1232 0 R /XYZ 85.0394 529.1534 null] >> endobj 1247 0 obj << -/D [1231 0 R /XYZ 85.0394 510.1735 null] +/D [1232 0 R /XYZ 85.0394 524.9381 null] >> endobj 1248 0 obj << -/D [1231 0 R /XYZ 85.0394 505.9582 null] +/D [1232 0 R /XYZ 85.0394 510.1735 null] >> endobj 1249 0 obj << -/D [1231 0 R /XYZ 85.0394 444.8058 null] ->> endobj -751 0 obj << -/D [1231 0 R /XYZ 85.0394 444.8058 null] +/D [1232 0 R /XYZ 85.0394 505.9582 null] >> endobj 1250 0 obj << -/D [1231 0 R /XYZ 85.0394 444.8058 null] +/D [1232 0 R /XYZ 85.0394 444.8058 null] +>> endobj +751 0 obj << +/D [1232 0 R /XYZ 85.0394 444.8058 null] >> endobj 1251 0 obj << -/D [1231 0 R /XYZ 85.0394 440.8655 null] +/D [1232 0 R /XYZ 85.0394 444.8058 null] >> endobj 1252 0 obj << -/D [1231 0 R /XYZ 85.0394 426.1009 null] +/D [1232 0 R /XYZ 85.0394 440.8655 null] >> endobj 1253 0 obj << -/D [1231 0 R /XYZ 85.0394 421.8857 null] +/D [1232 0 R /XYZ 85.0394 426.1009 null] >> endobj 1254 0 obj << -/D [1231 0 R /XYZ 85.0394 407.1211 null] +/D [1232 0 R /XYZ 85.0394 421.8857 null] >> endobj 1255 0 obj << -/D [1231 0 R /XYZ 85.0394 402.9058 null] +/D [1232 0 R /XYZ 85.0394 407.1211 null] >> endobj 1256 0 obj << -/D [1231 0 R /XYZ 85.0394 376.1861 null] +/D [1232 0 R /XYZ 85.0394 402.9058 null] >> endobj 1257 0 obj << -/D [1231 0 R /XYZ 85.0394 371.9708 null] +/D [1232 0 R /XYZ 85.0394 376.1861 null] >> endobj 1258 0 obj << -/D [1231 0 R /XYZ 85.0394 357.2062 null] +/D [1232 0 R /XYZ 85.0394 371.9708 null] >> endobj 1259 0 obj << -/D [1231 0 R /XYZ 85.0394 352.9909 null] +/D [1232 0 R /XYZ 85.0394 357.2062 null] >> endobj 1260 0 obj << -/D [1231 0 R /XYZ 85.0394 338.2862 null] +/D [1232 0 R /XYZ 85.0394 352.9909 null] >> endobj 1261 0 obj << -/D [1231 0 R /XYZ 85.0394 334.0111 null] +/D [1232 0 R /XYZ 85.0394 338.2862 null] >> endobj 1262 0 obj << -/D [1231 0 R /XYZ 85.0394 260.9035 null] +/D [1232 0 R /XYZ 85.0394 334.0111 null] >> endobj 1263 0 obj << -/D [1231 0 R /XYZ 85.0394 260.9035 null] +/D [1232 0 R /XYZ 85.0394 260.9035 null] >> endobj 1264 0 obj << -/D [1231 0 R /XYZ 85.0394 260.9035 null] +/D [1232 0 R /XYZ 85.0394 260.9035 null] >> endobj 1265 0 obj << -/D [1231 0 R /XYZ 85.0394 256.9632 null] +/D [1232 0 R /XYZ 85.0394 260.9035 null] >> endobj 1266 0 obj << -/D [1231 0 R /XYZ 85.0394 242.2585 null] +/D [1232 0 R /XYZ 85.0394 256.9632 null] >> endobj 1267 0 obj << -/D [1231 0 R /XYZ 85.0394 237.9833 null] +/D [1232 0 R /XYZ 85.0394 242.2585 null] >> endobj 1268 0 obj << -/D [1231 0 R /XYZ 85.0394 213.9136 null] +/D [1232 0 R /XYZ 85.0394 237.9833 null] >> endobj 1269 0 obj << -/D [1231 0 R /XYZ 85.0394 207.0483 null] +/D [1232 0 R /XYZ 85.0394 213.9136 null] >> endobj 1270 0 obj << -/D [1231 0 R /XYZ 85.0394 145.8959 null] +/D [1232 0 R /XYZ 85.0394 207.0483 null] >> endobj 1271 0 obj << -/D [1231 0 R /XYZ 85.0394 145.8959 null] +/D [1232 0 R /XYZ 85.0394 145.8959 null] >> endobj 1272 0 obj << -/D [1231 0 R /XYZ 85.0394 145.8959 null] +/D [1232 0 R /XYZ 85.0394 145.8959 null] >> endobj 1273 0 obj << -/D [1231 0 R /XYZ 85.0394 141.9556 null] +/D [1232 0 R /XYZ 85.0394 145.8959 null] >> endobj 1274 0 obj << -/D [1231 0 R /XYZ 85.0394 116.5111 null] +/D [1232 0 R /XYZ 85.0394 141.9556 null] >> endobj 1275 0 obj << -/D [1231 0 R /XYZ 85.0394 111.0206 null] +/D [1232 0 R /XYZ 85.0394 116.5111 null] >> endobj 1276 0 obj << -/D [1231 0 R /XYZ 85.0394 84.3008 null] +/D [1232 0 R /XYZ 85.0394 111.0206 null] >> endobj 1277 0 obj << -/D [1231 0 R /XYZ 85.0394 80.0855 null] +/D [1232 0 R /XYZ 85.0394 84.3008 null] >> endobj -1230 0 obj << -/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F77 707 0 R /F11 1166 0 R /F57 628 0 R /F56 622 0 R >> +1278 0 obj << +/D [1232 0 R /XYZ 85.0394 80.0855 null] +>> endobj +1231 0 obj << +/Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F77 707 0 R /F11 1171 0 R /F57 628 0 R /F56 622 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1281 0 obj << +1282 0 obj << /Length 2583 /Filter /FlateDecode >> @@ -5074,183 +5094,183 @@ xÚ¥ZYs£¸~ϯð£]Õá"‰õщ wz²];™¥zúØŠC5àtçþú{„rº¦òúÄùtVƒF.ü¡‘ 8AŒãQ{Žï"´ b<NÛ×$ :øÃ}UðND' Œ.eáAJµu¬ç[x°Ak<ô±Í<èØ*&žì±±Kþ‹\@½Oò÷V€_-Y{Œ¾w¦6v¼( 5 “¦Àžü-£9Ħf+ã`30rŠìE< ¶°ó÷[¨·Ÿß( WáBaöãÅðï!Êy„½a_—²Ð)¥Z:m?bZ¡5:ûØf:u쩪{ÞØ/ 2óº’%Ò‚žééÍÕÊlyÆÈN À}ÔÖ['zìwì€Ýt3»çªÈhÝof=åénŸ5]I™çÍB=’²ùnËåð‡DPvÿÔ‡`å#!¤¥ úm¸Ú'&=`ó&0a8ÐÛéXü$ÿ´Ø–Éþ5]7ªÑ?m0¥õj<?6}–Œ¯^BÓ,3MÂ!+\¿ ²ÿQ1ºòM뜪Ҧ8‰072X7EžÊ/ˆ$~Çž!K!¾Ã¾_3¨ØUî_&§÷ô ºÆS‚¡˜õX^ 6Å^%rv.¿§;ÞúÿçþKkendstream endobj -1280 0 obj << +1281 0 obj << /Type /Page -/Contents 1281 0 R -/Resources 1279 0 R +/Contents 1282 0 R +/Resources 1280 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1278 0 R ->> endobj -1282 0 obj << -/D [1280 0 R /XYZ 56.6929 794.5015 null] +/Parent 1279 0 R >> endobj 1283 0 obj << -/D [1280 0 R /XYZ 56.6929 749.0893 null] +/D [1281 0 R /XYZ 56.6929 794.5015 null] >> endobj 1284 0 obj << -/D [1280 0 R /XYZ 56.6929 749.0893 null] +/D [1281 0 R /XYZ 56.6929 749.0893 null] >> endobj 1285 0 obj << -/D [1280 0 R /XYZ 56.6929 749.0893 null] +/D [1281 0 R /XYZ 56.6929 749.0893 null] >> endobj 1286 0 obj << -/D [1280 0 R /XYZ 56.6929 745.5361 null] +/D [1281 0 R /XYZ 56.6929 749.0893 null] >> endobj 1287 0 obj << -/D [1280 0 R /XYZ 56.6929 721.4664 null] +/D [1281 0 R /XYZ 56.6929 745.5361 null] >> endobj 1288 0 obj << -/D [1280 0 R /XYZ 56.6929 714.8926 null] +/D [1281 0 R /XYZ 56.6929 721.4664 null] >> endobj 1289 0 obj << -/D [1280 0 R /XYZ 56.6929 700.128 null] +/D [1281 0 R /XYZ 56.6929 714.8926 null] >> endobj 1290 0 obj << -/D [1280 0 R /XYZ 56.6929 696.2043 null] +/D [1281 0 R /XYZ 56.6929 700.128 null] >> endobj 1291 0 obj << -/D [1280 0 R /XYZ 56.6929 669.4845 null] +/D [1281 0 R /XYZ 56.6929 696.2043 null] >> endobj 1292 0 obj << -/D [1280 0 R /XYZ 56.6929 665.5608 null] +/D [1281 0 R /XYZ 56.6929 669.4845 null] >> endobj 1293 0 obj << -/D [1280 0 R /XYZ 56.6929 641.4911 null] +/D [1281 0 R /XYZ 56.6929 665.5608 null] >> endobj 1294 0 obj << -/D [1280 0 R /XYZ 56.6929 634.9173 null] +/D [1281 0 R /XYZ 56.6929 641.4911 null] >> endobj 1295 0 obj << -/D [1280 0 R /XYZ 56.6929 608.1975 null] +/D [1281 0 R /XYZ 56.6929 634.9173 null] >> endobj 1296 0 obj << -/D [1280 0 R /XYZ 56.6929 604.2738 null] +/D [1281 0 R /XYZ 56.6929 608.1975 null] >> endobj 1297 0 obj << -/D [1280 0 R /XYZ 56.6929 577.554 null] +/D [1281 0 R /XYZ 56.6929 604.2738 null] >> endobj 1298 0 obj << -/D [1280 0 R /XYZ 56.6929 573.6303 null] +/D [1281 0 R /XYZ 56.6929 577.554 null] >> endobj 1299 0 obj << -/D [1280 0 R /XYZ 56.6929 516.4589 null] +/D [1281 0 R /XYZ 56.6929 573.6303 null] >> endobj 1300 0 obj << -/D [1280 0 R /XYZ 56.6929 516.4589 null] +/D [1281 0 R /XYZ 56.6929 516.4589 null] >> endobj 1301 0 obj << -/D [1280 0 R /XYZ 56.6929 516.4589 null] +/D [1281 0 R /XYZ 56.6929 516.4589 null] >> endobj 1302 0 obj << -/D [1280 0 R /XYZ 56.6929 509.9409 null] +/D [1281 0 R /XYZ 56.6929 516.4589 null] >> endobj 1303 0 obj << -/D [1280 0 R /XYZ 56.6929 495.1763 null] +/D [1281 0 R /XYZ 56.6929 509.9409 null] >> endobj 1304 0 obj << -/D [1280 0 R /XYZ 56.6929 491.2525 null] +/D [1281 0 R /XYZ 56.6929 495.1763 null] >> endobj 1305 0 obj << -/D [1280 0 R /XYZ 56.6929 476.5478 null] +/D [1281 0 R /XYZ 56.6929 491.2525 null] >> endobj 1306 0 obj << -/D [1280 0 R /XYZ 56.6929 472.5642 null] +/D [1281 0 R /XYZ 56.6929 476.5478 null] >> endobj 1307 0 obj << -/D [1280 0 R /XYZ 56.6929 457.8595 null] +/D [1281 0 R /XYZ 56.6929 472.5642 null] >> endobj 1308 0 obj << -/D [1280 0 R /XYZ 56.6929 453.8759 null] +/D [1281 0 R /XYZ 56.6929 457.8595 null] >> endobj 1309 0 obj << -/D [1280 0 R /XYZ 56.6929 393.8353 null] +/D [1281 0 R /XYZ 56.6929 453.8759 null] >> endobj 1310 0 obj << -/D [1280 0 R /XYZ 56.6929 393.8353 null] +/D [1281 0 R /XYZ 56.6929 393.8353 null] >> endobj 1311 0 obj << -/D [1280 0 R /XYZ 56.6929 393.8353 null] +/D [1281 0 R /XYZ 56.6929 393.8353 null] >> endobj 1312 0 obj << -/D [1280 0 R /XYZ 56.6929 390.1865 null] +/D [1281 0 R /XYZ 56.6929 393.8353 null] >> endobj 1313 0 obj << -/D [1280 0 R /XYZ 56.6929 375.4817 null] +/D [1281 0 R /XYZ 56.6929 390.1865 null] >> endobj 1314 0 obj << -/D [1280 0 R /XYZ 56.6929 371.4981 null] +/D [1281 0 R /XYZ 56.6929 375.4817 null] >> endobj 1315 0 obj << -/D [1280 0 R /XYZ 56.6929 356.7336 null] +/D [1281 0 R /XYZ 56.6929 371.4981 null] >> endobj 1316 0 obj << -/D [1280 0 R /XYZ 56.6929 352.8098 null] +/D [1281 0 R /XYZ 56.6929 356.7336 null] >> endobj 1317 0 obj << -/D [1280 0 R /XYZ 56.6929 338.0452 null] +/D [1281 0 R /XYZ 56.6929 352.8098 null] >> endobj 1318 0 obj << -/D [1280 0 R /XYZ 56.6929 334.1215 null] +/D [1281 0 R /XYZ 56.6929 338.0452 null] >> endobj 1319 0 obj << -/D [1280 0 R /XYZ 56.6929 276.9501 null] +/D [1281 0 R /XYZ 56.6929 334.1215 null] >> endobj 1320 0 obj << -/D [1280 0 R /XYZ 56.6929 276.9501 null] +/D [1281 0 R /XYZ 56.6929 276.9501 null] >> endobj 1321 0 obj << -/D [1280 0 R /XYZ 56.6929 276.9501 null] +/D [1281 0 R /XYZ 56.6929 276.9501 null] >> endobj 1322 0 obj << -/D [1280 0 R /XYZ 56.6929 270.4321 null] +/D [1281 0 R /XYZ 56.6929 276.9501 null] >> endobj 1323 0 obj << -/D [1280 0 R /XYZ 56.6929 246.3624 null] +/D [1281 0 R /XYZ 56.6929 270.4321 null] >> endobj 1324 0 obj << -/D [1280 0 R /XYZ 56.6929 239.7886 null] +/D [1281 0 R /XYZ 56.6929 246.3624 null] >> endobj 1325 0 obj << -/D [1280 0 R /XYZ 56.6929 225.0839 null] +/D [1281 0 R /XYZ 56.6929 239.7886 null] >> endobj 1326 0 obj << -/D [1280 0 R /XYZ 56.6929 221.1002 null] +/D [1281 0 R /XYZ 56.6929 225.0839 null] >> endobj 1327 0 obj << -/D [1280 0 R /XYZ 56.6929 206.3357 null] +/D [1281 0 R /XYZ 56.6929 221.1002 null] >> endobj 1328 0 obj << -/D [1280 0 R /XYZ 56.6929 202.4119 null] +/D [1281 0 R /XYZ 56.6929 206.3357 null] >> endobj 1329 0 obj << -/D [1280 0 R /XYZ 56.6929 187.6473 null] +/D [1281 0 R /XYZ 56.6929 202.4119 null] >> endobj 1330 0 obj << -/D [1280 0 R /XYZ 56.6929 183.7236 null] +/D [1281 0 R /XYZ 56.6929 187.6473 null] >> endobj 1331 0 obj << -/D [1280 0 R /XYZ 56.6929 159.6538 null] +/D [1281 0 R /XYZ 56.6929 183.7236 null] >> endobj 1332 0 obj << -/D [1280 0 R /XYZ 56.6929 153.0801 null] +/D [1281 0 R /XYZ 56.6929 159.6538 null] >> endobj 1333 0 obj << -/D [1280 0 R /XYZ 56.6929 93.0395 null] +/D [1281 0 R /XYZ 56.6929 153.0801 null] >> endobj 1334 0 obj << -/D [1280 0 R /XYZ 56.6929 93.0395 null] +/D [1281 0 R /XYZ 56.6929 93.0395 null] >> endobj 1335 0 obj << -/D [1280 0 R /XYZ 56.6929 93.0395 null] +/D [1281 0 R /XYZ 56.6929 93.0395 null] >> endobj 1336 0 obj << -/D [1280 0 R /XYZ 56.6929 89.3907 null] +/D [1281 0 R /XYZ 56.6929 93.0395 null] >> endobj -1279 0 obj << +1337 0 obj << +/D [1281 0 R /XYZ 56.6929 89.3907 null] +>> endobj +1280 0 obj << /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1339 0 obj << +1340 0 obj << /Length 995 /Filter /FlateDecode >> @@ -5260,52 +5280,52 @@ xÚ¥V_s£6÷§àx&¨’@ úæÄNê››$uÜ™v’<`,M0ø c¹V¯ª¬÷¦>È(N™?ßíKeèºqÞ{¼Œaž :]WjdUw.t}Z~h¹E`ÂÀkÚâ%³gèüç…~ÍÊ õ³Ê)w «Õõ¡t\Õ\V Ïo‡ºSkT„-/׎Y|lÄÊ9ÛÔÍ.+‘9|_ U 0;ý<¯wÁ¹÷Ùg•¶ÞõWïxbGÀeÛ¼ÌôN5GAÖõ*Nù£ xâ<2=×"iÓ…_±Þ¢jÛ£‡".Eöêœdx”z£ZH)Ûp¶ú;^vuÕÎúý˜â[¡óâ\¡.c1̈µ* D™¹ï×Y/X9Sp¢çåÐÐYÄ}Ñ'£B‡‚0Fã~(„n(Ü ça:x/3YWõÁÍŠË9 ËÞoDÂ(îýR’²Ôº]¨jÌgÔþ×à)',fáÏwÂP çÜp<±0%<òÙ‰ýÈž Ê%2åìçQ{ÏaE< +‘I(NÃNoaÝp*ÜwEã!Tìc˜¨æ¼µº@›ûìP¢Ñ¤\éîŸO¿jtþb§ h|ÕcÅ"ÿªÞ¿7z[t¶©XÛ!Š¤Ù ”bR9Ƈùý?à¶",‘Þì’3©2N(•©Ë¶–Ä| Ô*k»z_ÛY#öjòJî~Y(]–8o¡aL¬ä‡±[¹Î´mkèdìÔs]jvâ™×¢}SÿïÕûÑnQBB)ùùn iL$à\R¦ùéA¿£?§þ/.û9œendstream endobj -1338 0 obj << +1339 0 obj << /Type /Page -/Contents 1339 0 R -/Resources 1337 0 R +/Contents 1340 0 R +/Resources 1338 0 R /MediaBox [0 0 595.2756 841.8898] -/Parent 1278 0 R +/Parent 1279 0 R >> endobj -1340 0 obj << -/D [1338 0 R /XYZ 85.0394 794.5015 null] +1341 0 obj << +/D [1339 0 R /XYZ 85.0394 794.5015 null] >> endobj 586 0 obj << -/D [1338 0 R /XYZ 85.0394 769.5949 null] +/D [1339 0 R /XYZ 85.0394 769.5949 null] >> endobj -1341 0 obj << -/D [1338 0 R /XYZ 85.0394 752.4085 null] +1342 0 obj << +/D [1339 0 R /XYZ 85.0394 752.4085 null] >> endobj 590 0 obj << -/D [1338 0 R /XYZ 85.0394 668.8754 null] ->> endobj -1342 0 obj << -/D [1338 0 R /XYZ 85.0394 644.5358 null] +/D [1339 0 R /XYZ 85.0394 668.8754 null] >> endobj 1343 0 obj << -/D [1338 0 R /XYZ 85.0394 609.8359 null] +/D [1339 0 R /XYZ 85.0394 644.5358 null] >> endobj 1344 0 obj << -/D [1338 0 R /XYZ 85.0394 609.8359 null] +/D [1339 0 R /XYZ 85.0394 609.8359 null] >> endobj 1345 0 obj << -/D [1338 0 R /XYZ 85.0394 609.8359 null] +/D [1339 0 R /XYZ 85.0394 609.8359 null] >> endobj 1346 0 obj << -/D [1338 0 R /XYZ 85.0394 609.8359 null] +/D [1339 0 R /XYZ 85.0394 609.8359 null] >> endobj -1337 0 obj << +1347 0 obj << +/D [1339 0 R /XYZ 85.0394 609.8359 null] +>> endobj +1338 0 obj << /Font << /F62 638 0 R /F42 601 0 R /F43 604 0 R /F56 622 0 R /F14 612 0 R >> /ProcSet [ /PDF /Text ] >> endobj -881 0 obj +880 0 obj [594 0 R /Fit] endobj -1347 0 obj << +1348 0 obj << /Type /Encoding /Differences [ 0 /.notdef 1/dotaccent/fi/fl/fraction/hungarumlaut/Lslash/lslash/ogonek/ring 10/.notdef 11/breve/minus 13/.notdef 14/Zcaron/zcaron/caron/dotlessi/dotlessj/ff/ffi/ffl/notequal/infinity/lessequal/greaterequal/partialdiff/summation/product/pi/grave/quotesingle/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 127/.notdef 128/Euro/integral/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/Omega/radical/approxequal 144/.notdef 147/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/Delta/lozenge/Ydieresis 160/.notdef 161/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis] >> endobj -1194 0 obj << +1195 0 obj << /Length1 1628 /Length2 8040 /Length3 532 @@ -5315,7 +5335,7 @@ endobj stream xÚíte\Ôí¶6Ò ˆtÃÐÝÝÝÝ¡Ä0 00Ì ÝÝÝÝ ’‚R" ‚´t ÒÈ‹>ïÞûüž³?³?½¿w¾Ìÿ^×Z׺î7¶ ‡Œ5Ü ¬‡¹rðpr‹ t´P(ÐWç…CfL9g0ЇÉ]Á¢ -Äü{fX E +Äü{fX E 0Üú÷äè¹aÖÃöOÃoäæìüØã?ûÿxýœÿŒ=ì a.ÌÁAb¡ö™9Y®
Ä£ò/z{xÂœ*Þè—ÖÁ»2#×Dj,ïêÃ8›ÇEµyÍî;Ýoª²n
öA™ºÓÁß‹(üèX>ã.3v±ms™W`g Åú Ϩ¯"› rnêèš—ß¡RŽwð9£ _²Ò¹Ð_8=óe4%v>oFÀk(Ù?`LÙ½¼`ê ú4ð±ûåÃ&9[~ƒ˜;26cLà«|r)Sƒj…×Íl(ßÛ b¬Å7ÎßÊçÏVð™h9Žù,¢I‚°RÊ• e®äß·RÆ%=²ìÙ
êt›œ(†Ì%³LÇî)®Ž>1Ù¥‘„µ…^Ñ2¼éˆO£Ý %õ‰>•pjÕr{2–ÂwÍ<–g¬™-j—!3cäáakIè,AŒ$ÁLˆÇÆ‹J¯³nöùU» Ïm›Þ‰D3 @@ -5338,35 +5358,35 @@ $OíœàÅ€DÈ t‡Í=žÝbóÆÃwî6ß"£“˵?”JËOP2RÐ oQo+†â1) ©w†¦ÜèådîI½È Z¿VÍ(e÷åû È"[vQÔüFØs(úF$'‘qL ®/¶!õÔ
¤HvkÖ‰Œh¼È‰¬ê؉á¶o?Ùa:Šÿ±qêcŒ° gã!_QÇ~ÏWê¡1üaœ¯UÝGmã§Yñmn%ìRãr9÷¬ß0qˆ5†/‚E…(êÚ“†,W‚˜$Ù½ï¶åçLxËÎÔ|ú 奕£w†Z|ÂV€ãž÷,éOd ÞyŠGÝ
ŽÎ¨Ý3lÍ4©¿Î\×T2Zª½Ag—.7Ù#ÏPæï™v¼eŦQLÞ»±Oþ¼Ô\’ ¬ÿĵJÅñ¾(š3Ç].Å*,MÎ>ÛBx(ÃSÃó|D³uû‚Þ¡ï†{:Ò‘Á¨2G9¡Cê{É•<|?ÒK áéá@F)Ø,êw÷ó?È ¸ ¢Ëa„Çh%Ù±o ^Œñ{‹6™Ý @¥-«ä%Å~jÉwXjz1îi´·î¬%uÕ3^¿±g¸`d+ÎK[ŽDe—„]âò†YèÖýÇ?Ï>£³HjË,èkѸÍhÔ8Š” ™v_Å
[ªJÖ®²9m=·âú?\‹k>¼à¬‡¤*³Ñ³ž,Y
ê<‹ý¹uÓ Z/ZV$S·é#ƒmNOš¨5M@¿§rãÝ0Hõ7¬&7[àçŽAØñêOõƧÈêÚ5±pE6~d»Ž^.x¨T1¬µ¤$£Í7¿ÿ4òÆêüj§‹G1¬èípoóÌ3³QýÐZ:œNÍÆéç,0½‹ Š‡Zg‹ðâ£à)‹Q©¯³‹X""œÛÆ0ÏÁ¾äBvFA‚)Y9(ÎYÖý…ì¬S…|¸Ôü¾“qbæÇN.LÔX§…_ï‚¿œ%%½¥åŒìé|°D>W²7}C –Í#—ZR¸$º`bÛGο…a¿9gÝS%\”Á/œ îñhC|?s§ Ø…šg¯ÎÙÈ)ª¬m}ÐvÖËk†Ÿ.bÉ&O üõí+uqfº`Îa‡„°£â,I§ã¯½/‘˜÷ÇÝ›Á¤'P6ߢH‚Ú?÷›½šÙ¹˜Žà9¦ŠmHr7:pMRYŸ#£ 'æW¥¿ðKCß|-¡mWÝ躖nᲶË0–«ÞÐ3äÛÙ=j’¸Ë-,n–³e±€¢üb½iÙ;‘˜Hâ°l<)žL.ßÐYÖÿ°Ú·)wL=(‚Œ£± L|)=å'ÀÆ-Å@²öò¾µ<ÃNrä³6îµEôʃ3±d¶kÓ»¬ÿ‹%ôµøü·(kD~ô(¬_yñ‡Í; ¯åä²fùOî{&*‰äyÒ¯9ÛB±T¨d>è.<Sâ¢éX3p7«Á~ ª"럽Ÿ“lË´ÍÔDQÿfŒ°Ì -*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€ Ž¶Xo³êÙ} +*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€ Ž¶Xo³êÙ} endobj -1195 0 obj << +1196 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 67 /LastChar 85 -/Widths 1348 0 R -/BaseFont /UCTAZU+URWPalladioL-Bold-Slant_167 -/FontDescriptor 1193 0 R +/Widths 1349 0 R +/BaseFont /TJLKWT+URWPalladioL-Bold-Slant_167 +/FontDescriptor 1194 0 R >> endobj -1193 0 obj << +1194 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /UCTAZU+URWPalladioL-Bold-Slant_167 +/FontName /TJLKWT+URWPalladioL-Bold-Slant_167 /ItalicAngle -9 /StemV 123 /XHeight 471 /FontBBox [-152 -301 1000 935] /Flags 4 /CharSet (/C/D/E/H/I/O/R/S/T/U) -/FontFile 1194 0 R +/FontFile 1195 0 R >> endobj -1348 0 obj +1349 0 obj [722 833 611 0 0 833 389 0 0 0 0 0 833 0 0 722 611 667 778 ] endobj -1165 0 obj << +1170 0 obj << /Length1 771 /Length2 1151 /Length3 532 @@ -5374,47 +5394,43 @@ endobj /Filter /FlateDecode >> stream -xÚíRkTSW‘ª¡¬òRIÕzX%2yj b,žò˜{CnIH@Ä•TeYÄF—<EE©°ªÔJ-± -SÀiaËqªUð5¬««ôç̯YsΟ³¿ý½¿óMóˆ”1D¶ÅP‚Áar„ X*•pØ€<³Ù-‡å‚¡!rŽ@àVkÕ€»°ùBÞ -!O¡`,C#i*xÓ'I| ÒÀ8¢£@*'T°†¬¡« S 0¡g‘Z
ÖMÞÈëàLÏ‚!&…â ÀF8
A)¬IMT‰þ[Òf¼KeÁx&) -xMɤR$„¡j=€`%…µ#»Á¤–ÿ†¬éÅCµjõZ¹f²ü”SÉË5ˆZÿ;Ódh R ‚qt:5~+N -CˆV3=+!äjD!BÓÔ0`pV2Ù+ßâHf(¢ƒ¡H„P¨€R®Î„§p…¦+!ý›ÒÁ’ŠÂ$1QÞ¿íT2RŽ D´>ì?ØS1ç˜4 Gt ‘Íd³9$‘ÜïNÉÓš‰Q!hàò|€ Çåz -9DdÄ@PÖXG*f1QŒ ¯ -÷HçÖºlx/ÌépÇá5'ÿÝ % ¼ÏÚǩˈ—¯O-wûVŸZÌ é1> -k]“
¡GZ±Çµ}M.íÌü|QYP÷]#ª”ÆÎëåù¿ 1²FêD{õþ9œ˜|V@û,|±ÀnÖý®&|þ]j
p삸5ùZï—£Q;ù/-É,zr1CN¬êáͳl|š y¸ šZ7Àþåÿþ' -(Ô° '0 O§ü†ßŒ”endstream +xÚíRiTSבª¡¬2©¤j=,Œ)™4„„ƒEÂ(ƒÄÜrËͽôrIˆ8PIU–E,ºd¥Âª"P”ZbZÀ‰´ŠðËçCªVEÀé]°®®ÒŸïýzëóçìogïï|g3\"d bßáéÁeqE @*
år +_@c€ +Å”8¼…!Mú»T&LdP¢€Û”L& DB8†ê +CˆF==JÊQD!ÆRQxpW²8+ßâHF¢…¡„T¨€RŽfÀS8ŒAÓ•PþMé`GJ£bÃ׺ÿñµSÉ9‚‘QºtpþdOÅÜ?cÊ$Ñ‚‹ÃáRDj¿;%Mk&Á8„`©€Ç÷r‚ëhÔQ è¹ +m€‡ÛÖ3kõ_ò¾:mhÚl1X}g©êØ~ÝñjHŒš»%V¨å=?×™oõ~Náj:ý3Ì°´~L»¿>¤ÌÜtç¥¬è ŒwÝbœË$%¯-ãcê‡:,ËóDMŠ¦Ãž‹UŶŸÄ DYT¾¢ývò–ÕÃÒúÆ»mvp©²‹»ç´ÌZ¸só/N—eÊ*¿^ï{^Ÿs.ˆßï7ç{×ÅE*JÎ99T$©9˜zOÒ’ýÜï‡ ÷¬G—<‰=[ZXð¬ê;ãUQ :|¥K|«m£®m®)+Ø#[ë°á½`»Ã WD×ì|vwwð?k §/#_¾N8µÜé[]J7°Çð(¸5< ÂŽ´â¶kúš ÚýXyyâ2ÿî»FTÉ×Ëó~Å¢eô‰öêýs¸ÑylßöYÄb¡Õ¬û ]ÿü»”ÁàØIkÒµÞ/G×í¼4%±™IE rrUžiãÓ¬ˆÃùÕôºÎ¸hÿ/ð?Q@Âr‚ÄÕr"öo„:Œµendstream endobj -1166 0 obj << +1171 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1349 0 R +/Encoding 1350 0 R /FirstChar 60 /LastChar 62 -/Widths 1350 0 R -/BaseFont /MAGIUQ+CMMI10 -/FontDescriptor 1164 0 R +/Widths 1351 0 R +/BaseFont /RMTWLO+CMMI10 +/FontDescriptor 1169 0 R >> endobj -1164 0 obj << +1169 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /MAGIUQ+CMMI10 +/FontName /RMTWLO+CMMI10 /ItalicAngle -14.04 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 1165 0 R +/FontFile 1170 0 R >> endobj -1350 0 obj +1351 0 obj [778 0 778 ] endobj -1349 0 obj << +1350 0 obj << /Type /Encoding /Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef] >> endobj -981 0 obj << +985 0 obj << /Length1 1608 /Length2 6751 /Length3 532 @@ -5422,125 +5438,115 @@ endobj /Filter /FlateDecode >> stream -xÚítuTÔíÖ6Ò’J Cw·ô€ -3 383´t‡ ”´„ÒÝ
ÒÒ-%)!)ˆä‡>ï9ç]Ïwþzßó×·¾YkÖúí¸¯}í}íûfg1 - €RRRDì -fgp™™róòòýËó;`ãþÈÍI4Ìà¸ùp‘NŽPæâ|…0öP€- ¨è<ÖÒÓ -ö‡†3†°û> -jg‚À¡hô
Ì
öïéü«OÀëÞÚÉ îþç4òOÖ?9À0h(ÜV€(|SŒ¹©mC þ^-„- - “æ{c*>oÿd?ïs¢Î
c—xž6£ÜY XþñèÈ%gr…é GLwÑWª pVØ/:ŽI‘|C
–ãÕ}(X)QÌgfæ½kbO—Ú+rêÌ՛̋m_%-ïŸî#3
î7ŠÇG7¥àç´bŒ½62Lú ó£@ ÚÛí¤Ì±Üôì:
Ê8¼2Ô·I•f©®¿VNî¾ç"4¿µ L ?Õª*Nsÿa ˆý¢ôœ„ÛGPÔó<•ÒÕ ‚„D»b¹Ô=5y÷y‹GDv¯î€ÝÆ'ÂÀÂ>JèÐla¤dˆ/øûçÐö<Z úEüYmñGcŒÌ$ôî}Ý]všø”,ü[Ë3håþo•ßœôj0õæGIѺE÷QÌĪÂ=Sµ†j -a?±"²=;£€»òýÓY1“²aÄ\'ñéÜE2º_ÜrBebPƒ¢y< 55J+qD*á„‘C-Ÿn«Öë]¦y,%ƒÔ§Œ‚®Ž¾ïÚí¦ó$à”=+ª:‹ º<LÃ,Jdºzo}µ7µšÞÅ zÇ ³/jIÝ}ø|È4‡ú“ lfc{0Y[Fýy¸D‰`; Ù¸.ËÓöR´Ï°H ->©ñ:›BŸÁÖr•–ôì ¿žä£ s¥¬i³ÐrªôdxÕaÕrCVäÁé -Rrd
”éaAfµ|ù±G¡A;îR:?+ˆC§Ý‚ôò.¿v¶é²ö™ ØÆùܯF‹Ö üp-møPžÁý뉴 $Еçhð¿~)£¥ÒcE‡Cá¬' ˆ ù$°Üæ]úZÉ ë)ÍŒj(Hï;KDldv`ú¶Í –Ÿž›HSJÔÓûcƒuTf¾L)>¾9{rò`ÿ'-MË0šñ7BŒÈèôPÈè†*d¶g¹9«°Oë¨ñ³9¼)*úpĹÄòaõ¶À(“ÁÇ ²Ø_Oµ¯\"U#;íÒ¿N3vl†æÎ|T)D<¯áÔc=™-g¨ë2Ée3¶±cýD>¹¬ü•€Õ:atµ¾D -|” -8T–’> úAç*º^îö3®fhCõÇ9™Îãüd”«\ö<äU‰ýe©e™ *4¡ ÜJjÐ/ÖYvwÊrðù²"ìŠ/1^xx6"ìŽQã‚JŠT9 o³ -ÅóŽà±—\º©
žÙ×´m¢,ziº¸=[mI…jk)<Â4Èwoï1±q -íµcªîy5`j8NÙÜq#(t.«[q)ÉMì»
º¨¿÷,J΀5J’ןl™–r!º©.6(!’r˦ë-‚к‚n‡_€´} îDÈtr]Ö)cršLÁ ¢G3àç6~²
D--ýNïð™aG¿² Ÿ½^§Ë»¿ØGÔsn.p7mB(«â뽋P´‡×ÔNè -+®“Ñs¢§ ˜òJŸóÜãÖnçvók}ƒ%ó¢òI2¶¸×‰Ë÷Í#|æ8¸œVuä-¸k ±3g zn´¢°oo…~ÏàUò M^{û¼L|ç‰<ÏÎkù þ3žˆ–ÞÄÅ«_ŸüIGÕHç‹•Yý.¬g¿â% ÊÉœ¨ ¾^øÉJ¯ $³‘=THÐ4Î He ^"ö[` -¤çS–7þp%ÿPhÌÉÝþ9™ê“”=zn£TEùÖ‚prŽw{^aÇÃ}Öíf¤žÜL€ã ésˆ¬;xúFu¡f«9eü÷qmï¢o£b̺£{¤ªÁr)ýÖVfñ0%ñnû˜ vÂ.å"[eÀÊ[ŠaöTq&bn2
»SdÐèw)ú Ð*Þ×ꩵW®^ jxõÌÛPfÙñþ7é õs„T0Vé –·àö*}åg¸| +þ”ÞYÈm|À+áÙE%) -›´d·EuÈ)˜dK¨bÆ›Q/.K
¼„‚’¾Øsñ¹fL„ -O›[>` ³ó¦Q¯fiXWowÎÍ b÷WתXü¢÷!Ãà|ï «Ôm»¤žÙ÷Îøêç¥ÝqXZ$[Ö+îæÚ—Ò°Û¥¿ô¢ D³NŸ}f²V—›Ï‚ÎPÌSuÿÖ¾[j‹HχëQÓÛt\~úL ÚwBÌM „R0<Qv - êô¸”$\)ÿÒeÙ£8nç—Y?£—št¶÷ÎÔ¸éøÞMõz;´óÌŠ\tà=:'Wþ)ýôz ç•âyƒ¨‘ u„÷YuY€ulÙÿÄkèÕ|1º° ᓶÚeâÕïÝ(Z½_jÚÔ ’Wq[”É%q¸ÖÇ'Ç™?tS¦“æœþüö°‹N?3RܶX0 îµ)Òð‡Ò~Ò›ÿSÆ©ÄÖëø¦†k¼Ld ïÑ÷AùQ‘¬aÜñ®¬E^«Ú;\ÙŒf'3QûºµöH×wB"7;b»4|/Èž’7 âWeÁûÃ`°W VÅûFºÉOßt-èš•Œt ¸ueq”½8c"÷;ØOUÍ‹Ò¥öß4‰~î]{xw{¦±Fèrž¤(ÿƒ¸ÝªbcĨü™äK‘òJ¹,d|! ÿ}÷ -Ÿ,lã„G™â¯Eì»ÊˆEblȃ2é5®õŽ˜|\Úæ6YØ ý\$¨J"ä/†lùô¨Ü½µK ¾Is›L¸'Ò Ž§8ïËÇT3Ù *¶[bº©õ™Ûë'Üf±gÊ nñ -ÿ¡'°:N`J¯âZ¬a¾½8ô\k?Qª^¬ü"Aü¶<ï0—‡,PžYeßKn~A±=SƒÄÝŽ}l ul™½ Ý _ÉûÑÿô"EzT Ëì±pÚØumœª-5«£è®I™4–ás woªþ -ai(¼3(O²~õKœ…)ÁÂ,of(É°!ˆÉR@ˆ?ÓcúÜzù -GoãÅ ÕJ¯E˜QEAN–£oô¯_±u ¯x3H3ŒøI%\Å4rÕ ‡¬~«¸™ô¾Ù«Ÿ¦¦4¸ ¯H~–š±ê.ΡP†]4G¤Ýñ9˜íl¯÷TO´{ØñRßÞ«ÖU¼›7µ¹¼žÒ”È°"¸·ß¢ò|ؼSí;çQž±ÈÇÑï· Ü¨¢]»¯Ðãþbÿ›gÝ^dcŠŠÙÌãÒ`&4>ë/MÙ×F„ªÓÄŠ§Ñ|T¦3½’ò·è[É*gý™Çä7´f_iu¹`æ~ á–ö|² ¢VUZè_ü w±¢y¥Ë;:ùD+â[ù‘éŠY†šEõa(¹“ªb$°Ò&P¤æ[w÷c¶ò —~¡ -V.‰L„Äu-ábHo vWîó±Wƒô½Š·‚p.•†¬Zã«ž'¿°šqäÿ&<ŒÌÐ Ÿëà©ò”çȘàÓÝhäx3y‚{È x>ty€´õ5
(ή•m“#U xÆGÄÞî 6I¬™Ïw…—ÙìÑx?åÊ쬚¤š ;qè$zÔ>€ÑâÚwcyÅŽ r‡ô+gd`ƒ†m›ÍvߣR+k®Hsm³ Á¯}A{}ܥɩ‡\ú¥&îÍsæÞYÎ× t@übWdìIjÐSTqìš¾îÎ}‰Ñ}’•÷Ü)×É×ÆÅldzÖ ”þ‡“KbJÆ(ß²Ìà)Öð¤mµô -жý>Bŵé#5Z%ç›o¬¤]§ÙÏEÕ`œVã®vÒ—æ$Œoµµv ej¾
ß6e¸—’›4óÐøjk½-0÷”Ì©¸ºn…_ÄÍŽð 2;åùÈbÜ?5Fõ 5 Ý7§ÊÊ»šè¼§ðu®¤”U” ±·Æâ áE À¡Š0~Ü×N6´§Õ?òd‘ö FdeG¯\-]? ^j~ÅÓ–£§¡¶ âs·b0࿃Û&ow¯ÖæRÔ¶¢BcĈD^·8ÖÄÜK¬)ÁÅÒ½}‰™îà=Ý;,'ÓÇ”{} š»“‘!¢ÜEÊI®g ëâdï<ëIŽšfý¿íÒ”|ÿ0¨—¯ÉzjÎ,v§,Mý‡ç¤wÔÓ² ‡%.ú ¥ÜÈ]MÜŽé;w¸nU™²ãˆ+0øÿ:1ÿd“ä"21Û…k!zkÊlÍDD‚kÕFѧ¥ÇÉ„Œ¯1SöçOqßéË¢2eŸu-ò‘ö4ê"® ‘õºç4 aÌ{âxP9¹HµR÷¥#¸|#æÇ, v2SáèÀêVÇáÆñÍ&m#`b»JºÎéì ýú›Q+EI²©á$8§<ꇡ›Óç…oÚÎÚãeØ ró¾µc8™&[Uå>Tƒýòf· ßxõÜË=üÂÇØáÉó-”íÍ«W &…P«^Y§4XÑzÎ ®hjG -¹I»ÎØ/.^¿v#úN ûqÕJƒK²óY°œ}Åö“ÎããÀ{!¡ôñ’ý¦4RÏN¢_Bo TΨ<kçK*ñÍ0µñ4ã‘ó(«f½HZ+ÈñΎʾ#Ζר » ¦noÔTX0ß-kùA›ÌÕ3Ãõ'M ±q‰p“ÿÝv
[`ùsµìâ“ í¹§Ê$±Ö®pS¸LXœóÔ½ã*¾½:-É¢P¤ûÑ š¥˜ EC]peçÁxažû«—¦Ú3é³êÌ-Q:X*÷;ú½‹ bSµðëûÚj Oh÷´@\j-¼î‹>~¢×{Y¶_MNA"yZ‚àŻƈûÓ!Ä}vwRC%fB@»Gé¦Ù÷ºQc(ÛZa}6ÆÄÄ1Þ»œžÛ[âÕîU«d5µ{› -vˆ± -ÞͶD=-z¿áݸ Y,åóS-ú–Óºµ²ú@6WptLZJ:ò]ïebø\û*(R°ô;1î3£á«W4é -*ìÝRÇBáªw x¹:á&ˬ3$àòK6ìþŠë/ÜÀ¢§ÈRZ «³H‡ÐN)ª-šéJZ - ‡•*ÆÂÀƒ98cÂ2›a]Ž]ù±ÛUr©aòºžmº9¾ª&*è»Fæ/b3È èfr*ݾ9Ð0Ç€%¢azcDùzŒ˜NÉ$Í粿"²G'[ DLŸUfÿ(p^RÑ -/Q‡ÏÉ™äžE/nåÄJ÷6c¹L\y/Ô˜0’¾|Ù:'Ÿ_©…dAeº»UO¼é¹Š,Õ&7 å›/~–ÊÈ.Co-Gn‘ïCèJRŽX)-¥yÏ,¿ž9pyO:ò³föˆMìPF#¢‹å™ß¡‚PMYíÈRBü\¥Øëé“o 3\Ñ)÷p÷Éue2Aì0.Œ>ÒÉsE>rÝâðN7ˆhükvŽ¸èÔCdØ›RZ‰‹XìjÍ[èù#úÿ +xÚítuTÔíÖ6Ò)H©ä +ÀÆý ‘듸 ÀuýáC œ aHì5Äÿø `ía +âü»¥?±k˜ë( Gb +Ç8!Àî×µ¯ÁœÐð?4œ1p¤Ý¿ðÐ0;0Š€a0×0×Ø¿§ó¯>ÿ{°“ÂýÏiÔŸ¬r€c10„ )Päº&{]ÛŽ$ú½(ÚH[ +{]Àó?SYð?'ò@âÿˆÀÿyÿwâþ]£ÿv‰ÿ·÷ùïÐ΄>Øñzþz` +þé>²Óãx"LS +pN;Æ„Ùk#ô 6?ô¹MÐNÁËË8È©ÛÐ b‰Ç'KG@¡<K{õ¥r2pç ‰ÅoÀĉí +éâ4÷ †B¸ÏKÏÈy}„Ä<ÏRi\ý¡(h´+ŽKÝ‹˜· 7¹ñDáwêö9m|" -í£„ÌFK†ùƒ¿ mÑÎ#¾
Ä<?-þ`‚•„ݺ«·ÃI Ÿ’Etcy£rÏÿŠÉëã>M–¾ü(F¯è.š•LDM¤w*£ÖH]1ì'ND¶gg1pGa`:#+fRî<ŒŒç8>·HVï³[N¨l zH,ƒ:ïþBkMòJ ©j8IäpKZ½AÑEšÇRò@wÂ,äzîèûN°Ùn:ŸIAÓ»¢¦»¸ wŸe„M™RÏAÿ¯Î7í¦×Âqc@â¾ñÀ‡ûTœËcÚÒ· <6KÆ£ë’Ëll¦l˨? —,j'§œÐc{Ò^ŠñM!¢0Y‡âR+1ÙZÞ¦8½# /õ0èL9kÚ<´œ6=ÙQuHRµÜ¹2HÏÐ-1D wészà<\ÍT¹|{Þþ ÊìÏ ¦¬oí0Öfe5kô#[].žïÉ QI»¢´<eC'MzkTˆU=_!Düahжƒ»´î¡ +²Ði· ý¼‹/mzìý¦HŽ ~÷«ŸÑCõƒû?\KÞ¤gðþzì í
teÇ; z.`PÊl¥üHÉá@$ë1*D5I ,·y›¾VF>ÇàzB?£ +ÒÿΙ ˜¾e3¤í§ï&ZÀ’õ‰åÝ‘á::3_¶Æœ‚ˆÈ‚39yh K[Ë*Œ~âµ03*:=:¶¡F +í]nÎ*ì×>l|ÏjhŠJ£;Øq/±½_% c1üÐKûë‰Î%±K¤Zd§]ú—iæŽo¡¹3 T ‘Ï kxõ8gË™êºMs9LlìØ»¨&—U¾³ƒÆVK @Wª2ŽÔœ(€¶rx>a¿Š\…_m¹ëäÍ}¼¯ÝtùaVÆ•§5ž“‘o¸qì]æì~nDË+¡ÍãAL/ÙúKEh‰Ø%Ëí×.ÀAIg󗇺3X"Kz+c«ÊpM¼‰i=FOYþÑô{fÇ÷šMG4¦îÕ0 +|~KÃ<eæÆ*òÅÖ«Ù‹©?ܤq‹?ÜU°§K9ŒG18ŸZXK~Å’dûŒL8íœN³{5~¢Ïý覜¶e-‡†ÿTîHiµXezÏqyß -l¦®è@o};“/˜&'ïÔÞÈcj-¦ùÑKÌœÞ ¦Gô¡ž]Ù#Q—Sã™›™ ƒ,æTM~Õg¦Zö¦¥¨û.K”·2!ä»Qöä©êOEw +/~J` +u_Ü. *OAŒÑ‡ËRÒGBßë^F×Ë<…âk…6Ô?ÌÈËvƘä' ¢ì<Øå³ç¡/Kì/JÊ„Ô` åf0 +Ãñ ²[SVCÏn¦¸PÙàV|Žñ"$´åtŒšRV¢Èñx“`óàtyÄò+H^ýULâƲ¨áp4¾´]¼2ÀKáÛÅ qå´„ 8™bÚ»†æ›Fþ÷¢¶}ã•a£
¤WmÖgÆ/B5»Œ?1ÉêÝw¸R1™_éz^ß]æI/=þÖ”Vo- ÔNæ¬XxÑßç}S2‰Ù‘PŠƒÔC:¥ ÆuoäGŒv¼!çFC|ÏÆyÙß w~(ÑWhŠ¿/P̤¶YU$D¦)¢ +Á—*}?¢±û)øô÷ýìÓ#qx ƒ’_xg”P 7,—/ÊØ‹4ÿ +Àõ¤åè4ì~M}yÉŒKLü~ ¢2ÓpïʶðY ©$_–†ž]šý.¡þœèÈ} 7õ +›wö ·$7U +Õ×Rî‹ÐC#ß¾¹ÃLÊÁ\Ó]·äÑ4Ä#¥,9 ·|ùDû½dâš2Eҗ꺫>qE~;V8Jï0BJÙóß%žÎЈÉrSÿº4ÛMº[ý˶ý;:æ·Œ:»iÆú ‡<|¹õ±G³ šµd +íubªîx5`k¸N8Üñ#¨u/”ª[ñi¨Lí†z »é¾ .JÍ@”4K’× oš•ò »•hÏ7h RH*«¦«M͂І‚ ‡_€´= Þ§é京æä4Ù‚ç÷I Î@žÙøÉ5¶´ 8½%2a… þʶ^p|ú*x!ïîb?iï™…à´OÂY_¦]„£=¼¦¶CWØñü‹ž‘>ñÀ–Wúœå µö8·[\.Y„h•OšRrĽJü´|×"rÐgŽ‹ÇiUWÁ’·–7söçF+—`3ô{Ÿ²ïðXòÚ‹ØgeÛîo¿RÈ8½ ÑÒ—¸xù«ËˆbLb¾X…Ýï <Ëü…0E\NéDûàÕÂOvFƒ ÙÔèáB⦠>@*sð™ßK #¿Š‚ÉÏ€K…ÂãNV˜öÉ´]Òö˜¹U¬rÍK’É9¾yÅm÷Y3Œ›±Fr31ž'H´ß!²nÿÉkµ¤ºÖ”ÉCüGµ}‹¾J²ëŽî‘jÂÄË¥Œ››™Å#4d;Uœã.¸ ;4‹ •+o¨G8Su'XÈx)5íÍPAcߥ3@«„_fè¦Ö^ºzèÕ37`¬r¯Ó¹êçHˆiáì2lo íU*Oñù¹Vüi¼³P[D€—"³‹ÊÒ +JúlÏÃ_äšñ)Ì(PdÚÂê ë¸7¨F5[úF»sn^§¿ª„¶pÅâg}„%þ'îwþ±Ê=¶K™qoM.^Ø …¥Erd½ä½g¡s!'(ý¥ #uúè3“µºÜ|tŠfBjø·ößP_Dy>(X§ŽšÞb¸çòÓçÓ}'ÔÂô^(5Ócé N )’åòÏ =¶]ê£vÙõSF9 ig{ßL›®ïÔZ¯7ÃßbžZS‰
¾Ãää*<až\Mà½T:k03²ò=. +1Õ,6CJíVØ :ÖöúOn³G¸3e†7î?+Õ§âí5× HB™u×(Óø.RÄì¡ë¥Ž~Ý›ÒKÐÏù{êÑ+–±2¤òƒƒ¶â‡§B_$J; k°=HFøœäÓÀò†ÏxœnV[f-Y•8Å„ŠM‹aùˆš¡("öÐ`D]€V•nÆ8<Ô·‹ ¬pwüøÀÝ‚ñ.úꫪɇ‚äZÓ=^w-X7>+Åõê3ÐE¹§‚ÉÞ=à= ÿ¡/¸:AlƨêZ¬i¶µ8üL{/Qº^¼ü<A‚@o„ÇC¨Àªºç%?¿ Ôž©Iâí…Ä>2‰Ö>²Ê^ŽîD¬äýxrž"3&ŽcþH$müª6NÍ–ŽÝQlÇ´ÌËô1ƒ·/Õ`´2Ùž?P _¿Âù%ÁÆ’`iž73œdÔÄb%(,Àí1}^ÞÇH9ƒý¤T™–ó4xéÐÈö˜ ùM ɼ¼v÷à|¹`^ŠG0ÐdNÌ"R Ž¢ ž)ú´ÆëÅþ(<•fù]‚óÛ ¼1@È™|“¾Î+)ˆM&Óâä ÷x—_³¿ª²ˆg jÖV¶‘Ó•çsØ9ç‚CXšRvtV°¿Dö]½Ò¯å`;ÿl«<çËw@&¿ðO„ã} K;?¡–®ÓÆèfm,ÌùŒÚ¨ÝÔv<fñ_Ñ´Ï[˜ß§|‘xxÊ¢ë*Å°*à«ÇûÝqËGò3ÀN-]b¯œ¬›w7¨{¶ÿøC@Q{6Óù¦ßv˜Û§º•¼®g„êš‘¿¦;@4ÇÞR ¹oßqõX_¾ _fp¸~lÂoÀ„,éÒËO]ñƒµh¥”õÞ¥Ìô˜™Þ®gξ›¡O$.©{Õ÷}!úu¹¾!EÝPö"‡Ñ\æ:ÜدJ6óõ˜UÿuqË•é“=͆°}›‚“Û!wJ”wä}ɬdŒY‘ŶÏFÙ) Eïl»Ð½m2ߊŒ–ë:Ëüêd!iMgáª*+Eâ[¤ë5NŽ,óª$\¶(Œódˬ,óI-ù+¦vÈá4]Ù§}1÷iàÜF†»Ðaˆe†,¡QÊ¢½†à“}›Èk 'ªº±uéé½»HÔÔÁcí… +Øùíì}Šû +áN
ù¬ Öt@ä‘‘mnAνÇÇø [ç¾ ²ÝÄ7o9‹ +±9ÝôÍR{ëwÕŽšq}1¹}`ˆï@Ǫ’—è¡çýöÌ·ºv®ËsZÞê›%ÃÍA¥ b’„iëTãd¨¼E²3H q7nzø 6<ѧjGv€P“Åb>W:÷1³]¥é =¬L=jNQÆ{4GŸûÜTà€: žôbaÔÒþž¢w W›ÃR¡být3^“ÿŽHôaLF½ô*Q”]„âf;üÊøêÕ0GçÑŠ7“ Ó¨ŸtùeL#OÍHÈê׊ëI|ß55¥¹ÏóhEê£ôŒµpOqµ +ür¥9"í¦Ìþlg{½§F¢µøƒŽö^µ®E¸|©Íåõ4f¤FÁ}m–•g#Bß9òŒE~®¿eàF}£ØÚ]Å^÷çë_½¸ëv#STÍg •n³`ˆ¨Ùiɽ2&Q›&S:ùÍO`6Ó'¥@pÈhÒJY9ëÏ:®°¡=3ôR»¨³È;÷ë¿´· Çv˜NMya`ñ½üùŠÖ¥ ßØäc툯å‡â+æê–Et¡TNjJ‘ÀJ›@Ñš¯==8ÊÏ]„+Øy$3‘’Wµ$‹!}y¸Ý¹ÏbÄ_1ö)ÝÄ»P ¶n¯z–üÜzÆQà«4ð 2@?r¦K¨v¿ <8GÖ”ˆ ‘ëõ$ÿ€× ðløb eëk@\œ]+×&G¡2ø”Ÿ"ˆ³ÝA}’L+Ÿÿ’0³Ù£ñnÊ¥ùi5y5qOâðqô˜} +Жý RÕˆ½é F5ç«1_¬”]§ùÏEµ`¼÷ûÖ®v2äÌot´· fj½ ß2e¸›”R™6ߧ÷ÕÑ~S,há)•W puÝ 59› ÞCgv (ðSƸ jŒê n8¼kA›•wù©óŽâ—¹’Rv1Näî›t„Y +º·.AùÖ³žü°iÖÿë}É÷÷CúùZì'¬â7ËÒ4~xnCûÆ<ÊñØâ¢?ÓÈÞÒÂy“çF•'ž„"“ÿ¯c‹.›$ÑO³Ýø–b7¦Ì×LE%yVm”|ZzL9(ù3å~þ”ð¾(j TñYצmO£+â9Ç]¯{F¿Æº+A“—T/õxWê0ŠïÀ?jqÄÆeg(;E¼ Ž , Ûlu¬QiœøÖ$¨Co L¬àTM×=™ bc\=f¤.I63š„ä”Gý0rsú¸ðUÇYg‚x° wA~Þ·v</Ót³ªÜG’vh@Áœ Øèµ×€á܃ÏüÌ žlpßB¹~мFõARÚÅ08¥ÁšÑÄsæ`
pÛ¸6Ñd´Ð„—¢û”óüüÕ+7Òït± V5y¤:ŸËÛWŒã>î<: +¼Ê/5`F/ýô8úì†`åŒêÓ6`p¾”2ÿ K›@A3!Õ}µ¬çIkY£ÞÙQÙ7åÃ9òå–Ã4ì› + æ{ä¬ÞëP:°{f¸þ¤ïu!3)éfñ¿Õ®i ,¦ž]||®3÷D…<ìŠ0CȆÅ9OÝ9ªâ/ЯӖ* +E¹?ý¡UŠ-ÀR7ÔÕŠTvîO湿|a¦3“>«ÁÚ¥‹£zg¨cÀ+°Èè06U›¨¾¿Æñøö®6ˆG½…Ï}ÑÇOìj7Ëö‹é H4O[²xËyoo:„¬ßîfBj¨äLh§õ0Ý,ûNz m[+bÀÁœ˜8Îw‹Ûskó\¢Ú½j•²¦v÷ASÁ6®qÁÛÙ–¨'µEïöÎýq×#‹¥}~ªGßpZ«h fÓòGÇÔ©§ ¤£Þö]ô*…ϵ¯‚"…Jop’á?…Ò;½|IŸ®¨ÊÙ#}$ n©vó ¹—«~²ì:S¾€daÃv᯸Â
Fê,åEñ°:Ëtèí)%õEs=)+AÔÁˆŠbÅ„qd(gBR&ë`3¢Çµ£0NP%Ÿ¦ Ù¨WáÙ¦—ã«fªŠ¹elñ<6ƒJQÉqŸa&§âÀí«=k|D2®?Nšo©ÏŒí”JÒz&÷+"{l²ÅAÔlñieöç%Uíð
Äœ¼iîiôâfN¬L_3ŽË§KïÅ‚ bfŠ/ZçDãó+µQl¨B lOÚ±7#O‘•úäÆ>¬ü[ÄóŸ¥C +rË°Kg‘›T{P†’”CvšF+¾3c«ï gö]DßQŒþ¬™=ä?ÕŒèf{êw (\S–u{t_9!~®RüÕôñWЩf®Ø”{¸ûäº +¥nÖ endobj -982 0 obj << +986 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 36 /LastChar 121 -/Widths 1351 0 R -/BaseFont /DOHFNV+NimbusSanL-Bold -/FontDescriptor 980 0 R +/Widths 1352 0 R +/BaseFont /BVZOAV+NimbusSanL-Bold +/FontDescriptor 984 0 R >> endobj -980 0 obj << +984 0 obj << /Ascent 722 /CapHeight 722 /Descent -217 -/FontName /DOHFNV+NimbusSanL-Bold +/FontName /BVZOAV+NimbusSanL-Bold /ItalicAngle 0 /StemV 141 /XHeight 532 /FontBBox [-173 -307 1003 949] /Flags 4 /CharSet (/dollar/hyphen/C/D/E/G/I/L/N/O/R/U/a/c/d/e/f/g/i/l/n/o/p/q/r/s/t/u/y) -/FontFile 981 0 R +/FontFile 985 0 R >> endobj -1351 0 obj +1352 0 obj [556 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 722 722 667 0 778 0 278 0 0 611 0 722 778 0 0 722 0 0 722 0 0 0 0 0 0 0 0 0 0 0 556 0 556 611 556 333 611 0 278 0 0 278 0 611 611 611 611 389 556 333 611 0 0 0 556 ] endobj 801 0 obj << /Length1 1166 /Length2 7745 /Length3 544 -/Length 8567 +/Length 8565 /Filter /FlateDecode >> stream -xÚízeT\ݶ%šàîZ÷‚àR¸C -ª€B‹ªÂÝ!¸ îAÜ` ®A‚$M¾ûî½ý¾ûúWÿëÑçü8{ϹÎ\{ͽΨ±Ç(v ¿<ÄÕªìê‚â -Ñ…"]Ý6P¤Àö~eÿ™ðÌî€ÙÙ£ -¾‡ðþÙAQ -Ø‚P˜-ôþç‹{@(„;Ôß÷'þû OH -¼ïšû‡ÐÿØRÿÿ ëï9”Ýœþr…ë v -ýÓ·‡Ù8º@‘Èû½ø‹‚º@þ–RÉÅÆs±è¡î»Œ€ü øCÛ¸#÷öüµA÷ïþsn »_ êµÁ[˜uµ‘sxÖvU+OïÉ¿=þ¸WÌàâ·;³^œú¦ -Бzðy¸C虯ÞÙ4uÍ©nŠßtpI^ÕNöbf¶OP4ðs„ - êݱ5½I™¸TÇÇNáûòVÛ›Úax¡¨úc ø_! ¦iÎ~§1v¡×1€ôAJiœ=>"q‰Œ6}óýPµ +"èªs~ -xWÍW?Æß1,6¬O°± ’$,-v¡Ÿ½”Ñz}¼¨]6dÓÄ-®OXÜ—U¾ìMÔNÕ÷ýhô¢ºŒÛx:U‡SqÀS½õ€†§½žo€s{(t÷Œ?qöÕFœ<«Š CB+J3àÉ -eÓ òárø÷63æû¯É^£2Ï «Œ‹Ý·-ß.p±ü+®„1ùò¯] p1×^'^ÿ¾y95Ží{þÞD9‡¡ D däF’{j0`¢ñsOL…x~W¿ŽîO7I7'U ¼úÆ6ÙRÆYÑ Z$Áδ1¡ükÐSò™.ȲI ÄûJ? ©Ç"â¸?qîg®ÎzvxÛ*pÊ|!où±U_côRò;ºv+u.VÇ6›F«q•PDšWd _vßê›ómëìÖS¥S©Ó±Øk¦\a7ë‡¢ÃƒÝ ,¶cÙßõLãÕ†DŠ}5™+U(8ð QÇS3U“«NÝFÔXt¤þ4„vš{¸½p<«åY‡µ×bš›q²Ç®ˆ]ß²â|V3Q@*bCHô˜ ÇN²WB¤X> :¼ƒo`‰çÇ'R?²)Ù’Ä>ºÄð¹F÷™CZ2“3ë(0³y šÏ ¿í…Ç©_æÅ"dØrÙ°I ìU
k«2ܬÜ߃HX}:³z~Gʼø½Öøq3AÀ69˜‰WÛ!g§œÜ7³¤Þù¼e{}ëÀè(xÆÓí„íe¶ø“%
Qù·G† ÍVŠ™=,G{_)ŽBˆfi,õ,žHÔ‹ñ®jEk—ßÄ7œOào(/øéõáåÇ÷ó;ÓÐèë‘…™úÑ -„\¾*¥ìÇ -¤*–?ã°_UiŠfc°' <Ó!÷
| Bhy«F¬>À?öCø':×n Äi¿±ÚÙûmp9eÍßÚ‹„ïA¹é—»:óLâHÝ”p<ëßtF½ø|ü/FdûhÇTè
îB6†ß‰–”Ú9ìîppA· Terùö/Eô —¸aªDãò‡‹IT
»õ<ú=Ç›§ “„öJL 'É `qÙmž8AƒEpûKÌi¶‚ø‡ÑúÅÙ^ò··Çæ#ëGˆ†ÕRÁHÕ -‘îÃpwªŠßVé§t¼ÎÉàÄ•Œ
4.IcA#ê˜Ġ‰žs²[Š…J¤ü –Sú·XêÞÀó0*v/ß+—¹°ä^†Ý*\r› -˜MQ‰¦ i@.YÇAž}êÃÐ æ<FåϾÙ>ÞIS-¥ÅÔJË®†e‘·²~·E˜ ›ñÞ¶Œë—± ³È˜ | 4h¡©ly²Sz£t0Ÿ=H?Ýê„¥¼Pøth›úaŸ÷ ïé´‘þjúÌ äÆ^½Ó·+f?V1D$'¦¹tÄÍô|Œ¾EÉÒ+wÓû£Î%ϱ_-»Zeã¥ï·¬ :}ÞýØ ¡q*Õš‰£Ã¼ÇÙ›$ž€dz+6{²K[Rè -õÎu§æŽB_Ò¯ƒâZ ¼Í¶éëy©žÅ÷Î1uíŽ 8x²M÷½øóŒ á#:æxóÉÔß7’ÚjÑ,+1 r-°o<Èýìo %°mGÛfTqS4¹N‘Ò<^ñ™ªo–[^·_‘õžÐ¹œï±¼Øø°mòS–Ý‘L&q! „ÂUÀM.t ŒY-'zâ{EÛ,hy ’Á†i½L]æ ïà -Ÿú üPÀn eÑÿ K€!¦±f}i/Yÿ -õËK3€ÿæ…KoÎyž ·xÙØ˃ –K`KRš‰ó'œ«÷JBµf(ZÁ¶ç´þùø' ºƒgD2ýIËï‡ÏiÀíô±éÌæùìŒ×•‰šøW¨§†Á/¸¬~â{,жÕkM#t_ÙYyÕÒ7Ò†__Ñ1kÙi‘"loš+Ü@’~ 1„M‹ˆÃˆ¥DƒÐ¹<‚ñc¥Š½Â t 1¸)Ý‚Â[LûË¥šÝ_̃¢ÂŠjq¯ ò`Qý²VÏÜ#ØîŸîxçc1œ!³D툘«ÿÜziØU¬½’¸Gèïoè4ƒõÀ`uúýyÔ—1âxµ œ<Elüv*[×v²EŸz ߈ßa$»p[2ùÜy_ÅÆ*ü4\G|^-õ/¹ÕÁo -ìÆ_NN7}5rd}øÉsû'>F„´
¯=õ5™Áº‡†Ö˜sìlH¿îd6'íˆÄ €¼î€"@êÃôÙîÛ䇇A - S“)bêš•Ý‘ïS‡uà -Dk›R …
ŽM -½u ¬NB\ßw 9pŠ[—0åäxÓn©±¼6ˆ¡$-Wnò£k=—.÷ªz³ç™4w¡áœñäîU7ìÐ䶟Òãl»;$êËq¿½€)áuI
üîwêÍ,S±ŽÅj:M¤J1uáù“\5DõÓ5©ÖRrVô+ `8ƸYâld% é”éÀç¤C˜Á1Æ¡ˆ÷–„»Œ”DC ØnÒÿ*7Ì‘y’~üóÇös_öôB¶àÆ¢¯ßÒ9^*ÛßÌ
š-<É’Ø߇}¾ÀjÜp ²É&Ëlm0?J ”>Z˜àNMEü"m9Güoø7e <_Wƒ“®Ì´ò¸§ß(ƒsŠÁå“+/Jª[tUß Nñ–J„Q/Ãò·ÖnoÂÅp |´”,p2Ùì.cA‰£bíN%€<«ñ˜·^ - [ ò¾7ÒY çF†* XöyuÄCu%=g† ‹]›;Öó\ÐNNÚ[º·;´[Ý\̬~äGGÃÙ¿]!G´‚7\¯Ìq}wÄÍøïæ4ò¨2GÊ"Ž - )¹Ýʤ Š[‡J¿&¬D`§¡HGýÐ~^¬Ö×ḸK±I*¼ -¢àLk -qïqNËzF¥üQª2eæ¦à¸Ô»Ž<Ws”Šu* Ÿ°¥8Oõ,â!úì,Œ.†¦F-À:?›Es©¨¬çÀyærQOûµ(9û †I¹µ~¥YϯL d£Q_ûÃGñ6ˆ¥!ýDê7–«Ï‰I)=x”ØWk à/š‰ŒÇY9+‹|âOî5¤ÊŠ·ó‘¦½T³{‰Rp‘E. ¹5D{*Ð -g#Fx…H‚i&éÜãu2Ó£‘ó š<’7½[!l=®v¸|«.ë þh´³±š«+ EwÏôɘAñÖ{ ß4ø‰ ì×SH-lÙpFŠ–¢:3èeª-ÈD¼¶µeÈ8†í4JmÄ´Åÿ¨i$ qø¹7ùÙ¨jZ£ -~ ÓµH± --eYÈ|g•˜ÚÍYÑßdgDÿ©h- 0Rà¾p ºÇý %{ÅÈß–H×ÜüÕOÎ9>sÊ„Ÿf }aêE˜Ös··öè3¿“7_Ùá‘…Ã&ëì4žŸ&¾<NÞa ´ -MH¥ºïYjzÐKo±'¨‰³,í ‘YÛQ*Ì mžÁ˜E'¥âïщ½é¢Äµõb†ï£‡A$Ç~ÆAŸoyWØ<›\D¦M¯KVº˜z üƒ2Bù|‰ó~h;N¹Öj? ˆ÷Јð\8HÜñ´|?Þ Qp¶®;qÎvRxli¸*ˆVy¸ù~Î j)éŠßMÔ3Aü‡
J vá¿5@oš6@OÙ1“*Ò4ϯ Yw#íŽ2K1È¢}¼ôDI5ðkml•×¹?{Ðcƒ˜ÄßÖõ}za-d[*¾m6öiz‹íh›·¼…’»ù½o »6Ff_MøÉëùG )ÿŸ„µºëiYw4 -;ÉÄ÷è&p±¢œ É•È%Ž„8°ƒ§ßoö»æ6î6ÚÙCYåØhBÀ¢èkZÖߟ܄òsAfnEäZÛ ¾ë‘K Þª³:c{ôJ?è•iºªH…Ök¾Z+D6ÕŠ;.j˜¶×AJk䆯È3h&®C•ê‡%á%m©,µÂ¢®†‚……~}Å‘j,ÅFÚ@¿Ï" «<ânÇTÊØdIXZNh"Q#£þææ’ %ãF¼o¿™í³à»ª¸x–„ ™ÿŠûH«Œ>š}DùäD—óÄЂˆl¯iE? FgkæUŸ¶•mFj2† qŽ`gô5H*f>¡¶ë“69=Ãâ¼ ·•¬þ^ê®°‚ý¦ ܹµ€ÈÇ7Œìº sJžìdÜâe¦ñŠ•ÛÛ¬ñh†XI¦PÙ ‘ï?Èä6ÌJiNì7U±Â> 11²ûÎÿÄi|3ååCßSMì“DäO$ŽÎ4zä}߬E™WÐv©D6ºŠ$RðšAŒ’G?0ë€rßœŸ+f³` Þ‘»éíj_}ÌOóXdò˽ý—*Þè¸wäϽ YÔ¡q,©&ëš÷© à -Q L¾ÌY®Ùv´)×õ-ËGÛj½z¤Ègh•Ù¡.†©æ&$RD LsúpûÂJ¿'+Ž*‡p-rÙÔsmD_ã.:.¸·WàlKº×Öe÷÷Ã)ƒhe<Ú†uDÂÍ<mû‘ïÒ”0\(ßMbñ'$i/FnÛ eˆ“!7Ïï¼¾3Du¥ö;»Åk©è*Íä
yLmrž/–°ª=ØïðÖ ±·óü~*'Þ8 ƒÊÚZq“¿b±dìË—v&º $¿ÌÏmæ^ýàKÖjZç«°Rþþ˜ëë½|åòúºhÌóÝÈo\ƒ–•A°\äjd#pÓ×ûb -AþV‰Æ²ù¼Wjl”F=Šç¯tµqVâSO™ è3vœµ@rò8F.<<<ØŠöh µu áIÕ²çÊ ín‘ ËF~ókíA¤éÚwc°&ñTÊë²¢a¢ôâøï=—»œ¨ö–§ô~£Ûy A®g^.ü½Ud\ºÎûÇ–gUh×] Ú¼–§ùiß?ÀM€Ú~·×XÉx×ÙRŽŸbÈ+-5ÞWV”!t_l5à(“üìO#æ$ži ïÇÒètiyô^Œò‰Â'*%Uò#ú¨ èˆ&7Ã|!³ ¨ZRuÂi±ÙÉh,¶©ÃD1ÎlöÑ#ΑÃQw ãŸ9V –©•“™O»d3?S:WŸTÌýðVczòóa’é´’ß2‹+å70墀Ó8<¬Õ+=ÿ‡:W-`-œ3ù·gˆGàW‡…©wc= )+ó î¤W ßÊ®k7kÙÁ[õ†ž3y0¬{ž|ùÈÆa›c‘*ºÁ€×„q "£º1G÷%Ú®):%%O -+o®=(n¾ëný꽎çä«,þY¬Î|ë¨{|Åc¼pQ'c7ÓÒ¬»¼zZÙìtg⿬ôEŠv›å!Áå±C•Kà;äÞ>]÷ -ºŸçzp·sB¬ƒúŠ†Ñ¬¿&˜çä×*=ÔƦ(“ I¡X¥Rwýö¡…*ÈÌÁ¾žVŒJl–fF}ç¥Ë.G$= ˆ"Âü‰_dm-ní‚Õeßul}h ùøE×öG|d#±ÁðÕŒŒÉ ÿ¹‹û¸fê¢åW4íµÐ•(YÕq}Gk¡w¶u^ñI _Ýry*pŽ•t7AN gNØâôÙ7·Ì -_žŽ¨Ö‰›³:û0h"ÎQo¸…øÔ'û,E@îèò…ôjÄ€"p.a¸‚ðâ{«ôgòþñ(gæš pXÐØço -ƒ&+»ø‡±[%B–YZ£Jž4¸¸ûA£&“†ðÓÉ3/™çJ„ÅL׈”8æ¶ôr?¡.ÁBãu°‰§è´u±Îë·§£@uìQáý¯ö5™tÎ¥ßÈ÷˜ñï"Kã"Ýaz‹ëÈ$&ƒò%ôµË#»y¤õ «xÃæȲ+xS« ò"¨ˆÊL=˜#Éx÷{ž².^7‰‡…|íÒøŒ±ùîî°Na©9ìâUÙÐ<ªF'”ZB™–K-Ž¤BEÜ~l•Qî“TJÀ3‘äDYr<TÏœy5Yq8Õ8gmeä
®Ð¦¼q†sRÊñ‡¹ Â×Å7õ¥åUdn¹ö s ÷õ€'µë—ükQž¯ôÃõ´é#ZyúgU?çÆÎy;Àû +xÚízeT\ݶ%šàîZ÷‚àîN +ª€B‹ªÂÝ!¸ îAÜÝ îA‚$M¾ûî½ý¾ûúWÿëÑçü8{ϹÎ\{ͽΨ±Ç(V&-]^Y°‹DÑÅÉ+À” +Å‚ +ä +vqvôúw¸È à—WÐÑ–{Éý÷Úÿ%'çò É+ *à~è”Eqá§Wü—ÿôá/T ý¯uÿ-©âlãÿG9>þ³$w ñЛ +7çÔD€ëwÕÛ¨¾4ã43bùëol(“Í¥ìå]!…b¬ ›Š¿<Ä_xëhY4*hq¿ÑóOì6?éK˜ÿ™£½‘Ö׺œ2[Ì]yjÙÛµœô¦ÍR•ŠƒÙ¡Õú”Þr\)žêË“Õ»6Áât×2·ý\áLâl4&ÚŠ!GÐÕê±ðÐ@ “ÍhVÿw]“8•A¡Å" #uÆ +%26Ü'”qF” U¤ÊS÷áÕæí)?M +¬êØ9¹6ë1£zy"__ƱÒÕ)¬yŠÇŠ•Ã\hô;øQ-]Žd|ˆŸ=‘<ËH&Qn—Œk|¿n݈–¹dˆo€,Û;ìM_bZ²– —˜¤õuPsÔjnªdtüø¤ð‘›”¯?´›î‹Ðö\ͼÔxWbTJ gì Ëï¶ýž± ÒƒÁ´º
öÂð¶‹>G‘É~°šô¾+!Ñë° \x³] tKs–…†Wµ¨ÉÆë®lõ¥ß Ô šÀR ŽšÛ’¡Ð•¿µ²—l¤òË"D?º 9lÐn¹O^‘å¶þ²Toºz¾l?UpŸÞ8°ž5©d¥t‚v§P55Qÿ&€l°HöœÍnM©1Š…ίŸü\3˜Ô'àc0¾Å +¡j?ïHèÁŸ¨ {Í`ǃ†*'¯K(ý«‰H+6Øö~l ÂÁO»Ò‰Ð^`E茑Ãp¬~Óöàæóð¾6 –î¥ U¢Õ¿Þ ú \\bk¿w +Ïï=k¾±ÔÒ=L~ÿßôliF®ÛŸÏh‚L0iOrH; p P …L0æÒ+Îødy{%N5—Q‚+,:ëWø„ÞKûÞ¢ÓmÅyÙÐo\µÄŒe’0 9>ú„¯ßLUÑül·äVáp!k€vºÅ!CqÛ¿àùÐ&'äÓ÷î³uHíõô¹;(Еµj·wOÄn´|@F<T}ù˜“áå(m³‚…gö–טö׉o
«JEÃ;…ïbwÌtÚ½^}˜ZãlÊÕÇG¹O³¶ˆ< +ØœXŠbìôëú£‚@) ’š¿õ%µ_ î©Víá ‚~©¾Ä•CT 6Ú˜4F³<Vú›Š1uÜkAäsƒ W –?qÝ—‡©[ë†4¦Ç:olÍ
=kh¨Ãn®i5l5ˆá6·ýôån|Zâ¾íÑøKð£ðåýù\¼ñY#…òý‚ 4æîÑØÉ]‚ü‚Ûþ +%ê]_ŒÂ‚ò*±o saPü²RÍØÇÛé[ˆjÿàm>”.µ H埯›i¹2è,Ò\MØÇ÷ó3pœÅx¤¿6ýñ"òË(aœÊ%V®<&n…KÉ’w šOøïP¢=˜
‰lΫ\ð¯"#%^*ð Ïæº×œGª wù¶|ã¯ð'§¿:0?þì±ó-\ÒšÛŽò†DÃ]McTƒ1f._¨Og2‹zXlŸ@Z{Hæ/ñiú‹t×]Òýã@¹ø©ÉdUõŠò®ˆ)C:¡ùÂ5òÉ‚z‡ÇÆùýˆžZwfGŽ€ï»OìÙEŠ‰²³=©·U˜ÞêG“ãkTlð¢j¼”,ó¬|·ï‘8©æ”þìþMôÈø®Üý|§+8òËIŸ Ÿ îmq5ìþwÊí C‘¶ùZU„Re6þųO ÕbduÓæÕ)
V2–´«í Ú¸iÂ3LD á˜aÏ㨟Î6ʦ €óžˆ³”˜HMØjÔû*3Ä–qšvòóÇæK Ö´– †Â¯ßÒØ^+ÚÝΘ.>Ë;ˆ; +æX,¶W1Z #"mŽjÅ€\Ëñè÷žrécÍ`YŸ[ÉL¶ ÃM¥vŒ|»ÜZÂÁZýâîs-ó=ë{æ‹ ÝD¬Ô÷µïw©·»86™}I‡²~»€Ÿkmº\›aó{ãòÞÏ«åýPf,Š$ ‘† à“sº–JÒñéµüº‘| …_ÇL=Gø¢ü¼\««Årv“`—{HÆžZ <DÓ”!Mþ.)mpè>_sfÒ¤ÁèH$ž’ó¸Öy ®b]ñ–ܬBº[Š¶'ò›ÑíÓ1²ÓæŸ~"çÖÁ&òâÐÓ8QúÝ¥õIƒ/ ý•"ë”þ¦œ4Þ&›NÃëëT¹j9»=Ù9æÃ!n ÄÓíïô©.?l¡
ÞèšWñž/ðñ< JįqÕ‰>‹ðÍßÈT¼’ýÁ Ì,âîùÒãØv…6g£w«#׳X…ðÙ¢1Ìλ‘Rj¾B+Ûi©h<üŒIŽázEÅø4 ~×AíÒè¼wXr‰½j‘ÝB +ÎßUnDú'
›ƒ"ž´hvÃ<n'¨fï&åb?b•vHøý"WfÈÈ1HÆr®s~©â ãXÚ/:aCv‘âQÈE4ðÞ]^ Y +I‰\€´6 çPPX̓ÔrñÌd"Ÿžõi³÷Úsj ÿJµZXèÏB¡¼u…àlJ‚[úžÔm®T]“»s)°®U?Â]0!° pRúÌ›Ôc@‘gë-+H}¥bû)ç,#ŒXpò£’ ç «Iw·âH˜Ð|½÷«¶pr;šþŒžÁMH‘â”ìù%J`E§ ×ûK Ê×K |±–ô.\— ëÏÑlÖT«ÍOÏ4°ð¯i…§Vãã¨$Í]çÛË”$
+Ér *Êm„ÁÙ_’k½r•nI¡}¯$-nÒÙ>øÄ«þE6ÙgµfOÎÈøuu°5HÎc§#I¥$ô*Ë IÇd"œ¿£¯ÏGrC8‘·.ªÿÝ GþÙŠÑݤ 4…¸³«¯bM®ö¹Qn#cŽáó“¦öèÝ_Ê/T Ä0 ÷ h“®wô+ŸÃV æÄpøæçøŸæ7..QÍNQâ˜w¸øx l °ÕéÁKïé©U‡ïÅ"5&ï`K‘ô¯{Ù‡ï†ý;n’v}¯CJ‰ŒI´$O{•]uõ ¿;Üf¾@‘ÞêXg°º=¢‹ª¨'ÿþC¹Íø×æEƒ‹±åa&Ê[Ê'khÅwˆfM;=Ï& ? ˆ)f +›oƒ_o oñÂýË›%jË%¹]ë‹í¢¾œíH»˜,ÿ‚‹¢øk-hÔ; ›:-¿¢6ó•IÑòkJM¼»Át‘r…ç(ÚÊNöìï`>jŒC4|»…–Ã}RLaR’QLÁ:¬#oúÚU …Çü9¤œ?ÒÇžµÔêS¶ðšåT@ÇxeL4µç;,Án¸ËÄàüõe®–]Y¾À–Úî…º°©S8‘r u|IíàÅ>š°`|˜;A€8>ˆj’Æ-N‡/#-Ê +± %¤VKô®g;˜¥ÛÅ›gÍyÃÝ…z.F}oµ½ðþ… é1£VœÕ~û7õ„#K^‚Gud‹ÛÖìÂ%¨Ntxº*‹Ráom¬´2õ¥ Bw$6£ÛFã~T7AŽÙ|Ý}•Õù‹¿Ohš%™–3Í¥¾3‹Míe¯êm±Ò£þ”°âSö Îw[¼ÙçüŒ‡¾¡çmM ijúê+ã—1eÌKµ€º8uÄKHí¾ß_2£…ÛÁ§hÿÄÜ~‹ynÇWW+÷(@R‰*¸BÕç<%-ðµ—HµÚ3äÄy¦fºÐ¡4•Íú¥&×@ô’£BÑ÷¨ðþtaÂúFÝ÷‘£@¢_£À™;îUFg9¡i“›âÕN†žxïÄ€”@ O‚/Ê®cŽ•ÊÏÇ +ÝöMGÖùn2—
G}9Á'ÏÏÿ#
Ñû‰:°ß~ñ#ƒNÜ÷ú¨Óú¨É»F byª¦…õc«.|#„íqF Qx€“œ ®z«‰©ô6çg7jL ƒèûZ‚Þϯ¬ìîJDwLG?O/b° ïp—5“ãs6}ôifÕDËè;}»ðÄ=oè÷³Ðó7]µB«öz`)Õ::x)þ“56a¬@ãK ˆ™Há`±ÔóÕÞ¼ Žû¡Ž1lÀ”í¡Îà¯tŸvß’Rº &E/L]·¬H>P¢k”q8«¨ÃA•{
>ò#¿7¸‰UkIˆêL_ôË”õe“Èl‘Mæ¹UäÎvGa½_…’È.·Oøˆj s -ÌîßZ +]a‰‰Û¹ú|ç~±ªï`ï œ?Ö—VŒ¹…Äû/ ¿¥fþýÙ•N /GËÔµTÃ~‡Îg#"`™Î MYmN{tŸVá"Ug%±ÀFõW+¹ˆÆQ‡e@5ÃΆ–Â:©ÁÒtªÅþ‰›…º!q~Xñc +8S °‹AïfoQ„ +S‘¡&Ðw†Lˆ-~KÔõ„BÓž$CÃE(rxÄÏ,ßLüÒ½xÜ0€ûý7Ó&\%g¼àA³_±Ÿ©QÇsOÈŸêp£Ÿ˜¬â4®êù'CilL=ëò@6ÒMuú0öaÌôÞzqùŒÇB”V¡½’úÃgçìWã6âUßK<ÂäV1ßµãö‡9µäxû„’Üäç¡OÉ’œŽ›¿Î0ZÕ p}Ÿ9 ¥Q #Î"$.ôý‰Ì¦i Õ©Ý–2F˜ÿŒ +ʤǴ‘éauNº…F¾iqTrå Ç¥&GÃјÆvcùXÓ¹'O؇dž:"óïÑÚÇgØÖòW(“Ï:¥3fȪNËçx©0< +þù8ÑdÚZÁw…É…ü‘+ˆ|‰Ïq Úb„‘–÷C•£° ÆžËø[ˆ=Ø=à«ýâÔ‡ÑîÅäÕw7âëͱ÷ÒšM¶°ÝÁ— ît §_ÆXØl²²ÍS„7épÑnµH(.‡ÍP}6ëòŽ‰I“‚Š[ë/øŠ‡î»Ú„¿zmà8ú(ŠÎð“Ôšm ÷`Ž¯º ,i§ïeX˜v•UM+šžíNÜâ––¼JÖlµ8»:±¯tø€Ø?À éZEõõØêrŠO¥€¶SþBRÑ›áàVqþZc …X[f°"Èä+•£ƒkoÞ?6WÖ2µ·«£¡™£šUÝ}í|«ÃAË£EnöÌ7¢¦š»fÑòª÷&¦.¤ PŸ~ѱùQÞ ³ Ñ}5%aðÃ}éì6®ž²dñEs=d5RZy\ÏÁJàƒMg\bûW×ì®r¬…E Àm cü¹#¦(mÖí £Ü—çÃʵ¢fÌNÞtêð ä;N#^9UúÉ^ !-7TÙ‚KZB@!(?LNpé£eÚ Y¿8¤c=U6(4ptæ›Ü€ñê îQÌv±€E¦Æˆ‚6öAàˆñdºìlòœI_ûKÆÅ¡~Q Ã
<9–±5ÌW SŠ¿ÀÝhdì!<mU¤ýöýÙP3_Œÿð«}C"™}å;ü=z<ޫШPgˆÖü&"‘A¿lµ]eóêØvAaõʲ?Î )â‘ô*ÎÔÚ§Üp +‚RwÆîƒîçÌK7¢¡Á_;Õfж>Ü ÕÊ-7…^^!+ê›FThRŠÉSs(1EÈð{ü±)Å^q…xÜPcqv¤ÛcÕŒÙ7“åGƒ +)VÖBs.W1Cé. 7;±âäàH%v´®- úèýû¸Qém©]'¹¼‘í—õ±zí , ß_m¯1fbzîy/ÞF«ð´yVJF†±yš1¡›GÊf•¹ +\îMxv‰@qÛ`d”ØŸŠ-h}šÐdyì!t`vThr‹¬>Kˆ9<™Q¨5н²¢Øa-°e?I{{”PJƒWûÒè(ü9Ie(ôÛÈ<ú˜&ó³i࢕ñ;ežÛ«ë×EwŸ4x°ž½øñýX «ùäË+‹WÅŃîIÉ{CZàyâž¼¼Ô>tp¦*t[NÜóºî¨”רøWF/S¹ÿ…›5e[žÿãUµî7É1É´jâ*”¯,$¢ŒÃÜoÝTÒ9|<7ÚK~Ê ÕŒ2‘+˜E|™Ý [»Õ]ÐøFü!¸¾õ·¼¢›ÞÐsU}Ù”g«’îJ “2x®c>5ê” oý¤Ÿo(#0›LZP€ÿ—ÎÿøBÀÚ‚#]œ@p 8tÿùË Îÿ†8Ó|endstream endobj 802 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 2 /LastChar 151 -/Widths 1352 0 R -/BaseFont /PNUUAQ+NimbusSanL-Regu +/Widths 1353 0 R +/BaseFont /DERQBK+NimbusSanL-Regu /FontDescriptor 800 0 R >> endobj 800 0 obj << /Ascent 712 /CapHeight 712 /Descent -213 -/FontName /PNUUAQ+NimbusSanL-Regu +/FontName /DERQBK+NimbusSanL-Regu /ItalicAngle 0 /StemV 85 /XHeight 523 @@ -5549,7 +5555,7 @@ endobj /CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/nine/semicolon/B/C/D/F/I/N/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash) /FontFile 801 0 R >> endobj -1352 0 obj +1353 0 obj [500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 0 556 0 278 0 0 0 0 0 0 667 722 722 0 611 0 0 278 0 0 0 0 722 0 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 0 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 1000 ] endobj 714 0 obj << @@ -5560,46 +5566,46 @@ endobj /Filter /FlateDecode >> stream -xÚíWgP“붦ˆt¤w! E@z/‚4•^B ’„Ò{‘Þ‘¢Ò{Q¤÷ª Ò¥IWŠ4)Âî»Ï>³ïùuÏùuçf&™ï}ŸµžUžõ™psè -*ƒ¶û8FPTHD u¶uEk#àU0°®- -À’$Üܪ(EÀÕ€ˆ À¨A@ -Á\Á¿ÀÞÛ!~'„D!°ÎX K¦‡@cÐ ‰`£ê©Ýÿ#OŒó+6Š…;¬%rýUÒo KƒE1@(
À@<0¿bÙB -«îï7 [ôŸçßx@@$ÓŸ ù`Ç´ÌtLCNï;5‹ÎvQüÞdaÑË|ÿ -D›_Zø¢l©ÍEeˆPÝ°Üå[ω-äÏ/øWûÛéa¼m)<Vß[| ùTó<MÒ«ÂV…äéÛ¦ÑÞ» -\3—1Y]z§o`Upqýæp“8Šh÷„Ïÿ–[¾?-×1’â)(µæ]3e uÕ‹mžÄ“cÞî¾Þž¶}‚Ž/,ÏŸsË»]#ç‰òwy΢dn\ê Á¥¨>0DEj™¨<Ì9ëMþ4ÂM—}VB?÷ˆj´˜
V‘ ¹HC¨Hi9¨{»µ_“å‡k‘hî?á£>îº
¼üòeï Ï©¦:ý˜¨ùÚâÝç|~)P+"r>r‰æ§ ; —,Þô}è øŠæâ´Ž
(àçä8ŽWӥؕ¤JÇ,ÕåpcòÅÙae°íJ>»æ¤U³øí«øê3NU‚±ã,=šÙûšÙ&ûæø*â?åuŠ -R~Žú]%™å‹•`Œ+¥ž^M8~©d`VC/»°lþŒ<˨Æo¬ÌS†æZ’>#nÏâc`¹`¸YÅeqÜ*.ìT Oo-ž‘6ó/’Râ$ú€«^!î8Íro8”½¦©í&yÔº©m ›˜ÇcÊ@Ú†Ùu:;ýPËX5j!% #¬ÅQZß ØgïÔIK×5–Í••5‡fQ²®¿®¥>áfc43 Bµ“ Û¥ãÿìªcJŠ)þT|ßÞ!܉Ju‹Ø=3ñÑ7H -ú<û¬ö}£ÈéI-Û½^zeÃì¸×¨"ÎSskk²O2ÃM-ÚæáÇýÅìdú‹Ó]º9QN5éLm/°ÆýŠº£0U´Èf r5’;ƒÇ.‘*ºiݽ Lí¥ÚÜRŒºž65÷‚5Ü’³¥Ž¶ß ¨;ªêYIOÐR SÛ½’bíè¼Æ¯Ä³âL.«õ”ƒÔ¶ÂÀ©¼@—þ äÛž²~'1qvéCY¥¼©²o+îÎåMë-îéÐŽÆçI}èäg`Oòf›ép†ËÝăõji¥Ü9I„“̲{†â6Ø–õ´_Ù^¯IVHÔ[u3E¿T=ݱ¯ ¨ºfHåâ#wÏ“lí ÐnÌcnÔ⑇³øl½ôâf`„+²fkQÝiS>P²s{RNAüµÆ¿ÄyôË»®o¶Ò[ÖÅ ï„ÔùΔÜåíÌöhÌ!eõ¢ tÖËÇ6Þùa7"7¶Pþ&ëìì¼òæ&ÆžïSôÑÏ—¹_WlšÝ´ -ÂøI
_Õ®"¿iÌõ<·_HÇ£œËNº÷äï¾ ávVîxùnmhm¥ðòûú ™š‹/U쟕ƒüó wÈôë¼oš€åªš"T"éK)í Ióú“CZ5[¥LƒÊ„1VD„Æ}“¥ -›^ˇ³Ð,Mþ!7‘<&ÞR’ ‚‘îþèöu³ºÌbÖy ±ê9+ ¡ÑÂo®Ð˜9U3£‘ ãäzÇ82±L û¿ ßšÏÕà -‡ù Æ£Ï)wCp†L§X/'zFCf"ý•„SÓb ò)›_äôq Zkwm˜6ŽHEëÐß#|¬áÕ6ŸºÌ‘ô2nî¼R–.§¶@ž«„®f²¸£DŸJ^xj›Æà\ÓöE˜$ùõ±7š< ÝšOÙ-2tHô^¥êm >zkèàjoR}šš»]GÍ|ò · #X‹e%臈ϸ×jYJl
š«*–8h¤-ëjíh„ë» 6OLO& ÇÊ&–“&¶ß¥¼½Ìñ¸±.cÒÊÉ]$TÇËíÇ:âs0ÜìË íy¯iƒÉ dzv5³$+Š]©Òí†âš×ké_é x̘ ƒRj5ÍçJј/!›j#z´dÁoø`YŒëB’«(¶wŽ™ÆªLIz ç~¿·ôaã ˆMHMT. -ñ±Sq–£qz…‘¥órn¨h^•x²ë’š¬ :ò˜
àèÔ:[8‡~çsÎA©jÍꇳ“±eNš 9µ,+×TK•ã%TuËóÃßÛr}7¬pûæp1$è/ãù~p’xë“ÑúÑ«è§ï VžZK4:0WØçÖä¬5³hu2ÒÞîãownâú˜x{Á_Q÷ñRö10ŽÔ…RG"%Ç}P‡é%‚Ùûæ _åF㩪UãºÈpÓYâØÄ×|‹ù€Í9 ¦é3ñ¸ÁÄÛÁd9TZÄÌ{¥÷ÑÙÖå¯k +ò‚ÖŸË78µ %®5Bf‹’ŽuS}¯è#g6ò\œÞQ_OŸÐx€@üR€@*;÷…äyí·ßj¾Nf\çT-¯Ýö -Þ,ÌY:'§`™Ç«x“Öð¹<KR›y¤Ø:ä -—>Qΰ ˜úsš?ÜYî“ÒÉ|½ Žx›£ÒF†Ö³¬rï%ŽZ½8Aÿi7ËÎ ¹ -“4r÷º?Ke7bCËñÂ%Qx\èpX)„¦¤;ò"OÁµýËw”#;9ïÇÝO·ê#o°RÐb¢â@?ë=yùÐÏœæƬû # ®ã-WrØHر ²Yë+_~¬êüå
o‘pGCÓ -ˆn‡Th~5ÂìKB L c%[ËŽ¡ÿT/ØýKŽ ‚+Õ°3>“xZí!rû!% -«Z±löS–Â-=vŸËŒ¬…9Øî™$w7§˜æí ì”…-èp8u>à«}P\ƒãÄ¡¬Ý¹½SFÊÊC58UZ:ÚÖÊP>´T‚ymçț>¿˜0}•9;#}À®¥kTr‘×óð…Û2‰êŽà-U„K÷;iSâöÏ_:÷N}A2 /"Þµ —Z=õ²Kd‹Ž÷½?"WL`:%ª¥›ºÐ.-s|F©Ü¯%îìSùvªýV¨z§á:ÍRIËè»Q˜Šù´~lIÖˆ¨ØCàfn€Dô²ÛtÒ›$3i±õô£/‡—üMÿ°A‰”pºŒÆ ½ûàÓãr:…Ýåô Œ9ÿ«¡Ò‘¾kÔaúO" V Ä3e\ ô¤®m z£Ýq§û¶÷Hrwñ_Ê„¤èóÐ ©:Ÿ\”˜ -&™U†Ë°êÖ‚hÉžw´2Rˆ°´-è•SNXÞ_¤›'W;‚R׸äƒèà¡IXud"ˆ}¢)šòOn¥ÏVQ®ÇŒ*J¶(E»h¨»ªk”¨V;6NÕX5‘ +̶©G0!^s™ùáÉD¬2ЩèR‡Ö©_ËøÞå1û×ÇÎI8ïÚõšžãEí{ï8ü¢Õ L—YéኳSÉvb?V†V…+W¨í:‡l(AÍ‹”äOkÇÒÔÁ•vD"‡7¬x×&ZSf4† ‰ê8üðA^S¹*…Ú‡øñ8eÀ†,šú–uVŽª“7T™UK[k…aº{fѯ=k -hôqåÀPh2Ù"eà=¦H«¹Îš·»µZÂöéÆ#ÊÄÐ %&R•O€ áÀ;Îóh¾¥ËÕǹÓcÊò)£“g¾ñ,>¬}1b¯CònD -D=¿o«‘Eˆ.£9 «6.ÄŸS3Uï,ª{^ˆnIb(»5KqˆG·Qáë1øê‡3¡; + ¥¸[ºº¤ÊJáß¹{M ÓýŽo¸-t}<Ó×õËé–àûès‹„cË HÁ)®×a "rt‰¯|x¥ž4ns %ûçßô§Ò-ÆFÛPÍ× -òÖ'µ›“q¸Fm!¨bý®ÚÌŽ™™'±—£ZÞ¥»t”crÚ°ØpéGÓJŸè!ÂÞ½;cú ±*€(À•®ûbÂ"½rEAøÌgŒkpŒô>¬ŽÐýÐ5ü¾3êØ - ê5 uVÒ”]Ž¯pH2ÎæôçVKÈB>‘ÊÝJ["gù¤x¥•%‡{ìoÜh —ä罶W ³#Ó ËO*èsmú|…W·1œR¦i!9w¥íjƒrÏíᶞÎd§ï2ë ƒ'Á¨3` ¬mŸ™Ã 0dÍÅ)´äãùé—›ù8ë÷Ó;®â§Ç.z•u陀ùw>ê¡ŸKèi¦+Aþ&b3¤’*õ?;ÂÈsà…ìþƒ
¼´(Z›Ž¨©Â÷®çLŽ6(V·û!?hšÇ"x·ëðNú‹È¥†©6â‚öSb,ÀK/²œ †ÅÊû¯|ç@…wê#6Õè%‹ÝÉå&p -?V,„Y -„ì|6ƒéšŽÄQ¼€$2¡ùÛ½óñC×m´ø£z˜ªÉ)·e&·ölªÜÞx
ƒWüŠµ´v_zD:ïËóQ½àDãî6î7«—'Øn+À˜v»ô3ÜJÃ:,®?ãRë&™ßCÏQΑ|ß=_zíýS0…{Dò³Í5ûVòªfÌj £‡ÂÛ„å¬Úƒgú# KY/mÚ” ÖÔãZµ>X ïø‘}õê}‘O˜æ©²8î#]²=x1æò(홟3LU3à dјNÅR¸«^+E¢=JíÄ.ŽãÚ!µf'òo~HþŸàÿ¢0g Ê‰ä¿ +xÚíWgP“붦ˆt¤w! E@z/‚4‘^B ’¤JïEzGŠJïE‘Þ«‚€H—&])Ò¤7ºï>û̾ç×=ç×›™d¾÷}ÖzVyÖ·fÂÍ¡o$¨ FØAî#àAQ!9€.ÔÅÎ
ƒ€?TAÀÀzv0( +ð +‚ÀÑ>€=€ýq +r†ÿj¿ä þ{îX¡~g.¬oú@ÙÈDà_íÖß–úØÀ{"!€ÿc¦ƒ +ê°`ÿüþuzü7u8þ53F Œ ³\ü‚An(VÝßo>¶è?Ï¿ ñ€€H¦?!@òÁNi™é˜*†œÞwj–í¢ø½!ÈÂZã—ùþˆ6¿´ðEÙRÛ‹Ê¡ºa¹Ë·ž[ÈŸ_ ð¯ö·ÓÃxÛR ;y¬¾·ø:ò©æyš¤V… ÉÓ·Í¢½w?>\¸f!%bººôÎÀкàâúÍá&qÑî Ÿÿ-÷|Z®c$ÅSPjÍ3ºfÊ: êª[Û<‰'ǼÝ}½=mû _Xž?#æ–w¿FÎåïúœEɤÔ;‚KQ}`ˆŠÔ*Qy˜sÖ›üi„»,.û¬„AîÕh1¬"%>r‘†P‘ÒjPïvk¿&Ë!×"%ÐÂÂG5,|ÜmxùåËÞ=žSMu†{1QóµÅ»ÏùüR ÖDä|äÍO?v<*Y¼ è«íøŠæâ´Ž
(àçì4ŽWӥؕ¤JÇ,ÕåxcòÅÙae°ÝJ>»æ¤u³øí«øêsNU‚±ã,=šÙûšÙ¦ûø*â?åu‹ +R~Žú]%™ç‹•`L*¥ž^M8}©d`VC/»²lþŒ<˨Æo¬ÌS†æZ‘>#nÏâc`¹`¸YÅeyÜ*.ìT Oo-ž‘6÷/’Râ$ú€«^!î4Íro8”½¦©í&yÔº™] »˜Ç#Ê@[Ú†Ùu:{ƒP«X5Ýj!% #¬ÅQZß 8dïÔIK×5–Í•—5‡fQ²®¿®¥>áfc47
Bµ“ Û§ãÿìªcJŠ)þT|ßÞ!܉JuØ=3õ10L +ú<û¬ö}£Èùq-Ûƒ~zeÃì¸×¨"ÎS ²O2ÃM-:á§ýÅìdú‹Ó]º9QN5éL /°ÆýŠº£0U´Èf r5’;ƒÇ>‘*ºiýI˜ÚKµ¹/¤u=mjîk¸gK m¿aÿPwTÕ³’ž ¥8¦¶Çú%Å:Ñy_‰gÅ™\Wë)©í6„Sy®ý?È·=eýNbâìÓ‡²JySeßVÜË›Ö_ÜÓ¥ Ï“:ûÐÉÏÀžäÍ6Óá—»‰ëÕÒJ¹s’ '™e÷ Åm2´5*ëi¿²»^“¬¨¿ênV‹~©zºãP9Pu͈ÊÕGîž'ÙÚ= ý˜ÇܨåCfñÙzéÅÍÀ7dÍÖ£ºó¦| dç ÷¤œ‚øk3~‰ó$è—w#\ßì ¥·&lŠ;Þ ©ó)=‘··XØ£±€”Õ‹2@ÒY/ Ùz緆܈ÜØBù›Bl²³óÊ››{¾OÑG?_æ~]±i~Ó:ã'5|U»Šü¦1×óÜa! r.·>8éÞãd¼øv„ÛY¹ãå»u µ•ÂËïëƒfj.¾T±VòÏsÚ Ó ¬ó¾i +–«jŠP‰¤/¥´7"ÍëOiÕlA”2
*ÆXšôM–*lz- ÎB³4ù‡4ÞDNð˜zKIv.F>ñG·¯›×e³Î[ŠUÏYû~sƒÆÌ©šä˜$×;ÅɉebØ?øµxøÖ|®¸Ó7z3¥:”EÇêÇÚâã ž˜ +{ÆŸ\Ö¯á5»Ž¼eÓ›ËEÚˆ´Å[Øž´óváP¤Z»Ñ| sV ¯º2·4eßÙêÚhJna…¤4[Gô¨S8Î÷0 } H¹‚3d6Åz9Ñ32éo¢D œš£Í ¤l~‘ÓÇ-h£ÓµaÖ8"AKðE°†WÛ|ê2GÒ˸¹óJYºœÚy®ºšÉ⎠|*yá©mÃcpMÛa’ä×·ÆÞhò$ltk>e?:´ÌÐ%Ñ•ª´}øð‘c €«½Iõijîv 5óÉ[pÜ’Œ`-–• `">ó¤VËJêdkÐBU±ÄQ#mYOkG#ÜÀ]°ybz21ð8V6±œ4±°ý.%àíeŽÇuÑÓVNî"¡Š8^n?ŽÐW˜£Ñf_öhÏ{M[LN Ó³«™%YÉPìJn7×¼^KÿJïÀc†À|å”R«i>UŠÆ| ÙTѧ ~#ÀËb\’\E±½sÊ4QeJÒÿ8÷Ã何÷@lBj¢rQˆ˜Š‹ ó+Œ,—K‹p@EóªœÀã]×ÔdXБÇl +–yܸŠ7i
ŸË³$u˜GŠmB®péEà ‚)¡?÷÷¨ùÃ]ä>)Ì×Ëàˆ·9)mdh=Ë*ð^â¨ÕôŸ¶u·êÌ‘ yÐJÞ[Õ«Ç»Ýe;vÛEšKï4¨ÑÔ{ú0(™‰W"©HŸ1ÿŽÒ%H$°îÂ8§¤§:¯ÁѳÌ!aƒZ…:,ý|ùæ•ñÝD;]þ2g¢øþà8†µuoÚUkÁ8½H¾…“ôd³kñÙu¶xµìUß“J€ ±x4£â¾"¥t~ +ݜĈC»¦†E’ôï{"<~Æ 9Ö‹$ÆV¤ÎÍ~Ä–7 +a ¸Qdv¯†Ðq ùE<éâæÕS†f(WP´±Ê,âÀ˜ù‚cÙ´Vª”Nxªžð,§ñɇ¿Mûé൳1Ø£T’ÓqD ìàæ!s¯ñ#!~ùYTù†;œÙ0å²}Ø’:YXÁú±Ÿ ü䙧 +½g¾çxosL×Ð]Þ,[]rh÷Õ@z&1û]‘Œ^ýËJùùWPÚ ~–èÜþüå<2m°~~ÜýX3¤ä•Dê^›m÷¤fó¦çë š`[¦Û>=½/ƒg¦¾“D ïn¦î2Í 6×ÉÐ"kH gOðBÒ\V3ÆqßʃñÒLç>¯íÝ àV’WS´±«ŒkJ9odc6¯qqk!Ö¸ú\Žþ<vd*¢é}oé#ßSÎ8kb˜F>Bç(U?sss¯ÈÓ8« ûp‡ „߆ð±ÙÔ3+1èó +…Iš=ñº?Ke 7bKËñÂ5Qx\èpX)„¦¤;ñ"OÁµýËw”#;9ïÇÝO·î#o°V0b¢â@?ë=y©ígAscÖ‘}‘×Öé–9l$ìØÙ¬õ•/?Vuþr„†·H¸£¡iD·C*4¿aþ%!¦Ï€„±’åFÇЪŒìþÆ%GÁ•jØHŸI<ö¹M €È $Ø^-XTÆ ‘gØÁc\ÆÞ͵Tµ…„Deˆ +&æe}Rœ +ÝÙ.;¦’ÀA8"×MÚrë,Nùr<BåzŠ&D‹7èg免P”«áô\úú…Êi+¿Tt÷"[¶ŸTýƒ%äµÅÁ`ªªr”z°_žŠ7½—û툤ÿÉk‰.ö‰ïÏã|Ä»D\ÂðÂÍM ‹ô¸»¦²II&(ß´ôâœÝ»,6%8ÛΪ¨¿‰Ç:¸z׊ËSÔæ¶F»ØC>û*âTJÄ2}õ‘ÇÑ—C„×ÜT¨ùSÌð_qóÈ|y¸”9g‘](HùF/ýÆŒ
;³r¾ ™¤W¤o+ åZ5á¿yùrØ¥:‘]å<8 +¹S¿,ÙËbš?u[}Ï Š$÷”çqºü ´>c¬£q.7U|JÊâÐôØÅa9ÈFdü +Âs²®ïxìÑ·ÞÎõU¼ çNÙ÷ÉQnÜo×TÏ’ÎuºÄN‚Kò»LµÈ¨?5Ý¢Dª:¾¹Œ÷ôìJ¢*säÝO„7
¹8 ÂtUóñpDyÒî>ÍÍŽvÓ—…tÄ–Q5ÄNXC-¼Y̳H-sû©do$óú—¯à Ðß’±Î‰1bÜÐc]#~’:"¬™âÞ&‹ÜÚ»‹½¼¿ÉAkÛ¹.ÑI%ñÚ®ú VFê}³*Īô£ Ê䧸IùdYÙÔ¼2WÀiéùô\Sç=ÝEWäÎ1æqñ1SåÅu üI¤[E¦Ç§œª5Ï®s‹ó<OV'ŒµÂjV,›Ã”•pKO£ýç2ca¶{¦IëÝÍ)fyk»G#;ea º Îøj ×à8s(ëtnïÔ€‘²òP
N•–Οö…ƒµ2”Ú¶‚J0¯møyÓçf¯2§Ùwb¤Øu£ôŒK.òz´_¸/ œ©îÞÒZE¸v¿“6#nÿü¥sïÔ$³ ñ"â] éq©UÑS/ûDV°èxßû#rŦS¢Zº© Ò2§g”ÊýZâ.>•o§Úo…ªwÓ,•´Œ¾…©XLÄ–dˆŠiÓ +D=¿o§‘Eˆ.£9 «6)ÄŸS3Sï,ªÓ/D·$1”Ýš¥¸ +Ä£[‚¨ðõ~õÙЎRÜ-Ý]Re¥ðïܽf0é~Ç7 ܺ>žéëöåtKð}ô9‚ÎU©層à×ë09ºÄW¾ +¼RO·=Ž’ýóoúSéG–c£m¨fk +ò6'µŸ“y¢½Fm)¨bó®ÚÜž™™'±—£ZÞµ»t”crÚ¨ØhéGÓJŸè!ÂáIwÆôbU +?V,„[r&Ÿµ±—±Îµ™°ZÕŒÊ_>zL‘]º w§3„úËDkäÑN! /
å¤/¸SqýÔR¨¿à Lö+\ã¨ÔÃODÇß Æ@ðWû¬&V‡KÄNqƒšž[¯¶ì=’ÏEU~5Î4»¨6]Í‹9¬±zýÚ-ã”™GÔi ¡Tp
ÓYÂnE¼=çOäú½ùæyGŸÌ$IQû{‹2#\ +„ì|¶ƒéšNĆQ¼€$2¡ùÛ½óñ†C×mµø£z˜ªÉ)·e&·lªÜÞx
ƒWüŠµ´v_zDºìËóQ½àDãî6î7«—'Øm+À˜v» 2ÜKÃ:,¯?ãRë&™ßCÏQΑ|ß=_zíýS0…{Dò³í5‡VòªfÌj £‡ÂÛ„å¬Úƒg# +Y/Ým:” ÖÔãZµ>X ïø‘}õê}‘O˜æ©²8î#]²=x1æú0홟 LU3ã Ȳ1Š¥pW½VŠDg”Ú™] ÇCjÍ^äßüü?Áÿ Da.@”3É..„Œendstream endobj 715 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 46 /LastChar 122 -/Widths 1353 0 R -/BaseFont /NXYYRQ+NimbusMonL-BoldObli +/Widths 1354 0 R +/BaseFont /PVJASU+NimbusMonL-BoldObli /FontDescriptor 713 0 R >> endobj 713 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /NXYYRQ+NimbusMonL-BoldObli +/FontName /PVJASU+NimbusMonL-BoldObli /ItalicAngle -12 /StemV 103 /XHeight 439 @@ -5608,7 +5614,7 @@ endobj /CharSet (/period/a/c/e/i/l/m/n/o/s/v/w/z) /FontFile 714 0 R >> endobj -1353 0 obj +1354 0 obj [600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 0 600 0 0 0 600 0 0 600 600 600 600 0 0 0 600 0 0 600 600 0 0 600 ] endobj 706 0 obj << @@ -5619,45 +5625,59 @@ endobj /Filter /FlateDecode >> stream -xÚíwePœí²-î<øàNpwîî0ÀÀ -rµ°X™_îì]ËÁè 9 -ÙAš×`aßy\ Ò@§ÕY~Š“·Kã›–%’Â! -ŸíB(Ö†ðÖØ»±µŠ°
‹…,×ëb³’ª*w3¾é‡Öm‘$Œ -½@}ëœ){Çw“·µx´Ë‹D®¯ã#^Á2j¯õ–pÁŒ[‚‰³¡qòºãïùRì}¡LÓ¥›%'!* =wÑvÑ*……Ûš ,T«âˆ<vIð"4P‰¡}ë¨Î ¥ -åUgw¡I‘ý˜sFÜ
¿|Þ˜>è9Di‡Ù5[ÅÄHÄi‚=ÉÓz°%ÈûÔ'|Q/:Øõ³à ‡?mn¤ârnoÍè½
ŦÔê;@,æ!ŒÁ•f£E% ¡keÔŽ~$ƒ©é[*":]V]™¹øLÖû“è–ÖUw‚{çĘ ¯ûéb0n§ 3‡}ñcÒMî,åpàNý¦)³Ybº ô›<ãZ»J 'ßê‹T{YΔo¢EòªEÅÖÊ -×#uŒ dî´vxcA°Œ(ÓåNÆó•“ø Ö°á#ø ›YY¬ ¼ -SÛ7Šlzrs;Ó7_%w—D0òŽó Ú.Ħ›k𲳩1PÖ¦6²KÈguZíÅsX!ÄG…w‘èêÆÁÙzûŸŒùTzŽ|=šÈ-Ñ*鹂ŸÓñ zŽï‰Iö¡y¨Kï–]»î:b(WýnšvòcƒN„dy‡Qr
´6[¦$Ös•ä_Í‚ -\Τp£I¤3D,R·àIÉCÌbúÝÆcöè¥}p›¹kÞV%_²[¼Í ®SW<G€ß1৖§â\ÅX¾èLœ"b¡$¶œ’›àÒFí‚þb¶]ø99Óé+æÍ;¨‰¤sE’L3g y¤MÐ ü`fUfÿÙ°¬=·—Ü}^λ]ý&´
Õ–k ¾V -¹Oå_™xãf·ˆÃî¢l]áùGŸžQéDðE+_\Æ´x]ÄøB
Î5¤ ‚ª§Ðìª :° - åÞÖ,„'µEjŠ–g-ÃS¬²«¹
cùüÞ:^Mö2æ!r¦*Õ´]“îÉýõ¯
4öÕÇ°ã¶`4½MG”nNÒ æ
˜Ÿ³zG˜ìrºdéó)| ˆ“]È¥dõÅgy-š~ˆ¶>5qNÜ=Ü×k™¹æýµŒ÷W¦'Â<c˜ G›'ÐíËÇCN5óþ³+ØÂr¯ÓkªÔÃo›¾é}½K!>«žv†9[jä[oíÓ¯§×Ð~º·4±ó+
îÉs*¡Çˆ½¬DWŒ H;,ðMAK¡†Vª’½? -VJ•Ux‡Ž<{-o‘òzzQ vŽnHᣎìÁëŽLÜÒxNèTúÁQÕdÂt¤–²ž3TK¢³ÐÑ.ëÚÑÕSíœO3†<—7?¿t—F=ôFé¶?^K” ½û‰×è€{ºÌyÕ…G5ÑaÔ]:»4aNØYW¢ öX“S -Ö ** ñgòñ¾]Užx9ˆC†ÿÜåx ž„î(O®–ØþÛŸÒè!Káüˆ jª&8^µêð‹šn³•žëÜe«?âåßpÅÙÀÑJˆï D
¿Áó4lr™‚pFmiøÃ÷¦ð(cÏžƒWÐÈ(ò¾KÄQ$x*’)onud€F›f¿¡™²r*f ¿+báÖJº‰uX “>ïãFä~vSè>ÁÞùEYZ3íüúiÌH,ÂÒ‡è Á9¼`£x¥Â-rñη,ÓŽ<‰ò1‚Hv¹5º<xµÏ¬Ö ‰¯Î¢,ôg012ª9g×7³}Ò†çA§YŽºDârî~1³ŒÖÉ™· H-:ýì6„s~¾ ôy4°ê!?îŠ|GêÓC¤Ø ŒÈíFœ˜è!€?·_©è††ôƒçAÿ)õ€—‚pmJбV™¸ì`}%Ùˆ©®š†Qsäa¿ -K^{ ©{áDí,kGãçá íÕ+LÜÞÿ ànTJõ‰<µï Œ-űÿ–2y» -¬`ôÔ’H:ûªW0^¿jÁfp›meÑ7 oVÿàøûTqÄ”–-=)¾½´?Ò·ð5áH-. Fjóô6Éö‚ú ;[–aJÞÆy |óÛXE{›‹ÜOgêú5V0rf9 1Nw&†Á[íG·éä´¢4í˜3/ÌÞÉ…ó¢D¤ý¥õÚŬñV9X‘kb7Ƚˆ#ûš2‘ ¹¡“›ªß±°`Ññ¶AÏ‚òò{ûZ -œ®ÉÙ
@œË¼,îmÕãÐ܃PñóFzb*å´Ù¢MzI{ -ÖY -ÎgÎ< Šl’ÝVà®õÙ86„hd‚b•…‹q?þh8_JƒàôXMàÙ¹[ŸGTtõœÝ%±_~MgþDõ:ÚÆÇëÔ³
?ä•Z -‚—y´’,¯K.Œ¾DKÇ5Z¤Üiö•®‡A‘Ãn•?•‰†Î_#ppÚ“øëslg°ˆ!P@0ŽÇ0!IôqªyÕ÷ƒ, #ÆM>A,†o†•¬‹ÉV3Ê,ï42~(ã³
C‚ý(]åÍ\Hæ?òÿŒ½My•Ô»=Iñ NiõÉ -ˆ'{€<M5Šóçþ9#Èï³ú<4Wkë] -ÀV²À&rG\@¡2;º‰—ßpq1±nÑ#›·ž´ÖLÇÏróqøØY"’*ùý,¶Ý0‰¢ -¿Í•¥,á 4[ì‘îeÃüd?i‘âÊôb!ZçO ;í,§©ñ’‰0Ò*Ãj»ìép细ÖKLØþorÍ¥ã;»\Ç‚ÄæYq¼I›Ÿ êihëx6ïè„Ŧl»½µ}KÐiÆé`¸YKqü>ªŠXà¢8% De‡)eZ=éÆ5¹8šˆˆÚ@Hø°û,ÙÕ©¦šc£æò€çSÌàŽ -·ÏŒ·…âŽó^µz2gt_‹^)»ïqŠ;AQ3pÀÇ÷óÊé¥ôv8%þ¡úƒèÙnä°ù.ûÇ$˜'¶‹ò¢¹›· <S®e¡Á‡9ÌVªèË 09‹Ñ÷„½ÖµD 0ètkl+®®·éTŒòÊÇIšˆp–ÊE%ÉåK_¹ZÅSýwÑSÈ™EUŸOcm·#÷#æ¯áÀ%ö?>MWÇÞD±Œ·<RØõv”úHÆJB4B1CPHxB´v?°s³Â¶> A~Xû ×iÆZ«¬²·„ Ñöà`Ò+pì†ñY‰ Òduéì½: šê÷}'F4Ãɯ2‘¦ák±Ÿ~×eÐæ¼÷rB†A|t#¯]vË=~gWƒàFòµAp)jKâ}*3Ñ4W`æóý§/Ü兓DzÂÈ×êŸ/|Í8/mÞ'*ø~VŸ‰|sófbrµ®]ÒÙ‡ÊÍóI:˜S±¶gšÔ¤-¥D8fv»—RŠñä @þ›ðšaîèáÂb&%dY7üõÄGË£ºî¬ ø~%ˆôH¿j7Þ›×µâ× Øiœ%úS<ËPÕlM•„ïãø5ûk *«B¬®&œ ŒÖÏüͲD ¥÷À“ ϱ´5w½S~A®}fÂ
`sÛÀ¦f²‚ºÎkž™Ú‹á‘IÞÓÁ¤P ;Сv¨5eñ¼® ZÈ÷ÂhÒ®»èü`qú£^kMà7ž5 ¦XÃw¡Ð4ý <mc¾©bþ<f’¯ ¦³‹€F×ÚdÖ= ä}’žç•ÐåÆæó§"~aµñ‘{á./ç ?Ö*ñA/sP죙žÀùpLˆ]Õôü-aíÔPö¸;üyîôte`›ä{ -,ÄI·0÷î£vI‡B“qN„^ Ųá¼* [Š3œQ—ÁVå©“6*%`÷"£ž«oβö„§nÉ`®Q $•¬‰I]¡Îw±ZÅçþ*ðmÐèîň -U˜À%Û¸T?äx×Òh·K¹d Á‡©ù¡ë¼ü§:¾§ÿ‡øˆÒ£wõø-¿ôºõD6ê >QuO}•ý*ÐÚ¥Æ&v¾]ÉšŒÉUþ^ñM%fÍÎ+ª‘S¿³Ïªs †]Ì™ƒ
¤4" ž?ˆ'%¸ î9 õƒó‹ }ßùqØ]–]k•8xEký²eEJ4¿° ’³úBÛœ!¿E,~ãŽT S`Û$螺úˆ)äÎX¥wç}¡‹g¨’ô¸ç¡m¾Z„Ï€ÄÒw°e³ÿ6¤« Í@MýSô7nDAðÙg·u{\úzoáiC&‘RŠVçÇdA¿W"MÎàŸX]2P‰éÐ.ØYË ÍY.oiªƒúˆU÷ÑkZlü!µ9(1Ÿàd ¶aw¨É¾ †µQ1Ÿ”¨9ŸDv2@&*•ŠíùAùÿÿOX€fήŽöfÎv(ÿÀ‘bYendstream +xÚíwePœí²-î®Á Npww‡à>ÀÀ +hàà +ºÃ¡¿ŽpÊ!Õ×®ðŽdÚ©Û£ˆëIÌå1ñ:–¹M !LŸ+ÏS·×Ö:çñkÏñù È [œÒ¡±Tlü+Û¿-ë•øET×—mÚ<oR[¼Óf0ïw&±½‰2eé²G$QnXß´gÕíÂ_ÙM0¿ ³ Ë]ûÛv¢^íH•%Ü’(ª»Mðîïp[¸x³ŒÎ¶imæéú‡¿ë'
Ú „ÔEÛ¬Ó]ö ~!þãømýgRj$¸¤g2¤’Ä¿ïßæBýôQ2í¡8¹ò*Ö!rEºg²Y颺.€ú ¡Yœày¢f°‚mÆ™¹@ aæt˺—X[Y¶Ë¦’åA$o,çí„Ùš”ÜÝU—w3&´|!| —
Ã8¸XÁ⨡ +µÚ4‹î§AmëÁ$‘u]žœ¢ ¤é{þé
o)¯vzÞ·þ° ŠÇ~”0†S¶_EÑä¿XA^Àe#Ì”ŒCš¹þvৠ+ýƒ¹`Z¤†.,¡®Çsõ *haç"¿ñíéâ 2üE 2î$ÏOt:Š«
ŸÛ¨C™`öQÄ–ìëñçO¤¶"æ$:lþa8§}îsž©j“vå°yD±^¦ã z—FŽÝ†ˆ© DÏ®BcvgÖ5XØw χ,Ðiu–ŸòD~i|Ó²DR8T‘ð³ý@(åÚþ{7ŽvŽa±Ñz]|vJUånÖ7ý°z -’„Q¡¨o3mïønò¶ÿõò"±ë«Ä(,XFµÞ.¸qK0I4îÇîÄ{¾4{_(ÓLéfÉIˆ*aGÏ]¬]¬jaáv… õªø²!]J +jEÅÖ* +Ý–”èíC›ÇO/äÊBEQwÚüEšm˜§/Þ ôRų#m ¨Šç öØ +o<sW,³âVݘ”43>Jªb¯-ûÏ¥š¯ :ÜÒmSÂcòªÄòGµ›½d–ÝÒ±çfÐ
‡ï*7? Œø¹éݦÕáˆú»2Âœ; ä!X25#ÐjÓ¯*™Zðg‰ æ²M¦Û&=N„¡#‰ñô¤—l.gýiŽõŒ'S"œ+€êæíFý=õ1¸nWQ5’F”ÕØ#Äù4]P³sÀ‚Y~ך4Á†Ç®~„ír ݯ¨¨è& K‹F¶òmis–rùÐe'¶“ná}%’,Rñ|ë,ã>aL¦CÁ!0Y1'Ü¥çýüªP XXÊH<–êĨŸer¥¹ãyPå`C—@Gr›Ô!à–Áa•NºÎÄ{eBÀ… P}jlî'qþ z#„y ڬȧ¯úc
ArÅþÃqf§7ÅFù{ ÂÎ;x’›¨ÇOÇ™œØνC;óA%‰|ó;ÚŒHö“IÁi²Š1€À+,lÙ Fl¥ÁxI¢ŠØcØ,ûœÐ×o±©yÞ<œ_4Žø &Ñ337c†u¯ëКuÞp¥Ò+¥ÖU´vûŒ±³Æ¡ŠyT$Aø<)^Ô1&‘»¿¶Ã †ídD™.w2ž¯œ$à°î„ !ðØÌÎfíàUœÚ¾QbÓ“›Û™¾ù*¹»$‚ññ8Ÿ°íBŒaº¹?'‡emj#§„böm«]²x.+„ä¨ð.]Ã8$Goÿ“1ŸjÏ‘¯G…%Z%½3WÈs&¾CÏñ= é>4Méݲk×]G ÕªßMÓN~|ð‰,ï0Jž±öfË”Äzž² "Ö,¨Àå¼A +/–Tª1KÄ"} žŒ"Ô,®ÿØm<n^Ú¯™»F¾*õ’ÝB>o¸Ny\é m< +~Ç€ŸFš[pcù¢3yŠ˜…Š\ØrJn‚Kµ ú‹ÙváçÔN_1oÞAM¤œ“*‘~à0sæQ@ÚtíÁ~Ȧ.ìó?–µçã’»ÿ˜ûnW¿ mCåÚÅ‚¯•Rî“CùW&Þ„Ù-’ˆ»[—CxþѧgT`&1|ÑJã—1 `~ PVƒs
ÙÇ„ Ú)a4»ZÇ[X€ÆF¹”2‡;mS¢ª&ä GÅ*‚b˜Xõê¬ÌyÏë:°íMhÛÔÑÜ-¨‚Þ¦!anPÏÇ”díFÚüÚI·«³J 95ò«‹iYïIôÉúqËñú“=ŸÑÒ~±úMuk°¿„‡dbMTß\4 6ê:Úq-u.Á +fežÜrßCï£Üvµ~~1«e¥#Zç»×ÍÀ n®hÆÎJ/_Rîd{!ÏԺǤò3ìóðæ÷`¹’„¾%1íc-qlÇÙ‚iW¶tc L{ þÂÄkIcl1‡E5Ã6Ѭ 3€wXGZ´/dÖýÞ=“?Â5¨r!>Æh~X ¾2 +×IÙ.C h’Ŭø^AQ¾f!2¥ý+RS¢°k¾R•]ÍmËç ëDuÙ˸‡è™¨tÓv-º'÷W¿6ÐØW #ŽÛBÐô6 Qº9É&˜7`~b8Ìê a²Èé’gΧñu NvA —’ÕW”Ÿm´ifø!:ú4$¹ ÷p_£¬eæš÷ײ‚®LO„yÆ0Ž6O Û—‡œjæýgWp„å^eÖTiDÞ6}Óû —FrV=+ì s¶ÔÈ·Þ:Û;§)^O¯©ótoibçWÒóÑ©„ #þ²])Š2ã°À7
-ZC¨JBöjü +|Ò‡ b9¢Ý—B”Óeß¡#Ï^+X¤½š^Ô€ã„R|ÿVöàÕâÞ¼ÒDNètúÁQµd¢L¤–²ž3TKâ³°Ñ.ëÚÑÕSÜO3†<—7?¿t—Æ<ôÆè¶?„^K” ½û‰ßè€wºÌyÕ…O=ÑaÔ]:»4aNÚYW¦$ñX“S +sÆ@es‘Xü> ¹eéN!I±rÝ<¥ImÓávL^ Vc°èé4%ÐvcŒ~ŽuŸÚ:æšÐ(^V©FšÉFÊ„5¦@w:¤ªO!¸Ò:¨M„Páüòo nñ=¹/ )‰=D¬™‘x™( ;o•94‡Í‚¹m.Ïÿ&yj:f•… +ã¯ç´½y5âC̆7 ’gj óÄâ|ÈÂÚÔ¤à¤ò„[ZÓôÁûòúêFù³‚V"vÏ[´¯'›0¡'Øüˆu‡Haq>æ–‡›äã#‚ +[ê©úɱշÆ#]ðN«³¼6m¥‰8\mm×–æO*Ídœà?Ôd&ùãͼbÀ`›ÂQ EÑöý¸R>™üý‡Âk<7½¢ŸhTª*ñ!þ™ï¹ûXâ%|‰ddu:Ò_'r䕯w–Möaª 4¸Í(#在žÜköÓ?%
sö)Y~;=N³2€†»F +Ø Ÿ;Â[·^[VÕG
ô…›Ë5a¯Õ<M±kÕ¦1±¼âÜ0°«Áé&%=ösݨÃ8àŽd*vHᓯÜh¦îÇm0²‘¹Ñ5ŸkÞ²±ê"Ÿ¤Çµ©éì¹Ö-w^þbYm(<rq=ÍÆ$fò»Qf?1áù šÖ—æ“|!Ž(]U˜Z²*¹¯êë ýe<®mÒ…œ¡—7Å~·À2ÂC®,0¸úG”ý
) ÛùáHÁšCEÅC2ÁL>þ·«Ê/qhÃP៻ AxàIèŽòÔ*a‰íŸñýi "ñ”Îèa¦J‚ãU«¿hè6[é¹Î]¶ú£^þ
Wœ
„úž@Ô ú<O#&—)‰fÔ—†Ã¿7EÆ{ö `A#£(ø.‘ÄâW¨J¦½¹}+4zØ4ûuÍ”[1[Èhü] ¯VÒM¬Ãò˜ìy /*ï³›b÷ ÎÎ/ÊèÒšiçWOcFb )-}q‰Ïœ# 6ŠW*Ü¢ï|Ë>ØÁq‚'QÞG«Á.·C—‡¬ö™Õš#ñÕY”…ý !A¦S3çìºâÆe²OÙð<è4ËÕhB\ÎÛ/f–Ѿ39ó6©ÇfžÝ†ÒanÂÁÏ×áá–>Ï€V=Æ]‘ïÈ|zˆ•T°¹ÝH’“=æö+•ÜÐ~áâ>è?¥ ðRM :Öª” ¬¯¤1ÕUÓ2jmƒ<ì &oÅ•M<Ã,Aí‹K oLÇ / ÝžKÅ7™ ¡„<¾Cšì+Í5Êhk£JVY+x°À Bú€ÛH¬æó§˜W+° +Ún3!©E:qg^˜½“ çEÉHûK뵋Ùãi¬r°"×$n{G4.ö5b +C'75¾c aÁ¢ãmƒž•å ûZ *œ®ÉÙ
@œË¼,A¾‚úqhîA¨øy#³ +1j ÚlÑ&³¤= +Øcîmë5+ ¨38…y-5*6Ó¼'G†I¡s*Éžš<ªf'&Â÷ ç)7+9Si|пŠ·ÖC7¿¦´kEª3¡1/`@;ý‚·ÕØ%T¿h¿÷m UBÉg €Kj2ç3gžE>Én+p×úˆl J<2A1ƒÊÆø 4œ/¥Epz¬&ôìÜÿH\tõœÓ%±_~MgþD õ*ÖÆÇûÔ³ K½?€÷£–ò>#¹ëlY–ýaIø +•ªÿ^²~wå0§÷>¬i¡”Ðer;á2 \ŸS2ûkÿÚÙJ=ñ8ªÓ;åȲ¦ p«.©I*ΪoFãÄjèŸ*˜®$rرpVxO)ß-.LòV"ëàÁËð:¾ßOw(ʽ +X£ÏÕ½ÞÀ
¶aøz·#
OÈ +B–y´S,¯K.Œ¾ÄJ'7Z¤Ýiõ•®G@QÀn•?—‰†Í_#ppÚ“úëslg°ˆ!PB0ŽÇ0!)ô j «ïY:FŒ›|ƒY Þ +[#’¯f•YÞifýP!`9†„øQ1º*˜¹’οçÿ1›†•Ò»=Iù NeõÉ #˜' g€"C-†óçþ9#Èï³Æ<4Wkë] +bvÑCª¶<áVÅák…î 4ÛFüÀãó´[OÝÉ›þ(œ6®°Gɹ|ðzCà"å:.B*´ +ÌÇý¦”ït†ˆQF'£•W”‚Jî‹ö¨RZ»å>Õ;v×òu"Bä—,IÆ÷ +?tBVå äÓÒ·&ŸõaðÎÑ3ã?ì‰ðˆz)ýþŠË¬MÜöõÇÈR‹[uYÊ â™xŽ(ä ©rLx¹d0©Ù¹9›—€¹`eîWœŠjÍ`«
rëáeÕ0Eg—¬ÀpÛco:,Cú‰–èÓT` T콈l ×ÓkŽÊ]5É_oÖÏ +¿Ø„× óF¶?0PA–ßâeP¼šxoyT×]ƒ ߯ q‚ éWëÆóªVüš'ƒ³DŠgªšµ©’((_«¿ª²*ÉêjÂÉÀhýìÀß,[Rz<™ð<ËXs×;åäÚg&Ú +¢…~/Œ%뺋
Í_g>êµÓ~ãYbŠ5| +ËÐÿÁÓ6æ›.æÏcÖ(‰…4Sü4ºÖ. ³îñ à“ò<¯¬ˆ.76Ÿ?õ#»Â oyù£ðc
™2 ô2Íû>Úé \‘ðc"l誤çoIk§†²ÇÝ‘Ïs§§+Û¤ßÈ„ÊMðʪìW¯> Õ ÅŠJ~à‹“ç—=6óÎ/QP<Ž}%´5*¦²ÍÌà‹r][¸„ìWMfRA¾.¼Ôã· v’ówØøÍÄVn®q»7OçÙ`°W¹(ã#ðmL¢mÚ¬61$"ã”’OãÙ¿ +F
]bI“•C·v0ô]ïsŠ×V*à& Æ:-H<c°1ñõZvO(M DÁ™UnçÖÃMLw¦¼9Ìʘ'f {‚HòZÆpQ¹e熶c08*k¿^Z¨¤ü”÷« jÒ ®íVÅFDøqÍGLÎL[Þ»@7U92ÇŠ ®•pTæÁ_Š6E{E-”»ì“¡ï–á䨓Ôò‰÷Aé‘E +ö;)Ó5†90öê8’ÊøïSÏ]m/‚ƒÐ _èìûD"6ÅÐ +ó/
¤¤IÝn×ャÃH£J©´Á×í£\^"^?m¸î#ÜÓã¡]?Âǫ̀ôÍÄ ?õ}ŸÔ½ºCCv‰ ØÕÅóØôÉ‹ŽcÄq ÙÅÄ 1È‚ ÓÏAK–&ÇqJáw‡í¥óðq-²º5{Ü9cúx sœ…vtàtf>Ø.V/èàl)]ÆüjEÞ)â0 6¦±/ ˆÅˆÅðŸ—Â>¦O9L:»åcþ‘o†,
1ÜÊ È6dðdrx·±+ + þuch`’W ZÔ6¿©Rì2oŒ`¨ÍÍj“( FM›c¢JëÊ<^=¢fÎ(V«¯|^z‹DÞ»©Ú Ç«×4úóeÍQCf¼5-LØñè‹9 ¤ÓlêÏÈßiÚNŽKš.¨¿’ò+sÈî/ ÙXй'ŠÝSu÷ _g““X® d–²žÃ2ÈÄÀÅtÑ"Ý +GŽ—z¥YƹQëкtšI–X˜‡1·Ee#§r}›áŸz±g˜$>ÈÕ&)׬H1ì¶SdrvëOËx0P(îée¬-ÒM `¢!03ðÜW‰M^®#Yâ +.„²5ÚþÈÖñ^ž /|†Saï½ ô»ØIvê +Ý»ê}€‘D= Tÿéâö·½‡žëÑG ]#ÂâuöñçP2ÀÂ, +ï:/ÿ©Aàé žµ@vô®ž å—þA·žÈFàQ=á'ê²_Z»ÔÙÄη+YS1¹Êƒ”ÞTRcÖì`Qœú}V› v1g1ÒŒŠ$| OI q
@Ýsêç?ú¾óã°!¾,»Ö.qðŠ ×þeËŠ”l~a;$gõ…<¾9K„‹DüÆ ©8®À¶IÁI3ýSȱ$FïßûBßP5åqÏ' KÇ|µˆ€€‰¥ÿî`Ëf_>´« Í@MãSì7nDAðùg·u{<úzoáiC&‘RÊVçÇTA¿Wb-ΟØ]2PÉ™Ð.8ÙË ÍÙ.ò¯j|ƒz]÷ÞkZlü!½989Ÿðd ¶aw¨É¾ ŽµQ
1ŸŒ¸9ŸTv2@&* •šíùAùÿÿOX€fήŽöfÎv(ÿ†ïbPendstream endobj 707 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 40 /LastChar 122 -/Widths 1354 0 R -/BaseFont /ZFUKPF+NimbusMonL-ReguObli +/Widths 1355 0 R +/BaseFont /CVJLMQ+NimbusMonL-ReguObli /FontDescriptor 705 0 R >> endobj 705 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /ZFUKPF+NimbusMonL-ReguObli +/FontName /CVJLMQ+NimbusMonL-ReguObli /ItalicAngle -12 /StemV 43 /XHeight 426 @@ -5666,7 +5686,7 @@ endobj /CharSet (/parenleft/parenright/hyphen/a/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) /FontFile 706 0 R >> endobj -1354 0 obj +1355 0 obj [600 600 0 0 0 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj 637 0 obj << @@ -5679,7 +5699,7 @@ endobj stream xÚí¹UT¤]“%Œ»kቻ;îîîNâZ¸»»;…»»»;…»Z¸ÃÔûõt÷¬ž¹šé«ýy“ω ±#Nì8çY¹’œXQ…^ÈÔÞØLÜÞÎ…ž™‰ ¦¬¡hdccd ´—¥W¶·5ü5³Ã‘“‹8™¹ -rp²ÿëaûûK¦hïìâlâtpüͪ(*þouºX¹ü“ÛøØ›ÿõ4µ7qýgKÿÂþÒüE]Œ€vÎ +rp²ÿëaûûK¦hïìâlâtpüͪ(*þouºX¹ü“ÛøØ›ÿõ4µ7qýgKÿÂþÒüE]Œ€vÎ ±ªVõ¶ý^ Nc_ñõiܬ槕Q¿ÑŠÔ+«ñïPYŸÌôZ#Ûõ½¼6SºßS7Cç0ÂþD¶X>ªO¯Æ¶aÕl¾JüÁøÒŠu wßùöüh¨ÁŽ7n- ª}»›ËÏì¯ò[ùwµ gïèÕËä‡× †¸ºŽïÛIZR
» ˜Yâu#1¯› t,’‹¤×CMMW•M¬îÓ–$IÁ]•Ð}}™ß×(+X{—üÓHï=s]Ô½í<›Øáb57U‘Ct¸¹# ¹@
²KCúFúØì¸5Ö0ë ƒŽÊ©ˆtÝÊNõ‹æíùu§TþÝ4F¯ä‚™ ϸý§:Ù0Ìîz2.‡8Á¤¥"ð@b¹ð:Í(o`Ô¿kM.Z’#ï£2GYŠ nplwÌÙm݆øf[8³")Ý-Ì>ØÐÀ"¤¹ú,ï6çš#±VEÿú4Í ÙTÙ ƒ˜êççX}×¹F; yh ȱ½ýx˜!:Á<œ?-p©yó>sd³aEG2 ‰iħØä¢_,Ì:ý¡ÒI“ È ú€èç“.ª¡Ü^ó!Ozü(~”@½ð¤Ê¨JïŽ ÷(ù)I¡É’!Ë[í¿7O’0 ™(Öê/Êó#?ŸòtssÕï“wÏgWWÂù;í @@ -5751,23 +5771,23 @@ PÐ¿Ü ¼ST ªjDÒG@œ=ù¢0Vþ23qð8@R‚¢Sx†€ÀˆQšk>Ö˜IÛ»åÆnÕ@ Šœ+7ƒ¥ #xA& V°î2»“u=œÕÏ"¨¡
¥}ŨRpÔ G0Ò|Ëÿ°Á÷v¯×ã#Ði¹j3ÍTâè(3Z÷†]ö‰6$ áHý.ù2rä"Šñ.Q}Œ[ô(~áa¼ô|·g 7LÜëèi GÕzBƒ¤ìò°ôÉy,<ri5¢Ó<øQ°–"ß@X1páJ9¥œÜ{5ÖXOù!Òâ™DŒŸ-ƒÞÒ{ßî|¥Þ‹|õÈ”…;°ßUÃF rEþ÷÷>£–¢€%ÝÞû.îcäG3*Ùºr¢ê.ûÝS²Z°¶¯Üi𥰛‰àò"ë8׊Ê[¬oœæiªÈtB!N²Ma3_#”Ö‘3?z25Q«û%Tb÷‹ºðƒS‰\ ”Ë`DðÌø¹Õ"†Ò»K$šù‘ W»P-$Ô"taâ5í.§œi"2a îÎEg|鞢³‹O-,Œ'²Æ¤ùp|’Ì”‹Ò7rž´‘€µ‘‹Üä!ðvƒŸÖß0ÕBöy\åqýXkÊ€XƒÆ;my»”(~aŸ›{á|±ob’ØÏÖÙxœ=†¤…` Ö罦(h
ö˜85]‰„C¬…ù×UÎu×ÞÃ4 ?0 -tâï¯tãq·˜þ ?pÿ?Áÿ'LlÌŒœ\ìmœ¬áþ6½ ¯endstream +tâï¯tãq·˜þ ?pÿ?Áÿ'LlÌŒœ\ìmœ¬áþA Ãendstream endobj 638 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 40 /LastChar 90 -/Widths 1355 0 R -/BaseFont /DCPNPJ+URWPalladioL-Roma-Slant_167 +/Widths 1356 0 R +/BaseFont /LPMYJG+URWPalladioL-Roma-Slant_167 /FontDescriptor 636 0 R >> endobj 636 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /DCPNPJ+URWPalladioL-Roma-Slant_167 +/FontName /LPMYJG+URWPalladioL-Roma-Slant_167 /ItalicAngle -9 /StemV 84 /XHeight 469 @@ -5776,94 +5796,91 @@ endobj /CharSet (/parenleft/parenright/period/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/X/Y/Z) /FontFile 637 0 R >> endobj -1355 0 obj +1356 0 obj [333 333 0 0 0 0 250 0 0 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 778 611 709 774 611 556 763 832 337 0 726 611 946 831 786 604 786 668 525 613 778 722 0 667 667 667 ] endobj 630 0 obj << /Length1 1606 -/Length2 15226 +/Length2 15564 /Length3 532 -/Length 16089 +/Length 16423 /Filter /FlateDecode >> stream -xÚí·ePeݲ% -…»;ww(ܽpw6°qwwwww/ (ܽpw—ÂÝáÕwNß¾ ÷õ¯îûëÅ[+bÍÌœ#GæÈ9#ÉwaS;c „3 #3/@dcìâ$og+Ç bgm -øk䀣 u9ƒìlÅŒœ¼ -’ -tüWƒ¨ÿ™š¿$ŒLíl= -F6àß àï
cüsÇü¿bl@Ö ÿ›èÿ¨ü7Ãÿ ˆ´³Ñß6Ûšÿ•‚™‘ùßF“È hú älb03²þÛ£ÙÕlMŽÖ [à_-ÿÕF -ñ½¿Ý¡$ý6;›˜ ½S‘F‡‡9Lq®÷#7ùºÞAæOy«Æk™¬0\™òã)àÚŠ¯Põýè _°ÏÈ𸯠ª+WX½À4qW%¸3A pÇ‚yçNјŠhÙFƒ´¼òàH«Qûv¡;±0p•]ßt’~xd,Š‹÷xÂÍ6m $ˆ¤bŽè›a»èýa–Qº ÅZCE{˜Í¸ V>$zytgC¿ Ëûž~^üZÎ¢ë— '¿4vÌ¢€œQ(߈¼ÚóE$9>RÛòvJr —Ž!V•Qê-¦
ç]kˆ«#L¹)N[ -Y'L - Ml%£:Tid„‡ -†{z¼*†ÆO0RÕ[|+uØ<»×xB–)ûµjÃñáÛTK!ëßP.GJ¦
šïHídϷÂó‡8ÍÈÝÑìᣮ¨¹)KÔ«£" [ßáØÓz' f?r÷g‡ÏÁõûd„» Ë}áY‘’¡žRÞÃþÛÈžiu MÛqÁÞÚÖ: ÏÝu)â ì¾ -´mg!™Õ[º±dúrTýÛ·àÑï;¾Sh4+mpæN#{•x9)Âv]² O_ÊÚ"¸g)ˬÀ ó6ÌúäT¤q6`Ü,ÎÄÊ“Ê.ÆmRúuZ} -u¯Ôeø9 ‰ùXg©v«½~ô¤™ÎbfÓ@ËZ€'púÎfjûµ+4Šð9µ?çyG Åš2Ã>öá¡ èÓÍõ‹æ ©íq½j]F4ÊQc &ÚWÊ¥Œ!¤)Ô¡W;êíˆkúë¥|ÂO!xËl|Ê/"Ë ¥Y8Þg™t‹}1ü¸ê²áüs,écbDŠ‚<ÕÔ&0S™2(Ãmz\Ì#wÔJ$G”ûs uQ#JöõÖ1Œsoæˆ •X 1K÷·XøZ°˜©T†f zUàÝô¤˜:%)=ÿ¢NýÌýßáB0$awϬ&8Ž÷SMÕ@: ÿ÷6²± ‰ðJe Êq»‘€¿Cø# /ÒT
ÚÁûB2cQ˜ãSŸ_1IãÛóù´P$O´›ä…™±<œBn|\©žêŒ.ymõ¶9ŠLrd¤¼]‰m æâ¥ËNÛ” CS ÿ -Ôw(ˆ)¸ôèg¾ÜFþRM–”T–VRƒú¡âÕ€ 9«\æÁ r˜.° ׄZÎAÆØRöuaÓ^z¾A}É €1X•¢Ä<”BÅ2Ý )×BöÔÚó–7L}ƒ.DMZÖËçÒÌ¡sìÕzÇ<ï§PÙpK`Û¶— -d„½-˜vNªÊ:&¬.U~ø -S–2¶ò¦,|Uº•¹åÿŒ ²]d§ûHÛ±^ 'Óàrê¥Ñ'Wží¼IëÛËlžœ‹¯‡ýôÊ0 àU\|¬¹.wÑ`7ÐÛå/—êâY쵚ûU¿ð½@'Ã\Û#ÿ¨tÓ"¥ÍSûã†ÖÑ Ö9X ³*¶?"D'Ö ótÉ‘mtå -6¾íè†i#¦‡¨#d]™P8-ÆŒt8ñOÑÇ,«ñæ¿V´Dze<
xzÄz -ÉËh¶*”z T©
:ê %Ë×úì±m,0¼Z©“`Šì£ç!(ÐÖ2Y -<«<Æ;ƒÎdä”4éP йë×¥ß"á§KHe -¬Ÿþðåg¿ÐžT1‚ŒÙ{§ë³÷<¥·qÒVÍïl—ÎЕÑi„¦¨DäÒ)ìW¾V “{©¬1› -ºs„ŒÍDÔTQóÖÉ_+y’‡2„æSu•P¾1YÙÑ"®—tI+Œ,r]
¤'Ü~ÙŠÃüó²-e–´cOKswfÞé¬yòÒƒâÌ’.ËLÿµ_·_Ú•bȼ±ÞõŒCⶓ Сš¬ ©%˜îvNB Ä3Àu®*ó^ Ú£e3ÐWE>qßiSgb`ÑÞXpœõ
ú~0èu†£ÆBß^ ¨íHßÿó1p}PŠÇ -ÿ¡QÁ{þ -Pä±\7Š‡òÝÐBÞz¾–ܶ< -hÞãBÚ'¡ê{üŸ[gq«JNi9ª J¡ö–”ÍÎBÚ &eš"¡„™G -0ũ㻢×JïØÄæv -®t·Té„Ã}5§¯kŸ1öÖ¥¼?Pe;ö•Pö‘rû0ï}Bϼ˜\ˆ É6ù·Ò šÏ¹äçMI9!Èèm)L(ãÌSŠ›öž ™{ÔˆV"X¡…-’?.ESö®žªAÝP! j#HA ±}…KXžÌÕ§ÐÉMŠ[¤ã('©m»Ÿ >¾+›™Q…ºCTmr9ðn«!dØ}û\ >KdÚžïËeš»ùØã‚„À¹b¼ôd *Ç£GhU×¹ ->3;J¦@ÝÀ¯ÓrZþ@)%È€Êz¤a¨ädèji|µ€) eãCÊuÙ.ƒæqô~l»JöUþ ŽžØóáxf‘n#©[6ú<—¼FL¨ Õ‚¢p¦áâþòþttÁo¬‚¡:ks_V]º¨ž*Yº‚ÖS,"ƒTæ{à':¨²Ãêﳓ+xòä½o»äß(!\Z,ÓræÁÚÉŸ ð µµV$n« BA†lmº'U'ž½R›~nØõãç":E›çÎy?ž ‡
?CÑ<,ê‹DÜ(8Óv}å~õ ìòÙ¼ŸêGF¾nƒU„]¢6¼ óÈ¡@¦]¹:@¾"¹&~žûÔëâÈm!Ê ê½–B¿™—´¢´ -]éû.@U¥”¹7n0B¹TñÖ€•Ü’ü=²Øü ;ApÊ|,êºJ CåD…rÿ}œ_PHqÆ»LO…NEt"†‚©ÛAѲ‚÷&¾½&WáõÔ7j§qÝ Ä ´Öoºêe--Cª±G.y– æQ12Ò7 C}Ϥ$)S¢›#qò8R|ﬗT%’„`Ô‡>{|ÓÑ(~‰M€ì¡öÔõ| µ÷•Ý RÙŸ¿°xðÆÜ ï$xÂ1
ùê”"B/J#_“ÕK`ô!™"WX¥ž]58 áqA8Rkªk7bfRCèç`…oŽRÈeé'¶ ‚©&#É; °õCd€nzc¦}ϛ«ó~×€#\K "™qø$â~FÛŽ›–‰K¹Zð®=¿Í<ÍšQƒT¼hçîuÈÞ Œ&©ò§=&—àÈjóAŸVË pý~‹ wåhß\">ÿĺrÁ I~¹8îÖ²Ø eçmב[~ _‡Õ)Úùá!¼G âƪ̣}^jèÍeìGHj{FƒÏDI‰áž>ç;Ž;
:« ^/lü²ÏÜ!*‚v5Bw®vªz ‚/{¿É!Ä)Ý_Ò½,0‡Ä83ËqPA¨Ï ÀB¤¬PA$.Z„^™ùà À_q\E¯§nT©E|i¢jHm¯© -mO´ø$ZEZ»ß÷êSùâþqÆtd±ã±ïäœ1·+ } pyÉi"¾!¼ÈÓ‹ÞBêI†¾y¨‹5Á·n¤l¬ î¹2íib’-þa/mBrZJ¨g“mˆêia1éØæŽÌQt¡ÓÆ˃¨ -¢j)ü™pÒŠb÷"…í¬LÅí^²0 Ôô{k>—
¹§ ‚ˆàêÒ|%
ýˆëã_d;lEO㷳ߗœ×Rfå -ZcÁ²Z!å5Zn;£°¤Êîž4Üb -“â7+:¿ßå²p€‘ßTî º½bºLJzù:˜cÇZŸQyØCV`ÔÖ .ý\ø£é¬—Ò8~û§v Yg“ÕŒ1… ·ÁÅzýãÚWÕºÌÚùYÞ‘G½ µq€¥Žh” G ;èXîÙ7š%›Š K–YtÙ ÷¿q;Â*ò¾¤ÈfRʽC@Óz†¾>ÑRKíóðdêZ+%{ <V6KiH|žz:]6•Æåý̧ (j›ÀM¾dxÅ]©äh1=[SîKØ{²Y¿×Û3fãï[4HâÀfppï}:´$ŠÖ‘1
`â;Ø8§QŽVê’ÝýIX† ò«ˆ¤üYL ^R3‚ŸW:o»é9¾5¾æÃÿÉ#¡ÊSºyØànJ¾w|fjvä|ðý®PRñgž‡°¼äÃ!Šì1¬è¹Ø”9qζ 3™u° œºª¥?™l*¼~þ²[q)7Š–% ñ,L2Û#Šôï[IÒÖÆÂJÏ®B*öç¥6ÙâµÅÀìÝŸ#zç*û lãoô«âWýr)¿/©Ê»êrBIö…Úäé]›Ê®ß@¾ sL .ƒ6ß!•}º‹É÷ E‹šÏrW¹ý ¿ô¦®V*sŠâʨîø»iaŽv|Ýj0=Ø$Q>SÚ¯‘n¾€ûà3µ¨¯¹|Ï‚·#ø2òJ_×Kà?ew5²ò!msZYÝþ³Ûš6·—O,o|iVð”@DOXå¡gg'\ÔQUáÏ‹wƒ§ tÔи7uû]J8IÓ~«]Õgb+©‚±ëõúZ÷0©ÝæöœÉgp£è½»Í¾÷QöÅÒ+*A¶3M{#ˆ2¡éŸ‹\®þK§Œæx'wÅw÷q‡Ø™³G›Is%ößÕlÕ×ÙYó$;ƒ"d™ˆÞ›3™×Vc:DŸ!H™ØºASöò;ªÄ‚3:¬§µˆ6· ¿+><Æögn% ãïcªKZ¬ ý ÒEÓý°¡© -oöw¡‰Ç÷ LN(Ú–Ç•ë|¦ÙV0f†BckÔ/ÖözåÄò«ÎMüPC‘&§¤sâQOŸîì?`øá -u€2DZT‡ÿan<øF¢àƒKï¼ ƒÒÞxpÂä_µB…•’Ä5$(Z£½X÷˜,Çn=F„I1°Sk€/ô¿Ñû’-Ú%6© `Û/XwܸýŒPä°X{]‹{ÁõIê=/uµJLÒ "nÏÖ9 - ÊnQu}±”ÇËÂo¾ÀxÂO¦ßi“Ÿž„Z”ž¬ùáXßâjøLƒMw®ÝÉ¡þ‰à0߉òÐaàð1͈o®ŒKÔ2û%걓ºîöC·wÕ‹Þ «WI±á‰šæN&`†[Ë~©à}ã‘ë!–{«-ƒÐKÜ Q>µÓ™ÚHh[“+ÊäŠw˜Œ~š ‘o;UK䊋íó¢/¯sö6†>ûþøM7f“ wcå wÛƒS^‡ãIÔˆ·œ‘‘O ¡"è£á²N´(*–ñYaZÿnŽš -/ †¿ -¯)$QF!ËêbVqâ!Š–i× ÛÔáZ4 z³2„«#µùjÆa0Ž¢”½¦wÝ Ì³
Mx¹c "ve·yäÒ0Ëdao†
˜’|¨äÊÎ |ýªm¯;°”`È$ùúgH÷ôT¼‰K6lºæð°1I§Áü<Mø—Ùî¹A‘†*›Ý ´ß4èN]ÐL:òs@ˆv.BBÓØ~©ç0ϽxØÈ ¸Œ§´zŸÌ¹1lðhSe@¦¹Kz˜$Aˆ"ÆÀô¢A $Õs‚ݸHªê mªœÒòûÜ™\ð€Èª&¿o¢újt§ã;»ô°Š lñëÒñLÅ –ÞÎÙ ÆòÛÞ¢bòê/Èá‡@°‹Ôp;C¹@˜T¯+,OëBš—UÒæ7v¾µŽó"zÌžƒu¸WÖŠŽ®‰Úƒ6äfôT!m¹dÒ«?¢-gÊsŒÅ¿î•n!yªWƒ¨¡õ…*‚´Û˜d®Ë’Àî¤a‘ð7Àãk¦·nÖdsÈãMU„¼Ž8ðA;²Ÿ‡–œGC¹éâ¿q…”½ïyB –þ|;kßá4\àç¹òNJes
æ¶3 ìãdœx1y¼ \ø<µè¦>°¯Ì~δ¨ñ¬
&d‰tñ‚Üè>øŒº§ðTÍ”µq¥|rüꆸ´åxùòr ¿jÖÑy„æOä ¬-d‘Òä[ºz@z6>"Ò(K)+è¸ Ê]‚éÉ ëß-Z¿¹ùÁßP£«•O ?.Ÿ7©`ñ §„nºn´ˆ©AÅ -®K·¶M“‹PÐ-øeóù(,•Ðqš W×,׃ ññ£™”¦ £W…á觇²H•ª£ën“¼ºUÕq/ßíÇ%–Þqÿ J†tù›á8îe p©SíÊw¥N¶oéÑ!í3ày<Áév…‡~ñ¦g‰ûÓGÃPûÅ•'ëyçÅÙö°ê"б2¦<N[—ŸeD·^¸Ï×C2'!ðœþ…`—åæõ¤Ó.Çiæ’,Ýã I~d¿z`4¤‚+õë5e>¯ge&ü¿ˆh8#u÷$å†7 ~g¤ ÌÓj7#)¸"ãbø=ËÈÓF7mõÏx|)Ê ¦R+ËY'¢Æ‹f¯ -é0; êÈÞ šGû)¼ÕÝÛ•qòG‚}¢v7~ýUÌØ{/ª//¶£@¢’BxP
?×㺽v/Ò"¢³¬É–²7~õ¥-°ú¾Yâb²4GáY±Þ\ÛêùÑò:u|?í¥LTj/Ïäœän” …xÞN[³Ö´Yg$<o8ó!¯S庅{–¸¾£“7Bb¤ÖRƒû°)©5Õ‘
5e 'îäuõÄ]ºv&cÀ…oÊÄ8büR š?òré -GZläÞ¢Åë6}oÛ,“Nxúœ½™§~ãIf7Ù,’y®KuT§Ä‹óˆÞˆ:‘¼ '³é~” *=Ï¥aæ½L
šá(ˆ#}AÀ·åÖ•INø™Õqy»±ýQÐBþtSè³í¸Ç -Oùl_t>»ˆ„Q@·z×À!»Qqf¢Y Îë"Ìãì ]/©¦pš¶¢þz¨´ «E¹f‘SÑ”,Y¸!µx·?q¼ÀRœh·×ÚâOÐ`8 Ž÷PÚÑ¡lŽ~ñ¢ª ”HÓVß Qk6˜qØ `?'7Àw1²£;Äk§ÕùI…²™e£ -ÁÊ ýŠ{Eoa’¥VÖôJŠD¢VØ+çòêqgkSÃúæœÖJ!¾íѹ ‚§š@.¯¡?4÷k¯ÆpHmÉK HÆ`ÅÀgç»C~\þëÔƱ
)m®ðrô©:ã.ÓŒ±þ(pôs° ¶†Yi†u1`kîxÍræ N6Ór§‘Ó¾‡‡8êaì%ª?áXhu*‹e²ö×VÒôbÝMcÚí .ä Ü
SߟýŠw×ë±AV‚, “ gBsEû&·9Ó3÷–òÎöÀ¥[Œ»ÆT*UD-.ô€]¨ô€–'OWsá€TO›¦õ`¡Š»Ù†ÖáÂuþ¾ñFl ©>Ø NRȘa»CSÔ—Ÿ¶†ËÆÁdõÜBx½oÌ«·†)Ô›.hþ¬ng¬ûÛöVhNÁ4ýÔ¦zçŒi=÷·ZÁ¸ö‰ÝbáÂóû=™‰¡-í§ç)Cm=Úy«ôÇÅ“SwCðï—9C$~™¤9Ï …Û‡_ÚóWs¸ ù0.n ' ’8_JùïMæüÝRÄbI’OîÚë;Ãwh¯“J¬J ´Š^kû³ÅJŽm™ªó‘'i‹lÛüŠßGÀCÿçù#K‰}¢orL-–cƒ9MºNöÊ^âæYj—aíLY&.þˆf$Qžþjõ0Cñɇ\›€®ì³¼kÔ42uR0Ó…µöµ©k)¶¡)–—Í …‚‚Tuº—Æ6°…5ÚÅ(˳«mÀšÇÊõ™¶Ôî^H™¯Ì¯ò,µêiÝò¸: -SþÅ•ù°?UÆh´Û Æ~‹Ü³µ´FŽ ̽¨
÷`2±Í¾ ø_ÑÛ¥¥†%º %B\aáPbs–’´¯xÛŠÍPßí"2¸'\sïa øçÑõØê -ùôÀ®ß`&„jsJ·ÝqüÚy»©N¨ªÊ‚a
'±ð¾•ìýÊ ¤hö\êøÔ<{,üág`™ÁZ±Mãêà7G¤¢œ‚ñ¹ÍÃ5¼tÈŠµÎ”ࢼ'}ÍÈž›¹cU{œœ”ñ’£Ñ8þ» *\þ:X)8ìÆäG4k·D«S ½ </psð8M´vÊ#'®È?Ý(æDœ&jž]RBqf„I+=µ×õ;˜AüÂÛ©4€…Ï3‘«)Ã`&ùÄ. 3Sª[‘¾vÒE&Q†üÕ¤Â3$H˜3ÈX)Òö -Û fãu¡ÀÐZKÏ¢ÊôG„“ ?î ]¢ozNS¥•oNüÖA797mÄÚ¥âFËë -!üÂlŠÏY™ Vß‚-#õÛ"òæ)ê§4|÷4û•¦Ç\£Ù.,u˜XÞçAO¯é8h‘$?³DUŽ$ÐN—ýÀôZO ¾h¹)8’]íPlÒó!ÌÖ¦¾óí3„@ÍÿBkjû"qJº„‡›áûÛ >Ä£c¤ùÄþâ<NI×–áä‚b…&yK`à3r€ ‹¶ôfæX: „¡'*?§ºnQ~ÓRÙüÌ¢÷¿Ãs¦ yÞ$Â9{¶Å*+'QÅö* §H(ð›xrPßÞÐFñ`$•†ÔXóþÈÖxÊ ¥ô*$ƒn%Õu{¸‡£Û"Ýft
/æ.;FÑ÷·ßà9èf¤û*
Ž n5ˆò§\S¨ƒÆ+’Iñ$ÉÆãЩ$ÐÈ~f›hD"°[I r·»FªÁ>ÂnÆmp¥Z[ÆóžC|ø{}Í°†¡P®¦é§ -@á–ŸŽšó‘ŸqJB¬Í×H¬íÅ]¦m š_-Áµd‰[…©ÝG}kÂ'†¹ZñEïJ/2Ž¿I¢Û¼Œ;ÀJ?ЗXÒ²se¥[ñԆص–3—ñ>(ìí,¡’Ó7¿oØc›ŒÆrOã·¨Ó½¹`Ò^ ¼>¼a ˆË;hŒ¹ÿÙÿå`@HZ a½¥×¶9‘àÕâ¡[Ü ·Å’Øß©UøgéQuz`@ÝD7… 6˜^³&s %qßÕ±%zs‹É«I) Œ—þ[~x4ir:ÿ•Ä5¿‡¼c@'dPí¼+ Ê-ußvxØ€F -‹˜>cîÕ‡¬òš¢úcÓÕVAcB8‰à–à3†(¿Ÿ->2$§‰#Ï ²f~µÉO R¢}Ì^Ô*ëT¦9Ï^°Q¦òÌ0Ò@§…×õ™Û¡f}O†kÞÜ9ìFÄ«òwÛÍbµËØq„ÂL™§ÇÙ宕NÔuKJL:˜ Ü
õÚšöÀÎß ---˜TÎÁ?åשּׁ~Ig.äs#IR³1Þdà0säÐl„ë¤)wÜÔC‚5ZêD¡˜A|aK]¾öQŒ )ŠÑßÛ¥fÜ-6wâœÌn¿Ô‘ëZ¬×ñÂe²€KQÊÉ!qäl †ä Ã;¼Â` ¯ˆ«Ýjƒ"àFd’(ñ¹%Ð¥å Ÿ¤:ìKÐÙÖ»ûúj?ã0GLÝå/—‡ÕsÉmtèŠ 7@F.°vš\õ`òƒ_¨à@ó+ß'9/þ´îQöñ;*œî~¿ˆ\Ý‚°¥ù"@Ãw¥> -«ñh²°þ;f&õÏý tYPXÉ(ÄÑ—î ÿ*ìRâ͋MI.riAÛ³eBapX,&L˜”FÄqOÕi/zÌ-JîÙŽX!|½ôÔ{/¥Êl“”2êL¦›$ôéy¶r×òèt A3È× ¸„–MT•Ë¹#“Ÿ_«ê±C˜Ä%3(ØBN®fMݱd[ï0i®§¬Þe˜nùÃ, 2†•³>Q~Eó“l¤Ñ‡d¥K -È ¿X¤ô á€S¥M†kh_v.ÊZ°XY–×~dŠZ£þq z3„=pÔÍ*SÈá£.rYÎ8xz¡ªm:è« íƒÂfkl®õ3V°yÇݪ"|pA´q+K¯ìñÄ5ÄÆòX”ñ3³S“K¸8”Xgúy6VœOÉÒÀn‹|@aµ»§Õÿþ\1-óò$jô½·Yâ6IÞåQˆÿ¨Û.† î†!ÿ" Žíë½#kÒŸ@nüšÂ.MV5âÒžpɾT “L$*jsK€k U3P "¢÷ÇÇ‚“\e,Ѷ™ßUeÅATIˆ¼Š#DRÏãþfž‡ïDŒ4ùä;¬«"_u´©+E¸8å´•È.a«MçeÉ™¸m»ÝbîBß_S¨—,ò5žL(Áœ½¼«lè„OÞÐë³,ÜV"éˆeÛæÅ—¶‡~,¡¸ŸÆü€¾µ¦gq8¿¯Z‹—Å}á/Å'laÿ†SÙq³t‡º¶^H·âœNwÌ útaES<hpFEž u‹F,p?º °8*ü²z"¼ñ…>«¬¾lfœêð~,¯±Ni`—…Ïg Cž@2|§ãÓ>ú6.ûW˜ï>µ½Ø“ M¿+Ÿ
$g;µÆñGïÞ—ÆøE×®Ú§qkERãÒÆc{…ŽZ²ÊZd;_Pº· t‡Èû/QOûIàÏg»–%E:)‰7‰‹zz÷Ÿt¸ZúŠ -É9û×ÖN¨Ó©Þ¶Gn‚‰å”÷,Œó¹ñ:Ÿ5Å=©x¹=Z©¥…»Qò‚Gc]qŒð_¿³—«º'í(åDZþ´î€J®‚Iç'«_ßÂ:ŸÇHjDõlÝå„,©qØ` G¾¬†\È@éø¦‚œ—éܪðX¢ÈQ<Ñi8ºÄ|#ñ°Åòõ›O(m£mŸ8½7¸r¯já—"Tày¨
Zì|AúßPqéí
[ÈÃù3Vì lî¾
™VÉlb¼¤.ÛžF
ûoŸJ¶ô +xÚí·ep\Ͳ%*F‹™[ÌÌÌK3´¸-h133³d1£–e1³,fff¶èù;gî܉ûæ×ÌýõâuDGìÊÌZ¹2WVuojò/êÌâæ`S‹Ï`{fv6€2ÈÎÔÕY l¯È,¶5ü5r#QSK:Y +ÿ ßÿ\þi{3°ù?S¢î´7ÿ;XÿÓðÛÌÕÉ鯞ÿ:ë þõ¿FÜÂÂàiyl&ò5#;Óå;^Þด~o7;ô`¨CY£Fqa@-¸Ë?#b‹¿Êäµ.”¥é·Àû/Ïù‡·=y†ýán\[Ú®4‹‹b_JúžBŒuš6^Æý V£2”ÌSíïË9ÅM= 6ýíqU5£ÒW8’ßmœN—ô”n…ØT¨~fé
ñ8íèM˜ß‹NNi’ hûG†º®a{öˆsã©Ý`Ph¢ s‰Dõ4«¼#æ²FÇmqÅNÙ¬ºåøîpyV#Ø#׫Ý}/ðnŽTHÔ‘‡Àªƒä®g6N^A=ÉÓÝ„ýIm;M–4 ä75moØ2É—®ò'ÆÄ+œèG ù¸Ÿ,¾ÆʹEÆ~ëÉ…tAê;|ˆÚ*ÛFD— c躌T~ËIÑ:vФ³ÅVy1UE¿®u£B÷ììÉä¯NcA.ÇâÎÁùîã2 Gnu‚‘9C\ ä³~ݬMC4Ëâù^Ú.£é>ð,ݾ {/©¨ÍpÐ(¨nâ×yðd:7¤V»'1Ñ5£3䦥c´¸€VÖÁÙð §é/˜xו¤£_ðµ3-©ìȈbqÏ ÚçkÖñX ÑÎ]m¿¯ÔC°×_pþÒ`! +GÖ"òCùý0G|ÿ~ E ƒ ^¤Š¼óNd9FhY×K4ø$z„ô–l=“zß +XÔ’]•E Ÿ:~ú$®“³àà'|0’ëMÑÛ#ÕœH«â +26xB|,-m
»Oï#LJw !éŸÁ˸ð!µ÷^†~ 1:g¡g‹V¹f"ñJ~¯dùÈ<B°D†Î=ãZ«³Ä$÷¤ÒVŽüÆçžQsQI`î¶C¢! ß— îr{žîI×sd“ÇTÇn}—˜éiMì3á¨ì&µ +µ+Hö|“è\½²8Ÿ§Êþ.àiQK¿ )!E÷«æù“lJ ѳˆÚ®%¤ú«¡0j¿v€^ÆÏæËÓ@«ãŸŸË²¹D5zs”gÇ ” DS37ó&ýÔ»Ôø”N†18/ûs2|åÀ —Gɦô<†©”L)•gÛ¯rFö¦JƒËg —âë!Ã2lGduW_[ÞË LÄu¬6¥Ëźv]å }P‚à©® Ð+Ýu)ò4OÜ1Û @´Ã TÇ®Hí
Ë¡2Ju <]rç +y3dP”÷ «ÕÔî.Amù2/…º©¦|hH í"•ØxÏ6ùé0ÝHÎ\qÓŒö°¬@ùblúpó4å±úNf('´ÉÒo„ö ”ú¯je Øë÷‡›`•e, xùlo¤g–M¸úÓ5cÎXÜ‚Œ2ñ© ix'("cÈÑ’r%yàÇ×ú¬Ð> ž†_×z»Ù¾º¾nÓ)¡9~dª{ÙýÔÆÐõÐÝB\q§d~^²Š¢ÙºM“Xëù£ñxN†¿Ü+]=5Š µœ`ýù2Ðà#âS.Þ¼tŠý#–ñ1F +zpe~¸ +LŠ3®CÜ/¯W‹D58ÇÂúKÌÁÕ#²|¢Ã1º +4*oõ ›¹ØˆwèètdMN NéZÕ‹*Œ9,ŸØYBóÊjf@Y+é”S1 ^à½êGÏHé¿…ÚŒÇ9ù³%k™¼íÀ@AxfÕá¢s“ú§Ý…=C ¶Ï OÎzÊ‚m}óŸÜ};#°]#Å(JW4ÃGóœœ)áÿw ﹆ü[qX·®eloÕø9r‡]™±u[CÁQb0Ü/LøF¢L‹à—iîk#‘àÖCC¢€[œÇ µY~ãO!Ð9ûžùSô +ïôX KÓŒ‰®.ȇc2ÒdÓú(¼£ßåz½N_Gt§šç‹ŸGK¢_ôý„ñõ_˜7±„†½+âõÄCÉKÂ2Jä5_¦tê¢OhØåÄAÒÆÖ.ÁW‰1ݬóå ^
š'`¢H #œÜp©Š‡ô-…šÂ¬+C kqÕv´Z×Ú ®I™’§oµ×›Ÿ£¼Þ5ºD Ø|Bca¨P—ö}UýãD(&÷‘iÆ/ ãïó¯ «±Ölx„¢nˆIͨì` ¬N,zß±$ÍÕ¾Š0Ã'7Ô¶¹Ër‚ÖZ¾êáo)ëtn=½,ÃrõX;%WŽ+Ìà9Ù2Fý³š[løÝåÕ¸ 2µ’£)»•äº˜ôòE}Ùºxp*&uÀàˆè½ðf(êH± ÝSínÕÂZÉv®–ʾ<Úªە¢÷³†ßŸþÂ6n•¢êRtœrí-'ØZÎ!u ž:±„_õùí +h¡?°šuÍ'˧”uþ$o¸©<®†?7D#mÞSx|håY#YEòÉ3|êq1†¦gåTî†ö ‰Þ'YøCŽAX¤Ä¼ËÌ0#FmùÜäèÑFîròÚÖû©¡£»Òºéi
¸;&×}ŸÖæ?R KCg)€,ûó=Å,+w_ˆãP$7ì?Ý™(j ¦‘ºÕu®€[î„"¸ <w½Ä~¢óWa-™h+yÃxõ¾î+ ʶºw²ðú Ë89¸4L +kÐ5켟ÂÛ&YwÁGVÇ|É$¨ËvJQ7ÀBVæ ¾e&ó;l¥´ 9œNDŒ‚œ¦á!õºl‡Yç(f/®M=ç*šßPêyžd,«È •…Â=kŽ×—Y;6ÌŸ¶± (‚u¨¸ï˜ª¯ÝÌ KTˆC4Lÿóê,ÔŠk'í³s%{gðj½hªuT°:ñ\7òx;mNø÷ûœ” +þ<%Ÿ[‹ *!h×æ¯éßæ ZQ¨ž ‰ +õt—?ߺTÁ…Nímx$W§œ½Ð™¬ƒûˆrQœc¬rg} ÏÅÇžáè Œ$"o”]:aù^¼‚:}7î'ûÐЮ[Õá«—õoâüŠè0éWnŽ0/¨nI ç¾µÅF øŠ›(ò†/¥ð/ƒV%-èͪ׮5\f‹` +
ˆa•Íà KK¾èÖ-½ º’õlF‚n Ù UêÍW„åq¸ +GîRSÛ‰ëzýyÔHÆE² º¯ +4ɶ2
3ù+A”3«òI¬ªXtÞ^íšJ ;ºÙ¬`)a^éÃ5[gNû³ÏÄ-˜1¦¹WGæ
’µëNÍ6± ®¾°01“a˽_Dh«T³vG#Œ‡i+^ëqSšS¾D[ã%ŠNZF_×ÓJa« ƒhÑï¿Œ ‹Š©L›ã•}&TgFR— ¥fírdVùZ!p“‡ÜV“«ürê½Ý° +“ÊŽ@] uéZïŒp ´é‚¨l‚„"Öõ‹v%=ÅW‘â©ŽÝ9ÔøõÎKM|xSüI(ÌÏè‰Xih° 3FbýƦAgµCk…
P{l}’˜WÃŒ÷皧ç¡D +÷Üb<r}%]K"³¨,Ó3ÜûLF|ì¤jʤŸ±$‹° +£²T¶!Õ?ûwר6KW
jî–¢VaîJ Lj¡Ëéõù]}¨]Ü?N›/´?ö 7"™ò¹2(Z,í²:Ï@ç1ÕGyy39AË>É3ýìäHô«.mBzFë‚IÿÍ™ð°›>.3%+Ö=Ã9H÷´ýi!ùÈîŽÒIr¾ÃÎÛ“´ +ºj1â™ä·
õÞÎt*çY™ºû½L3`*0¹ibs.W»š„”øöÒj9 ë÷ý™Hb+ bÙP{ÂÅ êÛ±[)›Zƒ©hY˜Ú* ~ŒŽZ™èÈÉŸNðNFmVüjÃè?Q®€ž õh7è‘2`U5Ì×Çé =Ò…ùˆÎ³.XÇ´ ³ñå" Neÿ)vxj³V 7s¡7[É EPn¼
Ù'.6 ìÓ»ª6`ÓËÏö‰:ìI¬,¶Ç g:}Ã#òͼ»Ó/ŠÜTd~eŸ‘ÇRh¼Ÿ h¯ÈO¬‡JUÈ¢Q|ƒ†gð{yb “Ýã$Ì2°U Mñì¬ü!«ýùKÈäÓé’¹ ÀG>MQë8AŠEáŸLïø+õoºÌ…Á϶4{Ÿ ¼8mß¾;°fÉã!ë§ñ î}Ûu?¡ýbíÇ-$r´sI§%=4 ¼ <I\‚¦õ¯ˆ¢ùYÌQR3L”W:Šl¿á5¶9¶ê+üÁÿY3Œ¿tã ÞÃœj÷èÌÜòÐeÿË]¡ŒÊÏo„žvâJ2è +Gˆ’çR“V¤d߶\Ù(mCä‘´ì5*(ÒòÑÜ‹KùÐu¿’Í tÔ8 Ñå&ne(Z ++½: i¹ž[ŠW÷U‚rv~ž«ïµsŽ½2H_õ)¦N\Ò–wÖ} #ßkUbrk*»~ù%βzºØ -À¨ùvS&í9I²ý8Ë]á êI[=TãA”$×Øp×Åi‡Ý¬7‘Üß W;SÝ«‘ûqô.hn] Y5|ù– &†~aªë!˜DŒ_
/?dʙŞVV·ýì²eÈí”Ê[œ=%–0—D¿ýԽˆ¿ ¡m΢¡|rÁîüéÁK>z°éUË¡Þ€IÆ̼ÏfGã™ÌFö½`ôzXwí{G¸ìÎжodž!1»w½o#\ ¥W´¢œgÐ:@è2±©ß‹\ÞTáKçÌ vvÎ *oÚocŽqÓgv¿ÈU™¹&ª9«¯s²çÈ·$(³P|6¦³®mFõI?BQ³ð ‚' ”¶5ÈD§õ9NkQìnAþW‚ê„,m©.|ªø,>G´—Úµ¸ãFÝ æ{დ&èÎnjŸ.2ßaðàã<9î!šéØâÔq+|¸ÞÄÆC ߂׳xàš· —¯óYgZ ؘ Mm1 l 3ËÇÉ” 3W\š„á£ÌN)f©¥£ŸÄ?<¸~Ö##Jꀰ]4'¼¦[ß1pu? +è½þ² I²(:ŽåYyÊèi–Ž–0 A¸€pi'´‰©N°›AèI¢F!Ï,”³ ˆ-8ÊXR 1J÷Š;ÐC–uxó4Žýx;%Þ ˜9 €@—#g¢ÈÐL„#b% Øriþ\
êŽEˆþi[þ¹Dzó
b; )Ó>€0¨®úÞpK¨˜Œ¿&÷ø QõcŒ
HH¨Ý"M„ ¹ î|‡4Øà¨6û½t+ë&70[Ÿ[Æòö#Ž‘„È »S掵ó2º]à×{ý¨êàf/o}ÓÙ½&íOšÂ·â‚ öe©nÃK § K;²PðÌÜH.£Üâ©zeyïŽÚ¶ôo›2u p,wÝ1I4â†õ-¢æ úŽÐ¢~IÑ=.+ +G.ã"*ÙÜÉ ’Tây'Ðï›Ò N‘* +Sdhi fÑ¡\ØwªÚ<èJ´Ša™Þ€è[á."7†D²BèZ.œÚÞ#âÄ›Ä{ ²ŽØç2jWˆ:ècOI̬(p½AGp»[Ñ 2Æ1Âò a¬HöÆ‹¥0´ñ($ºjΪáu_Opdì<Éå¶U¨Ôxãе~†ÕÚÁ$2cAþ®ž«0+Ú «ç`п˜hÈ"‡=Ôö+=•îEåUÿ
_spЬ_úÉê<]ü—åιq P[ƒ¼ ï?º“ĵ”‹zÆéc˜ü¬cêˆ<ÏÚ}çQ<´²Xú”§ºrŸÂ³>dühWeL©³Cq¬tIò)U!œ™õ1T›XL¶û¯a8LÃ#2Æ\-µù'Þ¹ •è>©MM$QïxõÕÈvû.¹!uQÄâFÛÒ±,•DlöžŽ™al–òÛž¢bªêw(´ˆ rˆ‹Œ°‰bBš÷®—m!ýŸŠ ¯\‚«íçEL8ÝûkH/ íãèö[Ñ~`¥‰é)¦S\H6‹œ©Í²ÿºW½…á¯^ ¦ƒ7$«98Ôke•¿.›O†èW¾“CD%Z‡L¨ý™Ñ²Q“ÃD8Ya ú2ì(ïÄuv ñQr Sän@ôÊ -{Ûõ‚;ß (=y=kÛæ1™çä¿òINãt á›õò°Œÿ1{¼ X‹ü8µî¢Ûw¨üÿœe]ãUB åê
³Þµÿ}Oí¥‘¥PfçFóä뎲gaÏýêÏ}Šqz{Ç!f +ºÄ +~BJ8!ˆË"éƒÓÊUÑCÁRquþr¡|Ûf¸¨íHzß«0SƹŠv;Ô!>Ó·5{“Ž¸úË£ë¤ñanéãJ“×Ñø™)—Q±s56`.'\¤uKô¶Ð@‘c’‰sÁ+ó¯B.w•©Up´Â•É…Ï-·ÈÇøÛ:Ú‘~õÇ)oÐÙ(È%,%_Ö;Ÿ+ƒòµ†KuÛ¢ÃJ
©hc&ÀM x ÍÕõ¦³ˆ³}Ͼ³ø‡]P¹!„N%LÖ¼‹w5áA,lõDC¬ON» ›/¥ô~¤©F—[ +¢‚‘ïƒÆº]6¶Š± +ÁVοm)PÎö„iT5 +™¥ŽF~7ß wðö¼)µÐœ«"8~y1_)úôPµœšÚ„‹F)#6/¶>K¯IÑ"ÚCPŸq W#2ÈÁu†–À3¡‚E ¸É³ï`]´1ÂSÿ:.Ž°sh+ùÅYXyr#Ы934´žÙ?æ¹4ˆCƒéTm‡˜“#Ø,6HÉwÔ[ +»ý¹3ÉŽÀ¹Hî.šýÊ’ïŽ)ã +OˆËr…º'+ ¡mb˜“Ò€›W»S ¥pÁžôö½~xe 2}ÑMS¿>iFv ñöße֗¤JÍ‚*ÙåDÍePþ±^Sb"•zéäç«™æîõ•œí“ò +Èl´GÓB5xÖ-,mÒp~Óì£Ó¨œ+ ôüÛ€s kŽ©¡¥E6©5w|]Úöf4ºáb +=ýWú+7ä¡B-ñe|Aj/º+Yn”‡¶v TxbyÞXrëx¡×¹•,Ô`$JW1yýV¹).ØózÁ4óÃäEñ|OÓAF¾ß&3ñÍv#Ùèãšúgb4ŒGÝlõ¯e%ÿÇÌoÙêñël˦NvÙß¾Ú_ÁE,zJŽ4çnVZÂ_ign“êÔßÈ$, üiÆ ê¶ƒ;.½Íp)X]ÄêÏ
(ÁÕu*ozŸ^K›¾1Wjpôá· Î-ÍŽÁuV-~¹Ç…ƒ.ë(u,1©ËnÃpà wÔcª~0–¡WŠ³"í| hµï w{ €¨KD {7<oJöaÕ7*›Ãµ ß÷-xÙ•Á‘?¤]‘’ûãË-(ü•¸ äeèG§Qç™*<eÎlËót (å · ÇqÎ1Ñ'Te Ä=L4nP¢ïpÇ o§‡þlA-I£äèW—-'» ƒ«LI%¡`‡Ù\}sȃ¤Êùzaïs¿rŽï •j $¤Ú×+h~Cwª³â²j&ûQïF±À`º¬f}g“ûÚ!â꼟¶“ÄU>,{ÍNâw +üæÃ
nŠ‘hn¥qÏ‹ûðËŇªr‹
ğ펤£m‘–[q¦V ³›
íÖë¿ 9Kjº¼p}ýv÷óûU/¾!îÜÌúïˆ="oÍb¡”kÛ\çºÊ”»½vÄË L“ +ðC»Ü“`î5ñ,¥1»}~`–C–Z Ð
ä5æÊ’ƒàr¿ªn‚ÐT8jTÔj¢éaqgšý¥¯ÿSmþ +ÆOO6Žg¥ÀFipûP½õ"œÀ«þúµ†)˜Uš™… „™–Ñ(× ~P ô §ì±=¨km`¦‹0›nÉ»“L`Èø4öŽ1®€xM&… « u"³¿5*™'såÀmý[9ó:Õ…ìÅWÆÚ1Ýóä “ˆÈðRàÏ$ <6Yà~oM ݲݪî^Ó¾Îóg™VyÄ[´Ý^ìMgŠçú¶0 r(©Oº¹,§)w쵉O×$Üí¾ ‡ŒÇ¾77BÏÜLW¶0Pá†(¯ˆÆ +NP¦¾ ç¾Mu KÎX¥mç®»÷õã\Õ=K¹³4ZS Qï$~WèáÃÝo“xûÐúƒÞ_X=Ô/´¢TI}zÔðÂÿ©éͲ/ལû + jPÄJã ”m`4X9Ù**è +°G:xá÷‘"ñ2Š^â`¦i`ë£ès2ÝΰR´*c©*î“^x^¡¶ow]÷Ò2Üy|Ýšéo aç׆rYÕ‚E&¾VÔ¦+DFm %j¯DpŒç)}åÇ`#®É]ÅŒwËX–„ÏBâ ŒÝÇê‘ ÜÿÚA/üÓK–`Ü‹›fŒHز’Tšäw|4‰TÞÏ‹5|^«ÔØØ‹y¿‡m ,té¡h¸
ÖEøè´?I3ZÜ¿â²Uß#0&Yh0È‚’»·û 6ícvÀ{ûZýƒYah
¦¸$߀½-“%;v’>‰f›–Þ³9k =ÔÈñ<½®UÇj+>ï¬ã]×xé‘ÇCÖ,i7OùkN…CÑDÕ ’o¾V/‹‰åõ†±Õu÷„Ç@2bÕ¡»#ÒaÃÛ~¨¥öY¢¥ˆØ9Ì ›ÅuùñÃÆ8¿ƒüç 2ýä3A³—‰ÏŸFM9ú Ý8›„TÖÌðÄìÑpå¾ÖË´N>»)ym7‡)zjì÷"¬¤©0=ž};[J®ÀR²ñ5X¥šHË.«Êî_&ÿõ& ®5=Ú©}A™4SÛŸ»gñšhÚÆK. @?:×üž*»©oqÅ"æ¼ßôücjÓ _ 6_)téɺ#ôµ<Õ8¡#;<G<>O ôyøƪǢ# mgCœ·òd9\"äÞMTrÞvO'‚´Xñé‘,™à=Ü]ö–ùãÀá—ÃT$mL£NÖ•Hó•`Hý”þÝuFEi Åܼ™& … Bºð¡b?1j:æàedƒÄù„ã%Î VDea—ÆSÞ¯ÙÞõá +˜ÔÔ³´‰Aq^ JåŠkSÕD…-–©Ÿê¤Çيَ߮—ÌÓé qP +á·)””£ºJ bzÖ¸¡0ö³?諾Kd\…â]Ò–zEd7¶ÔRš?c飣_Z{UB*bl³å®ÝçRwºû†³£lßžØÝ2äí š¥ø@g‡¤Ÿs" iƒ ½Q¤-ݬ̃zc,öUWh§m3cMKÕ W*ú ‚)á'>›C)0b¼Ö.èûAxè÷œž2ç`£,KH˜Ä;êÍקSõœÛìŠX¨…ŸøÃ÷O'n‹ëï‹'nÿh(oí½–«_ÿ>ó s{lêšék@úC¸iþd&V*ânm§É<Ÿ‘] Ãh,POódJÅsï;|NÔwI ÜÐŒL=¼èÈâ U#ܯèû!²òz6Oø7™W…½oÏãÑZÎTV€cêÇXÆ]«òÞixC5ÁËÇC£úÓ?tDtîbÐ4;ô†¨îö9üGÇGH“¨ôâ›FµÝ…ïŠP-;™åöUº{íKÆ®]Æ YŒ{ $ÈÎü¤¾å0Pø¸Ç5Nâ*3¤›Á¦åLo,G½¼³xÏô†É}D[ËÛW|çWˆ'ß O(ö ßV8ë"zF!ØZÉ)|[@ƒ‰¢¶}ï £QÚ
-§ü¶E!Á[TyZ‰Ä»Âxx’ãV&éºÅÀÉxAÕÎg/,˜àÀg Ôž”Ù¿f‹lÌê‚Dc_ GØÕÜv/om\y˜$¥¬n‹ýÎSõÅzuwsÉA—CŒÒrý‘UçÓ"É!
ÔºY™ÔÉ.”¬j‚B¿ÖL.åRW
ȸ¤ÔÝK˜tÜ +´†2Šàc"Ì‚cÚ*ÕWzèîz$%z uÕDÜjåïKjÀ,‰¶zÛ)Áa4¸09v€Î†
ÄŒv)îh?uáï<ì07¾t6ü˜¨«¨Å¬½¤òóáR>-×tÔì¨Ëìsúß5_ú6rhRSF‰É禮5'ª¾¦%œpPFSØöÊJô0} 9ÉQÍf+Ë \th™3é(qäK‘99>Ú³¹¬H"b÷ÈÕÐÓ¤R¾)Hgðxª.tþI5ê ‹œ´‡¾›ïïßÌñïÞ2ªM û¼ª1Ê,ñ:qª wq†¦NêNì²~ ß×üÚdÙAÙ=¦…aæKâA<"PLå84bYÂ]@ 4=p8Z‘¨™æ‰¥ÁÝÜoÍךÔqXڙㆠ0 Qá`ÑZFŽ°*1B ³}õ¿Ì\Í«Iu6&áT<+Vý¨F?Þ r?L2¼†Àþb$©?'sŒ9 $yå ô% _SáS ÷a§û…™3µÝæ3pÖ'È c5¼›=WÏ4· µÚûÔ
=`B#Øgì@Ó‚åÇr¹í£B°)0 f0ïp
©ô)ƽY®KÛZpï„4S•_` f¾``F:JˆE:Ô6‘(cþÎM4)ÇfMÇÏ€»SÝ?-4e~J_ê=ÖUvEà”Â7o…eóTê.A 20¸‡äÉí¢Í† zUU.aé Wà( \CßÏR£„ [P…Èœ[Ðì#=Ô bþ»®5µÊò\©Ø˜’÷Žªöæ†h…9ýÔí7N ráÇÔQsrN´ì|8ýÕ3r½âÄg=²ÃßÞƒÅXMÕ “ ¤5{¥û×Àqj®/~_?œPÈÁT;Ú&hçÉcw•" öo²YL¶@òÛ;3ºNS¶üÁ2sßPºÏ5žÐœâ5õ½wæ-忳}þeWˆ0¬ÚLNQõ`¦í Ü
‘k8æ¬9V1ê®ÂžŠî3,y-ÊuI7~ç^ +
Ôìÿm¦§óyc –1ù¤»éÂlK;¶îÎA$¨¶âv ð¨jCíúJÁÕQœƒSÑäǦ0`)ÿ1‘} õë9céÀÈÎ'úåÍÃʳǯ(ÓÎÒצʀ7âHïR&N·ÿ ;P yíCÀ G––Ø«m†eU)÷Fhó||ÿÀ‹CÝ Õ³‡´ÿÆl©† uxˆ~ÒpEÈÅGE"A"ŒFdÔ·Ò9Þ;nÖ_ãNÄø;ŒG°³ +“¸0ÆvJ¦à˜b( +!‰ªASƹLº&çû<ÃG$^Ù5' µWŽÕ±ð&ww´âF㾋A«‡•c†Ümò˜¥ŸÚ RÔ]®Ÿ(ÝõM‹U4=kNq~ñ C[Ðz&IoË< ÎçßüR<ð=±1\¯çS‚Ìá-¨áMcc€4£ + öåJQÛÚ|ŠŽZ §º„#áÏ…ðï–5 )pC†ÁÎ Ðõ~sñ94¾ï w›8̧Ÿ˜¥ÊÍ›y›@æ‹.òÈ3Bm}¦"p&s™HY;ñ#Œd¶~Îöósÿûºeô¦[É ÜäØñdp$õO
Š'þ ¹ÑëJËo«ü,žØ²³Ð|Äç¸tïõ-ÅYœ8.fw%W*máßéòK 5…Ø0öT¥®¤ë¿jà ·|AoÖ|dŠ¶ çrr~ÙX—)a0ŠUHxj¥jæh +''5xóÞˆPbœDqƒÎFê¯#ÍûƒÀH¡'§*|sÚK¶®òÀ„2Œ ã˺¿?¹Kßo endobj 631 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 34 /LastChar 125 -/Widths 1356 0 R -/BaseFont /EGSTMX+NimbusMonL-Bold +/Widths 1357 0 R +/BaseFont /UQNYRK+NimbusMonL-Bold /FontDescriptor 629 0 R >> endobj 629 0 obj << /Ascent 624 /CapHeight 552 /Descent -126 -/FontName /EGSTMX+NimbusMonL-Bold +/FontName /UQNYRK+NimbusMonL-Bold /ItalicAngle 0 /StemV 101 /XHeight 439 /FontBBox [-43 -278 681 871] /Flags 4 -/CharSet (/quotedbl/hyphen/period/slash/zero/one/two/five/six/seven/eight/semicolon/A/B/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) +/CharSet (/quotedbl/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/semicolon/A/B/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) /FontFile 630 0 R >> endobj -1356 0 obj -[600 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 0 0 600 600 600 600 0 0 600 0 0 0 0 0 600 600 0 0 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] +1357 0 obj +[600 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 0 0 600 0 0 0 0 0 600 600 0 0 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj 627 0 obj << /Length1 1612 @@ -5875,7 +5892,7 @@ endobj stream xÚ¬·c”fÝÒ%š¶Yé'UiVÚ¶m?iÛ¶]i³Ò¶mÛ¨´Ué¼õžÓÝ_sûþéûýØcìkÆŒ˜±ÖØ›œXA™NÐÄÎ(fgëLÇDÏȳ°1rq’µ³•¡Sš¹ tüWƒ(ÿ™ª¿$ Mìl= -ÎÆæ +ÎÆæ ÿ ÏtÿFÔÖØÎäŸYQv6´5ù;^ÿËðÛØÅÑñ¯ªÿ:ñ þŸë
:è4†[[¶3æ¶LËLw®ÅÎ žÑîïe ±/mP)*ð¯¶ëñK ßå¬0x¯ ¡oœæúlóX:³ÿ8”¢þ=Ú‹eMÑ“ ¼ÊÇ÷!¥ê+@ÝúÞÁNó;A¯1ý\=ÚëzQfB‹Qí÷Þ¤¢’^É;ÁtÇG˜ë?Tþ¤®þdOöH¾Æ?ëã0;QAÐj Ïο'üy¢ ê¹…ì;ģɉƒ%çv…@ü åïƒÇ¯¥ZáA•Þ„€wÛ~ýI¤Þí¥—GN†Ki#óª`–¿nÛ.óž ™ÞÎÏ“$ë(ÑzX©u3? Å#˜4Í9—ûµáB.ê„ÍÓ„?Ô7kE4“ ]O8üvCÙïîUkSMýÚ‡”»02£ØYZïÖuHÎH7áR‰$ÜjïD"$m|/Ë·K|ZT7âí質9—1ÉÕu¬Íü¦@Ö vŠyÚÄVhØx+20%3 Ôt£%7!AZ|®èÑá{åÚG–PîóÄ¥¡
_•öÀÐXªÚÙ"³ ò'y´»¸
¹Í o)8[”Ì—3 !œ,ž Ëh!k<Lûëlà8Ã}Û-â4Àó4Ôe‹nv¡èÅ@ý+ŸÌZÐF£hˆ¡ãû¯ûæ??jb¹ÊS‰cjŠ ÞFÆצ³Âyxã°¢õB;^‘átlYéÇóžHü ‡ Þ´Ç^†‘À=‘DÌàbx:3pî=Æcà ˆ#£],ˆqGÄ®ækŒ ýH£f»Ð–Á™œ†ƒÎ ïŽ Ó“Ú|#9ž$’|SâðWßmMQ$T YÕZQ^‰žPÛLR`ð!Tèþ|Þ„lãlFOª›óS¢gc8FRîÍéS?ß°ÌÔl8DNýÞÉl¶›Çyøúä4Û²LŒéK ø¢Õê’4|EuœÄï´€Þf @@ -5947,23 +5964,23 @@ d‘\ÝxyÛ>™éþ €Mòb¾¨¢¡Ò@oæ1–%Hy.¢yœ?.µÜrn’¦ýTþËp¨Z[Ñù4£ùÉøHáy#I‹H³Ñìµgƒ1ÜrwõeB„?–ɾjŒ¨o[½Vµ« ”3PTcÈ=,r“?s0•Š)¡:Kô+®b¬Jå'(g³c?8Ⱦ<χôÇųÜÌÑæ°…SvU'µN—œôÜÛmiG˜DÇîÅQ’
øV|Q´iåÈ-(ýP¬1W”¸s+âAÎrlÜxHÔ†Dû# ù®„ZÁ· åVÆ çâ
.uþ&̺©Eµ VØ|„èèKo¼¸ N69 ]ô?%µð¬§Ðå:ˆGI
ÿöm‚‡i”yÖYú ^\ðÅå㿾²Þ«Ù`QÀ|§ ªiÏð<{ºDsäÔÓÑ©¾6è&`£ØWJÜ“ á+¼W|S#3 L¦+uÛé`D²ûdh·¢Vd‹Á+Ð{³"oËÿ ¦xôÿâ$þŒì”ÕîÜ\D`ˆ}‡Ècƒ‰Í†\¨Z.©[Û†î©]DåD1Á˜DSM ¬·¾Cå:-¾éÙ¦£™hj9 [èJˆG)õÈDâU˜¯QG^D:óçä!5çÞ«Ç eæ'ì7ªdícîèhÌ0ØÝ”}tw¾Ö²ÿ ü—6qj%¬y?xš`*OôzŒ–•‚m DÓàìÜg¥¹ª|[w¢ ÃP0 ¹æý3ij ¾naTû‹¨rļžË[àDù· ‹Ž¿Ã -bi}j2ù s Ðÿýo»”¿Haâ)yòcþHóÖiš¥ 6aÚ1Ÿ‘œ°Rm8 ß8§%óùäN ¯Â øÿà"@û¸9c‚ü}1ÞÀÿ +bi}j2ù s Ðÿýo»”¿Haâ)yòcþHóÖiš¥ 6aÚ1Ÿ‘œ°Rm8 ß8§%óùäN ¯Â øÿà"@û¸9c‚ü}1ÞÀÿ endobj 628 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 33 /LastChar 125 -/Widths 1357 0 R -/BaseFont /SIBBBC+NimbusMonL-Regu +/Widths 1358 0 R +/BaseFont /RMEZVV+NimbusMonL-Regu /FontDescriptor 626 0 R >> endobj 626 0 obj << /Ascent 625 /CapHeight 557 /Descent -147 -/FontName /SIBBBC+NimbusMonL-Regu +/FontName /RMEZVV+NimbusMonL-Regu /ItalicAngle 0 /StemV 41 /XHeight 426 @@ -5972,7 +5989,7 @@ endobj /CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright) /FontFile 627 0 R >> endobj -1357 0 obj +1358 0 obj [600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ] endobj 621 0 obj << @@ -5985,7 +6002,7 @@ endobj stream xÚ¬zSx¥]·eœTlcÇv%©Ø¶íìضmÛ¨Šm£b£bÛ6»¾ÿïÓ§ŸÓ}Õ}.ö~Þ5Çœcb¬µö¾xɉ”éM쌀bv¶ÎôÌ L\ ´¶³·Ú:ÿ¥øTÎæ@€©…5 ,¯ ))' —SˆmŽ›Pp1²¶0ÈXm€Ô -Ë(gçü7%€êÿMe†ÿ>‘ÿ$þoø¿EÞÿ?qÿ«FÿÛ!þÿ=Ïÿ•ZÌÅÚZÎÐø¯ ÀÜ1 +Ë(gçü7%€êÿMe†ÿ>‘ÿ$þoø¿EÞÿ?qÿ«FÿÛ!þÿ=Ïÿ•ZÌÅÚZÎÐø¯ ÀÜ1 Hk \P3ÏØ©®â%ª«Q¶°sy1*õŸƒð3›Wž®õ;7 K³y²mÇZÉh\HÐçãîäÑ|Àÿ´_˜D ®á!)?¬oöër$q0>°±ÏO„<X) @@ -6068,23 +6085,23 @@ lÅŸœ$f_dq_“ÉñøC–C'O§_œ„Í¢z™À7Í°5åAƒí` EûKࣃ„ >Ò„rÖ:«Í·ä—ˆ•Ö’"îJìK4åä NÏ @¤õÃo_U¡;¤¢æªe?Z*½¿ÚOæËͦcZ¢6zÓ*î €mK1”£»ãß:¹<f :µ¦V.sF»øÎN®õÎ îÅEQ‡gŒ‹uà,¥vz!ìuS,ñš#\¥€ª6KѯAÃIá)è˜SX1ïŒ~†‰<& ;Ã] zÜ)ZP= ëN¾Ðºg¼)Qµ°}¼>Õ˜z_# å *’Ðs,b½“o&‰ð]ÎÎì†Ò¬¦{˜± ãxÂZ©–\å .ÉÉ q™5í—]Í_ãÓ~w X~˜½UÖ"bg¬%Ì—ÊÉbÙ¶Õ¾VÂ3a¾$þ—ì!íL;ENLãÖ[µô(ÁzŠþÐÞÂ
:\¦oŽìÿÞÉðdþÌn¤j’Pïn‰“Ì{:}*PDvŸw*[ð@9‚ Ô0a¸¦û[ßÅräÛ%Ó\qŸž]£÷Àëð|O-FêkÞ‹³€'‰Qö.ÊÂTqëÚĵ¦Îš)RžcÀ¾ôßØ Dã“V¶¢Å åž5yÔL ùR„wOƒù ͳ¬¯ãƲ¹ûx¥óuj2a™ dêMèaÁxö³]&e9õ};ªÄqÜm–íʳì $j´’V¢_yŸ¹6€W 3‚èíRõѹc§EsšN1}œÇ‹”Çžácž!\°1£,,ᄬ¨\XMÔ›ÖÁ€DÊŸ&ë«~9F=Þ'KJk® -ÀÝÏói<ÐÿiŒö?o¤ª¥endstream +ÀÝÏói<ÐÿiŒö? ѪÒendstream endobj 622 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 2 /LastChar 151 -/Widths 1358 0 R -/BaseFont /ZCVAEP+URWPalladioL-Ital +/Widths 1359 0 R +/BaseFont /YVWKXM+URWPalladioL-Ital /FontDescriptor 620 0 R >> endobj 620 0 obj << /Ascent 722 /CapHeight 693 /Descent -261 -/FontName /ZCVAEP+URWPalladioL-Ital +/FontName /YVWKXM+URWPalladioL-Ital /ItalicAngle -9.5 /StemV 78 /XHeight 482 @@ -6093,41 +6110,42 @@ endobj /CharSet (/fi/parenleft/parenright/comma/hyphen/period/one/two/three/four/five/six/seven/eight/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/W/X/Z/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) /FontFile 621 0 R >> endobj -1358 0 obj +1359 0 obj [528 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 333 0 0 250 333 250 0 0 500 500 500 500 500 500 500 500 0 250 0 0 0 0 0 0 722 611 667 778 611 556 722 778 333 0 667 556 944 778 778 611 778 667 556 611 778 0 944 722 0 667 0 0 0 0 0 0 444 463 407 500 389 278 500 500 278 0 444 278 778 556 444 500 463 389 389 333 556 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ] endobj 611 0 obj << /Length1 862 /Length2 1251 /Length3 532 -/Length 1860 +/Length 1862 /Filter /FlateDecode >> stream -xÚíUkTgnõJÀ+Å€€¸ -æ2@ Š&X4•;*(R’É’ L P -A@0¨P¹TZ)`åb°¢àY#BAn¬\uÝôØ¥?wíÙ™?ó>Ïó½ß3ÏûóY˜yùèl$vEDHi€‹»ïA €D2ÎÂÂ…! í‚$0
-ߢ}ï>÷ƒn6oçºHzA|‘d_d ß«kð}¥„òe@ -Æ2‡ÿ -Ý®:Pǽ —Œ—: íZ©wéÕy
ïÄ( ?4f×ÞugwÉ£8ázFß}í XK÷„\_k¥7
¿ FÑ1—w:˜X~uàseÙjq±Õqñ¥¸ÑZßQ°òfG'ø@=–~8;†9ÁL5Èá^‹‡qä8ÇJë¦õòZƒîê³rE¯ž©vŸ*3Ê@i&¯ñ9gtg2ÒÒ½=¼ý÷jÅ nÊM ô |®Ñô¾(VŠœÝ6º)~ÔO“Ä<Ñòr`ÜfR<æ«K»ÔYâŸll _ªw¶›Îצ—]«f*‘춛 ÿ‹û:yIY¼¨É”sÿ0;ðûÄ÷ë C?E[Žk!·ödMÇ»,å=WyÖ:U•šš{ Ç »C"pΨ<±Mµê)þ¦mPÇ¡=(¦á±™GÂGͼ´ô=ËäWœtãã…žÛ&Ê|FWèxhö?+”S¢ê§^éઞÍÛvM|¬{9ßgøÔ¶Ÿ4kiËwÕûØA¦ªöox“qày;Ã0ç“пéÏøk^…çÎ Ò W{Ê{—q æ5È~þþ—Á’‰ðµy×n)®)ˆ®„–ñ–¾[…öTåчªë7F¥õ7,å$ÕmÊþø3™ì€’\¿‹?j<#YWÔV+ºkç’ƒÄóaÐ=e姴9”óÌu¬Üi¢¢$€ö¹ïž_c©ÎIú‹¿Ÿ"½Ièz¡UÛ"3)õcT&ONë´¼Ùì•Ù6è9` Ÿµ±fPªVI÷4€TÇ}ÆÛvqf/ü&sl^3æ§LˆvÔóá6¸à¬?Ö{úóݦ¯yyÏŽkE'+† -ø„5÷Õ+ÔšÓ&a´ûŠÀòQbmAê…_=v¨’“æ"6å
^o(ßq —ÙäÛüÐáøº™ÆW Vêo3*½ÌWšõÎW -•‰e1ìö:;4ö ´ûX–Vœ—¿:¨'§œó ù?|pÿoð?Ñ +xÚíUkTgnõJÀ+Õ€€¸ æ2M°h*—*¦2$“d ÉÀ$Á*¸@…¢ˆ*J+¥õ‚.¸\ V<kT(ˆ€FÁ+W]Aw@=véÏÝ_{væϼÏó|ï÷Ìó~ç|ŽöÜ K€FÀ>¨LAÉ ðö ÚRL%8:zc0¤@PÙH3ÐÃXJ +7ù€[ 2‰ÀBÅ Å÷‚q'ÿ
S³›û(%H:Ý~&¥?ñ‘¨ß*Pi´Rc€ *€1Ùli0üÆœ ,@”ÒÙ,GI>K&’À +€U¸c +Y†*ð% +±wÐ¥íæÆ’‡{¥ XX÷õÞBF +Þ7 fìÌNà sÒ—äˆ.'Áê^JçúÅšê%íŽk´v¦÷ô‡â–èì5ŠpDxÌ|<ó@—ç¿%d³IâÎúÜ^ +ô©û&c—çõ\©-_·=—S Ôð€±ÑxÝËäU†o3+¹síŠ:§Š+ +4¾†9ñ¦Ö–·nû”ö[6N]¬o¸ÑïÙúl¦Œ4™þ<¥ ã¤Ðàܦcn‹’Qûì¼Á¶üÕV6 ²l7R„’0btÝ$ñ1ýÁøŠ-Ýîƒ#YLV^ÝNŽT÷XÒþÇoâvúÂæÇôÿÒÙ`e¨®Þuôvë¾à_‡‰fUê1ýÈâµÍm¤ƒë² qw~Éö=froBk67¥,AÐYã†%îP¶ïÉ +4éЈóç‡wä” ?° þ‡áÿ
þ'àW7„)P)„Eþ5&þ{endstream endobj 612 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1359 0 R +/Encoding 1360 0 R /FirstChar 13 /LastChar 110 -/Widths 1360 0 R -/BaseFont /AKTMYL+CMSY10 +/Widths 1361 0 R +/BaseFont /ZPZVAK+CMSY10 /FontDescriptor 610 0 R >> endobj 610 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /AKTMYL+CMSY10 +/FontName /ZPZVAK+CMSY10 /ItalicAngle -14.035 /StemV 85 /XHeight 431 @@ -6136,10 +6154,10 @@ endobj /CharSet (/circlecopyrt/bullet/braceleft/braceright/bar/backslash) /FontFile 611 0 R >> endobj -1360 0 obj +1361 0 obj [1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ] endobj -1359 0 obj << +1360 0 obj << /Type /Encoding /Differences [ 0 /.notdef 13/circlecopyrt 14/.notdef 15/bullet 16/.notdef 102/braceleft/braceright 104/.notdef 106/bar 107/.notdef 110/backslash 111/.notdef] >> endobj @@ -6151,7 +6169,7 @@ endobj /Filter /FlateDecode >> stream -xÚ¬ºc”¤]°%\]ª.Û¶mÛ¶mÛ¶m»Ëv—mÛúú}ïܹ³î̯ùæG®õœˆ8;vÄ>'Öz2“˜@N‘šßÈÖÀXÄÖƉšž†Ž ¬ *§oe¥odn+E`køkf†"&t0Öw2·µÒw2æ +xÚ¬ºc”¤]°%\]ª.Û¶mÛ¶mÛ¶m»Ëv—mÛúú}ïܹ³î̯ùæG®õœˆ8;vÄ>'Öz2“˜@N‘šßÈÖÀXÄÖƉšž†Ž ¬ *§oe¥odn+E`køkf†"&t0Öw2·µÒw2æ áªV•¶½^MV ‘µO Y'¬àÌæçåß‘Š”+‹1.ðñ€Lÿ/ú}jõáú^N«I-®„”Y”Лˆ³'•©•˜6´šM¼7Ñ”oõ·1·mŒ—'=Ufì1K± w;9<ô~Š§ §Õ|¬½#W¯Ÿžª"*š>ïwü†©‰5Ì€ zÑ·õ„Üî_?F#ØhzÝ•¥‘´”˜”€ë¾¬ ÓèDaÜ”ðÜÖ–x¼°ô3ã 4vˆ_Põ…°?2Ö„ô˜Ûγ¸Í;œ,f'+@³ñVÁ¶yÅæÉv(ˆÞ‰žší7Gfì qðª}-W)¨Æ/“^íe…ö§éßk‰òŒ*(|‘ÿ ²Æ)æýdà€P>Œ,U‘à‹D¡"w("Z³°QºD£xyÛ.Õ„þ0ŠÖ.¹ 'Æ6h¬NÒ µ¹žˆÍ&2 §S 5@Uc„7VC¨ªNxÉßaëŽ ÃÈÝ»T¼E uFB¾j5̘ò»–…P¢ììËM{ÁoÇ Žïe›`¯ÇÁÍ° UÜíëšøɃœ›ú´
Le€ rØ»·#ú©ÞJúì—ÓU>ƒñË!+ìxàpÚ|mŽ¨-ZÆ @@ -6262,23 +6280,23 @@ DŠ})²;\l¡–®ÛÐûÊf•>“šŽz@«Ó_9ð6Àc×Q÷Ϋ¨ 5Ž¾äùS£·tW¾ª »³eI?´1k½š¹†N´ÑúU~^òù–sæòñÒ¤¾O—ô2N®#,ëÞ>¥¯»úþ‡UÅQÅ?c"xè ÓKm¨òôÉÁ˜AÍç|ú¨ÜX±ýé°Ž˜åDSZM©*,üèô^X䢨è xp{MäÜŽ ]æ2bþh7îä§ðkü<ºö.£`ùL ˆ¸¡lv ¿w§ óß; ±w˜xS(¯†N¦51àô›¼KÃ|…RJæÙÊ7ÎðÔÔÊä †öç!êß+ïùßæÃ[Åu;r+ i ³^jm˜3²÷¾ÏO3Ò¤÷/v¨+¿©¨ÇE ÷ÕÖõCD¶Ù+Å2áÃ3ÊWœ-CÃR*ݤ¸é9¼d<‘ [ºþþ¢9Žxu¨öúi$•EáyZ¼ –t0¼=Æ&A™_Ü39 õM䮩Ôø¨ˆõ gF‘¶@1Bz*¢·ù. -4: o€Íg¿€t2+,dÇ@w¾/-¡ ækÎû’lä* Øè!ª|¥3‘µ¤ü…ÖãÔcÀ¿7ûlSî°ü/ûÁÿ ©¹±³«ƒ½±³-Üÿ +4: o€Íg¿€t2+,dÇ@w¾/-¡ ækÎû’lä* Øè!ª|¥3‘µ¤ü…ÖãÔcÀ¿7ûlSî°ü/ûÁÿ ©¹±³«ƒ½±³-Üÿ endobj 604 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 2 /LastChar 216 -/Widths 1361 0 R -/BaseFont /PFLJOO+URWPalladioL-Roma +/Widths 1362 0 R +/BaseFont /XVVTPN+URWPalladioL-Roma /FontDescriptor 602 0 R >> endobj 602 0 obj << /Ascent 715 /CapHeight 680 /Descent -282 -/FontName /PFLJOO+URWPalladioL-Roma +/FontName /XVVTPN+URWPalladioL-Roma /ItalicAngle 0 /StemV 84 /XHeight 469 @@ -6287,7 +6305,7 @@ endobj /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash/Oslash) /FontFile 603 0 R >> endobj -1361 0 obj +1362 0 obj [605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 0 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 ] endobj 600 0 obj << @@ -6299,7 +6317,7 @@ endobj >> stream xÚ¬zceß³eÙ¶ë–m£Ë¶mÛ¶mWuÙ¶mÛ6»Œ®.×ôïÿ4ñf>ͼ'âìÌÜ+WæʽãÞˆCF¤ L'hbod*foçBÇDÏÈ
PURW0´±14±´—¡²·1ü5³Á‘ ;™ºXÚÛ‰º˜rÔMM -7µ3u2´(¸ÙXd,MíœM© +7µ3u2´(¸ÙXd,MíœM© ð|I¨ ‘wÈ»8hN‚ôÊà3/Õc¼o—eöÀ´ØÕN¦•ôJ? ðg»Xœ nÿP¸ ‘>; ø§7Æ£w#5¡Ôýº$O>ÿóL1<16:Òw>pŒK“MÆãO à˜‹Ë¯¥Z)ZÝL~Ó‘mÂ{ôÔ*’»RÆ¢)ï0=ã½Ég —\"nsYâ‚{s’ ?ËçžiE«vY«Ôè€9¡ÇΗ©5{ý‰÷r=Fa‘ŠÚòBLÖÔ—J|‚í uÿáq™ßx&™å2‹r&G-H.‹Û"]pYÝÝÝÜ "+0TjêkÉ™”“Œ†yF @@ -6406,23 +6424,23 @@ Lœ›Ê%…LeÌ¿+1Œ- •*ŒÂ0G70ýo2ˆ…"³ôd°Ç\g¶i7±ÝâsqLÆ7!õòîÏ¢{ßr%tCáòA@ò 6_mŠq'2~‹Ò=aFŠ†þÐœ²?Ç ¯Z¡._|;l[×OX˜àJÁ+QGýiÜZÉP &Yyf2—<²è•rŒG Ü75·ïá3òŽÃ#z‡FF⨾ãúF4þN¸ü5àcíÚ6P·¡“e ä è‡Ék¢œu_KŸ¥°L‹*·éñ0MH¼CrœT>Ü㇟x FÿàRÂB_!äµi¨N Ù%$hâ]tÞ ‰¢èÛîûs¶¼ª=nù<ü¨òÁËY©ÞØîƒQKñ™ÆýgF==ˆ3š öùs Cì¶G’Ð!YŠ
WaðŠ +·Yà¾]ˆh‘!{â#iŽ»¤"”¯ùù4bwËZ¨X à2&£‘.¿l=b, ¢,Ùl<aâr7à')¬Í‹RQÜ.)ö2—.‘ч¥r×uü)RÖ\-Cà" ¨{0öÊðeh饑@s£²çäV>ÔúAœ¦Gôì©5W 0!ÒãBîV\Êå6ÔÔëߥåíýŽá;RÐ$øžv(Ó@ÃIC M«Çv¹Ì_§/# È ÙÌÑ‚§ õ±Á¿2å 6ôw’ä{0ëó¬+/6A3C¿X ¬Ÿ? -¥0©j T™¶„qÚ]¡ÁÂ'DY¸
ö.g¬Âñ¨û ;AJÒ´á¿ÔÍ[ßÇHûaA@Ôñ ?ÍJµAì»tI•%[Ø$ Òð³"ɾ s™ÿ?÷€ÿ +¥0©j T™¶„qÚ]¡ÁÂ'DY¸
ö.g¬Âñ¨û ;AJÒ´á¿ÔÍ[ßÇHûaA@Ôñ ?ÍJµAì»tI•%[Ø$ Òð³"ɾ s™ÿ?÷€ÿ endobj 601 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1347 0 R +/Encoding 1348 0 R /FirstChar 2 /LastChar 151 -/Widths 1362 0 R -/BaseFont /WEGQVN+URWPalladioL-Bold +/Widths 1363 0 R +/BaseFont /IOWDMS+URWPalladioL-Bold /FontDescriptor 599 0 R >> endobj 599 0 obj << /Ascent 708 /CapHeight 672 /Descent -266 -/FontName /WEGQVN+URWPalladioL-Bold +/FontName /IOWDMS+URWPalladioL-Bold /ItalicAngle 0 /StemV 123 /XHeight 471 @@ -6431,117 +6449,117 @@ endobj /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) /FontFile 600 0 R >> endobj -1362 0 obj +1363 0 obj [611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 0 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 0 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ] endobj 605 0 obj << /Type /Pages /Count 6 -/Parent 1363 0 R +/Parent 1364 0 R /Kids [594 0 R 607 0 R 614 0 R 633 0 R 650 0 R 661 0 R] >> endobj 676 0 obj << /Type /Pages /Count 6 -/Parent 1363 0 R +/Parent 1364 0 R /Kids [668 0 R 678 0 R 683 0 R 691 0 R 702 0 R 710 0 R] >> endobj 721 0 obj << /Type /Pages /Count 6 -/Parent 1363 0 R +/Parent 1364 0 R /Kids [717 0 R 724 0 R 731 0 R 743 0 R 753 0 R 758 0 R] >> endobj 769 0 obj << /Type /Pages /Count 6 -/Parent 1363 0 R +/Parent 1364 0 R /Kids [762 0 R 771 0 R 781 0 R 789 0 R 797 0 R 807 0 R] >> endobj 822 0 obj << /Type /Pages /Count 6 -/Parent 1363 0 R +/Parent 1364 0 R /Kids [816 0 R 824 0 R 828 0 R 838 0 R 844 0 R 852 0 R] >> endobj 867 0 obj << /Type /Pages /Count 6 -/Parent 1363 0 R -/Kids [859 0 R 869 0 R 883 0 R 890 0 R 894 0 R 900 0 R] +/Parent 1364 0 R +/Kids [859 0 R 869 0 R 882 0 R 889 0 R 894 0 R 900 0 R] >> endobj 913 0 obj << /Type /Pages /Count 6 -/Parent 1364 0 R +/Parent 1365 0 R /Kids [906 0 R 915 0 R 922 0 R 926 0 R 931 0 R 937 0 R] >> endobj -950 0 obj << +948 0 obj << /Type /Pages /Count 6 -/Parent 1364 0 R -/Kids [943 0 R 953 0 R 959 0 R 967 0 R 976 0 R 984 0 R] +/Parent 1365 0 R +/Kids [943 0 R 950 0 R 959 0 R 967 0 R 976 0 R 981 0 R] >> endobj 991 0 obj << /Type /Pages /Count 6 -/Parent 1364 0 R -/Kids [988 0 R 993 0 R 1001 0 R 1007 0 R 1015 0 R 1022 0 R] +/Parent 1365 0 R +/Kids [988 0 R 993 0 R 999 0 R 1007 0 R 1012 0 R 1020 0 R] >> endobj -1035 0 obj << +1032 0 obj << /Type /Pages /Count 6 -/Parent 1364 0 R -/Kids [1028 0 R 1038 0 R 1043 0 R 1052 0 R 1057 0 R 1061 0 R] +/Parent 1365 0 R +/Kids [1027 0 R 1034 0 R 1043 0 R 1048 0 R 1057 0 R 1062 0 R] >> endobj -1072 0 obj << +1069 0 obj << /Type /Pages /Count 6 -/Parent 1364 0 R -/Kids [1065 0 R 1074 0 R 1086 0 R 1096 0 R 1112 0 R 1124 0 R] +/Parent 1365 0 R +/Kids [1066 0 R 1071 0 R 1079 0 R 1091 0 R 1101 0 R 1117 0 R] >> endobj -1136 0 obj << +1134 0 obj << /Type /Pages /Count 6 -/Parent 1364 0 R -/Kids [1130 0 R 1138 0 R 1149 0 R 1161 0 R 1171 0 R 1177 0 R] +/Parent 1365 0 R +/Kids [1129 0 R 1136 0 R 1143 0 R 1154 0 R 1165 0 R 1176 0 R] >> endobj -1188 0 obj << +1189 0 obj << /Type /Pages /Count 6 -/Parent 1365 0 R -/Kids [1181 0 R 1190 0 R 1200 0 R 1211 0 R 1215 0 R 1222 0 R] +/Parent 1366 0 R +/Kids [1182 0 R 1191 0 R 1201 0 R 1212 0 R 1216 0 R 1223 0 R] >> endobj -1278 0 obj << +1279 0 obj << /Type /Pages /Count 3 -/Parent 1365 0 R -/Kids [1231 0 R 1280 0 R 1338 0 R] +/Parent 1366 0 R +/Kids [1232 0 R 1281 0 R 1339 0 R] >> endobj -1363 0 obj << +1364 0 obj << /Type /Pages /Count 36 -/Parent 1366 0 R +/Parent 1367 0 R /Kids [605 0 R 676 0 R 721 0 R 769 0 R 822 0 R 867 0 R] >> endobj -1364 0 obj << +1365 0 obj << /Type /Pages /Count 36 -/Parent 1366 0 R -/Kids [913 0 R 950 0 R 991 0 R 1035 0 R 1072 0 R 1136 0 R] +/Parent 1367 0 R +/Kids [913 0 R 948 0 R 991 0 R 1032 0 R 1069 0 R 1134 0 R] >> endobj -1365 0 obj << +1366 0 obj << /Type /Pages /Count 9 -/Parent 1366 0 R -/Kids [1188 0 R 1278 0 R] +/Parent 1367 0 R +/Kids [1189 0 R 1279 0 R] >> endobj -1366 0 obj << +1367 0 obj << /Type /Pages /Count 81 -/Kids [1363 0 R 1364 0 R 1365 0 R] +/Kids [1364 0 R 1365 0 R 1366 0 R] >> endobj -1367 0 obj << +1368 0 obj << /Type /Outlines /First 7 0 R /Last 559 0 R @@ -6607,7 +6625,7 @@ endobj 559 0 obj << /Title 560 0 R /A 557 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 539 0 R /First 563 0 R /Last 579 0 R @@ -6643,7 +6661,7 @@ endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 515 0 R /Next 559 0 R /First 543 0 R @@ -6687,7 +6705,7 @@ endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 243 0 R /Next 539 0 R /First 519 0 R @@ -7174,7 +7192,7 @@ endobj 243 0 obj << /Title 244 0 R /A 241 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 231 0 R /Next 515 0 R /First 247 0 R @@ -7196,7 +7214,7 @@ endobj 231 0 obj << /Title 232 0 R /A 229 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 131 0 R /Next 243 0 R /First 235 0 R @@ -7378,7 +7396,7 @@ endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 91 0 R /Next 231 0 R /First 135 0 R @@ -7452,7 +7470,7 @@ endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 67 0 R /Next 131 0 R /First 95 0 R @@ -7495,7 +7513,7 @@ endobj 67 0 obj << /Title 68 0 R /A 65 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Prev 7 0 R /Next 91 0 R /First 71 0 R @@ -7604,1417 +7622,1418 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 1367 0 R +/Parent 1368 0 R /Next 67 0 R /First 11 0 R /Last 23 0 R /Count -4 >> endobj -1368 0 obj << -/Names [(Access_Control_Lists) 1185 0 R (Bv9ARM.ch01) 617 0 R (Bv9ARM.ch02) 671 0 R (Bv9ARM.ch03) 686 0 R (Bv9ARM.ch04) 734 0 R (Bv9ARM.ch05) 819 0 R (Bv9ARM.ch06) 831 0 R (Bv9ARM.ch07) 1184 0 R (Bv9ARM.ch08) 1203 0 R (Bv9ARM.ch09) 1218 0 R (Configuration_File_Grammar) 855 0 R (DNSSEC) 787 0 R (Doc-Start) 598 0 R (Setting_TTLs) 1152 0 R (access_control) 970 0 R (acl) 863 0 R (address_match_lists) 836 0 R (admin_tools) 708 0 R (appendix.A) 558 0 R (bibliography) 1234 0 R (boolean_options) 740 0 R (builtin) 1031 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 514 0 R (chapter.8) 538 0 R (cite.RFC1034) 1244 0 R (cite.RFC1035) 1246 0 R (cite.RFC1101) 1302 0 R (cite.RFC1123) 1304 0 R (cite.RFC1183) 1286 0 R (cite.RFC1464) 1322 0 R (cite.RFC1535) 1273 0 R (cite.RFC1536) 1275 0 R (cite.RFC1537) 1312 0 R (cite.RFC1591) 1306 0 R (cite.RFC1706) 1288 0 R (cite.RFC1712) 1336 0 R (cite.RFC1713) 1324 0 R (cite.RFC1794) 1326 0 R (cite.RFC1876) 1290 0 R (cite.RFC1886) 1265 0 R (cite.RFC1912) 1314 0 R (cite.RFC1982) 1277 0 R (cite.RFC1995) 1251 0 R (cite.RFC1996) 1253 0 R (cite.RFC2010) 1316 0 R (cite.RFC2052) 1292 0 R (cite.RFC2065) 1267 0 R (cite.RFC2136) 1255 0 R (cite.RFC2137) 1269 0 R (cite.RFC2163) 1294 0 R (cite.RFC2168) 1296 0 R (cite.RFC2181) 1257 0 R (cite.RFC2219) 1318 0 R (cite.RFC2230) 1298 0 R (cite.RFC2240) 1328 0 R (cite.RFC2308) 1259 0 R (cite.RFC2317) 1308 0 R (cite.RFC2345) 1330 0 R (cite.RFC2352) 1332 0 R (cite.RFC2845) 1261 0 R (cite.RFC974) 1248 0 R (cite.id2492088) 1345 0 R (configuration_file_elements) 832 0 R (controls_statement_definition_and_usage) 722 0 R (diagnostic_tools) 659 0 R (dynamic_update) 738 0 R (dynamic_update_policies) 779 0 R (dynamic_update_security) 974 0 R (historical_dns_information) 1225 0 R (id2465952) 643 0 R (id2466044) 619 0 R (id2466730) 623 0 R (id2466739) 624 0 R (id2466914) 639 0 R (id2467034) 618 0 R (id2467398) 641 0 R (id2467418) 642 0 R (id2467442) 996 0 R (id2467458) 997 0 R (id2467559) 999 0 R (id2467742) 646 0 R (id2467817) 653 0 R (id2467840) 656 0 R (id2467861) 657 0 R (id2467880) 658 0 R (id2467977) 664 0 R (id2468009) 665 0 R (id2468035) 666 0 R (id2468135) 672 0 R (id2468160) 673 0 R (id2468170) 674 0 R (id2468184) 675 0 R (id2468193) 681 0 R (id2468224) 688 0 R (id2468240) 689 0 R (id2468330) 694 0 R (id2468346) 695 0 R (id2468613) 698 0 R (id2468618) 699 0 R (id2469880) 727 0 R (id2469892) 728 0 R (id2470305) 749 0 R (id2470322) 750 0 R (id2470869) 766 0 R (id2470885) 767 0 R (id2470919) 768 0 R (id2470935) 774 0 R (id2470944) 775 0 R (id2470983) 776 0 R (id2471035) 777 0 R (id2471147) 784 0 R (id2471161) 785 0 R (id2471210) 786 0 R (id2471413) 792 0 R (id2471480) 793 0 R (id2471623) 794 0 R (id2471692) 810 0 R (id2471819) 812 0 R (id2471840) 813 0 R (id2471940) 820 0 R (id2472078) 833 0 R (id2472779) 841 0 R (id2472806) 842 0 R (id2472968) 847 0 R (id2472983) 848 0 R (id2473012) 849 0 R (id2473089) 856 0 R (id2473658) 862 0 R (id2473700) 864 0 R (id2473827) 866 0 R (id2474104) 874 0 R (id2474121) 875 0 R (id2474144) 876 0 R (id2474167) 877 0 R (id2474238) 886 0 R (id2474433) 887 0 R (id2474553) 888 0 R (id2475111) 903 0 R (id2475571) 909 0 R (id2475643) 910 0 R (id2475774) 918 0 R (id2475818) 919 0 R (id2475833) 920 0 R (id2477449) 940 0 R (id2478728) 962 0 R (id2478778) 964 0 R (id2478957) 973 0 R (id2479114) 979 0 R (id2482008) 1005 0 R (id2482414) 1019 0 R (id2482881) 1033 0 R (id2483577) 1048 0 R (id2483627) 1049 0 R (id2483712) 1055 0 R (id2484997) 1068 0 R (id2485003) 1069 0 R (id2485008) 1070 0 R (id2485309) 1077 0 R (id2485477) 1078 0 R (id2486444) 1115 0 R (id2486603) 1117 0 R (id2486621) 1118 0 R (id2486643) 1121 0 R (id2486782) 1127 0 R (id2487433) 1133 0 R (id2487542) 1135 0 R (id2487563) 1141 0 R (id2487921) 1143 0 R (id2488036) 1145 0 R (id2488054) 1146 0 R (id2488359) 1153 0 R (id2488465) 1155 0 R (id2488478) 1156 0 R (id2488570) 1158 0 R (id2488589) 1159 0 R (id2488645) 1167 0 R (id2488708) 1168 0 R (id2488739) 1169 0 R (id2488800) 1174 0 R (id2489197) 1196 0 R (id2489410) 1197 0 R (id2489467) 1198 0 R (id2489606) 1204 0 R (id2489611) 1205 0 R (id2489623) 1206 0 R (id2489640) 1207 0 R (id2489702) 1219 0 R (id2489707) 1220 0 R (id2490045) 1226 0 R (id2490357) 1228 0 R (id2490633) 1240 0 R (id2490635) 1242 0 R (id2490644) 1247 0 R (id2490667) 1243 0 R (id2490691) 1245 0 R (id2490728) 1256 0 R (id2490754) 1258 0 R (id2490779) 1250 0 R (id2490804) 1252 0 R (id2490827) 1254 0 R (id2490883) 1260 0 R (id2490944) 1263 0 R (id2490958) 1264 0 R (id2490997) 1266 0 R (id2491036) 1268 0 R (id2491064) 1271 0 R (id2491073) 1272 0 R (id2491098) 1274 0 R (id2491165) 1276 0 R (id2491202) 1284 0 R (id2491207) 1285 0 R (id2491265) 1287 0 R (id2491302) 1295 0 R (id2491337) 1289 0 R (id2491392) 1291 0 R (id2491431) 1293 0 R (id2491458) 1297 0 R (id2491484) 1300 0 R (id2491492) 1301 0 R (id2491517) 1303 0 R (id2491541) 1305 0 R (id2491562) 1307 0 R (id2491677) 1310 0 R (id2491685) 1311 0 R (id2491710) 1313 0 R (id2491737) 1315 0 R (id2491773) 1317 0 R (id2491813) 1320 0 R (id2491833) 1321 0 R (id2491856) 1323 0 R (id2491880) 1325 0 R (id2491905) 1327 0 R (id2491927) 1329 0 R (id2491973) 1331 0 R (id2491997) 1334 0 R (id2492004) 1335 0 R (id2492076) 1342 0 R (id2492086) 1344 0 R (id2492088) 1346 0 R (incremental_zone_transfers) 746 0 R (internet_drafts) 1341 0 R (ipv6addresses) 814 0 R (journal) 739 0 R (lwresd) 821 0 R (notify) 735 0 R (options) 929 0 R (page.1) 597 0 R (page.10) 693 0 R (page.11) 704 0 R (page.12) 712 0 R (page.13) 719 0 R (page.14) 726 0 R (page.15) 733 0 R (page.16) 745 0 R (page.17) 755 0 R (page.18) 760 0 R (page.19) 764 0 R (page.2) 609 0 R (page.20) 773 0 R (page.21) 783 0 R (page.22) 791 0 R (page.23) 799 0 R (page.24) 809 0 R (page.25) 818 0 R (page.26) 826 0 R (page.27) 830 0 R (page.28) 840 0 R (page.29) 846 0 R (page.3) 616 0 R (page.30) 854 0 R (page.31) 861 0 R (page.32) 871 0 R (page.33) 885 0 R (page.34) 892 0 R (page.35) 896 0 R (page.36) 902 0 R (page.37) 908 0 R (page.38) 917 0 R (page.39) 924 0 R (page.4) 635 0 R (page.40) 928 0 R (page.41) 933 0 R (page.42) 939 0 R (page.43) 945 0 R (page.44) 955 0 R (page.45) 961 0 R (page.46) 969 0 R (page.47) 978 0 R (page.48) 986 0 R (page.49) 990 0 R (page.5) 652 0 R (page.50) 995 0 R (page.51) 1003 0 R (page.52) 1009 0 R (page.53) 1017 0 R (page.54) 1024 0 R (page.55) 1030 0 R (page.56) 1040 0 R (page.57) 1045 0 R (page.58) 1054 0 R (page.59) 1059 0 R (page.6) 663 0 R (page.60) 1063 0 R (page.61) 1067 0 R (page.62) 1076 0 R (page.63) 1088 0 R (page.64) 1098 0 R (page.65) 1114 0 R (page.66) 1126 0 R (page.67) 1132 0 R (page.68) 1140 0 R (page.69) 1151 0 R (page.7) 670 0 R (page.70) 1163 0 R (page.71) 1173 0 R (page.72) 1179 0 R (page.73) 1183 0 R (page.74) 1192 0 R (page.75) 1202 0 R (page.76) 1213 0 R (page.77) 1217 0 R (page.78) 1224 0 R (page.79) 1233 0 R (page.8) 680 0 R (page.80) 1282 0 R (page.81) 1340 0 R (page.9) 685 0 R (proposed_standards) 751 0 R (rfcs) 648 0 R (rndc) 881 0 R (rrset_ordering) 700 0 R (sample_configuration) 687 0 R (section*.1) 1239 0 R (section*.10) 1333 0 R (section*.11) 1343 0 R (section*.2) 1241 0 R (section*.3) 1249 0 R (section*.4) 1262 0 R (section*.5) 1270 0 R (section*.6) 1283 0 R (section*.7) 1299 0 R (section*.8) 1309 0 R (section*.9) 1319 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 466 0 R (section.7.1) 518 0 R (section.7.2) 522 0 R (section.7.3) 534 0 R (section.8.1) 542 0 R (section.8.2) 550 0 R (section.8.3) 554 0 R (section.A.1) 562 0 R (section.A.2) 570 0 R (section.A.3) 578 0 R (server_statement_definition_and_usage) 951 0 R (server_statement_grammar) 1041 0 R (statsfile) 935 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 418 0 R (subsection.6.2.18) 422 0 R (subsection.6.2.19) 426 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 430 0 R (subsection.6.2.21) 434 0 R (subsection.6.2.22) 438 0 R (subsection.6.2.23) 442 0 R (subsection.6.2.24) 446 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 470 0 R (subsection.6.3.2) 482 0 R (subsection.6.3.3) 486 0 R (subsection.6.3.4) 490 0 R (subsection.6.3.5) 494 0 R (subsection.6.3.6) 510 0 R (subsection.7.2.1) 526 0 R (subsection.7.2.2) 530 0 R (subsection.8.1.1) 546 0 R (subsection.A.1.1) 566 0 R (subsection.A.2.1) 574 0 R (subsection.A.3.1) 582 0 R (subsection.A.3.2) 586 0 R (subsection.A.3.3) 590 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 450 0 R (subsubsection.6.2.24.2) 454 0 R (subsubsection.6.2.24.3) 458 0 R (subsubsection.6.2.24.4) 462 0 R (subsubsection.6.3.1.1) 474 0 R (subsubsection.6.3.1.2) 478 0 R (subsubsection.6.3.5.1) 498 0 R (subsubsection.6.3.5.2) 502 0 R (subsubsection.6.3.5.3) 506 0 R (table.1.1) 625 0 R (table.1.2) 640 0 R (table.3.1) 696 0 R (table.3.2) 729 0 R (table.6.1) 834 0 R (table.6.10) 1122 0 R (table.6.11) 1128 0 R (table.6.12) 1134 0 R (table.6.13) 1142 0 R (table.6.14) 1144 0 R (table.6.15) 1147 0 R (table.6.16) 1154 0 R (table.6.17) 1157 0 R (table.6.18) 1175 0 R (table.6.2) 857 0 R (table.6.3) 865 0 R (table.6.4) 904 0 R (table.6.5) 941 0 R (table.6.6) 1020 0 R (table.6.7) 1034 0 R (table.6.8) 1071 0 R (table.6.9) 1116 0 R (table.A.1) 1227 0 R (table.A.2) 1229 0 R (the_category_phrase) 898 0 R (the_sortlist_statement) 1011 0 R (topology) 1010 0 R (tsig) 765 0 R (tuning) 1025 0 R (types_of_resource_records_and_when_to_use_them) 647 0 R (view_statement_grammar) 1036 0 R (zone_statement_grammar) 965 0 R (zone_transfers) 741 0 R] -/Limits [(Access_Control_Lists) (zone_transfers)] ->> endobj 1369 0 obj << -/Kids [1368 0 R] +/Names [(Access_Control_Lists) 1186 0 R (Bv9ARM.ch01) 617 0 R (Bv9ARM.ch02) 671 0 R (Bv9ARM.ch03) 686 0 R (Bv9ARM.ch04) 734 0 R (Bv9ARM.ch05) 819 0 R (Bv9ARM.ch06) 831 0 R (Bv9ARM.ch07) 1185 0 R (Bv9ARM.ch08) 1204 0 R (Bv9ARM.ch09) 1219 0 R (Configuration_File_Grammar) 855 0 R (DNSSEC) 787 0 R (Doc-Start) 598 0 R (Setting_TTLs) 1157 0 R (access_control) 970 0 R (acl) 863 0 R (address_match_lists) 836 0 R (admin_tools) 708 0 R (appendix.A) 558 0 R (bibliography) 1235 0 R (boolean_options) 740 0 R (builtin) 1037 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 514 0 R (chapter.8) 538 0 R (cite.RFC1034) 1245 0 R (cite.RFC1035) 1247 0 R (cite.RFC1101) 1303 0 R (cite.RFC1123) 1305 0 R (cite.RFC1183) 1287 0 R (cite.RFC1464) 1323 0 R (cite.RFC1535) 1274 0 R (cite.RFC1536) 1276 0 R (cite.RFC1537) 1313 0 R (cite.RFC1591) 1307 0 R (cite.RFC1706) 1289 0 R (cite.RFC1712) 1337 0 R (cite.RFC1713) 1325 0 R (cite.RFC1794) 1327 0 R (cite.RFC1876) 1291 0 R (cite.RFC1886) 1266 0 R (cite.RFC1912) 1315 0 R (cite.RFC1982) 1278 0 R (cite.RFC1995) 1252 0 R (cite.RFC1996) 1254 0 R (cite.RFC2010) 1317 0 R (cite.RFC2052) 1293 0 R (cite.RFC2065) 1268 0 R (cite.RFC2136) 1256 0 R (cite.RFC2137) 1270 0 R (cite.RFC2163) 1295 0 R (cite.RFC2168) 1297 0 R (cite.RFC2181) 1258 0 R (cite.RFC2219) 1319 0 R (cite.RFC2230) 1299 0 R (cite.RFC2240) 1329 0 R (cite.RFC2308) 1260 0 R (cite.RFC2317) 1309 0 R (cite.RFC2345) 1331 0 R (cite.RFC2352) 1333 0 R (cite.RFC2845) 1262 0 R (cite.RFC974) 1249 0 R (cite.id2492414) 1346 0 R (configuration_file_elements) 832 0 R (controls_statement_definition_and_usage) 722 0 R (diagnostic_tools) 659 0 R (dynamic_update) 738 0 R (dynamic_update_policies) 779 0 R (dynamic_update_security) 974 0 R (historical_dns_information) 1226 0 R (id2465952) 643 0 R (id2466044) 619 0 R (id2466730) 623 0 R (id2466739) 624 0 R (id2466914) 639 0 R (id2467034) 618 0 R (id2467398) 641 0 R (id2467418) 642 0 R (id2467653) 841 0 R (id2467680) 842 0 R (id2467742) 646 0 R (id2467817) 653 0 R (id2467840) 656 0 R (id2467861) 657 0 R (id2467880) 658 0 R (id2467977) 664 0 R (id2468009) 665 0 R (id2468035) 666 0 R (id2468135) 672 0 R (id2468160) 673 0 R (id2468170) 674 0 R (id2468184) 675 0 R (id2468193) 681 0 R (id2468224) 688 0 R (id2468240) 689 0 R (id2468330) 694 0 R (id2468346) 695 0 R (id2468613) 698 0 R (id2468618) 699 0 R (id2469880) 727 0 R (id2469892) 728 0 R (id2470373) 749 0 R (id2470390) 750 0 R (id2470869) 766 0 R (id2470885) 767 0 R (id2470987) 768 0 R (id2471003) 774 0 R (id2471012) 775 0 R (id2471051) 776 0 R (id2471104) 777 0 R (id2471216) 784 0 R (id2471229) 785 0 R (id2471278) 786 0 R (id2471345) 792 0 R (id2471480) 793 0 R (id2471623) 794 0 R (id2471692) 810 0 R (id2471751) 812 0 R (id2471771) 813 0 R (id2471872) 820 0 R (id2472010) 833 0 R (id2474941) 847 0 R (id2474956) 848 0 R (id2474985) 849 0 R (id2475062) 856 0 R (id2475495) 862 0 R (id2475537) 864 0 R (id2475800) 866 0 R (id2476077) 874 0 R (id2476094) 875 0 R (id2476117) 876 0 R (id2476140) 877 0 R (id2476212) 886 0 R (id2476338) 887 0 R (id2476458) 892 0 R (id2477084) 903 0 R (id2477544) 909 0 R (id2477617) 910 0 R (id2477816) 918 0 R (id2477860) 919 0 R (id2477943) 920 0 R (id2479510) 940 0 R (id2480721) 962 0 R (id2480771) 964 0 R (id2481018) 973 0 R (id2481944) 996 0 R (id2482005) 1002 0 R (id2482106) 1004 0 R (id2482384) 1010 0 R (id2482722) 1024 0 R (id2483393) 1039 0 R (id2484021) 1053 0 R (id2484071) 1054 0 R (id2484155) 1060 0 R (id2485373) 1074 0 R (id2485380) 1075 0 R (id2485384) 1076 0 R (id2485686) 1082 0 R (id2485717) 1083 0 R (id2486684) 1120 0 R (id2486912) 1122 0 R (id2486930) 1123 0 R (id2486951) 1126 0 R (id2487091) 1132 0 R (id2487760) 1139 0 R (id2487868) 1141 0 R (id2487890) 1146 0 R (id2488110) 1148 0 R (id2488226) 1150 0 R (id2488244) 1151 0 R (id2488617) 1158 0 R (id2488723) 1160 0 R (id2488737) 1161 0 R (id2488828) 1163 0 R (id2488848) 1168 0 R (id2488903) 1172 0 R (id2489034) 1173 0 R (id2489065) 1174 0 R (id2489194) 1179 0 R (id2489729) 1197 0 R (id2489804) 1198 0 R (id2489862) 1199 0 R (id2489932) 1205 0 R (id2489938) 1206 0 R (id2489949) 1207 0 R (id2489966) 1208 0 R (id2490028) 1220 0 R (id2490034) 1221 0 R (id2490235) 1227 0 R (id2490547) 1229 0 R (id2490823) 1241 0 R (id2490825) 1243 0 R (id2490834) 1248 0 R (id2490925) 1244 0 R (id2490949) 1246 0 R (id2490986) 1257 0 R (id2491012) 1259 0 R (id2491037) 1251 0 R (id2491062) 1253 0 R (id2491085) 1255 0 R (id2491141) 1261 0 R (id2491202) 1264 0 R (id2491217) 1265 0 R (id2491255) 1267 0 R (id2491294) 1269 0 R (id2491322) 1272 0 R (id2491331) 1273 0 R (id2491356) 1275 0 R (id2491424) 1277 0 R (id2491460) 1285 0 R (id2491465) 1286 0 R (id2491523) 1288 0 R (id2491628) 1296 0 R (id2491664) 1290 0 R (id2491786) 1292 0 R (id2491826) 1294 0 R (id2491852) 1298 0 R (id2491879) 1301 0 R (id2491886) 1302 0 R (id2491912) 1304 0 R (id2491936) 1306 0 R (id2491957) 1308 0 R (id2492004) 1311 0 R (id2492011) 1312 0 R (id2492037) 1314 0 R (id2492064) 1316 0 R (id2492100) 1318 0 R (id2492139) 1321 0 R (id2492160) 1322 0 R (id2492182) 1324 0 R (id2492206) 1326 0 R (id2492231) 1328 0 R (id2492253) 1330 0 R (id2492299) 1332 0 R (id2492324) 1335 0 R (id2492330) 1336 0 R (id2492403) 1343 0 R (id2492412) 1345 0 R (id2492414) 1347 0 R (incremental_zone_transfers) 746 0 R (internet_drafts) 1342 0 R (ipv6addresses) 814 0 R (journal) 739 0 R (lwresd) 821 0 R (notify) 735 0 R (options) 929 0 R (page.1) 597 0 R (page.10) 693 0 R (page.11) 704 0 R (page.12) 712 0 R (page.13) 719 0 R (page.14) 726 0 R (page.15) 733 0 R (page.16) 745 0 R (page.17) 755 0 R (page.18) 760 0 R (page.19) 764 0 R (page.2) 609 0 R (page.20) 773 0 R (page.21) 783 0 R (page.22) 791 0 R (page.23) 799 0 R (page.24) 809 0 R (page.25) 818 0 R (page.26) 826 0 R (page.27) 830 0 R (page.28) 840 0 R (page.29) 846 0 R (page.3) 616 0 R (page.30) 854 0 R (page.31) 861 0 R (page.32) 871 0 R (page.33) 884 0 R (page.34) 891 0 R (page.35) 896 0 R (page.36) 902 0 R (page.37) 908 0 R (page.38) 917 0 R (page.39) 924 0 R (page.4) 635 0 R (page.40) 928 0 R (page.41) 933 0 R (page.42) 939 0 R (page.43) 945 0 R (page.44) 952 0 R (page.45) 961 0 R (page.46) 969 0 R (page.47) 978 0 R (page.48) 983 0 R (page.49) 990 0 R (page.5) 652 0 R (page.50) 995 0 R (page.51) 1001 0 R (page.52) 1009 0 R (page.53) 1014 0 R (page.54) 1022 0 R (page.55) 1029 0 R (page.56) 1036 0 R (page.57) 1045 0 R (page.58) 1050 0 R (page.59) 1059 0 R (page.6) 663 0 R (page.60) 1064 0 R (page.61) 1068 0 R (page.62) 1073 0 R (page.63) 1081 0 R (page.64) 1093 0 R (page.65) 1103 0 R (page.66) 1119 0 R (page.67) 1131 0 R (page.68) 1138 0 R (page.69) 1145 0 R (page.7) 670 0 R (page.70) 1156 0 R (page.71) 1167 0 R (page.72) 1178 0 R (page.73) 1184 0 R (page.74) 1193 0 R (page.75) 1203 0 R (page.76) 1214 0 R (page.77) 1218 0 R (page.78) 1225 0 R (page.79) 1234 0 R (page.8) 680 0 R (page.80) 1283 0 R (page.81) 1341 0 R (page.9) 685 0 R (proposed_standards) 751 0 R (query_address) 979 0 R (rfcs) 648 0 R (rndc) 880 0 R (rrset_ordering) 700 0 R (sample_configuration) 687 0 R (section*.1) 1240 0 R (section*.10) 1334 0 R (section*.11) 1344 0 R (section*.2) 1242 0 R (section*.3) 1250 0 R (section*.4) 1263 0 R (section*.5) 1271 0 R (section*.6) 1284 0 R (section*.7) 1300 0 R (section*.8) 1310 0 R (section*.9) 1320 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 466 0 R (section.7.1) 518 0 R (section.7.2) 522 0 R (section.7.3) 534 0 R (section.8.1) 542 0 R (section.8.2) 550 0 R (section.8.3) 554 0 R (section.A.1) 562 0 R (section.A.2) 570 0 R (section.A.3) 578 0 R (server_statement_definition_and_usage) 957 0 R (server_statement_grammar) 1046 0 R (statsfile) 935 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 418 0 R (subsection.6.2.18) 422 0 R (subsection.6.2.19) 426 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 430 0 R (subsection.6.2.21) 434 0 R (subsection.6.2.22) 438 0 R (subsection.6.2.23) 442 0 R (subsection.6.2.24) 446 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 470 0 R (subsection.6.3.2) 482 0 R (subsection.6.3.3) 486 0 R (subsection.6.3.4) 490 0 R (subsection.6.3.5) 494 0 R (subsection.6.3.6) 510 0 R (subsection.7.2.1) 526 0 R (subsection.7.2.2) 530 0 R (subsection.8.1.1) 546 0 R (subsection.A.1.1) 566 0 R (subsection.A.2.1) 574 0 R (subsection.A.3.1) 582 0 R (subsection.A.3.2) 586 0 R (subsection.A.3.3) 590 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 450 0 R (subsubsection.6.2.24.2) 454 0 R (subsubsection.6.2.24.3) 458 0 R (subsubsection.6.2.24.4) 462 0 R (subsubsection.6.3.1.1) 474 0 R (subsubsection.6.3.1.2) 478 0 R (subsubsection.6.3.5.1) 498 0 R (subsubsection.6.3.5.2) 502 0 R (subsubsection.6.3.5.3) 506 0 R (table.1.1) 625 0 R (table.1.2) 640 0 R (table.3.1) 696 0 R (table.3.2) 729 0 R (table.6.1) 834 0 R (table.6.10) 1127 0 R (table.6.11) 1133 0 R (table.6.12) 1140 0 R (table.6.13) 1147 0 R (table.6.14) 1149 0 R (table.6.15) 1152 0 R (table.6.16) 1159 0 R (table.6.17) 1162 0 R (table.6.18) 1180 0 R (table.6.2) 857 0 R (table.6.3) 865 0 R (table.6.4) 904 0 R (table.6.5) 941 0 R (table.6.6) 1025 0 R (table.6.7) 1040 0 R (table.6.8) 1077 0 R (table.6.9) 1121 0 R (table.A.1) 1228 0 R (table.A.2) 1230 0 R (the_category_phrase) 898 0 R (the_sortlist_statement) 1016 0 R (topology) 1015 0 R (tsig) 765 0 R (tuning) 1030 0 R (types_of_resource_records_and_when_to_use_them) 647 0 R (view_statement_grammar) 1041 0 R (zone_statement_grammar) 965 0 R (zone_transfers) 741 0 R] +/Limits [(Access_Control_Lists) (zone_transfers)] >> endobj 1370 0 obj << -/Dests 1369 0 R +/Kids [1369 0 R] >> endobj 1371 0 obj << +/Dests 1370 0 R +>> endobj +1372 0 obj << /Type /Catalog -/Pages 1366 0 R -/Outlines 1367 0 R -/Names 1370 0 R +/Pages 1367 0 R +/Outlines 1368 0 R +/Names 1371 0 R /PageMode /UseOutlines /OpenAction 593 0 R >> endobj -1372 0 obj << +1373 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords() -/CreationDate (D:20080527222349Z) +/CreationDate (D:20081024022700Z) /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4) >> endobj xref -0 1373 +0 1374 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000018969 00000 n -0000491721 00000 n +0000018967 00000 n +0000496151 00000 n 0000000054 00000 n 0000000086 00000 n -0000019093 00000 n -0000491649 00000 n +0000019091 00000 n +0000496079 00000 n 0000000133 00000 n 0000000173 00000 n -0000019218 00000 n -0000491563 00000 n +0000019216 00000 n +0000495993 00000 n 0000000221 00000 n 0000000273 00000 n -0000019343 00000 n -0000491477 00000 n +0000019341 00000 n +0000495907 00000 n 0000000321 00000 n 0000000377 00000 n -0000023633 00000 n -0000491367 00000 n +0000023631 00000 n +0000495797 00000 n 0000000425 00000 n 0000000478 00000 n -0000023758 00000 n -0000491293 00000 n +0000023756 00000 n +0000495723 00000 n 0000000531 00000 n 0000000572 00000 n -0000023883 00000 n -0000491206 00000 n +0000023881 00000 n +0000495636 00000 n 0000000625 00000 n 0000000674 00000 n -0000024008 00000 n -0000491119 00000 n +0000024006 00000 n +0000495549 00000 n 0000000727 00000 n 0000000757 00000 n -0000028318 00000 n -0000490995 00000 n +0000028316 00000 n +0000495425 00000 n 0000000810 00000 n 0000000861 00000 n -0000028443 00000 n -0000490921 00000 n +0000028441 00000 n +0000495351 00000 n 0000000919 00000 n 0000000964 00000 n -0000028568 00000 n -0000490834 00000 n +0000028566 00000 n +0000495264 00000 n 0000001022 00000 n 0000001062 00000 n -0000028693 00000 n -0000490760 00000 n +0000028691 00000 n +0000495190 00000 n 0000001120 00000 n 0000001162 00000 n -0000031606 00000 n -0000490636 00000 n +0000031604 00000 n +0000495066 00000 n 0000001215 00000 n 0000001260 00000 n -0000031731 00000 n -0000490575 00000 n +0000031729 00000 n +0000495005 00000 n 0000001318 00000 n 0000001355 00000 n -0000031856 00000 n -0000490501 00000 n +0000031854 00000 n +0000494931 00000 n 0000001408 00000 n 0000001463 00000 n -0000034244 00000 n -0000490376 00000 n +0000034242 00000 n +0000494806 00000 n 0000001509 00000 n 0000001556 00000 n -0000034369 00000 n -0000490302 00000 n +0000034367 00000 n +0000494732 00000 n 0000001604 00000 n 0000001648 00000 n -0000034494 00000 n -0000490215 00000 n +0000034492 00000 n +0000494645 00000 n 0000001696 00000 n 0000001735 00000 n -0000034617 00000 n -0000490128 00000 n +0000034615 00000 n +0000494558 00000 n 0000001783 00000 n 0000001825 00000 n -0000034741 00000 n -0000490041 00000 n +0000034739 00000 n +0000494471 00000 n 0000001873 00000 n 0000001936 00000 n -0000035777 00000 n -0000489967 00000 n +0000035820 00000 n +0000494397 00000 n 0000001984 00000 n 0000002034 00000 n -0000037455 00000 n -0000489839 00000 n +0000037498 00000 n +0000494269 00000 n 0000002080 00000 n 0000002126 00000 n -0000037579 00000 n -0000489726 00000 n +0000037622 00000 n +0000494156 00000 n 0000002174 00000 n 0000002218 00000 n -0000037704 00000 n -0000489650 00000 n +0000037747 00000 n +0000494080 00000 n 0000002271 00000 n 0000002323 00000 n -0000037829 00000 n -0000489573 00000 n +0000037872 00000 n +0000494003 00000 n 0000002377 00000 n 0000002436 00000 n -0000040461 00000 n -0000489482 00000 n +0000040504 00000 n +0000493912 00000 n 0000002485 00000 n 0000002523 00000 n -0000040712 00000 n -0000489365 00000 n +0000040755 00000 n +0000493795 00000 n 0000002572 00000 n 0000002618 00000 n -0000040838 00000 n -0000489247 00000 n +0000040881 00000 n +0000493677 00000 n 0000002672 00000 n 0000002739 00000 n -0000044023 00000 n -0000489168 00000 n +0000044066 00000 n +0000493598 00000 n 0000002798 00000 n 0000002842 00000 n -0000044149 00000 n -0000489089 00000 n +0000044192 00000 n +0000493519 00000 n 0000002901 00000 n 0000002949 00000 n -0000054288 00000 n -0000489010 00000 n +0000054331 00000 n +0000493440 00000 n 0000003003 00000 n 0000003036 00000 n -0000057561 00000 n -0000488878 00000 n +0000057604 00000 n +0000493308 00000 n 0000003083 00000 n 0000003126 00000 n -0000057687 00000 n -0000488799 00000 n +0000057730 00000 n +0000493229 00000 n 0000003175 00000 n 0000003205 00000 n -0000057813 00000 n -0000488667 00000 n +0000057856 00000 n +0000493097 00000 n 0000003254 00000 n 0000003292 00000 n -0000057938 00000 n -0000488602 00000 n +0000057981 00000 n +0000493032 00000 n 0000003346 00000 n 0000003388 00000 n -0000062257 00000 n -0000488509 00000 n +0000062300 00000 n +0000492939 00000 n 0000003437 00000 n 0000003496 00000 n -0000062383 00000 n -0000488377 00000 n +0000062426 00000 n +0000492807 00000 n 0000003545 00000 n 0000003578 00000 n -0000062509 00000 n -0000488312 00000 n +0000062552 00000 n +0000492742 00000 n 0000003632 00000 n 0000003681 00000 n -0000069370 00000 n -0000488180 00000 n +0000069413 00000 n +0000492610 00000 n 0000003730 00000 n 0000003758 00000 n -0000069496 00000 n -0000488062 00000 n +0000069539 00000 n +0000492492 00000 n 0000003812 00000 n 0000003881 00000 n -0000069621 00000 n -0000487983 00000 n +0000069664 00000 n +0000492413 00000 n 0000003940 00000 n 0000003988 00000 n -0000069747 00000 n -0000487904 00000 n +0000069790 00000 n +0000492334 00000 n 0000004047 00000 n 0000004092 00000 n -0000072749 00000 n -0000487811 00000 n +0000072792 00000 n +0000492241 00000 n 0000004146 00000 n 0000004214 00000 n -0000072875 00000 n -0000487718 00000 n +0000072918 00000 n +0000492148 00000 n 0000004268 00000 n 0000004338 00000 n -0000073001 00000 n -0000487625 00000 n +0000073044 00000 n +0000492055 00000 n 0000004392 00000 n 0000004455 00000 n -0000073127 00000 n -0000487532 00000 n +0000073170 00000 n +0000491962 00000 n 0000004509 00000 n 0000004564 00000 n -0000076860 00000 n -0000487453 00000 n +0000076903 00000 n +0000491883 00000 n 0000004618 00000 n 0000004650 00000 n -0000076986 00000 n -0000487360 00000 n +0000077029 00000 n +0000491790 00000 n 0000004699 00000 n 0000004727 00000 n -0000077111 00000 n -0000487267 00000 n +0000077154 00000 n +0000491697 00000 n 0000004776 00000 n 0000004808 00000 n -0000077237 00000 n -0000487135 00000 n +0000077280 00000 n +0000491565 00000 n 0000004857 00000 n 0000004887 00000 n -0000080688 00000 n -0000487056 00000 n +0000080731 00000 n +0000491486 00000 n 0000004941 00000 n 0000004982 00000 n -0000080813 00000 n -0000486963 00000 n +0000080856 00000 n +0000491393 00000 n 0000005036 00000 n 0000005078 00000 n -0000080939 00000 n -0000486884 00000 n +0000080982 00000 n +0000491314 00000 n 0000005132 00000 n 0000005177 00000 n -0000088379 00000 n -0000486766 00000 n +0000088422 00000 n +0000491196 00000 n 0000005226 00000 n 0000005272 00000 n -0000088505 00000 n -0000486687 00000 n +0000088548 00000 n +0000491117 00000 n 0000005326 00000 n 0000005386 00000 n -0000088631 00000 n -0000486608 00000 n +0000088674 00000 n +0000491038 00000 n 0000005440 00000 n 0000005509 00000 n -0000091066 00000 n -0000486475 00000 n +0000091109 00000 n +0000490905 00000 n 0000005556 00000 n 0000005609 00000 n -0000091192 00000 n -0000486396 00000 n +0000091235 00000 n +0000490826 00000 n 0000005658 00000 n 0000005714 00000 n -0000091318 00000 n -0000486317 00000 n +0000091361 00000 n +0000490747 00000 n 0000005763 00000 n 0000005812 00000 n -0000095439 00000 n -0000486184 00000 n +0000095482 00000 n +0000490614 00000 n 0000005859 00000 n 0000005911 00000 n -0000095565 00000 n -0000486066 00000 n +0000095608 00000 n +0000490496 00000 n 0000005960 00000 n 0000006011 00000 n -0000099709 00000 n -0000485948 00000 n +0000100168 00000 n +0000490378 00000 n 0000006065 00000 n 0000006110 00000 n -0000099834 00000 n -0000485869 00000 n +0000100294 00000 n +0000490299 00000 n 0000006169 00000 n 0000006203 00000 n -0000099959 00000 n -0000485790 00000 n +0000100420 00000 n +0000490220 00000 n 0000006262 00000 n 0000006310 00000 n -0000103241 00000 n -0000485672 00000 n +0000103776 00000 n +0000490102 00000 n 0000006364 00000 n 0000006404 00000 n -0000103367 00000 n -0000485593 00000 n +0000103901 00000 n +0000490023 00000 n 0000006463 00000 n 0000006497 00000 n -0000103493 00000 n -0000485514 00000 n +0000104027 00000 n +0000489944 00000 n 0000006556 00000 n 0000006604 00000 n -0000107219 00000 n -0000485381 00000 n +0000107896 00000 n +0000489811 00000 n 0000006653 00000 n 0000006703 00000 n -0000111057 00000 n -0000485302 00000 n +0000111407 00000 n +0000489732 00000 n 0000006757 00000 n 0000006804 00000 n -0000111183 00000 n -0000485209 00000 n +0000111533 00000 n +0000489639 00000 n 0000006858 00000 n 0000006918 00000 n -0000111433 00000 n -0000485116 00000 n +0000111785 00000 n +0000489546 00000 n 0000006972 00000 n 0000007024 00000 n -0000111559 00000 n -0000485023 00000 n +0000111911 00000 n +0000489453 00000 n 0000007078 00000 n 0000007143 00000 n -0000116189 00000 n -0000484930 00000 n +0000116539 00000 n +0000489360 00000 n 0000007197 00000 n 0000007248 00000 n -0000116315 00000 n -0000484837 00000 n +0000116665 00000 n +0000489267 00000 n 0000007302 00000 n 0000007366 00000 n -0000116441 00000 n -0000484744 00000 n +0000116791 00000 n +0000489174 00000 n 0000007420 00000 n 0000007467 00000 n -0000116567 00000 n -0000484651 00000 n +0000116917 00000 n +0000489081 00000 n 0000007521 00000 n 0000007581 00000 n -0000119509 00000 n -0000484558 00000 n +0000120093 00000 n +0000488988 00000 n 0000007635 00000 n 0000007686 00000 n -0000119635 00000 n -0000484426 00000 n +0000120219 00000 n +0000488856 00000 n 0000007741 00000 n 0000007806 00000 n -0000119761 00000 n -0000484347 00000 n +0000124842 00000 n +0000488777 00000 n 0000007866 00000 n 0000007913 00000 n -0000130170 00000 n -0000484268 00000 n +0000131000 00000 n +0000488698 00000 n 0000007973 00000 n 0000008021 00000 n -0000133886 00000 n -0000484175 00000 n +0000134715 00000 n +0000488605 00000 n 0000008076 00000 n 0000008126 00000 n -0000134012 00000 n -0000484082 00000 n +0000134841 00000 n +0000488512 00000 n 0000008181 00000 n 0000008244 00000 n -0000135742 00000 n -0000483989 00000 n +0000136571 00000 n +0000488419 00000 n 0000008299 00000 n 0000008351 00000 n -0000135868 00000 n -0000483896 00000 n +0000136697 00000 n +0000488326 00000 n 0000008406 00000 n 0000008471 00000 n -0000135994 00000 n -0000483803 00000 n +0000136823 00000 n +0000488233 00000 n 0000008526 00000 n 0000008578 00000 n -0000141175 00000 n -0000483670 00000 n +0000141832 00000 n +0000488100 00000 n 0000008633 00000 n 0000008698 00000 n -0000145209 00000 n -0000483591 00000 n +0000149873 00000 n +0000488021 00000 n 0000008758 00000 n 0000008802 00000 n -0000162726 00000 n -0000483498 00000 n +0000163494 00000 n +0000487928 00000 n 0000008862 00000 n 0000008901 00000 n -0000162852 00000 n -0000483405 00000 n +0000163620 00000 n +0000487835 00000 n 0000008961 00000 n 0000009008 00000 n -0000166993 00000 n -0000483312 00000 n +0000167817 00000 n +0000487742 00000 n 0000009068 00000 n 0000009111 00000 n -0000167119 00000 n -0000483219 00000 n +0000167942 00000 n +0000487649 00000 n 0000009171 00000 n 0000009210 00000 n -0000170296 00000 n -0000483126 00000 n +0000171164 00000 n +0000487556 00000 n 0000009270 00000 n 0000009312 00000 n -0000173827 00000 n -0000483033 00000 n +0000174647 00000 n +0000487463 00000 n 0000009372 00000 n 0000009415 00000 n -0000181413 00000 n -0000482940 00000 n +0000182087 00000 n +0000487370 00000 n 0000009475 00000 n -0000009522 00000 n -0000181539 00000 n -0000482847 00000 n -0000009582 00000 n -0000009643 00000 n -0000181665 00000 n -0000482754 00000 n -0000009704 00000 n -0000009756 00000 n -0000185582 00000 n -0000482661 00000 n -0000009817 00000 n -0000009870 00000 n -0000189915 00000 n -0000482568 00000 n -0000009931 00000 n -0000009969 00000 n -0000190044 00000 n -0000482475 00000 n -0000010030 00000 n -0000010082 00000 n -0000192946 00000 n -0000482382 00000 n -0000010143 00000 n -0000010187 00000 n -0000196692 00000 n -0000482289 00000 n -0000010248 00000 n -0000010284 00000 n -0000200657 00000 n -0000482196 00000 n -0000010345 00000 n -0000010408 00000 n -0000200786 00000 n -0000482117 00000 n -0000010469 00000 n -0000010518 00000 n -0000204307 00000 n -0000482024 00000 n -0000010573 00000 n -0000010624 00000 n -0000204434 00000 n -0000481931 00000 n -0000010679 00000 n -0000010743 00000 n -0000208561 00000 n -0000481838 00000 n -0000010798 00000 n -0000010855 00000 n -0000208688 00000 n -0000481745 00000 n -0000010910 00000 n -0000010980 00000 n -0000208816 00000 n -0000481652 00000 n -0000011035 00000 n -0000011084 00000 n -0000212235 00000 n -0000481559 00000 n -0000011139 00000 n -0000011201 00000 n -0000213812 00000 n -0000481466 00000 n -0000011256 00000 n -0000011305 00000 n -0000218667 00000 n -0000481348 00000 n -0000011360 00000 n -0000011422 00000 n -0000218796 00000 n -0000481269 00000 n -0000011482 00000 n -0000011521 00000 n -0000223747 00000 n -0000481176 00000 n -0000011581 00000 n -0000011615 00000 n -0000223876 00000 n -0000481083 00000 n -0000011675 00000 n -0000011716 00000 n -0000234063 00000 n -0000481004 00000 n -0000011776 00000 n -0000011828 00000 n -0000238234 00000 n -0000480886 00000 n -0000011877 00000 n -0000011910 00000 n -0000238363 00000 n -0000480768 00000 n -0000011964 00000 n -0000012036 00000 n -0000238491 00000 n -0000480689 00000 n -0000012095 00000 n -0000012139 00000 n -0000246225 00000 n -0000480610 00000 n -0000012198 00000 n -0000012251 00000 n -0000249809 00000 n -0000480517 00000 n -0000012305 00000 n -0000012355 00000 n -0000253169 00000 n -0000480424 00000 n -0000012409 00000 n -0000012447 00000 n -0000253427 00000 n -0000480331 00000 n -0000012501 00000 n -0000012550 00000 n -0000253685 00000 n -0000480199 00000 n -0000012604 00000 n -0000012656 00000 n -0000253814 00000 n -0000480120 00000 n -0000012715 00000 n -0000012767 00000 n -0000256695 00000 n -0000480027 00000 n -0000012826 00000 n -0000012879 00000 n -0000256824 00000 n -0000479948 00000 n -0000012938 00000 n -0000012987 00000 n -0000256953 00000 n -0000479869 00000 n -0000013041 00000 n -0000013121 00000 n -0000262822 00000 n -0000479736 00000 n -0000013168 00000 n -0000013220 00000 n -0000262951 00000 n -0000479657 00000 n -0000013269 00000 n -0000013313 00000 n -0000266684 00000 n -0000479525 00000 n -0000013362 00000 n -0000013424 00000 n -0000266813 00000 n -0000479446 00000 n -0000013478 00000 n -0000013526 00000 n -0000266942 00000 n -0000479367 00000 n -0000013580 00000 n -0000013631 00000 n -0000267071 00000 n -0000479288 00000 n -0000013680 00000 n -0000013727 00000 n -0000269988 00000 n -0000479155 00000 n -0000013774 00000 n -0000013811 00000 n -0000270117 00000 n -0000479037 00000 n -0000013860 00000 n -0000013899 00000 n -0000270246 00000 n -0000478972 00000 n -0000013953 00000 n -0000014031 00000 n -0000270375 00000 n -0000478879 00000 n -0000014080 00000 n -0000014147 00000 n -0000270504 00000 n -0000478800 00000 n -0000014196 00000 n -0000014241 00000 n -0000273998 00000 n -0000478681 00000 n -0000014289 00000 n -0000014321 00000 n -0000274127 00000 n -0000478563 00000 n -0000014370 00000 n -0000014409 00000 n -0000274256 00000 n -0000478498 00000 n -0000014463 00000 n -0000014524 00000 n -0000277755 00000 n -0000478366 00000 n -0000014573 00000 n -0000014630 00000 n -0000277884 00000 n -0000478301 00000 n -0000014684 00000 n -0000014733 00000 n -0000282071 00000 n -0000478183 00000 n -0000014782 00000 n -0000014844 00000 n -0000282200 00000 n -0000478104 00000 n -0000014898 00000 n -0000014953 00000 n -0000292815 00000 n -0000478011 00000 n -0000015007 00000 n -0000015048 00000 n -0000292944 00000 n -0000477932 00000 n -0000015102 00000 n -0000015154 00000 n -0000015507 00000 n -0000015755 00000 n -0000015207 00000 n -0000015629 00000 n -0000015692 00000 n -0000474773 00000 n -0000449109 00000 n -0000474599 00000 n -0000447921 00000 n -0000421761 00000 n -0000447747 00000 n -0000475778 00000 n -0000016419 00000 n -0000016234 00000 n -0000015840 00000 n -0000016356 00000 n -0000421076 00000 n -0000418932 00000 n -0000420912 00000 n -0000019594 00000 n -0000018784 00000 n -0000016504 00000 n -0000018906 00000 n -0000019030 00000 n -0000019155 00000 n -0000019280 00000 n -0000418078 00000 n -0000397720 00000 n -0000417904 00000 n -0000019405 00000 n -0000019468 00000 n -0000019531 00000 n -0000396771 00000 n -0000377019 00000 n -0000396598 00000 n -0000376292 00000 n -0000359908 00000 n -0000376119 00000 n -0000024132 00000 n -0000022950 00000 n -0000019718 00000 n -0000023444 00000 n -0000359373 00000 n -0000342456 00000 n -0000359189 00000 n -0000023507 00000 n -0000023570 00000 n -0000023695 00000 n -0000023820 00000 n -0000023945 00000 n -0000023100 00000 n -0000023293 00000 n -0000024070 00000 n -0000238427 00000 n -0000282264 00000 n -0000028818 00000 n -0000027783 00000 n -0000024256 00000 n -0000028255 00000 n -0000028380 00000 n -0000027933 00000 n -0000028095 00000 n -0000028505 00000 n -0000028630 00000 n -0000028755 00000 n -0000044086 00000 n -0000031980 00000 n -0000031421 00000 n -0000028942 00000 n -0000031543 00000 n -0000031668 00000 n -0000031793 00000 n -0000031917 00000 n -0000034866 00000 n -0000034059 00000 n -0000032091 00000 n -0000034181 00000 n -0000034306 00000 n -0000034431 00000 n -0000034556 00000 n -0000034678 00000 n -0000034803 00000 n -0000475896 00000 n -0000035902 00000 n -0000035592 00000 n -0000034951 00000 n -0000035714 00000 n -0000035839 00000 n -0000037955 00000 n -0000037270 00000 n -0000036000 00000 n -0000037392 00000 n -0000037517 00000 n -0000037641 00000 n -0000037766 00000 n -0000037892 00000 n -0000040964 00000 n -0000040097 00000 n -0000038053 00000 n -0000040398 00000 n -0000040524 00000 n -0000040587 00000 n -0000040649 00000 n -0000040239 00000 n -0000040775 00000 n -0000040901 00000 n -0000193010 00000 n -0000044275 00000 n -0000043838 00000 n -0000041075 00000 n -0000043960 00000 n -0000341929 00000 n -0000332620 00000 n -0000341752 00000 n -0000044212 00000 n -0000047975 00000 n -0000047790 00000 n -0000044399 00000 n -0000047912 00000 n -0000332177 00000 n -0000325378 00000 n -0000332000 00000 n -0000052340 00000 n -0000051949 00000 n -0000048138 00000 n -0000052277 00000 n -0000052091 00000 n -0000476014 00000 n -0000111622 00000 n -0000054540 00000 n -0000054103 00000 n -0000052477 00000 n -0000054225 00000 n -0000054351 00000 n -0000054414 00000 n -0000054477 00000 n -0000058064 00000 n -0000057026 00000 n -0000054664 00000 n -0000057498 00000 n -0000057624 00000 n -0000057750 00000 n -0000057176 00000 n -0000057337 00000 n -0000057875 00000 n -0000058001 00000 n -0000145272 00000 n -0000173890 00000 n -0000062635 00000 n -0000061718 00000 n -0000058162 00000 n -0000062194 00000 n -0000062320 00000 n -0000061868 00000 n -0000062033 00000 n -0000062446 00000 n -0000062572 00000 n -0000283043 00000 n -0000065550 00000 n -0000065178 00000 n -0000062785 00000 n -0000065487 00000 n -0000065320 00000 n -0000066735 00000 n -0000066550 00000 n -0000065674 00000 n -0000066672 00000 n -0000069873 00000 n -0000069185 00000 n -0000066833 00000 n -0000069307 00000 n -0000069433 00000 n -0000069559 00000 n -0000069684 00000 n -0000069810 00000 n -0000476132 00000 n -0000073253 00000 n -0000072376 00000 n -0000070010 00000 n -0000072686 00000 n -0000072812 00000 n -0000072938 00000 n -0000073064 00000 n -0000073190 00000 n -0000072518 00000 n -0000234127 00000 n -0000077362 00000 n -0000076675 00000 n -0000073390 00000 n -0000076797 00000 n -0000076923 00000 n -0000077049 00000 n -0000077174 00000 n -0000077299 00000 n -0000081063 00000 n -0000080503 00000 n -0000077486 00000 n -0000080625 00000 n -0000080750 00000 n -0000080876 00000 n -0000081000 00000 n -0000084064 00000 n -0000085763 00000 n -0000083942 00000 n -0000081187 00000 n -0000085700 00000 n -0000324543 00000 n -0000315683 00000 n -0000324371 00000 n -0000085532 00000 n -0000085589 00000 n -0000085678 00000 n -0000088757 00000 n -0000088015 00000 n -0000085915 00000 n -0000088316 00000 n -0000088442 00000 n -0000088157 00000 n -0000088568 00000 n -0000088694 00000 n -0000277948 00000 n -0000091444 00000 n -0000090881 00000 n -0000088881 00000 n -0000091003 00000 n -0000091129 00000 n -0000091255 00000 n -0000091381 00000 n -0000476250 00000 n -0000091876 00000 n -0000091691 00000 n -0000091542 00000 n -0000091813 00000 n -0000095816 00000 n -0000095068 00000 n -0000091917 00000 n -0000095376 00000 n -0000095502 00000 n -0000095627 00000 n -0000095690 00000 n -0000095753 00000 n -0000095210 00000 n -0000099772 00000 n -0000100085 00000 n -0000099524 00000 n -0000095914 00000 n -0000099646 00000 n -0000099896 00000 n -0000100022 00000 n -0000103619 00000 n -0000103056 00000 n -0000100222 00000 n -0000103178 00000 n -0000103304 00000 n -0000103430 00000 n -0000103556 00000 n -0000106231 00000 n -0000107470 00000 n -0000106109 00000 n -0000103730 00000 n -0000107156 00000 n -0000107282 00000 n -0000107345 00000 n -0000107408 00000 n -0000111685 00000 n -0000110872 00000 n -0000107622 00000 n -0000110994 00000 n -0000111120 00000 n -0000111244 00000 n -0000111307 00000 n -0000111370 00000 n -0000111496 00000 n -0000476368 00000 n -0000116693 00000 n -0000115127 00000 n -0000111796 00000 n -0000116126 00000 n -0000115301 00000 n -0000115451 00000 n -0000116252 00000 n -0000116378 00000 n -0000116504 00000 n -0000116630 00000 n -0000115609 00000 n -0000115760 00000 n -0000115944 00000 n -0000293458 00000 n -0000119887 00000 n -0000119324 00000 n -0000116830 00000 n -0000119446 00000 n -0000119572 00000 n -0000119698 00000 n -0000119824 00000 n -0000124398 00000 n -0000124213 00000 n -0000120024 00000 n -0000124335 00000 n -0000127433 00000 n -0000127063 00000 n -0000124509 00000 n -0000127370 00000 n -0000127205 00000 n -0000130233 00000 n -0000130422 00000 n -0000129985 00000 n -0000127544 00000 n -0000130107 00000 n -0000130296 00000 n -0000130359 00000 n -0000134138 00000 n -0000133370 00000 n -0000130533 00000 n -0000133823 00000 n -0000133949 00000 n -0000134075 00000 n -0000133520 00000 n -0000133671 00000 n -0000476486 00000 n -0000136120 00000 n -0000135557 00000 n -0000134249 00000 n -0000135679 00000 n -0000135805 00000 n -0000135931 00000 n -0000136057 00000 n -0000137666 00000 n -0000137481 00000 n -0000136231 00000 n -0000137603 00000 n -0000141301 00000 n -0000140990 00000 n -0000137764 00000 n -0000141112 00000 n -0000141238 00000 n -0000145334 00000 n -0000144849 00000 n -0000141425 00000 n -0000145146 00000 n -0000144991 00000 n -0000200850 00000 n -0000149374 00000 n -0000149063 00000 n -0000145458 00000 n -0000149185 00000 n -0000149248 00000 n -0000149311 00000 n -0000153964 00000 n -0000153073 00000 n -0000149485 00000 n -0000153901 00000 n -0000153239 00000 n -0000153392 00000 n -0000153548 00000 n -0000153730 00000 n -0000476604 00000 n -0000204498 00000 n -0000158684 00000 n -0000158103 00000 n -0000154129 00000 n -0000158621 00000 n -0000158253 00000 n -0000158437 00000 n -0000162978 00000 n -0000162353 00000 n -0000158821 00000 n -0000162663 00000 n -0000162789 00000 n -0000162495 00000 n -0000162915 00000 n -0000213876 00000 n -0000167245 00000 n -0000166445 00000 n -0000163102 00000 n -0000166930 00000 n -0000167056 00000 n -0000166595 00000 n -0000166760 00000 n -0000167182 00000 n -0000267134 00000 n -0000170422 00000 n -0000170111 00000 n -0000167369 00000 n -0000170233 00000 n -0000170359 00000 n -0000315157 00000 n -0000307266 00000 n -0000314984 00000 n -0000173953 00000 n -0000173642 00000 n -0000170587 00000 n -0000173764 00000 n -0000177876 00000 n -0000177691 00000 n -0000174105 00000 n -0000177813 00000 n -0000476722 00000 n -0000181791 00000 n -0000181035 00000 n -0000178041 00000 n -0000181350 00000 n -0000181476 00000 n -0000181602 00000 n -0000181177 00000 n -0000181728 00000 n -0000185711 00000 n -0000185216 00000 n -0000181943 00000 n -0000185517 00000 n -0000185362 00000 n -0000185646 00000 n -0000190172 00000 n -0000189378 00000 n -0000185864 00000 n -0000189850 00000 n -0000189979 00000 n -0000190107 00000 n -0000189533 00000 n -0000189695 00000 n -0000193204 00000 n -0000192566 00000 n -0000190338 00000 n -0000192881 00000 n -0000192712 00000 n -0000193074 00000 n -0000193139 00000 n -0000196820 00000 n -0000196319 00000 n -0000193316 00000 n -0000196627 00000 n -0000196756 00000 n -0000196465 00000 n -0000201044 00000 n -0000200277 00000 n -0000196999 00000 n -0000200592 00000 n -0000200721 00000 n -0000200424 00000 n -0000200914 00000 n -0000200979 00000 n -0000476844 00000 n -0000208880 00000 n -0000204561 00000 n -0000204116 00000 n -0000201156 00000 n -0000204242 00000 n -0000204371 00000 n -0000208945 00000 n -0000207865 00000 n -0000204673 00000 n -0000208496 00000 n -0000208030 00000 n -0000208181 00000 n -0000208623 00000 n -0000208751 00000 n -0000208342 00000 n -0000212363 00000 n -0000212044 00000 n -0000209057 00000 n -0000212170 00000 n -0000212299 00000 n -0000213940 00000 n -0000213621 00000 n -0000212475 00000 n -0000213747 00000 n -0000215316 00000 n -0000215125 00000 n -0000214052 00000 n -0000215251 00000 n -0000219053 00000 n -0000218476 00000 n -0000215415 00000 n -0000218602 00000 n -0000218731 00000 n -0000218860 00000 n -0000218925 00000 n -0000218990 00000 n -0000476969 00000 n -0000224005 00000 n -0000222503 00000 n -0000219165 00000 n -0000223682 00000 n -0000223811 00000 n -0000223940 00000 n -0000222695 00000 n -0000222857 00000 n -0000223019 00000 n -0000223181 00000 n -0000223352 00000 n -0000223522 00000 n -0000228825 00000 n -0000227596 00000 n -0000224117 00000 n -0000228760 00000 n -0000227788 00000 n -0000227951 00000 n -0000228113 00000 n -0000228275 00000 n -0000228435 00000 n -0000228597 00000 n -0000234191 00000 n -0000231832 00000 n -0000228950 00000 n -0000233998 00000 n -0000232078 00000 n -0000232231 00000 n -0000232393 00000 n -0000232555 00000 n -0000232717 00000 n -0000232879 00000 n -0000233041 00000 n -0000233203 00000 n -0000233365 00000 n -0000233519 00000 n -0000233680 00000 n -0000233835 00000 n -0000238748 00000 n -0000237551 00000 n -0000234316 00000 n -0000238039 00000 n -0000238104 00000 n -0000238169 00000 n -0000238298 00000 n -0000238555 00000 n -0000237707 00000 n -0000237877 00000 n -0000238620 00000 n -0000238684 00000 n -0000242343 00000 n -0000242022 00000 n -0000238873 00000 n -0000242148 00000 n -0000242213 00000 n -0000242278 00000 n -0000246354 00000 n -0000245904 00000 n -0000242442 00000 n -0000246030 00000 n -0000246095 00000 n -0000246160 00000 n -0000246289 00000 n -0000477094 00000 n -0000250068 00000 n -0000249358 00000 n -0000246479 00000 n -0000249484 00000 n -0000249549 00000 n -0000249614 00000 n -0000249679 00000 n -0000249744 00000 n -0000249873 00000 n -0000249938 00000 n -0000250003 00000 n -0000253941 00000 n -0000252978 00000 n -0000250193 00000 n -0000253104 00000 n -0000253233 00000 n -0000253298 00000 n -0000253363 00000 n -0000253491 00000 n -0000253555 00000 n -0000253620 00000 n -0000253749 00000 n -0000253877 00000 n -0000257082 00000 n -0000256504 00000 n -0000254133 00000 n -0000256630 00000 n -0000306911 00000 n -0000304913 00000 n -0000306746 00000 n -0000256759 00000 n -0000256888 00000 n -0000257017 00000 n -0000260045 00000 n -0000259724 00000 n -0000257275 00000 n -0000259850 00000 n -0000259915 00000 n -0000259980 00000 n -0000260498 00000 n -0000260307 00000 n -0000260157 00000 n -0000260433 00000 n -0000263079 00000 n -0000262171 00000 n -0000260540 00000 n -0000262757 00000 n -0000262886 00000 n -0000263015 00000 n -0000262327 00000 n -0000262542 00000 n -0000477219 00000 n -0000267198 00000 n -0000266493 00000 n -0000263205 00000 n -0000266619 00000 n -0000304592 00000 n -0000295379 00000 n -0000304406 00000 n -0000266748 00000 n -0000266877 00000 n -0000267006 00000 n -0000270632 00000 n -0000269406 00000 n -0000267363 00000 n -0000269923 00000 n -0000270052 00000 n -0000270181 00000 n -0000270310 00000 n -0000270439 00000 n -0000270568 00000 n -0000269562 00000 n -0000269734 00000 n -0000271086 00000 n +0000009518 00000 n +0000186262 00000 n +0000487277 00000 n +0000009578 00000 n +0000009639 00000 n +0000186388 00000 n +0000487184 00000 n +0000009700 00000 n +0000009752 00000 n +0000189933 00000 n +0000487091 00000 n +0000009813 00000 n +0000009866 00000 n +0000194265 00000 n +0000486998 00000 n +0000009927 00000 n +0000009965 00000 n +0000194394 00000 n +0000486905 00000 n +0000010026 00000 n +0000010078 00000 n +0000197310 00000 n +0000486812 00000 n +0000010139 00000 n +0000010183 00000 n +0000201070 00000 n +0000486719 00000 n +0000010244 00000 n +0000010280 00000 n +0000205027 00000 n +0000486626 00000 n +0000010341 00000 n +0000010404 00000 n +0000205156 00000 n +0000486547 00000 n +0000010465 00000 n +0000010514 00000 n +0000208684 00000 n +0000486454 00000 n +0000010569 00000 n +0000010620 00000 n +0000208811 00000 n +0000486361 00000 n +0000010675 00000 n +0000010739 00000 n +0000212942 00000 n +0000486268 00000 n +0000010794 00000 n +0000010851 00000 n +0000213069 00000 n +0000486175 00000 n +0000010906 00000 n +0000010976 00000 n +0000213197 00000 n +0000486082 00000 n +0000011031 00000 n +0000011080 00000 n +0000216622 00000 n +0000485989 00000 n +0000011135 00000 n +0000011197 00000 n +0000218198 00000 n +0000485896 00000 n +0000011252 00000 n +0000011301 00000 n +0000223055 00000 n +0000485778 00000 n +0000011356 00000 n +0000011418 00000 n +0000223184 00000 n +0000485699 00000 n +0000011478 00000 n +0000011517 00000 n +0000228140 00000 n +0000485606 00000 n +0000011577 00000 n +0000011611 00000 n +0000228269 00000 n +0000485513 00000 n +0000011671 00000 n +0000011712 00000 n +0000238431 00000 n +0000485434 00000 n +0000011772 00000 n +0000011824 00000 n +0000242597 00000 n +0000485316 00000 n +0000011873 00000 n +0000011906 00000 n +0000242726 00000 n +0000485198 00000 n +0000011960 00000 n +0000012032 00000 n +0000242854 00000 n +0000485119 00000 n +0000012091 00000 n +0000012135 00000 n +0000250575 00000 n +0000485040 00000 n +0000012194 00000 n +0000012247 00000 n +0000254137 00000 n +0000484947 00000 n +0000012301 00000 n +0000012351 00000 n +0000257570 00000 n +0000484854 00000 n +0000012405 00000 n +0000012443 00000 n +0000257829 00000 n +0000484761 00000 n +0000012497 00000 n +0000012546 00000 n +0000258088 00000 n +0000484629 00000 n +0000012600 00000 n +0000012652 00000 n +0000260962 00000 n +0000484550 00000 n +0000012711 00000 n +0000012763 00000 n +0000261091 00000 n +0000484457 00000 n +0000012822 00000 n +0000012875 00000 n +0000261220 00000 n +0000484378 00000 n +0000012934 00000 n +0000012983 00000 n +0000261349 00000 n +0000484299 00000 n +0000013037 00000 n +0000013117 00000 n +0000266904 00000 n +0000484166 00000 n +0000013164 00000 n +0000013216 00000 n +0000267033 00000 n +0000484087 00000 n +0000013265 00000 n +0000013309 00000 n +0000270766 00000 n +0000483955 00000 n +0000013358 00000 n +0000013420 00000 n 0000270895 00000 n -0000270745 00000 n -0000271021 00000 n -0000274385 00000 n -0000273807 00000 n -0000271128 00000 n -0000273933 00000 n -0000274062 00000 n -0000274191 00000 n -0000274320 00000 n -0000278271 00000 n -0000277564 00000 n -0000274471 00000 n -0000277690 00000 n -0000277819 00000 n -0000278012 00000 n -0000278077 00000 n -0000278141 00000 n -0000278206 00000 n -0000284925 00000 n -0000281125 00000 n -0000278397 00000 n -0000282006 00000 n -0000282135 00000 n -0000281299 00000 n -0000281478 00000 n -0000281655 00000 n -0000281830 00000 n -0000282328 00000 n -0000282393 00000 n -0000282458 00000 n -0000282523 00000 n -0000282588 00000 n -0000282653 00000 n -0000282718 00000 n -0000282783 00000 n -0000282848 00000 n -0000282913 00000 n -0000282978 00000 n -0000283107 00000 n -0000283172 00000 n -0000283237 00000 n -0000283302 00000 n -0000283367 00000 n -0000283432 00000 n -0000283497 00000 n -0000283562 00000 n -0000283627 00000 n -0000283692 00000 n -0000283757 00000 n -0000283822 00000 n -0000283887 00000 n -0000283952 00000 n -0000284017 00000 n -0000284082 00000 n -0000284147 00000 n -0000284212 00000 n -0000284277 00000 n -0000284342 00000 n -0000284407 00000 n -0000284472 00000 n -0000284537 00000 n -0000284602 00000 n -0000284667 00000 n -0000284732 00000 n -0000284797 00000 n -0000284861 00000 n -0000477344 00000 n -0000291436 00000 n -0000287741 00000 n -0000285077 00000 n -0000287867 00000 n -0000287932 00000 n -0000287997 00000 n -0000288062 00000 n -0000288127 00000 n -0000288192 00000 n -0000288257 00000 n -0000288322 00000 n -0000288386 00000 n -0000288451 00000 n -0000288516 00000 n -0000288581 00000 n -0000288646 00000 n -0000288711 00000 n -0000288776 00000 n -0000288841 00000 n -0000288905 00000 n -0000288970 00000 n -0000289035 00000 n -0000289100 00000 n -0000289165 00000 n -0000289230 00000 n -0000289295 00000 n -0000289360 00000 n -0000289425 00000 n -0000289490 00000 n -0000289555 00000 n -0000289620 00000 n -0000289685 00000 n -0000289750 00000 n -0000289815 00000 n -0000289880 00000 n -0000289945 00000 n -0000290010 00000 n -0000290075 00000 n -0000290140 00000 n -0000290205 00000 n -0000290270 00000 n -0000290335 00000 n -0000290400 00000 n -0000290465 00000 n -0000290530 00000 n -0000290595 00000 n -0000290660 00000 n -0000290725 00000 n -0000290790 00000 n -0000290855 00000 n -0000290920 00000 n -0000290985 00000 n -0000291050 00000 n -0000291115 00000 n -0000291180 00000 n -0000291244 00000 n -0000291308 00000 n -0000291372 00000 n -0000293333 00000 n -0000292624 00000 n -0000291548 00000 n -0000292750 00000 n -0000292879 00000 n -0000293008 00000 n -0000293073 00000 n -0000293138 00000 n -0000293203 00000 n -0000293268 00000 n -0000293490 00000 n -0000304834 00000 n -0000307158 00000 n -0000307127 00000 n -0000315432 00000 n -0000324948 00000 n -0000332419 00000 n -0000342215 00000 n -0000359713 00000 n -0000376700 00000 n -0000397339 00000 n -0000418482 00000 n -0000421563 00000 n -0000421333 00000 n -0000448482 00000 n -0000475292 00000 n -0000477442 00000 n -0000477562 00000 n -0000477685 00000 n -0000477774 00000 n -0000477856 00000 n -0000491831 00000 n -0000503879 00000 n -0000503920 00000 n -0000503960 00000 n -0000504094 00000 n +0000483876 00000 n +0000013474 00000 n +0000013522 00000 n +0000271024 00000 n +0000483797 00000 n +0000013576 00000 n +0000013627 00000 n +0000271153 00000 n +0000483718 00000 n +0000013676 00000 n +0000013723 00000 n +0000274070 00000 n +0000483585 00000 n +0000013770 00000 n +0000013807 00000 n +0000274199 00000 n +0000483467 00000 n +0000013856 00000 n +0000013895 00000 n +0000274328 00000 n +0000483402 00000 n +0000013949 00000 n +0000014027 00000 n +0000274457 00000 n +0000483309 00000 n +0000014076 00000 n +0000014143 00000 n +0000274586 00000 n +0000483230 00000 n +0000014192 00000 n +0000014237 00000 n +0000278080 00000 n +0000483111 00000 n +0000014285 00000 n +0000014317 00000 n +0000278209 00000 n +0000482993 00000 n +0000014366 00000 n +0000014405 00000 n +0000278338 00000 n +0000482928 00000 n +0000014459 00000 n +0000014520 00000 n +0000281837 00000 n +0000482796 00000 n +0000014569 00000 n +0000014626 00000 n +0000281966 00000 n +0000482731 00000 n +0000014680 00000 n +0000014729 00000 n +0000286153 00000 n +0000482613 00000 n +0000014778 00000 n +0000014840 00000 n +0000286282 00000 n +0000482534 00000 n +0000014894 00000 n +0000014949 00000 n +0000296897 00000 n +0000482441 00000 n +0000015003 00000 n +0000015044 00000 n +0000297026 00000 n +0000482362 00000 n +0000015098 00000 n +0000015150 00000 n +0000015505 00000 n +0000015753 00000 n +0000015203 00000 n +0000015627 00000 n +0000015690 00000 n +0000479204 00000 n +0000453540 00000 n +0000479030 00000 n +0000452352 00000 n +0000426192 00000 n +0000452178 00000 n +0000480209 00000 n +0000016417 00000 n +0000016232 00000 n +0000015838 00000 n +0000016354 00000 n +0000425507 00000 n +0000423361 00000 n +0000425343 00000 n +0000019592 00000 n +0000018782 00000 n +0000016502 00000 n +0000018904 00000 n +0000019028 00000 n +0000019153 00000 n +0000019278 00000 n +0000422507 00000 n +0000402149 00000 n +0000422333 00000 n +0000019403 00000 n +0000019466 00000 n +0000019529 00000 n +0000401200 00000 n +0000381448 00000 n +0000401027 00000 n +0000380706 00000 n +0000363988 00000 n +0000380533 00000 n +0000024130 00000 n +0000022948 00000 n +0000019716 00000 n +0000023442 00000 n +0000363453 00000 n +0000346536 00000 n +0000363269 00000 n +0000023505 00000 n +0000023568 00000 n +0000023693 00000 n +0000023818 00000 n +0000023943 00000 n +0000023098 00000 n +0000023291 00000 n +0000024068 00000 n +0000242790 00000 n +0000286346 00000 n +0000028816 00000 n +0000027781 00000 n +0000024254 00000 n +0000028253 00000 n +0000028378 00000 n +0000027931 00000 n +0000028093 00000 n +0000028503 00000 n +0000028628 00000 n +0000028753 00000 n +0000044129 00000 n +0000031978 00000 n +0000031419 00000 n +0000028940 00000 n +0000031541 00000 n +0000031666 00000 n +0000031791 00000 n +0000031915 00000 n +0000034864 00000 n +0000034057 00000 n +0000032089 00000 n +0000034179 00000 n +0000034304 00000 n +0000034429 00000 n +0000034554 00000 n +0000034676 00000 n +0000034801 00000 n +0000480327 00000 n +0000035945 00000 n +0000035635 00000 n +0000034949 00000 n +0000035757 00000 n +0000035882 00000 n +0000037998 00000 n +0000037313 00000 n +0000036043 00000 n +0000037435 00000 n +0000037560 00000 n +0000037684 00000 n +0000037809 00000 n +0000037935 00000 n +0000041007 00000 n +0000040140 00000 n +0000038096 00000 n +0000040441 00000 n +0000040567 00000 n +0000040630 00000 n +0000040692 00000 n +0000040282 00000 n +0000040818 00000 n +0000040944 00000 n +0000197374 00000 n +0000044318 00000 n +0000043881 00000 n +0000041118 00000 n +0000044003 00000 n +0000346009 00000 n +0000336700 00000 n +0000345832 00000 n +0000044255 00000 n +0000048018 00000 n +0000047833 00000 n +0000044442 00000 n +0000047955 00000 n +0000336257 00000 n +0000329458 00000 n +0000336080 00000 n +0000052383 00000 n +0000051992 00000 n +0000048181 00000 n +0000052320 00000 n +0000052134 00000 n +0000480445 00000 n +0000111974 00000 n +0000054583 00000 n +0000054146 00000 n +0000052520 00000 n +0000054268 00000 n +0000054394 00000 n +0000054457 00000 n +0000054520 00000 n +0000058107 00000 n +0000057069 00000 n +0000054707 00000 n +0000057541 00000 n +0000057667 00000 n +0000057793 00000 n +0000057219 00000 n +0000057380 00000 n +0000057918 00000 n +0000058044 00000 n +0000149936 00000 n +0000174710 00000 n +0000062678 00000 n +0000061761 00000 n +0000058205 00000 n +0000062237 00000 n +0000062363 00000 n +0000061911 00000 n +0000062076 00000 n +0000062489 00000 n +0000062615 00000 n +0000287125 00000 n +0000065593 00000 n +0000065221 00000 n +0000062828 00000 n +0000065530 00000 n +0000065363 00000 n +0000066778 00000 n +0000066593 00000 n +0000065717 00000 n +0000066715 00000 n +0000069916 00000 n +0000069228 00000 n +0000066876 00000 n +0000069350 00000 n +0000069476 00000 n +0000069602 00000 n +0000069727 00000 n +0000069853 00000 n +0000480563 00000 n +0000073296 00000 n +0000072419 00000 n +0000070053 00000 n +0000072729 00000 n +0000072855 00000 n +0000072981 00000 n +0000073107 00000 n +0000073233 00000 n +0000072561 00000 n +0000238495 00000 n +0000077405 00000 n +0000076718 00000 n +0000073433 00000 n +0000076840 00000 n +0000076966 00000 n +0000077092 00000 n +0000077217 00000 n +0000077342 00000 n +0000081106 00000 n +0000080546 00000 n +0000077529 00000 n +0000080668 00000 n +0000080793 00000 n +0000080919 00000 n +0000081043 00000 n +0000084107 00000 n +0000085806 00000 n +0000083985 00000 n +0000081230 00000 n +0000085743 00000 n +0000328623 00000 n +0000319765 00000 n +0000328451 00000 n +0000085575 00000 n +0000085632 00000 n +0000085721 00000 n +0000088800 00000 n +0000088058 00000 n +0000085958 00000 n +0000088359 00000 n +0000088485 00000 n +0000088200 00000 n +0000088611 00000 n +0000088737 00000 n +0000282030 00000 n +0000091487 00000 n +0000090924 00000 n +0000088924 00000 n +0000091046 00000 n +0000091172 00000 n +0000091298 00000 n +0000091424 00000 n +0000480681 00000 n +0000091919 00000 n +0000091734 00000 n +0000091585 00000 n +0000091856 00000 n +0000095859 00000 n +0000095111 00000 n +0000091960 00000 n +0000095419 00000 n +0000095545 00000 n +0000095670 00000 n +0000095733 00000 n +0000095796 00000 n +0000095253 00000 n +0000100231 00000 n +0000100546 00000 n +0000099983 00000 n +0000095957 00000 n +0000100105 00000 n +0000100357 00000 n +0000100483 00000 n +0000104153 00000 n +0000103591 00000 n +0000100670 00000 n +0000103713 00000 n +0000103838 00000 n +0000103964 00000 n +0000104090 00000 n +0000106908 00000 n +0000108148 00000 n +0000106786 00000 n +0000104277 00000 n +0000107833 00000 n +0000107959 00000 n +0000108022 00000 n +0000108085 00000 n +0000112037 00000 n +0000111222 00000 n +0000108300 00000 n +0000111344 00000 n +0000111470 00000 n +0000111596 00000 n +0000111659 00000 n +0000111722 00000 n +0000111848 00000 n +0000480799 00000 n +0000117041 00000 n +0000115670 00000 n +0000112148 00000 n +0000116476 00000 n +0000115836 00000 n +0000115986 00000 n +0000116602 00000 n +0000116728 00000 n +0000116854 00000 n +0000116980 00000 n +0000116144 00000 n +0000116293 00000 n +0000297540 00000 n +0000120344 00000 n +0000119702 00000 n +0000117178 00000 n +0000120030 00000 n +0000119844 00000 n +0000120156 00000 n +0000120282 00000 n +0000124968 00000 n +0000124657 00000 n +0000120468 00000 n +0000124779 00000 n +0000124905 00000 n +0000128122 00000 n +0000127751 00000 n +0000125092 00000 n +0000128059 00000 n +0000127893 00000 n +0000131063 00000 n +0000131251 00000 n +0000130815 00000 n +0000128233 00000 n +0000130937 00000 n +0000131126 00000 n +0000131188 00000 n +0000134967 00000 n +0000134199 00000 n +0000131362 00000 n +0000134652 00000 n +0000134778 00000 n +0000134904 00000 n +0000134349 00000 n +0000134500 00000 n +0000480917 00000 n +0000136949 00000 n +0000136386 00000 n +0000135078 00000 n +0000136508 00000 n +0000136634 00000 n +0000136760 00000 n +0000136886 00000 n +0000138488 00000 n +0000138303 00000 n +0000137060 00000 n +0000138425 00000 n +0000141958 00000 n +0000141647 00000 n +0000138586 00000 n +0000141769 00000 n +0000141895 00000 n +0000146033 00000 n +0000145673 00000 n +0000142082 00000 n +0000145970 00000 n +0000145815 00000 n +0000205220 00000 n +0000150125 00000 n +0000149688 00000 n +0000146157 00000 n +0000149810 00000 n +0000149999 00000 n +0000150062 00000 n +0000154198 00000 n +0000153679 00000 n +0000150236 00000 n +0000154135 00000 n +0000153829 00000 n +0000153981 00000 n +0000481035 00000 n +0000159353 00000 n +0000158402 00000 n +0000154363 00000 n +0000159290 00000 n +0000158568 00000 n +0000158752 00000 n +0000158925 00000 n +0000159107 00000 n +0000208875 00000 n +0000163746 00000 n +0000163121 00000 n +0000159503 00000 n +0000163431 00000 n +0000163557 00000 n +0000163263 00000 n +0000163683 00000 n +0000218262 00000 n +0000168067 00000 n +0000167269 00000 n +0000163870 00000 n +0000167754 00000 n +0000167879 00000 n +0000167419 00000 n +0000167584 00000 n +0000168004 00000 n +0000271216 00000 n +0000171290 00000 n +0000170979 00000 n +0000168191 00000 n +0000171101 00000 n +0000171227 00000 n +0000174773 00000 n +0000174462 00000 n +0000171401 00000 n +0000174584 00000 n +0000319239 00000 n +0000311348 00000 n +0000319066 00000 n +0000178624 00000 n +0000178439 00000 n +0000174938 00000 n +0000178561 00000 n +0000481153 00000 n +0000182213 00000 n +0000181722 00000 n +0000178735 00000 n +0000182024 00000 n +0000182150 00000 n +0000181864 00000 n +0000186515 00000 n +0000185715 00000 n +0000182378 00000 n +0000186198 00000 n +0000186325 00000 n +0000185868 00000 n +0000186451 00000 n +0000186043 00000 n +0000190062 00000 n +0000189743 00000 n +0000186626 00000 n +0000189868 00000 n +0000189997 00000 n +0000194522 00000 n +0000193727 00000 n +0000190215 00000 n +0000194200 00000 n +0000194329 00000 n +0000194457 00000 n +0000193882 00000 n +0000194044 00000 n +0000197568 00000 n +0000196929 00000 n +0000194688 00000 n +0000197245 00000 n +0000197075 00000 n +0000197438 00000 n +0000197503 00000 n +0000201198 00000 n +0000200697 00000 n +0000197680 00000 n +0000201005 00000 n +0000201134 00000 n +0000200844 00000 n +0000481274 00000 n +0000205414 00000 n +0000204649 00000 n +0000201377 00000 n +0000204962 00000 n +0000205091 00000 n +0000204796 00000 n +0000205284 00000 n +0000205349 00000 n +0000213261 00000 n +0000208938 00000 n +0000208493 00000 n +0000205526 00000 n +0000208619 00000 n +0000208748 00000 n +0000213326 00000 n +0000212249 00000 n +0000209050 00000 n +0000212877 00000 n +0000212414 00000 n +0000212564 00000 n +0000213004 00000 n +0000213132 00000 n +0000212723 00000 n +0000216750 00000 n +0000216431 00000 n +0000213438 00000 n +0000216557 00000 n +0000216686 00000 n +0000218326 00000 n +0000218007 00000 n +0000216862 00000 n +0000218133 00000 n +0000219706 00000 n +0000219515 00000 n +0000218438 00000 n +0000219641 00000 n +0000481399 00000 n +0000223441 00000 n +0000222864 00000 n +0000219805 00000 n +0000222990 00000 n +0000223119 00000 n +0000223248 00000 n +0000223313 00000 n +0000223378 00000 n +0000228398 00000 n +0000226897 00000 n +0000223553 00000 n +0000228075 00000 n +0000228204 00000 n +0000228333 00000 n +0000227089 00000 n +0000227251 00000 n +0000227413 00000 n +0000227575 00000 n +0000227745 00000 n +0000227915 00000 n +0000233202 00000 n +0000231975 00000 n +0000228510 00000 n +0000233137 00000 n +0000232167 00000 n +0000232328 00000 n +0000232490 00000 n +0000232652 00000 n +0000232812 00000 n +0000232974 00000 n +0000238559 00000 n +0000236211 00000 n +0000233327 00000 n +0000238366 00000 n +0000236457 00000 n +0000236611 00000 n +0000236773 00000 n +0000236935 00000 n +0000237095 00000 n +0000237255 00000 n +0000237417 00000 n +0000237577 00000 n +0000237736 00000 n +0000237889 00000 n +0000238052 00000 n +0000238203 00000 n +0000243111 00000 n +0000241915 00000 n +0000238684 00000 n +0000242402 00000 n +0000242467 00000 n +0000242532 00000 n +0000242661 00000 n +0000242918 00000 n +0000242071 00000 n +0000242241 00000 n +0000242983 00000 n +0000243047 00000 n +0000246703 00000 n +0000246382 00000 n +0000243236 00000 n +0000246508 00000 n +0000246573 00000 n +0000246638 00000 n +0000481524 00000 n +0000250703 00000 n +0000250255 00000 n +0000246802 00000 n +0000250381 00000 n +0000250446 00000 n +0000250510 00000 n +0000250638 00000 n +0000254396 00000 n +0000253687 00000 n +0000250828 00000 n +0000253813 00000 n +0000253878 00000 n +0000253942 00000 n +0000254007 00000 n +0000254072 00000 n +0000254201 00000 n +0000254266 00000 n +0000254331 00000 n +0000258217 00000 n +0000257379 00000 n +0000254521 00000 n +0000257505 00000 n +0000257634 00000 n +0000257699 00000 n +0000257764 00000 n +0000257893 00000 n +0000257958 00000 n +0000258023 00000 n +0000258152 00000 n +0000261478 00000 n +0000260771 00000 n +0000258396 00000 n +0000260897 00000 n +0000261026 00000 n +0000310993 00000 n +0000308995 00000 n +0000310828 00000 n +0000261155 00000 n +0000261284 00000 n +0000261413 00000 n +0000264497 00000 n +0000264176 00000 n +0000261671 00000 n +0000264302 00000 n +0000264367 00000 n +0000264432 00000 n +0000267161 00000 n +0000266253 00000 n +0000264622 00000 n +0000266839 00000 n +0000266968 00000 n +0000267097 00000 n +0000266409 00000 n +0000266624 00000 n +0000481649 00000 n +0000271280 00000 n +0000270575 00000 n +0000267287 00000 n +0000270701 00000 n +0000308674 00000 n +0000299461 00000 n +0000308488 00000 n +0000270830 00000 n +0000270959 00000 n +0000271088 00000 n +0000274714 00000 n +0000273488 00000 n +0000271445 00000 n +0000274005 00000 n +0000274134 00000 n +0000274263 00000 n +0000274392 00000 n +0000274521 00000 n +0000274650 00000 n +0000273644 00000 n +0000273816 00000 n +0000275168 00000 n +0000274977 00000 n +0000274827 00000 n +0000275103 00000 n +0000278467 00000 n +0000277889 00000 n +0000275210 00000 n +0000278015 00000 n +0000278144 00000 n +0000278273 00000 n +0000278402 00000 n +0000282353 00000 n +0000281646 00000 n +0000278553 00000 n +0000281772 00000 n +0000281901 00000 n +0000282094 00000 n +0000282159 00000 n +0000282223 00000 n +0000282288 00000 n +0000289007 00000 n +0000285207 00000 n +0000282479 00000 n +0000286088 00000 n +0000286217 00000 n +0000285381 00000 n +0000285560 00000 n +0000285737 00000 n +0000285912 00000 n +0000286410 00000 n +0000286475 00000 n +0000286540 00000 n +0000286605 00000 n +0000286670 00000 n +0000286735 00000 n +0000286800 00000 n +0000286865 00000 n +0000286930 00000 n +0000286995 00000 n +0000287060 00000 n +0000287189 00000 n +0000287254 00000 n +0000287319 00000 n +0000287384 00000 n +0000287449 00000 n +0000287514 00000 n +0000287579 00000 n +0000287644 00000 n +0000287709 00000 n +0000287774 00000 n +0000287839 00000 n +0000287904 00000 n +0000287969 00000 n +0000288034 00000 n +0000288099 00000 n +0000288164 00000 n +0000288229 00000 n +0000288294 00000 n +0000288359 00000 n +0000288424 00000 n +0000288489 00000 n +0000288554 00000 n +0000288619 00000 n +0000288684 00000 n +0000288749 00000 n +0000288814 00000 n +0000288879 00000 n +0000288943 00000 n +0000481774 00000 n +0000295518 00000 n +0000291823 00000 n +0000289159 00000 n +0000291949 00000 n +0000292014 00000 n +0000292079 00000 n +0000292144 00000 n +0000292209 00000 n +0000292274 00000 n +0000292339 00000 n +0000292404 00000 n +0000292468 00000 n +0000292533 00000 n +0000292598 00000 n +0000292663 00000 n +0000292728 00000 n +0000292793 00000 n +0000292858 00000 n +0000292923 00000 n +0000292987 00000 n +0000293052 00000 n +0000293117 00000 n +0000293182 00000 n +0000293247 00000 n +0000293312 00000 n +0000293377 00000 n +0000293442 00000 n +0000293507 00000 n +0000293572 00000 n +0000293637 00000 n +0000293702 00000 n +0000293767 00000 n +0000293832 00000 n +0000293897 00000 n +0000293962 00000 n +0000294027 00000 n +0000294092 00000 n +0000294157 00000 n +0000294222 00000 n +0000294287 00000 n +0000294352 00000 n +0000294417 00000 n +0000294482 00000 n +0000294547 00000 n +0000294612 00000 n +0000294677 00000 n +0000294742 00000 n +0000294807 00000 n +0000294872 00000 n +0000294937 00000 n +0000295002 00000 n +0000295067 00000 n +0000295132 00000 n +0000295197 00000 n +0000295262 00000 n +0000295326 00000 n +0000295390 00000 n +0000295454 00000 n +0000297415 00000 n +0000296706 00000 n +0000295630 00000 n +0000296832 00000 n +0000296961 00000 n +0000297090 00000 n +0000297155 00000 n +0000297220 00000 n +0000297285 00000 n +0000297350 00000 n +0000297572 00000 n +0000308916 00000 n +0000311240 00000 n +0000311209 00000 n +0000319514 00000 n +0000329028 00000 n +0000336499 00000 n +0000346295 00000 n +0000363793 00000 n +0000381125 00000 n +0000401768 00000 n +0000422911 00000 n +0000425994 00000 n +0000425764 00000 n +0000452913 00000 n +0000479723 00000 n +0000481872 00000 n +0000481992 00000 n +0000482115 00000 n +0000482204 00000 n +0000482286 00000 n +0000496261 00000 n +0000508315 00000 n +0000508356 00000 n +0000508396 00000 n +0000508530 00000 n trailer << -/Size 1373 -/Root 1371 0 R -/Info 1372 0 R -/ID [<01CCFD1E5FBF13DF94A8F939D2FB9838> <01CCFD1E5FBF13DF94A8F939D2FB9838>] +/Size 1374 +/Root 1372 0 R +/Info 1373 0 R +/ID [<849C0367ACB409D7EBB4F8D7A4BA6CDD> <849C0367ACB409D7EBB4F8D7A4BA6CDD>] >> startxref -504352 +508788 %%EOF diff --git a/doc/misc/options b/doc/misc/options index a1bcf779a3bf..792b7986f21f 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -19,7 +19,8 @@ key <string> { logging { category <string> { <string>; ... }; channel <string> { - file <log_file>; + file <quoted_string> [ versions ( "unlimited" | <integer> ) + ] [ size <size> ]; null; print-category <boolean>; print-severity <boolean>; @@ -38,8 +39,8 @@ lwres { view <string> <optional_class>; }; -masters <string> [ port <integer> ] { ( <masters> | <ipv4_address> [port - <integer>] | <ipv6_address> [port <integer>] ) [ key <string> ]; ... }; +masters <string> [ port <integer> ] { ( <masters> | <ipv4_address> [ port + <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... }; options { additional-from-auth <boolean>; @@ -56,8 +57,8 @@ options { alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]; auth-nxdomain <boolean>; // default changed - avoid-v4-udp-ports { <port>; ... }; - avoid-v6-udp-ports { <port>; ... }; + avoid-v4-udp-ports { <portrange>; ... }; + avoid-v6-udp-ports { <portrange>; ... }; blackhole { <address_match_element>; ... }; cache-file <quoted_string>; check-names ( master | slave | response ) ( fail | warn | ignore ); @@ -71,9 +72,9 @@ options { dnssec-enable <boolean>; dnssec-lookaside <string> trust-anchor <string>; dnssec-must-be-secure <string> <boolean>; - dual-stack-servers [ port <integer> ] { ( <quoted_string> [port - <integer>] | <ipv4_address> [port <integer>] | <ipv6_address> - [port <integer>] ); ... }; + dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port + <integer> ] | <ipv4_address> [ port <integer> ] | + <ipv6_address> [ port <integer> ] ); ... }; dump-file <quoted_string>; edns-udp-size <integer>; fake-iquery <boolean>; // obsolete @@ -130,6 +131,7 @@ options { recursion <boolean>; recursive-clients <integer>; request-ixfr <boolean>; + reserved-sockets <integer>; rfc2308-type1 <boolean>; // not yet implemented root-delegation-only [ exclude { <quoted_string>; ... } ]; rrset-order { [ class <string> ] [ type <string> ] [ name @@ -159,6 +161,8 @@ options { use-alt-transfer-source <boolean>; use-id-pool <boolean>; // obsolete use-ixfr <boolean>; + use-v4-udp-ports { <portrange>; ... }; + use-v6-udp-ports { <portrange>; ... }; version ( <quoted_string> | none ); zone-statistics <boolean>; }; @@ -201,9 +205,9 @@ view <string> <optional_class> { dnssec-enable <boolean>; dnssec-lookaside <string> trust-anchor <string>; dnssec-must-be-secure <string> <boolean>; - dual-stack-servers [ port <integer> ] { ( <quoted_string> [port - <integer>] | <ipv4_address> [port <integer>] | <ipv6_address> - [port <integer>] ); ... }; + dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port + <integer> ] | <ipv4_address> [ port <integer> ] | + <ipv6_address> [ port <integer> ] ); ... }; edns-udp-size <integer>; fetch-glue <boolean>; // obsolete forward ( first | only ); @@ -298,9 +302,9 @@ view <string> <optional_class> { ixfr-tmp-file <quoted_string>; // obsolete key-directory <quoted_string>; maintain-ixfr-base <boolean>; // obsolete - masters [ port <integer> ] { ( <masters> | <ipv4_address> - [port <integer>] | <ipv6_address> [port <integer>] ) [ - key <string> ]; ... }; + masters [ port <integer> ] { ( <masters> | <ipv4_address> [ + port <integer> ] | <ipv6_address> [ port <integer> ] ) + [ key <string> ]; ... }; max-ixfr-log-size <size>; // obsolete max-journal-size <size_no_default>; max-refresh-time <integer>; @@ -359,9 +363,9 @@ zone <string> <optional_class> { ixfr-tmp-file <quoted_string>; // obsolete key-directory <quoted_string>; maintain-ixfr-base <boolean>; // obsolete - masters [ port <integer> ] { ( <masters> | <ipv4_address> [port - <integer>] | <ipv6_address> [port <integer>] ) [ key <string> - ]; ... }; + masters [ port <integer> ] { ( <masters> | <ipv4_address> [ port + <integer> ] | <ipv6_address> [ port <integer> ] ) [ key + <string> ]; ... }; max-ixfr-log-size <size>; // obsolete max-journal-size <size_no_default>; max-refresh-time <integer>; diff --git a/doc/rfc/index b/doc/rfc/index index 990d4a90be04..fea5f7181928 100644 --- a/doc/rfc/index +++ b/doc/rfc/index @@ -9,7 +9,7 @@ 1183: New DNS RR Definitions (AFSDB, RP, X25, ISDN and RT) 1348: DNS NSAP RRs 1535: A Security Problem and Proposed Correction - With Widely Deployed DNS Software + With Widely Deployed DNS Software 1536: Common DNS Implementation Errors and Suggested Fixes 1537: Common DNS Data File Configuration Errors 1591: Domain Name System Structure and Delegation @@ -63,6 +63,7 @@ 2931: DNS Request and Transaction Signatures ( SIG(0)s ) 3007: Secure Domain Name System (DNS) Dynamic Update 3008: Domain Name System Security (DNSSEC) Signing Authority +3056: Connection of IPv6 Domains via IPv4 Clouds 3071: Reflections on the DNS, RFC 1591, and Categories of Domains 3090: DNS Security Extension Clarification on Zone Status 3110: RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS) @@ -81,17 +82,17 @@ 3490: Internationalizing Domain Names In Applications (IDNA) 3491: Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN) 3492: Punycode:A Bootstring encoding of Unicode for - Internationalized Domain Names in Applications (IDNA) + Internationalized Domain Names in Applications (IDNA) 3493: Basic Socket Interface Extensions for IPv6 3513: Internet Protocol Version 6 (IPv6) Addressing Architecture 3596: DNS Extensions to Support IP Version 6 3597: Handling of Unknown DNS Resource Record (RR) Types 3645: Generic Security Service Algorithm for - Secret Key Transaction Authentication for DNS (GSS-TSIG) + Secret Key Transaction Authentication for DNS (GSS-TSIG) 3655: Redefinition of DNS Authenticated Data (AD) bit 3658: Delegation Signer (DS) Resource Record (RR) 3757: Domain Name System KEY (DNSKEY) Resource Record (RR) - Secure Entry Point (SEP) Flag + Secure Entry Point (SEP) Flag 3833: Threat Analysis of the Domain Name System (DNS) 3845: DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format 3901: DNS IPv6 Transport Operational Guidelines @@ -112,3 +113,7 @@ 4470: Minimally Covering NSEC Records and DNSSEC On-line Signing 4634: US Secure Hash Algorithms (SHA and HMAC-SHA) 4641: DNSSEC Operational Practices +4648: The Base16, Base32, and Base64 Data Encodings +4701: A DNS Resource Record (RR) for Encoding + Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR) +5155: DNS Security (DNSSEC) Hashed Authenticated Denial of Existence diff --git a/doc/rfc/rfc4648.txt b/doc/rfc/rfc4648.txt new file mode 100644 index 000000000000..c7599b4330cb --- /dev/null +++ b/doc/rfc/rfc4648.txt @@ -0,0 +1,1011 @@ + + + + + + +Network Working Group S. Josefsson +Request for Comments: 4648 SJD +Obsoletes: 3548 October 2006 +Category: Standards Track + + + The Base16, Base32, and Base64 Data Encodings + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + This document describes the commonly used base 64, base 32, and base + 16 encoding schemes. It also discusses the use of line-feeds in + encoded data, use of padding in encoded data, use of non-alphabet + characters in encoded data, use of different encoding alphabets, and + canonical encodings. + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 1] + +RFC 4648 Base-N Encodings October 2006 + + +Table of Contents + + 1. Introduction ....................................................3 + 2. Conventions Used in This Document ...............................3 + 3. Implementation Discrepancies ....................................3 + 3.1. Line Feeds in Encoded Data .................................3 + 3.2. Padding of Encoded Data ....................................4 + 3.3. Interpretation of Non-Alphabet Characters in Encoded Data ..4 + 3.4. Choosing the Alphabet ......................................4 + 3.5. Canonical Encoding .........................................5 + 4. Base 64 Encoding ................................................5 + 5. Base 64 Encoding with URL and Filename Safe Alphabet ............7 + 6. Base 32 Encoding ................................................8 + 7. Base 32 Encoding with Extended Hex Alphabet ....................10 + 8. Base 16 Encoding ...............................................10 + 9. Illustrations and Examples .....................................11 + 10. Test Vectors ..................................................12 + 11. ISO C99 Implementation of Base64 ..............................14 + 12. Security Considerations .......................................14 + 13. Changes Since RFC 3548 ........................................15 + 14. Acknowledgements ..............................................15 + 15. Copying Conditions ............................................15 + 16. References ....................................................16 + 16.1. Normative References .....................................16 + 16.2. Informative References ...................................16 + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 2] + +RFC 4648 Base-N Encodings October 2006 + + +1. Introduction + + Base encoding of data is used in many situations to store or transfer + data in environments that, perhaps for legacy reasons, are restricted + to US-ASCII [1] data. Base encoding can also be used in new + applications that do not have legacy restrictions, simply because it + makes it possible to manipulate objects with text editors. + + In the past, different applications have had different requirements + and thus sometimes implemented base encodings in slightly different + ways. Today, protocol specifications sometimes use base encodings in + general, and "base64" in particular, without a precise description or + reference. Multipurpose Internet Mail Extensions (MIME) [4] is often + used as a reference for base64 without considering the consequences + for line-wrapping or non-alphabet characters. The purpose of this + specification is to establish common alphabet and encoding + considerations. This will hopefully reduce ambiguity in other + documents, leading to better interoperability. + +2. Conventions Used in This Document + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [2]. + +3. Implementation Discrepancies + + Here we discuss the discrepancies between base encoding + implementations in the past and, where appropriate, mandate a + specific recommended behavior for the future. + +3.1. Line Feeds in Encoded Data + + MIME [4] is often used as a reference for base 64 encoding. However, + MIME does not define "base 64" per se, but rather a "base 64 Content- + Transfer-Encoding" for use within MIME. As such, MIME enforces a + limit on line length of base 64-encoded data to 76 characters. MIME + inherits the encoding from Privacy Enhanced Mail (PEM) [3], stating + that it is "virtually identical"; however, PEM uses a line length of + 64 characters. The MIME and PEM limits are both due to limits within + SMTP. + + Implementations MUST NOT add line feeds to base-encoded data unless + the specification referring to this document explicitly directs base + encoders to add line feeds after a specific number of characters. + + + + + + +Josefsson Standards Track [Page 3] + +RFC 4648 Base-N Encodings October 2006 + + +3.2. Padding of Encoded Data + + In some circumstances, the use of padding ("=") in base-encoded data + is not required or used. In the general case, when assumptions about + the size of transported data cannot be made, padding is required to + yield correct decoded data. + + Implementations MUST include appropriate pad characters at the end of + encoded data unless the specification referring to this document + explicitly states otherwise. + + The base64 and base32 alphabets use padding, as described below in + sections 4 and 6, but the base16 alphabet does not need it; see + section 8. + +3.3. Interpretation of Non-Alphabet Characters in Encoded Data + + Base encodings use a specific, reduced alphabet to encode binary + data. Non-alphabet characters could exist within base-encoded data, + caused by data corruption or by design. Non-alphabet characters may + be exploited as a "covert channel", where non-protocol data can be + sent for nefarious purposes. Non-alphabet characters might also be + sent in order to exploit implementation errors leading to, e.g., + buffer overflow attacks. + + Implementations MUST reject the encoded data if it contains + characters outside the base alphabet when interpreting base-encoded + data, unless the specification referring to this document explicitly + states otherwise. Such specifications may instead state, as MIME + does, that characters outside the base encoding alphabet should + simply be ignored when interpreting data ("be liberal in what you + accept"). Note that this means that any adjacent carriage return/ + line feed (CRLF) characters constitute "non-alphabet characters" and + are ignored. Furthermore, such specifications MAY ignore the pad + character, "=", treating it as non-alphabet data, if it is present + before the end of the encoded data. If more than the allowed number + of pad characters is found at the end of the string (e.g., a base 64 + string terminated with "==="), the excess pad characters MAY also be + ignored. + +3.4. Choosing the Alphabet + + Different applications have different requirements on the characters + in the alphabet. Here are a few requirements that determine which + alphabet should be used: + + + + + + +Josefsson Standards Track [Page 4] + +RFC 4648 Base-N Encodings October 2006 + + + o Handled by humans. The characters "0" and "O" are easily + confused, as are "1", "l", and "I". In the base32 alphabet below, + where 0 (zero) and 1 (one) are not present, a decoder may + interpret 0 as O, and 1 as I or L depending on case. (However, by + default it should not; see previous section.) + + o Encoded into structures that mandate other requirements. For base + 16 and base 32, this determines the use of upper- or lowercase + alphabets. For base 64, the non-alphanumeric characters (in + particular, "/") may be problematic in file names and URLs. + + o Used as identifiers. Certain characters, notably "+" and "/" in + the base 64 alphabet, are treated as word-breaks by legacy text + search/index tools. + + There is no universally accepted alphabet that fulfills all the + requirements. For an example of a highly specialized variant, see + IMAP [8]. In this document, we document and name some currently used + alphabets. + +3.5. Canonical Encoding + + The padding step in base 64 and base 32 encoding can, if improperly + implemented, lead to non-significant alterations of the encoded data. + For example, if the input is only one octet for a base 64 encoding, + then all six bits of the first symbol are used, but only the first + two bits of the next symbol are used. These pad bits MUST be set to + zero by conforming encoders, which is described in the descriptions + on padding below. If this property do not hold, there is no + canonical representation of base-encoded data, and multiple base- + encoded strings can be decoded to the same binary data. If this + property (and others discussed in this document) holds, a canonical + encoding is guaranteed. + + In some environments, the alteration is critical and therefore + decoders MAY chose to reject an encoding if the pad bits have not + been set to zero. The specification referring to this may mandate a + specific behaviour. + +4. Base 64 Encoding + + The following description of base 64 is derived from [3], [4], [5], + and [6]. This encoding may be referred to as "base64". + + The Base 64 encoding is designed to represent arbitrary sequences of + octets in a form that allows the use of both upper- and lowercase + letters but that need not be human readable. + + + + +Josefsson Standards Track [Page 5] + +RFC 4648 Base-N Encodings October 2006 + + + A 65-character subset of US-ASCII is used, enabling 6 bits to be + represented per printable character. (The extra 65th character, "=", + is used to signify a special processing function.) + + The encoding process represents 24-bit groups of input bits as output + strings of 4 encoded characters. Proceeding from left to right, a + 24-bit input group is formed by concatenating 3 8-bit input groups. + These 24 bits are then treated as 4 concatenated 6-bit groups, each + of which is translated into a single character in the base 64 + alphabet. + + Each 6-bit group is used as an index into an array of 64 printable + characters. The character referenced by the index is placed in the + output string. + + Table 1: The Base 64 Alphabet + + Value Encoding Value Encoding Value Encoding Value Encoding + 0 A 17 R 34 i 51 z + 1 B 18 S 35 j 52 0 + 2 C 19 T 36 k 53 1 + 3 D 20 U 37 l 54 2 + 4 E 21 V 38 m 55 3 + 5 F 22 W 39 n 56 4 + 6 G 23 X 40 o 57 5 + 7 H 24 Y 41 p 58 6 + 8 I 25 Z 42 q 59 7 + 9 J 26 a 43 r 60 8 + 10 K 27 b 44 s 61 9 + 11 L 28 c 45 t 62 + + 12 M 29 d 46 u 63 / + 13 N 30 e 47 v + 14 O 31 f 48 w (pad) = + 15 P 32 g 49 x + 16 Q 33 h 50 y + + Special processing is performed if fewer than 24 bits are available + at the end of the data being encoded. A full encoding quantum is + always completed at the end of a quantity. When fewer than 24 input + bits are available in an input group, bits with value zero are added + (on the right) to form an integral number of 6-bit groups. Padding + at the end of the data is performed using the '=' character. Since + all base 64 input is an integral number of octets, only the following + cases can arise: + + (1) The final quantum of encoding input is an integral multiple of 24 + bits; here, the final unit of encoded output will be an integral + multiple of 4 characters with no "=" padding. + + + +Josefsson Standards Track [Page 6] + +RFC 4648 Base-N Encodings October 2006 + + + (2) The final quantum of encoding input is exactly 8 bits; here, the + final unit of encoded output will be two characters followed by + two "=" padding characters. + + (3) The final quantum of encoding input is exactly 16 bits; here, the + final unit of encoded output will be three characters followed by + one "=" padding character. + +5. Base 64 Encoding with URL and Filename Safe Alphabet + + The Base 64 encoding with an URL and filename safe alphabet has been + used in [12]. + + An alternative alphabet has been suggested that would use "~" as the + 63rd character. Since the "~" character has special meaning in some + file system environments, the encoding described in this section is + recommended instead. The remaining unreserved URI character is ".", + but some file system environments do not permit multiple "." in a + filename, thus making the "." character unattractive as well. + + The pad character "=" is typically percent-encoded when used in an + URI [9], but if the data length is known implicitly, this can be + avoided by skipping the padding; see section 3.2. + + This encoding may be referred to as "base64url". This encoding + should not be regarded as the same as the "base64" encoding and + should not be referred to as only "base64". Unless clarified + otherwise, "base64" refers to the base 64 in the previous section. + + This encoding is technically identical to the previous one, except + for the 62:nd and 63:rd alphabet character, as indicated in Table 2. + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 7] + +RFC 4648 Base-N Encodings October 2006 + + + Table 2: The "URL and Filename safe" Base 64 Alphabet + + Value Encoding Value Encoding Value Encoding Value Encoding + 0 A 17 R 34 i 51 z + 1 B 18 S 35 j 52 0 + 2 C 19 T 36 k 53 1 + 3 D 20 U 37 l 54 2 + 4 E 21 V 38 m 55 3 + 5 F 22 W 39 n 56 4 + 6 G 23 X 40 o 57 5 + 7 H 24 Y 41 p 58 6 + 8 I 25 Z 42 q 59 7 + 9 J 26 a 43 r 60 8 + 10 K 27 b 44 s 61 9 + 11 L 28 c 45 t 62 - (minus) + 12 M 29 d 46 u 63 _ + 13 N 30 e 47 v (underline) + 14 O 31 f 48 w + 15 P 32 g 49 x + 16 Q 33 h 50 y (pad) = + +6. Base 32 Encoding + + The following description of base 32 is derived from [11] (with + corrections). This encoding may be referred to as "base32". + + The Base 32 encoding is designed to represent arbitrary sequences of + octets in a form that needs to be case insensitive but that need not + be human readable. + + A 33-character subset of US-ASCII is used, enabling 5 bits to be + represented per printable character. (The extra 33rd character, "=", + is used to signify a special processing function.) + + The encoding process represents 40-bit groups of input bits as output + strings of 8 encoded characters. Proceeding from left to right, a + 40-bit input group is formed by concatenating 5 8bit input groups. + These 40 bits are then treated as 8 concatenated 5-bit groups, each + of which is translated into a single character in the base 32 + alphabet. When a bit stream is encoded via the base 32 encoding, the + bit stream must be presumed to be ordered with the most-significant- + bit first. That is, the first bit in the stream will be the high- + order bit in the first 8bit byte, the eighth bit will be the low- + order bit in the first 8bit byte, and so on. + + + + + + + +Josefsson Standards Track [Page 8] + +RFC 4648 Base-N Encodings October 2006 + + + Each 5-bit group is used as an index into an array of 32 printable + characters. The character referenced by the index is placed in the + output string. These characters, identified in Table 3, below, are + selected from US-ASCII digits and uppercase letters. + + Table 3: The Base 32 Alphabet + + Value Encoding Value Encoding Value Encoding Value Encoding + 0 A 9 J 18 S 27 3 + 1 B 10 K 19 T 28 4 + 2 C 11 L 20 U 29 5 + 3 D 12 M 21 V 30 6 + 4 E 13 N 22 W 31 7 + 5 F 14 O 23 X + 6 G 15 P 24 Y (pad) = + 7 H 16 Q 25 Z + 8 I 17 R 26 2 + + Special processing is performed if fewer than 40 bits are available + at the end of the data being encoded. A full encoding quantum is + always completed at the end of a body. When fewer than 40 input bits + are available in an input group, bits with value zero are added (on + the right) to form an integral number of 5-bit groups. Padding at + the end of the data is performed using the "=" character. Since all + base 32 input is an integral number of octets, only the following + cases can arise: + + (1) The final quantum of encoding input is an integral multiple of 40 + bits; here, the final unit of encoded output will be an integral + multiple of 8 characters with no "=" padding. + + (2) The final quantum of encoding input is exactly 8 bits; here, the + final unit of encoded output will be two characters followed by + six "=" padding characters. + + (3) The final quantum of encoding input is exactly 16 bits; here, the + final unit of encoded output will be four characters followed by + four "=" padding characters. + + (4) The final quantum of encoding input is exactly 24 bits; here, the + final unit of encoded output will be five characters followed by + three "=" padding characters. + + (5) The final quantum of encoding input is exactly 32 bits; here, the + final unit of encoded output will be seven characters followed by + one "=" padding character. + + + + + +Josefsson Standards Track [Page 9] + +RFC 4648 Base-N Encodings October 2006 + + +7. Base 32 Encoding with Extended Hex Alphabet + + The following description of base 32 is derived from [7]. This + encoding may be referred to as "base32hex". This encoding should not + be regarded as the same as the "base32" encoding and should not be + referred to as only "base32". This encoding is used by, e.g., + NextSECure3 (NSEC3) [10]. + + One property with this alphabet, which the base64 and base32 + alphabets lack, is that encoded data maintains its sort order when + the encoded data is compared bit-wise. + + This encoding is identical to the previous one, except for the + alphabet. The new alphabet is found in Table 4. + + Table 4: The "Extended Hex" Base 32 Alphabet + + Value Encoding Value Encoding Value Encoding Value Encoding + 0 0 9 9 18 I 27 R + 1 1 10 A 19 J 28 S + 2 2 11 B 20 K 29 T + 3 3 12 C 21 L 30 U + 4 4 13 D 22 M 31 V + 5 5 14 E 23 N + 6 6 15 F 24 O (pad) = + 7 7 16 G 25 P + 8 8 17 H 26 Q + +8. Base 16 Encoding + + The following description is original but analogous to previous + descriptions. Essentially, Base 16 encoding is the standard case- + insensitive hex encoding and may be referred to as "base16" or "hex". + + A 16-character subset of US-ASCII is used, enabling 4 bits to be + represented per printable character. + + The encoding process represents 8-bit groups (octets) of input bits + as output strings of 2 encoded characters. Proceeding from left to + right, an 8-bit input is taken from the input data. These 8 bits are + then treated as 2 concatenated 4-bit groups, each of which is + translated into a single character in the base 16 alphabet. + + Each 4-bit group is used as an index into an array of 16 printable + characters. The character referenced by the index is placed in the + output string. + + + + + +Josefsson Standards Track [Page 10] + +RFC 4648 Base-N Encodings October 2006 + + + Table 5: The Base 16 Alphabet + + Value Encoding Value Encoding Value Encoding Value Encoding + 0 0 4 4 8 8 12 C + 1 1 5 5 9 9 13 D + 2 2 6 6 10 A 14 E + 3 3 7 7 11 B 15 F + + Unlike base 32 and base 64, no special padding is necessary since a + full code word is always available. + +9. Illustrations and Examples + + To translate between binary and a base encoding, the input is stored + in a structure, and the output is extracted. The case for base 64 is + displayed in the following figure, borrowed from [5]. + + +--first octet--+-second octet--+--third octet--+ + |7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0| + +-----------+---+-------+-------+---+-----------+ + |5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0| + +--1.index--+--2.index--+--3.index--+--4.index--+ + + The case for base 32 is shown in the following figure, borrowed from + [7]. Each successive character in a base-32 value represents 5 + successive bits of the underlying octet sequence. Thus, each group + of 8 characters represents a sequence of 5 octets (40 bits). + + 1 2 3 + 01234567 89012345 67890123 45678901 23456789 + +--------+--------+--------+--------+--------+ + |< 1 >< 2| >< 3 ><|.4 >< 5.|>< 6 ><.|7 >< 8 >| + +--------+--------+--------+--------+--------+ + <===> 8th character + <====> 7th character + <===> 6th character + <====> 5th character + <====> 4th character + <===> 3rd character + <====> 2nd character + <===> 1st character + + + + + + + + + + +Josefsson Standards Track [Page 11] + +RFC 4648 Base-N Encodings October 2006 + + + The following example of Base64 data is from [5], with corrections. + + Input data: 0x14fb9c03d97e + Hex: 1 4 f b 9 c | 0 3 d 9 7 e + 8-bit: 00010100 11111011 10011100 | 00000011 11011001 01111110 + 6-bit: 000101 001111 101110 011100 | 000000 111101 100101 111110 + Decimal: 5 15 46 28 0 61 37 62 + Output: F P u c A 9 l + + + Input data: 0x14fb9c03d9 + Hex: 1 4 f b 9 c | 0 3 d 9 + 8-bit: 00010100 11111011 10011100 | 00000011 11011001 + pad with 00 + 6-bit: 000101 001111 101110 011100 | 000000 111101 100100 + Decimal: 5 15 46 28 0 61 36 + pad with = + Output: F P u c A 9 k = + + Input data: 0x14fb9c03 + Hex: 1 4 f b 9 c | 0 3 + 8-bit: 00010100 11111011 10011100 | 00000011 + pad with 0000 + 6-bit: 000101 001111 101110 011100 | 000000 110000 + Decimal: 5 15 46 28 0 48 + pad with = = + Output: F P u c A w = = + +10. Test Vectors + + BASE64("") = "" + + BASE64("f") = "Zg==" + + BASE64("fo") = "Zm8=" + + BASE64("foo") = "Zm9v" + + BASE64("foob") = "Zm9vYg==" + + BASE64("fooba") = "Zm9vYmE=" + + BASE64("foobar") = "Zm9vYmFy" + + BASE32("") = "" + + BASE32("f") = "MY======" + + BASE32("fo") = "MZXQ====" + + + +Josefsson Standards Track [Page 12] + +RFC 4648 Base-N Encodings October 2006 + + + BASE32("foo") = "MZXW6===" + + BASE32("foob") = "MZXW6YQ=" + + BASE32("fooba") = "MZXW6YTB" + + BASE32("foobar") = "MZXW6YTBOI======" + + BASE32-HEX("") = "" + + BASE32-HEX("f") = "CO======" + + BASE32-HEX("fo") = "CPNG====" + + BASE32-HEX("foo") = "CPNMU===" + + BASE32-HEX("foob") = "CPNMUOG=" + + BASE32-HEX("fooba") = "CPNMUOJ1" + + BASE32-HEX("foobar") = "CPNMUOJ1E8======" + + BASE16("") = "" + + BASE16("f") = "66" + + BASE16("fo") = "666F" + + BASE16("foo") = "666F6F" + + BASE16("foob") = "666F6F62" + + BASE16("fooba") = "666F6F6261" + + BASE16("foobar") = "666F6F626172" + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 13] + +RFC 4648 Base-N Encodings October 2006 + + +11. ISO C99 Implementation of Base64 + + An ISO C99 implementation of Base64 encoding and decoding that is + believed to follow all recommendations in this RFC is available from: + + http://josefsson.org/base-encoding/ + + This code is not normative. + + The code could not be included in this RFC for procedural reasons + (RFC 3978 section 5.4). + +12. Security Considerations + + When base encoding and decoding is implemented, care should be taken + not to introduce vulnerabilities to buffer overflow attacks, or other + attacks on the implementation. A decoder should not break on invalid + input including, e.g., embedded NUL characters (ASCII 0). + + If non-alphabet characters are ignored, instead of causing rejection + of the entire encoding (as recommended), a covert channel that can be + used to "leak" information is made possible. The ignored characters + could also be used for other nefarious purposes, such as to avoid a + string equality comparison or to trigger implementation bugs. The + implications of ignoring non-alphabet characters should be understood + in applications that do not follow the recommended practice. + Similarly, when the base 16 and base 32 alphabets are handled case + insensitively, alteration of case can be used to leak information or + make string equality comparisons fail. + + When padding is used, there are some non-significant bits that + warrant security concerns, as they may be abused to leak information + or used to bypass string equality comparisons or to trigger + implementation problems. + + Base encoding visually hides otherwise easily recognized information, + such as passwords, but does not provide any computational + confidentiality. This has been known to cause security incidents + when, e.g., a user reports details of a network protocol exchange + (perhaps to illustrate some other problem) and accidentally reveals + the password because she is unaware that the base encoding does not + protect the password. + + Base encoding adds no entropy to the plaintext, but it does increase + the amount of plaintext available and provide a signature for + cryptanalysis in the form of a characteristic probability + distribution. + + + + +Josefsson Standards Track [Page 14] + +RFC 4648 Base-N Encodings October 2006 + + +13. Changes Since RFC 3548 + + Added the "base32 extended hex alphabet", needed to preserve sort + order of encoded data. + + Referenced IMAP for the special Base64 encoding used there. + + Fixed the example copied from RFC 2440. + + Added security consideration about providing a signature for + cryptoanalysis. + + Added test vectors. + + Fixed typos. + +14. Acknowledgements + + Several people offered comments and/or suggestions, including John E. + Hadstate, Tony Hansen, Gordon Mohr, John Myers, Chris Newman, and + Andrew Sieber. Text used in this document are based on earlier RFCs + describing specific uses of various base encodings. The author + acknowledges the RSA Laboratories for supporting the work that led to + this document. + + This revised version is based in parts on comments and/or suggestions + made by Roy Arends, Eric Blake, Brian E Carpenter, Elwyn Davies, Bill + Fenner, Sam Hartman, Ted Hardie, Per Hygum, Jelte Jansen, Clement + Kent, Tero Kivinen, Paul Kwiatkowski, and Ben Laurie. + +15. Copying Conditions + + Copyright (c) 2000-2006 Simon Josefsson + + Regarding the abstract and sections 1, 3, 8, 10, 12, 13, and 14 of + this document, that were written by Simon Josefsson ("the author", + for the remainder of this section), the author makes no guarantees + and is not responsible for any damage resulting from its use. The + author grants irrevocable permission to anyone to use, modify, and + distribute it in any way that does not diminish the rights of anyone + else to use, modify, and distribute it, provided that redistributed + derivative works do not contain misleading author or version + information and do not falsely purport to be IETF RFC documents. + Derivative works need not be licensed under similar terms. + + + + + + + +Josefsson Standards Track [Page 15] + +RFC 4648 Base-N Encodings October 2006 + + +16. References + +16.1. Normative References + + [1] Cerf, V., "ASCII format for network interchange", RFC 20, + October 1969. + + [2] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + +16.2. Informative References + + [3] Linn, J., "Privacy Enhancement for Internet Electronic Mail: + Part I: Message Encryption and Authentication Procedures", RFC + 1421, February 1993. + + [4] Freed, N. and N. Borenstein, "Multipurpose Internet Mail + Extensions (MIME) Part One: Format of Internet Message Bodies", + RFC 2045, November 1996. + + [5] Callas, J., Donnerhacke, L., Finney, H., and R. Thayer, + "OpenPGP Message Format", RFC 2440, November 1998. + + [6] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "DNS Security Introduction and Requirements", RFC 4033, March + 2005. + + [7] Klyne, G. and L. Masinter, "Identifying Composite Media + Features", RFC 2938, September 2000. + + [8] Crispin, M., "INTERNET MESSAGE ACCESS PROTOCOL - VERSION + 4rev1", RFC 3501, March 2003. + + [9] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform + Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, + January 2005. + + [10] Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNSSEC Hash + Authenticated Denial of Existence", Work in Progress, June + 2006. + + [11] Myers, J., "SASL GSSAPI mechanisms", Work in Progress, May + 2000. + + [12] Wilcox-O'Hearn, B., "Post to P2P-hackers mailing list", + http://zgp.org/pipermail/p2p-hackers/2001-September/ + 000315.html, September 2001. + + + + +Josefsson Standards Track [Page 16] + +RFC 4648 Base-N Encodings October 2006 + + +Author's Address + + Simon Josefsson + SJD + EMail: simon@josefsson.org + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Josefsson Standards Track [Page 17] + +RFC 4648 Base-N Encodings October 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Josefsson Standards Track [Page 18] + diff --git a/doc/rfc/rfc4701.txt b/doc/rfc/rfc4701.txt new file mode 100644 index 000000000000..03e3c54376f4 --- /dev/null +++ b/doc/rfc/rfc4701.txt @@ -0,0 +1,675 @@ + + + + + + +Network Working Group M. Stapp +Request for Comments: 4701 Cisco Systems, Inc. +Category: Standards Track T. Lemon + Nominum, Inc. + A. Gustafsson + Araneus Information Systems Oy + October 2006 + + + A DNS Resource Record (RR) for Encoding + Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR) + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Copyright Notice + + Copyright (C) The Internet Society (2006). + +Abstract + + It is possible for Dynamic Host Configuration Protocol (DHCP) clients + to attempt to update the same DNS Fully Qualified Domain Name (FQDN) + or to update a DNS FQDN that has been added to the DNS for another + purpose as they obtain DHCP leases. Whether the DHCP server or the + clients themselves perform the DNS updates, conflicts can arise. To + resolve such conflicts, RFC 4703 proposes storing client identifiers + in the DNS to unambiguously associate domain names with the DHCP + clients to which they refer. This memo defines a distinct Resource + Record (RR) type for this purpose for use by DHCP clients and + servers: the "DHCID" RR. + + + + + + + + + + + + + + + +Stapp, et al. Standards Track [Page 1] + +RFC 4701 The DHCID RR October 2006 + + +Table of Contents + + 1. Introduction ....................................................3 + 2. Terminology .....................................................3 + 3. The DHCID RR ....................................................3 + 3.1. DHCID RDATA Format .........................................3 + 3.2. DHCID Presentation Format ..................................4 + 3.3. The DHCID RR Identifier Type Codes .........................4 + 3.4. The DHCID RR Digest Type Code ..............................4 + 3.5. Computation of the RDATA ...................................5 + 3.5.1. Using the Client's DUID .............................5 + 3.5.2. Using the Client Identifier Option ..................6 + 3.5.3. Using the Client's htype and chaddr .................6 + 3.6. Examples ...................................................6 + 3.6.1. Example 1 ...........................................6 + 3.6.2. Example 2 ...........................................7 + 3.6.3. Example 3 ...........................................7 + 4. Use of the DHCID RR .............................................8 + 5. Updater Behavior ................................................8 + 6. Security Considerations .........................................8 + 7. IANA Considerations .............................................9 + 8. Acknowledgements ................................................9 + 9. References ......................................................9 + 9.1. Normative References .......................................9 + 9.2. Informative References ....................................10 + + + + + + + + + + + + + + + + + + + + + + + + + + +Stapp, et al. Standards Track [Page 2] + +RFC 4701 The DHCID RR October 2006 + + +1. Introduction + + A set of procedures to allow DHCP [7] [11] clients and servers to + automatically update the DNS ([3], [4]) is proposed in [1]. + + Conflicts can arise if multiple DHCP clients wish to use the same DNS + name or a DHCP client attempts to use a name added for another + purpose. To resolve such conflicts, [1] proposes storing client + identifiers in the DNS to unambiguously associate domain names with + the DHCP clients using them. In the interest of clarity, it is + preferable for this DHCP information to use a distinct RR type. This + memo defines a distinct RR for this purpose for use by DHCP clients + or servers: the "DHCID" RR. + + In order to obscure potentially sensitive client identifying + information, the data stored is the result of a one-way SHA-256 hash + computation. The hash includes information from the DHCP client's + message as well as the domain name itself, so that the data stored in + the DHCID RR will be dependent on both the client identification used + in the DHCP protocol interaction and the domain name. This means + that the DHCID RDATA will vary if a single client is associated over + time with more than one name. This makes it difficult to 'track' a + client as it is associated with various domain names. + +2. Terminology + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [2]. + +3. The DHCID RR + + The DHCID RR is defined with mnemonic DHCID and type code 49. The + DHCID RR is only defined in the IN class. DHCID RRs cause no + additional section processing. + +3.1. DHCID RDATA Format + + The RDATA section of a DHCID RR in transmission contains RDLENGTH + octets of binary data. The format of this data and its + interpretation by DHCP servers and clients are described below. + + DNS software should consider the RDATA section to be opaque. DHCP + clients or servers use the DHCID RR to associate a DHCP client's + identity with a DNS name, so that multiple DHCP clients and servers + may deterministically perform dynamic DNS updates to the same zone. + From the updater's perspective, the DHCID resource record RDATA + consists of a 2-octet identifier type, in network byte order, + + + +Stapp, et al. Standards Track [Page 3] + +RFC 4701 The DHCID RR October 2006 + + + followed by a 1-octet digest type, followed by one or more octets + representing the actual identifier: + + < 2 octets > Identifier type code + < 1 octet > Digest type code + < n octets > Digest (length depends on digest type) + +3.2. DHCID Presentation Format + + In DNS master files, the RDATA is represented as a single block in + base-64 encoding identical to that used for representing binary data + in [8], Section 3. The data may be divided up into any number of + white-space-separated substrings, down to single base-64 digits, + which are concatenated to form the complete RDATA. These substrings + can span lines using the standard parentheses. + +3.3. The DHCID RR Identifier Type Codes + + The DHCID RR Identifier Type Code specifies what data from the DHCP + client's request was used as input into the hash function. The + identifier type codes are defined in a registry maintained by IANA, + as specified in Section 7. The initial list of assigned values for + the identifier type code and that type's identifier is: + + + +------------------+------------------------------------------------+ + | Identifier Type | Identifier | + | Code | | + +------------------+------------------------------------------------+ + | 0x0000 | The 1-octet 'htype' followed by 'hlen' octets | + | | of 'chaddr' from a DHCPv4 client's DHCPREQUEST | + | | [7]. | + | 0x0001 | The data octets (i.e., the Type and | + | | Client-Identifier fields) from a DHCPv4 | + | | client's Client Identifier option [10]. | + | 0x0002 | The client's DUID (i.e., the data octets of a | + | | DHCPv6 client's Client Identifier option [11] | + | | or the DUID field from a DHCPv4 client's | + | | Client Identifier option [6]). | + | 0x0003 - 0xfffe | Undefined; available to be assigned by IANA. | + | 0xffff | Undefined; RESERVED. | + +------------------+------------------------------------------------+ + +3.4. The DHCID RR Digest Type Code + + The DHCID RR Digest Type Code is an identifier for the digest + algorithm used. The digest is calculated over an identifier and the + canonical FQDN as described in the next section. + + + +Stapp, et al. Standards Track [Page 4] + +RFC 4701 The DHCID RR October 2006 + + + The digest type codes are defined in a registry maintained by IANA, + as specified in Section 7. The initial list of assigned values for + the digest type codes is: value 0 is reserved, and value 1 is + SHA-256. Reserving other types requires IETF standards action. + Defining new values will also require IETF standards action to + document how DNS updaters are to deal with multiple digest types. + +3.5. Computation of the RDATA + + The DHCID RDATA is formed by concatenating the 2-octet identifier + type code with variable-length data. + + The RDATA for all type codes other than 0xffff, which is reserved for + future expansion, is formed by concatenating the 2-octet identifier + type code, the 1-octet digest type code, and the digest value (32 + octets for SHA-256). + + < identifier-type > < digest-type > < digest > + + The input to the digest hash function is defined to be: + + digest = SHA-256(< identifier > < FQDN >) + + The FQDN is represented in the buffer in the canonical wire format as + described in [9], Section 6.2. The identifier type code and the + identifier are related as specified in Section 3.3: the identifier + type code describes the source of the identifier. + + A DHCPv4 updater uses the 0x0002 type code if a Client Identifier + option is present in the DHCPv4 messages and it is encoded as + specified in [6]. Otherwise, the updater uses 0x0001 if a Client + Identifier option is present, and 0x0000 if not. + + A DHCPv6 updater always uses the 0x0002 type code. + +3.5.1. Using the Client's DUID + + When the updater is using the Client's DUID (either from a DHCPv6 + Client Identifier option or from a portion of the DHCPv4 Client + Identifier option encoded as specified in [6]), the first two octets + of the DHCID RR MUST be 0x0002, in network byte order. The third + octet is the digest type code (1 for SHA-256). The rest of the DHCID + RR MUST contain the results of computing the SHA-256 hash across the + octets of the DUID followed by the FQDN. + + + + + + + +Stapp, et al. Standards Track [Page 5] + +RFC 4701 The DHCID RR October 2006 + + +3.5.2. Using the Client Identifier Option + + When the updater is using the DHCPv4 Client Identifier option sent by + the client in its DHCPREQUEST message, the first two octets of the + DHCID RR MUST be 0x0001, in network byte order. The third octet is + the digest type code (1 for SHA-256). The rest of the DHCID RR MUST + contain the results of computing the SHA-256 hash across the data + octets (i.e., the Type and Client-Identifier fields) of the option, + followed by the FQDN. + +3.5.3. Using the Client's htype and chaddr + + When the updater is using the client's link-layer address as the + identifier, the first two octets of the DHCID RDATA MUST be zero. + The third octet is the digest type code (1 for SHA-256). To generate + the rest of the resource record, the updater computes a one-way hash + using the SHA-256 algorithm across a buffer containing the client's + network hardware type, link-layer address, and the FQDN data. + Specifically, the first octet of the buffer contains the network + hardware type as it appeared in the DHCP 'htype' field of the + client's DHCPREQUEST message. All of the significant octets of the + 'chaddr' field in the client's DHCPREQUEST message follow, in the + same order in which the octets appear in the DHCPREQUEST message. + The number of significant octets in the 'chaddr' field is specified + in the 'hlen' field of the DHCPREQUEST message. The FQDN data, as + specified above, follows. + +3.6. Examples + +3.6.1. Example 1 + + A DHCP server allocates the IPv6 address 2001:DB8::1234:5678 to a + client that included the DHCPv6 client-identifier option data 00:01: + 00:06:41:2d:f1:66:01:02:03:04:05:06 in its DHCPv6 request. The + server updates the name "chi6.example.com" on the client's behalf and + uses the DHCP client identifier option data as input in forming a + DHCID RR. The DHCID RDATA is formed by setting the two type octets + to the value 0x0002, the 1-octet digest type to 1 for SHA-256, and + performing a SHA-256 hash computation across a buffer containing the + 14 octets from the client-id option and the FQDN (represented as + specified in Section 3.5). + + chi6.example.com. AAAA 2001:DB8::1234:5678 + chi6.example.com. DHCID ( AAIBY2/AuCccgoJbsaxcQc9TUapptP69l + OjxfNuVAA2kjEA= ) + + If the DHCID RR type is not supported, the RDATA would be encoded + [13] as: + + + +Stapp, et al. Standards Track [Page 6] + +RFC 4701 The DHCID RR October 2006 + + + \# 35 ( 000201636fc0b8271c82825bb1ac5c41cf5351aa69b4febd94e8f17cd + b95000da48c40 ) + +3.6.2. Example 2 + + A DHCP server allocates the IPv4 address 192.0.2.2 to a client that + included the DHCP client-identifier option data 01:07:08:09:0a:0b:0c + in its DHCP request. The server updates the name "chi.example.com" + on the client's behalf and uses the DHCP client identifier option + data as input in forming a DHCID RR. The DHCID RDATA is formed by + setting the two type octets to the value 0x0001, the 1-octet digest + type to 1 for SHA-256, and performing a SHA-256 hash computation + across a buffer containing the seven octets from the client-id option + and the FQDN (represented as specified in Section 3.5). + + chi.example.com. A 192.0.2.2 + chi.example.com. DHCID ( AAEBOSD+XR3Os/0LozeXVqcNc7FwCfQdW + L3b/NaiUDlW2No= ) + + If the DHCID RR type is not supported, the RDATA would be encoded + [13] as: + + \# 35 ( 0001013920fe5d1dceb3fd0ba3379756a70d73b17009f41d58bddbfcd + 6a2503956d8da ) + +3.6.3. Example 3 + + A DHCP server allocating the IPv4 address 192.0.2.3 to a client with + the Ethernet MAC address 01:02:03:04:05:06 using domain name + "client.example.com" uses the client's link-layer address to identify + the client. The DHCID RDATA is composed by setting the two type + octets to zero, the 1-octet digest type to 1 for SHA-256, and + performing an SHA-256 hash computation across a buffer containing the + 1-octet 'htype' value for Ethernet, 0x01, followed by the six octets + of the Ethernet MAC address, and the domain name (represented as + specified in Section 3.5). + + client.example.com. A 192.0.2.3 + client.example.com. DHCID ( AAABxLmlskllE0MVjd57zHcWmEH3pCQ6V + ytcKD//7es/deY= ) + + If the DHCID RR type is not supported, the RDATA would be encoded + [13] as: + + \# 35 ( 000001c4b9a5b249651343158dde7bcc77169841f7a4243a572b5c283 + fffedeb3f75e6 ) + + + + + +Stapp, et al. Standards Track [Page 7] + +RFC 4701 The DHCID RR October 2006 + + +4. Use of the DHCID RR + + This RR MUST NOT be used for any purpose other than that detailed in + [1]. Although this RR contains data that is opaque to DNS servers, + the data must be consistent across all entities that update and + interpret this record. Therefore, new data formats may only be + defined through actions of the DHC Working Group, as a result of + revising [1]. + +5. Updater Behavior + + The data in the DHCID RR allows updaters to determine whether more + than one DHCP client desires to use a particular FQDN. This allows + site administrators to establish policy about DNS updates. The DHCID + RR does not establish any policy itself. + + Updaters use data from a DHCP client's request and the domain name + that the client desires to use to compute a client identity hash, and + then compare that hash to the data in any DHCID RRs on the name that + they wish to associate with the client's IP address. If an updater + discovers DHCID RRs whose RDATA does not match the client identity + that they have computed, the updater SHOULD conclude that a different + client is currently associated with the name in question. The + updater SHOULD then proceed according to the site's administrative + policy. That policy might dictate that a different name be selected, + or it might permit the updater to continue. + +6. Security Considerations + + The DHCID record as such does not introduce any new security problems + into the DNS. In order to obscure the client's identity information, + a one-way hash is used. Further, in order to make it difficult to + 'track' a client by examining the names associated with a particular + hash value, the FQDN is included in the hash computation. Thus, the + RDATA is dependent on both the DHCP client identification data and on + each FQDN associated with the client. + + However, it should be noted that an attacker that has some knowledge, + such as of MAC addresses commonly used in DHCP client identification + data, may be able to discover the client's DHCP identify by using a + brute-force attack. Even without any additional knowledge, the + number of unknown bits used in computing the hash is typically only + 48 to 80. + + Administrators should be wary of permitting unsecured DNS updates to + zones, whether or not they are exposed to the global Internet. Both + DHCP clients and servers SHOULD use some form of update + authentication (e.g., [12]) when performing DNS updates. + + + +Stapp, et al. Standards Track [Page 8] + +RFC 4701 The DHCID RR October 2006 + + +7. IANA Considerations + + IANA has allocated a DNS RR type number for the DHCID record type. + + This specification defines a new number-space for the 2-octet + identifier type codes associated with the DHCID RR. IANA has + established a registry of the values for this number-space. Three + initial values are assigned in Section 3.3, and the value 0xFFFF is + reserved for future use. New DHCID RR identifier type codes are + assigned through Standards Action, as defined in [5]. + + This specification defines a new number-space for the 1-octet digest + type codes associated with the DHCID RR. IANA has established a + registry of the values for this number-space. Two initial values are + assigned in Section 3.4. New DHCID RR digest type codes are assigned + through Standards Action, as defined in [5]. + +8. Acknowledgements + + Many thanks to Harald Alvestrand, Ralph Droms, Olafur Gudmundsson, + Sam Hartman, Josh Littlefield, Pekka Savola, and especially Bernie + Volz for their review and suggestions. + +9. References + +9.1. Normative References + + [1] Stapp, M. and B. Volz, "Resolution of Fully Qualified Domain + Name (FQDN) Conflicts among Dynamic Host Configuration Protocol + (DHCP) Clients", RFC 4703, October 2006. + + [2] Bradner, S., "Key words for use in RFCs to Indicate Requirement + Levels", BCP 14, RFC 2119, March 1997. + + [3] Mockapetris, P., "Domain names - concepts and facilities", + STD 13, RFC 1034, November 1987. + + [4] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + [5] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA + Considerations Section in RFCs", BCP 26, RFC 2434, October 1998. + + [6] Lemon, T. and B. Sommerfeld, "Node-specific Client Identifiers + for Dynamic Host Configuration Protocol Version Four (DHCPv4)", + RFC 4361, February 2006. + + + + + +Stapp, et al. Standards Track [Page 9] + +RFC 4701 The DHCID RR October 2006 + + +9.2. Informative References + + [7] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, + March 1997. + + [8] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", + RFC 3548, July 2003. + + [9] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, + "Resource Records for the DNS Security Extensions", RFC 4034, + March 2005. + + [10] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor + Extensions", RFC 2132, March 1997. + + [11] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., and M. + Carney, "Dynamic Host Configuration Protocol for IPv6 + (DHCPv6)", RFC 3315, July 2003. + + [12] Vixie, P., Gudmundsson, O., Eastlake, D., and B. Wellington, + "Secret Key Transaction Authentication for DNS (TSIG)", + RFC 2845, May 2000. + + [13] Gustafsson, A., "Handling of Unknown DNS Resource Record (RR) + Types", RFC 3597, September 2003. + + + + + + + + + + + + + + + + + + + + + + + + + + +Stapp, et al. Standards Track [Page 10] + +RFC 4701 The DHCID RR October 2006 + + +Authors' Addresses + + Mark Stapp + Cisco Systems, Inc. + 1414 Massachusetts Ave. + Boxborough, MA 01719 + USA + + Phone: 978.936.1535 + EMail: mjs@cisco.com + + + Ted Lemon + Nominum, Inc. + 950 Charter St. + Redwood City, CA 94063 + USA + + EMail: mellon@nominum.com + + + Andreas Gustafsson + Araneus Information Systems Oy + Ulappakatu 1 + 02320 Espoo + Finland + + EMail: gson@araneus.fi + + + + + + + + + + + + + + + + + + + + + + + +Stapp, et al. Standards Track [Page 11] + +RFC 4701 The DHCID RR October 2006 + + +Full Copyright Statement + + Copyright (C) The Internet Society (2006). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET + ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE + INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + +Acknowledgement + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + +Stapp, et al. Standards Track [Page 12] + diff --git a/doc/rfc/rfc5155.txt b/doc/rfc/rfc5155.txt new file mode 100644 index 000000000000..d4b729761925 --- /dev/null +++ b/doc/rfc/rfc5155.txt @@ -0,0 +1,2915 @@ + + + + + + +Network Working Group B. Laurie +Request for Comments: 5155 G. Sisson +Category: Standards Track R. Arends + Nominet + D. Blacka + VeriSign, Inc. + March 2008 + + + DNS Security (DNSSEC) Hashed Authenticated Denial of Existence + +Status of This Memo + + This document specifies an Internet standards track protocol for the + Internet community, and requests discussion and suggestions for + improvements. Please refer to the current edition of the "Internet + Official Protocol Standards" (STD 1) for the standardization state + and status of this protocol. Distribution of this memo is unlimited. + +Abstract + + The Domain Name System Security (DNSSEC) Extensions introduced the + NSEC resource record (RR) for authenticated denial of existence. + This document introduces an alternative resource record, NSEC3, which + similarly provides authenticated denial of existence. However, it + also provides measures against zone enumeration and permits gradual + expansion of delegation-centric zones. + +Table of Contents + + 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 + 1.1. Rationale . . . . . . . . . . . . . . . . . . . . . . . . 4 + 1.2. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4 + 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5 + 2. Backwards Compatibility . . . . . . . . . . . . . . . . . . . 6 + 3. The NSEC3 Resource Record . . . . . . . . . . . . . . . . . . 7 + 3.1. RDATA Fields . . . . . . . . . . . . . . . . . . . . . . . 8 + 3.1.1. Hash Algorithm . . . . . . . . . . . . . . . . . . . . 8 + 3.1.2. Flags . . . . . . . . . . . . . . . . . . . . . . . . 8 + 3.1.3. Iterations . . . . . . . . . . . . . . . . . . . . . . 8 + 3.1.4. Salt Length . . . . . . . . . . . . . . . . . . . . . 8 + 3.1.5. Salt . . . . . . . . . . . . . . . . . . . . . . . . . 8 + 3.1.6. Hash Length . . . . . . . . . . . . . . . . . . . . . 9 + 3.1.7. Next Hashed Owner Name . . . . . . . . . . . . . . . . 9 + 3.1.8. Type Bit Maps . . . . . . . . . . . . . . . . . . . . 9 + 3.2. NSEC3 RDATA Wire Format . . . . . . . . . . . . . . . . . 9 + 3.2.1. Type Bit Maps Encoding . . . . . . . . . . . . . . . . 10 + 3.3. Presentation Format . . . . . . . . . . . . . . . . . . . 11 + + + +Laurie, et al. Standards Track [Page 1] + +RFC 5155 NSEC3 March 2008 + + + 4. The NSEC3PARAM Resource Record . . . . . . . . . . . . . . . . 12 + 4.1. RDATA Fields . . . . . . . . . . . . . . . . . . . . . . . 12 + 4.1.1. Hash Algorithm . . . . . . . . . . . . . . . . . . . . 12 + 4.1.2. Flag Fields . . . . . . . . . . . . . . . . . . . . . 12 + 4.1.3. Iterations . . . . . . . . . . . . . . . . . . . . . . 13 + 4.1.4. Salt Length . . . . . . . . . . . . . . . . . . . . . 13 + 4.1.5. Salt . . . . . . . . . . . . . . . . . . . . . . . . . 13 + 4.2. NSEC3PARAM RDATA Wire Format . . . . . . . . . . . . . . . 13 + 4.3. Presentation Format . . . . . . . . . . . . . . . . . . . 14 + 5. Calculation of the Hash . . . . . . . . . . . . . . . . . . . 14 + 6. Opt-Out . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 + 7. Authoritative Server Considerations . . . . . . . . . . . . . 16 + 7.1. Zone Signing . . . . . . . . . . . . . . . . . . . . . . . 16 + 7.2. Zone Serving . . . . . . . . . . . . . . . . . . . . . . . 17 + 7.2.1. Closest Encloser Proof . . . . . . . . . . . . . . . . 18 + 7.2.2. Name Error Responses . . . . . . . . . . . . . . . . . 19 + 7.2.3. No Data Responses, QTYPE is not DS . . . . . . . . . . 19 + 7.2.4. No Data Responses, QTYPE is DS . . . . . . . . . . . . 19 + 7.2.5. Wildcard No Data Responses . . . . . . . . . . . . . . 19 + 7.2.6. Wildcard Answer Responses . . . . . . . . . . . . . . 20 + 7.2.7. Referrals to Unsigned Subzones . . . . . . . . . . . . 20 + 7.2.8. Responding to Queries for NSEC3 Owner Names . . . . . 20 + 7.2.9. Server Response to a Run-Time Collision . . . . . . . 21 + 7.3. Secondary Servers . . . . . . . . . . . . . . . . . . . . 21 + 7.4. Zones Using Unknown Hash Algorithms . . . . . . . . . . . 21 + 7.5. Dynamic Update . . . . . . . . . . . . . . . . . . . . . . 21 + 8. Validator Considerations . . . . . . . . . . . . . . . . . . . 23 + 8.1. Responses with Unknown Hash Types . . . . . . . . . . . . 23 + 8.2. Verifying NSEC3 RRs . . . . . . . . . . . . . . . . . . . 23 + 8.3. Closest Encloser Proof . . . . . . . . . . . . . . . . . . 23 + 8.4. Validating Name Error Responses . . . . . . . . . . . . . 24 + 8.5. Validating No Data Responses, QTYPE is not DS . . . . . . 24 + 8.6. Validating No Data Responses, QTYPE is DS . . . . . . . . 24 + 8.7. Validating Wildcard No Data Responses . . . . . . . . . . 25 + 8.8. Validating Wildcard Answer Responses . . . . . . . . . . . 25 + 8.9. Validating Referrals to Unsigned Subzones . . . . . . . . 25 + 9. Resolver Considerations . . . . . . . . . . . . . . . . . . . 26 + 9.1. NSEC3 Resource Record Caching . . . . . . . . . . . . . . 26 + 9.2. Use of the AD Bit . . . . . . . . . . . . . . . . . . . . 26 + 10. Special Considerations . . . . . . . . . . . . . . . . . . . . 26 + 10.1. Domain Name Length Restrictions . . . . . . . . . . . . . 26 + 10.2. DNAME at the Zone Apex . . . . . . . . . . . . . . . . . . 27 + 10.3. Iterations . . . . . . . . . . . . . . . . . . . . . . . . 27 + 10.4. Transitioning a Signed Zone from NSEC to NSEC3 . . . . . . 28 + 10.5. Transitioning a Signed Zone from NSEC3 to NSEC . . . . . . 28 + 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 29 + 12. Security Considerations . . . . . . . . . . . . . . . . . . . 30 + 12.1. Hashing Considerations . . . . . . . . . . . . . . . . . . 30 + + + +Laurie, et al. Standards Track [Page 2] + +RFC 5155 NSEC3 March 2008 + + + 12.1.1. Dictionary Attacks . . . . . . . . . . . . . . . . . . 30 + 12.1.2. Collisions . . . . . . . . . . . . . . . . . . . . . . 31 + 12.1.3. Transitioning to a New Hash Algorithm . . . . . . . . 31 + 12.1.4. Using High Iteration Values . . . . . . . . . . . . . 31 + 12.2. Opt-Out Considerations . . . . . . . . . . . . . . . . . . 32 + 12.3. Other Considerations . . . . . . . . . . . . . . . . . . . 33 + 13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 33 + 13.1. Normative References . . . . . . . . . . . . . . . . . . . 33 + 13.2. Informative References . . . . . . . . . . . . . . . . . . 34 + Appendix A. Example Zone . . . . . . . . . . . . . . . . . . . . 35 + Appendix B. Example Responses . . . . . . . . . . . . . . . . . . 40 + B.1. Name Error . . . . . . . . . . . . . . . . . . . . . . . . 40 + B.2. No Data Error . . . . . . . . . . . . . . . . . . . . . . 42 + B.2.1. No Data Error, Empty Non-Terminal . . . . . . . . . . 43 + B.3. Referral to an Opt-Out Unsigned Zone . . . . . . . . . . . 44 + B.4. Wildcard Expansion . . . . . . . . . . . . . . . . . . . . 45 + B.5. Wildcard No Data Error . . . . . . . . . . . . . . . . . . 46 + B.6. DS Child Zone No Data Error . . . . . . . . . . . . . . . 48 + Appendix C. Special Considerations . . . . . . . . . . . . . . . 48 + C.1. Salting . . . . . . . . . . . . . . . . . . . . . . . . . 49 + C.2. Hash Collision . . . . . . . . . . . . . . . . . . . . . . 49 + C.2.1. Avoiding Hash Collisions During Generation . . . . . . 50 + C.2.2. Second Preimage Requirement Analysis . . . . . . . . . 50 + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Laurie, et al. Standards Track [Page 3] + +RFC 5155 NSEC3 March 2008 + + +1. Introduction + +1.1. Rationale + + The DNS Security Extensions included the NSEC RR to provide + authenticated denial of existence. Though the NSEC RR meets the + requirements for authenticated denial of existence, it introduces a + side-effect in that the contents of a zone can be enumerated. This + property introduces undesired policy issues. + + The enumeration is enabled by the set of NSEC records that exists + inside a signed zone. An NSEC record lists two names that are + ordered canonically, in order to show that nothing exists between the + two names. The complete set of NSEC records lists all the names in a + zone. It is trivial to enumerate the content of a zone by querying + for names that do not exist. + + An enumerated zone can be used, for example, as a source of probable + e-mail addresses for spam, or as a key for multiple WHOIS queries to + reveal registrant data that many registries may have legal + obligations to protect. Many registries therefore prohibit the + copying of their zone data; however, the use of NSEC RRs renders + these policies unenforceable. + + A second problem is that the cost to cryptographically secure + delegations to unsigned zones is high, relative to the perceived + security benefit, in two cases: large, delegation-centric zones, and + zones where insecure delegations will be updated rapidly. In these + cases, the costs of maintaining the NSEC RR chain may be extremely + high and use of the "Opt-Out" convention may be more appropriate (for + these unsecured zones). + + This document presents the NSEC3 Resource Record which can be used as + an alternative to NSEC to mitigate these issues. + + Earlier work to address these issues include [DNSEXT-NO], [RFC4956], + and [DNSEXT-NSEC2v2]. + +1.2. Requirements + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [RFC2119]. + + + + + + + + +Laurie, et al. Standards Track [Page 4] + +RFC 5155 NSEC3 March 2008 + + +1.3. Terminology + + The reader is assumed to be familiar with the basic DNS and DNSSEC + concepts described in [RFC1034], [RFC1035], [RFC4033], [RFC4034], + [RFC4035], and subsequent RFCs that update them: [RFC2136], + [RFC2181], and [RFC2308]. + + The following terminology is used throughout this document: + + Zone enumeration: the practice of discovering the full content of a + zone via successive queries. Zone enumeration was non-trivial + prior to the introduction of DNSSEC. + + Original owner name: the owner name corresponding to a hashed owner + name. + + Hashed owner name: the owner name created after applying the hash + function to an owner name. + + Hash order: the order in which hashed owner names are arranged + according to their numerical value, treating the leftmost (lowest + numbered) octet as the most significant octet. Note that this + order is the same as the canonical DNS name order specified in + [RFC4034], when the hashed owner names are in base32, encoded with + an Extended Hex Alphabet [RFC4648]. + + Empty non-terminal: a domain name that owns no resource records, but + has one or more subdomains that do. + + Delegation: an NS RRSet with a name different from the current zone + apex (non-zone-apex), signifying a delegation to a child zone. + + Secure delegation: a name containing a delegation (NS RRSet) and a + signed DS RRSet, signifying a delegation to a signed child zone. + + Insecure delegation: a name containing a delegation (NS RRSet), but + lacking a DS RRSet, signifying a delegation to an unsigned child + zone. + + Opt-Out NSEC3 resource record: an NSEC3 resource record that has the + Opt-Out flag set to 1. + + Opt-Out zone: a zone with at least one Opt-Out NSEC3 RR. + + Closest encloser: the longest existing ancestor of a name. See also + Section 3.3.1 of [RFC4592]. + + + + + +Laurie, et al. Standards Track [Page 5] + +RFC 5155 NSEC3 March 2008 + + + Closest provable encloser: the longest ancestor of a name that can + be proven to exist. Note that this is only different from the + closest encloser in an Opt-Out zone. + + Next closer name: the name one label longer than the closest + provable encloser of a name. + + Base32: the "Base 32 Encoding with Extended Hex Alphabet" as + specified in [RFC4648]. Note that trailing padding characters + ("=") are not used in the NSEC3 specification. + + To cover: An NSEC3 RR is said to "cover" a name if the hash of the + name or "next closer" name falls between the owner name and the + next hashed owner name of the NSEC3. In other words, if it proves + the nonexistence of the name, either directly or by proving the + nonexistence of an ancestor of the name. + + To match: An NSEC3 RR is said to "match" a name if the owner name of + the NSEC3 RR is the same as the hashed owner name of that name. + +2. Backwards Compatibility + + This specification describes a protocol change that is not generally + backwards compatible with [RFC4033], [RFC4034], and [RFC4035]. In + particular, security-aware resolvers that are unaware of this + specification (NSEC3-unaware resolvers) may fail to validate the + responses introduced by this document. + + In order to aid deployment, this specification uses a signaling + technique to prevent NSEC3-unaware resolvers from attempting to + validate responses from NSEC3-signed zones. + + This specification allocates two new DNSKEY algorithm identifiers for + this purpose. Algorithm 6, DSA-NSEC3-SHA1 is an alias for algorithm + 3, DSA. Algorithm 7, RSASHA1-NSEC3-SHA1 is an alias for algorithm 5, + RSASHA1. These are not new algorithms, they are additional + identifiers for the existing algorithms. + + Zones signed according to this specification MUST only use these + algorithm identifiers for their DNSKEY RRs. Because these new + identifiers will be unknown algorithms to existing, NSEC3-unaware + resolvers, those resolvers will then treat responses from the NSEC3 + signed zone as insecure, as detailed in Section 5.2 of [RFC4035]. + + These algorithm identifiers are used with the NSEC3 hash algorithm + SHA1. Using other NSEC3 hash algorithms requires allocation of a new + alias (see Section 12.1.3). + + + + +Laurie, et al. Standards Track [Page 6] + +RFC 5155 NSEC3 March 2008 + + + Security aware resolvers that are aware of this specification MUST + recognize the new algorithm identifiers and treat them as equivalent + to the algorithms that they alias. + + A methodology for transitioning from a DNSSEC signed zone to a zone + signed using NSEC3 is discussed in Section 10.4. + +3. The NSEC3 Resource Record + + The NSEC3 Resource Record (RR) provides authenticated denial of + existence for DNS Resource Record Sets. + + The NSEC3 RR lists RR types present at the original owner name of the + NSEC3 RR. It includes the next hashed owner name in the hash order + of the zone. The complete set of NSEC3 RRs in a zone indicates which + RRSets exist for the original owner name of the RR and form a chain + of hashed owner names in the zone. This information is used to + provide authenticated denial of existence for DNS data. To provide + protection against zone enumeration, the owner names used in the + NSEC3 RR are cryptographic hashes of the original owner name + prepended as a single label to the name of the zone. The NSEC3 RR + indicates which hash function is used to construct the hash, which + salt is used, and how many iterations of the hash function are + performed over the original owner name. The hashing technique is + described fully in Section 5. + + Hashed owner names of unsigned delegations may be excluded from the + chain. An NSEC3 RR whose span covers the hash of an owner name or + "next closer" name of an unsigned delegation is referred to as an + Opt-Out NSEC3 RR and is indicated by the presence of a flag. + + The owner name for the NSEC3 RR is the base32 encoding of the hashed + owner name prepended as a single label to the name of the zone. + + The type value for the NSEC3 RR is 50. + + The NSEC3 RR RDATA format is class independent and is described + below. + + The class MUST be the same as the class of the original owner name. + + The NSEC3 RR SHOULD have the same TTL value as the SOA minimum TTL + field. This is in the spirit of negative caching [RFC2308]. + + + + + + + + +Laurie, et al. Standards Track [Page 7] + +RFC 5155 NSEC3 March 2008 + + +3.1. RDATA Fields + +3.1.1. Hash Algorithm + + The Hash Algorithm field identifies the cryptographic hash algorithm + used to construct the hash-value. + + The values for this field are defined in the NSEC3 hash algorithm + registry defined in Section 11. + +3.1.2. Flags + + The Flags field contains 8 one-bit flags that can be used to indicate + different processing. All undefined flags must be zero. The only + flag defined by this specification is the Opt-Out flag. + +3.1.2.1. Opt-Out Flag + + If the Opt-Out flag is set, the NSEC3 record covers zero or more + unsigned delegations. + + If the Opt-Out flag is clear, the NSEC3 record covers zero unsigned + delegations. + + The Opt-Out Flag indicates whether this NSEC3 RR may cover unsigned + delegations. It is the least significant bit in the Flags field. + See Section 6 for details about the use of this flag. + +3.1.3. Iterations + + The Iterations field defines the number of additional times the hash + function has been performed. More iterations result in greater + resiliency of the hash value against dictionary attacks, but at a + higher computational cost for both the server and resolver. See + Section 5 for details of the use of this field, and Section 10.3 for + limitations on the value. + +3.1.4. Salt Length + + The Salt Length field defines the length of the Salt field in octets, + ranging in value from 0 to 255. + +3.1.5. Salt + + The Salt field is appended to the original owner name before hashing + in order to defend against pre-calculated dictionary attacks. See + Section 5 for details on how the salt is used. + + + + +Laurie, et al. Standards Track [Page 8] + +RFC 5155 NSEC3 March 2008 + + +3.1.6. Hash Length + + The Hash Length field defines the length of the Next Hashed Owner + Name field, ranging in value from 1 to 255 octets. + +3.1.7. Next Hashed Owner Name + + The Next Hashed Owner Name field contains the next hashed owner name + in hash order. This value is in binary format. Given the ordered + set of all hashed owner names, the Next Hashed Owner Name field + contains the hash of an owner name that immediately follows the owner + name of the given NSEC3 RR. The value of the Next Hashed Owner Name + field in the last NSEC3 RR in the zone is the same as the hashed + owner name of the first NSEC3 RR in the zone in hash order. Note + that, unlike the owner name of the NSEC3 RR, the value of this field + does not contain the appended zone name. + +3.1.8. Type Bit Maps + + The Type Bit Maps field identifies the RRSet types that exist at the + original owner name of the NSEC3 RR. + +3.2. NSEC3 RDATA Wire Format + + The RDATA of the NSEC3 RR is as shown below: + + 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Hash Alg. | Flags | Iterations | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Salt Length | Salt / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Hash Length | Next Hashed Owner Name / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + / Type Bit Maps / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + Hash Algorithm is a single octet. + + Flags field is a single octet, the Opt-Out flag is the least + significant bit, as shown below: + + 0 1 2 3 4 5 6 7 + +-+-+-+-+-+-+-+-+ + | |O| + +-+-+-+-+-+-+-+-+ + + + + +Laurie, et al. Standards Track [Page 9] + +RFC 5155 NSEC3 March 2008 + + + Iterations is represented as a 16-bit unsigned integer, with the most + significant bit first. + + Salt Length is represented as an unsigned octet. Salt Length + represents the length of the Salt field in octets. If the value is + zero, the following Salt field is omitted. + + Salt, if present, is encoded as a sequence of binary octets. The + length of this field is determined by the preceding Salt Length + field. + + Hash Length is represented as an unsigned octet. Hash Length + represents the length of the Next Hashed Owner Name field in octets. + + The next hashed owner name is not base32 encoded, unlike the owner + name of the NSEC3 RR. It is the unmodified binary hash value. It + does not include the name of the containing zone. The length of this + field is determined by the preceding Hash Length field. + +3.2.1. Type Bit Maps Encoding + + The encoding of the Type Bit Maps field is the same as that used by + the NSEC RR, described in [RFC4034]. It is explained and clarified + here for clarity. + + The RR type space is split into 256 window blocks, each representing + the low-order 8 bits of the 16-bit RR type space. Each block that + has at least one active RR type is encoded using a single octet + window number (from 0 to 255), a single octet bitmap length (from 1 + to 32) indicating the number of octets used for the bitmap of the + window block, and up to 32 octets (256 bits) of bitmap. + + Blocks are present in the NSEC3 RR RDATA in increasing numerical + order. + + Type Bit Maps Field = ( Window Block # | Bitmap Length | Bitmap )+ + + where "|" denotes concatenation. + + Each bitmap encodes the low-order 8 bits of RR types within the + window block, in network bit order. The first bit is bit 0. For + window block 0, bit 1 corresponds to RR type 1 (A), bit 2 corresponds + to RR type 2 (NS), and so forth. For window block 1, bit 1 + corresponds to RR type 257, bit 2 to RR type 258. If a bit is set to + 1, it indicates that an RRSet of that type is present for the + original owner name of the NSEC3 RR. If a bit is set to 0, it + indicates that no RRSet of that type is present for the original + owner name of the NSEC3 RR. + + + +Laurie, et al. Standards Track [Page 10] + +RFC 5155 NSEC3 March 2008 + + + Since bit 0 in window block 0 refers to the non-existing RR type 0, + it MUST be set to 0. After verification, the validator MUST ignore + the value of bit 0 in window block 0. + + Bits representing Meta-TYPEs or QTYPEs as specified in Section 3.1 of + [RFC2929] or within the range reserved for assignment only to QTYPEs + and Meta-TYPEs MUST be set to 0, since they do not appear in zone + data. If encountered, they must be ignored upon reading. + + Blocks with no types present MUST NOT be included. Trailing zero + octets in the bitmap MUST be omitted. The length of the bitmap of + each block is determined by the type code with the largest numerical + value, within that block, among the set of RR types present at the + original owner name of the NSEC3 RR. Trailing octets not specified + MUST be interpreted as zero octets. + +3.3. Presentation Format + + The presentation format of the RDATA portion is as follows: + + o The Hash Algorithm field is represented as an unsigned decimal + integer. The value has a maximum of 255. + + o The Flags field is represented as an unsigned decimal integer. + The value has a maximum of 255. + + o The Iterations field is represented as an unsigned decimal + integer. The value is between 0 and 65535, inclusive. + + o The Salt Length field is not represented. + + o The Salt field is represented as a sequence of case-insensitive + hexadecimal digits. Whitespace is not allowed within the + sequence. The Salt field is represented as "-" (without the + quotes) when the Salt Length field has a value of 0. + + o The Hash Length field is not represented. + + o The Next Hashed Owner Name field is represented as an unpadded + sequence of case-insensitive base32 digits, without whitespace. + + o The Type Bit Maps field is represented as a sequence of RR type + mnemonics. When the mnemonic is not known, the TYPE + representation as described in Section 5 of [RFC3597] MUST be + used. + + + + + + +Laurie, et al. Standards Track [Page 11] + +RFC 5155 NSEC3 March 2008 + + +4. The NSEC3PARAM Resource Record + + The NSEC3PARAM RR contains the NSEC3 parameters (hash algorithm, + flags, iterations, and salt) needed by authoritative servers to + calculate hashed owner names. The presence of an NSEC3PARAM RR at a + zone apex indicates that the specified parameters may be used by + authoritative servers to choose an appropriate set of NSEC3 RRs for + negative responses. The NSEC3PARAM RR is not used by validators or + resolvers. + + If an NSEC3PARAM RR is present at the apex of a zone with a Flags + field value of zero, then there MUST be an NSEC3 RR using the same + hash algorithm, iterations, and salt parameters present at every + hashed owner name in the zone. That is, the zone MUST contain a + complete set of NSEC3 RRs with the same hash algorithm, iterations, + and salt parameters. + + The owner name for the NSEC3PARAM RR is the name of the zone apex. + + The type value for the NSEC3PARAM RR is 51. + + The NSEC3PARAM RR RDATA format is class independent and is described + below. + + The class MUST be the same as the NSEC3 RRs to which this RR refers. + +4.1. RDATA Fields + + The RDATA for this RR mirrors the first four fields in the NSEC3 RR. + +4.1.1. Hash Algorithm + + The Hash Algorithm field identifies the cryptographic hash algorithm + used to construct the hash-value. + + The acceptable values are the same as the corresponding field in the + NSEC3 RR. + +4.1.2. Flag Fields + + The Opt-Out flag is not used and is set to zero. + + All other flags are reserved for future use, and must be zero. + + NSEC3PARAM RRs with a Flags field value other than zero MUST be + ignored. + + + + + +Laurie, et al. Standards Track [Page 12] + +RFC 5155 NSEC3 March 2008 + + +4.1.3. Iterations + + The Iterations field defines the number of additional times the hash + is performed. + + Its acceptable values are the same as the corresponding field in the + NSEC3 RR. + +4.1.4. Salt Length + + The Salt Length field defines the length of the salt in octets, + ranging in value from 0 to 255. + +4.1.5. Salt + + The Salt field is appended to the original owner name before hashing. + +4.2. NSEC3PARAM RDATA Wire Format + + The RDATA of the NSEC3PARAM RR is as shown below: + + 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Hash Alg. | Flags | Iterations | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | Salt Length | Salt / + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + Hash Algorithm is a single octet. + + Flags field is a single octet. + + Iterations is represented as a 16-bit unsigned integer, with the most + significant bit first. + + Salt Length is represented as an unsigned octet. Salt Length + represents the length of the following Salt field in octets. If the + value is zero, the Salt field is omitted. + + Salt, if present, is encoded as a sequence of binary octets. The + length of this field is determined by the preceding Salt Length + field. + + + + + + + + +Laurie, et al. Standards Track [Page 13] + +RFC 5155 NSEC3 March 2008 + + +4.3. Presentation Format + + The presentation format of the RDATA portion is as follows: + + o The Hash Algorithm field is represented as an unsigned decimal + integer. The value has a maximum of 255. + + o The Flags field is represented as an unsigned decimal integer. + The value has a maximum value of 255. + + o The Iterations field is represented as an unsigned decimal + integer. The value is between 0 and 65535, inclusive. + + o The Salt Length field is not represented. + + o The Salt field is represented as a sequence of case-insensitive + hexadecimal digits. Whitespace is not allowed within the + sequence. This field is represented as "-" (without the quotes) + when the Salt Length field is zero. + +5. Calculation of the Hash + + The hash calculation uses three of the NSEC3 RDATA fields: Hash + Algorithm, Salt, and Iterations. + + Define H(x) to be the hash of x using the Hash Algorithm selected by + the NSEC3 RR, k to be the number of Iterations, and || to indicate + concatenation. Then define: + + IH(salt, x, 0) = H(x || salt), and + + IH(salt, x, k) = H(IH(salt, x, k-1) || salt), if k > 0 + + Then the calculated hash of an owner name is + + IH(salt, owner name, iterations), + + where the owner name is in the canonical form, defined as: + + The wire format of the owner name where: + + 1. The owner name is fully expanded (no DNS name compression) and + fully qualified; + + 2. All uppercase US-ASCII letters are replaced by the corresponding + lowercase US-ASCII letters; + + + + + +Laurie, et al. Standards Track [Page 14] + +RFC 5155 NSEC3 March 2008 + + + 3. If the owner name is a wildcard name, the owner name is in its + original unexpanded form, including the "*" label (no wildcard + substitution); + + This form is as defined in Section 6.2 of [RFC4034]. + + The method to calculate the Hash is based on [RFC2898]. + +6. Opt-Out + + In this specification, as in [RFC4033], [RFC4034] and [RFC4035], NS + RRSets at delegation points are not signed and may be accompanied by + a DS RRSet. With the Opt-Out bit clear, the security status of the + child zone is determined by the presence or absence of this DS RRSet, + cryptographically proven by the signed NSEC3 RR at the hashed owner + name of the delegation. Setting the Opt-Out flag modifies this by + allowing insecure delegations to exist within the signed zone without + a corresponding NSEC3 RR at the hashed owner name of the delegation. + + An Opt-Out NSEC3 RR is said to cover a delegation if the hash of the + owner name or "next closer" name of the delegation is between the + owner name of the NSEC3 RR and the next hashed owner name. + + An Opt-Out NSEC3 RR does not assert the existence or non-existence of + the insecure delegations that it may cover. This allows for the + addition or removal of these delegations without recalculating or re- + signing RRs in the NSEC3 RR chain. However, Opt-Out NSEC3 RRs do + assert the (non)existence of other, authoritative RRSets. + + An Opt-Out NSEC3 RR MAY have the same original owner name as an + insecure delegation. In this case, the delegation is proven insecure + by the lack of a DS bit in the type map and the signed NSEC3 RR does + assert the existence of the delegation. + + Zones using Opt-Out MAY contain a mixture of Opt-Out NSEC3 RRs and + non-Opt-Out NSEC3 RRs. If an NSEC3 RR is not Opt-Out, there MUST NOT + be any hashed owner names of insecure delegations (nor any other RRs) + between it and the name indicated by the next hashed owner name in + the NSEC3 RDATA. If it is Opt-Out, it MUST only cover hashed owner + names or hashed "next closer" names of insecure delegations. + + The effects of the Opt-Out flag on signing, serving, and validating + responses are covered in following sections. + + + + + + + + +Laurie, et al. Standards Track [Page 15] + +RFC 5155 NSEC3 March 2008 + + +7. Authoritative Server Considerations + +7.1. Zone Signing + + Zones using NSEC3 must satisfy the following properties: + + o Each owner name within the zone that owns authoritative RRSets + MUST have a corresponding NSEC3 RR. Owner names that correspond + to unsigned delegations MAY have a corresponding NSEC3 RR. + However, if there is not a corresponding NSEC3 RR, there MUST be + an Opt-Out NSEC3 RR that covers the "next closer" name to the + delegation. Other non-authoritative RRs are not represented by + NSEC3 RRs. + + o Each empty non-terminal MUST have a corresponding NSEC3 RR, unless + the empty non-terminal is only derived from an insecure delegation + covered by an Opt-Out NSEC3 RR. + + o The TTL value for any NSEC3 RR SHOULD be the same as the minimum + TTL value field in the zone SOA RR. + + o The Type Bit Maps field of every NSEC3 RR in a signed zone MUST + indicate the presence of all types present at the original owner + name, except for the types solely contributed by an NSEC3 RR + itself. Note that this means that the NSEC3 type itself will + never be present in the Type Bit Maps. + + The following steps describe a method of proper construction of NSEC3 + RRs. This is not the only such possible method. + + 1. Select the hash algorithm and the values for salt and iterations. + + 2. For each unique original owner name in the zone add an NSEC3 RR. + + * If Opt-Out is being used, owner names of unsigned delegations + MAY be excluded. + + * The owner name of the NSEC3 RR is the hash of the original + owner name, prepended as a single label to the zone name. + + * The Next Hashed Owner Name field is left blank for the moment. + + * If Opt-Out is being used, set the Opt-Out bit to one. + + * For collision detection purposes, optionally keep track of the + original owner name with the NSEC3 RR. + + + + + +Laurie, et al. Standards Track [Page 16] + +RFC 5155 NSEC3 March 2008 + + + * Additionally, for collision detection purposes, optionally + create an additional NSEC3 RR corresponding to the original + owner name with the asterisk label prepended (i.e., as if a + wildcard existed as a child of this owner name) and keep track + of this original owner name. Mark this NSEC3 RR as temporary. + + 3. For each RRSet at the original owner name, set the corresponding + bit in the Type Bit Maps field. + + 4. If the difference in number of labels between the apex and the + original owner name is greater than 1, additional NSEC3 RRs need + to be added for every empty non-terminal between the apex and the + original owner name. This process may generate NSEC3 RRs with + duplicate hashed owner names. Optionally, for collision + detection, track the original owner names of these NSEC3 RRs and + create temporary NSEC3 RRs for wildcard collisions in a similar + fashion to step 1. + + 5. Sort the set of NSEC3 RRs into hash order. + + 6. Combine NSEC3 RRs with identical hashed owner names by replacing + them with a single NSEC3 RR with the Type Bit Maps field + consisting of the union of the types represented by the set of + NSEC3 RRs. If the original owner name was tracked, then + collisions may be detected when combining, as all of the matching + NSEC3 RRs should have the same original owner name. Discard any + possible temporary NSEC3 RRs. + + 7. In each NSEC3 RR, insert the next hashed owner name by using the + value of the next NSEC3 RR in hash order. The next hashed owner + name of the last NSEC3 RR in the zone contains the value of the + hashed owner name of the first NSEC3 RR in the hash order. + + 8. Finally, add an NSEC3PARAM RR with the same Hash Algorithm, + Iterations, and Salt fields to the zone apex. + + If a hash collision is detected, then a new salt has to be chosen, + and the signing process restarted. + +7.2. Zone Serving + + This specification modifies DNSSEC-enabled DNS responses generated by + authoritative servers. In particular, it replaces the use of NSEC + RRs in such responses with NSEC3 RRs. + + + + + + + +Laurie, et al. Standards Track [Page 17] + +RFC 5155 NSEC3 March 2008 + + + In the following response cases, the NSEC RRs dictated by DNSSEC + [RFC4035] are replaced with NSEC3 RRs that prove the same facts. + Responses that would not contain NSEC RRs are unchanged by this + specification. + + When returning responses containing multiple NSEC3 RRs, all of the + NSEC3 RRs MUST use the same hash algorithm, iteration, and salt + values. The Flags field value MUST be either zero or one. + +7.2.1. Closest Encloser Proof + + For many NSEC3 responses a proof of the closest encloser is required. + This is a proof that some ancestor of the QNAME is the closest + encloser of QNAME. + + This proof consists of (up to) two different NSEC3 RRs: + + o An NSEC3 RR that matches the closest (provable) encloser. + + o An NSEC3 RR that covers the "next closer" name to the closest + encloser. + + The first NSEC3 RR essentially proposes a possible closest encloser, + and proves that the particular encloser does, in fact, exist. The + second NSEC3 RR proves that the possible closest encloser is the + closest, and proves that the QNAME (and any ancestors between QNAME + and the closest encloser) does not exist. + + These NSEC3 RRs are collectively referred to as the "closest encloser + proof" in the subsequent descriptions. + + For example, the closest encloser proof for the nonexistent + "alpha.beta.gamma.example." owner name might prove that + "gamma.example." is the closest encloser. This response would + contain the NSEC3 RR that matches "gamma.example.", and would also + contain the NSEC3 RR that covers "beta.gamma.example." (which is the + "next closer" name). + + It is possible, when using Opt-Out (Section 6), to not be able to + prove the actual closest encloser because it is, or is part of an + insecure delegation covered by an Opt-Out span. In this case, + instead of proving the actual closest encloser, the closest provable + encloser is used. That is, the closest enclosing authoritative name + is used instead. In this case, the set of NSEC3 RRs used for this + proof is referred to as the "closest provable encloser proof". + + + + + + +Laurie, et al. Standards Track [Page 18] + +RFC 5155 NSEC3 March 2008 + + +7.2.2. Name Error Responses + + To prove the nonexistence of QNAME, a closest encloser proof and an + NSEC3 RR covering the (nonexistent) wildcard RR at the closest + encloser MUST be included in the response. This collection of (up + to) three NSEC3 RRs proves both that QNAME does not exist and that a + wildcard that could have matched QNAME also does not exist. + + For example, if "gamma.example." is the closest provable encloser to + QNAME, then an NSEC3 RR covering "*.gamma.example." is included in + the authority section of the response. + +7.2.3. No Data Responses, QTYPE is not DS + + The server MUST include the NSEC3 RR that matches QNAME. This NSEC3 + RR MUST NOT have the bits corresponding to either the QTYPE or CNAME + set in its Type Bit Maps field. + +7.2.4. No Data Responses, QTYPE is DS + + If there is an NSEC3 RR that matches QNAME, the server MUST return it + in the response. The bits corresponding with DS and CNAME MUST NOT + be set in the Type Bit Maps field of this NSEC3 RR. + + If no NSEC3 RR matches QNAME, the server MUST return a closest + provable encloser proof for QNAME. The NSEC3 RR that covers the + "next closer" name MUST have the Opt-Out bit set (note that this is + true by definition -- if the Opt-Out bit is not set, something has + gone wrong). + + If a server is authoritative for both sides of a zone cut at QNAME, + the server MUST return the proof from the parent side of the zone + cut. + +7.2.5. Wildcard No Data Responses + + If there is a wildcard match for QNAME, but QTYPE is not present at + that name, the response MUST include a closest encloser proof for + QNAME and MUST include the NSEC3 RR that matches the wildcard. This + combination proves both that QNAME itself does not exist and that a + wildcard that matches QNAME does exist. Note that the closest + encloser to QNAME MUST be the immediate ancestor of the wildcard RR + (if this is not the case, then something has gone wrong). + + + + + + + + +Laurie, et al. Standards Track [Page 19] + +RFC 5155 NSEC3 March 2008 + + +7.2.6. Wildcard Answer Responses + + If there is a wildcard match for QNAME and QTYPE, then, in addition + to the expanded wildcard RRSet returned in the answer section of the + response, proof that the wildcard match was valid must be returned. + + This proof is accomplished by proving that both QNAME does not exist + and that the closest encloser of the QNAME and the immediate ancestor + of the wildcard are the same (i.e., the correct wildcard matched). + + To this end, the NSEC3 RR that covers the "next closer" name of the + immediate ancestor of the wildcard MUST be returned. It is not + necessary to return an NSEC3 RR that matches the closest encloser, as + the existence of this closest encloser is proven by the presence of + the expanded wildcard in the response. + +7.2.7. Referrals to Unsigned Subzones + + If there is an NSEC3 RR that matches the delegation name, then that + NSEC3 RR MUST be included in the response. The DS bit in the type + bit maps of the NSEC3 RR MUST NOT be set. + + If the zone is Opt-Out, then there may not be an NSEC3 RR + corresponding to the delegation. In this case, the closest provable + encloser proof MUST be included in the response. The included NSEC3 + RR that covers the "next closer" name for the delegation MUST have + the Opt-Out flag set to one. (Note that this will be the case unless + something has gone wrong). + +7.2.8. Responding to Queries for NSEC3 Owner Names + + The owner names of NSEC3 RRs are not represented in the NSEC3 RR + chain like other owner names. As a result, each NSEC3 owner name is + covered by another NSEC3 RR, effectively negating the existence of + the NSEC3 RR. This is a paradox, since the existence of an NSEC3 RR + can be proven by its RRSIG RRSet. + + If the following conditions are all true: + + o the QNAME equals the owner name of an existing NSEC3 RR, and + + o no RR types exist at the QNAME, nor at any descendant of QNAME, + + then the response MUST be constructed as a Name Error response + (Section 7.2.2). Or, in other words, the authoritative name server + will act as if the owner name of the NSEC3 RR did not exist. + + + + + +Laurie, et al. Standards Track [Page 20] + +RFC 5155 NSEC3 March 2008 + + + Note that NSEC3 RRs are returned as a result of an AXFR or IXFR + query. + +7.2.9. Server Response to a Run-Time Collision + + If the hash of a non-existing QNAME collides with the owner name of + an existing NSEC3 RR, then the server will be unable to return a + response that proves that QNAME does not exist. In this case, the + server MUST return a response with an RCODE of 2 (server failure). + + Note that with the hash algorithm specified in this document, SHA-1, + such collisions are highly unlikely. + +7.3. Secondary Servers + + Secondary servers (and perhaps other entities) need to reliably + determine which NSEC3 parameters (i.e., hash, salt, and iterations) + are present at every hashed owner name, in order to be able to choose + an appropriate set of NSEC3 RRs for negative responses. This is + indicated by an NSEC3PARAM RR present at the zone apex. + + If there are multiple NSEC3PARAM RRs present, there are multiple + valid NSEC3 chains present. The server must choose one of them, but + may use any criteria to do so. + +7.4. Zones Using Unknown Hash Algorithms + + Zones that are signed according to this specification, but are using + an unrecognized NSEC3 hash algorithm value, cannot be effectively + served. Such zones SHOULD be rejected when loading. Servers SHOULD + respond with RCODE=2 (server failure) responses when handling queries + that would fall under such zones. + +7.5. Dynamic Update + + A zone signed using NSEC3 may accept dynamic updates [RFC2136]. + However, NSEC3 introduces some special considerations for dynamic + updates. + + Adding and removing names in a zone MUST account for the creation or + removal of empty non-terminals. + + o When removing a name with a corresponding NSEC3 RR, any NSEC3 RRs + corresponding to empty non-terminals created by that name MUST be + removed. Note that more than one name may be asserting the + existence of a particular empty non-terminal. + + + + + +Laurie, et al. Standards Track [Page 21] + +RFC 5155 NSEC3 March 2008 + + + o When adding a name that requires adding an NSEC3 RR, NSEC3 RRs + MUST also be added for any empty non-terminals that are created. + That is, if there is not an existing NSEC3 RR matching an empty + non-terminal, it must be created and added. + + The presence of Opt-Out in a zone means that some additions or + delegations of names will not require changes to the NSEC3 RRs in a + zone. + + o When removing a delegation RRSet, if that delegation does not have + a matching NSEC3 RR, then it was opted out. In this case, nothing + further needs to be done. + + o When adding a delegation RRSet, if the "next closer" name of the + delegation is covered by an existing Opt-Out NSEC3 RR, then the + delegation MAY be added without modifying the NSEC3 RRs in the + zone. + + The presence of Opt-Out in a zone means that when adding or removing + NSEC3 RRs, the value of the Opt-Out flag that should be set in new or + modified NSEC3 RRs is ambiguous. Servers SHOULD follow this set of + basic rules to resolve the ambiguity. + + The central concept to these rules is that the state of the Opt-Out + flag of the covering NSEC3 RR is preserved. + + o When removing an NSEC3 RR, the value of the Opt-Out flag for the + previous NSEC3 RR (the one whose next hashed owner name is + modified) should not be changed. + + o When adding an NSEC3 RR, the value of the Opt-Out flag is set to + the value of the Opt-Out flag of the NSEC3 RR that previously + covered the owner name of the NSEC3 RR. That is, the now previous + NSEC3 RR. + + If the zone in question is consistent with its use of the Opt-Out + flag (that is, all NSEC3 RRs in the zone have the same value for the + flag) then these rules will retain that consistency. If the zone is + not consistent in the use of the flag (i.e., a partially Opt-Out + zone), then these rules will not retain the same pattern of use of + the Opt-Out flag. + + For zones that partially use the Opt-Out flag, if there is a logical + pattern for that use, the pattern could be maintained by using a + local policy on the server. + + + + + + +Laurie, et al. Standards Track [Page 22] + +RFC 5155 NSEC3 March 2008 + + +8. Validator Considerations + +8.1. Responses with Unknown Hash Types + + A validator MUST ignore NSEC3 RRs with unknown hash types. The + practical result of this is that responses containing only such NSEC3 + RRs will generally be considered bogus. + +8.2. Verifying NSEC3 RRs + + A validator MUST ignore NSEC3 RRs with a Flag fields value other than + zero or one. + + A validator MAY treat a response as bogus if the response contains + NSEC3 RRs that contain different values for hash algorithm, + iterations, or salt from each other for that zone. + +8.3. Closest Encloser Proof + + In order to verify a closest encloser proof, the validator MUST find + the longest name, X, such that + + o X is an ancestor of QNAME that is matched by an NSEC3 RR present + in the response. This is a candidate for the closest encloser, + and + + o The name one label longer than X (but still an ancestor of -- or + equal to -- QNAME) is covered by an NSEC3 RR present in the + response. + + One possible algorithm for verifying this proof is as follows: + + 1. Set SNAME=QNAME. Clear the flag. + + 2. Check whether SNAME exists: + + * If there is no NSEC3 RR in the response that matches SNAME + (i.e., an NSEC3 RR whose owner name is the same as the hash of + SNAME, prepended as a single label to the zone name), clear + the flag. + + * If there is an NSEC3 RR in the response that covers SNAME, set + the flag. + + * If there is a matching NSEC3 RR in the response and the flag + was set, then the proof is complete, and SNAME is the closest + encloser. + + + + +Laurie, et al. Standards Track [Page 23] + +RFC 5155 NSEC3 March 2008 + + + * If there is a matching NSEC3 RR in the response, but the flag + is not set, then the response is bogus. + + 3. Truncate SNAME by one label from the left, go to step 2. + + Once the closest encloser has been discovered, the validator MUST + check that the NSEC3 RR that has the closest encloser as the original + owner name is from the proper zone. The DNAME type bit must not be + set and the NS type bit may only be set if the SOA type bit is set. + If this is not the case, it would be an indication that an attacker + is using them to falsely deny the existence of RRs for which the + server is not authoritative. + + In the following descriptions, the phrase "a closest (provable) + encloser proof for X" means that the algorithm above (or an + equivalent algorithm) proves that X does not exist by proving that an + ancestor of X is its closest encloser. + +8.4. Validating Name Error Responses + + A validator MUST verify that there is a closest encloser proof for + QNAME present in the response and that there is an NSEC3 RR that + covers the wildcard at the closest encloser (i.e., the name formed by + prepending the asterisk label to the closest encloser). + +8.5. Validating No Data Responses, QTYPE is not DS + + The validator MUST verify that an NSEC3 RR that matches QNAME is + present and that both the QTYPE and the CNAME type are not set in its + Type Bit Maps field. + + Note that this test also covers the case where the NSEC3 RR exists + because it corresponds to an empty non-terminal, in which case the + NSEC3 RR will have an empty Type Bit Maps field. + +8.6. Validating No Data Responses, QTYPE is DS + + If there is an NSEC3 RR that matches QNAME present in the response, + then that NSEC3 RR MUST NOT have the bits corresponding to DS and + CNAME set in its Type Bit Maps field. + + If there is no such NSEC3 RR, then the validator MUST verify that a + closest provable encloser proof for QNAME is present in the response, + and that the NSEC3 RR that covers the "next closer" name has the Opt- + Out bit set. + + + + + + +Laurie, et al. Standards Track [Page 24] + +RFC 5155 NSEC3 March 2008 + + +8.7. Validating Wildcard No Data Responses + + The validator MUST verify a closest encloser proof for QNAME and MUST + find an NSEC3 RR present in the response that matches the wildcard + name generated by prepending the asterisk label to the closest + encloser. Furthermore, the bits corresponding to both QTYPE and + CNAME MUST NOT be set in the wildcard matching NSEC3 RR. + +8.8. Validating Wildcard Answer Responses + + The verified wildcard answer RRSet in the response provides the + validator with a (candidate) closest encloser for QNAME. This + closest encloser is the immediate ancestor to the generating + wildcard. + + Validators MUST verify that there is an NSEC3 RR that covers the + "next closer" name to QNAME present in the response. This proves + that QNAME itself did not exist and that the correct wildcard was + used to generate the response. + +8.9. Validating Referrals to Unsigned Subzones + + The delegation name in a referral is the owner name of the NS RRSet + present in the authority section of the referral response. + + If there is an NSEC3 RR present in the response that matches the + delegation name, then the validator MUST ensure that the NS bit is + set and that the DS bit is not set in the Type Bit Maps field of the + NSEC3 RR. The validator MUST also ensure that the NSEC3 RR is from + the correct (i.e., parent) zone. This is done by ensuring that the + SOA bit is not set in the Type Bit Maps field of this NSEC3 RR. + + Note that the presence of an NS bit implies the absence of a DNAME + bit, so there is no need to check for the DNAME bit in the Type Bit + Maps field of the NSEC3 RR. + + If there is no NSEC3 RR present that matches the delegation name, + then the validator MUST verify a closest provable encloser proof for + the delegation name. The validator MUST verify that the Opt-Out bit + is set in the NSEC3 RR that covers the "next closer" name to the + delegation name. + + + + + + + + + + +Laurie, et al. Standards Track [Page 25] + +RFC 5155 NSEC3 March 2008 + + +9. Resolver Considerations + +9.1. NSEC3 Resource Record Caching + + Caching resolvers MUST be able to retrieve the appropriate NSEC3 RRs + when returning responses that contain them. In DNSSEC [RFC4035], in + many cases it is possible to find the correct NSEC RR to return in a + response by name (e.g., when returning a referral, the NSEC RR will + always have the same owner name as the delegation). With this + specification, that will not be true, nor will a cache be able to + calculate the name(s) of the appropriate NSEC3 RR(s). + Implementations may need to use new methods for caching and + retrieving NSEC3 RRs. + +9.2. Use of the AD Bit + + The AD bit, as defined by [RFC4035], MUST NOT be set when returning a + response containing a closest (provable) encloser proof in which the + NSEC3 RR that covers the "next closer" name has the Opt-Out bit set. + + This rule is based on what this closest encloser proof actually + proves: names that would be covered by the Opt-Out NSEC3 RR may or + may not exist as insecure delegations. As such, not all the data in + responses containing such closest encloser proofs will have been + cryptographically verified, so the AD bit cannot be set. + +10. Special Considerations + +10.1. Domain Name Length Restrictions + + Zones signed using this specification have additional domain name + length restrictions imposed upon them. In particular, zones with + names that, when converted into hashed owner names exceed the 255 + octet length limit imposed by [RFC1035], cannot use this + specification. + + The actual maximum length of a domain name in a particular zone + depends on both the length of the zone name (versus the whole domain + name) and the particular hash function used. + + As an example, SHA-1 produces a hash of 160 bits. The base-32 + encoding of 160 bits results in 32 characters. The 32 characters are + prepended to the name of the zone as a single label, which includes a + length field of a single octet. The maximum length of the zone name, + when using SHA-1, is 222 octets (255 - 33). + + + + + + +Laurie, et al. Standards Track [Page 26] + +RFC 5155 NSEC3 March 2008 + + +10.2. DNAME at the Zone Apex + + The DNAME specification in Section 3 of [RFC2672] has a 'no- + descendants' limitation. If a DNAME RR is present at node N, there + MUST be no data at any descendant of N. + + If N is the apex of the zone, there will be NSEC3 and RRSIG types + present at descendants of N. This specification updates the DNAME + specification to allow NSEC3 and RRSIG types at descendants of the + apex regardless of the existence of DNAME at the apex. + +10.3. Iterations + + Setting the number of iterations used allows the zone owner to choose + the cost of computing a hash, and therefore the cost of generating a + dictionary. Note that this is distinct from the effect of salt, + which prevents the use of a single precomputed dictionary for all + time. + + Obviously the number of iterations also affects the zone owner's cost + of signing and serving the zone as well as the validator's cost of + verifying responses from the zone. We therefore impose an upper + limit on the number of iterations. We base this on the number of + iterations that approximates the cost of verifying an RRSet. + + The limits, therefore, are based on the size of the smallest zone + signing key, rounded up to the nearest table value (or rounded down + if the key is larger than the largest table value). + + A zone owner MUST NOT use a value higher than shown in the table + below for iterations for the given key size. A resolver MAY treat a + response with a higher value as insecure, after the validator has + verified that the signature over the NSEC3 RR is correct. + + +----------+------------+ + | Key Size | Iterations | + +----------+------------+ + | 1024 | 150 | + | 2048 | 500 | + | 4096 | 2,500 | + +----------+------------+ + + This table is based on an approximation of the ratio between the cost + of an SHA-1 calculation and the cost of an RSA verification for keys + of size 1024 bits (150 to 1), 2048 bits (500 to 1), and 4096 bits + (2500 to 1). + + + + + +Laurie, et al. Standards Track [Page 27] + +RFC 5155 NSEC3 March 2008 + + + The ratio between SHA-1 calculation and DSA verification is higher + (1500 to 1 for keys of size 1024). A higher iteration count degrades + performance, while DSA verification is already more expensive than + RSA for the same key size. Therefore the values in the table MUST be + used independent of the key algorithm. + +10.4. Transitioning a Signed Zone from NSEC to NSEC3 + + When transitioning an already signed and trusted zone to this + specification, care must be taken to prevent client validation + failures during the process. + + The basic procedure is as follows: + + 1. Transition all DNSKEYs to DNSKEYs using the algorithm aliases + described in Section 2. The actual method for safely and + securely changing the DNSKEY RRSet of the zone is outside the + scope of this specification. However, the end result MUST be + that all DS RRs in the parent use the specified algorithm + aliases. + + After this transition is complete, all NSEC3-unaware clients will + treat the zone as insecure. At this point, the authoritative + server still returns negative and wildcard responses that contain + NSEC RRs. + + 2. Add signed NSEC3 RRs to the zone, either incrementally or all at + once. If adding incrementally, then the last RRSet added MUST be + the NSEC3PARAM RRSet. + + 3. Upon the addition of the NSEC3PARAM RRSet, the server switches to + serving negative and wildcard responses with NSEC3 RRs according + to this specification. + + 4. Remove the NSEC RRs either incrementally or all at once. + +10.5. Transitioning a Signed Zone from NSEC3 to NSEC + + To safely transition back to a DNSSEC [RFC4035] signed zone, simply + reverse the procedure above: + + 1. Add NSEC RRs incrementally or all at once. + + 2. Remove the NSEC3PARAM RRSet. This will signal the server to use + the NSEC RRs for negative and wildcard responses. + + 3. Remove the NSEC3 RRs either incrementally or all at once. + + + + +Laurie, et al. Standards Track [Page 28] + +RFC 5155 NSEC3 March 2008 + + + 4. Transition all of the DNSKEYs to DNSSEC algorithm identifiers. + After this transition is complete, all NSEC3-unaware clients will + treat the zone as secure. + +11. IANA Considerations + + Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm + parameter, this document does not define a particular mechanism for + safely transitioning from one NSEC3 hash algorithm to another. When + specifying a new hash algorithm for use with NSEC3, a transition + mechanism MUST also be defined. + + This document updates the IANA registry "DOMAIN NAME SYSTEM + PARAMETERS" (http://www.iana.org/assignments/dns-parameters) in sub- + registry "TYPES", by defining two new types. Section 3 defines the + NSEC3 RR type 50. Section 4 defines the NSEC3PARAM RR type 51. + + This document updates the IANA registry "DNS SECURITY ALGORITHM + NUMBERS -- per [RFC4035]" + (http://www.iana.org/assignments/dns-sec-alg-numbers). Section 2 + defines the aliases DSA-NSEC3-SHA1 (6) and RSASHA1-NSEC3-SHA1 (7) for + respectively existing registrations DSA and RSASHA1 in combination + with NSEC3 hash algorithm SHA1. + + Since these algorithm numbers are aliases for existing DNSKEY + algorithm numbers, the flags that exist for the original algorithm + are valid for the alias algorithm. + + This document creates a new IANA registry for NSEC3 flags. This + registry is named "DNSSEC NSEC3 Flags". The initial contents of this + registry are: + + 0 1 2 3 4 5 6 7 + +---+---+---+---+---+---+---+---+ + | | | | | | | |Opt| + | | | | | | | |Out| + +---+---+---+---+---+---+---+---+ + + bit 7 is the Opt-Out flag. + + bits 0 - 6 are available for assignment. + + Assignment of additional NSEC3 Flags in this registry requires IETF + Standards Action [RFC2434]. + + This document creates a new IANA registry for NSEC3PARAM flags. This + registry is named "DNSSEC NSEC3PARAM Flags". The initial contents of + this registry are: + + + +Laurie, et al. Standards Track [Page 29] + +RFC 5155 NSEC3 March 2008 + + + 0 1 2 3 4 5 6 7 + +---+---+---+---+---+---+---+---+ + | | | | | | | | 0 | + +---+---+---+---+---+---+---+---+ + + bit 7 is reserved and must be 0. + + bits 0 - 6 are available for assignment. + + Assignment of additional NSEC3PARAM Flags in this registry requires + IETF Standards Action [RFC2434]. + + Finally, this document creates a new IANA registry for NSEC3 hash + algorithms. This registry is named "DNSSEC NSEC3 Hash Algorithms". + The initial contents of this registry are: + + 0 is Reserved. + + 1 is SHA-1. + + 2-255 Available for assignment. + + Assignment of additional NSEC3 hash algorithms in this registry + requires IETF Standards Action [RFC2434]. + +12. Security Considerations + +12.1. Hashing Considerations + +12.1.1. Dictionary Attacks + + The NSEC3 RRs are still susceptible to dictionary attacks (i.e., the + attacker retrieves all the NSEC3 RRs, then calculates the hashes of + all likely domain names, comparing against the hashes found in the + NSEC3 RRs, and thus enumerating the zone). These are substantially + more expensive than enumerating the original NSEC RRs would have + been, and in any case, such an attack could also be used directly + against the name server itself by performing queries for all likely + names, though this would obviously be more detectable. The expense + of this off-line attack can be chosen by setting the number of + iterations in the NSEC3 RR. + + Zones are also susceptible to a pre-calculated dictionary attack -- + that is, a list of hashes for all likely names is computed once, then + NSEC3 RR is scanned periodically and compared against the precomputed + hashes. This attack is prevented by changing the salt on a regular + basis. + + + + +Laurie, et al. Standards Track [Page 30] + +RFC 5155 NSEC3 March 2008 + + + The salt SHOULD be at least 64 bits long and unpredictable, so that + an attacker cannot anticipate the value of the salt and compute the + next set of dictionaries before the zone is published. + +12.1.2. Collisions + + Hash collisions between QNAME and the owner name of an NSEC3 RR may + occur. When they do, it will be impossible to prove the non- + existence of the colliding QNAME. However, with SHA-1, this is + highly unlikely (on the order of 1 in 2^160). Note that DNSSEC + already relies on the presumption that a cryptographic hash function + is second pre-image resistant, since these hash functions are used + for generating and validating signatures and DS RRs. + +12.1.3. Transitioning to a New Hash Algorithm + + Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm + parameter, this document does not define a particular mechanism for + safely transitioning from one NSEC3 hash algorithm to another. When + specifying a new hash algorithm for use with NSEC3, a transition + mechanism MUST also be defined. It is possible that the only + practical and palatable transition mechanisms may require an + intermediate transition to an insecure state, or to a state that uses + NSEC records instead of NSEC3. + +12.1.4. Using High Iteration Values + + Since validators should treat responses containing NSEC3 RRs with + high iteration values as insecure, presence of just one signed NSEC3 + RR with a high iteration value in a zone provides attackers with a + possible downgrade attack. + + The attack is simply to remove any existing NSEC3 RRs from a + response, and replace or add a single (or multiple) NSEC3 RR that + uses a high iterations value to the response. Validators will then + be forced to treat the response as insecure. This attack would be + effective only when all of following conditions are met: + + o There is at least one signed NSEC3 RR that uses a high iterations + value present in the zone. + + o The attacker has access to one or more of these NSEC3 RRs. This + is trivially true when the NSEC3 RRs with high iteration values + are being returned in typical responses, but may also be true if + the attacker can access the zone via AXFR or IXFR queries, or any + other methodology. + + + + + +Laurie, et al. Standards Track [Page 31] + +RFC 5155 NSEC3 March 2008 + + + Using a high number of iterations also introduces an additional + denial-of-service opportunity against servers, since servers must + calculate several hashes per negative or wildcard response. + +12.2. Opt-Out Considerations + + The Opt-Out Flag (O) allows for unsigned names, in the form of + delegations to unsigned zones, to exist within an otherwise signed + zone. All unsigned names are, by definition, insecure, and their + validity or existence cannot be cryptographically proven. + + In general: + + o Resource records with unsigned names (whether existing or not) + suffer from the same vulnerabilities as RRs in an unsigned zone. + These vulnerabilities are described in more detail in [RFC3833] + (note in particular Section 2.3, "Name Chaining" and Section 2.6, + "Authenticated Denial of Domain Names"). + + o Resource records with signed names have the same security whether + or not Opt-Out is used. + + Note that with or without Opt-Out, an insecure delegation may be + undetectably altered by an attacker. Because of this, the primary + difference in security when using Opt-Out is the loss of the ability + to prove the existence or nonexistence of an insecure delegation + within the span of an Opt-Out NSEC3 RR. + + In particular, this means that a malicious entity may be able to + insert or delete RRs with unsigned names. These RRs are normally NS + RRs, but this also includes signed wildcard expansions (while the + wildcard RR itself is signed, its expanded name is an unsigned name). + + Note that being able to add a delegation is functionally equivalent + to being able to add any RR type: an attacker merely has to forge a + delegation to name server under his/her control and place whatever + RRs needed at the subzone apex. + + While in particular cases, this issue may not present a significant + security problem, in general it should not be lightly dismissed. + Therefore, it is strongly RECOMMENDED that Opt-Out be used sparingly. + In particular, zone signing tools SHOULD NOT default to using Opt- + Out, and MAY choose to not support Opt-Out at all. + + + + + + + + +Laurie, et al. Standards Track [Page 32] + +RFC 5155 NSEC3 March 2008 + + +12.3. Other Considerations + + Walking the NSEC3 RRs will reveal the total number of RRs in the zone + (plus empty non-terminals), and also what types there are. This + could be mitigated by adding dummy entries, but certainly an upper + limit can always be found. + +13. References + +13.1. Normative References + + [RFC1034] Mockapetris, P., "Domain names - concepts and + facilities", STD 13, RFC 1034, November 1987. + + [RFC1035] Mockapetris, P., "Domain names - implementation and + specification", STD 13, RFC 1035, November 1987. + + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate + Requirement Levels", BCP 14, RFC 2119, March 1997. + + [RFC2136] Vixie, P., Thomson, S., Rekhter, Y., and J. Bound, + "Dynamic Updates in the Domain Name System (DNS + UPDATE)", RFC 2136, April 1997. + + [RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS + Specification", RFC 2181, July 1997. + + [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS + NCACHE)", RFC 2308, March 1998. + + [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for + Writing an IANA Considerations Section in RFCs", + BCP 26, RFC 2434, October 1998. + + [RFC2929] Eastlake, D., Brunner-Williams, E., and B. Manning, + "Domain Name System (DNS) IANA Considerations", + BCP 42, RFC 2929, September 2000. + + [RFC3597] Gustafsson, A., "Handling of Unknown DNS Resource + Record (RR) Types", RFC 3597, September 2003. + + [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., + and S. Rose, "DNS Security Introduction and + Requirements", RFC 4033, March 2005. + + [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., + and S. Rose, "Resource Records for the DNS Security + Extensions", RFC 4034, March 2005. + + + +Laurie, et al. Standards Track [Page 33] + +RFC 5155 NSEC3 March 2008 + + + [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., + and S. Rose, "Protocol Modifications for the DNS + Security Extensions", RFC 4035, March 2005. + + [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data + Encodings", RFC 4648, October 2006. + +13.2. Informative References + + [DNSEXT-NO] Josefsson, S., "Authenticating Denial of Existence + in DNS with Minimum Disclosure", Work in Progress, + July 2000. + + [DNSEXT-NSEC2v2] Laurie, B., "DNSSEC NSEC2 Owner and RDATA Format", + Work in Progress, December 2004. + + [RFC2672] Crawford, M., "Non-Terminal DNS Name Redirection", + RFC 2672, August 1999. + + [RFC2898] Kaliski, B., "PKCS #5: Password-Based Cryptography + Specification Version 2.0", RFC 2898, + September 2000. + + [RFC3833] Atkins, D. and R. Austein, "Threat Analysis of the + Domain Name System (DNS)", RFC 3833, August 2004. + + [RFC4592] Lewis, E., "The Role of Wildcards in the Domain + Name System", RFC 4592, July 2006. + + [RFC4956] Arends, R., Kosters, M., and D. Blacka, "DNS + Security (DNSSEC) Opt-In", RFC 4956, July 2007. + + + + + + + + + + + + + + + + + + + + +Laurie, et al. Standards Track [Page 34] + +RFC 5155 NSEC3 March 2008 + + +Appendix A. Example Zone + + This is a zone showing its NSEC3 RRs. They can also be used as test + vectors for the hash algorithm. + + The overall TTL and class are specified in the SOA RR, and are + subsequently omitted for clarity. + + The zone is preceded by a list that contains the hashes of the + original ownernames. + + ; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom + ; H(a.example) = 35mthgpgcu1qg68fab165klnsnk3dpvl + ; H(ai.example) = gjeqe526plbf1g8mklp59enfd789njgi + ; H(ns1.example) = 2t7b4g4vsa5smi47k61mv5bv1a22bojr + ; H(ns2.example) = q04jkcevqvmu85r014c7dkba38o0ji5r + ; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h + ; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en + ; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995 + ; H(y.w.example) = ji6neoaepv8b5o6k4ev33abha8ht9fgc + ; H(x.y.w.example) = 2vptu5timamqttgl4luu9kg21e0aor3s + ; H(xx.example) = t644ebqk9bibcna874givr6joj62mlhv + ; H(2t7b4g4vsa5smi47k61mv5bv1a22bojr.example) + ; = kohar7mbb8dc2ce8a9qvl8hon4k53uhi + example. 3600 IN SOA ns1.example. bugs.x.w.example. 1 3600 300 ( + 3600000 3600 ) + RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i + q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd + VI2LmKusbZsT0Q== ) + NS ns1.example. + NS ns2.example. + RRSIG NS 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ + qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv + CnMXjtz6SyObxA== ) + MX 1 xx.example. + RRSIG MX 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + GgQ1A9xs47k42VPvpL/a1BWUz/6XsnHkjotw + 9So8MQtZtl2wJBsnOQsaoHrRCrRbyriEl/GZ + n9Mto/Kx+wBo+w== ) + DNSKEY 256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( + sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h + TY4hHn9npWFRw5BYubE= ) + + + + +Laurie, et al. Standards Track [Page 35] + +RFC 5155 NSEC3 March 2008 + + + DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( + j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 + AbsUdblMFin8CVF3n4s= ) + RRSIG DNSKEY 7 1 3600 20150420235959 ( + 20051021000000 12708 example. + AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 + uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm + MGQZf3bH+QsCtg== ) + NSEC3PARAM 1 0 12 aabbccdd + RRSIG NSEC3PARAM 7 1 3600 20150420235959 ( + 20051021000000 40430 example. + C1Gl8tPZNtnjlrYWDeeUV/sGLCyy/IHie2re + rN05XSA3Pq0U3+4VvGWYWdUMfflOdxqnXHwJ + TLQsjlkynhG6Cg== ) + 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( + 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS + SOA NSEC3PARAM RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL + IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 + BOCXJZMnpuwhpA== ) + 2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. A 192.0.2.127 + RRSIG A 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + h6c++bzhRuWWt2bykN6mjaTNBcXNq5UuL5Ed + K+iDP4eY8I0kSiKaCjg3tC1SQkeloMeub2GW + k8p6xHMPZumXlw== ) + NSEC3 1 1 12 aabbccdd ( + 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN + 4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq + NI6mRk/r1dOSUw== ) + 2vptu5timamqttgl4luu9kg21e0aor3s.example. NSEC3 1 1 12 aabbccdd ( + 35mthgpgcu1qg68fab165klnsnk3dpvl MX RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + KL1V2oFYghNV0Hm7Tf2vpJjM6l+0g1JCcVYG + VfI0lKrhPmTsOA96cLEACgo1x8I7kApJX+ob + TuktZ+sdsZPY1w== ) + 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( + b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG ) + + + + + + + +Laurie, et al. Standards Track [Page 36] + +RFC 5155 NSEC3 March 2008 + + + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ + Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ + XtAIR3chwgW+SA== ) + a.example. NS ns1.a.example. + NS ns2.a.example. + DS 58470 5 1 ( + 3079F1593EBAD6DC121E202A8B766A6A4837206C ) + RRSIG DS 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + XacFcQVHLVzdoc45EJhN616zQ4mEXtE8FzUh + M2KWjfy1VfRKD9r1MeVGwwoukOKgJxBPFsWo + o722vZ4UZ2dIdA== ) + ns1.a.example. A 192.0.2.5 + ns2.a.example. A 192.0.2.6 + ai.example. A 192.0.2.9 + RRSIG A 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F + tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+ + rznEn8sQ64UdqA== ) + HINFO "KLH-10" "ITS" + RRSIG HINFO 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + Yi42uOq43eyO6qXHNvwwfFnIustWgV5urFcx + enkLvs6pKRh00VBjODmf3Z4nMO7IOl6nHSQ1 + v0wLHpEZG7Xj2w== ) + AAAA 2001:db8:0:0:0:0:f00:baa9 + RRSIG AAAA 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W + uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG + cHueLuXkMjBArQ== ) + b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( + gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh + 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 + pOv0TSTyiTxIZg== ) + c.example. NS ns1.c.example. + NS ns2.c.example. + ns1.c.example. A 192.0.2.7 + ns2.c.example. A 192.0.2.8 + gjeqe526plbf1g8mklp59enfd789njgi.example. NSEC3 1 1 12 aabbccdd ( + ji6neoaepv8b5o6k4ev33abha8ht9fgc HINFO A AAAA + RRSIG ) + + + +Laurie, et al. Standards Track [Page 37] + +RFC 5155 NSEC3 March 2008 + + + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + IVnezTJ9iqblFF97vPSmfXZ5Zozngx3KX3by + LTZC4QBH2dFWhf6scrGFZB980AfCxoD9qbbK + Dy+rdGIeRSVNyw== ) + ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( + k8udemvp1j2f7eg6jebps17vp3n8i58h ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 + 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 + MpzVSKfTwx4uYA== ) + k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( + kohar7mbb8dc2ce8a9qvl8hon4k53uhi ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK + S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt + Otx7w9WfcIg62A== ) + kohar7mbb8dc2ce8a9qvl8hon4k53uhi.example. NSEC3 1 1 12 aabbccdd ( + q04jkcevqvmu85r014c7dkba38o0ji5r A RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + VrDXs2uVW21N08SyQIz88zml+y4ZCInTwgDr + 6zz43yAg+LFERjOrj3Ojct51ac7Dp4eZbf9F + QJazmASFKGxGXg== ) + ns1.example. A 192.0.2.1 + RRSIG A 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + bu6kx73n6XEunoVGuRfAgY7EF/AJqHy7hj0j + kiqJjB0dOrx3wuz9SaBeGfqWIdn/uta3SavN + 4FRvZR9SCFHF5Q== ) + ns2.example. A 192.0.2.2 + RRSIG A 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + ktQ3TqE0CfRfki0Rb/Ip5BM0VnxelbuejCC4 + zpLbFKA/7eD7UNAwxMgxJPtbdST+syjYSJaj + 4IHfeX6n8vfoGA== ) + q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( + r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 + ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN + NlkxWcLsIlMmUg== ) + + + + + + +Laurie, et al. Standards Track [Page 38] + +RFC 5155 NSEC3 March 2008 + + + r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( + t644ebqk9bibcna874givr6joj62mlhv MX RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C + ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ + HF1FWKW7RIJdtQ== ) + t644ebqk9bibcna874givr6joj62mlhv.example. NSEC3 1 1 12 aabbccdd ( + 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom HINFO A AAAA + RRSIG ) + RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + RAjGECB8P7O+F4Pa4Dx3tC0M+Z3KmlLKImca + fb9XWwx+NWUNz7NBEDBQHivIyKPVDkChcePI + X1xPl1ATNa+8Dw== ) + *.w.example. MX 1 ai.example. + RRSIG MX 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb + 9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM + ivEBP6+4KS3ldA== ) + x.w.example. MX 1 xx.example. + RRSIG MX 7 3 3600 20150420235959 20051021000000 ( + 40430 example. + IrK3tq/tHFIBF0scHiE/1IwMAvckS/55hAVv + QyxTFbkAdDloP3NbZzu+yoSsr3b3OX6qbBpY + 7WCtwwekLKRAwQ== ) + x.y.w.example. MX 1 xx.example. + RRSIG MX 7 4 3600 20150420235959 20051021000000 ( + 40430 example. + MqSt5HqJIN8+SLlzTOImrh5h9Xa6gDvAW/Gn + nbdPc6Z7nXvCpLPJj/5lCwx3VuzVOjkbvXze + 8/8Ccl2Zn2hbug== ) + xx.example. A 192.0.2.10 + RRSIG A 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + T35hBWEZ017VC5u2c4OriKyVn/pu+fVK4AlX + YOxJ6iQylfV2HQIKjv6b7DzINB3aF/wjJqgX + pQvhq+Ac6+ZiFg== ) + HINFO "KLH-10" "TOPS-20" + RRSIG HINFO 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + KimG+rDd+7VA1zRsu0ITNAQUTRlpnsmqWrih + FRnU+bRa93v2e5oFNFYCs3Rqgv62K93N7AhW + 6Jfqj/8NzWjvKg== ) + AAAA 2001:db8:0:0:0:0:f00:baaa + + + + + +Laurie, et al. Standards Track [Page 39] + +RFC 5155 NSEC3 March 2008 + + + RRSIG AAAA 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + IXBcXORITNwd8h3gNwyxtYFvAupS/CYWufVe + uBUX0O25ivBCULjZjpDxFSxfohb/KA7YRdxE + NzYfMItpILl/Xw== ) + +Appendix B. Example Responses + + The examples in this section show response messages using the signed + zone example in Appendix A. + +B.1. Name Error + + An authoritative name error. The NSEC3 RRs prove that the name does + not exist and that there is no wildcard RR that should have been + expanded. + +;; Header: QR AA DO RCODE=3 +;; +;; Question +a.c.x.w.example. IN A + +;; Answer +;; (empty) + +;; Authority + +example. SOA ns1.example. bugs.x.w.example. 1 3600 300 ( + 3600000 3600 ) +example. RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i + q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd + VI2LmKusbZsT0Q== ) + +;; NSEC3 RR that covers the "next closer" name (c.x.w.example) +;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh + +0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( + 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS + SOA NSEC3PARAM RRSIG ) +0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL + IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 + BOCXJZMnpuwhpA== ) + + + + + +Laurie, et al. Standards Track [Page 40] + +RFC 5155 NSEC3 March 2008 + + +;; NSEC3 RR that matches the closest encloser (x.w.example) +;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995 + +b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( + gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG ) +b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh + 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 + pOv0TSTyiTxIZg== ) + +;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example) +;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m + +35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( + b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG ) +35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ + Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ + XtAIR3chwgW+SA== ) + +;; Additional +;; (empty) + + The query returned three NSEC3 RRs that prove that the requested data + does not exist and that no wildcard expansion applies. The negative + response is authenticated by verifying the NSEC3 RRs. The + corresponding RRSIGs indicate that the NSEC3 RRs are signed by an + "example" DNSKEY of algorithm 7 and with key tag 40430. The resolver + needs the corresponding DNSKEY RR in order to authenticate this + answer. + + One of the owner names of the NSEC3 RRs matches the closest encloser. + One of the NSEC3 RRs prove that there exists no longer name. One of + the NSEC3 RRs prove that there exists no wildcard RRSets that should + have been expanded. The closest encloser can be found by applying + the algorithm in Section 8.3. + + In the above example, the name 'x.w.example' hashes to + 'b4um86eghhds6nea196smvmlo4ors995'. This indicates that this might + be the closest encloser. To prove that 'c.x.w.example' and + '*.x.w.example' do not exist, these names are hashed to, + respectively, '0va5bpr2ou0vk0lbqeeljri88laipsfh' and + '92pqneegtaue7pjatc3l3qnk738c6v5m'. The first and last NSEC3 RRs + prove that these hashed owner names do not exist. + + + + + +Laurie, et al. Standards Track [Page 41] + +RFC 5155 NSEC3 March 2008 + + +B.2. No Data Error + + A "no data" response. The NSEC3 RR proves that the name exists and + that the requested RR type does not. + +;; Header: QR AA DO RCODE=0 +;; +;; Question +ns1.example. IN MX + +;; Answer +;; (empty) + +;; Authority +example. SOA ns1.example. bugs.x.w.example. 1 3600 300 ( + 3600000 3600 ) +example. RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i + q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd + VI2LmKusbZsT0Q== ) + +;; NSEC3 RR matches the QNAME and shows that the MX type bit is not set. + +2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd ( + 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG ) +2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN + 4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq + NI6mRk/r1dOSUw== ) +;; Additional +;; (empty) + + The query returned an NSEC3 RR that proves that the requested name + exists ("ns1.example." hashes to "2t7b4g4vsa5smi47k61mv5bv1a22bojr"), + but the requested RR type does not exist (type MX is absent in the + type code list of the NSEC3 RR), and was not a CNAME (type CNAME is + also absent in the type code list of the NSEC3 RR). + + + + + + + + + + + + +Laurie, et al. Standards Track [Page 42] + +RFC 5155 NSEC3 March 2008 + + +B.2.1. No Data Error, Empty Non-Terminal + + A "no data" response because of an empty non-terminal. The NSEC3 RR + proves that the name exists and that the requested RR type does not. + + ;; Header: QR AA DO RCODE=0 + ;; + ;; Question + y.w.example. IN A + + ;; Answer + ;; (empty) + + ;; Authority + example. SOA ns1.example. bugs.x.w.example. 1 3600 300 ( + 3600000 3600 ) + example. RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i + q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd + VI2LmKusbZsT0Q== ) + + ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set. + + ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( + k8udemvp1j2f7eg6jebps17vp3n8i58h ) + ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 + 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 + MpzVSKfTwx4uYA== ) + + ;; Additional + ;; (empty) + + The query returned an NSEC3 RR that proves that the requested name + exists ("y.w.example." hashes to "ji6neoaepv8b5o6k4ev33abha8ht9fgc"), + but the requested RR type does not exist (Type A is absent in the + Type Bit Maps field of the NSEC3 RR). Note that, unlike an empty + non-terminal proof using NSECs, this is identical to a No Data Error. + This example is solely mentioned to be complete. + + + + + + + + + + +Laurie, et al. Standards Track [Page 43] + +RFC 5155 NSEC3 March 2008 + + +B.3. Referral to an Opt-Out Unsigned Zone + + The NSEC3 RRs prove that nothing for this delegation was signed. + There is no proof that the unsigned delegation exists. + + ;; Header: QR DO RCODE=0 + ;; + ;; Question + mc.c.example. IN MX + + ;; Answer + ;; (empty) + + ;; Authority + c.example. NS ns1.c.example. + NS ns2.c.example. + + ;; NSEC3 RR that covers the "next closer" name (c.example) + ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck + + 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( + b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG ) + 35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ + Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ + XtAIR3chwgW+SA== ) + + ;; NSEC3 RR that matches the closest encloser (example) + ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom + + 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( + 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS + SOA NSEC3PARAM RRSIG ) + 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL + IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 + BOCXJZMnpuwhpA== ) + + ;; Additional + ns1.c.example. A 192.0.2.7 + ns2.c.example. A 192.0.2.8 + + The query returned a referral to the unsigned "c.example." zone. The + response contains the closest provable encloser of "c.example" to be + "example", since the hash of "c.example" + + + + +Laurie, et al. Standards Track [Page 44] + +RFC 5155 NSEC3 March 2008 + + + ("4g6p9u5gvfshp30pqecj98b3maqbn1ck") is covered by the first NSEC3 RR + and its Opt-Out bit is set. + +B.4. Wildcard Expansion + + A query that was answered with a response containing a wildcard + expansion. The label count in the RRSIG RRSet in the answer section + indicates that a wildcard RRSet was expanded to produce this + response, and the NSEC3 RR proves that no "next closer" name exists + in the zone. + + ;; Header: QR AA DO RCODE=0 + ;; + ;; Question + a.z.w.example. IN MX + + ;; Answer + a.z.w.example. MX 1 ai.example. + a.z.w.example. RRSIG MX 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb + 9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM + ivEBP6+4KS3ldA== ) + + ;; Authority + example. NS ns1.example. + example. NS ns2.example. + example. RRSIG NS 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ + qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv + CnMXjtz6SyObxA== ) + + ;; NSEC3 RR that covers the "next closer" name (z.w.example) + ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03 + + q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( + r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG ) + q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 + ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN + NlkxWcLsIlMmUg== ) + + + + + + + + +Laurie, et al. Standards Track [Page 45] + +RFC 5155 NSEC3 March 2008 + + + ;; Additional + ai.example. A 192.0.2.9 + ai.example. RRSIG A 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F + tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+ + rznEn8sQ64UdqA== ) + ai.example. AAAA 2001:db8:0:0:0:0:f00:baa9 + ai.example. RRSIG AAAA 7 2 3600 20150420235959 20051021000000 ( + 40430 example. + LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W + uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG + cHueLuXkMjBArQ== ) + + The query returned an answer that was produced as a result of a + wildcard expansion. The answer section contains a wildcard RRSet + expanded as it would be in a traditional DNS response. The RRSIG + Labels field value of 2 indicates that the answer is the result of a + wildcard expansion, as the "a.z.w.example" name contains 4 labels. + This also shows that "w.example" exists, so there is no need for an + NSEC3 RR that matches the closest encloser. + + The NSEC3 RR proves that no closer match could have been used to + answer this query. + +B.5. Wildcard No Data Error + + A "no data" response for a name covered by a wildcard. The NSEC3 RRs + prove that the matching wildcard name does not have any RRs of the + requested type and that no closer match exists in the zone. + + ;; Header: QR AA DO RCODE=0 + ;; + ;; Question + a.z.w.example. IN AAAA + + ;; Answer + ;; (empty) + + ;; Authority + example. SOA ns1.example. bugs.x.w.example. 1 3600 300 ( + 3600000 3600 ) + example. RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i + q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd + VI2LmKusbZsT0Q== ) + + + + +Laurie, et al. Standards Track [Page 46] + +RFC 5155 NSEC3 March 2008 + + + ;; NSEC3 RR that matches the closest encloser (w.example) + ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h + + k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( + kohar7mbb8dc2ce8a9qvl8hon4k53uhi ) + k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK + S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt + Otx7w9WfcIg62A== ) + + ;; NSEC3 RR that covers the "next closer" name (z.w.example) + ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03 + + q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( + r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG ) + q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 + ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN + NlkxWcLsIlMmUg== ) + + ;; NSEC3 RR that matches a wildcard at the closest encloser. + ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en + + r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( + t644ebqk9bibcna874givr6joj62mlhv MX RRSIG ) + r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 7 2 3600 ( + 20150420235959 20051021000000 40430 example. + aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C + ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ + HF1FWKW7RIJdtQ== ) + + ;; Additional + ;; (empty) + + The query returned the NSEC3 RRs that prove that the requested data + does not exist and no wildcard RR applies. + + + + + + + + + + + + + +Laurie, et al. Standards Track [Page 47] + +RFC 5155 NSEC3 March 2008 + + +B.6. DS Child Zone No Data Error + + A "no data" response for a QTYPE=DS query that was mistakenly sent to + a name server for the child zone. + +;; Header: QR AA DO RCODE=0 +;; +;; Question +example. IN DS + +;; Answer +;; (empty) + +;; Authority +example. SOA ns1.example. bugs.x.w.example. 1 3600 300 ( + 3600000 3600 ) +example. RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( + 40430 example. + Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i + q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd + VI2LmKusbZsT0Q== ) + +;; NSEC3 RR matches the QNAME and shows that the DS type bit is not set. + +0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( + 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS + SOA NSEC3PARAM RRSIG ) +0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 + 20150420235959 20051021000000 40430 example. + OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL + IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 + BOCXJZMnpuwhpA== ) + +;; Additional +;; (empty) + + The query returned an NSEC3 RR showing that the requested was + answered by the server authoritative for the zone "example". The + NSEC3 RR indicates the presence of an SOA RR, showing that this NSEC3 + RR is from the apex of the child, not from the zone cut of the + parent. Queries for the "example" DS RRSet should be sent to the + parent servers (which are in this case the root servers). + +Appendix C. Special Considerations + + The following paragraphs clarify specific behavior and explain + special considerations for implementations. + + + + +Laurie, et al. Standards Track [Page 48] + +RFC 5155 NSEC3 March 2008 + + +C.1. Salting + + Augmenting original owner names with salt before hashing increases + the cost of a dictionary of pre-generated hash-values. For every bit + of salt, the cost of a precomputed dictionary doubles (because there + must be an entry for each word combined with each possible salt + value). The NSEC3 RR can use a maximum of 2040 bits (255 octets) of + salt, multiplying the cost by 2^2040. This means that an attacker + must, in practice, recompute the dictionary each time the salt is + changed. + + Including a salt, regardless of size, does not affect the cost of + constructing NSEC3 RRs. It does increase the size of the NSEC3 RR. + + There MUST be at least one complete set of NSEC3 RRs for the zone + using the same salt value. + + The salt SHOULD be changed periodically to prevent pre-computation + using a single salt. It is RECOMMENDED that the salt be changed for + every re-signing. + + Note that this could cause a resolver to see RRs with different salt + values for the same zone. This is harmless, since each RR stands + alone (that is, it denies the set of owner names whose hashes, using + the salt in the NSEC3 RR, fall between the two hashes in the NSEC3 + RR) -- it is only the server that needs a complete set of NSEC3 RRs + with the same salt in order to be able to answer every possible + query. + + There is no prohibition with having NSEC3 RRs with different salts + within the same zone. However, in order for authoritative servers to + be able to consistently find covering NSEC3 RRs, the authoritative + server MUST choose a single set of parameters (algorithm, salt, and + iterations) to use when selecting NSEC3 RRs. + +C.2. Hash Collision + + Hash collisions occur when different messages have the same hash + value. The expected number of domain names needed to give a 1 in 2 + chance of a single collision is about 2^(n/2) for a hash of length n + bits (i.e., 2^80 for SHA-1). Though this probability is extremely + low, the following paragraphs deal with avoiding collisions and + assessing possible damage in the event of an attack using hash + collisions. + + + + + + + +Laurie, et al. Standards Track [Page 49] + +RFC 5155 NSEC3 March 2008 + + +C.2.1. Avoiding Hash Collisions During Generation + + During generation of NSEC3 RRs, hash values are supposedly unique. + In the (academic) case of a collision occurring, an alternative salt + MUST be chosen and all hash values MUST be regenerated. + +C.2.2. Second Preimage Requirement Analysis + + A cryptographic hash function has a second-preimage resistance + property. The second-preimage resistance property means that it is + computationally infeasible to find another message with the same hash + value as a given message, i.e., given preimage X, to find a second + preimage X' != X such that hash(X) = hash(X'). The work factor for + finding a second preimage is of the order of 2^160 for SHA-1. To + mount an attack using an existing NSEC3 RR, an adversary needs to + find a second preimage. + + Assuming an adversary is capable of mounting such an extreme attack, + the actual damage is that a response message can be generated that + claims that a certain QNAME (i.e., the second pre-image) does exist, + while in reality QNAME does not exist (a false positive), which will + either cause a security-aware resolver to re-query for the non- + existent name, or to fail the initial query. Note that the adversary + can't mount this attack on an existing name, but only on a name that + the adversary can't choose and that does not yet exist. + + + + + + + + + + + + + + + + + + + + + + + + + + +Laurie, et al. Standards Track [Page 50] + +RFC 5155 NSEC3 March 2008 + + +Authors' Addresses + + Ben Laurie + Nominet + 17 Perryn Road + London W3 7LR + England + + Phone: +44 20 8735 0686 + EMail: ben@links.org + + + Geoffrey Sisson + Nominet + Minerva House + Edmund Halley Road + Oxford Science Park + Oxford OX4 4DQ + UNITED KINGDOM + + Phone: +44 1865 332211 + EMail: geoff-s@panix.com + + + Roy Arends + Nominet + Minerva House + Edmund Halley Road + Oxford Science Park + Oxford OX4 4DQ + UNITED KINGDOM + + Phone: +44 1865 332211 + EMail: roy@nominet.org.uk + + + David Blacka + VeriSign, Inc. + 21355 Ridgetop Circle + Dulles, VA 20166 + US + + Phone: +1 703 948 3200 + EMail: davidb@verisign.com + + + + + + + +Laurie, et al. Standards Track [Page 51] + +RFC 5155 NSEC3 March 2008 + + +Full Copyright Statement + + Copyright (C) The IETF Trust (2008). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on an + "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS + OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND + THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF + THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED + WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed to + pertain to the implementation or use of the technology described in + this document or the extent to which any license under such rights + might or might not be available; nor does it represent that it has + made any independent effort to identify any such rights. Information + on the procedures with respect to rights in RFC documents can be + found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use of + such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository at + http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + this standard. Please address the information to the IETF at + ietf-ipr@ietf.org. + + + + + + + + + + + + +Laurie, et al. Standards Track [Page 52] + diff --git a/lib/bind/api b/lib/bind/api index d4b1ecd36b2b..7ffeba810f24 100644 --- a/lib/bind/api +++ b/lib/bind/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 4 -LIBREVISION = 9 -LIBAGE = 0 +LIBINTERFACE = 5 +LIBREVISION = 2 +LIBAGE = 1 diff --git a/lib/bind/bsd/Makefile.in b/lib/bind/bsd/Makefile.in index dd7b616e482d..998cd637e2b1 100644 --- a/lib/bind/bsd/Makefile.in +++ b/lib/bind/bsd/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:13:22 marka Exp $ +# $Id: Makefile.in,v 1.6.206.3 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -34,6 +34,6 @@ SRCS= daemon.c ftruncate.c gettimeofday.c mktemp.c putenv.c \ TARGETS= ${OBJS} -CINCLUDES= -I.. -I${srcdir}/../include +CINCLUDES= -I.. -I../include -I${srcdir}/../include @BIND9_MAKE_RULES@ diff --git a/lib/bind/bsd/strerror.c b/lib/bind/bsd/strerror.c index d13adbb03b4d..5fba248f3624 100644 --- a/lib/bind/bsd/strerror.c +++ b/lib/bind/bsd/strerror.c @@ -1,6 +1,6 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)strerror.c 8.1 (Berkeley) 6/4/93"; -static const char rcsid[] = "$Id: strerror.c,v 1.3.2.1 2001/11/02 17:45:31 gson Exp $"; +static const char rcsid[] = "$Id: strerror.c,v 1.3.2.1.10.1 2008/04/28 04:25:42 marka Exp $"; #endif /* LIBC_SCCS and not lint */ /* @@ -60,12 +60,14 @@ isc_strerror(int num) { static char ebuf[40] = UPREFIX; /* 64-bit number + slop */ u_int errnum; char *p, *t; +#ifndef USE_SYSERROR_LIST const char *ret; +#endif char tmp[40]; errnum = num; /* convert to unsigned */ #ifdef USE_SYSERROR_LIST - if (errnum < sys_nerr) + if (errnum < (u_int)sys_nerr) return (sys_errlist[errnum]); #else #undef strerror diff --git a/lib/bind/bsd/strtoul.c b/lib/bind/bsd/strtoul.c index d110f30943df..0741fc5504a3 100644 --- a/lib/bind/bsd/strtoul.c +++ b/lib/bind/bsd/strtoul.c @@ -1,6 +1,6 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)strtoul.c 8.1 (Berkeley) 6/4/93"; -static const char rcsid[] = "$Id: strtoul.c,v 1.1.2.1 2003/06/27 03:51:35 marka Exp $"; +static const char rcsid[] = "$Id: strtoul.c,v 1.1.2.1.4.1 2008/04/28 04:25:42 marka Exp $"; #endif /* LIBC_SCCS and not lint */ /* @@ -70,7 +70,7 @@ strtoul(const char *nptr, char **endptr, int base) { * See strtol for comments as to the logic used. */ do { - c = *(unsigned char *)s++; + c = *(const unsigned char *)s++; } while (isspace(c)); if (c == '-') { neg = 1; @@ -87,7 +87,7 @@ strtoul(const char *nptr, char **endptr, int base) { base = c == '0' ? 8 : 10; cutoff = (u_long)ULONG_MAX / (u_long)base; cutlim = (u_long)ULONG_MAX % (u_long)base; - for (acc = 0, any = 0;; c = *(unsigned char*)s++) { + for (acc = 0, any = 0;; c = *(const unsigned char*)s++) { if (isdigit(c)) c -= '0'; else if (isalpha(c)) @@ -96,7 +96,7 @@ strtoul(const char *nptr, char **endptr, int base) { break; if (c >= base) break; - if (any < 0 || acc > cutoff || acc == cutoff && c > cutlim) + if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim)) any = -1; else { any = 1; @@ -110,7 +110,7 @@ strtoul(const char *nptr, char **endptr, int base) { } else if (neg) acc = -acc; if (endptr != 0) - *endptr = (char *)(any ? s - 1 : nptr); + DE_CONST((any ? s - 1 : nptr), *endptr); return (acc); } diff --git a/lib/bind/configure.in b/lib/bind/configure.in index 4b752f93f1e1..5115dc8eabfd 100644 --- a/lib/bind/configure.in +++ b/lib/bind/configure.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -AC_REVISION($Revision: 1.83.2.5.2.38.2.1 $) +AC_REVISION($Revision: 1.83.2.5.2.42 $) AC_INIT(resolv/herror.c) AC_PREREQ(2.13) @@ -169,7 +169,7 @@ AC_PROG_CC AC_HEADER_STDC -AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/timers.h stropts.h) +AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/timers.h stropts.h memory.h) AC_C_CONST AC_C_INLINE @@ -461,6 +461,7 @@ AC_SUBST(WANT_THREADS_OBJS) AC_CHECK_FUNC(strlcat, AC_DEFINE(HAVE_STRLCAT)) AC_CHECK_FUNC(memmove, AC_DEFINE(HAVE_MEMMOVE)) AC_CHECK_FUNC(memchr, AC_DEFINE(HAVE_MEMCHR)) +AC_CHECK_FUNC(strtoul, , AC_DEFINE(NEED_STRTOUL)) AC_CHECK_FUNC(if_nametoindex, [USE_IFNAMELINKID="#define USE_IFNAMELINKID 1"], @@ -490,6 +491,16 @@ AC_CHECK_FUNC(strerror, [NEED_STRERROR="#undef NEED_STRERROR"], [NEED_STRERROR="#define NEED_STRERROR 1"]) AC_SUBST(NEED_STRERROR) +if test -n "$NEED_STRERROR" +then + AC_MSG_CHECKING([for extern char * sys_errlist[]]) + AC_TRY_LINK([ extern int sys_nerr; extern char *sys_errlist[]; ], + [ const char *p = sys_errlist[0]; ], + AC_MSG_RESULT(yes) + AC_DEFINE(USE_SYSERROR_LIST), + AC_MSG_RESULT(no)) +fi + # # flockfile is usually provided by pthreads, but we may want to use it # even if compiled with --disable-threads. @@ -666,6 +677,14 @@ AC_SUBST(PURIFY) # # GNU libtool support # +case $host in +sunos*) + # Just set the maximum command line length for sunos as it otherwise + # takes a exceptionally long time to work it out. Required for libtool. + lt_cv_sys_max_cmd_len=4096; + ;; +esac + AC_ARG_WITH(libtool, [ --with-libtool use GNU libtool (following indented options supported)], use_libtool="$withval", use_libtool="no") @@ -1050,6 +1069,7 @@ case "$host" in *-qnx*) PORT_DIR="port/qnx";; *-rhapsody*) PORT_DIR="port/rhapsody";; *-sunos4*) + AC_DEFINE(NEED_SUN4PROTOS) PORT_NONBLOCK="#define PORT_NONBLOCK O_NDELAY" PORT_DIR="port/sunos";; *-solaris2.[[01234]]) @@ -1246,6 +1266,38 @@ found_rt_iflist AC_CHECK_FUNC(strsep, [ISC_PLATFORM_NEEDSTRSEP="#undef ISC_PLATFORM_NEEDSTRSEP"], [ISC_PLATFORM_NEEDSTRSEP="#define ISC_PLATFORM_NEEDSTRSEP 1"]) + + +AC_MSG_CHECKING(for char *sprintf) +AC_TRY_COMPILE([ +#include <stdio.h> +], +[ char buf[2]; return(*sprintf(buf,"x"));], +AC_DEFINE(SPRINTF_CHAR) +AC_MSG_RESULT(yes) +, +AC_MSG_RESULT(no) +) + +AC_MSG_CHECKING(for char *vsprintf) +case $host in +*sunos4*) # not decared in any header file. +AC_DEFINE(VSPRINTF_CHAR) +AC_MSG_RESULT(yes) +;; +*) +AC_TRY_COMPILE([ +#include <stdio.h> +], +[ char buf[2]; return(*vsprintf(buf,"x"));], +AC_DEFINE(VSPRINTF_CHAR) +AC_MSG_RESULT(yes) +, +AC_MSG_RESULT(no) +) +;; +esac + AC_CHECK_FUNC(vsnprintf, [ISC_PLATFORM_NEEDVSNPRINTF="#undef ISC_PLATFORM_NEEDVSNPRINTF"], [ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS print.$O" @@ -1256,12 +1308,7 @@ AC_SUBST(ISC_PLATFORM_NEEDVSNPRINTF) AC_SUBST(ISC_EXTRA_OBJS) AC_SUBST(ISC_EXTRA_SRCS) -AC_CHECK_FUNC(strerror, - [USE_SYSERROR_LIST="#undef USE_SYSERROR_LIST"], - [USE_SYSERROR_LIST="#define USE_SYSERROR_LIST 1"]) -AC_SUBST(USE_SYSERROR_LIST) -# # Determine the printf format characters to use when printing # values of type isc_int64_t. We make the assumption that platforms # where a "long long" is the same size as a "long" (e.g., Alpha/OSF1) @@ -2590,7 +2637,7 @@ case "$host" in *-solaris2.9) hack_shutup_in6addr_init_macros=yes ;; - *-solaris2.1[0-9]) + *-solaris2.1[[0-9]]) hack_shutup_in6addr_init_macros=yes ;; esac diff --git a/lib/bind/dst/Makefile.in b/lib/bind/dst/Makefile.in index 8b306591708e..dbc0265669fd 100644 --- a/lib/bind/dst/Makefile.in +++ b/lib/bind/dst/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.5.206.1 2004/03/06 08:13:22 marka Exp $ +# $Id: Makefile.in,v 1.5.206.3 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -26,7 +26,7 @@ TARGETS= ${OBJS} CRYPTFLAGS= -DCYLINK_DSS -DHMAC_MD5 -DUSE_MD5 -DDNSSAFE -CINCLUDES= -I.. -I${srcdir}/../include ${CRYPTINCL} +CINCLUDES= -I.. -I../include -I${srcdir}/../include ${CRYPTINCL} CDEFINES= ${CRYPTFLAGS} @BIND9_MAKE_RULES@ diff --git a/lib/bind/dst/dst_api.c b/lib/bind/dst/dst_api.c index c1313075aeee..f2bf7d266771 100644 --- a/lib/bind/dst/dst_api.c +++ b/lib/bind/dst/dst_api.c @@ -1,5 +1,5 @@ #ifndef LINT -static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.4.2.6.8.6 2007/09/24 17:26:10 each Exp $"; +static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/dst_api.c,v 1.4.2.6.8.6 2007/09/24 17:26:10 each Exp $"; #endif /* diff --git a/lib/bind/dst/hmac_link.c b/lib/bind/dst/hmac_link.c index efad2583f666..665622647314 100644 --- a/lib/bind/dst/hmac_link.c +++ b/lib/bind/dst/hmac_link.c @@ -1,6 +1,6 @@ #ifdef HMAC_MD5 #ifndef LINT -static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.2.2.1.4.4 2007/09/24 17:26:10 each Exp $"; +static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.2.2.1.4.4 2007/09/24 17:26:10 each Exp $"; #endif /* * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc. diff --git a/lib/bind/dst/support.c b/lib/bind/dst/support.c index 8fe3cdb4780d..8bcc4e0e6df1 100644 --- a/lib/bind/dst/support.c +++ b/lib/bind/dst/support.c @@ -1,4 +1,4 @@ -static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/support.c,v 1.2.2.1.10.2 2005/10/11 00:48:14 marka Exp $"; +static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/support.c,v 1.2.2.1.10.2 2005/10/11 00:48:14 marka Exp $"; /* diff --git a/lib/bind/include/arpa/nameser.h b/lib/bind/include/arpa/nameser.h index 23db49871dcf..ab297a14c796 100644 --- a/lib/bind/include/arpa/nameser.h +++ b/lib/bind/include/arpa/nameser.h @@ -49,7 +49,7 @@ */ /* - * $Id: nameser.h,v 1.2.2.4.4.1 2004/03/09 08:33:30 marka Exp $ + * $Id: nameser.h,v 1.2.2.4.4.2 2008/04/28 05:46:51 marka Exp $ */ #ifndef _ARPA_NAMESER_H_ @@ -430,9 +430,10 @@ typedef enum __ns_cert_types { #define NS_NXT_MAX 127 /* - * EDNS0 extended flags, host order. + * EDNS0 extended flags and option codes, host order. */ #define NS_OPT_DNSSEC_OK 0x8000U +#define NS_OPT_NSID 3 /* * Inline versions of get/put short/long. Pointer is advanced. diff --git a/lib/bind/include/isc/assertions.h b/lib/bind/include/isc/assertions.h index 9a9b9dec9855..4b3335368e87 100644 --- a/lib/bind/include/isc/assertions.h +++ b/lib/bind/include/isc/assertions.h @@ -16,7 +16,7 @@ */ /* - * $Id: assertions.h,v 1.1.206.1 2004/03/09 08:33:30 marka Exp $ + * $Id: assertions.h,v 1.1.206.2 2008/10/15 03:57:45 marka Exp $ */ #ifndef ASSERTIONS_H @@ -29,18 +29,19 @@ typedef enum { typedef void (*assertion_failure_callback)(const char *, int, assertion_type, const char *, int); +/* coverity[+kill] */ extern assertion_failure_callback __assertion_failed; void set_assertion_failure_callback(assertion_failure_callback f); const char *assertion_type_to_text(assertion_type type); -#ifdef CHECK_ALL +#if defined(CHECK_ALL) || defined(__COVERITY__) #define CHECK_REQUIRE 1 #define CHECK_ENSURE 1 #define CHECK_INSIST 1 #define CHECK_INVARIANT 1 #endif -#ifdef CHECK_NONE +#if defined(CHECK_NONE) && !defined(__COVERITY__) #define CHECK_REQUIRE 0 #define CHECK_ENSURE 0 #define CHECK_INSIST 0 diff --git a/lib/bind/include/isc/misc.h b/lib/bind/include/isc/misc.h index b08b02d2890e..a391974c18ca 100644 --- a/lib/bind/include/isc/misc.h +++ b/lib/bind/include/isc/misc.h @@ -16,13 +16,14 @@ */ /* - * $Id: misc.h,v 1.2.2.1.4.1 2004/03/09 08:33:31 marka Exp $ + * $Id: misc.h,v 1.2.2.1.4.2 2008/04/28 04:25:42 marka Exp $ */ #ifndef _ISC_MISC_H #define _ISC_MISC_H #include <stdio.h> +#include <sys/types.h> #define bitncmp __bitncmp /*#define isc_movefile __isc_movefile */ diff --git a/lib/bind/include/resolv.h b/lib/bind/include/resolv.h index 87a95200bb95..0a1c7f26102b 100644 --- a/lib/bind/include/resolv.h +++ b/lib/bind/include/resolv.h @@ -50,7 +50,7 @@ /* * @(#)resolv.h 8.1 (Berkeley) 6/2/93 - * $Id: resolv.h,v 1.7.2.11.4.3 2005/08/25 04:44:13 marka Exp $ + * $Id: resolv.h,v 1.7.2.11.4.4 2008/04/28 05:46:51 marka Exp $ */ #ifndef _RESOLV_H_ @@ -252,6 +252,7 @@ union res_sockaddr_union { #define RES_NOCHECKNAME 0x00008000 /* do not check names for sanity. */ #define RES_KEEPTSIG 0x00010000 /* do not strip TSIG records */ #define RES_BLAST 0x00020000 /* blast all recursive servers */ +#define RES_NSID 0x00040000 /*%< request name server ID */ #define RES_NOTLDQUERY 0x00100000 /* don't unqualified name as a tld */ #define RES_USE_DNSSEC 0x00200000 /* use DNSSEC using OK bit in OPT */ /* #define RES_DEBUG2 0x00400000 */ /* nslookup internal */ @@ -398,6 +399,7 @@ extern const struct res_sym __p_rcode_syms[]; #define sym_ntos __sym_ntos #define sym_ston __sym_ston #define res_nopt __res_nopt +#define res_nopt_rdata __res_nopt_rdata #define res_ndestroy __res_ndestroy #define res_nametoclass __res_nametoclass #define res_nametotype __res_nametotype @@ -484,6 +486,8 @@ int res_findzonecut2 __P((res_state, const char *, ns_class, int, union res_sockaddr_union *, int)); void res_nclose __P((res_state)); int res_nopt __P((res_state, int, u_char *, int, int)); +int res_nopt_rdata __P((res_state, int, u_char *, int, u_char *, + u_short, u_short, u_char *)); void res_send_setqhook __P((res_send_qhook)); void res_send_setrhook __P((res_send_rhook)); int __res_vinit __P((res_state, int)); diff --git a/lib/bind/inet/Makefile.in b/lib/bind/inet/Makefile.in index 96698fde7f8b..9f79b9243154 100644 --- a/lib/bind/inet/Makefile.in +++ b/lib/bind/inet/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.4.206.1 2004/03/06 08:13:23 marka Exp $ +# $Id: Makefile.in,v 1.4.206.3 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -30,6 +30,6 @@ SRCS= inet_addr.c inet_cidr_ntop.c inet_cidr_pton.c inet_data.c \ TARGETS= ${OBJS} -CINCLUDES= -I.. -I${srcdir}/../include +CINCLUDES= -I.. -I../include -I${srcdir}/../include @BIND9_MAKE_RULES@ diff --git a/lib/bind/inet/inet_net_pton.c b/lib/bind/inet/inet_net_pton.c index abecfc79cd2c..6a67379c0e65 100644 --- a/lib/bind/inet/inet_net_pton.c +++ b/lib/bind/inet/inet_net_pton.c @@ -16,7 +16,7 @@ */ #if defined(LIBC_SCCS) && !defined(lint) -static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.2 2004/03/17 00:29:47 marka Exp $"; +static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.3 2008/08/26 04:50:32 marka Exp $"; #endif #include "port_before.h" @@ -133,11 +133,11 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) { INSIST(n >= 0 && n <= 9); bits *= 10; bits += n; + if (bits > 32) + goto enoent; } while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch)); if (ch != '\0') goto enoent; - if (bits > 32) - goto emsgsize; } /* Firey death and destruction unless we prefetched EOS. */ diff --git a/lib/bind/irs/Makefile.in b/lib/bind/irs/Makefile.in index 9695435ba66f..ba0092b9ae36 100644 --- a/lib/bind/irs/Makefile.in +++ b/lib/bind/irs/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.7.206.3 2004/12/07 00:38:35 marka Exp $ +# $Id: Makefile.in,v 1.7.206.5 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -65,6 +65,6 @@ WANT_IRS_THREADSGR_OBJS=getgrent_r.@O@ TARGETS= ${OBJS} -CINCLUDES= -I.. -I${srcdir}/../include +CINCLUDES= -I.. -I../include -I${srcdir}/../include @BIND9_MAKE_RULES@ diff --git a/lib/bind/irs/dns_ho.c b/lib/bind/irs/dns_ho.c index b1bd5f01e679..d942ae1be64f 100644 --- a/lib/bind/irs/dns_ho.c +++ b/lib/bind/irs/dns_ho.c @@ -52,7 +52,7 @@ /* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */ #if defined(LIBC_SCCS) && !defined(lint) -static const char rcsid[] = "$Id: dns_ho.c,v 1.5.2.7.4.9 2006/12/07 04:00:08 marka Exp $"; +static const char rcsid[] = "$Id: dns_ho.c,v 1.5.2.7.4.10 2008/09/24 06:04:13 marka Exp $"; #endif /* LIBC_SCCS and not lint */ /* Imports. */ @@ -962,7 +962,7 @@ gethostans(struct irs_ho *this, } if (m == 0) continue; - if (hap < &pvt->h_addr_ptrs[MAXADDRS-1]) + if (hap < &pvt->h_addr_ptrs[MAXADDRS]) hap++; *hap = NULL; bp += m; @@ -984,9 +984,10 @@ gethostans(struct irs_ho *this, *ap = NULL; *hap = NULL; - if (pvt->res->nsort && haveanswer > 1 && qtype == T_A) + if (pvt->res->nsort && hap != pvt->h_addr_ptrs && + qtype == T_A) addrsort(pvt->res, pvt->h_addr_ptrs, - haveanswer); + hap - pvt->h_addr_ptrs); if (pvt->host.h_name == NULL) { n = strlen(qname) + 1; /* for the \0 */ if (n > (ep - bp) || n >= MAXHOSTNAMELEN) @@ -1053,7 +1054,7 @@ add_hostent(struct pvt *pvt, char *bp, char **hap, struct addrinfo *ai) /* Avoid overflows. */ if (bp + addrlen > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1]) return(-1); - if (hap >= &pvt->h_addr_ptrs[MAXADDRS-1]) + if (hap >= &pvt->h_addr_ptrs[MAXADDRS]) return(0); /* fail, but not treat it as an error. */ /* Suppress duplicates. */ diff --git a/lib/bind/irs/irp.c b/lib/bind/irs/irp.c index 649079c31f1c..4ddf2d883f0a 100644 --- a/lib/bind/irs/irp.c +++ b/lib/bind/irs/irp.c @@ -16,7 +16,7 @@ */ #if !defined(LINT) && !defined(CODECENTER) -static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.4 2006/03/10 00:17:21 marka Exp $"; +static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.5 2008/04/28 04:25:42 marka Exp $"; #endif /* Imports */ @@ -48,6 +48,12 @@ static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.4 2006/03/10 00:17:21 marka #include "port_after.h" +#ifdef VSPRINTF_CHAR +# define VSPRINTF(x) strlen(vsprintf/**/x) +#else +# define VSPRINTF(x) ((size_t)vsprintf x) +#endif + /* Forward. */ static void irp_close(struct irs_acc *); @@ -541,7 +547,7 @@ irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...) { } va_start(ap, fmt); - todo = vsprintf(buffer, fmt, ap); + todo = VSPRINTF((buffer, fmt, ap)); va_end(ap); if (todo > (int)sizeof(buffer) - 3) { syslog(LOG_CRIT, "memory overrun in irs_irp_send_command()"); diff --git a/lib/bind/isc/Makefile.in b/lib/bind/isc/Makefile.in index d8e8889ab385..b03a9f2c0e9c 100644 --- a/lib/bind/isc/Makefile.in +++ b/lib/bind/isc/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:13:23 marka Exp $ +# $Id: Makefile.in,v 1.6.206.3 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -30,6 +30,6 @@ SRCS= assertions.c base64.c bitncmp.c ctl_clnt.c ctl_p.c \ TARGETS= ${OBJS} -CINCLUDES= -I.. -I${srcdir}/../include +CINCLUDES= -I.. -I../include -I${srcdir}/../include @BIND9_MAKE_RULES@ diff --git a/lib/bind/isc/assertions.c b/lib/bind/isc/assertions.c index f1fb2efe9570..264670e1075e 100644 --- a/lib/bind/isc/assertions.c +++ b/lib/bind/isc/assertions.c @@ -16,7 +16,7 @@ */ #if !defined(LINT) && !defined(CODECENTER) -static const char rcsid[] = "$Id: assertions.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $"; +static const char rcsid[] = "$Id: assertions.c,v 1.1.206.2 2008/10/15 03:57:45 marka Exp $"; #endif #include "port_before.h" @@ -78,6 +78,7 @@ assertion_type_to_text(assertion_type type) { * Private. */ +/* coverity[+kill] */ static void default_assertion_failed(const char *file, int line, assertion_type type, const char *cond, int print_errno) diff --git a/lib/bind/isc/bitncmp.c b/lib/bind/isc/bitncmp.c index fcff9f71ed3f..35b570b45fb0 100644 --- a/lib/bind/isc/bitncmp.c +++ b/lib/bind/isc/bitncmp.c @@ -16,7 +16,7 @@ */ #if defined(LIBC_SCCS) && !defined(lint) -static const char rcsid[] = "$Id: bitncmp.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $"; +static const char rcsid[] = "$Id: bitncmp.c,v 1.1.206.2 2008/05/12 00:20:16 marka Exp $"; #endif #include "port_before.h" @@ -48,7 +48,7 @@ bitncmp(const void *l, const void *r, int n) { b = n / 8; x = memcmp(l, r, b); - if (x) + if (x || (n % 8) == 0) return (x); lb = ((const u_char *)l)[b]; diff --git a/lib/bind/isc/ctl_clnt.c b/lib/bind/isc/ctl_clnt.c index ddb2efbe660e..d921b559c875 100644 --- a/lib/bind/isc/ctl_clnt.c +++ b/lib/bind/isc/ctl_clnt.c @@ -1,5 +1,5 @@ #if !defined(lint) && !defined(SABER) -static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.4 2007/05/18 06:25:17 marka Exp $"; +static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.5 2008/04/28 04:25:42 marka Exp $"; #endif /* not lint */ /* @@ -38,6 +38,9 @@ static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.4 2007/05/18 06:25:17 m #include <string.h> #include <time.h> #include <unistd.h> +#ifdef HAVE_MEMORY_H +#include <memory.h> +#endif #include <isc/assertions.h> #include <isc/ctl.h> diff --git a/lib/bind/isc/ctl_srvr.c b/lib/bind/isc/ctl_srvr.c index 0d1b53dfef08..11d39c719275 100644 --- a/lib/bind/isc/ctl_srvr.c +++ b/lib/bind/isc/ctl_srvr.c @@ -1,5 +1,5 @@ #if !defined(lint) && !defined(SABER) -static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.4 2006/12/07 04:52:50 marka Exp $"; +static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.5 2008/04/28 04:25:42 marka Exp $"; #endif /* not lint */ /* @@ -40,6 +40,9 @@ static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.4 2006/12/07 04:52:50 m #include <time.h> #include <unistd.h> #include <fcntl.h> +#ifdef HAVE_MEMORY_H +#include <memory.h> +#endif #include <isc/assertions.h> #include <isc/ctl.h> diff --git a/lib/bind/nameser/Makefile.in b/lib/bind/nameser/Makefile.in index aa4bc6cf6b4b..b7b7bc7bad02 100644 --- a/lib/bind/nameser/Makefile.in +++ b/lib/bind/nameser/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.4.206.1 2004/03/15 01:02:45 marka Exp $ +# $Id: Makefile.in,v 1.4.206.3 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -26,6 +26,6 @@ SRCS= ns_date.c ns_name.c ns_netint.c ns_parse.c ns_print.c \ TARGETS= ${OBJS} -CINCLUDES= -I.. -I${srcdir}/../include +CINCLUDES= -I.. -I../include -I${srcdir}/../include @BIND9_MAKE_RULES@ diff --git a/lib/bind/port_after.h.in b/lib/bind/port_after.h.in index 162535ee5067..8ee135bcdde6 100644 --- a/lib/bind/port_after.h.in +++ b/lib/bind/port_after.h.in @@ -22,6 +22,10 @@ @NEED_DAEMON@ @NEED_STRSEP@ @NEED_STRERROR@ +#ifdef NEED_STRERROR +const char *isc_strerror(int); +#define strerror isc_strerror +#endif @HAS_INET6_STRUCTS@ @HAVE_SIN6_SCOPE_ID@ @NEED_IN6ADDR_ANY@ @@ -30,7 +34,6 @@ @NEED_GETTIMEOFDAY@ @HAVE_STRNDUP@ @USE_FIONBIO_IOCTL@ -@USE_SYSERROR_LIST@ @INNETGR_ARGS@ @SETNETGRENT_ARGS@ @USE_IFNAMELINKID@ @@ -419,4 +422,80 @@ setnetgrent_r(const char *netgroup, NGR_R_ENT_ARGS); NGR_R_SET_RETURN setnetgrent_r(const char *netgroup); #endif + +#ifdef NEED_STRTOUL +unsigned long strtoul(const char *, char **, int); +#endif + +#ifdef NEED_SUN4PROTOS +#include <stdarg.h> +#ifndef __SIZE_TYPE__ +#define __SIZE_TYPE__ int +#endif +struct sockaddr; +struct iovec; +struct timeval; +struct timezone; +int fprintf(FILE *, const char *, ...); +int getsockname(int, struct sockaddr *, int *); +int getpeername(int, struct sockaddr *, int *); +int socket(int, int, int); +int connect(int, const struct sockaddr *, int); +int writev(int, struct iovec *, int); +int readv(int, struct iovec *, int); +int send(int, const char *, int, int); +void bzero(char *, int); +int recvfrom(int, char *, int, int, struct sockaddr *, int *); +int syslog(int, const char *, ... ); +int printf(const char *, ...); +__SIZE_TYPE__ fread(void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *); +__SIZE_TYPE__ fwrite(const void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *); +int fclose(FILE *); +int ungetc(int, FILE *); +int scanf(const char *, ...); +int sscanf(const char *, const char *, ... ); +int tolower(int); +int toupper(int); +int strcasecmp(const char *, const char *); +int strncasecmp(const char *, const char *, int); +int select(int, fd_set *, fd_set *, fd_set *, struct timeval *); +#ifdef gettimeofday +#undef gettimeofday +int gettimeofday(struct timeval *, struct timezone *); +#define gettimeofday isc__gettimeofday +#else +int gettimeofday(struct timeval *, struct timezone *); +#endif +long strtol(const char*, char **, int); +int fseek(FILE *, long, int); +int setsockopt(int, int, int, const char *, int); +int bind(int, const struct sockaddr *, int); +void bcopy(char *, char *, int); +int fputc(char, FILE *); +int listen(int, int); +int accept(int, struct sockaddr *, int *); +int getsockopt(int, int, int, char *, int *); +int vfprintf(FILE *, const char *, va_list); +int fflush(FILE *); +int fgetc(FILE *); +int fputs(const char *, FILE *); +int fchown(int, int, int); +void setbuf(FILE *, char *); +int gethostname(char *, int); +int rename(const char *, const char *); +time_t time(time_t *); +int fscanf(FILE *, const char *, ...); +int sscanf(const char *, const char *, ...); +int ioctl(int, int, caddr_t); +void perror(const char *); + +#if !defined(__USE_FIXED_PROTOTYPES__) && !defined(__cplusplus) && !defined(__STRICT_ANSI__) +/* + * 'gcc -ansi' changes the prototype for vsprintf(). + * Use this prototype when 'gcc -ansi' is not in effect. + */ +char *vsprintf(char *, const char *, va_list); +#endif +#endif + #endif diff --git a/lib/bind/resolv/Makefile.in b/lib/bind/resolv/Makefile.in index a235fbc7a5e3..06ceb96aeaea 100644 --- a/lib/bind/resolv/Makefile.in +++ b/lib/bind/resolv/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.3.206.3 2005/07/29 00:13:09 marka Exp $ +# $Id: Makefile.in,v 1.3.206.5 2008/04/28 23:45:35 tbox Exp $ srcdir= @srcdir@ VPATH = @srcdir@ @@ -28,7 +28,7 @@ SRCS= herror.c mtctxres.c res_comp.c res_data.c res_debug.c \ TARGETS= ${OBJS} -CINCLUDES= -I.. -I${srcdir}/../include +CINCLUDES= -I.. -I../include -I${srcdir}/../include CWARNINGS= @BIND9_MAKE_RULES@ diff --git a/lib/bind/resolv/res_debug.c b/lib/bind/resolv/res_debug.c index 8dda12c5e81c..4c3cc7530fa7 100644 --- a/lib/bind/resolv/res_debug.c +++ b/lib/bind/resolv/res_debug.c @@ -95,7 +95,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)res_debug.c 8.1 (Berkeley) 6/4/93"; -static const char rcsid[] = "$Id: res_debug.c,v 1.3.2.5.4.6 2005/07/28 07:43:22 marka Exp $"; +static const char rcsid[] = "$Id: res_debug.c,v 1.3.2.5.4.7 2008/04/28 05:46:51 marka Exp $"; #endif /* LIBC_SCCS and not lint */ #include "port_before.h" @@ -189,10 +189,56 @@ do_section(const res_state statp, p_type(ns_rr_type(rr)), p_class(ns_rr_class(rr))); else if (section == ns_s_ar && ns_rr_type(rr) == ns_t_opt) { + u_int16_t optcode, optlen, rdatalen = ns_rr_rdlen(rr); u_int32_t ttl = ns_rr_ttl(rr); + fprintf(file, "; EDNS: version: %u, udp=%u, flags=%04x\n", (ttl>>16)&0xff, ns_rr_class(rr), ttl&0xffff); + + while (rdatalen >= 4) { + const u_char *cp = ns_rr_rdata(rr); + int i; + + GETSHORT(optcode, cp); + GETSHORT(optlen, cp); + + if (optcode == NS_OPT_NSID) { + fputs("; NSID: ", file); + if (optlen == 0) { + fputs("; NSID\n", file); + } else { + fputs("; NSID: ", file); + for (i = 0; i < optlen; i++) + fprintf(file, "%02x ", + cp[i]); + fputs(" (",file); + for (i = 0; i < optlen; i++) + fprintf(file, "%c", + isprint(cp[i])? + cp[i] : '.'); + fputs(")\n", file); + } + } else { + if (optlen == 0) { + fprintf(file, "; OPT=%u\n", + optcode); + } else { + fprintf(file, "; OPT=%u: ", + optcode); + for (i = 0; i < optlen; i++) + fprintf(file, "%02x ", + cp[i]); + fputs(" (",file); + for (i = 0; i < optlen; i++) + fprintf(file, "%c", + isprint(cp[i]) ? + cp[i] : '.'); + fputs(")\n", file); + } + } + rdatalen -= 4 + optlen; + } } else { n = ns_sprintrr(handle, &rr, NULL, NULL, buf, buflen); @@ -204,7 +250,7 @@ do_section(const res_state statp, buf = malloc(buflen += 1024); if (buf == NULL) { fprintf(file, - ";; memory allocation failure\n"); + ";; memory allocation failure\n"); return; } continue; @@ -380,7 +426,7 @@ const struct res_sym __p_default_section_syms[] = { {ns_s_an, "ANSWER", (char *)0}, {ns_s_ns, "AUTHORITY", (char *)0}, {ns_s_ar, "ADDITIONAL", (char *)0}, - {0, (char *)0, (char *)0} + {0, (char *)0, (char *)0} }; const struct res_sym __p_update_section_syms[] = { @@ -388,7 +434,7 @@ const struct res_sym __p_update_section_syms[] = { {S_PREREQ, "PREREQUISITE", (char *)0}, {S_UPDATE, "UPDATE", (char *)0}, {S_ADDT, "ADDITIONAL", (char *)0}, - {0, (char *)0, (char *)0} + {0, (char *)0, (char *)0} }; const struct res_sym __p_key_syms[] = { @@ -616,6 +662,7 @@ p_option(u_long option) { case RES_USE_INET6: return "inet6"; #ifdef RES_USE_EDNS0 /* KAME extension */ case RES_USE_EDNS0: return "edns0"; + case RES_NSID: return "nsid"; #endif #ifdef RES_USE_DNAME case RES_USE_DNAME: return "dname"; diff --git a/lib/bind/resolv/res_mkquery.c b/lib/bind/resolv/res_mkquery.c index 89000edf6ad4..0e450e9b5304 100644 --- a/lib/bind/resolv/res_mkquery.c +++ b/lib/bind/resolv/res_mkquery.c @@ -70,7 +70,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)res_mkquery.c 8.1 (Berkeley) 6/4/93"; -static const char rcsid[] = "$Id: res_mkquery.c,v 1.1.2.2.4.2 2004/03/16 12:34:18 marka Exp $"; +static const char rcsid[] = "$Id: res_mkquery.c,v 1.1.2.2.4.3 2008/04/28 05:46:51 marka Exp $"; #endif /* LIBC_SCCS and not lint */ #include "port_before.h" @@ -203,9 +203,6 @@ res_nmkquery(res_state statp, #ifdef RES_USE_EDNS0 /* attach OPT pseudo-RR, as documented in RFC2671 (EDNS0). */ -#ifndef T_OPT -#define T_OPT 41 -#endif int res_nopt(res_state statp, @@ -230,14 +227,14 @@ res_nopt(res_state statp, if ((ep - cp) < 1 + RRFIXEDSZ) return (-1); - *cp++ = 0; /* "." */ - - ns_put16(T_OPT, cp); /* TYPE */ + *cp++ = 0; /*%< "." */ + ns_put16(ns_t_opt, cp); /*%< TYPE */ cp += INT16SZ; - ns_put16(anslen & 0xffff, cp); /* CLASS = UDP payload size */ + ns_put16(anslen & 0xffff, cp); /*%< CLASS = UDP payload size */ cp += INT16SZ; - *cp++ = NOERROR; /* extended RCODE */ - *cp++ = 0; /* EDNS version */ + *cp++ = NOERROR; /*%< extended RCODE */ + *cp++ = 0; /*%< EDNS version */ + if (statp->options & RES_USE_DNSSEC) { #ifdef DEBUG if (statp->options & RES_DEBUG) @@ -247,10 +244,60 @@ res_nopt(res_state statp, } ns_put16(flags, cp); cp += INT16SZ; - ns_put16(0, cp); /* RDLEN */ + + ns_put16(0, cp); /*%< RDLEN */ cp += INT16SZ; + hp->arcount = htons(ntohs(hp->arcount) + 1); return (cp - buf); } + +/* + * Construct variable data (RDATA) block for OPT psuedo-RR, append it + * to the buffer, then update the RDLEN field (previously set to zero by + * res_nopt()) with the new RDATA length. + */ +int +res_nopt_rdata(res_state statp, + int n0, /*%< current offset in buffer */ + u_char *buf, /*%< buffer to put query */ + int buflen, /*%< size of buffer */ + u_char *rdata, /*%< ptr to start of opt rdata */ + u_short code, /*%< OPTION-CODE */ + u_short len, /*%< OPTION-LENGTH */ + u_char *data) /*%< OPTION_DATA */ +{ + register u_char *cp, *ep; + +#ifdef DEBUG + if ((statp->options & RES_DEBUG) != 0U) + printf(";; res_nopt_rdata()\n"); +#endif + + cp = buf + n0; + ep = buf + buflen; + + if ((ep - cp) < (4 + len)) + return (-1); + + if (rdata < (buf + 2) || rdata >= ep) + return (-1); + + ns_put16(code, cp); + cp += INT16SZ; + + ns_put16(len, cp); + cp += INT16SZ; + + memcpy(cp, data, len); + cp += len; + + len = cp - rdata; + ns_put16(len, rdata - 2); /* Update RDLEN field */ + + return (cp - buf); +} #endif + +/*! \file */ diff --git a/lib/bind/resolv/res_query.c b/lib/bind/resolv/res_query.c index 5156ce84c086..6855b73f12c0 100644 --- a/lib/bind/resolv/res_query.c +++ b/lib/bind/resolv/res_query.c @@ -70,7 +70,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static const char sccsid[] = "@(#)res_query.c 8.1 (Berkeley) 6/4/93"; -static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.2 2004/03/16 12:34:19 marka Exp $"; +static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.3 2008/04/28 05:46:51 marka Exp $"; #endif /* LIBC_SCCS and not lint */ #include "port_before.h" @@ -116,8 +116,9 @@ res_nquery(res_state statp, { u_char buf[MAXPACKET]; HEADER *hp = (HEADER *) answer; - int n; u_int oflags; + u_char *rdata; + int n; oflags = statp->_flags; @@ -133,8 +134,14 @@ again: buf, sizeof(buf)); #ifdef RES_USE_EDNS0 if (n > 0 && (statp->_flags & RES_F_EDNS0ERR) == 0 && - (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC)) != 0U) + (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC|RES_NSID))) { n = res_nopt(statp, n, buf, sizeof(buf), anslen); + rdata = &buf[n]; + if (n > 0 && (statp->options & RES_NSID) != 0U) { + n = res_nopt_rdata(statp, n, buf, sizeof(buf), rdata, + NS_OPT_NSID, 0, NULL); + } + } #endif if (n <= 0) { #ifdef DEBUG @@ -144,6 +151,7 @@ again: RES_SET_H_ERRNO(statp, NO_RECOVERY); return (n); } + n = res_nsend(statp, buf, n, answer, anslen); if (n < 0) { #ifdef RES_USE_EDNS0 diff --git a/lib/bind9/api b/lib/bind9/api index cff58c8ed232..1bdcb768ee2c 100644 --- a/lib/bind9/api +++ b/lib/bind9/api @@ -1,3 +1,3 @@ LIBINTERFACE = 0 -LIBREVISION = 10 +LIBREVISION = 11 LIBAGE = 0 diff --git a/lib/bind9/check.c b/lib/bind9/check.c index fe9836ca4b42..4aaa37e38b66 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check.c,v 1.37.6.39 2007/12/14 01:28:26 marka Exp $ */ +/* $Id: check.c,v 1.37.6.41 2008/04/28 23:45:35 tbox Exp $ */ #include <config.h> @@ -213,13 +213,24 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) { } static isc_result_t -check_forward(const cfg_obj_t *options, isc_log_t *logctx) { +check_forward(const cfg_obj_t *options, const cfg_obj_t *global, + isc_log_t *logctx) +{ const cfg_obj_t *forward = NULL; const cfg_obj_t *forwarders = NULL; (void)cfg_map_get(options, "forward", &forward); (void)cfg_map_get(options, "forwarders", &forwarders); + if (forwarders != NULL && global != NULL) { + const char *file = cfg_obj_file(global); + unsigned int line = cfg_obj_line(global); + cfg_obj_log(forwarders, logctx, ISC_LOG_ERROR, + "forwarders declared in root zone and " + "in general configuration: %s:%u", + file, line); + return (ISC_R_FAILURE); + } if (forward != NULL && forwarders == NULL) { cfg_obj_log(forward, logctx, ISC_LOG_ERROR, "no matching 'forwarders' statement"); @@ -400,8 +411,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) { (void)cfg_map_get(options, "preferred-glue", &obj); if (obj != NULL) { const char *str; - str = cfg_obj_asstring(obj); - if (strcasecmp(str, "a") != 0 && + str = cfg_obj_asstring(obj); + if (strcasecmp(str, "a") != 0 && strcasecmp(str, "aaaa") != 0 && strcasecmp(str, "none") != 0) cfg_obj_log(obj, logctx, ISC_LOG_ERROR, @@ -430,7 +441,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) { isc_buffer_add(&b, strlen(str)); tresult = dns_name_fromtext(name, &b, dns_rootname, - ISC_FALSE, NULL); + ISC_FALSE, NULL); if (tresult != ISC_R_SUCCESS) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, "bad domain name '%s'", @@ -440,7 +451,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) { } } } - + /* * Set supported DNSSEC algorithms. */ @@ -586,7 +597,7 @@ get_masters_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret) static isc_result_t validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config, - isc_uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx) + isc_uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx) { isc_result_t result = ISC_R_SUCCESS; isc_result_t tresult; @@ -608,7 +619,7 @@ validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config, newlist: list = cfg_tuple_get(obj, "addresses"); element = cfg_list_first(list); - resume: + resume: for ( ; element != NULL; element = cfg_list_next(element)) @@ -693,9 +704,9 @@ typedef struct { } optionstable; static isc_result_t -check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config, - isc_symtab_t *symtab, dns_rdataclass_t defclass, - isc_log_t *logctx, isc_mem_t *mctx) +check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, + const cfg_obj_t *config, isc_symtab_t *symtab, + dns_rdataclass_t defclass, isc_log_t *logctx, isc_mem_t *mctx) { const char *zname; const char *typestr; @@ -708,6 +719,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config, dns_rdataclass_t zclass; dns_fixedname_t fixedname; isc_buffer_t b; + isc_boolean_t root = ISC_FALSE; static optionstable options[] = { { "allow-query", MASTERZONE | SLAVEZONE | STUBZONE }, @@ -817,7 +829,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config, isc_buffer_init(&b, zname, strlen(zname)); isc_buffer_add(&b, strlen(zname)); tresult = dns_name_fromtext(dns_fixedname_name(&fixedname), &b, - dns_rootname, ISC_TRUE, NULL); + dns_rootname, ISC_TRUE, NULL); if (tresult != ISC_R_SUCCESS) { cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR, "zone '%s': is not a valid name", zname); @@ -832,6 +844,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config, "previous definition: %s:%u", logctx, mctx); if (tresult != ISC_R_SUCCESS) result = tresult; + if (dns_name_equal(dns_fixedname_name(&fixedname), + dns_rootname)) + root = ISC_TRUE; } /* @@ -938,7 +953,18 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config, /* * Check that forwarding is reasonable. */ - if (check_forward(zoptions, logctx) != ISC_R_SUCCESS) + obj = NULL; + if (root) { + if (voptions != NULL) + (void)cfg_map_get(voptions, "forwarders", &obj); + if (obj == NULL) { + const cfg_obj_t *options = NULL; + (void)cfg_map_get(config, "options", &options); + if (options != NULL) + (void)cfg_map_get(options, "forwarders", &obj); + } + } + if (check_forward(zoptions, obj, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; /* @@ -968,7 +994,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config, result = tresult; } } - + return (result); } @@ -977,7 +1003,7 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) { const cfg_obj_t *algobj = NULL; const cfg_obj_t *secretobj = NULL; const char *keyname = cfg_obj_asstring(cfg_map_getname(key)); - + (void)cfg_map_get(key, "algorithm", &algobj); (void)cfg_map_get(key, "secret", &secretobj); if (secretobj == NULL || algobj == NULL) { @@ -1094,9 +1120,9 @@ check_servers(const cfg_obj_t *servers, isc_log_t *logctx) { } return (result); } - + static isc_result_t -check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig, +check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions, dns_rdataclass_t vclass, isc_log_t *logctx, isc_mem_t *mctx) { const cfg_obj_t *servers = NULL; @@ -1116,8 +1142,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig, if (tresult != ISC_R_SUCCESS) return (ISC_R_NOMEMORY); - if (vconfig != NULL) - (void)cfg_map_get(vconfig, "zone", &zones); + if (voptions != NULL) + (void)cfg_map_get(voptions, "zone", &zones); else (void)cfg_map_get(config, "zone", &zones); @@ -1128,7 +1154,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig, isc_result_t tresult; const cfg_obj_t *zone = cfg_listelt_value(element); - tresult = check_zoneconf(zone, config, symtab, vclass, + tresult = check_zoneconf(zone, voptions, config, symtab, vclass, logctx, mctx); if (tresult != ISC_R_SUCCESS) result = ISC_R_FAILURE; @@ -1152,10 +1178,10 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig, isc_symtab_destroy(&symtab); return (tresult); } - - if (vconfig != NULL) { + + if (voptions != NULL) { keys = NULL; - (void)cfg_map_get(vconfig, "key", &keys); + (void)cfg_map_get(voptions, "key", &keys); tresult = check_keylist(keys, symtab, logctx); if (tresult == ISC_R_EXISTS) result = ISC_R_FAILURE; @@ -1170,47 +1196,48 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig, /* * Check that forwarding is reasonable. */ - if (vconfig == NULL) { + if (voptions == NULL) { const cfg_obj_t *options = NULL; (void)cfg_map_get(config, "options", &options); if (options != NULL) - if (check_forward(options, logctx) != ISC_R_SUCCESS) + if (check_forward(options, NULL, + logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; } else { - if (check_forward(vconfig, logctx) != ISC_R_SUCCESS) + if (check_forward(voptions, NULL, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; } /* * Check that dual-stack-servers is reasonable. */ - if (vconfig == NULL) { + if (voptions == NULL) { const cfg_obj_t *options = NULL; (void)cfg_map_get(config, "options", &options); if (options != NULL) if (check_dual_stack(options, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; } else { - if (check_dual_stack(vconfig, logctx) != ISC_R_SUCCESS) + if (check_dual_stack(voptions, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; } /* * Check that rrset-order is reasonable. */ - if (vconfig != NULL) { - if (check_order(vconfig, logctx) != ISC_R_SUCCESS) + if (voptions != NULL) { + if (check_order(voptions, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; } - if (vconfig != NULL) { - (void)cfg_map_get(vconfig, "server", &servers); + if (voptions != NULL) { + (void)cfg_map_get(voptions, "server", &servers); if (servers != NULL && check_servers(servers, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; } - if (vconfig != NULL) - tresult = check_options(vconfig, logctx, mctx); + if (voptions != NULL) + tresult = check_options(voptions, logctx, mctx); else tresult = check_options(config, logctx, mctx); if (tresult != ISC_R_SUCCESS) @@ -1249,7 +1276,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx, check_servers(servers, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; - if (options != NULL && + if (options != NULL && check_order(options, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; @@ -1311,7 +1338,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx, const char *file; unsigned int line; RUNTIME_CHECK(isc_symtab_lookup(symtab, key, - vclass, &symvalue) == ISC_R_SUCCESS); + vclass, &symvalue) == ISC_R_SUCCESS); file = cfg_obj_file(symvalue.as_cpointer); line = cfg_obj_line(symvalue.as_cpointer); cfg_obj_log(view, logctx, ISC_LOG_ERROR, @@ -1351,8 +1378,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx, } } - tresult = cfg_map_get(config, "acl", &acls); - if (tresult == ISC_R_SUCCESS) { + tresult = cfg_map_get(config, "acl", &acls); + if (tresult == ISC_R_SUCCESS) { const cfg_listelt_t *elt; const cfg_listelt_t *elt2; const char *aclname; @@ -1371,7 +1398,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx, cfg_obj_log(acl, logctx, ISC_LOG_ERROR, "attempt to redefine " "builtin acl '%s'", - aclname); + aclname); result = ISC_R_FAILURE; break; } @@ -1401,8 +1428,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx, } } - tresult = cfg_map_get(config, "kal", &kals); - if (tresult == ISC_R_SUCCESS) { + tresult = cfg_map_get(config, "kal", &kals); + if (tresult == ISC_R_SUCCESS) { const cfg_listelt_t *elt; const cfg_listelt_t *elt2; const char *aclname; diff --git a/lib/dns/adb.c b/lib/dns/adb.c index a6c6d8b1de2c..49f60ecbf887 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: adb.c,v 1.181.2.11.2.34 2008/04/03 06:07:11 tbox Exp $ */ +/* $Id: adb.c,v 1.181.2.11.2.41 2008/10/17 03:34:53 marka Exp $ */ /* * Implementation notes @@ -116,6 +116,7 @@ struct dns_adb { isc_mutex_t lock; isc_mutex_t reflock; /* Covers irefcnt, erefcnt */ + isc_mutex_t overmemlock; /*%< Covers overmem */ isc_mem_t *mctx; dns_view_t *view; isc_timermgr_t *timermgr; @@ -488,6 +489,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset, isc_boolean_t new_addresses_added; dns_rdatatype_t rdtype; unsigned int findoptions; + dns_adbnamehooklist_t *hookhead; INSIST(DNS_ADBNAME_VALID(adbname)); adb = adbname->adb; @@ -512,10 +514,12 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset, INSIST(rdata.length == 4); memcpy(&ina.s_addr, rdata.data, 4); isc_sockaddr_fromin(&sockaddr, &ina, 0); + hookhead = &adbname->v4; } else { INSIST(rdata.length == 16); memcpy(in6a.s6_addr, rdata.data, 16); isc_sockaddr_fromin6(&sockaddr, &in6a, 0); + hookhead = &adbname->v6; } INSIST(nh == NULL); @@ -544,7 +548,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset, link_entry(adb, addr_bucket, entry); } else { - for (anh = ISC_LIST_HEAD(adbname->v4); + for (anh = ISC_LIST_HEAD(*hookhead); anh != NULL; anh = ISC_LIST_NEXT(anh, plink)) if (anh->entry == foundentry) @@ -557,12 +561,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset, } new_addresses_added = ISC_TRUE; - if (nh != NULL) { - if (rdtype == dns_rdatatype_a) - ISC_LIST_APPEND(adbname->v4, nh, plink); - else - ISC_LIST_APPEND(adbname->v6, nh, plink); - } + if (nh != NULL) + ISC_LIST_APPEND(*hookhead, nh, plink); nh = NULL; result = dns_rdataset_next(rdataset); } @@ -1731,8 +1731,11 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *zone, bucket = entry->lock_bucket; LOCK(&adb->entrylocks[bucket]); - if (entry_is_bad_for_zone(adb, entry, zone, now)) + if (!FIND_RETURNLAME(find) + && entry_is_bad_for_zone(adb, entry, zone, now)) { + find->options |= DNS_ADBFIND_LAMEPRUNED; goto nextv6; + } addrinfo = new_adbaddrinfo(adb, entry, find->port); if (addrinfo == NULL) { find->partial_result |= DNS_ADBFIND_INET6; @@ -1766,12 +1769,15 @@ shutdown_task(isc_task_t *task, isc_event_t *ev) { INSIST(DNS_ADB_VALID(adb)); /* + * Wait for lock around check_exit() call to be released. + */ + LOCK(&adb->lock); + /* * Kill the timer, and then the ADB itself. Note that this implies * that this task was the one scheduled to get timer events. If * this is not true (and it is unfortunate there is no way to INSIST() * this) badness will occur. */ - LOCK(&adb->lock); isc_timer_detach(&adb->timer); UNLOCK(&adb->lock); isc_event_free(&ev); @@ -1983,6 +1989,7 @@ destroy(dns_adb_t *adb) { DESTROYLOCK(&adb->reflock); DESTROYLOCK(&adb->lock); DESTROYLOCK(&adb->mplock); + DESTROYLOCK(&adb->overmemlock); isc_mem_putanddetach(&adb->mctx, adb, sizeof(dns_adb_t)); } @@ -2053,6 +2060,10 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr, if (result != ISC_R_SUCCESS) goto fail0d; + result = isc_mutex_init(&adb->overmemlock); + if (result != ISC_R_SUCCESS) + goto fail0e; + /* * Initialize the bucket locks for names and elements. * May as well initialize the list heads, too. @@ -2155,6 +2166,8 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr, if (adb->afmp != NULL) isc_mempool_destroy(&adb->afmp); + DESTROYLOCK(&adb->overmemlock); + fail0e: DESTROYLOCK(&adb->reflock); fail0d: DESTROYLOCK(&adb->mplock); @@ -3122,8 +3135,10 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) { address_type = DNS_ADBFIND_INET6; fetch = name->fetch_aaaa; name->fetch_aaaa = NULL; - } - INSIST(address_type != 0); + } else + fetch = NULL; + + INSIST(address_type != 0 && fetch != NULL); dns_resolver_destroyfetch(&fetch->fetch); dev->fetch = NULL; @@ -3570,12 +3585,21 @@ water(void *arg, int mark) { DP(ISC_LOG_DEBUG(1), "adb reached %s water mark", overmem ? "high" : "low"); - adb->overmem = overmem; - if (overmem) { - isc_interval_set(&interval, 0, 1); - (void)isc_timer_reset(adb->timer, isc_timertype_once, NULL, - &interval, ISC_TRUE); + /* + * We can't use adb->lock as there is potential for water + * to be called when adb->lock is held. + */ + LOCK(&adb->overmemlock); + if (adb->overmem != overmem) { + adb->overmem = overmem; + if (overmem) { + isc_interval_set(&interval, 0, 1); + (void)isc_timer_reset(adb->timer, isc_timertype_once, + NULL, &interval, ISC_TRUE); + } + isc_mem_waterack(adb->mctx, mark); } + UNLOCK(&adb->overmemlock); } void diff --git a/lib/dns/api b/lib/dns/api index efe79b507c4a..6bbd1729bc15 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 25 -LIBREVISION = 1 +LIBINTERFACE = 26 +LIBREVISION = 2 LIBAGE = 0 diff --git a/lib/dns/cache.c b/lib/dns/cache.c index f45af90d08d3..1212a73212a7 100644 --- a/lib/dns/cache.c +++ b/lib/dns/cache.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: cache.c,v 1.45.2.4.8.15 2006/08/01 01:07:05 marka Exp $ */ +/* $Id: cache.c,v 1.45.2.4.8.17 2008/04/28 23:45:37 tbox Exp $ */ #include <config.h> @@ -466,7 +466,7 @@ dns_cache_setcleaninginterval(dns_cache_t *cache, unsigned int t) { isc_timertype_ticker, NULL, &interval, ISC_FALSE); } - if (result != ISC_R_SUCCESS) + if (result != ISC_R_SUCCESS) isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE, ISC_LOG_WARNING, "could not set cache cleaning interval: %s", @@ -558,7 +558,7 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr, result = ISC_R_NOMEMORY; goto cleanup; } - + cleaner->overmem_event = isc_event_allocate(cache->mctx, cleaner, DNS_EVENT_CACHEOVERMEM, @@ -596,7 +596,7 @@ begin_cleaning(cache_cleaner_t *cleaner) { /* * Create an iterator, if it does not already exist, and - * position it at the beginning of the cache. + * position it at the beginning of the cache. */ if (cleaner->iterator == NULL) result = dns_db_createiterator(cleaner->cache->db, ISC_FALSE, @@ -635,7 +635,7 @@ begin_cleaning(cache_cleaner_t *cleaner) { isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1), "begin cache cleaning, mem inuse %lu", - (unsigned long)isc_mem_inuse(cleaner->cache->mctx)); + (unsigned long)isc_mem_inuse(cleaner->cache->mctx)); cleaner->state = cleaner_s_busy; isc_task_send(cleaner->task, &cleaner->resched_event); } @@ -695,7 +695,7 @@ static void overmem_cleaning_action(isc_task_t *task, isc_event_t *event) { cache_cleaner_t *cleaner = event->ev_arg; isc_boolean_t want_cleaning = ISC_FALSE; - + UNUSED(task); INSIST(task == cleaner->task); @@ -908,9 +908,12 @@ water(void *arg, int mark) { REQUIRE(VALID_CACHE(cache)); LOCK(&cache->cleaner.lock); - - dns_db_overmem(cache->db, overmem); - cache->cleaner.overmem = overmem; + + if (overmem != cache->cleaner.overmem) { + dns_db_overmem(cache->db, overmem); + cache->cleaner.overmem = overmem; + isc_mem_waterack(cache->mctx, mark); + } if (cache->cleaner.overmem_event != NULL) isc_task_send(cache->cleaner.task, @@ -1034,7 +1037,7 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) { dns_rdatasetiter_t *iter = NULL; dns_dbnode_t *node = NULL; dns_db_t *db = NULL; - + LOCK(&cache->lock); if (cache->db != NULL) dns_db_attach(cache->db, &db); diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 02a2f188d08c..8fef86c36ffe 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -15,17 +15,19 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dispatch.c,v 1.101.2.6.2.21.4.5 2008/07/23 23:16:26 marka Exp $ */ +/* $Id: dispatch.c,v 1.101.2.6.2.36 2008/09/04 00:25:40 jinmei Exp $ */ #include <config.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> +#include <stdlib.h> #include <isc/entropy.h> #include <isc/mem.h> #include <isc/mutex.h> +#include <isc/portset.h> #include <isc/print.h> #include <isc/random.h> #include <isc/string.h> @@ -44,13 +46,8 @@ typedef ISC_LIST(dns_dispentry_t) dns_displist_t; -typedef struct dns_qid { - unsigned int magic; - unsigned int qid_nbuckets; /* hash table size */ - unsigned int qid_increment; /* id increment on collision */ - isc_mutex_t lock; - dns_displist_t *qid_table; /* the table itself */ -} dns_qid_t; +typedef struct dispsocket dispsocket_t; +typedef ISC_LIST(dispsocket_t) dispsocketlist_t; /* ARC4 Random generator state */ typedef struct arc4ctx { @@ -58,14 +55,26 @@ typedef struct arc4ctx { isc_uint8_t j; isc_uint8_t s[256]; int count; + isc_entropy_t *entropy; /* entropy source for ARC4 */ + isc_mutex_t *lock; } arc4ctx_t; +typedef struct dns_qid { + unsigned int magic; + unsigned int qid_nbuckets; /* hash table size */ + unsigned int qid_increment; /* id increment on collision */ + isc_mutex_t lock; + dns_displist_t *qid_table; /* the table itself */ + dispsocketlist_t *sock_table; /* socket table */ +} dns_qid_t; + struct dns_dispatchmgr { /* Unlocked. */ unsigned int magic; isc_mem_t *mctx; dns_acl_t *blackhole; dns_portlist_t *portlist; + isc_entropy_t *entropy; /* entropy source */ /* Locked by "lock". */ isc_mutex_t lock; @@ -74,7 +83,7 @@ struct dns_dispatchmgr { /* Locked by arc4_lock. */ isc_mutex_t arc4_lock; - arc4ctx_t arc4ctx; /*%< ARC4 context for QID */ + arc4ctx_t arc4ctx; /* ARC4 context for QID */ /* locked by buffer lock */ dns_qid_t *qid; @@ -89,8 +98,27 @@ struct dns_dispatchmgr { isc_mempool_t *rpool; /* memory pool for replies */ isc_mempool_t *dpool; /* dispatch allocations */ isc_mempool_t *bpool; /* memory pool for buffers */ + isc_mempool_t *spool; /* memory pool for dispsocs */ - isc_entropy_t *entropy; /* entropy source */ + /* + * Locked by qid->lock if qid exists; otherwise, can be used without + * being locked. + * Memory footprint considerations: this is a simple implementation of + * available ports, i.e., an ordered array of the actual port numbers. + * This will require about 256KB of memory in the worst case (128KB for + * each of IPv4 and IPv6). We could reduce it by representing it as a + * more sophisticated way such as a list (or array) of ranges that are + * searched to identify a specific port. Our decision here is the saved + * memory isn't worth the implementation complexity, considering the + * fact that the whole BIND9 process (which is mainly named) already + * requires a pretty large memory footprint. We may, however, have to + * revisit the decision when we want to use it as a separate module for + * an environment where memory requirement is severer. + */ + in_port_t *v4ports; /* available ports for IPv4 */ + unsigned int nv4ports; /* # of available ports for IPv4 */ + in_port_t *v6ports; /* available ports for IPv4 */ + unsigned int nv6ports; /* # of available ports for IPv4 */ }; #define MGR_SHUTTINGDOWN 0x00000001U @@ -109,17 +137,65 @@ struct dns_dispentry { isc_taskaction_t action; void *arg; isc_boolean_t item_out; + dispsocket_t *dispsocket; ISC_LIST(dns_dispatchevent_t) items; ISC_LINK(dns_dispentry_t) link; }; +/* + * Maximum number of dispatch sockets that can be pooled for reuse. The + * appropriate value may vary, but experiments have shown a busy caching server + * may need more than 1000 sockets concurrently opened. The maximum allowable + * number of dispatch sockets (per manager) will be set to the double of this + * value. + */ +#ifndef DNS_DISPATCH_POOLSOCKS +#define DNS_DISPATCH_POOLSOCKS 2048 +#endif + +/* + * Quota to control the number of dispatch sockets. If a dispatch has more + * than the quota of sockets, new queries will purge oldest ones, so that + * a massive number of outstanding queries won't prevent subsequent queries + * (especially if the older ones take longer time and result in timeout). + */ +#ifndef DNS_DISPATCH_SOCKSQUOTA +#define DNS_DISPATCH_SOCKSQUOTA 3072 +#endif + +struct dispsocket { + unsigned int magic; + isc_socket_t *socket; + dns_dispatch_t *disp; + isc_sockaddr_t host; + in_port_t localport; + dns_dispentry_t *resp; + isc_task_t *task; + ISC_LINK(dispsocket_t) link; + unsigned int bucket; + ISC_LINK(dispsocket_t) blink; +}; + #define INVALID_BUCKET (0xffffdead) +/* + * Number of tasks for each dispatch that use separate sockets for different + * transactions. This must be a power of 2 as it will divide 32 bit numbers + * to get an uniformly random tasks selection. See get_dispsocket(). + */ +#define MAX_INTERNAL_TASKS 64 + struct dns_dispatch { /* Unlocked. */ unsigned int magic; /* magic */ dns_dispatchmgr_t *mgr; /* dispatch manager */ - isc_task_t *task; /* internal task */ + int ntasks; + /* + * internal task buckets. We use multiple tasks to distribute various + * socket events well when using separate dispatch sockets. We use the + * 1st task (task[0]) for internal control events. + */ + isc_task_t *task[MAX_INTERNAL_TASKS]; isc_socket_t *socket; /* isc socket attached to */ isc_sockaddr_t local; /* local address */ in_port_t localport; /* local UDP port */ @@ -141,10 +217,14 @@ struct dns_dispatch { tcpmsg_valid : 1, recv_pending : 1; /* is a recv() pending? */ isc_result_t shutdown_why; + ISC_LIST(dispsocket_t) activesockets; + ISC_LIST(dispsocket_t) inactivesockets; + unsigned int nsockets; unsigned int requests; /* how many requests we have */ unsigned int tcpbuffers; /* allocated buffers */ dns_tcpmsg_t tcpmsg; /* for tcp streams */ dns_qid_t *qid; + arc4ctx_t arc4ctx; /* for QID/UDP port num */ }; #define QID_MAGIC ISC_MAGIC('Q', 'i', 'd', ' ') @@ -153,6 +233,9 @@ struct dns_dispatch { #define RESPONSE_MAGIC ISC_MAGIC('D', 'r', 's', 'p') #define VALID_RESPONSE(e) ISC_MAGIC_VALID((e), RESPONSE_MAGIC) +#define DISPSOCK_MAGIC ISC_MAGIC('D', 's', 'o', 'c') +#define VALID_DISPSOCK(e) ISC_MAGIC_VALID((e), DISPSOCK_MAGIC) + #define DISPATCH_MAGIC ISC_MAGIC('D', 'i', 's', 'p') #define VALID_DISPATCH(e) ISC_MAGIC_VALID((e), DISPATCH_MAGIC) @@ -161,16 +244,33 @@ struct dns_dispatch { #define DNS_QID(disp) ((disp)->socktype == isc_sockettype_tcp) ? \ (disp)->qid : (disp)->mgr->qid +#define DISP_ARC4CTX(disp) ((disp)->socktype == isc_sockettype_udp) ? \ + (&(disp)->arc4ctx) : (&(disp)->mgr->arc4ctx) + +/* + * Locking a query port buffer is a bit tricky. We access the buffer without + * locking until qid is created. Technically, there is a possibility of race + * between the creation of qid and access to the port buffer; in practice, + * however, this should be safe because qid isn't created until the first + * dispatch is created and there should be no contending situation until then. + */ +#define PORTBUFLOCK(mgr) if ((mgr)->qid != NULL) LOCK(&((mgr)->qid->lock)) +#define PORTBUFUNLOCK(mgr) if ((mgr)->qid != NULL) UNLOCK((&(mgr)->qid->lock)) + /* * Statics. */ -static dns_dispentry_t *bucket_search(dns_qid_t *, isc_sockaddr_t *, - dns_messageid_t, in_port_t, unsigned int); +static dns_dispentry_t *entry_search(dns_qid_t *, isc_sockaddr_t *, + dns_messageid_t, in_port_t, unsigned int); static isc_boolean_t destroy_disp_ok(dns_dispatch_t *); static void destroy_disp(isc_task_t *task, isc_event_t *event); -static void udp_recv(isc_task_t *, isc_event_t *); +static void destroy_dispsocket(dns_dispatch_t *, dispsocket_t **); +static void deactivate_dispsocket(dns_dispatch_t *, dispsocket_t *); +static void udp_exrecv(isc_task_t *, isc_event_t *); +static void udp_shrecv(isc_task_t *, isc_event_t *); +static void udp_recv(isc_event_t *, dns_dispatch_t *, dispsocket_t *); static void tcp_recv(isc_task_t *, isc_event_t *); -static void startrecv(dns_dispatch_t *); +static isc_result_t startrecv(dns_dispatch_t *, dispsocket_t *); static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t, in_port_t); static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len); @@ -182,6 +282,11 @@ static dns_dispentry_t *linear_first(dns_qid_t *disp); static dns_dispentry_t *linear_next(dns_qid_t *disp, dns_dispentry_t *resp); static void dispatch_free(dns_dispatch_t **dispp); +static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr, + dns_dispatch_t *disp, + isc_socketmgr_t *sockmgr, + isc_sockaddr_t *localaddr, + isc_socket_t **sockp); static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, isc_taskmgr_t *taskmgr, @@ -192,8 +297,13 @@ static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr, static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr); static void destroy_mgr(dns_dispatchmgr_t **mgrp); static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, - unsigned int increment, dns_qid_t **qidp); + unsigned int increment, dns_qid_t **qidp, + isc_boolean_t needaddrtable); static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp); +static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, + unsigned int options, isc_socket_t **sockp); +static isc_boolean_t portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock, + isc_sockaddr_t *sockaddrp); #define LVL(x) ISC_LOG_DEBUG(x) @@ -296,13 +406,15 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp, * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ static void -dispatch_arc4init(arc4ctx_t *actx) { +dispatch_arc4init(arc4ctx_t *actx, isc_entropy_t *entropy, isc_mutex_t *lock) { int n; for (n = 0; n < 256; n++) actx->s[n] = n; actx->i = 0; actx->j = 0; actx->count = 0; + actx->entropy = entropy; /* don't have to attach */ + actx->lock = lock; } static void @@ -346,7 +458,7 @@ dispatch_arc4get16(arc4ctx_t *actx) { } static void -dispatch_arc4stir(dns_dispatchmgr_t *mgr) { +dispatch_arc4stir(arc4ctx_t *actx) { int i; union { unsigned char rnd[128]; @@ -354,51 +466,55 @@ dispatch_arc4stir(dns_dispatchmgr_t *mgr) { } rnd; isc_result_t result; - if (mgr->entropy != NULL) { + if (actx->entropy != NULL) { /* * We accept any quality of random data to avoid blocking. */ - result = isc_entropy_getdata(mgr->entropy, rnd.rnd, + result = isc_entropy_getdata(actx->entropy, rnd.rnd, sizeof(rnd), NULL, 0); RUNTIME_CHECK(result == ISC_R_SUCCESS); } else { for (i = 0; i < 32; i++) isc_random_get(&rnd.rnd32[i]); } - dispatch_arc4addrandom(&mgr->arc4ctx, rnd.rnd, sizeof(rnd.rnd)); + dispatch_arc4addrandom(actx, rnd.rnd, sizeof(rnd.rnd)); /* * Discard early keystream, as per recommendations in: * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps */ for (i = 0; i < 256; i++) - (void)dispatch_arc4get8(&mgr->arc4ctx); + (void)dispatch_arc4get8(actx); /* * Derived from OpenBSD's implementation. The rationale is not clear, * but should be conservative enough in safety, and reasonably large * for efficiency. */ - mgr->arc4ctx.count = 1600000; + actx->count = 1600000; } static isc_uint16_t -dispatch_arc4random(dns_dispatchmgr_t *mgr) { +dispatch_arc4random(arc4ctx_t *actx) { isc_uint16_t result; - LOCK(&mgr->arc4_lock); - mgr->arc4ctx.count -= sizeof(isc_uint16_t); - if (mgr->arc4ctx.count <= 0) - dispatch_arc4stir(mgr); - result = dispatch_arc4get16(&mgr->arc4ctx); - UNLOCK(&mgr->arc4_lock); + if (actx->lock != NULL) + LOCK(actx->lock); + + actx->count -= sizeof(isc_uint16_t); + if (actx->count <= 0) + dispatch_arc4stir(actx); + result = dispatch_arc4get16(actx); + + if (actx->lock != NULL) + UNLOCK(actx->lock); + return (result); } static isc_uint16_t -dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) { +dispatch_arc4uniformrandom(arc4ctx_t *actx, isc_uint16_t upper_bound) { isc_uint16_t min, r; - /* The caller must hold the manager lock. */ if (upper_bound < 2) return (0); @@ -420,7 +536,7 @@ dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) { * to re-roll. */ for (;;) { - r = dispatch_arc4random(mgr); + r = dispatch_arc4random(actx); if (r >= min) break; } @@ -503,13 +619,15 @@ destroy_disp_ok(dns_dispatch_t *disp) if (disp->recv_pending != 0) return (ISC_FALSE); + if (!ISC_LIST_EMPTY(disp->activesockets)) + return (ISC_FALSE); + if (disp->shutting_down == 0) return (ISC_FALSE); return (ISC_TRUE); } - /* * Called when refcount reaches 0 (and safe to destroy). * @@ -521,6 +639,8 @@ destroy_disp(isc_task_t *task, isc_event_t *event) { dns_dispatch_t *disp; dns_dispatchmgr_t *mgr; isc_boolean_t killmgr; + dispsocket_t *dispsocket; + int i; INSIST(event->ev_type == DNS_EVENT_DISPATCHCONTROL); @@ -534,10 +654,16 @@ destroy_disp(isc_task_t *task, isc_event_t *event) { dispatch_log(disp, LVL(90), "shutting down; detaching from sock %p, task %p", - disp->socket, disp->task); + disp->socket, disp->task[0]); /* XXXX */ - isc_socket_detach(&disp->socket); - isc_task_detach(&disp->task); + if (disp->socket != NULL) + isc_socket_detach(&disp->socket); + while ((dispsocket = ISC_LIST_HEAD(disp->inactivesockets)) != NULL) { + ISC_LIST_UNLINK(disp->inactivesockets, dispsocket, link); + destroy_dispsocket(disp, &dispsocket); + } + for (i = 0; i < disp->ntasks; i++) + isc_task_detach(&disp->task[i]); isc_event_free(&event); dispatch_free(&disp); @@ -548,14 +674,210 @@ destroy_disp(isc_task_t *task, isc_event_t *event) { destroy_mgr(&mgr); } +/* + * Find a dispsocket for socket address 'dest', and port number 'port'. + * Return NULL if no such entry exists. + */ +static dispsocket_t * +socket_search(dns_qid_t *qid, isc_sockaddr_t *dest, in_port_t port, + unsigned int bucket) +{ + dispsocket_t *dispsock; + + REQUIRE(bucket < qid->qid_nbuckets); + + dispsock = ISC_LIST_HEAD(qid->sock_table[bucket]); + + while (dispsock != NULL) { + if (isc_sockaddr_equal(dest, &dispsock->host) && + dispsock->localport == port) + return (dispsock); + dispsock = ISC_LIST_NEXT(dispsock, blink); + } + + return (NULL); +} /* - * Find an entry for query ID 'id' and socket address 'dest' in 'qid'. + * Make a new socket for a single dispatch with a random port number. + * The caller must hold the disp->lock and qid->lock. + */ +static isc_result_t +get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest, + isc_socketmgr_t *sockmgr, dns_qid_t *qid, + dispsocket_t **dispsockp, in_port_t *portp) +{ + int i; + isc_uint32_t r; + dns_dispatchmgr_t *mgr = disp->mgr; + isc_socket_t *sock = NULL; + isc_result_t result = ISC_R_FAILURE; + in_port_t port; + isc_sockaddr_t localaddr; + unsigned int bucket = 0; + dispsocket_t *dispsock; + unsigned int nports; + in_port_t *ports; + + if (isc_sockaddr_pf(&disp->local) == AF_INET) { + nports = disp->mgr->nv4ports; + ports = disp->mgr->v4ports; + } else { + nports = disp->mgr->nv6ports; + ports = disp->mgr->v6ports; + } + if (nports == 0) + return (ISC_R_ADDRNOTAVAIL); + + dispsock = ISC_LIST_HEAD(disp->inactivesockets); + if (dispsock != NULL) { + ISC_LIST_UNLINK(disp->inactivesockets, dispsock, link); + sock = dispsock->socket; + dispsock->socket = NULL; + } else { + dispsock = isc_mempool_get(mgr->spool); + if (dispsock == NULL) + return (ISC_R_NOMEMORY); + + disp->nsockets++; + dispsock->socket = NULL; + dispsock->disp = disp; + dispsock->resp = NULL; + isc_random_get(&r); + dispsock->task = NULL; + isc_task_attach(disp->task[r % disp->ntasks], &dispsock->task); + ISC_LINK_INIT(dispsock, link); + ISC_LINK_INIT(dispsock, blink); + dispsock->magic = DISPSOCK_MAGIC; + } + + /* + * Pick up a random UDP port and open a new socket with it. Avoid + * choosing ports that share the same destination because it will be + * very likely to fail in bind(2) or connect(2). + */ + localaddr = disp->local; + for (i = 0; i < 64; i++) { + port = ports[dispatch_arc4uniformrandom(DISP_ARC4CTX(disp), + nports)]; + isc_sockaddr_setport(&localaddr, port); + + bucket = dns_hash(qid, dest, 0, port); + if (socket_search(qid, dest, port, bucket) != NULL) + continue; + + result = open_socket(sockmgr, &localaddr, 0, &sock); + if (result == ISC_R_SUCCESS || result != ISC_R_ADDRINUSE) + break; + } + + if (result == ISC_R_SUCCESS) { + dispsock->socket = sock; + dispsock->host = *dest; + dispsock->localport = port; + dispsock->bucket = bucket; + ISC_LIST_APPEND(qid->sock_table[bucket], dispsock, blink); + *dispsockp = dispsock; + *portp = port; + } else { + /* + * We could keep it in the inactive list, but since this should + * be an exceptional case and might be resource shortage, we'd + * rather destroy it. + */ + if (sock != NULL) + isc_socket_detach(&sock); + destroy_dispsocket(disp, &dispsock); + } + + return (result); +} + +/* + * Destroy a dedicated dispatch socket. + */ +static void +destroy_dispsocket(dns_dispatch_t *disp, dispsocket_t **dispsockp) { + dispsocket_t *dispsock; + dns_qid_t *qid; + + /* + * The dispatch must be locked. + */ + + REQUIRE(dispsockp != NULL && *dispsockp != NULL); + dispsock = *dispsockp; + REQUIRE(!ISC_LINK_LINKED(dispsock, link)); + + disp->nsockets--; + dispsock->magic = 0; + if (dispsock->socket != NULL) + isc_socket_detach(&dispsock->socket); + if (ISC_LINK_LINKED(dispsock, blink)) { + qid = DNS_QID(disp); + LOCK(&qid->lock); + ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock, + blink); + UNLOCK(&qid->lock); + } + if (dispsock->task != NULL) + isc_task_detach(&dispsock->task); + isc_mempool_put(disp->mgr->spool, dispsock); + + *dispsockp = NULL; +} + +/* + * Deactivate a dedicated dispatch socket. Move it to the inactive list for + * future reuse unless the total number of sockets are exceeding the maximum. + */ +static void +deactivate_dispsocket(dns_dispatch_t *disp, dispsocket_t *dispsock) { + isc_result_t result; + dns_qid_t *qid; + + /* + * The dispatch must be locked. + */ + ISC_LIST_UNLINK(disp->activesockets, dispsock, link); + if (dispsock->resp != NULL) { + INSIST(dispsock->resp->dispsocket == dispsock); + dispsock->resp->dispsocket = NULL; + } + + if (disp->nsockets > DNS_DISPATCH_POOLSOCKS) + destroy_dispsocket(disp, &dispsock); + else { + result = isc_socket_close(dispsock->socket); + + qid = DNS_QID(disp); + LOCK(&qid->lock); + ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock, + blink); + UNLOCK(&qid->lock); + + if (result == ISC_R_SUCCESS) + ISC_LIST_APPEND(disp->inactivesockets, dispsock, link); + else { + /* + * If the underlying system does not allow this + * optimization, destroy this temporary structure (and + * create a new one for a new transaction). + */ + INSIST(result == ISC_R_NOTIMPLEMENTED); + destroy_dispsocket(disp, &dispsock); + } + } +} + +/* + * Find an entry for query ID 'id', socket address 'dest', and port number + * 'port'. * Return NULL if no such entry exists. */ static dns_dispentry_t * -bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id, - in_port_t port, unsigned int bucket) +entry_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id, + in_port_t port, unsigned int bucket) { dns_dispentry_t *res; @@ -564,7 +886,7 @@ bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id, res = ISC_LIST_HEAD(qid->qid_table[bucket]); while (res != NULL) { - if ((res->id == id) && isc_sockaddr_equal(dest, &res->host) && + if (res->id == id && isc_sockaddr_equal(dest, &res->host) && res->port == port) { return (res); } @@ -638,6 +960,26 @@ allocate_event(dns_dispatch_t *disp) { return (ev); } +static void +udp_exrecv(isc_task_t *task, isc_event_t *ev) { + dispsocket_t *dispsock = ev->ev_arg; + + UNUSED(task); + + REQUIRE(VALID_DISPSOCK(dispsock)); + udp_recv(ev, dispsock->disp, dispsock); +} + +static void +udp_shrecv(isc_task_t *task, isc_event_t *ev) { + dns_dispatch_t *disp = ev->ev_arg; + + UNUSED(task); + + REQUIRE(VALID_DISPATCH(disp)); + udp_recv(ev, disp, NULL); +} + /* * General flow: * @@ -653,14 +995,13 @@ allocate_event(dns_dispatch_t *disp) { * restart. */ static void -udp_recv(isc_task_t *task, isc_event_t *ev_in) { +udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) { isc_socketevent_t *ev = (isc_socketevent_t *)ev_in; - dns_dispatch_t *disp = ev_in->ev_arg; dns_messageid_t id; isc_result_t dres; isc_buffer_t source; unsigned int flags; - dns_dispentry_t *resp; + dns_dispentry_t *resp = NULL; dns_dispatchevent_t *rev; unsigned int bucket; isc_boolean_t killit; @@ -669,8 +1010,8 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { dns_qid_t *qid; isc_netaddr_t netaddr; int match; - - UNUSED(task); + int result; + isc_boolean_t qidlocked = ISC_FALSE; LOCK(&disp->lock); @@ -681,7 +1022,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { "got packet: requests %d, buffers %d, recvs %d", disp->requests, disp->mgr->buffers, disp->recv_pending); - if (ev->ev_type == ISC_SOCKEVENT_RECVDONE) { + if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) { /* * Unless the receive event was imported from a listening * interface, in which case the event type is @@ -691,6 +1032,19 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { disp->recv_pending = 0; } + if (dispsock != NULL && + (ev->result == ISC_R_CANCELED || dispsock->resp == NULL)) { + /* + * dispsock->resp can be NULL if this transaction was canceled + * just after receiving a response. Since this socket is + * exclusively used and there should be at most one receive + * event the canceled event should have been no effect. So + * we can (and should) deactivate the socket right now. + */ + deactivate_dispsocket(disp, dispsock); + dispsock = NULL; + } + if (disp->shutting_down) { /* * This dispatcher is shutting down. @@ -703,12 +1057,32 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { killit = destroy_disp_ok(disp); UNLOCK(&disp->lock); if (killit) - isc_task_send(disp->task, &disp->ctlevent); + isc_task_send(disp->task[0], &disp->ctlevent); return; } - if (ev->result != ISC_R_SUCCESS) { + if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) { + if (dispsock != NULL) { + resp = dispsock->resp; + id = resp->id; + if (ev->result != ISC_R_SUCCESS) { + /* + * This is most likely a network error on a + * connected socket. It makes no sense to + * check the address or parse the packet, but it + * will help to return the error to the caller. + */ + goto sendresponse; + } + } else { + free_buffer(disp, ev->region.base, ev->region.length); + + UNLOCK(&disp->lock); + isc_event_free(&ev_in); + return; + } + } else if (ev->result != ISC_R_SUCCESS) { free_buffer(disp, ev->region.base, ev->region.length); if (ev->result != ISC_R_CANCELED) @@ -769,15 +1143,29 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { goto restart; } - /* response */ - bucket = dns_hash(qid, &ev->address, id, disp->localport); - LOCK(&qid->lock); - resp = bucket_search(qid, &ev->address, id, disp->localport, bucket); - dispatch_log(disp, LVL(90), - "search for response in bucket %d: %s", - bucket, (resp == NULL ? "not found" : "found")); - + /* + * Search for the corresponding response. If we are using an exclusive + * socket, we've already identified it and we can skip the search; but + * the ID and the address must match the expected ones. + */ if (resp == NULL) { + bucket = dns_hash(qid, &ev->address, id, disp->localport); + LOCK(&qid->lock); + qidlocked = ISC_TRUE; + resp = entry_search(qid, &ev->address, id, disp->localport, + bucket); + dispatch_log(disp, LVL(90), + "search for response in bucket %d: %s", + bucket, (resp == NULL ? "not found" : "found")); + + if (resp == NULL) { + free_buffer(disp, ev->region.base, ev->region.length); + goto unlock; + } + } else if (resp->id != id || !isc_sockaddr_equal(&ev->address, + &resp->host)) { + dispatch_log(disp, LVL(90), + "response to an exclusive socket doesn't match"); free_buffer(disp, ev->region.base, ev->region.length); goto unlock; } @@ -825,6 +1213,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { } } + sendresponse: queue_response = resp->item_out; rev = allocate_event(resp->disp); if (rev == NULL) { @@ -839,7 +1228,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { */ isc_buffer_init(&rev->buffer, ev->region.base, ev->region.length); isc_buffer_add(&rev->buffer, ev->n); - rev->result = ISC_R_SUCCESS; + rev->result = ev->result; rev->id = id; rev->addr = ev->address; rev->pktinfo = ev->pktinfo; @@ -858,14 +1247,23 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { isc_task_send(resp->task, ISC_EVENT_PTR(&rev)); } unlock: - UNLOCK(&qid->lock); + if (qidlocked) + UNLOCK(&qid->lock); /* * Restart recv() to get the next packet. */ restart: - startrecv(disp); - + result = startrecv(disp, dispsock); + if (result != ISC_R_SUCCESS && dispsock != NULL) { + /* + * XXX: wired. There seems to be no recovery process other than + * deactivate this socket anyway (since we cannot start + * receiving, we won't be able to receive a cancel event + * from the user). + */ + deactivate_dispsocket(disp, dispsock); + } UNLOCK(&disp->lock); isc_event_free(&ev_in); @@ -965,7 +1363,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { killit = destroy_disp_ok(disp); UNLOCK(&disp->lock); if (killit) - isc_task_send(disp->task, &disp->ctlevent); + isc_task_send(disp->task[0], &disp->ctlevent); return; } @@ -1008,8 +1406,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { */ bucket = dns_hash(qid, &tcpmsg->address, id, disp->localport); LOCK(&qid->lock); - resp = bucket_search(qid, &tcpmsg->address, id, disp->localport, - bucket); + resp = entry_search(qid, &tcpmsg->address, id, disp->localport, bucket); dispatch_log(disp, LVL(90), "search for response in bucket %d: %s", bucket, (resp == NULL ? "not found" : "found")); @@ -1050,7 +1447,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { * Restart recv() to get the next packet. */ restart: - startrecv(disp); + (void)startrecv(disp, NULL); UNLOCK(&disp->lock); @@ -1060,22 +1457,33 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { /* * disp must be locked. */ -static void -startrecv(dns_dispatch_t *disp) { +static isc_result_t +startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) { isc_result_t res; isc_region_t region; + isc_socket_t *socket; if (disp->shutting_down == 1) - return; + return (ISC_R_SUCCESS); if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) - return; + return (ISC_R_SUCCESS); - if (disp->recv_pending != 0) - return; + if (disp->recv_pending != 0 && dispsock == NULL) + return (ISC_R_SUCCESS); if (disp->mgr->buffers >= disp->mgr->maxbuffers) - return; + return (ISC_R_NOMEMORY); + + if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 && + dispsock == NULL) + return (ISC_R_SUCCESS); + + if (dispsock != NULL) + socket = dispsock->socket; + else + socket = disp->socket; + INSIST(socket != NULL); switch (disp->socktype) { /* @@ -1085,33 +1493,45 @@ startrecv(dns_dispatch_t *disp) { region.length = disp->mgr->buffersize; region.base = allocate_udp_buffer(disp); if (region.base == NULL) - return; - res = isc_socket_recv(disp->socket, ®ion, 1, - disp->task, udp_recv, disp); - if (res != ISC_R_SUCCESS) { - free_buffer(disp, region.base, region.length); - disp->shutdown_why = res; - disp->shutting_down = 1; - do_cancel(disp); - return; + return (ISC_R_NOMEMORY); + if (dispsock != NULL) { + res = isc_socket_recv(socket, ®ion, 1, + dispsock->task, udp_exrecv, + dispsock); + if (res != ISC_R_SUCCESS) { + free_buffer(disp, region.base, region.length); + return (res); + } + } else { + res = isc_socket_recv(socket, ®ion, 1, + disp->task[0], udp_shrecv, disp); + if (res != ISC_R_SUCCESS) { + free_buffer(disp, region.base, region.length); + disp->shutdown_why = res; + disp->shutting_down = 1; + do_cancel(disp); + return (ISC_R_SUCCESS); /* recover by cancel */ + } + INSIST(disp->recv_pending == 0); + disp->recv_pending = 1; } - INSIST(disp->recv_pending == 0); - disp->recv_pending = 1; break; case isc_sockettype_tcp: - res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task, + res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task[0], tcp_recv, disp); if (res != ISC_R_SUCCESS) { disp->shutdown_why = res; disp->shutting_down = 1; do_cancel(disp); - return; + return (ISC_R_SUCCESS); /* recover by cancel */ } INSIST(disp->recv_pending == 0); disp->recv_pending = 1; break; } + + return (ISC_R_SUCCESS); } /* @@ -1164,6 +1584,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) { isc_mempool_destroy(&mgr->rpool); isc_mempool_destroy(&mgr->dpool); isc_mempool_destroy(&mgr->bpool); + isc_mempool_destroy(&mgr->spool); DESTROYLOCK(&mgr->pool_lock); @@ -1177,32 +1598,46 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) { if (mgr->blackhole != NULL) dns_acl_detach(&mgr->blackhole); - if (mgr->portlist != NULL) - dns_portlist_detach(&mgr->portlist); - + if (mgr->v4ports != NULL) { + isc_mem_put(mctx, mgr->v4ports, + mgr->nv4ports * sizeof(in_port_t)); + } + if (mgr->v6ports != NULL) { + isc_mem_put(mctx, mgr->v6ports, + mgr->nv6ports * sizeof(in_port_t)); + } isc_mem_put(mctx, mgr, sizeof(dns_dispatchmgr_t)); isc_mem_detach(&mctx); } static isc_result_t -create_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, - unsigned int options, isc_socket_t **sockp) +open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, + unsigned int options, isc_socket_t **sockp) { isc_socket_t *sock; isc_result_t result; - sock = NULL; - result = isc_socket_create(mgr, isc_sockaddr_pf(local), - isc_sockettype_udp, &sock); - if (result != ISC_R_SUCCESS) - return (result); + sock = *sockp; + if (sock == NULL) { + result = isc_socket_create(mgr, isc_sockaddr_pf(local), + isc_sockettype_udp, &sock); + if (result != ISC_R_SUCCESS) + return (result); + } else { + result = isc_socket_open(sock); + if (result != ISC_R_SUCCESS) + return (result); + } #ifndef ISC_ALLOW_MAPPED isc_socket_ipv6only(sock, ISC_TRUE); #endif result = isc_socket_bind(sock, local, options); if (result != ISC_R_SUCCESS) { - isc_socket_detach(&sock); + if (*sockp == NULL) + isc_socket_detach(&sock); + else + isc_socket_close(sock); return (result); } @@ -1211,6 +1646,24 @@ create_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local, } /* + * Create a temporary port list to set the initial default set of dispatch + * ports: [1024, 65535]. This is almost meaningless as the application will + * normally set the ports explicitly, but is provided to fill some minor corner + * cases. + */ +static isc_result_t +create_default_portset(isc_mem_t *mctx, isc_portset_t **portsetp) { + isc_result_t result; + + result = isc_portset_create(mctx, portsetp); + if (result != ISC_R_SUCCESS) + return (result); + isc_portset_addrange(*portsetp, 1024, 65535); + + return (ISC_R_SUCCESS); +} + +/* * Publics. */ @@ -1220,6 +1673,8 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, { dns_dispatchmgr_t *mgr; isc_result_t result; + isc_portset_t *v4portset = NULL; + isc_portset_t *v6portset = NULL; REQUIRE(mctx != NULL); REQUIRE(mgrp != NULL && *mgrp == NULL); @@ -1232,7 +1687,6 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, isc_mem_attach(mctx, &mgr->mctx); mgr->blackhole = NULL; - mgr->portlist = NULL; result = isc_mutex_init(&mgr->lock); if (result != ISC_R_SUCCESS) @@ -1287,20 +1741,43 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, mgr->buffersize = 0; mgr->maxbuffers = 0; mgr->bpool = NULL; + mgr->spool = NULL; mgr->entropy = NULL; mgr->qid = NULL; mgr->state = 0; ISC_LIST_INIT(mgr->list); + mgr->v4ports = NULL; + mgr->v6ports = NULL; + mgr->nv4ports = 0; + mgr->nv6ports = 0; mgr->magic = DNS_DISPATCHMGR_MAGIC; + result = create_default_portset(mctx, &v4portset); + if (result == ISC_R_SUCCESS) { + result = create_default_portset(mctx, &v6portset); + if (result == ISC_R_SUCCESS) { + result = dns_dispatchmgr_setavailports(mgr, + v4portset, + v6portset); + } + } + if (v4portset != NULL) + isc_portset_destroy(mctx, &v4portset); + if (v6portset != NULL) + isc_portset_destroy(mctx, &v6portset); + if (result != ISC_R_SUCCESS) + goto kill_dpool; + if (entropy != NULL) isc_entropy_attach(entropy, &mgr->entropy); - dispatch_arc4init(&mgr->arc4ctx); + dispatch_arc4init(&mgr->arc4ctx, mgr->entropy, &mgr->arc4_lock); *mgrp = mgr; return (ISC_R_SUCCESS); + kill_dpool: + isc_mempool_destroy(&mgr->dpool); kill_rpool: isc_mempool_destroy(&mgr->rpool); kill_epool: @@ -1339,22 +1816,88 @@ dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr, dns_portlist_t *portlist) { REQUIRE(VALID_DISPATCHMGR(mgr)); - if (mgr->portlist != NULL) - dns_portlist_detach(&mgr->portlist); - if (portlist != NULL) - dns_portlist_attach(portlist, &mgr->portlist); + UNUSED(portlist); + + /* This function is deprecated: use dns_dispatchmgr_setavailports(). */ + return; } dns_portlist_t * dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr) { REQUIRE(VALID_DISPATCHMGR(mgr)); - return (mgr->portlist); + return (NULL); /* this function is deprecated */ +} + +isc_result_t +dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset, + isc_portset_t *v6portset) +{ + in_port_t *v4ports, *v6ports, p; + unsigned int nv4ports, nv6ports, i4, i6; + + REQUIRE(VALID_DISPATCHMGR(mgr)); + + nv4ports = isc_portset_nports(v4portset); + nv6ports = isc_portset_nports(v6portset); + + v4ports = NULL; + if (nv4ports != 0) { + v4ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv4ports); + if (v4ports == NULL) + return (ISC_R_NOMEMORY); + } + v6ports = NULL; + if (nv6ports != 0) { + v6ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv6ports); + if (v6ports == NULL) { + if (v4ports != NULL) { + isc_mem_put(mgr->mctx, v4ports, + sizeof(in_port_t) * + isc_portset_nports(v4portset)); + } + return (ISC_R_NOMEMORY); + } + } + + p = 0; + i4 = 0; + i6 = 0; + do { + if (isc_portset_isset(v4portset, p)) { + INSIST(i4 < nv4ports); + v4ports[i4++] = p; + } + if (isc_portset_isset(v6portset, p)) { + INSIST(i6 < nv6ports); + v6ports[i6++] = p; + } + } while (p++ < 65535); + INSIST(i4 == nv4ports && i6 == nv6ports); + + PORTBUFLOCK(mgr); + if (mgr->v4ports != NULL) { + isc_mem_put(mgr->mctx, mgr->v4ports, + mgr->nv4ports * sizeof(in_port_t)); + } + mgr->v4ports = v4ports; + mgr->nv4ports = nv4ports; + + if (mgr->v6ports != NULL) { + isc_mem_put(mgr->mctx, mgr->v6ports, + mgr->nv6ports * sizeof(in_port_t)); + } + mgr->v6ports = v6ports; + mgr->nv6ports = nv6ports; + PORTBUFUNLOCK(mgr); + + return (ISC_R_SUCCESS); } static isc_result_t dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, - unsigned int buffersize, unsigned int maxbuffers, - unsigned int buckets, unsigned int increment) + unsigned int buffersize, unsigned int maxbuffers, + unsigned int maxrequests, unsigned int buckets, + unsigned int increment) { isc_result_t result; @@ -1381,24 +1924,39 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, maxbuffers = 8; LOCK(&mgr->buffer_lock); + + /* Create or adjust buffer pool */ if (mgr->bpool != NULL) { isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); mgr->maxbuffers = maxbuffers; + } else { + result = isc_mempool_create(mgr->mctx, buffersize, &mgr->bpool); + if (result != ISC_R_SUCCESS) { + UNLOCK(&mgr->buffer_lock); + return (result); + } + isc_mempool_setname(mgr->bpool, "dispmgr_bpool"); + isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); + isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock); + } + + /* Create or adjust socket pool */ + if (mgr->spool != NULL) { + isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2); UNLOCK(&mgr->buffer_lock); return (ISC_R_SUCCESS); } - - if (isc_mempool_create(mgr->mctx, buffersize, - &mgr->bpool) != ISC_R_SUCCESS) { + result = isc_mempool_create(mgr->mctx, sizeof(dispsocket_t), + &mgr->spool); + if (result != ISC_R_SUCCESS) { UNLOCK(&mgr->buffer_lock); - return (ISC_R_NOMEMORY); + goto cleanup; } + isc_mempool_setname(mgr->spool, "dispmgr_spool"); + isc_mempool_setmaxalloc(mgr->spool, maxrequests); + isc_mempool_associatelock(mgr->spool, &mgr->pool_lock); - isc_mempool_setname(mgr->bpool, "dispmgr_bpool"); - isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); - isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock); - - result = qid_allocate(mgr, buckets, increment, &mgr->qid); + result = qid_allocate(mgr, buckets, increment, &mgr->qid, ISC_TRUE); if (result != ISC_R_SUCCESS) goto cleanup; @@ -1409,8 +1967,10 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, cleanup: isc_mempool_destroy(&mgr->bpool); + if (mgr->spool != NULL) + isc_mempool_destroy(&mgr->spool); UNLOCK(&mgr->buffer_lock); - return (ISC_R_NOMEMORY); + return (result); } void @@ -1436,30 +1996,56 @@ dns_dispatchmgr_destroy(dns_dispatchmgr_t **mgrp) { destroy_mgr(&mgr); } +static int +port_cmp(const void *key, const void *ent) { + in_port_t p1 = *(const in_port_t *)key; + in_port_t p2 = *(const in_port_t *)ent; + + if (p1 < p2) + return (-1); + else if (p1 == p2) + return (0); + else + return (1); +} + static isc_boolean_t -blacklisted(dns_dispatchmgr_t *mgr, isc_socket_t *sock, - isc_sockaddr_t *sockaddrp) +portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock, + isc_sockaddr_t *sockaddrp) { isc_sockaddr_t sockaddr; isc_result_t result; + in_port_t *ports, port; + unsigned int nports; + isc_boolean_t available = ISC_FALSE; REQUIRE(sock != NULL || sockaddrp != NULL); - if (mgr->portlist == NULL) - return (ISC_FALSE); - + PORTBUFLOCK(mgr); if (sock != NULL) { sockaddrp = &sockaddr; result = isc_socket_getsockname(sock, sockaddrp); if (result != ISC_R_SUCCESS) - return (ISC_FALSE); + goto unlock; } - if (mgr->portlist != NULL && - dns_portlist_match(mgr->portlist, isc_sockaddr_pf(sockaddrp), - isc_sockaddr_getport(sockaddrp))) - return (ISC_TRUE); - return (ISC_FALSE); + if (isc_sockaddr_pf(sockaddrp) == AF_INET) { + ports = mgr->v4ports; + nports = mgr->nv4ports; + } else { + ports = mgr->v6ports; + nports = mgr->nv6ports; + } + if (ports == NULL) + goto unlock; + + port = isc_sockaddr_getport(sockaddrp); + if (bsearch(&port, ports, nports, sizeof(in_port_t), port_cmp) != NULL) + available = ISC_TRUE; + +unlock: + PORTBUFUNLOCK(mgr); + return (available); } #define ATTRMATCH(_a1, _a2, _mask) (((_a1) & (_mask)) == ((_a2) & (_mask))) @@ -1469,17 +2055,20 @@ local_addr_match(dns_dispatch_t *disp, isc_sockaddr_t *addr) { isc_sockaddr_t sockaddr; isc_result_t result; + REQUIRE(disp->socket != NULL); + if (addr == NULL) return (ISC_TRUE); /* - * Don't match wildcard ports against newly blacklisted ports. + * Don't match wildcard ports unless the port is available in the + * current configuration. */ - if (disp->mgr->portlist != NULL && - isc_sockaddr_getport(addr) == 0 && + if (isc_sockaddr_getport(addr) == 0 && isc_sockaddr_getport(&disp->local) == 0 && - blacklisted(disp->mgr, disp->socket, NULL)) + !portavailable(disp->mgr, disp->socket, NULL)) { return (ISC_FALSE); + } /* * Check if we match the binding <address,port>. @@ -1521,10 +2110,10 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local, isc_result_t result; /* - * Make certain that we will not match a private dispatch. + * Make certain that we will not match a private or exclusive dispatch. */ - attributes &= ~DNS_DISPATCHATTR_PRIVATE; - mask |= DNS_DISPATCHATTR_PRIVATE; + attributes &= ~(DNS_DISPATCHATTR_PRIVATE|DNS_DISPATCHATTR_EXCLUSIVE); + mask |= (DNS_DISPATCHATTR_PRIVATE|DNS_DISPATCHATTR_EXCLUSIVE); disp = ISC_LIST_HEAD(mgr->list); while (disp != NULL) { @@ -1551,7 +2140,8 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local, static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, - unsigned int increment, dns_qid_t **qidp) + unsigned int increment, dns_qid_t **qidp, + isc_boolean_t needsocktable) { dns_qid_t *qid; unsigned int i; @@ -1572,16 +2162,35 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, return (ISC_R_NOMEMORY); } + qid->sock_table = NULL; + if (needsocktable) { + qid->sock_table = isc_mem_get(mgr->mctx, buckets * + sizeof(dispsocketlist_t)); + if (qid->sock_table == NULL) { + isc_mem_put(mgr->mctx, qid, sizeof(*qid)); + isc_mem_put(mgr->mctx, qid->qid_table, + buckets * sizeof(dns_displist_t)); + return (ISC_R_NOMEMORY); + } + } + if (isc_mutex_init(&qid->lock) != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_mutex_init failed"); + if (qid->sock_table != NULL) { + isc_mem_put(mgr->mctx, qid->sock_table, + buckets * sizeof(dispsocketlist_t)); + } isc_mem_put(mgr->mctx, qid->qid_table, buckets * sizeof(dns_displist_t)); isc_mem_put(mgr->mctx, qid, sizeof(*qid)); return (ISC_R_UNEXPECTED); } - for (i = 0; i < buckets; i++) + for (i = 0; i < buckets; i++) { ISC_LIST_INIT(qid->qid_table[i]); + if (qid->sock_table != NULL) + ISC_LIST_INIT(qid->sock_table[i]); + } qid->qid_nbuckets = buckets; qid->qid_increment = increment; @@ -1603,6 +2212,10 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) { qid->magic = 0; isc_mem_put(mctx, qid->qid_table, qid->qid_nbuckets * sizeof(dns_displist_t)); + if (qid->sock_table != NULL) { + isc_mem_put(mctx, qid->sock_table, + qid->qid_nbuckets * sizeof(dispsocketlist_t)); + } DESTROYLOCK(&qid->lock); isc_mem_put(mctx, qid, sizeof(*qid)); } @@ -1646,6 +2259,10 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests, disp->requests = 0; disp->tcpbuffers = 0; disp->qid = NULL; + ISC_LIST_INIT(disp->activesockets); + ISC_LIST_INIT(disp->inactivesockets); + disp->nsockets = 0; + dispatch_arc4init(&disp->arc4ctx, mgr->entropy, NULL); if (isc_mutex_init(&disp->lock) != ISC_R_SUCCESS) { res = ISC_R_UNEXPECTED; @@ -1700,6 +2317,8 @@ dispatch_free(dns_dispatch_t **dispp) INSIST(disp->tcpbuffers == 0); INSIST(disp->requests == 0); INSIST(disp->recv_pending == 0); + INSIST(ISC_LIST_EMPTY(disp->activesockets)); + INSIST(ISC_LIST_EMPTY(disp->inactivesockets)); isc_mempool_put(mgr->epool, disp->failsafe_ev); disp->failsafe_ev = NULL; @@ -1745,7 +2364,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, return (result); } - result = qid_allocate(mgr, buckets, increment, &disp->qid); + result = qid_allocate(mgr, buckets, increment, &disp->qid, ISC_FALSE); if (result != ISC_R_SUCCESS) goto deallocate_dispatch; @@ -1753,8 +2372,9 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, disp->socket = NULL; isc_socket_attach(sock, &disp->socket); - disp->task = NULL; - result = isc_task_create(taskmgr, 0, &disp->task); + disp->ntasks = 1; + disp->task[0] = NULL; + result = isc_task_create(taskmgr, 0, &disp->task[0]); if (result != ISC_R_SUCCESS) goto kill_socket; @@ -1767,7 +2387,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, goto kill_task; } - isc_task_setname(disp->task, "tcpdispatch", disp); + isc_task_setname(disp->task[0], "tcpdispatch", disp); dns_tcpmsg_init(mgr->mctx, disp->socket, &disp->tcpmsg); disp->tcpmsg_valid = 1; @@ -1781,7 +2401,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, UNLOCK(&mgr->lock); mgr_log(mgr, LVL(90), "created TCP dispatcher %p", disp); - dispatch_log(disp, LVL(90), "created task %p", disp->task); + dispatch_log(disp, LVL(90), "created task %p", disp->task[0]); *dispp = disp; @@ -1791,7 +2411,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock, * Error returns. */ kill_task: - isc_task_detach(&disp->task); + isc_task_detach(&disp->task[0]); kill_socket: isc_socket_detach(&disp->socket); deallocate_dispatch: @@ -1826,13 +2446,13 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, REQUIRE((attributes & DNS_DISPATCHATTR_TCP) == 0); result = dns_dispatchmgr_setudp(mgr, buffersize, maxbuffers, - buckets, increment); + maxrequests, buckets, increment); if (result != ISC_R_SUCCESS) return (result); LOCK(&mgr->lock); - if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) { + if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) { REQUIRE(isc_sockaddr_getport(localaddr) == 0); goto createudp; } @@ -1853,7 +2473,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, { disp->attributes |= DNS_DISPATCHATTR_NOLISTEN; if (disp->recv_pending != 0) - isc_socket_cancel(disp->socket, disp->task, + isc_socket_cancel(disp->socket, disp->task[0], ISC_SOCKCANCEL_RECV); } @@ -1890,6 +2510,101 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, #endif static isc_result_t +get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp, + isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr, + isc_socket_t **sockp) +{ + unsigned int i, j; + isc_socket_t *held[DNS_DISPATCH_HELD]; + isc_sockaddr_t localaddr_bound; + isc_socket_t *sock = NULL; + isc_result_t result = ISC_R_SUCCESS; + isc_boolean_t anyport; + + INSIST(sockp != NULL && *sockp == NULL); + + localaddr_bound = *localaddr; + anyport = ISC_TF(isc_sockaddr_getport(localaddr) == 0); + + if (anyport) { + unsigned int nports; + in_port_t *ports; + + /* + * If no port is specified, we first try to pick up a random + * port by ourselves. + */ + if (isc_sockaddr_pf(&disp->local) == AF_INET) { + nports = disp->mgr->nv4ports; + ports = disp->mgr->v4ports; + } else { + nports = disp->mgr->nv6ports; + ports = disp->mgr->v6ports; + } + if (nports == 0) + return (ISC_R_ADDRNOTAVAIL); + + for (i = 0; i < 1024; i++) { + in_port_t prt; + + prt = ports[dispatch_arc4uniformrandom( + DISP_ARC4CTX(disp), + nports)]; + isc_sockaddr_setport(&localaddr_bound, prt); + result = open_socket(sockmgr, &localaddr_bound, + 0, &sock); + if (result == ISC_R_SUCCESS || + result != ISC_R_ADDRINUSE) { + disp->localport = prt; + *sockp = sock; + return (result); + } + } + + /* + * If this fails 1024 times, we then ask the kernel for + * choosing one. + */ + } + + memset(held, 0, sizeof(held)); + i = 0; + + for (j = 0; j < 0xffffU; j++) { + result = open_socket(sockmgr, localaddr, 0, &sock); + if (result != ISC_R_SUCCESS) + goto end; + else if (!anyport) + break; + else if (portavailable(mgr, sock, NULL)) + break; + if (held[i] != NULL) + isc_socket_detach(&held[i]); + held[i++] = sock; + sock = NULL; + if (i == DNS_DISPATCH_HELD) + i = 0; + } + if (j == 0xffffU) { + mgr_log(mgr, ISC_LOG_ERROR, + "avoid-v%s-udp-ports: unable to allocate " + "an available port", + isc_sockaddr_pf(localaddr) == AF_INET ? "4" : "6"); + result = ISC_R_FAILURE; + goto end; + } + *sockp = sock; + +end: + for (i = 0; i < DNS_DISPATCH_HELD; i++) { + if (held[i] != NULL) + isc_socket_detach(&held[i]); + } + + return (result); +} + +static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr, @@ -1900,10 +2615,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, isc_result_t result; dns_dispatch_t *disp; isc_socket_t *sock = NULL; - isc_socket_t *held[DNS_DISPATCH_HELD]; - unsigned int i = 0, j = 0, k = 0; - isc_sockaddr_t localaddr_bound; - in_port_t localport = 0; + int i = 0; /* * dispatch_allocate() checks mgr for us. @@ -1913,67 +2625,46 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, if (result != ISC_R_SUCCESS) return (result); - /* - * Try to allocate a socket that is not on the blacklist. - * Hold up to DNS_DISPATCH_HELD sockets to prevent the OS - * from returning the same port to us too quickly. - */ - memset(held, 0, sizeof(held)); - localaddr_bound = *localaddr; - getsocket: - if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) { - in_port_t prt; - - /* XXX: should the range be configurable? */ - prt = 1024 + dispatch_arc4uniformrandom(mgr, 65535 - 1023); - isc_sockaddr_setport(&localaddr_bound, prt); - if (blacklisted(mgr, NULL, &localaddr_bound)) { - if (++k == 1024) - attributes &= ~DNS_DISPATCHATTR_RANDOMPORT; - goto getsocket; - } - result = create_socket(sockmgr, &localaddr_bound, 0, &sock); - if (result == ISC_R_ADDRINUSE) { - if (++k == 1024) - attributes &= ~DNS_DISPATCHATTR_RANDOMPORT; - goto getsocket; - } - localport = prt; - } else - result = create_socket(sockmgr, localaddr, - ISC_SOCKET_REUSEADDRESS, &sock); - if (result != ISC_R_SUCCESS) - goto deallocate_dispatch; - if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) == 0 && - isc_sockaddr_getport(localaddr) == 0 && - blacklisted(mgr, sock, NULL)) - { - if (held[i] != NULL) - isc_socket_detach(&held[i]); - held[i++] = sock; - sock = NULL; - if (i == DNS_DISPATCH_HELD) - i = 0; - if (j++ == 0xffffU) { - mgr_log(mgr, ISC_LOG_ERROR, "avoid-v%s-udp-ports: " - "unable to allocate a non-blacklisted port", - isc_sockaddr_pf(localaddr) == AF_INET ? - "4" : "6"); - result = ISC_R_FAILURE; + if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) { + result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock); + if (result != ISC_R_SUCCESS) goto deallocate_dispatch; + } else { + isc_sockaddr_t sa_any; + + /* + * For dispatches using exclusive sockets with a specific + * source address, we only check if the specified address is + * available on the system. Query sockets will be created later + * on demand. + */ + isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr)); + if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) { + result = open_socket(sockmgr, localaddr, 0, &sock); + if (sock != NULL) + isc_socket_detach(&sock); + if (result != ISC_R_SUCCESS) + goto deallocate_dispatch; } - goto getsocket; } - disp->socktype = isc_sockettype_udp; disp->socket = sock; disp->local = *localaddr; - disp->localport = localport; - disp->task = NULL; - result = isc_task_create(taskmgr, 0, &disp->task); - if (result != ISC_R_SUCCESS) - goto kill_socket; + if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) + disp->ntasks = MAX_INTERNAL_TASKS; + else + disp->ntasks = 1; + for (i = 0; i < disp->ntasks; i++) { + disp->task[i] = NULL; + result = isc_task_create(taskmgr, 0, &disp->task[i]); + if (result != ISC_R_SUCCESS) { + while (--i >= 0) + isc_task_destroy(&disp->task[i]); + goto kill_socket; + } + isc_task_setname(disp->task[i], "udpdispatch", disp); + } disp->ctlevent = isc_event_allocate(mgr->mctx, disp, DNS_EVENT_DISPATCHCONTROL, @@ -1984,8 +2675,6 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, goto kill_task; } - isc_task_setname(disp->task, "udpdispatch", disp); - attributes &= ~DNS_DISPATCHATTR_TCP; attributes |= DNS_DISPATCHATTR_UDP; disp->attributes = attributes; @@ -1996,26 +2685,25 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, ISC_LIST_APPEND(mgr->list, disp, link); mgr_log(mgr, LVL(90), "created UDP dispatcher %p", disp); - dispatch_log(disp, LVL(90), "created task %p", disp->task); - dispatch_log(disp, LVL(90), "created socket %p", disp->socket); + dispatch_log(disp, LVL(90), "created task %p", disp->task[0]); /* XXX */ + if (disp->socket != NULL) + dispatch_log(disp, LVL(90), "created socket %p", disp->socket); *dispp = disp; - - goto cleanheld; + return (result); /* * Error returns. */ kill_task: - isc_task_detach(&disp->task); + for (i = 0; i < disp->ntasks; i++) + isc_task_detach(&disp->task[i]); kill_socket: - isc_socket_detach(&disp->socket); + if (disp->socket != NULL) + isc_socket_detach(&disp->socket); deallocate_dispatch: dispatch_free(&disp); - cleanheld: - for (i = 0; i < DNS_DISPATCH_HELD; i++) - if (held[i] != NULL) - isc_socket_detach(&held[i]); + return (result); } @@ -2041,6 +2729,7 @@ dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp) { void dns_dispatch_detach(dns_dispatch_t **dispp) { dns_dispatch_t *disp; + dispsocket_t *dispsock; isc_boolean_t killit; REQUIRE(dispp != NULL && VALID_DISPATCH(*dispp)); @@ -2055,8 +2744,14 @@ dns_dispatch_detach(dns_dispatch_t **dispp) { killit = ISC_FALSE; if (disp->refcount == 0) { if (disp->recv_pending > 0) - isc_socket_cancel(disp->socket, disp->task, + isc_socket_cancel(disp->socket, disp->task[0], + ISC_SOCKCANCEL_RECV); + for (dispsock = ISC_LIST_HEAD(disp->activesockets); + dispsock != NULL; + dispsock = ISC_LIST_NEXT(dispsock, link)) { + isc_socket_cancel(dispsock->socket, dispsock->task, ISC_SOCKCANCEL_RECV); + } disp->shutting_down = 1; } @@ -2065,26 +2760,32 @@ dns_dispatch_detach(dns_dispatch_t **dispp) { killit = destroy_disp_ok(disp); UNLOCK(&disp->lock); if (killit) - isc_task_send(disp->task, &disp->ctlevent); + isc_task_send(disp->task[0], &disp->ctlevent); } isc_result_t -dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, - isc_task_t *task, isc_taskaction_t action, void *arg, - dns_messageid_t *idp, dns_dispentry_t **resp) +dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, + isc_task_t *task, isc_taskaction_t action, void *arg, + dns_messageid_t *idp, dns_dispentry_t **resp, + isc_socketmgr_t *sockmgr) { dns_dispentry_t *res; unsigned int bucket; + in_port_t localport = 0; dns_messageid_t id; int i; isc_boolean_t ok; dns_qid_t *qid; + dispsocket_t *dispsocket = NULL; + isc_result_t result; REQUIRE(VALID_DISPATCH(disp)); REQUIRE(task != NULL); REQUIRE(dest != NULL); REQUIRE(resp != NULL && *resp == NULL); REQUIRE(idp != NULL); + if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) + REQUIRE(sockmgr != NULL); LOCK(&disp->lock); @@ -2098,23 +2799,75 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, return (ISC_R_QUOTA); } + if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 && + disp->nsockets > DNS_DISPATCH_SOCKSQUOTA) { + dispsocket_t *oldestsocket; + dns_dispentry_t *oldestresp; + dns_dispatchevent_t *rev; + + /* + * Kill oldest outstanding query if the number of sockets + * exceeds the quota to keep the room for new queries. + */ + oldestsocket = ISC_LIST_HEAD(disp->activesockets); + oldestresp = oldestsocket->resp; + if (oldestresp != NULL && !oldestresp->item_out) { + rev = allocate_event(oldestresp->disp); + if (rev != NULL) { + rev->buffer.base = NULL; + rev->result = ISC_R_CANCELED; + rev->id = oldestresp->id; + ISC_EVENT_INIT(rev, sizeof(*rev), 0, + NULL, DNS_EVENT_DISPATCH, + oldestresp->action, + oldestresp->arg, oldestresp, + NULL, NULL); + oldestresp->item_out = ISC_TRUE; + isc_task_send(oldestresp->task, + ISC_EVENT_PTR(&rev)); + } + } + + /* + * Move this entry to the tail so that it won't (easily) be + * examined before actually being canceled. + */ + ISC_LIST_UNLINK(disp->activesockets, oldestsocket, link); + ISC_LIST_APPEND(disp->activesockets, oldestsocket, link); + } + + qid = DNS_QID(disp); + LOCK(&qid->lock); + + if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) { + /* + * Get a separate UDP socket with a random port number. + */ + result = get_dispsocket(disp, dest, sockmgr, qid, &dispsocket, + &localport); + if (result != ISC_R_SUCCESS) { + UNLOCK(&qid->lock); + UNLOCK(&disp->lock); + return (result); + } + } else { + localport = disp->localport; + } + /* * Try somewhat hard to find an unique ID. */ - id = (dns_messageid_t)dispatch_arc4random(disp->mgr); - qid = DNS_QID(disp); - LOCK(&qid->lock); - bucket = dns_hash(qid, dest, id, disp->localport); + id = (dns_messageid_t)dispatch_arc4random(DISP_ARC4CTX(disp)); + bucket = dns_hash(qid, dest, id, localport); ok = ISC_FALSE; for (i = 0; i < 64; i++) { - if (bucket_search(qid, dest, id, disp->localport, bucket) == - NULL) { + if (entry_search(qid, dest, id, localport, bucket) == NULL) { ok = ISC_TRUE; break; } id += qid->qid_increment; id &= 0x0000ffff; - bucket = dns_hash(qid, dest, id, disp->localport); + bucket = dns_hash(qid, dest, id, localport); } if (!ok) { @@ -2127,6 +2880,8 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, if (res == NULL) { UNLOCK(&qid->lock); UNLOCK(&disp->lock); + if (dispsocket != NULL) + destroy_dispsocket(disp, &dispsocket); return (ISC_R_NOMEMORY); } @@ -2136,11 +2891,14 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, isc_task_attach(task, &res->task); res->disp = disp; res->id = id; - res->port = disp->localport; + res->port = localport; res->bucket = bucket; res->host = *dest; res->action = action; res->arg = arg; + res->dispsocket = dispsocket; + if (dispsocket != NULL) + dispsocket->resp = res; res->item_out = ISC_FALSE; ISC_LIST_INIT(res->items); ISC_LINK_INIT(res, link); @@ -2152,27 +2910,62 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, "attached to task %p", res->task); if (((disp->attributes & DNS_DISPATCHATTR_UDP) != 0) || - ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0)) - startrecv(disp); + ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0)) { + result = startrecv(disp, dispsocket); + if (result != ISC_R_SUCCESS) { + LOCK(&qid->lock); + ISC_LIST_UNLINK(qid->qid_table[bucket], res, link); + UNLOCK(&qid->lock); + + if (dispsocket != NULL) + destroy_dispsocket(disp, &dispsocket); + + disp->refcount--; + disp->requests--; + + UNLOCK(&disp->lock); + isc_task_detach(&res->task); + isc_mempool_put(disp->mgr->rpool, res); + return (result); + } + } + + if (dispsocket != NULL) + ISC_LIST_APPEND(disp->activesockets, dispsocket, link); UNLOCK(&disp->lock); *idp = id; *resp = res; + if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) + INSIST(res->dispsocket != NULL); + return (ISC_R_SUCCESS); } +isc_result_t +dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, + isc_task_t *task, isc_taskaction_t action, void *arg, + dns_messageid_t *idp, dns_dispentry_t **resp) +{ + REQUIRE(VALID_DISPATCH(disp)); + REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0); + + return (dns_dispatch_addresponse2(disp, dest, task, action, arg, + idp, resp, NULL)); +} + void dns_dispatch_starttcp(dns_dispatch_t *disp) { REQUIRE(VALID_DISPATCH(disp)); - dispatch_log(disp, LVL(90), "starttcp %p", disp->task); + dispatch_log(disp, LVL(90), "starttcp %p", disp->task[0]); LOCK(&disp->lock); disp->attributes |= DNS_DISPATCHATTR_CONNECTED; - startrecv(disp); + (void)startrecv(disp, NULL); UNLOCK(&disp->lock); } @@ -2183,6 +2976,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, dns_dispatchmgr_t *mgr; dns_dispatch_t *disp; dns_dispentry_t *res; + dispsocket_t *dispsock; dns_dispatchevent_t *ev; unsigned int bucket; isc_boolean_t killit; @@ -2220,8 +3014,14 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, killit = ISC_FALSE; if (disp->refcount == 0) { if (disp->recv_pending > 0) - isc_socket_cancel(disp->socket, disp->task, + isc_socket_cancel(disp->socket, disp->task[0], + ISC_SOCKCANCEL_RECV); + for (dispsock = ISC_LIST_HEAD(disp->activesockets); + dispsock != NULL; + dispsock = ISC_LIST_NEXT(dispsock, link)) { + isc_socket_cancel(dispsock->socket, dispsock->task, ISC_SOCKCANCEL_RECV); + } disp->shutting_down = 1; } @@ -2257,6 +3057,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, request_log(disp, res, LVL(90), "detaching from task %p", res->task); isc_task_detach(&res->task); + if (res->dispsocket != NULL) { + isc_socket_cancel(res->dispsocket->socket, + res->dispsocket->task, ISC_SOCKCANCEL_RECV); + res->dispsocket->resp = NULL; + } + /* * Free any buffered requests as well */ @@ -2273,12 +3079,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, if (disp->shutting_down == 1) do_cancel(disp); else - startrecv(disp); + (void)startrecv(disp, NULL); killit = destroy_disp_ok(disp); UNLOCK(&disp->lock); if (killit) - isc_task_send(disp->task, &disp->ctlevent); + isc_task_send(disp->task[0], &disp->ctlevent); } static void @@ -2293,13 +3099,15 @@ do_cancel(dns_dispatch_t *disp) { qid = DNS_QID(disp); /* - * Search for the first response handler without packets outstanding. + * Search for the first response handler without packets outstanding + * unless a specific hander is given. */ LOCK(&qid->lock); for (resp = linear_first(qid); - resp != NULL && resp->item_out != ISC_FALSE; + resp != NULL && resp->item_out; /* Empty. */) resp = linear_next(qid, resp); + /* * No one to send the cancel event to, so nothing to do. */ @@ -2332,6 +3140,16 @@ dns_dispatch_getsocket(dns_dispatch_t *disp) { return (disp->socket); } +isc_socket_t * +dns_dispatch_getentrysocket(dns_dispentry_t *resp) { + REQUIRE(VALID_RESPONSE(resp)); + + if (resp->dispsocket != NULL) + return (resp->dispsocket->socket); + else + return (NULL); +} + isc_result_t dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp) { @@ -2365,11 +3183,27 @@ dns_dispatch_cancel(dns_dispatch_t *disp) { return; } +unsigned int +dns_dispatch_getattributes(dns_dispatch_t *disp) { + REQUIRE(VALID_DISPATCH(disp)); + + /* + * We don't bother locking disp here; it's the caller's responsibility + * to use only non volatile flags. + */ + return (disp->attributes); +} + void dns_dispatch_changeattributes(dns_dispatch_t *disp, unsigned int attributes, unsigned int mask) { REQUIRE(VALID_DISPATCH(disp)); + /* Exclusive attribute can only be set on creation */ + REQUIRE((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0); + /* Also, a dispatch with randomport specified cannot start listening */ + REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0 || + (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0); /* XXXMLG * Should check for valid attributes here! @@ -2381,13 +3215,13 @@ dns_dispatch_changeattributes(dns_dispatch_t *disp, if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0 && (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) { disp->attributes &= ~DNS_DISPATCHATTR_NOLISTEN; - startrecv(disp); + (void)startrecv(disp, NULL); } else if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0 && (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) { disp->attributes |= DNS_DISPATCHATTR_NOLISTEN; if (disp->recv_pending != 0) - isc_socket_cancel(disp->socket, disp->task, + isc_socket_cancel(disp->socket, disp->task[0], ISC_SOCKCANCEL_RECV); } } @@ -2411,7 +3245,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) { INSIST(sevent->n <= disp->mgr->buffersize); newsevent = (isc_socketevent_t *) isc_event_allocate(disp->mgr->mctx, NULL, - DNS_EVENT_IMPORTRECVDONE, udp_recv, + DNS_EVENT_IMPORTRECVDONE, udp_shrecv, disp, sizeof(isc_socketevent_t)); if (newsevent == NULL) return; @@ -2431,7 +3265,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) { newsevent->pktinfo = sevent->pktinfo; newsevent->attributes = sevent->attributes; - isc_task_send(disp->task, ISC_EVENT_PTR(&newsevent)); + isc_task_send(disp->task[0], ISC_EVENT_PTR(&newsevent)); } #if 0 diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h index e3495aaa361f..041e2b6acb01 100644 --- a/lib/dns/include/dns/dispatch.h +++ b/lib/dns/include/dns/dispatch.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dispatch.h,v 1.45.2.2.4.5.4.2 2008/07/23 07:28:11 tbox Exp $ */ +/* $Id: dispatch.h,v 1.45.2.2.4.9 2008/06/25 23:45:37 tbox Exp $ */ #ifndef DNS_DISPATCH_H #define DNS_DISPATCH_H 1 @@ -104,7 +104,7 @@ struct dns_dispatchevent { * The dispatcher is a TCP or UDP socket. * * _IPV4, _IPV6 - * The dispatcher uses an ipv4 or ipv6 socket. + * The dispatcher uses an IPv4 or IPv6 socket. * * _NOLISTEN * The dispatcher should not listen on the socket. @@ -114,7 +114,12 @@ struct dns_dispatchevent { * accept replies from them. * * _RANDOMPORT - * Allocate UDP port randomly. + * Previously used to indicate that the port of a dispatch UDP must be + * chosen randomly. This behavior now always applies and the attribute + * is obsoleted. + * + * _EXCLUSIVE + * A separate socket will be used on-demand for each transaction. */ #define DNS_DISPATCHATTR_PRIVATE 0x00000001U #define DNS_DISPATCHATTR_TCP 0x00000002U @@ -124,7 +129,8 @@ struct dns_dispatchevent { #define DNS_DISPATCHATTR_NOLISTEN 0x00000020U #define DNS_DISPATCHATTR_MAKEQUERY 0x00000040U #define DNS_DISPATCHATTR_CONNECTED 0x00000080U -#define DNS_DISPATCHATTR_RANDOMPORT 0x00000100U +/*#define DNS_DISPATCHATTR_RANDOMPORT 0x00000100U*/ +#define DNS_DISPATCHATTR_EXCLUSIVE 0x00000200U isc_result_t dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, @@ -187,24 +193,32 @@ void dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr, dns_portlist_t *portlist); /* - * Sets a list of UDP ports that won't be used when creating a udp - * dispatch with a wildcard port. + * This function is deprecated. Use dns_dispatchmgr_setavailports() instead. * * Requires: * mgr is a valid dispatchmgr - * portlist to be NULL or a valid port list. */ dns_portlist_t * dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr); /* - * Return the current port list. + * This function is deprecated and always returns NULL. * * Requires: * mgr is a valid dispatchmgr */ - +isc_result_t +dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset, + isc_portset_t *v6portset); +/* + * Sets a list of UDP ports that can be used for outgoing UDP messages. + * + * Requires: + * mgr is a valid dispatchmgr + * v4portset is NULL or a valid port set + * v6portset is NULL or a valid port set + */ isc_result_t dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr, @@ -317,6 +331,12 @@ dns_dispatch_starttcp(dns_dispatch_t *disp); */ isc_result_t +dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest, + isc_task_t *task, isc_taskaction_t action, void *arg, + isc_uint16_t *idp, dns_dispentry_t **resp, + isc_socketmgr_t *sockmgr); + +isc_result_t dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, isc_task_t *task, isc_taskaction_t action, void *arg, isc_uint16_t *idp, dns_dispentry_t **resp); @@ -339,6 +359,10 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest, * * "resp" be non-NULL and *resp be NULL * + *\li "sockmgr" be NULL or a valid socket manager. If 'disp' has + * the DNS_DISPATCHATTR_EXCLUSIVE attribute, this must not be NULL, + * which also means dns_dispatch_addresponse() cannot be used. + * * Ensures: * * <id, dest> is a unique tuple. That means incoming messages @@ -369,6 +393,8 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, * argument to dns_dispatch_addresponse() when allocating '*resp'. */ +isc_socket_t * +dns_dispatch_getentrysocket(dns_dispentry_t *resp); isc_socket_t * dns_dispatch_getsocket(dns_dispatch_t *disp); @@ -406,6 +432,16 @@ dns_dispatch_cancel(dns_dispatch_t *disp); * disp is valid. */ +unsigned int +dns_dispatch_getattributes(dns_dispatch_t *disp); +/* + * Return the attributes (DNS_DISPATCHATTR_xxx) of this dispatch. Only the + * non-changeable attributes are expected to be referenced by the caller. + * + * Requires: + *\li disp is valid. + */ + void dns_dispatch_changeattributes(dns_dispatch_t *disp, unsigned int attributes, unsigned int mask); diff --git a/lib/dns/journal.c b/lib/dns/journal.c index b7e81f7ccec7..910e01ed44bd 100644 --- a/lib/dns/journal.c +++ b/lib/dns/journal.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: journal.c,v 1.77.2.1.10.22 2007/09/07 05:25:37 marka Exp $ */ +/* $Id: journal.c,v 1.77.2.1.10.24 2008/09/25 04:01:06 tbox Exp $ */ #include <config.h> @@ -71,7 +71,7 @@ static isc_boolean_t bind8_compat = ISC_TRUE; /* XXX config */ } while (0) #define CHECK(op) \ - do { result = (op); \ + do { result = (op); \ if (result != ISC_R_SUCCESS) goto failure; \ } while (0) @@ -113,11 +113,11 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx, dns_rdataset_init(&rdataset); result = dns_db_findrdataset(db, node, ver, dns_rdatatype_soa, 0, (isc_stdtime_t)0, &rdataset, NULL); - if (result != ISC_R_SUCCESS) + if (result != ISC_R_SUCCESS) goto freenode; result = dns_rdataset_first(&rdataset); - if (result != ISC_R_SUCCESS) + if (result != ISC_R_SUCCESS) goto freenode; dns_rdataset_current(&rdataset, &rdata); @@ -680,7 +680,7 @@ dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write, int namelen; char backup[1024]; size_t n; - + result = journal_open(mctx, filename, write, write, journalp); if (result == ISC_R_NOTFOUND) { namelen = strlen(filename); @@ -1372,7 +1372,7 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) { if (result != ISC_R_SUCCESS) { isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR, "journal open failure: %s: %s", - isc_result_totext(result), j->filename); + isc_result_totext(result), filename); return (result); } @@ -1410,9 +1410,9 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) { if (n_soa == 3) n_soa = 1; if (n_soa == 0) { - isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR, - "%s: journal file corrupt: missing " - "initial SOA", j->filename); + isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR, + "%s: journal file corrupt: missing " + "initial SOA", j->filename); FAIL(ISC_R_UNEXPECTED); } CHECK(dns_difftuple_create(diff.mctx, n_soa == 1 ? @@ -1988,7 +1988,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, dns_journal_destroy(&j); return (ISC_R_SUCCESS); } - + if (DNS_SERIAL_GT(j->header.begin.serial, serial) || DNS_SERIAL_GT(serial, j->header.end.serial)) { dns_journal_destroy(&j); @@ -2012,7 +2012,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, } CHECK(journal_open(mctx, newname, ISC_TRUE, ISC_TRUE, &new)); - + /* * Remove overhead so space test below can succeed. */ @@ -2070,7 +2070,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, result = ISC_R_NOMEMORY; goto failure; } - + CHECK(journal_seek(j, best_guess.offset)); CHECK(journal_seek(new, indexend)); for (i = 0; i < copy_length; i += size) { @@ -2143,7 +2143,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial, goto failure; } } - + dns_journal_destroy(&j); result = ISC_R_SUCCESS; diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c index 0f4716d583d9..ed0834ac574d 100644 --- a/lib/dns/masterdump.c +++ b/lib/dns/masterdump.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: masterdump.c,v 1.56.2.5.2.15 2006/03/10 00:17:21 marka Exp $ */ +/* $Id: masterdump.c,v 1.56.2.5.2.17 2008/08/13 23:45:33 tbox Exp $ */ #include <config.h> @@ -173,7 +173,7 @@ struct dns_dumpctx { char *tmpfile; }; -#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) +#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) /* * Output tabs and spaces to go from column '*current' to @@ -920,13 +920,13 @@ dns_dumpctx_detach(dns_dumpctx_t **dctxp) { dns_dbversion_t * dns_dumpctx_version(dns_dumpctx_t *dctx) { - REQUIRE(DNS_DCTX_VALID(dctx)); + REQUIRE(DNS_DCTX_VALID(dctx)); return (dctx->version); } dns_db_t * dns_dumpctx_db(dns_dumpctx_t *dctx) { - REQUIRE(DNS_DCTX_VALID(dctx)); + REQUIRE(DNS_DCTX_VALID(dctx)); return (dctx->db); } @@ -1159,13 +1159,12 @@ dumptostreaminc(dns_dumpctx_t *dctx) { result = dns_dbiterator_next(dctx->dbiter); } - if (dctx->nodes != 0 && result == ISC_R_SUCCESS) { - result = dns_dbiterator_pause(dctx->dbiter); - RUNTIME_CHECK(result == ISC_R_SUCCESS); + if (dctx->nodes != 0 && result == ISC_R_SUCCESS) result = DNS_R_CONTINUE; - } else if (result == ISC_R_NOMORE) + else if (result == ISC_R_NOMORE) result = ISC_R_SUCCESS; fail: + RUNTIME_CHECK(dns_dbiterator_pause(dctx->dbiter) == ISC_R_SUCCESS); isc_mem_put(dctx->mctx, buffer.base, buffer.length); return (result); } @@ -1419,10 +1418,10 @@ dns_master_dumpnode(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version, isc_result_t dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags, - unsigned int ttl_column, unsigned int class_column, - unsigned int type_column, unsigned int rdata_column, - unsigned int line_length, unsigned int tab_width, - isc_mem_t *mctx) + unsigned int ttl_column, unsigned int class_column, + unsigned int type_column, unsigned int rdata_column, + unsigned int line_length, unsigned int tab_width, + isc_mem_t *mctx) { dns_master_style_t *style; diff --git a/lib/dns/message.c b/lib/dns/message.c index 915f58787154..5eacad02f928 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: message.c,v 1.194.2.10.2.28.4.2 2008/07/28 23:47:49 tbox Exp $ */ +/* $Id: message.c,v 1.194.2.10.2.30 2008/07/28 23:45:48 tbox Exp $ */ /*** *** Imports diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c index df731e45a47d..fbfcfbad35ad 100644 --- a/lib/dns/openssldsa_link.c +++ b/lib/dns/openssldsa_link.c @@ -16,7 +16,7 @@ * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: openssldsa_link.c,v 1.1.4.7 2007/08/28 07:19:13 tbox Exp $ */ +/* $Id: openssldsa_link.c,v 1.1.4.8 2008/12/24 00:21:45 marka Exp $ */ #ifdef OPENSSL @@ -133,7 +133,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) { status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa); DSA_SIG_free(dsasig); - if (status == 0) + if (status != 1) return (dst__openssl_toresult(DST_R_VERIFYFAILURE)); return (ISC_R_SUCCESS); diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c index c33913ce3d07..765d9ed2a575 100644 --- a/lib/dns/opensslrsa_link.c +++ b/lib/dns/opensslrsa_link.c @@ -17,7 +17,7 @@ /* * Principal Author: Brian Wellington - * $Id: opensslrsa_link.c,v 1.1.4.9 2006/11/07 21:28:40 marka Exp $ + * $Id: opensslrsa_link.c,v 1.1.4.10 2008/12/24 00:21:45 marka Exp $ */ #ifdef OPENSSL @@ -246,7 +246,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { status = RSA_verify(type, digest, digestlen, sig->base, RSA_size(rsa), rsa); - if (status == 0) + if (status != 1) return (dst__openssl_toresult(DST_R_VERIFYFAILURE)); return (ISC_R_SUCCESS); diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c index 46c317d262bc..14d5ea73849f 100644 --- a/lib/dns/rbt.c +++ b/lib/dns/rbt.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rbt.c,v 1.115.2.2.2.17 2008/04/03 00:17:07 each Exp $ */ +/* $Id: rbt.c,v 1.115.2.2.2.18 2008/04/18 19:03:00 each Exp $ */ /* Principal Authors: DCL */ @@ -2048,10 +2048,6 @@ dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, node = LEFT(node); goto traverse; } - if (RIGHT(node) != NULL) { - node = RIGHT(node); - goto traverse; - } if (DOWN(node) != NULL) { node = DOWN(node); goto traverse; @@ -2068,14 +2064,15 @@ dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, node->magic = 0; #endif parent = PARENT(node); + if (RIGHT(node) != NULL) + PARENT(RIGHT(node)) = parent; if (parent != NULL) { if (LEFT(parent) == node) - LEFT(parent) = NULL; + LEFT(parent) = RIGHT(node); else if (DOWN(parent) == node) - DOWN(parent) = NULL; - else if (RIGHT(parent) == node) - RIGHT(parent) = NULL; - } + DOWN(parent) = RIGHT(node); + } else + parent = RIGHT(node); isc_mem_put(rbt->mctx, node, NODE_SIZE(node)); rbt->nodecount--; node = parent; diff --git a/lib/dns/rdata/generic/nsec_47.c b/lib/dns/rdata/generic/nsec_47.c index 74b7806c7e11..307cac89e081 100644 --- a/lib/dns/rdata/generic/nsec_47.c +++ b/lib/dns/rdata/generic/nsec_47.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,11 +15,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nsec_47.c,v 1.7.2.1 2004/03/08 02:08:03 marka Exp $ */ +/* $Id: nsec_47.c,v 1.7.2.3 2008/07/15 23:45:44 tbox Exp $ */ /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */ -/* draft-ietf-dnsext-nsec-rdata-01.txt */ +/* RFC 3845 */ #ifndef RDATA_GENERIC_NSEC_47_C #define RDATA_GENERIC_NSEC_47_C @@ -255,7 +255,7 @@ fromstruct_nsec(ARGS_FROMSTRUCT) { window = nsec->typebits[i]; len = nsec->typebits[i+1]; i += 2; - INSIST(first || window > lastwindow); + INSIST(first || window > lastwindow); INSIST(len > 0 && len <= 32); INSIST(i + len <= nsec->len); INSIST(nsec->typebits[i + len - 1] != 0); diff --git a/lib/dns/rdata/generic/nsec_47.h b/lib/dns/rdata/generic/nsec_47.h index d76a25cc43db..0070bfc6e456 100644 --- a/lib/dns/rdata/generic/nsec_47.h +++ b/lib/dns/rdata/generic/nsec_47.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -18,9 +18,10 @@ #ifndef GENERIC_NSEC_47_H #define GENERIC_NSEC_47_H 1 -/* $Id: nsec_47.h,v 1.4.2.1 2004/03/08 02:08:03 marka Exp $ */ +/* $Id: nsec_47.h,v 1.4.2.3 2008/07/15 23:45:44 tbox Exp $ */ -/* draft-ietf-dnsext-nsec-rdata-01.txt */ +/*! + * \brief Per RFC 3845 */ typedef struct dns_rdata_nsec { dns_rdatacommon_t common; diff --git a/lib/dns/rdata/generic/txt_16.c b/lib/dns/rdata/generic/txt_16.c index 625fa2be8e7c..eb511ba859f5 100644 --- a/lib/dns/rdata/generic/txt_16.c +++ b/lib/dns/rdata/generic/txt_16.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: txt_16.c,v 1.37.12.7 2007/08/28 07:19:15 tbox Exp $ */ +/* $Id: txt_16.c,v 1.37.12.9 2008/04/28 23:45:37 tbox Exp $ */ /* Reviewed: Thu Mar 16 15:40:00 PST 2000 by bwelling */ @@ -142,7 +142,7 @@ fromstruct_txt(ARGS_FROMSTRUCT) { while (region.length > 0) { length = uint8_fromregion(®ion); isc_region_consume(®ion, 1); - if (region.length <= length) + if (region.length < length) return (ISC_R_UNEXPECTEDEND); isc_region_consume(®ion, length); } diff --git a/lib/dns/rdata/in_1/naptr_35.c b/lib/dns/rdata/in_1/naptr_35.c index f3c93c7c03d9..fc6ee8cad9d1 100644 --- a/lib/dns/rdata/in_1/naptr_35.c +++ b/lib/dns/rdata/in_1/naptr_35.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: naptr_35.c,v 1.43.2.1.2.3 2004/03/06 08:14:17 marka Exp $ */ +/* $Id: naptr_35.c,v 1.43.2.1.2.5 2008/04/28 23:45:37 tbox Exp $ */ /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */ @@ -154,7 +154,7 @@ totext_in_naptr(ARGS_TOTEXT) { static inline isc_result_t fromwire_in_naptr(ARGS_FROMWIRE) { - dns_name_t name; + dns_name_t name; isc_region_t sr; REQUIRE(type == 35); @@ -165,7 +165,7 @@ fromwire_in_naptr(ARGS_FROMWIRE) { dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE); - dns_name_init(&name, NULL); + dns_name_init(&name, NULL); /* * Order, preference. @@ -321,8 +321,8 @@ fromstruct_in_naptr(ARGS_FROMSTRUCT) { REQUIRE(naptr->common.rdtype == type); REQUIRE(naptr->common.rdclass == rdclass); REQUIRE(naptr->flags != NULL || naptr->flags_len == 0); - REQUIRE(naptr->service != NULL && naptr->service_len == 0); - REQUIRE(naptr->regexp != NULL && naptr->regexp_len == 0); + REQUIRE(naptr->service != NULL || naptr->service_len == 0); + REQUIRE(naptr->regexp != NULL || naptr->regexp_len == 0); UNUSED(type); UNUSED(rdclass); diff --git a/lib/dns/request.c b/lib/dns/request.c index 6fe7b114ab04..cbc6714af454 100644 --- a/lib/dns/request.c +++ b/lib/dns/request.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: request.c,v 1.64.2.1.10.12.4.2 2008/07/23 07:28:11 tbox Exp $ */ +/* $Id: request.c,v 1.64.2.1.10.15 2008/07/22 04:00:37 marka Exp $ */ #include <config.h> @@ -119,6 +119,7 @@ static isc_result_t req_render(dns_message_t *message, isc_buffer_t **buffer, static void req_senddone(isc_task_t *task, isc_event_t *event); static void req_response(isc_task_t *task, isc_event_t *event); static void req_timeout(isc_task_t *task, isc_event_t *event); +static isc_socket_t * req_getsocket(dns_request_t *request); static void req_connected(isc_task_t *task, isc_event_t *event); static void req_sendevent(dns_request_t *request, isc_result_t result); static void req_cancel(dns_request_t *request); @@ -144,6 +145,7 @@ dns_requestmgr_create(isc_mem_t *mctx, isc_socket_t *socket; isc_result_t result; int i; + unsigned int dispattr; req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_create"); @@ -152,13 +154,14 @@ dns_requestmgr_create(isc_mem_t *mctx, REQUIRE(socketmgr != NULL); REQUIRE(taskmgr != NULL); REQUIRE(dispatchmgr != NULL); + UNUSED(socket); if (dispatchv4 != NULL) { - socket = dns_dispatch_getsocket(dispatchv4); - REQUIRE(isc_socket_gettype(socket) == isc_sockettype_udp); + dispattr = dns_dispatch_getattributes(dispatchv4); + REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0); } if (dispatchv6 != NULL) { - socket = dns_dispatch_getsocket(dispatchv6); - REQUIRE(isc_socket_gettype(socket) == isc_sockettype_udp); + dispattr = dns_dispatch_getattributes(dispatchv6); + REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0); } requestmgr = isc_mem_get(mctx, sizeof(*requestmgr)); @@ -423,12 +426,19 @@ req_send(dns_request_t *request, isc_task_t *task, isc_sockaddr_t *address) { isc_region_t r; isc_socket_t *socket; isc_result_t result; + unsigned int dispattr; req_log(ISC_LOG_DEBUG(3), "req_send: request %p", request); REQUIRE(VALID_REQUEST(request)); - socket = dns_dispatch_getsocket(request->dispatch); + dispattr = dns_dispatch_getattributes(request->dispatch); + socket = req_getsocket(request); isc_buffer_usedregion(request->query, &r); + /* + * We could connect the socket when we are using an exclusive dispatch + * as we do in resolver.c, but we prefer implementation simplicity + * at this moment. + */ result = isc_socket_sendto(socket, &r, task, req_senddone, request, address, NULL); if (result == ISC_R_SUCCESS) @@ -740,14 +750,16 @@ dns_request_createraw3(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf, if (result != ISC_R_SUCCESS) goto cleanup; - socket = dns_dispatch_getsocket(request->dispatch); - INSIST(socket != NULL); - result = dns_dispatch_addresponse(request->dispatch, destaddr, task, - req_response, request, &id, - &request->dispentry); + result = dns_dispatch_addresponse2(request->dispatch, destaddr, task, + req_response, request, &id, + &request->dispentry, + requestmgr->socketmgr); if (result != ISC_R_SUCCESS) goto cleanup; + socket = req_getsocket(request); + INSIST(socket != NULL); + result = isc_buffer_allocate(mctx, &request->query, r.length + (tcp ? 2 : 0)); if (result != ISC_R_SUCCESS) @@ -933,13 +945,14 @@ dns_request_createvia3(dns_requestmgr_t *requestmgr, dns_message_t *message, if (result != ISC_R_SUCCESS) goto cleanup; - socket = dns_dispatch_getsocket(request->dispatch); - INSIST(socket != NULL); - result = dns_dispatch_addresponse(request->dispatch, destaddr, task, - req_response, request, &id, - &request->dispentry); + result = dns_dispatch_addresponse2(request->dispatch, destaddr, task, + req_response, request, &id, + &request->dispentry, + requestmgr->socketmgr); if (result != ISC_R_SUCCESS) goto cleanup; + socket = req_getsocket(request); + INSIST(socket != NULL); message->id = id; if (setkey) { @@ -1224,6 +1237,21 @@ dns_request_destroy(dns_request_t **requestp) { *** Private: request. ***/ +static isc_socket_t * +req_getsocket(dns_request_t *request) { + unsigned int dispattr; + isc_socket_t *socket; + + dispattr = dns_dispatch_getattributes(request->dispatch); + if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) { + INSIST(request->dispentry != NULL); + socket = dns_dispatch_getentrysocket(request->dispentry); + } else + socket = dns_dispatch_getsocket(request->dispatch); + + return (socket); +} + static void req_connected(isc_task_t *task, isc_event_t *event) { isc_socketevent_t *sevent = (isc_socketevent_t *)event; @@ -1423,6 +1451,7 @@ req_destroy(dns_request_t *request) { static void req_cancel(dns_request_t *request) { isc_socket_t *socket; + unsigned int dispattr; REQUIRE(VALID_REQUEST(request)); @@ -1435,16 +1464,23 @@ req_cancel(dns_request_t *request) { if (request->timer != NULL) isc_timer_detach(&request->timer); + dispattr = dns_dispatch_getattributes(request->dispatch); + socket = NULL; + if (DNS_REQUEST_CONNECTING(request) || DNS_REQUEST_SENDING(request)) { + if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) { + if (request->dispentry != NULL) { + socket = dns_dispatch_getentrysocket( + request->dispentry); + } + } else + socket = dns_dispatch_getsocket(request->dispatch); + if (DNS_REQUEST_CONNECTING(request) && socket != NULL) + isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_CONNECT); + if (DNS_REQUEST_SENDING(request) && socket != NULL) + isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND); + } if (request->dispentry != NULL) dns_dispatch_removeresponse(&request->dispentry, NULL); - if (DNS_REQUEST_CONNECTING(request)) { - socket = dns_dispatch_getsocket(request->dispatch); - isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_CONNECT); - } - if (DNS_REQUEST_SENDING(request)) { - socket = dns_dispatch_getsocket(request->dispatch); - isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND); - } dns_dispatch_detach(&request->dispatch); } diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 602dcf5f9632..3a02ba798e73 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resolver.c,v 1.218.2.18.4.77.2.3 2008/07/24 05:00:46 jinmei Exp $ */ +/* $Id: resolver.c,v 1.218.2.18.4.85 2008/10/17 22:03:37 jinmei Exp $ */ #include <config.h> @@ -119,6 +119,7 @@ typedef struct query { isc_mem_t * mctx; dns_dispatchmgr_t * dispatchmgr; dns_dispatch_t * dispatch; + isc_boolean_t exclusivesocket; dns_adbaddrinfo_t * addrinfo; isc_socket_t * tcpsocket; isc_time_t start; @@ -301,7 +302,9 @@ struct dns_resolver { unsigned int options; dns_dispatchmgr_t * dispatchmgr; dns_dispatch_t * dispatchv4; + isc_boolean_t exclusivev4; dns_dispatch_t * dispatchv6; + isc_boolean_t exclusivev6; unsigned int nbuckets; fctxbucket_t * buckets; isc_uint32_t lame_ttl; @@ -360,6 +363,8 @@ static isc_result_t ncache_adderesult(dns_message_t *message, isc_result_t *eresultp); static void validated(isc_task_t *task, isc_event_t *event); static void maybe_destroy(fetchctx_t *fctx); +static void add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, + isc_result_t reason); static isc_result_t valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name, @@ -549,6 +554,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp, unsigned int factor; dns_adbfind_t *find; dns_adbaddrinfo_t *addrinfo; + isc_socket_t *socket; query = *queryp; fctx = query->fctx; @@ -631,35 +637,48 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp, 0, factor); } - if (query->dispentry != NULL) - dns_dispatch_removeresponse(&query->dispentry, deventp); - - ISC_LIST_UNLINK(fctx->queries, query, link); - - if (query->tsig != NULL) - isc_buffer_free(&query->tsig); - - if (query->tsigkey != NULL) - dns_tsigkey_detach(&query->tsigkey); - /* * Check for any outstanding socket events. If they exist, cancel * them and let the event handlers finish the cleanup. The resolver * only needs to worry about managing the connect and send events; * the dispatcher manages the recv events. */ - if (RESQUERY_CONNECTING(query)) + if (RESQUERY_CONNECTING(query)) { /* * Cancel the connect. */ - isc_socket_cancel(query->tcpsocket, NULL, - ISC_SOCKCANCEL_CONNECT); - else if (RESQUERY_SENDING(query)) + if (query->tcpsocket != NULL) { + isc_socket_cancel(query->tcpsocket, NULL, + ISC_SOCKCANCEL_CONNECT); + } else if (query->dispentry != NULL) { + INSIST(query->exclusivesocket); + socket = dns_dispatch_getentrysocket(query->dispentry); + if (socket != NULL) + isc_socket_cancel(socket, NULL, + ISC_SOCKCANCEL_CONNECT); + } + } else if (RESQUERY_SENDING(query)) { /* * Cancel the pending send. */ - isc_socket_cancel(dns_dispatch_getsocket(query->dispatch), - NULL, ISC_SOCKCANCEL_SEND); + if (query->exclusivesocket && query->dispentry != NULL) + socket = dns_dispatch_getentrysocket(query->dispentry); + else + socket = dns_dispatch_getsocket(query->dispatch); + if (socket != NULL) + isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND); + } + + if (query->dispentry != NULL) + dns_dispatch_removeresponse(&query->dispentry, deventp); + + ISC_LIST_UNLINK(fctx->queries, query, link); + + if (query->tsig != NULL) + isc_buffer_free(&query->tsig); + + if (query->tsigkey != NULL) + dns_tsigkey_detach(&query->tsigkey); if (query->dispatch != NULL) dns_dispatch_detach(&query->dispatch); @@ -824,43 +843,25 @@ fctx_done(fetchctx_t *fctx, isc_result_t result) { } static void -resquery_senddone(isc_task_t *task, isc_event_t *event) { +process_sendevent(resquery_t *query, isc_event_t *event) { isc_socketevent_t *sevent = (isc_socketevent_t *)event; - resquery_t *query = event->ev_arg; isc_boolean_t retry = ISC_FALSE; isc_result_t result; fetchctx_t *fctx; - REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE); - - QTRACE("senddone"); - - /* - * XXXRTH - * - * Currently we don't wait for the senddone event before retrying - * a query. This means that if we get really behind, we may end - * up doing extra work! - */ - - UNUSED(task); - - INSIST(RESQUERY_SENDING(query)); - - query->sends--; fctx = query->fctx; if (RESQUERY_CANCELED(query)) { - if (query->sends == 0) { + if (query->sends == 0 && query->connects == 0) { /* * This query was canceled while the - * isc_socket_sendto() was in progress. + * isc_socket_sendto/connect() was in progress. */ if (query->tcpsocket != NULL) isc_socket_detach(&query->tcpsocket); resquery_destroy(&query); } - } else + } else { switch (sevent->result) { case ISC_R_SUCCESS: break; @@ -874,6 +875,7 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) { /* * No route to remote. */ + add_bad(fctx, query->addrinfo, sevent->result); fctx_cancelquery(&query, NULL, NULL, ISC_TRUE); retry = ISC_TRUE; break; @@ -882,6 +884,7 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) { fctx_cancelquery(&query, NULL, NULL, ISC_FALSE); break; } + } isc_event_free(&event); @@ -899,6 +902,48 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) { } } +static void +resquery_udpconnected(isc_task_t *task, isc_event_t *event) { + resquery_t *query = event->ev_arg; + + REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT); + + QTRACE("udpconnected"); + + UNUSED(task); + + INSIST(RESQUERY_CONNECTING(query)); + + query->connects--; + + process_sendevent(query, event); +} + +static void +resquery_senddone(isc_task_t *task, isc_event_t *event) { + resquery_t *query = event->ev_arg; + + REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE); + + QTRACE("senddone"); + + /* + * XXXRTH + * + * Currently we don't wait for the senddone event before retrying + * a query. This means that if we get really behind, we may end + * up doing extra work! + */ + + UNUSED(task); + + INSIST(RESQUERY_SENDING(query)); + + query->sends--; + + process_sendevent(query, event); +} + static inline isc_result_t fctx_addopt(dns_message_t *message, dns_resolver_t *res) { dns_rdataset_t *rdataset; @@ -1029,6 +1074,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, */ query->dispatchmgr = res->dispatchmgr; query->dispatch = NULL; + query->exclusivesocket = ISC_FALSE; query->tcpsocket = NULL; if ((query->options & DNS_FETCHOPT_TCP) != 0) { isc_sockaddr_t addr; @@ -1070,50 +1116,21 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, * A dispatch will be created once the connect succeeds. */ } else { - isc_sockaddr_t localaddr; - unsigned int attrs, attrmask; - dns_dispatch_t *disp_base; - - attrs = 0; - attrs |= DNS_DISPATCHATTR_UDP; - attrs |= DNS_DISPATCHATTR_RANDOMPORT; - - attrmask = 0; - attrmask |= DNS_DISPATCHATTR_UDP; - attrmask |= DNS_DISPATCHATTR_TCP; - attrmask |= DNS_DISPATCHATTR_IPV4; - attrmask |= DNS_DISPATCHATTR_IPV6; - switch (isc_sockaddr_pf(&addrinfo->sockaddr)) { - case AF_INET: - disp_base = res->dispatchv4; - attrs |= DNS_DISPATCHATTR_IPV4; + case PF_INET: + dns_dispatch_attach(res->dispatchv4, + &query->dispatch); + query->exclusivesocket = res->exclusivev4; break; - case AF_INET6: - disp_base = res->dispatchv6; - attrs |= DNS_DISPATCHATTR_IPV6; + case PF_INET6: + dns_dispatch_attach(res->dispatchv6, + &query->dispatch); + query->exclusivesocket = res->exclusivev6; break; default: result = ISC_R_NOTIMPLEMENTED; goto cleanup_query; } - - result = dns_dispatch_getlocaladdress(disp_base, &localaddr); - if (result != ISC_R_SUCCESS) - goto cleanup_query; - if (isc_sockaddr_getport(&localaddr) == 0) { - result = dns_dispatch_getudp(res->dispatchmgr, - res->socketmgr, - res->taskmgr, - &localaddr, - 4096, 1000, 32768, - 16411, 16433, - attrs, attrmask, - &query->dispatch); - if (result != ISC_R_SUCCESS) - goto cleanup_query; - } else - dns_dispatch_attach(disp_base, &query->dispatch); /* * We should always have a valid dispatcher here. If we * don't support a protocol family, then its dispatcher @@ -1224,13 +1241,14 @@ resquery_send(resquery_t *query) { /* * Get a query id from the dispatch. */ - result = dns_dispatch_addresponse(query->dispatch, - &query->addrinfo->sockaddr, - task, - resquery_response, - query, - &query->id, - &query->dispentry); + result = dns_dispatch_addresponse2(query->dispatch, + &query->addrinfo->sockaddr, + task, + resquery_response, + query, + &query->id, + &query->dispentry, + res->socketmgr); if (result != ISC_R_SUCCESS) goto cleanup_temps; @@ -1412,12 +1430,24 @@ resquery_send(resquery_t *query) { */ dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER); - socket = dns_dispatch_getsocket(query->dispatch); + if (query->exclusivesocket) + socket = dns_dispatch_getentrysocket(query->dispentry); + else + socket = dns_dispatch_getsocket(query->dispatch); /* * Send the query! */ - if ((query->options & DNS_FETCHOPT_TCP) == 0) + if ((query->options & DNS_FETCHOPT_TCP) == 0) { address = &query->addrinfo->sockaddr; + if (query->exclusivesocket) { + result = isc_socket_connect(socket, address, task, + resquery_udpconnected, + query); + if (result != ISC_R_SUCCESS) + goto cleanup_message; + query->connects++; + } + } isc_buffer_usedregion(buffer, &r); /* @@ -1740,7 +1770,7 @@ add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_result_t reason) { return; if (reason == DNS_R_UNEXPECTEDRCODE && - fctx->rmessage->opcode == dns_rcode_servfail && + fctx->rmessage->rcode == dns_rcode_servfail && ISFORWARDER(addrinfo)) return; @@ -2026,6 +2056,13 @@ fctx_getaddresses(fetchctx_t *fctx) { } while (sa != NULL) { + if ((isc_sockaddr_pf(sa) == AF_INET && + fctx->res->dispatchv4 == NULL) || + (isc_sockaddr_pf(sa) == AF_INET6 && + fctx->res->dispatchv6 == NULL)) { + sa = ISC_LIST_NEXT(sa, link); + continue; + } ai = NULL; result = dns_adb_findaddrinfo(fctx->adb, sa, &ai, 0); /* XXXMLG */ @@ -5315,6 +5352,19 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * There's no hope for this query. */ keep_trying = ISC_TRUE; + + /* + * If this is a network error on an exclusive query + * socket, mark the server as bad so that we won't try + * it for this fetch again. + */ + if (query->exclusivesocket && + (devent->result == ISC_R_HOSTUNREACH || + devent->result == ISC_R_NETUNREACH || + devent->result == ISC_R_CONNREFUSED || + devent->result == ISC_R_CANCELED)) { + broken_server = devent->result; + } } goto done; } @@ -5465,12 +5515,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) { */ if (message->rcode != dns_rcode_noerror && message->rcode != dns_rcode_nxdomain) { - if ((message->rcode == dns_rcode_formerr || - message->rcode == dns_rcode_notimp || - message->rcode == dns_rcode_servfail) && + if (((message->rcode == dns_rcode_formerr || + message->rcode == dns_rcode_notimp) || + (message->rcode == dns_rcode_servfail && + dns_message_getopt(message) == NULL)) && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { /* * It's very likely they don't like EDNS0. + * If the response code is SERVFAIL, also check if the + * response contains an OPT RR and don't cache the + * failure since it can be returned for various other + * reasons. * * XXXRTH We should check if the question * we're asking requires EDNS0, and @@ -5936,6 +5991,7 @@ dns_resolver_create(dns_view_t *view, isc_result_t result = ISC_R_SUCCESS; unsigned int i, buckets_created = 0; char name[16]; + unsigned dispattr; /* * Create a resolver. @@ -5991,11 +6047,20 @@ dns_resolver_create(dns_view_t *view, } res->dispatchv4 = NULL; - if (dispatchv4 != NULL) + if (dispatchv4 != NULL) { dns_dispatch_attach(dispatchv4, &res->dispatchv4); + dispattr = dns_dispatch_getattributes(dispatchv4); + res->exclusivev4 = + ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0); + } + res->dispatchv6 = NULL; - if (dispatchv6 != NULL) + if (dispatchv6 != NULL) { dns_dispatch_attach(dispatchv6, &res->dispatchv6); + dispattr = dns_dispatch_getattributes(dispatchv6); + res->exclusivev6 = + ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0); + } res->references = 1; res->exiting = ISC_FALSE; @@ -6253,12 +6318,12 @@ dns_resolver_shutdown(dns_resolver_t *res) { fctx != NULL; fctx = ISC_LIST_NEXT(fctx, link)) fctx_shutdown(fctx); - if (res->dispatchv4 != NULL) { + if (res->dispatchv4 != NULL && !res->exclusivev4) { sock = dns_dispatch_getsocket(res->dispatchv4); isc_socket_cancel(sock, res->buckets[i].task, ISC_SOCKCANCEL_ALL); } - if (res->dispatchv6 != NULL) { + if (res->dispatchv6 != NULL && !res->exclusivev6) { sock = dns_dispatch_getsocket(res->dispatchv6); isc_socket_cancel(sock, res->buckets[i].task, ISC_SOCKCANCEL_ALL); diff --git a/lib/dns/validator.c b/lib/dns/validator.c index a32892f3b7d6..7c7aae1f17ec 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.c,v 1.91.2.5.8.40 2008/02/19 17:10:55 each Exp $ */ +/* $Id: validator.c,v 1.91.2.5.8.41 2008/08/21 04:59:16 marka Exp $ */ #include <config.h> @@ -974,6 +974,7 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) { } else if (result != ISC_R_SUCCESS && result != DNS_R_NCACHENXDOMAIN && result != DNS_R_NCACHENXRRSET && + result != DNS_R_EMPTYNAME && result != DNS_R_NXRRSET && result != ISC_R_NOTFOUND) { goto notfound; @@ -1231,6 +1232,7 @@ get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) { return (DNS_R_WAIT); } else if (result == DNS_R_NCACHENXDOMAIN || result == DNS_R_NCACHENXRRSET || + result == DNS_R_EMPTYNAME || result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) { @@ -1791,8 +1793,9 @@ validatezonekey(dns_validator_t *val) { if (result != ISC_R_SUCCESS) return (result); return (DNS_R_WAIT); - } else if (result == DNS_R_NCACHENXDOMAIN || + } else if (result == DNS_R_NCACHENXDOMAIN || result == DNS_R_NCACHENXRRSET || + result == DNS_R_EMPTYNAME || result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) { @@ -2420,6 +2423,7 @@ finddlvsep(dns_validator_t *val, isc_boolean_t resume) { } if (result != DNS_R_NXRRSET && result != DNS_R_NXDOMAIN && + result != DNS_R_EMPTYNAME && result != DNS_R_NCACHENXRRSET && result != DNS_R_NCACHENXDOMAIN) return (result); diff --git a/lib/dns/view.c b/lib/dns/view.c index 90b7e938b3cb..21effb6284a9 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: view.c,v 1.103.2.5.2.17 2007/08/28 07:19:14 tbox Exp $ */ +/* $Id: view.c,v 1.103.2.5.2.19 2008/06/17 23:45:32 tbox Exp $ */ #include <config.h> @@ -298,7 +298,7 @@ destroy(dns_view_t *view) { name = ISC_LIST_HEAD(view->rootexclude[i]); while (name != NULL) { ISC_LIST_UNLINK(view->rootexclude[i], - name, link); + name, link); dns_name_free(name, view->mctx); isc_mem_put(view->mctx, name, sizeof(*name)); name = ISC_LIST_HEAD(view->rootexclude[i]); @@ -822,17 +822,6 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, } cleanup: - if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) { - /* - * We don't care about any DNSSEC proof data in these cases. - */ - if (dns_rdataset_isassociated(rdataset)) - dns_rdataset_disassociate(rdataset); - if (sigrdataset != NULL && - dns_rdataset_isassociated(sigrdataset)) - dns_rdataset_disassociate(sigrdataset); - } - if (dns_rdataset_isassociated(&zrdataset)) { dns_rdataset_disassociate(&zrdataset); if (dns_rdataset_isassociated(&zsigrdataset)) @@ -912,7 +901,7 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, isc_result_t dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname, isc_stdtime_t now, unsigned int options, - isc_boolean_t use_hints, + isc_boolean_t use_hints, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) { return(dns_view_findzonecut2(view, name, fname, now, options, @@ -1320,7 +1309,7 @@ dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name) { return (ISC_TRUE); } -void +void dns_view_setrootdelonly(dns_view_t *view, isc_boolean_t value) { REQUIRE(DNS_VIEW_VALID(view)); view->rootdelonly = value; diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index 0e7a487b1057..ca2d8570d49e 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: xfrin.c,v 1.124.2.4.2.21.4.5 2008/07/28 23:47:49 tbox Exp $ */ +/* $Id: xfrin.c,v 1.124.2.4.2.28 2008/09/25 04:16:12 marka Exp $ */ #include <config.h> @@ -424,6 +424,10 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, isc_uint32_t ttl, { isc_result_t result; + if (rdata->type == dns_rdatatype_none || + dns_rdatatype_ismeta(rdata->type)) + FAIL(DNS_R_FORMERR); + redo: switch (xfr->state) { case XFRST_SOAQUERY: diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in index 7e53510c507d..78a820d767aa 100644 --- a/lib/isc/Makefile.in +++ b/lib/isc/Makefile.in @@ -1,7 +1,7 @@ -# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # -# Permission to use, copy, modify, and distribute this software for any +# Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.71.2.2.2.8 2004/07/20 07:01:58 marka Exp $ +# $Id: Makefile.in,v 1.71.2.2.2.10 2008/06/25 23:45:37 tbox Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -55,7 +55,7 @@ OBJS = @ISC_EXTRA_OBJS@ \ hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ \ lex.@O@ lfsr.@O@ lib.@O@ log.@O@ md5.@O@ \ mem.@O@ mutexblock.@O@ netaddr.@O@ netscope.@O@ ondestroy.@O@ \ - parseint.@O@ quota.@O@ random.@O@ \ + parseint.@O@ portset.@O@ quota.@O@ random.@O@ \ ratelimiter.@O@ region.@O@ result.@O@ rwlock.@O@ \ serial.@O@ sha1.@O@ sockaddr.@O@ string.@O@ strtoul.@O@ \ symtab.@O@ task.@O@ taskpool.@O@ timer.@O@ version.@O@ \ @@ -68,7 +68,7 @@ SRCS = @ISC_EXTRA_SRCS@ \ heap.c hex.c hmacmd5.c \ lex.c lfsr.c lib.c log.c \ md5.c mem.c mutexblock.c netaddr.c netscope.c ondestroy.c \ - parseint.c quota.c random.c \ + parseint.c portset.c quota.c random.c \ ratelimiter.c result.c rwlock.c \ serial.c sha1.c sockaddr.c string.c strtoul.c symtab.c \ task.c taskpool.c timer.c version.c diff --git a/lib/isc/api b/lib/isc/api index a8be9070823b..00b7f9242ef5 100644 --- a/lib/isc/api +++ b/lib/isc/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 14 -LIBREVISION = 0 +LIBINTERFACE = 15 +LIBREVISION = 2 LIBAGE = 0 diff --git a/lib/isc/assertions.c b/lib/isc/assertions.c index 94c6732fd8bd..ce4ea83c850a 100644 --- a/lib/isc/assertions.c +++ b/lib/isc/assertions.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2001 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: assertions.c,v 1.16.206.1 2004/03/06 08:14:27 marka Exp $ */ +/* $Id: assertions.c,v 1.16.206.3 2008/10/15 23:45:34 tbox Exp $ */ #include <config.h> @@ -28,7 +28,7 @@ /* * Forward. */ - +/* coverity[+kill] */ static void default_callback(const char *, int, isc_assertiontype_t, const char *); diff --git a/lib/isc/include/isc/assertions.h b/lib/isc/include/isc/assertions.h index 6091de9a6338..b6f68a6dfd5b 100644 --- a/lib/isc/include/isc/assertions.h +++ b/lib/isc/include/isc/assertions.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2001 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -16,7 +16,7 @@ */ /* - * $Id: assertions.h,v 1.17.206.1 2004/03/06 08:14:38 marka Exp $ + * $Id: assertions.h,v 1.17.206.3 2008/10/15 23:45:34 tbox Exp $ */ #ifndef ISC_ASSERTIONS_H @@ -37,6 +37,7 @@ typedef enum { typedef void (*isc_assertioncallback_t)(const char *, int, isc_assertiontype_t, const char *); +/* coverity[+kill] */ LIBISC_EXTERNAL_DATA extern isc_assertioncallback_t isc_assertion_failed; void @@ -45,14 +46,14 @@ isc_assertion_setcallback(isc_assertioncallback_t); const char * isc_assertion_typetotext(isc_assertiontype_t type); -#ifdef ISC_CHECK_ALL +#if defined(ISC_CHECK_ALL) || defined(__COVERITY__) #define ISC_CHECK_REQUIRE 1 #define ISC_CHECK_ENSURE 1 #define ISC_CHECK_INSIST 1 #define ISC_CHECK_INVARIANT 1 #endif -#ifdef ISC_CHECK_NONE +#if defined(ISC_CHECK_NONE) && !defined(__COVERITY__) #define ISC_CHECK_REQUIRE 0 #define ISC_CHECK_ENSURE 0 #define ISC_CHECK_INSIST 0 diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h index bb94f5236b57..979407d89c1c 100644 --- a/lib/isc/include/isc/mem.h +++ b/lib/isc/include/isc/mem.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: mem.h,v 1.54.12.7 2007/08/28 07:19:15 tbox Exp $ */ +/* $Id: mem.h,v 1.54.12.9 2008/04/28 23:45:38 tbox Exp $ */ #ifndef ISC_MEM_H #define ISC_MEM_H 1 @@ -170,11 +170,11 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging; #define isc_mempool_put(c, p) isc__mempool_put((c), (p) _ISC_MEM_FILELINE) #endif -isc_result_t +isc_result_t isc_mem_create(size_t max_size, size_t target_size, isc_mem_t **mctxp); -isc_result_t +isc_result_t isc_mem_createx(size_t max_size, size_t target_size, isc_memalloc_t memalloc, isc_memfree_t memfree, void *arg, isc_mem_t **mctxp); @@ -203,9 +203,9 @@ isc_mem_createx(size_t max_size, size_t target_size, * Requires: * mctxp != NULL && *mctxp == NULL */ -void +void isc_mem_attach(isc_mem_t *, isc_mem_t **); -void +void isc_mem_detach(isc_mem_t **); /* * Attach to / detach from a memory context. @@ -213,20 +213,20 @@ isc_mem_detach(isc_mem_t **); * This is intended for applications that use multiple memory contexts * in such a way that it is not obvious when the last allocations from * a given context has been freed and destroying the context is safe. - * + * * Most applications do not need to call these functions as they can * simply create a single memory context at the beginning of main() * and destroy it at the end of main(), thereby guaranteeing that it * is not destroyed while there are outstanding allocations. */ -void +void isc_mem_destroy(isc_mem_t **); /* * Destroy a memory context. */ -isc_result_t +isc_result_t isc_mem_ondestroy(isc_mem_t *ctx, isc_task_t *task, isc_event_t **event); @@ -235,13 +235,13 @@ isc_mem_ondestroy(isc_mem_t *ctx, * been successfully destroyed. */ -void +void isc_mem_stats(isc_mem_t *mctx, FILE *out); /* * Print memory usage statistics for 'mctx' on the stream 'out'. */ -void +void isc_mem_setdestroycheck(isc_mem_t *mctx, isc_boolean_t on); /* @@ -249,9 +249,9 @@ isc_mem_setdestroycheck(isc_mem_t *mctx, * destroyed and abort the program if any are present. */ -void +void isc_mem_setquota(isc_mem_t *, size_t); -size_t +size_t isc_mem_getquota(isc_mem_t *); /* * Set/get the memory quota of 'mctx'. This is a hard limit @@ -259,7 +259,7 @@ isc_mem_getquota(isc_mem_t *); * if it is exceeded, allocations will fail. */ -size_t +size_t isc_mem_inuse(isc_mem_t *mctx); /* * Get an estimate of the number of memory in use in 'mctx', in bytes. @@ -271,10 +271,28 @@ void isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg, size_t hiwater, size_t lowater); /* - * Set high and low water marks for this memory context. When the memory - * usage of 'mctx' exceeds 'hiwater', '(water)(water_arg, ISC_MEM_HIWATER)' - * will be called. When the usage drops below 'lowater', 'water' will - * again be called, this time with ISC_MEM_LOWATER. + * Set high and low water marks for this memory context. + * When the memory usage of 'mctx' exceeds 'hiwater', + * '(water)(water_arg, #ISC_MEM_HIWATER)' will be called. 'water' needs to + * call isc_mem_waterack() with #ISC_MEM_HIWATER to acknowlege the state + * change. 'water' may be called multiple times. + * + * When the usage drops below 'lowater', 'water' will again be called, this + * time with #ISC_MEM_LOWATER. 'water' need to calls isc_mem_waterack() with + * #ISC_MEM_LOWATER to acknowlege the change. + * + * static void + * water(void *arg, int mark) { + * struct foo *foo = arg; + * + * LOCK(&foo->marklock); + * if (foo->mark != mark) { + * foo->mark = mark; + * .... + * isc_mem_waterack(foo->mctx, mark); + * } + * UNLOCK(&foo->marklock); + * } * * If 'water' is NULL then 'water_arg', 'hi_water' and 'lo_water' are * ignored and the state is reset. @@ -285,6 +303,12 @@ isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg, * hi_water >= lo_water */ +void +isc_mem_waterack(isc_mem_t *ctx, int mark); +/*%< + * Called to acknowledge changes in signalled by calls to 'water'. + */ + /* * Memory pools */ @@ -429,22 +453,22 @@ isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit); /* * Pseudo-private functions for use via macros. Do not call directly. */ -void * +void * isc__mem_get(isc_mem_t *, size_t _ISC_MEM_FLARG); -void +void isc__mem_putanddetach(isc_mem_t **, void *, size_t _ISC_MEM_FLARG); -void +void isc__mem_put(isc_mem_t *, void *, size_t _ISC_MEM_FLARG); -void * +void * isc__mem_allocate(isc_mem_t *, size_t _ISC_MEM_FLARG); -void +void isc__mem_free(isc_mem_t *, void * _ISC_MEM_FLARG); -char * +char * isc__mem_strdup(isc_mem_t *, const char *_ISC_MEM_FLARG); -void * +void * isc__mempool_get(isc_mempool_t * _ISC_MEM_FLARG); -void +void isc__mempool_put(isc_mempool_t *, void * _ISC_MEM_FLARG); ISC_LANG_ENDDECLS diff --git a/lib/isc/include/isc/msgs.h b/lib/isc/include/isc/msgs.h index 967005bf3531..584edcbd881c 100644 --- a/lib/isc/include/isc/msgs.h +++ b/lib/isc/include/isc/msgs.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: msgs.h,v 1.5.2.2.8.3 2004/03/06 08:14:44 marka Exp $ */ +/* $Id: msgs.h,v 1.5.2.2.8.5 2008/08/08 06:27:25 tbox Exp $ */ #ifndef ISC_MSGS_H #define ISC_MSGS_H 1 @@ -146,7 +146,9 @@ #define ISC_MSG_ACCEPTRETURNED 1418 /* accept() returned %d/%s */ #define ISC_MSG_TOOMANYFDS 1419 /* %s: too many open file descriptors */ #define ISC_MSG_ZEROPORT 1420 /* dropping source port zero packet */ -#define ISC_MSG_FILTER 1420 /* setsockopt(SO_ACCEPTFILTER): %s */ +#define ISC_MSG_FILTER 1421 /* setsockopt(SO_ACCEPTFILTER): %s */ + +#define ISC_MSG_TOOMANYHANDLES 1422 /*%< %s: too many open WSA event handles: %s */ #define ISC_MSG_AWAKE 1502 /* "awake" */ #define ISC_MSG_WORKING 1503 /* "working" */ diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in index 9c4edabb5fac..d1877931d425 100644 --- a/lib/isc/include/isc/platform.h.in +++ b/lib/isc/include/isc/platform.h.in @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: platform.h.in,v 1.24.2.1.10.13 2007/09/13 23:45:58 tbox Exp $ */ +/* $Id: platform.h.in,v 1.24.2.1.10.15 2008/06/25 23:45:37 tbox Exp $ */ #ifndef ISC_PLATFORM_H #define ISC_PLATFORM_H 1 @@ -142,6 +142,21 @@ *** Printing. ***/ +/*! \brief + * Define if the system supports kqueue multiplexing + */ +@ISC_PLATFORM_HAVEKQUEUE@ + +/*! \brief + * Define if the system supports epoll multiplexing + */ +@ISC_PLATFORM_HAVEEPOLL@ + +/*! \brief + * Define if the system supports /dev/poll multiplexing + */ +@ISC_PLATFORM_HAVEDEVPOLL@ + /* * If this system needs vsnprintf() and snprintf(), ISC_PLATFORM_NEEDVSNPRINTF * will be defined. diff --git a/lib/isc/include/isc/portset.h b/lib/isc/include/isc/portset.h new file mode 100644 index 000000000000..60cbb790cbe8 --- /dev/null +++ b/lib/isc/include/isc/portset.h @@ -0,0 +1,141 @@ +/* + * Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: portset.h,v 1.3.6.2 2008/06/25 23:45:37 tbox Exp $ */ + +/*! \file isc/portset.h + * \brief Transport Protocol Port Manipuration Module + * + * This module provides simple utilities to handle a set of transport protocol + * (UDP or TCP) port numbers, e.g., for creating an ACL list. An isc_portset_t + * object is an opaque instance of a port set, for which the user can add or + * remove a specific port or a range of consecutive ports. This object is + * expected to be used as a temporary work space only, and does not protect + * simultaneous access from multiple threads. Therefore it must not be stored + * in a place that can be accessed from multiple threads. + */ + +#ifndef ISC_PORTSET_H +#define ISC_PORTSET_H 1 + +/*** + *** Imports + ***/ + +#include <isc/net.h> + +/*** + *** Functions + ***/ + +ISC_LANG_BEGINDECLS + +isc_result_t +isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp); +/*%< + * Create a port set and initialize it as an empty set. + * + * Requires: + *\li 'mctx' to be valid. + *\li 'portsetp' to be non NULL and '*portsetp' to be NULL; + * + * Returns: + *\li #ISC_R_SUCCESS + *\li #ISC_R_NOMEMORY + */ + +void +isc_portset_destroy(isc_mem_t *mctx, isc_portset_t **portsetp); +/*%< + * Destroy a port set. + * + * Requires: + *\li 'mctx' to be valid and must be the same context given when the port set + * was created. + *\li '*portsetp' to be a valid set. + */ + +isc_boolean_t +isc_portset_isset(isc_portset_t *portset, in_port_t port); +/*%< + * Test whether the given port is stored in the portset. + * + * Requires: + *\li 'portset' to be a valid set. + * + * Returns + * \li #ISC_TRUE if the port is found, ISC_FALSE otherwise. + */ + +unsigned int +isc_portset_nports(isc_portset_t *portset); +/*%< + * Provides the number of ports stored in the given portset. + * + * Requires: + *\li 'portset' to be a valid set. + * + * Returns + * \li the number of ports stored in portset. + */ + +void +isc_portset_add(isc_portset_t *portset, in_port_t port); +/*%< + * Add the given port to the portset. The port may or may not be stored in + * the portset. + * + * Requires: + *\li 'portlist' to be valid. + */ + +void +isc_portset_remove(isc_portset_t *portset, in_port_t port); +/*%< + * Remove the given port to the portset. The port may or may not be stored in + * the portset. + * + * Requires: + *\li 'portlist' to be valid. + */ + +void +isc_portset_addrange(isc_portset_t *portset, in_port_t port_lo, + in_port_t port_hi); +/*%< + * Add a subset of [port_lo, port_hi] (inclusive) to the portset. Ports in the + * subset may or may not be stored in portset. + * + * Requires: + *\li 'portlist' to be valid. + *\li port_lo <= port_hi + */ + +void +isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo, + in_port_t port_hi); +/*%< + * Subtract a subset of [port_lo, port_hi] (inclusive) from the portset. Ports + * in the subset may or may not be stored in portset. + * + * Requires: + *\li 'portlist' to be valid. + *\li port_lo <= port_hi + */ + +ISC_LANG_ENDDECLS + +#endif /* ISC_NETADDR_H */ diff --git a/lib/isc/include/isc/resource.h b/lib/isc/include/isc/resource.h index 1d4cb3023a4a..fbd9e287ae84 100644 --- a/lib/isc/include/isc/resource.h +++ b/lib/isc/include/isc/resource.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resource.h,v 1.4.206.1.34.2 2008/07/23 23:47:49 tbox Exp $ */ +/* $Id: resource.h,v 1.4.206.3 2008/08/01 23:45:29 tbox Exp $ */ #ifndef ISC_RESOURCE_H #define ISC_RESOURCE_H 1 @@ -80,16 +80,13 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value); */ isc_result_t -isc_resource_curlimit(isc_resource_t resource, isc_resourcevalue_t *value); -/* - * Get the current limit on a resource. - * - * Requires: - * 'resource' is a valid member of the isc_resource_t enumeration. +isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value); +/*%< + * Same as isc_resource_getlimit(), but returns the current (soft) limit. * * Returns: - * ISC_R_SUCCESS Success. - * ISC_R_NOTIMPLEMENTED 'resource' is not a type known by the OS. + *\li #ISC_R_SUCCESS Success. + *\li #ISC_R_NOTIMPLEMENTED 'resource' is not a type known by the OS. */ ISC_LANG_ENDDECLS diff --git a/lib/isc/include/isc/socket.h b/lib/isc/include/isc/socket.h index 0537a0d6693b..73ffb2daffd9 100644 --- a/lib/isc/include/isc/socket.h +++ b/lib/isc/include/isc/socket.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: socket.h,v 1.54.12.7.4.4 2008/07/23 23:16:27 marka Exp $ */ +/* $Id: socket.h,v 1.54.12.16 2008/09/11 06:14:46 each Exp $ */ #ifndef ISC_SOCKET_H #define ISC_SOCKET_H 1 @@ -103,6 +103,7 @@ struct isc_socketevent { isc_time_t timestamp; /* timestamp of packet recv */ struct in6_pktinfo pktinfo; /* ipv6 pktinfo */ isc_uint32_t attributes; /* see below */ + isc_eventdestructor_t destroy; /* original destructor */ }; typedef struct isc_socket_newconnev isc_socket_newconnev_t; @@ -312,8 +313,53 @@ isc_socket_detach(isc_socket_t **socketp); */ isc_result_t +isc_socket_open(isc_socket_t *sock); +/* + * Open a new socket file descriptor of the given socket structure. It simply + * opens a new descriptor; all of the other parameters including the socket + * type are inherited from the existing socket. This function is provided to + * avoid overhead of destroying and creating sockets when many short-lived + * sockets are frequently opened and closed. When the efficiency is not an + * issue, it should be safer to detach the unused socket and re-create a new + * one. This optimization may not be available for some systems, in which + * case this function will return ISC_R_NOTIMPLEMENTED and must not be used. + * + * Requires: + * + * \li there must be no other reference to this socket. + * + * \li 'socket' is a valid and previously closed by isc_socket_close() + * + * Returns: + * Same as isc_socket_create(). + * \li ISC_R_NOTIMPLEMENTED + */ + +isc_result_t +isc_socket_close(isc_socket_t *sock); +/* + * Close a socket file descriptor of the given socket structure. This function + * is provided as an alternative to destroying an unused socket when overhead + * destroying/re-creating sockets can be significant, and is expected to be + * used with isc_socket_open(). This optimization may not be available for some + * systems, in which case this function will return ISC_R_NOTIMPLEMENTED and + * must not be used. + * + * Requires: + * + * \li The socket must have a valid descriptor. + * + * \li There must be no other reference to this socket. + * + * \li There must be no pending I/O requests. + * + * Returns: + * \li #ISC_R_NOTIMPLEMENTED + */ + +isc_result_t isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *addressp, - unsigned int reuseaddr); + unsigned int options); /* * Bind 'socket' to '*addressp'. * @@ -624,6 +670,7 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region, * ISC_R_INPROGRESS * ISC_R_NOMEMORY * ISC_R_UNEXPECTED + * ISC_R_NOTIMPLEMENTED * * Event results: * @@ -634,8 +681,14 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region, isc_result_t isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp); + +isc_result_t +isc_socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp, + unsigned int maxsocks); /* - * Create a socket manager. + * Create a socket manager. If "maxsocks" is non-zero, it specifies the + * maximum number of sockets that the created manager should handle. + * isc_socketmgr_create() is equivalent of isc_socketmgr_create2() with * * Notes: * @@ -658,6 +711,22 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp); * ISC_R_UNEXPECTED */ +isc_result_t +isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp); +/*%< + * Returns in "*nsockp" the maximum number of sockets this manager may open. + * + * Requires: + * + *\li '*manager' is a valid isc_socketmgr_t. + *\li 'nsockp' is not NULL. + * + * Returns: + * + *\li #ISC_R_SUCCESS + *\li #ISC_R_NOTIMPLEMENTED + */ + void isc_socketmgr_destroy(isc_socketmgr_t **managerp); /* diff --git a/lib/isc/include/isc/timer.h b/lib/isc/include/isc/timer.h index 9d4cc00000a8..4b39c6220b60 100644 --- a/lib/isc/include/isc/timer.h +++ b/lib/isc/include/isc/timer.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: timer.h,v 1.28.12.9.4.2 2008/07/24 23:47:44 tbox Exp $ */ +/* $Id: timer.h,v 1.28.12.11 2008/06/25 23:45:37 tbox Exp $ */ #ifndef ISC_TIMER_H #define ISC_TIMER_H 1 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h index fad77da99e7b..d5f010092889 100644 --- a/lib/isc/include/isc/types.h +++ b/lib/isc/include/isc/types.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: types.h,v 1.32.2.3.2.1 2004/03/06 08:14:50 marka Exp $ */ +/* $Id: types.h,v 1.32.2.3.2.3 2008/06/25 23:45:37 tbox Exp $ */ #ifndef ISC_TYPES_H #define ISC_TYPES_H 1 @@ -66,6 +66,7 @@ typedef struct isc_mempool isc_mempool_t; typedef struct isc_msgcat isc_msgcat_t; typedef struct isc_ondestroy isc_ondestroy_t; typedef struct isc_netaddr isc_netaddr_t; +typedef struct isc_portset isc_portset_t; typedef struct isc_quota isc_quota_t; typedef struct isc_random isc_random_t; typedef struct isc_ratelimiter isc_ratelimiter_t; diff --git a/lib/isc/mem.c b/lib/isc/mem.c index 8bfe967295c9..69f6cab9ea7b 100644 --- a/lib/isc/mem.c +++ b/lib/isc/mem.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: mem.c,v 1.98.2.7.2.12 2007/11/26 23:45:51 tbox Exp $ */ +/* $Id: mem.c,v 1.98.2.7.2.14 2008/04/28 23:45:37 tbox Exp $ */ #include <config.h> @@ -604,7 +604,7 @@ mem_get(isc_mem_t *ctx, size_t size) { ret = (ctx->memalloc)(ctx->arg, size); if (ret == NULL) - ctx->memalloc_failures++; + ctx->memalloc_failures++; #if ISC_MEM_FILL if (ret != NULL) @@ -1036,7 +1036,6 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) { ADD_TRACE(ctx, ptr, size, file, line); if (ctx->hi_water != 0U && !ctx->hi_called && ctx->inuse > ctx->hi_water) { - ctx->hi_called = ISC_TRUE; call_water = ISC_TRUE; } if (ctx->inuse > ctx->maxinuse) { @@ -1078,10 +1077,8 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG) * when the context was pushed over hi_water but then had * isc_mem_setwater() called with 0 for hi_water and lo_water. */ - if (ctx->hi_called && + if (ctx->hi_called && (ctx->inuse < ctx->lo_water || ctx->lo_water == 0U)) { - ctx->hi_called = ISC_FALSE; - if (ctx->water != NULL) call_water = ISC_TRUE; } @@ -1091,6 +1088,18 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG) (ctx->water)(ctx->water_arg, ISC_MEM_LOWATER); } +void +isc_mem_waterack(isc_mem_t *ctx, int flag) { + REQUIRE(VALID_CONTEXT(ctx)); + + LOCK(&ctx->lock); + if (flag == ISC_MEM_LOWATER) + ctx->hi_called = ISC_FALSE; + else if (flag == ISC_MEM_HIWATER) + ctx->hi_called = ISC_TRUE; + UNLOCK(&ctx->lock); +} + #if ISC_MEM_TRACKLINES static void print_active(isc_mem_t *mctx, FILE *out) { @@ -1110,7 +1119,7 @@ print_active(isc_mem_t *mctx, FILE *out) { "\tptr %p size %u file %s line %u\n"); for (i = 0; i <= mctx->max_size; i++) { dl = ISC_LIST_HEAD(mctx->debuglist[i]); - + if (dl != NULL) found = ISC_TRUE; diff --git a/lib/isc/portset.c b/lib/isc/portset.c new file mode 100644 index 000000000000..90e95968fc3b --- /dev/null +++ b/lib/isc/portset.c @@ -0,0 +1,143 @@ +/* + * Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: portset.c,v 1.4.2.1 2008/06/25 00:03:29 jinmei Exp $ */ + +/*! \file */ + +#include <config.h> + +#include <isc/mem.h> +#include <isc/portset.h> +#include <isc/string.h> +#include <isc/types.h> +#include <isc/util.h> + +#define ISC_PORTSET_BUFSIZE (65536 / (sizeof(isc_uint32_t) * 8)) + +/*% + * Internal representation of portset. It's an array of 32-bit integers, each + * bit corresponding to a single port in the ascending order. For example, + * the second most significant bit of buf[0] corresponds to port 1. + */ +struct isc_portset { + unsigned int nports; /*%< number of ports in the set */ + isc_uint32_t buf[ISC_PORTSET_BUFSIZE]; +}; + +static inline isc_boolean_t +portset_isset(isc_portset_t *portset, in_port_t port) { + return (ISC_TF((portset->buf[port >> 5] & (1 << (port & 31))) != 0)); +} + +static inline void +portset_add(isc_portset_t *portset, in_port_t port) { + if (!portset_isset(portset, port)) { + portset->nports++; + portset->buf[port >> 5] |= (1 << (port & 31)); + } +} + +static inline void +portset_remove(isc_portset_t *portset, in_port_t port) { + if (portset_isset(portset, port)) { + portset->nports--; + portset->buf[port >> 5] &= ~(1 << (port & 31)); + } +} + +isc_result_t +isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp) { + isc_portset_t *portset; + + REQUIRE(portsetp != NULL && *portsetp == NULL); + + portset = isc_mem_get(mctx, sizeof(*portset)); + if (portset == NULL) + return (ISC_R_NOMEMORY); + + /* Make the set 'empty' by default */ + memset(portset, 0, sizeof(*portset)); + *portsetp = portset; + + return (ISC_R_SUCCESS); +} + +void +isc_portset_destroy(isc_mem_t *mctx, isc_portset_t **portsetp) { + isc_portset_t *portset; + + REQUIRE(portsetp != NULL); + portset = *portsetp; + + isc_mem_put(mctx, portset, sizeof(*portset)); +} + +isc_boolean_t +isc_portset_isset(isc_portset_t *portset, in_port_t port) { + REQUIRE(portset != NULL); + + return (portset_isset(portset, port)); +} + +unsigned int +isc_portset_nports(isc_portset_t *portset) { + REQUIRE(portset != NULL); + + return (portset->nports); +} + +void +isc_portset_add(isc_portset_t *portset, in_port_t port) { + REQUIRE(portset != NULL); + + portset_add(portset, port); +} + +void +isc_portset_remove(isc_portset_t *portset, in_port_t port) { + portset_remove(portset, port); +} + +void +isc_portset_addrange(isc_portset_t *portset, in_port_t port_lo, + in_port_t port_hi) +{ + in_port_t p; + + REQUIRE(portset != NULL); + REQUIRE(port_lo <= port_hi); + + p = port_lo; + do { + portset_add(portset, p); + } while (p++ < port_hi); +} + +void +isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo, + in_port_t port_hi) +{ + in_port_t p; + + REQUIRE(portset != NULL); + REQUIRE(port_lo <= port_hi); + + p = port_lo; + do { + portset_remove(portset, p); + } while (p++ < port_hi); +} diff --git a/lib/isc/print.c b/lib/isc/print.c index ee50b29e5d6d..e4e4a709f7c4 100644 --- a/lib/isc/print.c +++ b/lib/isc/print.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: print.c,v 1.22.2.3.2.4 2006/04/17 18:27:20 explorer Exp $ */ +/* $Id: print.c,v 1.22.2.3.2.6 2008/04/28 23:45:38 tbox Exp $ */ /*! \file */ @@ -246,8 +246,24 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) { head = ""; tmpui = tmpi; } - sprintf(buf, "%" ISC_PRINT_QUADFORMAT "u", - tmpui); + if (tmpui <= 0xffffffffU) + sprintf(buf, "%lu", + (unsigned long)tmpui); + else { + unsigned long mid; + unsigned long lo; + unsigned long hi; + lo = tmpui % 1000000000; + tmpui /= 1000000000; + mid = tmpui % 1000000000; + hi = tmpui / 1000000000; + if (hi != 0) + sprintf(buf, "%lu", hi); + else + buf[0] = '\n'; + sprintf(buf + strlen(buf), "%lu", mid); + sprintf(buf + strlen(buf), "%lu", lo); + } goto printint; case 'o': if (q) @@ -256,10 +272,29 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) { tmpui = va_arg(ap, long int); else tmpui = va_arg(ap, int); - sprintf(buf, - alt ? "%#" ISC_PRINT_QUADFORMAT "o" - : "%" ISC_PRINT_QUADFORMAT "o", - tmpui); + if (tmpui <= 0xffffffffU) + sprintf(buf, alt ? "%#lo" : "%lo", + (unsigned long)tmpui); + else { + unsigned long mid; + unsigned long lo; + unsigned long hi; + lo = tmpui % 010000000000; + tmpui /= 010000000000; + mid = tmpui % 010000000000; + hi = tmpui / 010000000000; + if (hi != 0) { + sprintf(buf, + alt ? "%#lo" : "%lo", + hi); + sprintf(buf + strlen(buf), + "%lo", mid); + } else + sprintf(buf, + alt ? "%#lo" : "%lo", + mid); + sprintf(buf + strlen(buf), "%lo", lo); + } goto printint; case 'u': if (q) @@ -268,8 +303,24 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) { tmpui = va_arg(ap, unsigned long int); else tmpui = va_arg(ap, unsigned int); - sprintf(buf, "%" ISC_PRINT_QUADFORMAT "u", - tmpui); + if (tmpui <= 0xffffffffU) + sprintf(buf, "%lu", + (unsigned long)tmpui); + else { + unsigned long mid; + unsigned long lo; + unsigned long hi; + lo = tmpui % 1000000000; + tmpui /= 1000000000; + mid = tmpui % 1000000000; + hi = tmpui / 1000000000; + if (hi != 0) + sprintf(buf, "%lu", hi); + else + buf[0] = '\n'; + sprintf(buf + strlen(buf), "%lu", mid); + sprintf(buf + strlen(buf), "%lu", lo); + } goto printint; case 'x': if (q) @@ -283,8 +334,15 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) { if (precision > 2) precision -= 2; } - sprintf(buf, "%" ISC_PRINT_QUADFORMAT "x", - tmpui); + if (tmpui <= 0xffffffffU) + sprintf(buf, "%lx", + (unsigned long)tmpui); + else { + unsigned long hi = tmpui>>32; + unsigned long lo = tmpui & 0xffffffff; + sprintf(buf, "%lx", hi); + sprintf(buf + strlen(buf), "%lx", lo); + } goto printint; case 'X': if (q) @@ -298,8 +356,15 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) { if (precision > 2) precision -= 2; } - sprintf(buf, "%" ISC_PRINT_QUADFORMAT "X", - tmpui); + if (tmpui <= 0xffffffffU) + sprintf(buf, "%lX", + (unsigned long)tmpui); + else { + unsigned long hi = tmpui>>32; + unsigned long lo = tmpui & 0xffffffff; + sprintf(buf, "%lX", hi); + sprintf(buf + strlen(buf), "%lX", lo); + } goto printint; printint: if (precision != 0 || width != 0) { diff --git a/lib/isc/pthreads/mutex.c b/lib/isc/pthreads/mutex.c index 17cca53fc6a7..ef7db0de9709 100644 --- a/lib/isc/pthreads/mutex.c +++ b/lib/isc/pthreads/mutex.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: mutex.c,v 1.6.26.8 2007/08/28 07:19:17 tbox Exp $ */ +/* $Id: mutex.c,v 1.6.26.10 2008/04/04 23:45:32 tbox Exp $ */ #include <config.h> @@ -31,23 +31,23 @@ /* Operations on timevals; adapted from FreeBSD's sys/time.h */ #define timevalclear(tvp) ((tvp)->tv_sec = (tvp)->tv_usec = 0) #define timevaladd(vvp, uvp) \ - do { \ - (vvp)->tv_sec += (uvp)->tv_sec; \ - (vvp)->tv_usec += (uvp)->tv_usec; \ - if ((vvp)->tv_usec >= 1000000) { \ - (vvp)->tv_sec++; \ - (vvp)->tv_usec -= 1000000; \ - } \ - } while (0) + do { \ + (vvp)->tv_sec += (uvp)->tv_sec; \ + (vvp)->tv_usec += (uvp)->tv_usec; \ + if ((vvp)->tv_usec >= 1000000) { \ + (vvp)->tv_sec++; \ + (vvp)->tv_usec -= 1000000; \ + } \ + } while (0) #define timevalsub(vvp, uvp) \ - do { \ - (vvp)->tv_sec -= (uvp)->tv_sec; \ - (vvp)->tv_usec -= (uvp)->tv_usec; \ - if ((vvp)->tv_usec < 0) { \ - (vvp)->tv_sec--; \ - (vvp)->tv_usec += 1000000; \ - } \ - } while (0) + do { \ + (vvp)->tv_sec -= (uvp)->tv_sec; \ + (vvp)->tv_usec -= (uvp)->tv_usec; \ + if ((vvp)->tv_usec < 0) { \ + (vvp)->tv_sec--; \ + (vvp)->tv_usec += 1000000; \ + } \ + } while (0) #define ISC_MUTEX_MAX_LOCKERS 32 @@ -70,8 +70,11 @@ struct isc_mutexstats { isc_mutexlocker_t lockers[ISC_MUTEX_MAX_LOCKERS]; }; -#define TABLESIZE (8 * 1024) -static isc_mutexstats_t stats[TABLESIZE]; +#ifndef ISC_MUTEX_PROFTABLESIZE +#define ISC_MUTEX_PROFTABLESIZE (16 * 1024) +#endif +static isc_mutexstats_t stats[ISC_MUTEX_PROFTABLESIZE]; +static int stats_next = 0; static isc_boolean_t stats_init = ISC_FALSE; static pthread_mutex_t statslock = PTHREAD_MUTEX_INITIALIZER; @@ -85,21 +88,19 @@ isc_mutex_init_profile(isc_mutex_t *mp, const char *file, int line) { RUNTIME_CHECK(pthread_mutex_lock(&statslock) == 0); - if (stats_init == ISC_FALSE) { - for (i = 0; i < TABLESIZE; i++) { - stats[i].file = NULL; - } + if (stats_init == ISC_FALSE) stats_init = ISC_TRUE; - } - mp->stats = NULL; - for (i = 0; i < TABLESIZE; i++) { - if (stats[i].file == NULL) { - mp->stats = &stats[i]; - break; - } - } - RUNTIME_CHECK(mp->stats != NULL); + /* + * If all statistics entries have been used, give up and trigger an + * assertion failure. There would be no other way to deal with this + * because we'd like to keep record of all locks for the purpose of + * debugging and the number of necessary locks is unpredictable. + * If this failure is triggered while debugging, named should be + * rebuilt with an increased ISC_MUTEX_PROFTABLESIZE. + */ + RUNTIME_CHECK(stats_next < ISC_MUTEX_PROFTABLESIZE); + mp->stats = &stats[stats_next++]; RUNTIME_CHECK(pthread_mutex_unlock(&statslock) == 0); @@ -186,10 +187,9 @@ void isc_mutex_statsprofile(FILE *fp) { isc_mutexlocker_t *locker; int i, j; + fprintf(fp, "Mutex stats (in us)\n"); - for (i = 0; i < TABLESIZE; i++) { - if (stats[i].file == NULL) - continue; + for (i = 0; i < stats_next; i++) { fprintf(fp, "%-12s %4d: %10u %lu.%06lu %lu.%06lu\n", stats[i].file, stats[i].line, stats[i].count, stats[i].locked_total.tv_sec, @@ -225,7 +225,7 @@ isc_mutex_init_errcheck(isc_mutex_t *mp) if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK) != 0) return ISC_R_UNEXPECTED; - + if (pthread_mutex_init(mp, &attr) != 0) return ISC_R_UNEXPECTED; diff --git a/lib/isc/timer.c b/lib/isc/timer.c index 990f2943cd6c..75508563ca1d 100644 --- a/lib/isc/timer.c +++ b/lib/isc/timer.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: timer.c,v 1.64.12.17.4.3 2008/07/29 18:34:29 jinmei Exp $ */ +/* $Id: timer.c,v 1.64.12.20 2008/08/22 05:59:24 marka Exp $ */ #include <config.h> diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c index 382e445ead5c..daf4b2f495e7 100644 --- a/lib/isc/unix/app.c +++ b/lib/isc/unix/app.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: app.c,v 1.43.2.3.8.8.4.1 2008/07/29 04:43:57 each Exp $ */ +/* $Id: app.c,v 1.43.2.3.8.11 2008/10/15 03:41:17 marka Exp $ */ #include <config.h> @@ -28,6 +28,9 @@ #include <unistd.h> #include <signal.h> #include <sys/time.h> +#ifdef HAVE_EPOLL +#include <sys/epoll.h> +#endif #include <isc/app.h> #include <isc/boolean.h> @@ -295,14 +298,13 @@ isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action, * Event loop for nonthreaded programs. */ static isc_result_t -evloop() { +evloop(void) { isc_result_t result; while (!want_shutdown) { int n; isc_time_t when, now; struct timeval tv, *tvp; - fd_set *readfds, *writefds; - int maxfd; + isc_socketwait_t *swait; isc_boolean_t readytasks; isc_boolean_t call_timer_dispatch = ISC_FALSE; @@ -329,8 +331,8 @@ evloop() { } } - isc__socketmgr_getfdsets(&readfds, &writefds, &maxfd); - n = select(maxfd, readfds, writefds, NULL, tvp); + swait = NULL; + n = isc__socketmgr_waitevents(tvp, &swait); if (n == 0 || call_timer_dispatch) { /* @@ -350,8 +352,7 @@ evloop() { isc__timermgr_dispatch(); } if (n > 0) - (void)isc__socketmgr_dispatch(readfds, writefds, - maxfd); + (void)isc__socketmgr_dispatch(swait); (void)isc__taskmgr_dispatch(); if (want_reload) { @@ -432,10 +433,10 @@ isc_app_run(void) { #ifdef ISC_PLATFORM_USETHREADS sigset_t sset; char strbuf[ISC_STRERRORSIZE]; -#endif /* ISC_PLATFORM_USETHREADS */ #ifdef HAVE_SIGWAIT int sig; #endif +#endif /* ISC_PLATFORM_USETHREADS */ #ifdef HAVE_LINUXTHREADS REQUIRE(main_thread == pthread_self()); diff --git a/lib/isc/unix/include/isc/net.h b/lib/isc/unix/include/isc/net.h index f1a015f5bb1d..01c808fea611 100644 --- a/lib/isc/unix/include/isc/net.h +++ b/lib/isc/unix/include/isc/net.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: net.h,v 1.31.2.2.10.8 2004/04/29 01:31:23 marka Exp $ */ +/* $Id: net.h,v 1.31.2.2.10.10 2008/06/25 23:45:37 tbox Exp $ */ #ifndef ISC_NET_H #define ISC_NET_H 1 @@ -101,7 +101,7 @@ /* * Required for some pre RFC2133 implementations. * IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT were added in - * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt. + * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt. * If 's6_addr' is defined then assume that there is a union and three * levels otherwise assume two levels required. */ @@ -303,6 +303,23 @@ isc_net_enableipv4(void); void isc_net_enableipv6(void); +isc_result_t +isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high); +/* + * Returns system's default range of ephemeral UDP ports, if defined. + * If the range is not available or unknown, ISC_NET_PORTRANGELOW and + * ISC_NET_PORTRANGEHIGH will be returned. + * + * Requires: + * + *\li 'low' and 'high' must be non NULL. + * + * Returns: + * + *\li *low and *high will be the ports specifying the low and high ends of + * the range. + */ + #ifdef ISC_PLATFORM_NEEDNTOP const char * isc_net_ntop(int af, const void *src, char *dst, size_t size); diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c index 42cadec7d761..cd3abc64ed00 100644 --- a/lib/isc/unix/net.c +++ b/lib/isc/unix/net.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,10 +15,19 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: net.c,v 1.22.2.2.10.11 2007/09/13 23:45:58 tbox Exp $ */ +/* $Id: net.c,v 1.22.2.2.10.15 2008/07/04 23:45:39 tbox Exp $ */ #include <config.h> +#include <sys/types.h> + +#if defined(HAVE_SYS_SYSCTL_H) +#if defined(HAVE_SYS_PARAM_H) +#include <sys/param.h> +#endif +#include <sys/sysctl.h> +#endif + #include <errno.h> #include <unistd.h> @@ -30,6 +39,59 @@ #include <isc/string.h> #include <isc/util.h> +/* + * Definitions about UDP port range specification. This is a total mess of + * portability variants: some use sysctl (but the sysctl names vary), some use + * system-specific interfaces, some have the same interface for IPv4 and IPv6, + * some separate them, etc... + */ + +/* + * The last resort defaults: use all non well known port space + */ +#ifndef ISC_NET_PORTRANGELOW +#define ISC_NET_PORTRANGELOW 1024 +#endif /* ISC_NET_PORTRANGELOW */ +#ifndef ISC_NET_PORTRANGEHIGH +#define ISC_NET_PORTRANGEHIGH 65535 +#endif /* ISC_NET_PORTRANGEHIGH */ + +#ifdef HAVE_SYSCTLBYNAME + +/* + * sysctl variants + */ +#if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__) +#define USE_SYSCTL_PORTRANGE +#define SYSCTL_V4PORTRANGE_LOW "net.inet.ip.portrange.hifirst" +#define SYSCTL_V4PORTRANGE_HIGH "net.inet.ip.portrange.hilast" +#define SYSCTL_V6PORTRANGE_LOW "net.inet.ip.portrange.hifirst" +#define SYSCTL_V6PORTRANGE_HIGH "net.inet.ip.portrange.hilast" +#endif + +#ifdef __NetBSD__ +#define USE_SYSCTL_PORTRANGE +#define SYSCTL_V4PORTRANGE_LOW "net.inet.ip.anonportmin" +#define SYSCTL_V4PORTRANGE_HIGH "net.inet.ip.anonportmax" +#define SYSCTL_V6PORTRANGE_LOW "net.inet6.ip6.anonportmin" +#define SYSCTL_V6PORTRANGE_HIGH "net.inet6.ip6.anonportmax" +#endif + +#else /* !HAVE_SYSCTLBYNAME */ + +#ifdef __OpenBSD__ +#define USE_SYSCTL_PORTRANGE +#define SYSCTL_V4PORTRANGE_LOW { CTL_NET, PF_INET, IPPROTO_IP, \ + IPCTL_IPPORT_HIFIRSTAUTO } +#define SYSCTL_V4PORTRANGE_HIGH { CTL_NET, PF_INET, IPPROTO_IP, \ + IPCTL_IPPORT_HILASTAUTO } +/* Same for IPv6 */ +#define SYSCTL_V6PORTRANGE_LOW SYSCTL_V4PORTRANGE_LOW +#define SYSCTL_V6PORTRANGE_HIGH SYSCTL_V4PORTRANGE_HIGH +#endif + +#endif /* HAVE_SYSCTLBYNAME */ + #if defined(ISC_PLATFORM_HAVEIPV6) # if defined(ISC_PLATFORM_NEEDIN6ADDRANY) const struct in6_addr isc_net_in6addrany = IN6ADDR_ANY_INIT; @@ -328,6 +390,101 @@ isc_net_probe_ipv6pktinfo(void) { return (ipv6pktinfo_result); } +#if defined(USE_SYSCTL_PORTRANGE) +#if defined(HAVE_SYSCTLBYNAME) +static isc_result_t +getudpportrange_sysctl(int af, in_port_t *low, in_port_t *high) { + int port_low, port_high; + size_t portlen; + const char *sysctlname_lowport, *sysctlname_hiport; + + if (af == AF_INET) { + sysctlname_lowport = SYSCTL_V4PORTRANGE_LOW; + sysctlname_hiport = SYSCTL_V4PORTRANGE_HIGH; + } else { + sysctlname_lowport = SYSCTL_V6PORTRANGE_LOW; + sysctlname_hiport = SYSCTL_V6PORTRANGE_HIGH; + } + portlen = sizeof(portlen); + if (sysctlbyname(sysctlname_lowport, &port_low, &portlen, + NULL, 0) < 0) { + return (ISC_R_FAILURE); + } + portlen = sizeof(portlen); + if (sysctlbyname(sysctlname_hiport, &port_high, &portlen, + NULL, 0) < 0) { + return (ISC_R_FAILURE); + } + if ((port_low & ~0xffff) != 0 || (port_high & ~0xffff) != 0) + return (ISC_R_RANGE); + + *low = (in_port_t)port_low; + *high = (in_port_t)port_high; + + return (ISC_R_SUCCESS); +} +#else /* !HAVE_SYSCTLBYNAME */ +static isc_result_t +getudpportrange_sysctl(int af, in_port_t *low, in_port_t *high) { + int mib_lo4[4] = SYSCTL_V4PORTRANGE_LOW; + int mib_hi4[4] = SYSCTL_V4PORTRANGE_HIGH; + int mib_lo6[4] = SYSCTL_V6PORTRANGE_LOW; + int mib_hi6[4] = SYSCTL_V6PORTRANGE_HIGH; + int *mib_lo, *mib_hi, miblen; + int port_low, port_high; + size_t portlen; + + if (af == AF_INET) { + mib_lo = mib_lo4; + mib_hi = mib_hi4; + miblen = sizeof(mib_lo4) / sizeof(mib_lo4[0]); + } else { + mib_lo = mib_lo6; + mib_hi = mib_hi6; + miblen = sizeof(mib_lo6) / sizeof(mib_lo6[0]); + } + + portlen = sizeof(portlen); + if (sysctl(mib_lo, miblen, &port_low, &portlen, NULL, 0) < 0) { + return (ISC_R_FAILURE); + } + + portlen = sizeof(portlen); + if (sysctl(mib_hi, miblen, &port_high, &portlen, NULL, 0) < 0) { + return (ISC_R_FAILURE); + } + + if ((port_low & ~0xffff) != 0 || (port_high & ~0xffff) != 0) + return (ISC_R_RANGE); + + *low = (in_port_t) port_low; + *high = (in_port_t) port_high; + + return (ISC_R_SUCCESS); +} +#endif /* HAVE_SYSCTLBYNAME */ +#endif /* USE_SYSCTL_PORTRANGE */ + +isc_result_t +isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high) { + int result = ISC_R_FAILURE; + + REQUIRE(low != NULL && high != NULL); + +#if defined(USE_SYSCTL_PORTRANGE) + result = getudpportrange_sysctl(af, low, high); +#else + UNUSED(af); +#endif + + if (result != ISC_R_SUCCESS) { + *low = ISC_NET_PORTRANGELOW; + *high = ISC_NET_PORTRANGEHIGH; + } + + return (ISC_R_SUCCESS); /* we currently never fail in this function */ +} + void isc_net_disableipv4(void) { initialize(); diff --git a/lib/isc/unix/resource.c b/lib/isc/unix/resource.c index a6280b7477e8..dac9fcaa6c08 100644 --- a/lib/isc/unix/resource.c +++ b/lib/isc/unix/resource.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resource.c,v 1.11.206.3.4.3 2008/07/28 22:45:53 marka Exp $ */ +/* $Id: resource.c,v 1.11.206.7 2008/08/05 07:23:56 marka Exp $ */ #include <config.h> @@ -32,7 +32,7 @@ #include <linux/fs.h> /* To get the large NR_OPEN. */ #endif -#ifdef __hpux +#if defined(__hpux) && defined(HAVE_SYS_DYNTUNE_H) #include <sys/dyntune.h> #endif @@ -170,7 +170,7 @@ isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) { if (unixresult == 0) return (ISC_R_SUCCESS); } -#elif defined(__hpux) +#elif defined(__hpux) && defined(HAVE_SYS_DYNTUNE_H) if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) { uint64_t maxfiles; if (gettune("maxfiles_lim", &maxfiles) == 0) { @@ -210,7 +210,7 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value) { } isc_result_t -isc_resource_curlimit(isc_resource_t resource, isc_resourcevalue_t *value) { +isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value) { int unixresult; int unixresource; struct rlimit rl; diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index 3ee796c24bba..1508487945be 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: socket.c,v 1.207.2.19.2.35.4.6 2008/07/29 04:43:57 each Exp $ */ +/* $Id: socket.c,v 1.207.2.19.2.62 2008/11/20 00:07:38 jinmei Exp $ */ #include <config.h> @@ -52,20 +52,66 @@ #include <isc/thread.h> #include <isc/util.h> +#ifdef ISC_PLATFORM_HAVESYSUNH +#include <sys/un.h> +#endif +#ifdef ISC_PLATFORM_HAVEKQUEUE +#include <sys/event.h> +#endif +#ifdef ISC_PLATFORM_HAVEEPOLL +#include <sys/epoll.h> +#endif +#ifdef ISC_PLATFORM_HAVEDEVPOLL +#include <sys/devpoll.h> +#endif + #include "errno2result.h" #ifndef ISC_PLATFORM_USETHREADS #include "socket_p.h" #endif /* ISC_PLATFORM_USETHREADS */ -#if defined(SO_BSDCOMPAT) && defined(__linux__) -#include <sys/utsname.h> -#endif +/* + * Choose the most preferable multiplex method. + */ +#ifdef ISC_PLATFORM_HAVEKQUEUE +#define USE_KQUEUE +#elif defined (ISC_PLATFORM_HAVEEPOLL) +#define USE_EPOLL +#elif defined (ISC_PLATFORM_HAVEDEVPOLL) +#define USE_DEVPOLL +typedef struct { + unsigned int want_read : 1, + want_write : 1; +} pollinfo_t; +#else +#define USE_SELECT +#endif /* ISC_PLATFORM_HAVEKQUEUE */ -/*% - * Max number of open sockets. In the vast majority of cases the default size - * of FD_SETSIZE should be fine, and this constant should be increased only - * when absolutely necessary and possible, i.e., the server is exhausting all +#ifndef ISC_PLATFORM_USETHREADS +#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) +struct isc_socketwait { + int nevents; +}; +#elif defined (USE_SELECT) +struct isc_socketwait { + fd_set *readset; + fd_set *writeset; + int nfds; + int maxfd; +}; +#endif /* USE_KQUEUE */ +#endif /* !ISC_PLATFORM_USETHREADS */ + +/* + * Maximum number of allowable open sockets. This is also the maximum + * allowable socket file descriptor. + * + * Care should be taken before modifying this value for select(): + * The API standard doesn't ensure select() accept more than (the system default + * of) FD_SETSIZE descriptors, and the default size should in fact be fine in + * the vast majority of cases. This constant should therefore be increased only + * when absolutely necessary and possible, i.e., the server is exhausting all * available file descriptors (up to FD_SETSIZE) and the select() function * and FD_xxx macros support larger values than FD_SETSIZE (which may not * always by true, but we keep using some of them to ensure as much @@ -76,21 +122,79 @@ * As a special note, this value shouldn't have to be touched if * this is a build for an authoritative only DNS server. */ - -#ifndef ISC_SOCKET_FDSETSIZE -#define ISC_SOCKET_FDSETSIZE FD_SETSIZE -#endif - +#ifndef ISC_SOCKET_MAXSOCKETS +#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) +#define ISC_SOCKET_MAXSOCKETS 4096 +#elif defined(USE_SELECT) +#define ISC_SOCKET_MAXSOCKETS FD_SETSIZE +#endif /* USE_KQUEUE... */ +#endif /* ISC_SOCKET_MAXSOCKETS */ + +#ifdef USE_SELECT /*% - * Mac OS X needs a special definition to support larger values in select() + * Mac OS X needs a special definition to support larger values in select(). + * We always define this because a larger value can be specified run-time. */ -#if ISC_SOCKET_FDSETSIZE > FD_SETSIZE #ifdef __APPLE__ #define _DARWIN_UNLIMITED_SELECT #endif /* __APPLE__ */ +#endif /* USE_SELECT */ + +#ifdef ISC_SOCKET_USE_POLLWATCH +/* + * If this macro is defined, enable workaround for a Solaris /dev/poll kernel + * bug: DP_POLL ioctl could keep sleeping even if socket I/O is possible for + * some of the specified FD. The idea is based on the observation that it's + * likely for a busy server to keep receiving packets. It specifically works + * as follows: the socket watcher is first initialized with the state of + * "poll_idle". While it's in the idle state it keeps sleeping until a socket + * event occurs. When it wakes up for a socket I/O event, it moves to the + * poll_active state, and sets the poll timeout to a short period + * (ISC_SOCKET_POLLWATCH_TIMEOUT msec). If timeout occurs in this state, the + * watcher goes to the poll_checking state with the same timeout period. + * In this state, the watcher tries to detect whether this is a break + * during intermittent events or the kernel bug is triggered. If the next + * polling reports an event within the short period, the previous timeout is + * likely to be a kernel bug, and so the watcher goes back to the active state. + * Otherwise, it moves to the idle state again. + * + * It's not clear whether this is a thread-related bug, but since we've only + * seen this with threads, this workaround is used only when enabling threads. + */ + +typedef enum { poll_idle, poll_active, poll_checking } pollstate_t; + +#ifndef ISC_SOCKET_POLLWATCH_TIMEOUT +#define ISC_SOCKET_POLLWATCH_TIMEOUT 10 +#endif /* ISC_SOCKET_POLLWATCH_TIMEOUT */ +#endif /* ISC_SOCKET_USE_POLLWATCH */ + +/* + * Size of per-FD lock buckets. + */ +#ifdef ISC_PLATFORM_USETHREADS +#define FDLOCK_COUNT 1024 +#define FDLOCK_ID(fd) ((fd) % FDLOCK_COUNT) +#else +#define FDLOCK_COUNT 1 +#define FDLOCK_ID(fd) 0 +#endif /* ISC_PLATFORM_USETHREADS */ + +/* + * Maximum number of events communicated with the kernel. There should normally + * be no need for having a large number. + */ +#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) +#ifndef ISC_SOCKET_MAXEVENTS +#define ISC_SOCKET_MAXEVENTS 64 +#endif #endif -/*% +#if defined(SO_BSDCOMPAT) && defined(__linux__) +#include <sys/utsname.h> +#endif + +/* * Some systems define the socket length argument as an int, some as size_t, * some as socklen_t. This is here so it can be easily changed if needed. */ @@ -218,22 +322,50 @@ struct isc_socketmgr { unsigned int magic; isc_mem_t *mctx; isc_mutex_t lock; + isc_mutex_t *fdlock; +#ifdef USE_KQUEUE + int kqueue_fd; + int nevents; + struct kevent *events; +#endif /* USE_KQUEUE */ +#ifdef USE_EPOLL + int epoll_fd; + int nevents; + struct epoll_event *events; +#endif /* USE_EPOLL */ +#ifdef USE_DEVPOLL + int devpoll_fd; + int nevents; + struct pollfd *events; +#endif /* USE_DEVPOLL */ +#ifdef USE_SELECT int fd_bufsize; - int fdsize; +#endif /* USE_SELECT */ + unsigned int maxsocks; +#ifdef ISC_PLATFORM_USETHREADS + int pipe_fds[2]; +#endif + + /* Locked by fdlock. */ + isc_socket_t **fds; + int *fdstate; +#ifdef USE_DEVPOLL + pollinfo_t *fdpollinfo; +#endif + /* Locked by manager lock. */ ISC_LIST(isc_socket_t) socklist; +#ifdef USE_SELECT fd_set *read_fds; fd_set *read_fds_copy; fd_set *write_fds; fd_set *write_fds_copy; - isc_socket_t **fds; - int *fdstate; int maxfd; - int reserved; /* unlocked */ +#endif /* USE_SELECT */ + int reserved; /* unlocked */ #ifdef ISC_PLATFORM_USETHREADS isc_thread_t watcher; isc_condition_t shutdown_ok; - int pipe_fds[2]; #else /* ISC_PLATFORM_USETHREADS */ unsigned int refs; #endif /* ISC_PLATFORM_USETHREADS */ @@ -272,8 +404,9 @@ static void build_msghdr_send(isc_socket_t *, isc_socketevent_t *, struct msghdr *, struct iovec *, size_t *); static void build_msghdr_recv(isc_socket_t *, isc_socketevent_t *, struct msghdr *, struct iovec *, size_t *); -static void cleanup_fdsets(isc_socketmgr_t *, isc_mem_t *); -static isc_result_t create_fdsets(isc_socketmgr_t *, isc_mem_t *); +#ifdef ISC_PLATFORM_USETHREADS +static isc_boolean_t process_ctlfd(isc_socketmgr_t *manager); +#endif #define SELECT_POKE_SHUTDOWN (-1) #define SELECT_POKE_NOTHING (-2) @@ -342,9 +475,195 @@ socket_log(isc_socket_t *sock, isc_sockaddr_t *address, } } +#if defined(_AIX) && defined(ISC_NET_BSD44MSGHDR) && \ + defined(USE_CMSG) && defined(IPV6_RECVPKTINFO) +/* + * AIX has a kernel bug where IPV6_RECVPKTINFO gets cleared by + * setting IPV6_V6ONLY. + */ +static void +FIX_IPV6_RECVPKTINFO(isc_socket_t *sock) +{ + char strbuf[ISC_STRERRORSIZE]; + int on = 1; + + if (sock->pf != AF_INET6 || sock->type != isc_sockettype_udp) + return; + + if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, + (void *)&on, sizeof(on)) < 0) { + + UNEXPECTED_ERROR(__FILE__, __LINE__, + "setsockopt(%d, IPV6_RECVPKTINFO) " + "%s: %s", sock->fd, + isc_msgcat_get(isc_msgcat, + ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, + "failed"), + strbuf); + } +} +#else +#define FIX_IPV6_RECVPKTINFO(sock) (void)0 +#endif + +static inline isc_result_t +watch_fd(isc_socketmgr_t *manager, int fd, int msg) { + isc_result_t result = ISC_R_SUCCESS; + +#ifdef USE_KQUEUE + struct kevent evchange; + + memset(&evchange, 0, sizeof(evchange)); + if (msg == SELECT_POKE_READ) + evchange.filter = EVFILT_READ; + else + evchange.filter = EVFILT_WRITE; + evchange.flags = EV_ADD; + evchange.ident = fd; + if (kevent(manager->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0) + result = isc__errno2result(errno); + + return (result); +#elif defined(USE_EPOLL) + struct epoll_event event; + + if (msg == SELECT_POKE_READ) + event.events = EPOLLIN; + else + event.events = EPOLLOUT; + event.data.fd = fd; + if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_ADD, fd, &event) == -1 && + errno != EEXIST) { + result = isc__errno2result(errno); + } + + return (result); +#elif defined(USE_DEVPOLL) + struct pollfd pfd; + int lockid = FDLOCK_ID(fd); + + memset(&pfd, 0, sizeof(pfd)); + if (msg == SELECT_POKE_READ) + pfd.events = POLLIN; + else + pfd.events = POLLOUT; + pfd.fd = fd; + pfd.revents = 0; + LOCK(&manager->fdlock[lockid]); + if (write(manager->devpoll_fd, &pfd, sizeof(pfd)) == -1) + result = isc__errno2result(errno); + else { + if (msg == SELECT_POKE_READ) + manager->fdpollinfo[fd].want_read = 1; + else + manager->fdpollinfo[fd].want_write = 1; + } + UNLOCK(&manager->fdlock[lockid]); + + return (result); +#elif defined(USE_SELECT) + LOCK(&manager->lock); + if (msg == SELECT_POKE_READ) + FD_SET(fd, manager->read_fds); + if (msg == SELECT_POKE_WRITE) + FD_SET(fd, manager->write_fds); + UNLOCK(&manager->lock); + + return (result); +#endif +} + +static inline isc_result_t +unwatch_fd(isc_socketmgr_t *manager, int fd, int msg) { + isc_result_t result = ISC_R_SUCCESS; + +#ifdef USE_KQUEUE + struct kevent evchange; + + memset(&evchange, 0, sizeof(evchange)); + if (msg == SELECT_POKE_READ) + evchange.filter = EVFILT_READ; + else + evchange.filter = EVFILT_WRITE; + evchange.flags = EV_DELETE; + evchange.ident = fd; + if (kevent(manager->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0) + result = isc__errno2result(errno); + + return (result); +#elif defined(USE_EPOLL) + struct epoll_event event; + + if (msg == SELECT_POKE_READ) + event.events = EPOLLIN; + else + event.events = EPOLLOUT; + event.data.fd = fd; + if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_DEL, fd, &event) == -1 && + errno != ENOENT) { + char strbuf[ISC_STRERRORSIZE]; + isc__strerror(errno, strbuf, sizeof(strbuf)); + UNEXPECTED_ERROR(__FILE__, __LINE__, + "epoll_ctl(DEL), %d: %s", fd, strbuf); + result = ISC_R_UNEXPECTED; + } + return (result); +#elif defined(USE_DEVPOLL) + struct pollfd pfds[2]; + size_t writelen = sizeof(pfds[0]); + int lockid = FDLOCK_ID(fd); + + memset(pfds, 0, sizeof(pfds)); + pfds[0].events = POLLREMOVE; + pfds[0].fd = fd; + + /* + * Canceling read or write polling via /dev/poll is tricky. Since it + * only provides a way of canceling per FD, we may need to re-poll the + * socket for the other operation. + */ + LOCK(&manager->fdlock[lockid]); + if (msg == SELECT_POKE_READ && + manager->fdpollinfo[fd].want_write == 1) { + pfds[1].events = POLLOUT; + pfds[1].fd = fd; + writelen += sizeof(pfds[1]); + } + if (msg == SELECT_POKE_WRITE && + manager->fdpollinfo[fd].want_read == 1) { + pfds[1].events = POLLIN; + pfds[1].fd = fd; + writelen += sizeof(pfds[1]); + } + + if (write(manager->devpoll_fd, pfds, writelen) == -1) + result = isc__errno2result(errno); + else { + if (msg == SELECT_POKE_READ) + manager->fdpollinfo[fd].want_read = 0; + else + manager->fdpollinfo[fd].want_write = 0; + } + UNLOCK(&manager->fdlock[lockid]); + + return (result); +#elif defined(USE_SELECT) + LOCK(&manager->lock); + if (msg == SELECT_POKE_READ) + FD_CLR(fd, manager->read_fds); + else if (msg == SELECT_POKE_WRITE) + FD_CLR(fd, manager->write_fds); + UNLOCK(&manager->lock); + + return (result); +#endif +} + static void wakeup_socket(isc_socketmgr_t *manager, int fd, int msg) { - isc_socket_t *sock; + isc_result_t result; + int lockid = FDLOCK_ID(fd); /* * This is a wakeup on a socket. If the socket is not in the @@ -352,27 +671,54 @@ wakeup_socket(isc_socketmgr_t *manager, int fd, int msg) { * or writes. */ - INSIST(fd >= 0 && fd < manager->fdsize); + INSIST(fd >= 0 && fd < (int)manager->maxsocks); - if (manager->fdstate[fd] == CLOSE_PENDING) { + if (msg == SELECT_POKE_CLOSE) { + /* No one should be updating fdstate, so no need to lock it */ + INSIST(manager->fdstate[fd] == CLOSE_PENDING); manager->fdstate[fd] = CLOSED; - FD_CLR(fd, manager->read_fds); - FD_CLR(fd, manager->write_fds); + (void)unwatch_fd(manager, fd, SELECT_POKE_READ); + (void)unwatch_fd(manager, fd, SELECT_POKE_WRITE); (void)close(fd); return; } - if (manager->fdstate[fd] != MANAGED) - return; - sock = manager->fds[fd]; + LOCK(&manager->fdlock[lockid]); + if (manager->fdstate[fd] == CLOSE_PENDING) { + UNLOCK(&manager->fdlock[lockid]); + /* + * We accept (and ignore) any error from unwatch_fd() as we are + * closing the socket, hoping it doesn't leave dangling state in + * the kernel. + * Note that unwatch_fd() must be called after releasing the + * fdlock; otherwise it could cause deadlock due to a lock order + * reversal. + */ + (void)unwatch_fd(manager, fd, SELECT_POKE_READ); + (void)unwatch_fd(manager, fd, SELECT_POKE_WRITE); + return; + } + if (manager->fdstate[fd] != MANAGED) { + UNLOCK(&manager->fdlock[lockid]); + return; + } + UNLOCK(&manager->fdlock[lockid]); /* * Set requested bit. */ - if (msg == SELECT_POKE_READ) - FD_SET(sock->fd, manager->read_fds); - if (msg == SELECT_POKE_WRITE) - FD_SET(sock->fd, manager->write_fds); + result = watch_fd(manager, fd, msg); + if (result != ISC_R_SUCCESS) { + /* + * XXXJT: what should we do? Ignoring the failure of watching + * a socket will make the application dysfunctional, but there + * seems to be no reasonable recovery process. + */ + isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL, + ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR, + "failed to start watching FD (%d): %s", + fd, isc_result_totext(result)); + } } #ifdef ISC_PLATFORM_USETHREADS @@ -667,7 +1013,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev, memset(msg, 0, sizeof(*msg)); - if (sock->type == isc_sockettype_udp) { + if (!sock->connected) { msg->msg_name = (void *)&dev->address.type.sa; msg->msg_namelen = dev->address.length; } else { @@ -941,15 +1287,17 @@ dump_msg(struct msghdr *msg) { unsigned int i; printf("MSGHDR %p\n", msg); - printf("\tname %p, namelen %d\n", msg->msg_name, msg->msg_namelen); - printf("\tiov %p, iovlen %d\n", msg->msg_iov, msg->msg_iovlen); + printf("\tname %p, namelen %ld\n", msg->msg_name, + (long) msg->msg_namelen); + printf("\tiov %p, iovlen %ld\n", msg->msg_iov, + (long) msg->msg_iovlen); for (i = 0; i < (unsigned int)msg->msg_iovlen; i++) - printf("\t\t%d\tbase %p, len %d\n", i, + printf("\t\t%d\tbase %p, len %ld\n", i, msg->msg_iov[i].iov_base, - msg->msg_iov[i].iov_len); + (long) msg->msg_iov[i].iov_len); #ifdef ISC_NET_BSD44MSGHDR - printf("\tcontrol %p, controllen %d\n", msg->msg_control, - msg->msg_controllen); + printf("\tcontrol %p, controllen %ld\n", msg->msg_control, + (long) msg->msg_controllen); #endif } #endif @@ -1017,6 +1365,14 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) { /* HPUX 11.11 can return EADDRNOTAVAIL. */ SOFT_OR_HARD(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL); ALWAYS_HARD(ENOBUFS, ISC_R_NORESOURCES); + /* + * HPUX returns EPROTO and EINVAL on receiving some ICMP/ICMPv6 + * errors. + */ +#ifdef EPROTO + SOFT_OR_HARD(EPROTO, ISC_R_HOSTUNREACH); +#endif + SOFT_OR_HARD(EINVAL, ISC_R_HOSTUNREACH); #undef SOFT_OR_HARD #undef ALWAYS_HARD @@ -1222,7 +1578,54 @@ doio_send(isc_socket_t *sock, isc_socketevent_t *dev) { * references exist. */ static void +closesocket(isc_socketmgr_t *manager, isc_sockettype_t type, int fd) { + int lockid = FDLOCK_ID(fd); + + UNUSED(type); + + /* + * No one has this socket open, so the watcher doesn't have to be + * poked, and the socket doesn't have to be locked. + */ + LOCK(&manager->fdlock[lockid]); + manager->fds[fd] = NULL; + manager->fdstate[fd] = CLOSE_PENDING; + UNLOCK(&manager->fdlock[lockid]); + select_poke(manager, fd, SELECT_POKE_CLOSE); + + /* + * update manager->maxfd here (XXX: this should be implemented more + * efficiently) + */ +#ifdef USE_SELECT + LOCK(&manager->lock); + if (manager->maxfd == fd) { + int i; + + manager->maxfd = 0; + for (i = fd - 1; i >= 0; i--) { + lockid = FDLOCK_ID(i); + + LOCK(&manager->fdlock[lockid]); + if (manager->fdstate[i] == MANAGED) { + manager->maxfd = i; + UNLOCK(&manager->fdlock[lockid]); + break; + } + UNLOCK(&manager->fdlock[lockid]); + } +#ifdef ISC_PLATFORM_USETHREADS + if (manager->maxfd < manager->pipe_fds[0]) + manager->maxfd = manager->pipe_fds[0]; +#endif + } + UNLOCK(&manager->lock); +#endif /* USE_SELECT */ +} + +static void destroy(isc_socket_t **sockp) { + int fd; isc_socket_t *sock = *sockp; isc_socketmgr_t *manager = sock->manager; @@ -1233,17 +1636,16 @@ destroy(isc_socket_t **sockp) { INSIST(ISC_LIST_EMPTY(sock->recv_list)); INSIST(ISC_LIST_EMPTY(sock->send_list)); INSIST(sock->connect_ev == NULL); - REQUIRE(sock->fd >= 0 && sock->fd < (int)manager->fdsize); + REQUIRE(sock->fd == -1 || sock->fd < (int)manager->maxsocks); + + if (sock->fd >= 0) { + fd = sock->fd; + sock->fd = -1; + closesocket(manager, sock->type, fd); + } LOCK(&manager->lock); - /* - * No one has this socket open, so the watcher doesn't have to be - * poked, and the socket doesn't have to be locked. - */ - manager->fds[sock->fd] = NULL; - manager->fdstate[sock->fd] = CLOSE_PENDING; - select_poke(manager, sock->fd, SELECT_POKE_CLOSE); ISC_LIST_UNLINK(manager->socklist, sock, link); #ifdef ISC_PLATFORM_USETHREADS @@ -1251,10 +1653,6 @@ destroy(isc_socket_t **sockp) { SIGNAL(&manager->shutdown_ok); #endif /* ISC_PLATFORM_USETHREADS */ - /* - * XXX should reset manager->maxfd here - */ - UNLOCK(&manager->lock); free_socket(sockp); @@ -1446,40 +1844,22 @@ clear_bsdcompat(void) { } #endif -/*% - * Create a new 'type' socket managed by 'manager'. Events - * will be posted to 'task' and when dispatched 'action' will be - * called with 'arg' as the arg value. The new socket is returned - * in 'socketp'. - */ -isc_result_t -isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, - isc_socket_t **socketp) -{ - isc_socket_t *sock = NULL; - isc_result_t ret; -#if defined(USE_CMSG) || defined(SO_BSDCOMPAT) - int on = 1; -#endif +static isc_result_t +opensocket(isc_socketmgr_t *manager, isc_socket_t *sock) { char strbuf[ISC_STRERRORSIZE]; const char *err = "socket"; int tries = 0; +#if defined(USE_CMSG) || defined(SO_BSDCOMPAT) + int on = 1; +#endif - REQUIRE(VALID_MANAGER(manager)); - REQUIRE(socketp != NULL && *socketp == NULL); - - ret = allocate_socket(manager, type, &sock); - if (ret != ISC_R_SUCCESS) - return (ret); - - sock->pf = pf; again: - switch (type) { + switch (sock->type) { case isc_sockettype_udp: - sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP); + sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP); break; case isc_sockettype_tcp: - sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP); + sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP); break; } if (sock->fd == -1 && errno == EINTR && tries++ < 42) @@ -1489,7 +1869,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, /* * Leave a space for stdio and TCP to work in. */ - if (manager->reserved != 0 && type == isc_sockettype_udp && + if (manager->reserved != 0 && sock->type == isc_sockettype_udp && sock->fd >= 0 && sock->fd < manager->reserved) { int new, tmp; new = fcntl(sock->fd, F_DUPFD, manager->reserved); @@ -1509,23 +1889,28 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #endif - if (sock->fd >= (int)manager->fdsize) { + if (sock->fd >= (int)manager->maxsocks) { (void)close(sock->fd); isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR, isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_TOOMANYFDS, - "%s: too many open file descriptors", "socket"); - free_socket(&sock); + "socket: file descriptor exceeds limit (%d/%u)", + sock->fd, manager->maxsocks); return (ISC_R_NORESOURCES); } if (sock->fd < 0) { - free_socket(&sock); - switch (errno) { case EMFILE: case ENFILE: + isc__strerror(errno, strbuf, sizeof(strbuf)); + isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL, + ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR, + isc_msgcat, ISC_MSGSET_SOCKET, + ISC_MSG_TOOMANYFDS, + "%s: %s", err, strbuf); + /* fallthrough */ case ENOBUFS: return (ISC_R_NORESOURCES); @@ -1554,7 +1939,6 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, if (make_nonblock(sock->fd) != ISC_R_SUCCESS) { (void)close(sock->fd); - free_socket(&sock); return (ISC_R_UNEXPECTED); } @@ -1562,7 +1946,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, RUNTIME_CHECK(isc_once_do(&bsdcompat_once, clear_bsdcompat) == ISC_R_SUCCESS); if (bsdcompat && setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT, - (void *)&on, sizeof(on)) < 0) { + (void *)&on, sizeof(on)) < 0) { isc__strerror(errno, strbuf, sizeof(strbuf)); UNEXPECTED_ERROR(__FILE__, __LINE__, "setsockopt(%d, SO_BSDCOMPAT) %s: %s", @@ -1588,9 +1972,10 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #endif -#if defined(USE_CMSG) - if (type == isc_sockettype_udp) { +#if defined(USE_CMSG) || defined(SO_RCVBUF) + if (sock->type == isc_sockettype_udp) { +#if defined(USE_CMSG) #if defined(SO_TIMESTAMP) if (setsockopt(sock->fd, SOL_SOCKET, SO_TIMESTAMP, (void *)&on, sizeof(on)) < 0 @@ -1609,7 +1994,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, #endif /* SO_TIMESTAMP */ #if defined(ISC_PLATFORM_HAVEIPV6) - if (pf == AF_INET6 && sock->recvcmsgbuflen == 0U) { + if (sock->pf == AF_INET6 && sock->recvcmsgbuflen == 0U) { /* * Warn explicitly because this anomaly can be hidden * in usual operation (and unexpectedly appear later). @@ -1621,7 +2006,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, #ifdef ISC_PLATFORM_HAVEIN6PKTINFO #ifdef IPV6_RECVPKTINFO /* RFC 3542 */ - if ((pf == AF_INET6) + if ((sock->pf == AF_INET6) && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, (void *)&on, sizeof(on)) < 0)) { isc__strerror(errno, strbuf, sizeof(strbuf)); @@ -1636,7 +2021,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, } #else /* RFC 2292 */ - if ((pf == AF_INET6) + if ((sock->pf == AF_INET6) && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_PKTINFO, (void *)&on, sizeof(on)) < 0)) { isc__strerror(errno, strbuf, sizeof(strbuf)); @@ -1653,33 +2038,93 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, #endif /* ISC_PLATFORM_HAVEIN6PKTINFO */ #ifdef IPV6_USE_MIN_MTU /* RFC 3542, not too common yet*/ /* use minimum MTU */ - if (pf == AF_INET6) { + if (sock->pf == AF_INET6) { (void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_USE_MIN_MTU, (void *)&on, sizeof(on)); } #endif #endif /* ISC_PLATFORM_HAVEIPV6 */ +#endif /* defined(USE_CMSG) */ +#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) + /* + * Turn off Path MTU discovery on IPv4/UDP sockets. + */ + if (sock->pf == AF_INET) { + int action = IP_PMTUDISC_DONT; + (void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER, + &action, sizeof(action)); + } +#endif +#if defined(IP_DONTFRAG) + /* + * Turn off Path MTU discovery on IPv4/UDP sockets. + */ + if (sock->pf == AF_INET) { + int off = 0; + (void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG, + &off, sizeof(off)); + } +#endif + } +#endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */ + + return (ISC_R_SUCCESS); +} + +/* + * Create a new 'type' socket managed by 'manager'. Events + * will be posted to 'task' and when dispatched 'action' will be + * called with 'arg' as the arg value. The new socket is returned + * in 'socketp'. + */ +isc_result_t +isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, + isc_socket_t **socketp) +{ + isc_socket_t *sock = NULL; + isc_result_t result; + int lockid; + + REQUIRE(VALID_MANAGER(manager)); + REQUIRE(socketp != NULL && *socketp == NULL); + + result = allocate_socket(manager, type, &sock); + if (result != ISC_R_SUCCESS) + return (result); + + sock->pf = pf; + result = opensocket(manager, sock); + if (result != ISC_R_SUCCESS) { + free_socket(&sock); + return (result); } -#endif /* USE_CMSG */ sock->references = 1; *socketp = sock; - LOCK(&manager->lock); - /* * Note we don't have to lock the socket like we normally would because * there are no external references to it yet. */ + lockid = FDLOCK_ID(sock->fd); + LOCK(&manager->fdlock[lockid]); manager->fds[sock->fd] = sock; manager->fdstate[sock->fd] = MANAGED; +#ifdef USE_DEVPOLL + INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 && + sock->manager->fdpollinfo[sock->fd].want_write == 0); +#endif + UNLOCK(&manager->fdlock[lockid]); + + LOCK(&manager->lock); ISC_LIST_APPEND(manager->socklist, sock, link); +#ifdef USE_SELECT if (manager->maxfd < sock->fd) manager->maxfd = sock->fd; - +#endif UNLOCK(&manager->lock); socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET, @@ -1688,6 +2133,48 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, return (ISC_R_SUCCESS); } +isc_result_t +isc_socket_open(isc_socket_t *sock) { + isc_result_t result; + + REQUIRE(VALID_SOCKET(sock)); + + LOCK(&sock->lock); + REQUIRE(sock->references == 1); + UNLOCK(&sock->lock); + /* + * We don't need to retain the lock hereafter, since no one else has + * this socket. + */ + REQUIRE(sock->fd == -1); + + result = opensocket(sock->manager, sock); + if (result != ISC_R_SUCCESS) + sock->fd = -1; + + if (result == ISC_R_SUCCESS) { + int lockid = FDLOCK_ID(sock->fd); + + LOCK(&sock->manager->fdlock[lockid]); + sock->manager->fds[sock->fd] = sock; + sock->manager->fdstate[sock->fd] = MANAGED; +#ifdef USE_DEVPOLL + INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 && + sock->manager->fdpollinfo[sock->fd].want_write == 0); +#endif + UNLOCK(&sock->manager->fdlock[lockid]); + +#ifdef USE_SELECT + LOCK(&sock->manager->lock); + if (sock->manager->maxfd < sock->fd) + sock->manager->maxfd = sock->fd; + UNLOCK(&sock->manager->lock); +#endif + } + + return (result); +} + /* * Attach to a socket. Caller must explicitly detach when it is done. */ @@ -1729,6 +2216,44 @@ isc_socket_detach(isc_socket_t **socketp) { *socketp = NULL; } +isc_result_t +isc_socket_close(isc_socket_t *sock) { + int fd; + + REQUIRE(VALID_SOCKET(sock)); + + LOCK(&sock->lock); + REQUIRE(sock->references == 1); + UNLOCK(&sock->lock); + /* + * We don't need to retain the lock hereafter, since no one else has + * this socket. + */ + + REQUIRE(sock->fd >= 0 && sock->fd < (int)sock->manager->maxsocks); + + INSIST(!sock->connecting); + INSIST(!sock->pending_recv); + INSIST(!sock->pending_send); + INSIST(!sock->pending_accept); + INSIST(ISC_LIST_EMPTY(sock->recv_list)); + INSIST(ISC_LIST_EMPTY(sock->send_list)); + INSIST(ISC_LIST_EMPTY(sock->accept_list)); + INSIST(sock->connect_ev == NULL); + + fd = sock->fd; + sock->fd = -1; + sock->listener = 0; + sock->connected = 0; + sock->connecting = 0; + sock->bound = 0; + isc_sockaddr_any(&sock->address); + + closesocket(sock->manager, sock->type, fd); + + return (ISC_R_SUCCESS); +} + /* * I/O is possible on a given socket. Schedule an event to this task that * will call an internal function to do the I/O. This will charge the @@ -2041,13 +2566,14 @@ internal_accept(isc_task_t *me, isc_event_t *ev) { sock->pf); (void)close(fd); goto soft_error; - } else if (fd >= (int)manager->fdsize) { + } else if (fd >= (int)manager->maxsocks) { isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR, isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_TOOMANYFDS, - "%s: too many open file descriptors", - "accept"); + "accept: " + "file descriptor exceeds limit (%d/%u)", + fd, manager->maxsocks); (void)close(fd); goto soft_error; } @@ -2081,6 +2607,13 @@ internal_accept(isc_task_t *me, isc_event_t *ev) { * -1 means the new socket didn't happen. */ if (fd != -1) { + int lockid = FDLOCK_ID(fd); + + LOCK(&manager->fdlock[lockid]); + manager->fds[fd] = dev->newsocket; + manager->fdstate[fd] = MANAGED; + UNLOCK(&manager->fdlock[lockid]); + LOCK(&manager->lock); ISC_LIST_APPEND(manager->socklist, dev->newsocket, link); @@ -2093,10 +2626,10 @@ internal_accept(isc_task_t *me, isc_event_t *ev) { */ dev->address = dev->newsocket->address; - manager->fds[fd] = dev->newsocket; - manager->fdstate[fd] = MANAGED; +#ifdef USE_SELECT if (manager->maxfd < fd) manager->maxfd = fd; +#endif socket_log(sock, &dev->newsocket->address, CREATION, isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_ACCEPTEDCXN, @@ -2245,77 +2778,256 @@ internal_send(isc_task_t *me, isc_event_t *ev) { UNLOCK(&sock->lock); } +/* + * Process read/writes on each fd here. Avoid locking + * and unlocking twice if both reads and writes are possible. + */ static void -process_fds(isc_socketmgr_t *manager, int maxfd, - fd_set *readfds, fd_set *writefds) +process_fd(isc_socketmgr_t *manager, int fd, isc_boolean_t readable, + isc_boolean_t writeable) { - int i; isc_socket_t *sock; isc_boolean_t unlock_sock; - - REQUIRE(maxfd <= (int)manager->fdsize); + int lockid = FDLOCK_ID(fd); /* - * Process read/writes on other fds here. Avoid locking - * and unlocking twice if both reads and writes are possible. + * If the socket is going to be closed, don't do more I/O. */ - for (i = 0; i < maxfd; i++) { + LOCK(&manager->fdlock[lockid]); + if (manager->fdstate[fd] == CLOSE_PENDING) { + UNLOCK(&manager->fdlock[lockid]); + + (void)unwatch_fd(manager, fd, SELECT_POKE_READ); + (void)unwatch_fd(manager, fd, SELECT_POKE_WRITE); + return; + } + + sock = manager->fds[fd]; + UNLOCK(&manager->fdlock[lockid]); + unlock_sock = ISC_FALSE; + if (readable) { + if (sock == NULL) { + (void)unwatch_fd(manager, fd, SELECT_POKE_READ); + goto check_write; + } + unlock_sock = ISC_TRUE; + LOCK(&sock->lock); + if (!SOCK_DEAD(sock)) { + if (sock->listener) + dispatch_accept(sock); + else + dispatch_recv(sock); + } + (void)unwatch_fd(manager, fd, SELECT_POKE_READ); + } +check_write: + if (writeable) { + if (sock == NULL) { + (void)unwatch_fd(manager, fd, SELECT_POKE_WRITE); + return; + } + if (!unlock_sock) { + unlock_sock = ISC_TRUE; + LOCK(&sock->lock); + } + if (!SOCK_DEAD(sock)) { + if (sock->connecting) + dispatch_connect(sock); + else + dispatch_send(sock); + } + (void)unwatch_fd(manager, fd, SELECT_POKE_WRITE); + } + if (unlock_sock) + UNLOCK(&sock->lock); +} + +#ifdef USE_KQUEUE +static isc_boolean_t +process_fds(isc_socketmgr_t *manager, struct kevent *events, int nevents) { + int i; + isc_boolean_t readable, writable; + isc_boolean_t done = ISC_FALSE; #ifdef ISC_PLATFORM_USETHREADS - if (i == manager->pipe_fds[0] || i == manager->pipe_fds[1]) + isc_boolean_t have_ctlevent = ISC_FALSE; +#endif + + if (nevents == manager->nevents) { + /* + * This is not an error, but something unexpected. If this + * happens, it may indicate the need for increasing + * ISC_SOCKET_MAXEVENTS. + */ + manager_log(manager, ISC_LOGCATEGORY_GENERAL, + ISC_LOGMODULE_SOCKET, ISC_LOG_INFO, + "maximum number of FD events (%d) received", + nevents); + } + + for (i = 0; i < nevents; i++) { + REQUIRE(events[i].ident < manager->maxsocks); +#ifdef ISC_PLATFORM_USETHREADS + if (events[i].ident == (uintptr_t)manager->pipe_fds[0]) { + have_ctlevent = ISC_TRUE; continue; -#endif /* ISC_PLATFORM_USETHREADS */ + } +#endif + readable = ISC_TF(events[i].filter == EVFILT_READ); + writable = ISC_TF(events[i].filter == EVFILT_WRITE); + process_fd(manager, events[i].ident, readable, writable); + } - if (manager->fdstate[i] == CLOSE_PENDING) { - manager->fdstate[i] = CLOSED; - FD_CLR(i, manager->read_fds); - FD_CLR(i, manager->write_fds); +#ifdef ISC_PLATFORM_USETHREADS + if (have_ctlevent) + done = process_ctlfd(manager); +#endif - (void)close(i); + return (done); +} +#elif defined(USE_EPOLL) +static isc_boolean_t +process_fds(isc_socketmgr_t *manager, struct epoll_event *events, int nevents) { + int i; + isc_boolean_t done = ISC_FALSE; +#ifdef ISC_PLATFORM_USETHREADS + isc_boolean_t have_ctlevent = ISC_FALSE; +#endif + if (nevents == manager->nevents) { + manager_log(manager, ISC_LOGCATEGORY_GENERAL, + ISC_LOGMODULE_SOCKET, ISC_LOG_INFO, + "maximum number of FD events (%d) received", + nevents); + } + + for (i = 0; i < nevents; i++) { + REQUIRE(events[i].data.fd < (int)manager->maxsocks); +#ifdef ISC_PLATFORM_USETHREADS + if (events[i].data.fd == manager->pipe_fds[0]) { + have_ctlevent = ISC_TRUE; continue; } - - sock = manager->fds[i]; - unlock_sock = ISC_FALSE; - if (FD_ISSET(i, readfds)) { - if (sock == NULL) { - FD_CLR(i, manager->read_fds); - goto check_write; - } - unlock_sock = ISC_TRUE; - LOCK(&sock->lock); - if (!SOCK_DEAD(sock)) { - if (sock->listener) - dispatch_accept(sock); - else - dispatch_recv(sock); - } - FD_CLR(i, manager->read_fds); +#endif + if ((events[i].events & EPOLLERR) != 0 || + (events[i].events & EPOLLHUP) != 0) { + /* + * epoll does not set IN/OUT bits on an erroneous + * condition, so we need to try both anyway. This is a + * bit inefficient, but should be okay for such rare + * events. Note also that the read or write attempt + * won't block because we use non-blocking sockets. + */ + events[i].events |= (EPOLLIN | EPOLLOUT); } - check_write: - if (FD_ISSET(i, writefds)) { - if (sock == NULL) { - FD_CLR(i, manager->write_fds); - continue; - } - if (!unlock_sock) { - unlock_sock = ISC_TRUE; - LOCK(&sock->lock); - } - if (!SOCK_DEAD(sock)) { - if (sock->connecting) - dispatch_connect(sock); - else - dispatch_send(sock); - } - FD_CLR(i, manager->write_fds); + process_fd(manager, events[i].data.fd, + (events[i].events & EPOLLIN) != 0, + (events[i].events & EPOLLOUT) != 0); + } + +#ifdef ISC_PLATFORM_USETHREADS + if (have_ctlevent) + done = process_ctlfd(manager); +#endif + + return (done); +} +#elif defined(USE_DEVPOLL) +static isc_boolean_t +process_fds(isc_socketmgr_t *manager, struct pollfd *events, int nevents) { + int i; + isc_boolean_t done = ISC_FALSE; +#ifdef ISC_PLATFORM_USETHREADS + isc_boolean_t have_ctlevent = ISC_FALSE; +#endif + + if (nevents == manager->nevents) { + manager_log(manager, ISC_LOGCATEGORY_GENERAL, + ISC_LOGMODULE_SOCKET, ISC_LOG_INFO, + "maximum number of FD events (%d) received", + nevents); + } + + for (i = 0; i < nevents; i++) { + REQUIRE(events[i].fd < (int)manager->maxsocks); +#ifdef ISC_PLATFORM_USETHREADS + if (events[i].fd == manager->pipe_fds[0]) { + have_ctlevent = ISC_TRUE; + continue; } - if (unlock_sock) - UNLOCK(&sock->lock); +#endif + process_fd(manager, events[i].fd, + (events[i].events & POLLIN) != 0, + (events[i].events & POLLOUT) != 0); + } + +#ifdef ISC_PLATFORM_USETHREADS + if (have_ctlevent) + done = process_ctlfd(manager); +#endif + + return (done); +} +#elif defined(USE_SELECT) +static void +process_fds(isc_socketmgr_t *manager, int maxfd, + fd_set *readfds, fd_set *writefds) +{ + int i; + + REQUIRE(maxfd <= (int)manager->maxsocks); + + for (i = 0; i < maxfd; i++) { +#ifdef ISC_PLATFORM_USETHREADS + if (i == manager->pipe_fds[0] || i == manager->pipe_fds[1]) + continue; +#endif /* ISC_PLATFORM_USETHREADS */ + process_fd(manager, i, FD_ISSET(i, readfds), + FD_ISSET(i, writefds)); } } +#endif #ifdef ISC_PLATFORM_USETHREADS +static isc_boolean_t +process_ctlfd(isc_socketmgr_t *manager) { + int msg, fd; + + for (;;) { + select_readmsg(manager, &fd, &msg); + + manager_log(manager, IOEVENT, + isc_msgcat_get(isc_msgcat, ISC_MSGSET_SOCKET, + ISC_MSG_WATCHERMSG, + "watcher got message %d " + "for socket %d"), msg, fd); + + /* + * Nothing to read? + */ + if (msg == SELECT_POKE_NOTHING) + break; + + /* + * Handle shutdown message. We really should + * jump out of this loop right away, but + * it doesn't matter if we have to do a little + * more work first. + */ + if (msg == SELECT_POKE_SHUTDOWN) + return (ISC_TRUE); + + /* + * This is a wakeup on a socket. Look + * at the event queue for both read and write, + * and decide if we need to watch on it now + * or not. + */ + wakeup_socket(manager, fd, msg); + } + + return (ISC_FALSE); +} + /* * This is the thread that will loop forever, always in a select or poll * call. @@ -2329,98 +3041,115 @@ watcher(void *uap) { isc_boolean_t done; int ctlfd; int cc; - int msg, fd; +#ifdef USE_KQUEUE + const char *fnname = "kevent()"; +#elif defined (USE_EPOLL) + const char *fnname = "epoll_wait()"; +#elif defined(USE_DEVPOLL) + const char *fnname = "ioctl(DP_POLL)"; + struct dvpoll dvp; +#elif defined (USE_SELECT) + const char *fnname = "select()"; int maxfd; +#endif char strbuf[ISC_STRERRORSIZE]; +#ifdef ISC_SOCKET_USE_POLLWATCH + pollstate_t pollstate = poll_idle; +#endif /* * Get the control fd here. This will never change. */ - LOCK(&manager->lock); ctlfd = manager->pipe_fds[0]; - done = ISC_FALSE; while (!done) { do { +#ifdef USE_KQUEUE + cc = kevent(manager->kqueue_fd, NULL, 0, + manager->events, manager->nevents, NULL); +#elif defined(USE_EPOLL) + cc = epoll_wait(manager->epoll_fd, manager->events, + manager->nevents, -1); +#elif defined(USE_DEVPOLL) + dvp.dp_fds = manager->events; + dvp.dp_nfds = manager->nevents; +#ifndef ISC_SOCKET_USE_POLLWATCH + dvp.dp_timeout = -1; +#else + if (pollstate == poll_idle) + dvp.dp_timeout = -1; + else + dvp.dp_timeout = ISC_SOCKET_POLLWATCH_TIMEOUT; +#endif /* ISC_SOCKET_USE_POLLWATCH */ + cc = ioctl(manager->devpoll_fd, DP_POLL, &dvp); +#elif defined(USE_SELECT) + LOCK(&manager->lock); memcpy(manager->read_fds_copy, manager->read_fds, manager->fd_bufsize); memcpy(manager->write_fds_copy, manager->write_fds, manager->fd_bufsize); maxfd = manager->maxfd + 1; - UNLOCK(&manager->lock); cc = select(maxfd, manager->read_fds_copy, manager->write_fds_copy, NULL, NULL); - if (cc < 0) { - if (!SOFT_ERROR(errno)) { - isc__strerror(errno, strbuf, - sizeof(strbuf)); - FATAL_ERROR(__FILE__, __LINE__, - "select() %s: %s", - isc_msgcat_get(isc_msgcat, - ISC_MSGSET_GENERAL, - ISC_MSG_FAILED, - "failed"), - strbuf); - } +#endif /* USE_KQUEUE */ + + if (cc < 0 && !SOFT_ERROR(errno)) { + isc__strerror(errno, strbuf, sizeof(strbuf)); + FATAL_ERROR(__FILE__, __LINE__, + "%s %s: %s", fnname, + isc_msgcat_get(isc_msgcat, + ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, + "failed"), strbuf); } - LOCK(&manager->lock); +#if defined(USE_DEVPOLL) && defined(ISC_SOCKET_USE_POLLWATCH) + if (cc == 0) { + if (pollstate == poll_active) + pollstate = poll_checking; + else if (pollstate == poll_checking) + pollstate = poll_idle; + } else if (cc > 0) { + if (pollstate == poll_checking) { + /* + * XXX: We'd like to use a more + * verbose log level as it's actually an + * unexpected event, but the kernel bug + * reportedly happens pretty frequently + * (and it can also be a false positive) + * so it would be just too noisy. + */ + manager_log(manager, + ISC_LOGCATEGORY_GENERAL, + ISC_LOGMODULE_SOCKET, + ISC_LOG_DEBUG(1), + "unexpected POLL timeout"); + } + pollstate = poll_active; + } +#endif } while (cc < 0); +#if defined(USE_KQUEUE) || defined (USE_EPOLL) || defined (USE_DEVPOLL) + done = process_fds(manager, manager->events, cc); +#elif defined(USE_SELECT) + process_fds(manager, maxfd, manager->read_fds_copy, + manager->write_fds_copy); /* * Process reads on internal, control fd. */ - if (FD_ISSET(ctlfd, manager->read_fds_copy)) { - for (;;) { - select_readmsg(manager, &fd, &msg); - - manager_log(manager, IOEVENT, - isc_msgcat_get(isc_msgcat, - ISC_MSGSET_SOCKET, - ISC_MSG_WATCHERMSG, - "watcher got message %d"), - msg); - - /* - * Nothing to read? - */ - if (msg == SELECT_POKE_NOTHING) - break; - - /* - * Handle shutdown message. We really should - * jump out of this loop right away, but - * it doesn't matter if we have to do a little - * more work first. - */ - if (msg == SELECT_POKE_SHUTDOWN) { - done = ISC_TRUE; - - break; - } - - /* - * This is a wakeup on a socket. Look - * at the event queue for both read and write, - * and decide if we need to watch on it now - * or not. - */ - wakeup_socket(manager, fd, msg); - } - } - - process_fds(manager, maxfd, manager->read_fds_copy, - manager->write_fds_copy); + if (FD_ISSET(ctlfd, manager->read_fds_copy)) + done = process_ctlfd(manager); +#endif } manager_log(manager, TRACE, isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, ISC_MSG_EXITING, "watcher exiting")); - UNLOCK(&manager->lock); return ((isc_threadresult_t)0); } #endif /* ISC_PLATFORM_USETHREADS */ @@ -2434,69 +3163,208 @@ isc__socketmgr_setreserved(isc_socketmgr_t *manager, isc_uint32_t reserved) { } /* - * Initialize fdsets in socketmgr structure. + * Create a new socket manager. */ + static isc_result_t -create_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) { -#if ISC_SOCKET_FDSETSIZE > FD_SETSIZE - manager->fdsize = ISC_SOCKET_FDSETSIZE; - manager->fd_bufsize = howmany(ISC_SOCKET_FDSETSIZE, NFDBITS) * +setup_watcher(isc_mem_t *mctx, isc_socketmgr_t *manager) { + isc_result_t result; +#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) + char strbuf[ISC_STRERRORSIZE]; +#endif + +#ifdef USE_KQUEUE + manager->nevents = ISC_SOCKET_MAXEVENTS; + manager->events = isc_mem_get(mctx, sizeof(struct kevent) * + manager->nevents); + if (manager->events == NULL) + return (ISC_R_NOMEMORY); + manager->kqueue_fd = kqueue(); + if (manager->kqueue_fd == -1) { + result = isc__errno2result(errno); + isc__strerror(errno, strbuf, sizeof(strbuf)); + UNEXPECTED_ERROR(__FILE__, __LINE__, + "kqueue %s: %s", + isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, "failed"), + strbuf); + isc_mem_put(mctx, manager->events, + sizeof(struct kevent) * manager->nevents); + return (result); + } + +#ifdef ISC_PLATFORM_USETHREADS + result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ); + if (result != ISC_R_SUCCESS) { + close(manager->kqueue_fd); + isc_mem_put(mctx, manager->events, + sizeof(struct kevent) * manager->nevents); + return (result); + } +#endif /* ISC_PLATFORM_USETHREADS */ +#elif defined(USE_EPOLL) + manager->nevents = ISC_SOCKET_MAXEVENTS; + manager->events = isc_mem_get(mctx, sizeof(struct epoll_event) * + manager->nevents); + if (manager->events == NULL) + return (ISC_R_NOMEMORY); + manager->epoll_fd = epoll_create(manager->nevents); + if (manager->epoll_fd == -1) { + result = isc__errno2result(errno); + isc__strerror(errno, strbuf, sizeof(strbuf)); + UNEXPECTED_ERROR(__FILE__, __LINE__, + "epoll_create %s: %s", + isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, "failed"), + strbuf); + isc_mem_put(mctx, manager->events, + sizeof(struct epoll_event) * manager->nevents); + return (result); + } +#ifdef ISC_PLATFORM_USETHREADS + result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ); + if (result != ISC_R_SUCCESS) { + close(manager->epoll_fd); + isc_mem_put(mctx, manager->events, + sizeof(struct epoll_event) * manager->nevents); + return (result); + } +#endif /* ISC_PLATFORM_USETHREADS */ +#elif defined(USE_DEVPOLL) + /* + * XXXJT: /dev/poll seems to reject large numbers of events, + * so we should be careful about redefining ISC_SOCKET_MAXEVENTS. + */ + manager->nevents = ISC_SOCKET_MAXEVENTS; + manager->events = isc_mem_get(mctx, sizeof(struct pollfd) * + manager->nevents); + if (manager->events == NULL) + return (ISC_R_NOMEMORY); + /* + * Note: fdpollinfo should be able to support all possible FDs, so + * it must have maxsocks entries (not nevents). + */ + manager->fdpollinfo = isc_mem_get(mctx, sizeof(pollinfo_t) * + manager->maxsocks); + if (manager->fdpollinfo == NULL) { + isc_mem_put(mctx, manager->events, + sizeof(pollinfo_t) * manager->maxsocks); + return (ISC_R_NOMEMORY); + } + memset(manager->fdpollinfo, 0, sizeof(pollinfo_t) * manager->maxsocks); + manager->devpoll_fd = open("/dev/poll", O_RDWR); + if (manager->devpoll_fd == -1) { + result = isc__errno2result(errno); + isc__strerror(errno, strbuf, sizeof(strbuf)); + UNEXPECTED_ERROR(__FILE__, __LINE__, + "open(/dev/poll) %s: %s", + isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, "failed"), + strbuf); + isc_mem_put(mctx, manager->events, + sizeof(struct pollfd) * manager->nevents); + isc_mem_put(mctx, manager->fdpollinfo, + sizeof(pollinfo_t) * manager->maxsocks); + return (result); + } +#ifdef ISC_PLATFORM_USETHREADS + result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ); + if (result != ISC_R_SUCCESS) { + close(manager->devpoll_fd); + isc_mem_put(mctx, manager->events, + sizeof(struct pollfd) * manager->nevents); + isc_mem_put(mctx, manager->fdpollinfo, + sizeof(pollinfo_t) * manager->maxsocks); + return (result); + } +#endif /* ISC_PLATFORM_USETHREADS */ +#elif defined(USE_SELECT) + UNUSED(result); + +#if ISC_SOCKET_MAXSOCKETS > FD_SETSIZE + /* + * Note: this code should also cover the case of MAXSOCKETS <= + * FD_SETSIZE, but we separate the cases to avoid possible portability + * issues regarding howmany() and the actual representation of fd_set. + */ + manager->fd_bufsize = howmany(manager->maxsocks, NFDBITS) * sizeof(fd_mask); #else - manager->fdsize = FD_SETSIZE; manager->fd_bufsize = sizeof(fd_set); #endif - manager->fds = NULL; - manager->fdstate = NULL; manager->read_fds = NULL; manager->read_fds_copy = NULL; manager->write_fds = NULL; manager->write_fds_copy = NULL; - manager->fds = isc_mem_get(mctx, - manager->fdsize * sizeof(manager->fds[0])); - if (manager->fds == NULL) - goto fail; - - manager->fdstate = isc_mem_get(mctx, manager->fdsize * - sizeof(manager->fdstate[0])); - if (manager->fdstate == NULL) - goto fail; - manager->read_fds = isc_mem_get(mctx, manager->fd_bufsize); - if (manager->read_fds == NULL) - goto fail; - manager->read_fds_copy = isc_mem_get(mctx, manager->fd_bufsize); - if (manager->read_fds_copy == NULL) - goto fail; - manager->write_fds = isc_mem_get(mctx, manager->fd_bufsize); - if (manager->write_fds == NULL) - goto fail; - manager->write_fds_copy = isc_mem_get(mctx, manager->fd_bufsize); - if (manager->write_fds_copy == NULL) - goto fail; + if (manager->read_fds != NULL) + manager->read_fds_copy = isc_mem_get(mctx, manager->fd_bufsize); + if (manager->read_fds_copy != NULL) + manager->write_fds = isc_mem_get(mctx, manager->fd_bufsize); + if (manager->write_fds != NULL) { + manager->write_fds_copy = isc_mem_get(mctx, + manager->fd_bufsize); + } + if (manager->write_fds_copy == NULL) { + if (manager->write_fds != NULL) { + isc_mem_put(mctx, manager->write_fds, + manager->fd_bufsize); + } + if (manager->read_fds_copy != NULL) { + isc_mem_put(mctx, manager->read_fds_copy, + manager->fd_bufsize); + } + if (manager->read_fds != NULL) { + isc_mem_put(mctx, manager->read_fds, + manager->fd_bufsize); + } + return (ISC_R_NOMEMORY); + } + memset(manager->read_fds, 0, manager->fd_bufsize); + memset(manager->write_fds, 0, manager->fd_bufsize); - return (ISC_R_SUCCESS); +#ifdef ISC_PLATFORM_USETHREADS + (void)watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ); + manager->maxfd = manager->pipe_fds[0]; +#else /* ISC_PLATFORM_USETHREADS */ + manager->maxfd = 0; +#endif /* ISC_PLATFORM_USETHREADS */ +#endif /* USE_KQUEUE */ - fail: - cleanup_fdsets(manager, mctx); - return (ISC_R_NOMEMORY); + return (ISC_R_SUCCESS); } -/* - * Clean up fdsets in socketmgr structure. - */ static void -cleanup_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) { - if (manager->fds != NULL) { - isc_mem_put(mctx, manager->fds, - manager->fdsize * sizeof(manager->fds[0])); - } - if (manager->fdstate != NULL) { - isc_mem_put(mctx, manager->fdstate, - manager->fdsize * sizeof(manager->fdstate[0])); +cleanup_watcher(isc_mem_t *mctx, isc_socketmgr_t *manager) { +#ifdef ISC_PLATFORM_USETHREADS + isc_result_t result; + + result = unwatch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ); + if (result != ISC_R_SUCCESS) { + UNEXPECTED_ERROR(__FILE__, __LINE__, + "epoll_ctl(DEL) %s", + isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, "failed")); } +#endif /* ISC_PLATFORM_USETHREADS */ + +#ifdef USE_KQUEUE + close(manager->kqueue_fd); + isc_mem_put(mctx, manager->events, + sizeof(struct kevent) * manager->nevents); +#elif defined(USE_EPOLL) + close(manager->epoll_fd); + isc_mem_put(mctx, manager->events, + sizeof(struct epoll_event) * manager->nevents); +#elif defined(USE_DEVPOLL) + close(manager->devpoll_fd); + isc_mem_put(mctx, manager->events, + sizeof(struct pollfd) * manager->nevents); + isc_mem_put(mctx, manager->fdpollinfo, + sizeof(pollinfo_t) * manager->maxsocks); +#elif defined(USE_SELECT) if (manager->read_fds != NULL) isc_mem_put(mctx, manager->read_fds, manager->fd_bufsize); if (manager->read_fds_copy != NULL) @@ -2505,13 +3373,19 @@ cleanup_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) { isc_mem_put(mctx, manager->write_fds, manager->fd_bufsize); if (manager->write_fds_copy != NULL) isc_mem_put(mctx, manager->write_fds_copy, manager->fd_bufsize); +#endif /* USE_KQUEUE */ } -/* - * Create a new socket manager. - */ isc_result_t isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) { + return (isc_socketmgr_create2(mctx, managerp, 0)); +} + +isc_result_t +isc_socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp, + unsigned int maxsocks) +{ + int i; isc_socketmgr_t *manager; #ifdef ISC_PLATFORM_USETHREADS char strbuf[ISC_STRERRORSIZE]; @@ -2522,46 +3396,71 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) { #ifndef ISC_PLATFORM_USETHREADS if (socketmgr != NULL) { + /* Don't allow maxsocks to be updated */ + if (maxsocks > 0 && socketmgr->maxsocks != maxsocks) + return (ISC_R_EXISTS); + socketmgr->refs++; *managerp = socketmgr; return (ISC_R_SUCCESS); } #endif /* ISC_PLATFORM_USETHREADS */ + if (maxsocks == 0) + maxsocks = ISC_SOCKET_MAXSOCKETS; + manager = isc_mem_get(mctx, sizeof(*manager)); if (manager == NULL) return (ISC_R_NOMEMORY); - result = create_fdsets(manager, mctx); - if (result != ISC_R_SUCCESS) { - cleanup_fdsets(manager, mctx); - isc_mem_put(mctx, manager, sizeof(*manager)); - return (result); + /* zero-clear so that necessary cleanup on failure will be easy */ + memset(manager, 0, sizeof(*manager)); + manager->maxsocks = maxsocks; + manager->reserved = 0; + manager->fds = isc_mem_get(mctx, + manager->maxsocks * sizeof(isc_socket_t *)); + if (manager->fds == NULL) { + result = ISC_R_NOMEMORY; + goto free_manager; + } + manager->fdstate = isc_mem_get(mctx, manager->maxsocks * sizeof(int)); + if (manager->fds == NULL) { + result = ISC_R_NOMEMORY; + goto free_manager; } manager->magic = SOCKET_MANAGER_MAGIC; manager->mctx = NULL; + memset(manager->fds, 0, manager->maxsocks * sizeof(isc_socket_t *)); ISC_LIST_INIT(manager->socklist); - result = isc_mutex_init(&manager->lock); - if (result != ISC_R_SUCCESS) { - cleanup_fdsets(manager, mctx); - isc_mem_put(mctx, manager, sizeof(*manager)); - UNEXPECTED_ERROR(__FILE__, __LINE__, - "isc_mutex_init() %s", - isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, - ISC_MSG_FAILED, "failed")); - return (ISC_R_UNEXPECTED); + result = isc_mutex_init(&manager->lock); + if (result != ISC_R_SUCCESS) + goto free_manager; + manager->fdlock = isc_mem_get(mctx, FDLOCK_COUNT * sizeof(isc_mutex_t)); + if (manager->fdlock == NULL) { + result = ISC_R_NOMEMORY; + goto cleanup_lock; } + for (i = 0; i < FDLOCK_COUNT; i++) { + result = isc_mutex_init(&manager->fdlock[i]); + if (result != ISC_R_SUCCESS) { + while (--i >= 0) + DESTROYLOCK(&manager->fdlock[i]); + isc_mem_put(mctx, manager->fdlock, + FDLOCK_COUNT * sizeof(isc_mutex_t)); + manager->fdlock = NULL; + goto cleanup_lock; + } + } + #ifdef ISC_PLATFORM_USETHREADS if (isc_condition_init(&manager->shutdown_ok) != ISC_R_SUCCESS) { - cleanup_fdsets(manager, mctx); - DESTROYLOCK(&manager->lock); - isc_mem_put(mctx, manager, sizeof(*manager)); UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_condition_init() %s", isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, ISC_MSG_FAILED, "failed")); - return (ISC_R_UNEXPECTED); + result = ISC_R_UNEXPECTED; + goto cleanup_lock; } /* @@ -2569,17 +3468,14 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) { * select/poll loop when something internal needs to be done. */ if (pipe(manager->pipe_fds) != 0) { - cleanup_fdsets(manager, mctx); - DESTROYLOCK(&manager->lock); - isc_mem_put(mctx, manager, sizeof(*manager)); isc__strerror(errno, strbuf, sizeof(strbuf)); UNEXPECTED_ERROR(__FILE__, __LINE__, "pipe() %s: %s", isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, ISC_MSG_FAILED, "failed"), strbuf); - - return (ISC_R_UNEXPECTED); + result = ISC_R_UNEXPECTED; + goto cleanup_condition; } RUNTIME_CHECK(make_nonblock(manager->pipe_fds[0]) == ISC_R_SUCCESS); @@ -2593,33 +3489,23 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) { /* * Set up initial state for the select loop */ - memset(manager->read_fds, 0, manager->fd_bufsize); - memset(manager->write_fds, 0, manager->fd_bufsize); -#ifdef ISC_PLATFORM_USETHREADS - FD_SET(manager->pipe_fds[0], manager->read_fds); - manager->maxfd = manager->pipe_fds[0]; -#else /* ISC_PLATFORM_USETHREADS */ - manager->maxfd = 0; -#endif /* ISC_PLATFORM_USETHREADS */ - manager->reserved = 0; - memset(manager->fdstate, 0, - manager->fdsize * sizeof(manager->fdstate[0])); - + result = setup_watcher(mctx, manager); + if (result != ISC_R_SUCCESS) + goto cleanup; + memset(manager->fdstate, 0, manager->maxsocks * sizeof(int)); #ifdef ISC_PLATFORM_USETHREADS /* * Start up the select/poll thread. */ if (isc_thread_create(watcher, manager, &manager->watcher) != ISC_R_SUCCESS) { - (void)close(manager->pipe_fds[0]); - (void)close(manager->pipe_fds[1]); - DESTROYLOCK(&manager->lock); - isc_mem_put(mctx, manager, sizeof(*manager)); UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_thread_create() %s", isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL, ISC_MSG_FAILED, "failed")); - return (ISC_R_UNEXPECTED); + cleanup_watcher(mctx, manager); + result = ISC_R_UNEXPECTED; + goto cleanup; } #endif /* ISC_PLATFORM_USETHREADS */ isc_mem_attach(mctx, &manager->mctx); @@ -2630,6 +3516,52 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) { *managerp = manager; return (ISC_R_SUCCESS); + +cleanup: +#ifdef ISC_PLATFORM_USETHREADS + (void)close(manager->pipe_fds[0]); + (void)close(manager->pipe_fds[1]); +#endif /* ISC_PLATFORM_USETHREADS */ + +#ifdef ISC_PLATFORM_USETHREADS +cleanup_condition: + (void)isc_condition_destroy(&manager->shutdown_ok); +#endif /* ISC_PLATFORM_USETHREADS */ + + +cleanup_lock: + if (manager->fdlock != NULL) { + for (i = 0; i < FDLOCK_COUNT; i++) + DESTROYLOCK(&manager->fdlock[i]); + } + DESTROYLOCK(&manager->lock); + +free_manager: + if (manager->fdlock != NULL) { + isc_mem_put(mctx, manager->fdlock, + FDLOCK_COUNT * sizeof(isc_mutex_t)); + } + if (manager->fdstate != NULL) { + isc_mem_put(mctx, manager->fdstate, + manager->maxsocks * sizeof(int)); + } + if (manager->fds != NULL) { + isc_mem_put(mctx, manager->fds, + manager->maxsocks * sizeof(isc_socket_t *)); + } + isc_mem_put(mctx, manager, sizeof(*manager)); + + return (result); +} + +isc_result_t +isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp) { + REQUIRE(VALID_MANAGER(manager)); + REQUIRE(nsockp != NULL); + + *nsockp = manager->maxsocks; + + return (ISC_R_SUCCESS); } void @@ -2703,18 +3635,30 @@ isc_socketmgr_destroy(isc_socketmgr_t **managerp) { /* * Clean up. */ + cleanup_watcher(manager->mctx, manager); + #ifdef ISC_PLATFORM_USETHREADS (void)close(manager->pipe_fds[0]); (void)close(manager->pipe_fds[1]); (void)isc_condition_destroy(&manager->shutdown_ok); #endif /* ISC_PLATFORM_USETHREADS */ - for (i = 0; i < (int)manager->fdsize; i++) - if (manager->fdstate[i] == CLOSE_PENDING) + for (i = 0; i < (int)manager->maxsocks; i++) + if (manager->fdstate[i] == CLOSE_PENDING) /* no need to lock */ (void)close(i); + isc_mem_put(manager->mctx, manager->fds, + manager->maxsocks * sizeof(isc_socket_t *)); + isc_mem_put(manager->mctx, manager->fdstate, + manager->maxsocks * sizeof(int)); + + if (manager->fdlock != NULL) { + for (i = 0; i < FDLOCK_COUNT; i++) + DESTROYLOCK(&manager->fdlock[i]); + isc_mem_put(manager->mctx, manager->fdlock, + FDLOCK_COUNT * sizeof(isc_mutex_t)); + } DESTROYLOCK(&manager->lock); - cleanup_fdsets(manager, manager->mctx); manager->magic = 0; mctx= manager->mctx; isc_mem_put(mctx, manager, sizeof(*manager)); @@ -2767,7 +3711,7 @@ socket_recv(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task, * Enqueue the request. If the socket was previously not being * watched, poke the watcher to start paying attention to it. */ - if (ISC_LIST_EMPTY(sock->recv_list)) + if (ISC_LIST_EMPTY(sock->recv_list) && !sock->pending_recv) select_poke(sock->manager, sock->fd, SELECT_POKE_READ); ISC_LIST_ENQUEUE(sock->recv_list, dev, ev_link); @@ -2964,7 +3908,8 @@ socket_send(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task, * not being watched, poke the watcher to start * paying attention to it. */ - if (ISC_LIST_EMPTY(sock->send_list)) + if (ISC_LIST_EMPTY(sock->send_list) && + !sock->pending_send) select_poke(sock->manager, sock->fd, SELECT_POKE_WRITE); ISC_LIST_ENQUEUE(sock->send_list, dev, ev_link); @@ -3222,7 +4167,7 @@ isc_socket_listen(isc_socket_t *sock, unsigned int backlog) { } /* - * This should try to do agressive accept() XXXMLG + * This should try to do aggressive accept() XXXMLG */ isc_result_t isc_socket_accept(isc_socket_t *sock, @@ -3333,6 +4278,16 @@ isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr, sock->address = *addr; cc = connect(sock->fd, &addr->type.sa, addr->length); if (cc < 0) { + /* + * HP-UX "fails" to connect a UDP socket and sets errno to + * EINPROGRESS if it's non-blocking. We'd rather regard this as + * a success and let the user detect it if it's really an error + * at the time of sending a packet on the socket. + */ + if (sock->type == isc_sockettype_udp && errno == EINPROGRESS) { + cc = 0; + goto success; + } if (SOFT_ERROR(errno) || errno == EINPROGRESS) goto queue; @@ -3374,6 +4329,7 @@ isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr, /* * If connect completed, fire off the done event. */ + success: if (cc == 0) { sock->connected = 1; sock->bound = 1; @@ -3733,37 +4689,107 @@ isc_socket_ipv6only(isc_socket_t *sock, isc_boolean_t yes) { #ifdef IPV6_V6ONLY if (sock->pf == AF_INET6) { - (void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY, - (void *)&onoff, sizeof(onoff)); + if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY, + (void *)&onoff, sizeof(int)) < 0) { + char strbuf[ISC_STRERRORSIZE]; + + UNEXPECTED_ERROR(__FILE__, __LINE__, + "setsockopt(%d, IPV6_V6ONLY) " + "%s: %s", sock->fd, + isc_msgcat_get(isc_msgcat, + ISC_MSGSET_GENERAL, + ISC_MSG_FAILED, + "failed"), + strbuf); + } } + FIX_IPV6_RECVPKTINFO(sock); /* AIX */ #endif } #ifndef ISC_PLATFORM_USETHREADS -void -isc__socketmgr_getfdsets(fd_set **readset, fd_set **writeset, int *maxfd) { +/* In our assumed scenario, we can simply use a single static object. */ +static isc_socketwait_t swait_private; + +int +isc__socketmgr_waitevents(struct timeval *tvp, isc_socketwait_t **swaitp) { + int n; +#ifdef USE_KQUEUE + struct timespec ts, *tsp; +#endif +#ifdef USE_EPOLL + int timeout; +#endif +#ifdef USE_DEVPOLL + struct dvpoll dvp; +#endif + + REQUIRE(swaitp != NULL && *swaitp == NULL); + if (socketmgr == NULL) - *maxfd = 0; - else { - /* Prepare duplicates of fd_sets, as select() will modify */ - memcpy(socketmgr->read_fds_copy, socketmgr->read_fds, - socketmgr->fd_bufsize); - memcpy(socketmgr->write_fds_copy, socketmgr->write_fds, - socketmgr->fd_bufsize); - *readset = socketmgr->read_fds_copy; - *writeset = socketmgr->write_fds_copy; - *maxfd = socketmgr->maxfd + 1; - } + return (0); + +#ifdef USE_KQUEUE + if (tvp != NULL) { + ts.tv_sec = tvp->tv_sec; + ts.tv_nsec = tvp->tv_usec * 1000; + tsp = &ts; + } else + tsp = NULL; + swait_private.nevents = kevent(socketmgr->kqueue_fd, NULL, 0, + socketmgr->events, socketmgr->nevents, + tsp); + n = swait_private.nevents; +#elif defined(USE_EPOLL) + if (tvp != NULL) + timeout = tvp->tv_sec * 1000 + (tvp->tv_usec + 999) / 1000; + else + timeout = -1; + swait_private.nevents = epoll_wait(socketmgr->epoll_fd, + socketmgr->events, + socketmgr->nevents, timeout); + n = swait_private.nevents; +#elif defined(USE_DEVPOLL) + dvp.dp_fds = socketmgr->events; + dvp.dp_nfds = socketmgr->nevents; + if (tvp != NULL) { + dvp.dp_timeout = tvp->tv_sec * 1000 + + (tvp->tv_usec + 999) / 1000; + } else + dvp.dp_timeout = -1; + swait_private.nevents = ioctl(socketmgr->devpoll_fd, DP_POLL, &dvp); + n = swait_private.nevents; +#elif defined(USE_SELECT) + memcpy(socketmgr->read_fds_copy, socketmgr->read_fds, + socketmgr->fd_bufsize); + memcpy(socketmgr->write_fds_copy, socketmgr->write_fds, + socketmgr->fd_bufsize); + + swait_private.readset = socketmgr->read_fds_copy; + swait_private.writeset = socketmgr->write_fds_copy; + swait_private.maxfd = socketmgr->maxfd + 1; + + n = select(swait_private.maxfd, swait_private.readset, + swait_private.writeset, NULL, tvp); +#endif + + *swaitp = &swait_private; + return (n); } isc_result_t -isc__socketmgr_dispatch(fd_set *readset, fd_set *writeset, int maxfd) { - isc_socketmgr_t *manager = socketmgr; +isc__socketmgr_dispatch(isc_socketwait_t *swait) { + REQUIRE(swait == &swait_private); - if (manager == NULL) + if (socketmgr == NULL) return (ISC_R_NOTFOUND); - process_fds(manager, maxfd, readset, writeset); +#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) + (void)process_fds(socketmgr, socketmgr->events, swait->nevents); return (ISC_R_SUCCESS); +#elif defined(USE_SELECT) + process_fds(socketmgr, swait->maxfd, swait->readset, swait->writeset); + return (ISC_R_SUCCESS); +#endif } #endif /* ISC_PLATFORM_USETHREADS */ diff --git a/lib/isc/unix/socket_p.h b/lib/isc/unix/socket_p.h index 07720eef656c..5786facad9c8 100644 --- a/lib/isc/unix/socket_p.h +++ b/lib/isc/unix/socket_p.h @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: socket_p.h,v 1.6.206.1.34.1 2008/07/29 04:43:57 each Exp $ */ +/* $Id: socket_p.h,v 1.6.206.3 2008/06/25 23:45:37 tbox Exp $ */ #ifndef ISC_SOCKET_P_H #define ISC_SOCKET_P_H @@ -24,10 +24,7 @@ #include <sys/select.h> #endif -void -isc__socketmgr_getfdsets(fd_set **readset, fd_set **writeset, int *maxfd); - -isc_result_t -isc__socketmgr_dispatch(fd_set *readset, fd_set *writeset, int maxfd); - +typedef struct isc_socketwait isc_socketwait_t; +int isc__socketmgr_waitevents(struct timeval *, isc_socketwait_t **); +isc_result_t isc__socketmgr_dispatch(isc_socketwait_t *); #endif /* ISC_SOCKET_P_H */ diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c index 39c851cebe9a..c4b7f13600eb 100644 --- a/lib/isc/unix/time.c +++ b/lib/isc/unix/time.c @@ -1,8 +1,8 @@ /* - * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001, 2003 Internet Software Consortium. * - * Permission to use, copy, modify, and distribute this software for any + * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: time.c,v 1.34.2.6.2.4 2004/03/06 08:15:03 marka Exp $ */ +/* $Id: time.c,v 1.34.2.6.2.6 2008/04/28 23:45:41 tbox Exp $ */ #include <config.h> @@ -225,7 +225,7 @@ isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) { t->seconds = tv.tv_sec + i->seconds; t->nanoseconds = tv.tv_usec * NS_PER_US + i->nanoseconds; - if (t->nanoseconds > NS_PER_S) { + if (t->nanoseconds >= NS_PER_S) { t->seconds++; t->nanoseconds -= NS_PER_S; } @@ -408,5 +408,5 @@ isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len) { snprintf(buf + flen, len - flen, ".%03u", t->nanoseconds / 1000000); else - snprintf(buf, len, "99-Bad-9999 99:99:99.999"); + snprintf(buf, len, "99-Bad-9999 99:99:99.999"); } diff --git a/lib/isccfg/api b/lib/isccfg/api index 808217d1f364..364ea9d2a3bc 100644 --- a/lib/isccfg/api +++ b/lib/isccfg/api @@ -1,3 +1,3 @@ LIBINTERFACE = 1 -LIBREVISION = 9 +LIBREVISION = 10 LIBAGE = 0 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index 622d76aef790..65b4e4e57e72 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: namedconf.c,v 1.21.44.36.2.1 2008/07/23 12:03:53 marka Exp $ */ +/* $Id: namedconf.c,v 1.21.44.40 2008/09/04 08:11:25 marka Exp $ */ #include <config.h> @@ -513,30 +513,80 @@ static cfg_type_t cfg_type_serverid = { /* * Port list. */ +static cfg_tuplefielddef_t porttuple_fields[] = { + { "loport", &cfg_type_uint32, 0 }, + { "hiport", &cfg_type_uint32, 0 }, + { NULL, NULL, 0 } +}; +static cfg_type_t cfg_type_porttuple = { + "porttuple", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, + &cfg_rep_tuple, porttuple_fields +}; + static isc_result_t -parse_port(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { +parse_port(cfg_parser_t *pctx, cfg_obj_t **ret) { isc_result_t result; - UNUSED(type); - CHECK(cfg_parse_uint32(pctx, NULL, ret)); if ((*ret)->value.uint32 > 0xffff) { cfg_parser_error(pctx, CFG_LOG_NEAR, "invalid port"); cfg_obj_destroy(pctx, ret); result = ISC_R_RANGE; } + + cleanup: + return (result); +} + +static isc_result_t +parse_portrange(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { + isc_result_t result; + cfg_obj_t *obj = NULL; + + UNUSED(type); + + CHECK(cfg_peektoken(pctx, ISC_LEXOPT_NUMBER | ISC_LEXOPT_CNUMBER)); + if (pctx->token.type == isc_tokentype_number) + CHECK(parse_port(pctx, ret)); + else { + CHECK(cfg_gettoken(pctx, 0)); + if (pctx->token.type != isc_tokentype_string || + strcasecmp(TOKEN_STRING(pctx), "range") != 0) { + cfg_parser_error(pctx, CFG_LOG_NEAR, + "expected integer or 'range'"); + return (ISC_R_UNEXPECTEDTOKEN); + } + CHECK(cfg_create_tuple(pctx, &cfg_type_porttuple, &obj)); + CHECK(parse_port(pctx, &obj->value.tuple[0])); + CHECK(parse_port(pctx, &obj->value.tuple[1])); + if (obj->value.tuple[0]->value.uint32 > + obj->value.tuple[1]->value.uint32) { + cfg_parser_error(pctx, CFG_LOG_NOPREP, + "low port '%u' must not be larger " + "than high port", + obj->value.tuple[0]->value.uint32); + result = ISC_R_RANGE; + goto cleanup; + } + *ret = obj; + obj = NULL; + } + cleanup: + if (obj != NULL) + cfg_obj_destroy(pctx, &obj); return (result); } -static cfg_type_t cfg_type_port = { - "port", parse_port, NULL, cfg_doc_terminal, +static cfg_type_t cfg_type_portrange = { + "portrange", parse_portrange, NULL, cfg_doc_terminal, NULL, NULL }; static cfg_type_t cfg_type_bracketed_portlist = { - "bracketed_sockaddrlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list, - &cfg_rep_list, &cfg_type_port + "bracketed_sockaddrlist", cfg_parse_bracketed_list, + cfg_print_bracketed_list, cfg_doc_bracketed_list, + &cfg_rep_list, &cfg_type_portrange }; /* @@ -573,6 +623,8 @@ namedconf_or_view_clauses[] = { */ static cfg_clausedef_t options_clauses[] = { + { "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 }, + { "use-v6-udp-ports", &cfg_type_bracketed_portlist, 0 }, { "avoid-v4-udp-ports", &cfg_type_bracketed_portlist, 0 }, { "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 }, { "blackhole", &cfg_type_bracketed_aml, 0 }, @@ -1565,6 +1617,7 @@ static isc_result_t parse_logversions(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_uint32, ret)); } + static cfg_type_t cfg_type_logversions = { "logversions", parse_logversions, cfg_print_ustring, cfg_doc_terminal, &cfg_rep_string, logversions_enums @@ -1638,8 +1691,19 @@ print_logfile(cfg_printer_t *pctx, const cfg_obj_t *obj) { } } + +static void +doc_logfile(cfg_printer_t *pctx, const cfg_type_t *type) { + UNUSED(type); + cfg_print_cstr(pctx, "<quoted_string>"); + cfg_print_chars(pctx, " ", 1); + cfg_print_cstr(pctx, "[ versions ( \"unlimited\" | <integer> ) ]"); + cfg_print_chars(pctx, " ", 1); + cfg_print_cstr(pctx, "[ size <size> ]"); +} + static cfg_type_t cfg_type_logfile = { - "log_file", parse_logfile, print_logfile, cfg_doc_terminal, + "log_file", parse_logfile, print_logfile, doc_logfile, &cfg_rep_tuple, logfile_fields }; @@ -1671,8 +1735,8 @@ static cfg_type_t cfg_type_lwres_view = { }; static cfg_type_t cfg_type_lwres_searchlist = { - "lwres_searchlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list, - &cfg_rep_list, &cfg_type_astring }; + "lwres_searchlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, + cfg_doc_bracketed_list, &cfg_rep_list, &cfg_type_astring }; static cfg_clausedef_t lwres_clauses[] = { @@ -1784,15 +1848,15 @@ doc_sockaddrnameport(cfg_printer_t *pctx, const cfg_type_t *type) { cfg_print_chars(pctx, "( ", 2); cfg_print_cstr(pctx, "<quoted_string>"); cfg_print_chars(pctx, " ", 1); - cfg_print_cstr(pctx, "[port <integer>]"); + cfg_print_cstr(pctx, "[ port <integer> ]"); cfg_print_chars(pctx, " | ", 3); cfg_print_cstr(pctx, "<ipv4_address>"); cfg_print_chars(pctx, " ", 1); - cfg_print_cstr(pctx, "[port <integer>]"); + cfg_print_cstr(pctx, "[ port <integer> ]"); cfg_print_chars(pctx, " | ", 3); cfg_print_cstr(pctx, "<ipv6_address>"); cfg_print_chars(pctx, " ", 1); - cfg_print_cstr(pctx, "[port <integer>]"); + cfg_print_cstr(pctx, "[ port <integer> ]"); cfg_print_chars(pctx, " )", 2); } @@ -1870,11 +1934,11 @@ doc_masterselement(cfg_printer_t *pctx, const cfg_type_t *type) { cfg_print_chars(pctx, " | ", 3); cfg_print_cstr(pctx, "<ipv4_address>"); cfg_print_chars(pctx, " ", 1); - cfg_print_cstr(pctx, "[port <integer>]"); + cfg_print_cstr(pctx, "[ port <integer> ]"); cfg_print_chars(pctx, " | ", 3); cfg_print_cstr(pctx, "<ipv6_address>"); cfg_print_chars(pctx, " ", 1); - cfg_print_cstr(pctx, "[port <integer>]"); + cfg_print_cstr(pctx, "[ port <integer> ]"); cfg_print_chars(pctx, " )", 2); } @@ -1,10 +1,10 @@ -# $Id: version,v 1.26.2.17.2.31.4.2 2008/07/29 05:03:50 each Exp $ +# $Id: version,v 1.26.2.17.2.35 2008/12/24 00:21:45 marka Exp $ # # This file must follow /bin/sh rules. It is imported directly via # configure. # MAJORVER=9 MINORVER=3 -PATCHVER=5 +PATCHVER=6 RELEASETYPE=-P -RELEASEVER=2 +RELEASEVER=1 |